/analyze

description: Full static analysis workflow — PE headers, strings, disassembly, classification
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep, Task
argument-hint: <path-to-binary>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Full Binary Analysis

Parse `$ARGUMENTS` to get the binary path. This command runs the complete 8-phase reverse engineering workflow.

Pre-flight

1. Verify the binary exists at the provided path. 2. Check tool availability:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/tool-checker.js" check

3. If critical Tier 1 tools are missing, inform the user and suggest `/re-install`.

Phase 1 — Initial Assessment

1. Compute hashes:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js" hash "$ARGUMENTS"

2. Check for prior analysis:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js" check "<sha256>" "full-analysis"

3. File type identification: `file <binary>` 4. Record basic metadata: size, timestamps.

Phase 2 — PE Structure Analysis

Use radare2 for PE header analysis:

r2 -qc 'iH' <binary>     # PE headers
r2 -qc 'iI' <binary>     # Binary info
r2 -qc 'iS' <binary>     # Sections (check entropy)
r2 -qc 'ii' <binary>     # Imports
r2 -qc 'iE' <binary>     # Exports
r2 -qc 'ir' <binary>     # Resources

Flag suspicious indicators:

• High-entropy sections (>7.0 = likely packed)
• Unusual section names (.UPX, .aspack, .nsp)
• Suspicious imports (CreateRemoteThread, VirtualAllocEx, WSAStartup)
• TLS callbacks (anti-debug)

Phase 3 — String & Secret Extraction

strings -a -n 6 <binary>              # ASCII strings
strings -a -n 6 -el <binary>          # UTF-16 LE strings
floss <binary>                          # Obfuscated/stack strings

Regex-match for: URLs, IPs, emails, API keys (AWS `AKIA*`, Azure, GCP `AIza*`), JWT tokens (`eyJ*`), base64 blobs, file paths, registry keys, wallet addresses.

Log each finding:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<binary>" "<type>" "<value>" "<severity>" "<title>"

Phase 4 — Disassembly & Function Analysis

r2 -qc 'aaa; afl' <binary>           # Analyze and list functions
r2 -qc 'aaa; pdf @main' <binary>     # Decompile main/entry

Identify key function categories: network, file I/O, process manipulation, registry, crypto, anti-analysis.

Phase 5 — .NET Check

If imports include `mscoree.dll` or `_CorExeMain`, this is a .NET binary. Run `/dotnet` for specialized analysis.

Phase 6 — Packer Detection

Check section entropy and known packer signatures. If packed, suggest `/unpack` before deep analysis.

Phase 7 — Classification

yara -r <rules-dir> <binary>          # YARA scan (if rules available)

Extract IOCs: C2 addresses, mutex names, dropped file paths, persistence keys.

Phase 8 — Report Generation

Log analysis completion:

node "${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js" add "<sha256>" "full-analysis" "completed" --binary "<name>" --findings <count>

Save comprehensive report to `analysis-<binary-name>.md` with sections:

• File Identification & Hashes
• PE Structure Summary
• Extracted Strings & Secrets
• Key Functions Identified
• Classification Results
• IOC Summary
• Risk Assessment
• Recommendations