grahama1970/analyze-elf

STOP. READ THIS ENTIRE SKILL.MD BEFORE CALLING ANY ENDPOINT.

O que analyze-elf faz?

Reverse-engineer features from compiled ELF binaries. Not a disassembler — a feature extractor that answers "what does this binary do?"

When to Use

• Understanding what a compiled CLI tool does (Bun SEA, Go, Rust, C/C++)
• Extracting CLI commands, flags, and help text
• Recovering state machines, protocol schemas, and event types
• Mapping JSON-RPC methods and Zod data models
• Producing a prosecution brief walkthrough with Mermaid diagrams

Quick Start

# Primary command — extract features, generate walkthrough
.pi/skills/analyze-elf/run.sh features /path/to/binary --goal "understand the mission system"

# With AST analysis via /treesitter (slower, deeper)
.pi/skills/analyze-elf/run.sh features /path/to/binary --ast --goal "find all RPC methods"

# JSON output for programmatic use
.pi/skills/analyze-elf/run.sh features /path/to/binary --output-format json

# Low-level ELF info (headers, symbols, runtime detection)
.pi/skills/analyze-elf/run.sh elf /path/to/binary

# String extraction with regex
.pi/skills/analyze-elf/run.sh strings /path/to/binary --pattern "mission|worker"

Commands

Command	Description
features	Primary. Extract features → generate walkthrough with Mermaid diagrams
elf	Low-level: headers, sections, symbols, runtime detection
strings	Regex-filtered string extraction

What features Extracts

Category	Method	Example
CLI commands	Help text pattern matching	exec, daemon, mcp
State machines	Enum assignment patterns (M.State="value")	orchestrator_turn, paused
Event types	KH.literal("type_name") patterns	mission_accepted, worker_completed
JSON-RPC methods	method: KH.literal("name") patterns	droid.session_notification
Zod schemas	KH.object({...}) field extraction	Feature, WorkerHandoff, State
npm packages	"name": "pkg" in bundled package.json	@grpc/grpc-js
API routes	/api/ and /v1/ path literals	/api/auth/login
Classes/functions	AST via /treesitter (with --ast flag)	MissionRunner, spawnWorker

Composition

/treesitter (AST analysis)

When --ast is passed, the skill:

1. Carves JS source strings from .rodata
2. Filters to JS-bearing lines (function/class/import/Zod patterns)
3. Pipes chunks through /treesitter parse --language javascript
4. Extracts classes, functions, and method signatures

/create-walkthrough (auto-generated)

The features command produces a prosecution brief with:

• Mermaid CLI command tree
• Mermaid state machine diagrams
• Mermaid event type taxonomy
• Schema tables with field types
• Risk assessment ("What Could Go Wrong")

/create-figure

DOT-format dependency and module diagrams available via the elf command for rendering through /create-figure.

Dependencies

• pyelftools — structured ELF parsing
• httpx — /scillm API calls
• typer — CLI
• loguru — logging
• System: binutils (readelf, nm, strings)