Promote binary-analysis; supersede windows-reversing#32
Merged
Conversation
…sing
Promotes the binary-analysis capability from dreadnode/capabilities-internal
to the public catalog and removes windows-reversing, which it supersedes.
binary-analysis is the cross-platform successor to windows-reversing:
- pe_triage MCP → static_triage (PE/ELF/Mach-O via LIEF, capa, FLOSS, YARA, debuginfod)
- ghidra MCP → ghidra_mcp composition server (pyghidra-mcp superset:
FID similarity, HighFunction dataflow, emulation, diffing, BSim)
- qiling MCP (one-shot) → skill-taught Qiling Python templates (adaptable hooks)
- 3 windows-only skills → one consolidated cross-platform binary-analysis skill
Promotion touch-ups applied during the move:
- ghidra_mcp.py header now records the ghidriff differentiator (GPL-3.0 →
clean-room reimplementation of its match cascade, not vendored), which
previously lived only in internal dev docs.
- qiling-emulation.md no longer names the now-removed windows-reversing
capability; the design rationale (why templates, not an MCP) is preserved.
Tracked files only (internal dev docs/, caches excluded). Validate green;
static_triage 22 tests + ghidra 8 tests pass in the new location.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Promotes binary-analysis from
dreadnode/capabilities-internalinto the public catalog and removes windows-reversing, which it supersedes.Why
binary-analysisis the cross-platform successor towindows-reversing(Windows-PE-only). It consolidates the predecessor's three MCP servers and three skills into a broader, better-tested surface:pe_triageMCP (PE only)static_triage— PE/ELF/Mach-O via LIEF, capa, FLOSS, YARA, debuginfodghidraMCPghidra_mcpcomposition server — pyghidra-mcp superset: FID similarity, HighFunction dataflow, emulation, two-binary diffing, BSimqilingMCP (one-shot tools)binary-analysisskill (8-phase, SANS FOR610-grounded)No capability references
windows-reversing(verified across both repos); the only mentions werebinary-analysis's own design-rationale prose, reworded here.Touch-ups applied during the move
ghidra_mcp.pyheader now records the ghidriff differentiator — GPL-3.0 → clean-room reimplementation of its match cascade against Ghidra's Apache-2.0 API, deliberately not vendored. (Previously lived only in internal devdocs/, which is gitignored and doesn't ship.)qiling-emulation.mdno longer names the now-removedwindows-reversing; the rationale (Python templates over a pinned MCP surface) is preserved.Verification
dreadnode capability validate ./capabilities/binary-analysis→ ✓ greenstatic_triagetests: 22 passed;ghidra_mcptests: 8 passed (in the new location)git archive— tracked files only; internal devdocs/, caches, and\$HOME/cruft excluded.Note
Removing
binary-analysisfromcapabilities-internalships as a separate PR there (no duplicates across repos).🤖 Generated with Claude Code