/binary-triage

name: binary-triage
description: Performs initial binary triage by surveying memory layout, strings, imports/exports, and functions to quickly understand what a binary does and identify suspicious behavior. Use when first examining a binary, when user asks to triage/survey/analyze a program, or wants an overview before deeper reverse engineering.

Binary Triage

Instructions

We are triaging a binary to quickly understand what it does. This is an initial survey, not deep analysis. Our goal is to: 1. Identify key components and behaviors 2. Flag suspicious or interesting areas 3. Create a task list of next steps for deeper investigation

Binary triage with ReVa

Follow this systematic workflow using ReVa's MCP tools:

1. Identify the Program

• Use `get-current-program` to see the active program
• Or use `list-project-files` to see available programs in the project
• Note the `programPath` (e.g., "/Hatchery.exe") for use in subsequent tools

2. Survey Memory Layout

• Use `get-memory-blocks` to understand the binary structure
• Examine key sections:
• `.text` - executable code
• `.data` - initialized data
• `.rodata` - read-only data (strings, constants)
• `.bss` - uninitialized data
• Flag unusual characteristics:
• Unusually large sections
• Packed/encrypted sections
• Executable data sections
• Writable code sections

3. Survey Strings

• Use `get-strings-count` to see total string count
• Use `get-strings` with pagination (100-200 strings at a time)
• Look for indicators of functionality or malicious behavior:
• **Network**: URLs, IP addresses, domain names, API endpoints
• **File System**: File paths, registry keys, configuration files
• **APIs**: Function names, library references
• **Messages**: Error messages, debug strings, log messages
• **Suspicious Keywords**: admin, password, credential, token, crypto, encrypt, decrypt, download, execute, inject, shellcode, payload

4. Survey Symbols and Imports

• Use `get-symbols-count` with `includeExternal=true` to count imports
• Use `get-symbols` with `includeExternal=true` and `filterDefaultNames=true`
• Focus on external symbols (imports from libraries)
• Flag interesting/suspicious imports by category:
• **Network APIs**: connect, send, recv, WSAStartup, getaddrinfo, curl_*, socket
• **File I/O**: CreateFile, WriteFile, ReadFile, fopen, fwrite, fread
• **Process Manipulation**: CreateProcess, exec, fork, system, WinExec, ShellExecute
• **Memory Operations**: VirtualAlloc, VirtualProtect, mmap, mprotect
• **Crypto**: CryptEncrypt, CryptDecrypt, EVP_*, AES_*, bcrypt, RC4
• **Anti-Analysis**: IsDebuggerPresent, CheckRemoteDebuggerPresent, ptrace
• **Registry**: RegOpenKey, RegSetValue, RegQueryValue
• Note the ratio of imports to total symbols (heavy import usage may indicate reliance on libraries)

5. Survey Functions

• Use `get-function-count` with `filterDefaultNames=true` to count named functions
• Use `get-function-count` with `filterDefaultNames=false` to count all functions
• Calculate ratio of named vs unnamed functions (high unnamed ratio = stripped binary)
• Use `get-functions` with `filterDefaultNames=true` to list named functions
• Identify key functions:
• **Entry points**: `entry`, `start`, `_start`
• **Main functions**: `main`, `WinMain`, `DllMain`, `_main`
• **Suspicious names**: If not stripped, look for revealing function names

6. Cross-Reference Analysis for Key Findings

• For interesting strings found in Step 3:
• Use `find-cross-references` with `direction="to"` and `includeContext=true`
• Identify which functions reference suspicious strings
• For suspicious imports found in Step 4:
• Use `find-cross-references` with `direction="to"` and `includeContext=true`
• Identify which functions call suspicious APIs
• This helps prioritize which functions need detailed examination

7. Selective Initial Decompilation

• Use `get-decompilation` on entry point or main function
• Set `limit=30` to get ~30 lines initially
• Set `includeIncomingReferences=true` to see callers
• Set `includeReferenceContext=true` for context snippets
• Use `get-decompilation` on 1-2 suspicious functions identified in Step 6
• Set `limit=20-30` for quick overview
• Look for high-level patterns:
• Loops (encryption/decryption routines)
• Network operations
• File operations
• Process creation
• Suspicious control flow (obfuscation indicators)
• **Do not do deep analysis yet** - this is just to understand general behavior

8. Document Findings and Create Task List

• Use the `TodoWrite` tool to create an actionable task list with items like:
• "Investigate string 'http://malicious-c2.com' (referenced at 0x00401234)"
• "Decompile function sub_401000 (calls VirtualAlloc + memcpy + CreateThread)"
• "Analyze crypto usage in function encrypt_payload (uses CryptEncrypt)"
• "Trace anti-debugging checks (IsDebuggerPresent at 0x00402000)"
• "Examine packed section .UPX0 for unpacking routine"
• Each todo should be:
• Specific (include addresses, function names, strings)
• Actionable (what needs to be investigated)
• Prioritized (most suspicious first)

Output Format

Present triage findings to the user in this structured format:

Program Overview

• **Name**: [Program name from programPath]
• **Type**: [Executable type - PE, ELF, Mach-O, etc.]
• **Platform**: [Windows, Linux, macOS, etc.]

Memory Layout

• **Total Size**: [Size in bytes/KB/MB]
• **Key Sections**: [List main sections with sizes and permissions]
• **Unusual Characteristics**: [Any packed/encrypted/suspicious sections]

String Analysis

• **Total Strings**: [Count from get-strings-count]
• **Notable Findings**: [Bullet list of interesting strings with context]
• **Suspicious Indicators**: [URLs, IPs, suspicious keywords found]

Import Analysis

• **Total Symbols**: [Count from get-symbols-count]
• **External Imports**: [Count of external symbols]
• **Key