# Ctf Reverse

Provides reverse engineering techniques for CTF challenges.

- Repository: https://github.com/ljagiello/ctf-skills (3598 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add ljagiello/ctf-skills --skill ctf-reverse -g -a claude-code -y`
Codex: `npx skills add ljagiello/ctf-skills --skill ctf-reverse -g -a codex -y`
Cursor: `npx skills add ljagiello/ctf-skills --skill ctf-reverse -g -a cursor -y`
Gemini CLI: `npx skills add ljagiello/ctf-skills --skill ctf-reverse -g -a gemini-cli -y`

## Description

Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CTF Reverse Engineering

Quick reference for RE challenges. For detailed techniques, see supporting files.

## Prerequisites

**Python packages (all platforms):**
```bash
pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver
# For Python 3.9+ bytecode: build pycdc from source
git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make
```

**Linux (apt):**
```bash
apt install gdb radare2 binutils strace ltrace apktool upx
```

**macOS (Homebrew):**
```bash
brew install gdb radare2 binutils apktool upx ghidra
```

**radare2 plugins:**
```bash
r2pm -ci r2ghidra   # Native Ghidra decompiler for radare2
# The prebuilt r2ghidra zip is ABI-locked to one radare2 version (WARN: ABI mismatch: Expect 142 vs 152); r2pm -ci r2ghidra builds the plugin from source instead.
```

**Manual install:**
- pwndbg, Linux: [GitHub](https://github.com/pwndbg/pwndbg), macOS: `brew install pwndbg/tap/pwndbg-gdb`

**MCP servers (optional, agent-driven RE):** IDA Pro MCP ([mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp)), Ghidra MCP ([bethington/ghidra-mcp](https://github.com/bethington/ghidra-mcp), has a headless server, no GUI needed), JADX MCP ([zinja-coder/jadx-ai-mcp](https://github.com/zinja-coder/jadx-ai-mcp)), see [tools-mcp.md](tools-mcp.md) for setup and usage.

## Additional Resources

The rest: https://github.com/ljagiello/ctf-skills/blob/HEAD/ctf-reverse/SKILL.md