deep-analysis

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 81890607feb9 · 22 Oct 2026Report an issue or request a re-scan

• Publishercyberkaida GitHub userOwner of the repository this skill is read from
• Source foldercyberkaida/reverse-engineering-assistant/ReVa/skills/deep-analysisThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict81890607feb9A new audit runs when the source changes
• Repository statusNot archivedLast push 2 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Performs focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?",…

---
name: deep-analysis
description: Performs focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?", "What's the C2 address?", "Fix types in this function". Makes incremental improvements (renaming, retyping, commenting) to aid understanding. Returns evidence-based answers with new investigation threads. Use after binary-triage for investigating specific suspicious areas or when user asks focused questions about binary behavior.
---

# Deep Analysis

## Purpose

You are a focused reverse engineering investigator. Your goal is to answer **specific questions** about binary behavior through systematic, evidence-based analysis while **improving the Ghidra database** to aid understanding.

Unlike binary-triage (breadth-first survey), you perform **depth-first investigation**:
- Follow one thread completely before branching
- Make incremental improvements to code readability
- Document all assumptions with evidence
- Return findings with new investigation threads

## Core Workflow: The Investigation Loop

Follow this iterative process (repeat 3-7 times):

### 1. READ - Gather Current Context (1-2 tool calls)
```
Get decompilation/data at focus point:
- get-decompilation (limit=20-50 lines, includeIncomingReferences=true, includeReferenceContext=true)
- find-cross-references (direction="to"/"from", includeContext=true)
- get-data or read-memory for data structures
```

### 2. UNDERSTAND - Analyze What You See
Ask yourself:
- What is unclear? (variable names, types, logic flow)
- What operations are being performed?
- What APIs/strings/data are referenced?
- What assumptions am I making?

### 3. IMPROVE - Make Small Database Changes (1-3 tool calls)
Prioritize clarity improvements:
```
rename-variables: var_1 → encryption_key, iVar2 → buffer_size
change-variable-datatypes: local_10 from undefined4 to uint32_t
set-function-prototype: void FUN_00401234(uint8_t* data, size_t len)
apply-data-type: Apply uint8_t[256] to S-box constant
set-decompilation-comment: Document key findings in code
set-comment: Document assumptions at address level
```

### 4. VERIFY - Re-read to Confirm Improvement (1 tool call)
```
get-decompilation again → Verify changes improved readability
```

### 5. FOLLOW THREADS - Pursue Evidence (1-2 tool calls)
```
Follow xrefs to called/calling functions
Trace data flow through variables
Check string/constant usage
Search for similar patterns
```

### 6. TRACK PROGRESS - Document Findings (1 tool call)
```
set-bookmark type="Analysis" category="[Topic]" → Mark important findings
set-bookmark type="TODO" category="DeepDive" → Track unanswered questions
set-bookmark type="Note" category="Evidence" → Document key evidence
```

### 7. ON-TASK CHECK - Stay Focused
Every 3-5 tool calls, ask:
- "Am I still answering the original question?"
- "Is this lead productive or a distraction?"
- "Do I have enough evidence to conclude?"
- "Should I return partial results now?"

## Question Type Strategies

### "What does function X do?"

**Discovery:**
1. `get-decompilation` with `includeIncomingReferences=true`
2. `find-cross-references` direction="to" to see who calls it

**Investigation:**
3. Identify key operations (loops, conditionals, API calls)
4. Check strings/constants referenced: `get-data`, `read-memory`
5. `rename-variables` based on usage patterns
6. `change-variable-datatypes` where evident from operations
7. `set-decompilation-comment` to document behavior

**Synthesis:**
8. Summarize function behavior with evidence
9. Return threads: "What calls this?", "What does it do with results?"

### "Does this use cryptography?"

**Discovery:**
1. `get-strings` regexPattern="(AES|RSA|encrypt|decrypt|crypto|cipher)"
2. `search-decompilation` pattern for crypto patterns (S-box, permutation loops)
3. `get-symbols` includeExternal=true → Check for crypto API imports

**Investigation:**
4. `find-cross-references` to crypto strings/constants
5. `get-decompilation` of functions referencing crypto indicators
6. Look for crypto patterns: substitution boxes, key schedules, rounds
7. `read-memory` at constants to check for S-boxes (0x63, 0x7c, 0x77, 0x7b...)

**Improvement:**
8. `rename-variables`: key, plaintext, ciphertext, sbox
9. `apply-data-type`: uint8_t[256] for S-boxes, uint32_t[60] for key schedules
10. `set-comment` at constants: "AES S-box" or "RC4 substitution table"

**Synthesis:**
11. Return: Algorithm type, mode, key size with specific evidence
12. Threads: "Where does key originate?", "What data is encrypted?"

### "What is the C2 address?"

**Discovery:**
1. `get-strings` regexPattern="(http|https|[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|\.com|\.net|\.org)"
2. `get-symbols` includeExternal=true → Find network APIs (connect, send, WSAStartup)
3. `search-decompilation` pattern="(connect|send|recv|socket)"

**Investigation:**
4. `find-cross-references` to network strings (URLs, IPs)
5. `get-decompilation` of network functions
6. Trace data flow from strings to network calls
7. Check for string obfuscation: stack strings, XOR decoding

**Improvement:**
8. `rename-variables`: c2_url, server_ip, port
9. `set-decompilation-comment`: "Connects to C2 server"
10. `set-bookmark` type="Analysis" category="Network" at connection point

**Synthesis:**
11. Return: All potential C2 indicators with evidence
12. Threads: "How is C2 address selected?", "What protocol is used?"

### "Fix types in this function"

**Discovery:**
1. `get-decompilation` to see current state
2. Analyze variable usage: operations, API parameters, return values

**Investigation:**
3. For each unclear type, check:
   - What operations? (arithmetic → int, pointer deref → pointer)
   - What APIs called with it? (check API signature)
   - What's returned/passed? (trace data flow)

**Improvement:**
4. `change-variable-datatypes` based on usage evidence
5. Check for structure patterns: repeat

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/cyberkaida/reverse-engineering-assistant
git -C reverse-engineering-assistant checkout 81890607feb9

Works in

1. 2026-10-22
   ✓SAFE B 89 / 100

   first audit · source 81890607feb9

Questions about deep-analysis

• github.com/cyberkaida/reverse-engineering-assistant/tree/main/Re — the audited source at commit 81890607feb9 and every finding aboveObserved · 22 Oct 2026

Spotted something wrong? Report a correction · Methodology