# AI use cases for Awesome Reverse Engineering (morluto/awesome-reverse-engineering) Repo: [morluto/awesome-reverse-engineering](https://github.com/morluto/awesome-reverse-engineering) | Use cases: 5 | Page: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/ A curated list of reverse-engineering tools and learning resources for binaries, apps, firmware, file formats, and protocols. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Learn assembly and reversing basics for free: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/learn-assembly-and-reversing-basics/ - Triage an unknown executable to see what it can do: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/triage-unknown-windows-executable/ - Trace calls in a running program with Frida: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/trace-running-program-with-frida/ - Run a suspicious sample in an automated sandbox: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/detonate-suspicious-sample-in-sandbox/ - Map IPC channels and preload bridges in an Electron app: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/triage-electron-app-ipc-and-bridges/ ## How to learn assembly and reversing basics for free with Awesome Reverse Engineering Repo: [morluto/awesome-reverse-engineering](https://github.com/morluto/awesome-reverse-engineering) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README Pick free courses and browser tools to start reading compiled code and assembly. **Who it is for:** A new student or developer who wants to understand how compiled programs work and has no prior reversing experience. **The problem:** Reverse engineering assumes knowledge of assembly, memory layout, and calling conventions, which beginners rarely have. **The outcome:** A short starter path that combines a browser-based compiler view with one structured course. ### Steps 1. Open Compiler Explorer at https://godbolt.org/ and compile a small C function to see its assembly output. 2. Read the ARM assembly tutorials at https://azeria-labs.com/writing-arm-assembly-part-1/ and do the exercises for registers and memory. 3. Look at the visual format posters from Corkami at https://github.com/corkami/pics to see how executable files are laid out. 4. Choose one structured course such as pwn.college at https://pwn.college/ or OpenSecurityTraining2 at https://ost2.fyi/ and work through its first module. ### Prompt to paste into your agent ```text Using the awesome-reverse-engineering list in the morluto/awesome-reverse-engineering repo, pick one beginner resource from its Learning section and suggest a 3-step study plan for a learner who knows basic C. Expected output: a numbered plan with one link per step. Verify that every link appears in the Learning section of the README. ``` ### Caveat The RPISEC course has had no commits since December 2021, so its labs may need older toolchains. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/learn-assembly-and-reversing-basics/ ## How to triage an unknown executable to see what it can do with Awesome Reverse Engineering Repo: [morluto/awesome-reverse-engineering](https://github.com/morluto/awesome-reverse-engineering) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Combine capability, format, and string tools for a first look at a binary. **Who it is for:** A security analyst who has received an unfamiliar Windows or Linux executable and needs a quick assessment before deeper work. **The problem:** Opening an unknown binary in a full disassembler takes time, and the first question is usually what the file is and what it does. **The outcome:** A short list of identified file traits, suspicious imports or strings, and likely capabilities. ### Steps 1. Identify the file type, compiler, and packer with Detect It Easy at https://github.com/horsicq/Detect-It-Easy. 2. Open the headers, sections, and imports in PE-bear at https://github.com/hasherezade/pe-bear for a first look. 3. Recover obfuscated strings with FLOSS at https://github.com/mandiant/flare-floss. 4. Run capa at https://github.com/mandiant/capa to list the capabilities its rules detect. 5. For ELF files, check mitigation flags with checksec at https://github.com/slimm609/checksec and treat them as context, not a verdict. ### Prompt to paste into your agent ```text Using the morluto/awesome-reverse-engineering list, select the triage tools from its File identification and triage section that fit a Windows PE file. Run or describe the steps for and report the file type, notable imports, and capabilities. Verify that the report states that checksec flags are not a vulnerability verdict if you include ELF checks. ``` ### Caveat The list does not give install commands for these tools, so you must follow each project's own setup instructions. Risk, reverse engineering: Handle the unknown executable in an isolated environment because it may be malicious. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/triage-unknown-windows-executable/ ## How to trace calls in a running program with Frida with Awesome Reverse Engineering Repo: [morluto/awesome-reverse-engineering](https://github.com/morluto/awesome-reverse-engineering) | Difficulty: Advanced | Time: 1 hour | Basis: From the README Inject scripts into a process you are authorized to test to observe its behavior. **Who it is for:** A reverse engineer or app tester who needs to see which functions a running program calls and what data they receive. **The problem:** Static reading shows code paths but not the values used at runtime. **The outcome:** A log of selected function calls and their data from a live process. ### Steps 1. Read the Frida entry in the Dynamic instrumentation and tracing section at https://github.com/frida/frida. 2. Install Frida by following the project's own setup instructions. 3. Choose a process you are allowed to test and note the function names you want to observe. 4. Write a small script that hooks those functions and logs their arguments. 5. Run the script against the process and confirm that the logged calls match the program's visible behavior. ### Prompt to paste into your agent ```text Using the morluto/awesome-reverse-engineering list, confirm that Frida is listed under Dynamic instrumentation and tracing, then outline a Frida hook plan for the process . Expected output: a short plan listing the functions to hook and what to log. Verify that the plan only targets a process the user is authorized to test. ``` ### Caveat The README describes Frida only in one line, so you will need the project's own documentation for hooking syntax. Risk, reverse engineering: Only inject into processes you own or are authorized to test, since injection can change program behavior. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/trace-running-program-with-frida/ ## How to run a suspicious sample in an automated sandbox with Awesome Reverse Engineering Repo: [morluto/awesome-reverse-engineering](https://github.com/morluto/awesome-reverse-engineering) | Difficulty: Advanced | Time: 2 hours | Basis: From the README Use CAPE Sandbox to record behavior and payloads from a malware sample. **Who it is for:** A malware analyst at a team with an isolated lab who needs to see what a sample does without running it on a workstation. **The problem:** Manual detonation is slow and easy to get wrong, and it can expose the analyst's machine. **The outcome:** A behavior report with recorded actions, unpacked payloads, and any malware configuration the sandbox extracts. ### Steps 1. Read the malware analysis warning in the list: run samples only in isolated, disposable environments. 2. Prepare a Windows virtual machine, optionally with FLARE-VM from https://github.com/mandiant/flare-vm. 3. Set up CAPE Sandbox from https://github.com/kevoreilly/CAPEv2 following its own documentation. 4. Submit the sample to the sandbox and wait for the run to finish. 5. Review the recorded behavior, unpacked payloads, and configuration output for the report. ### Prompt to paste into your agent ```text Using the morluto/awesome-reverse-engineering list, outline a sandbox workflow for that uses only tools in its Malware analysis section. Expected output: a checklist covering isolation, submission, and report review. Verify that the checklist starts with an isolated virtual machine requirement. ``` ### Caveat The list says Malduck does not ship family extractors, so you should expect to write or find your own configuration extractors. Risk, reverse engineering: Run the sample only inside an isolated, disposable virtual machine that cannot reach your production network. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/detonate-suspicious-sample-in-sandbox/ ## How to map IPC channels and preload bridges in an Electron app with Awesome Reverse Engineering Repo: [morluto/awesome-reverse-engineering](https://github.com/morluto/awesome-reverse-engineering) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Use hexvero to scan an Electron archive for IPC channels and window settings. **Who it is for:** A security reviewer who needs to understand how a desktop Electron app talks between its renderer and main process. **The problem:** Electron apps hide their inter-process messaging in large JavaScript bundles that are hard to review by hand. **The outcome:** A list of IPC channels, preload bridges, and window settings found in the archive. ### Steps 1. Read the hexvero entry in the File identification and triage section at https://github.com/maximilianfeix/hexvero. 2. Install Node.js 22.12 or later, as the README requires. 3. Install hexvero by following its own repository instructions. 4. Point the CLI at the Electron archive you are reviewing. 5. Check the output against the JavaScript code, since the README warns that pattern-based analysis can miss indirect code. ### Prompt to paste into your agent ```text Using the morluto/awesome-reverse-engineering list, summarize what hexvero reports for and list the IPC channels and preload bridges it finds. Expected output: a table of channels with their source files. Verify that the report notes the limitation about indirect code. ``` ### Caveat The README says pattern-based JavaScript analysis can miss indirect code, so results are a starting point, not a complete map. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/morluto-awesome-reverse-engineering/triage-electron-app-ipc-and-bridges/