Michael Haag MHaggis

EDR Reverse Engineering Workspace

Universal workflow for complete reverse engineering of endpoint detection and response (EDR) products. Every EDR dropped into this workspace gets the same systematic treatment: full decompilation, rule extraction, ML model extraction, vulnerability analysis, detection gap analysis, and tradecraft development.

Standardized Folder Structure

When given a new EDR product, create this structure under <product>/:

<product>/

name

edr-reverse-engineering

description

Standardized workflow for reverse engineering endpoint security products, including extraction, decompilation, rule and model recovery, vulnerability analysis, detection gap analysis, proof-of-concept planning, live probes, and stakeholder reports. Use when Claude is asked to analyze an endpoint detection and response product, endpoint protection agent, security sensor, antivirus engine, or similar endpoint security package from installer artifacts, extracted binaries, live systems, or prior workspace outputs.

EDR Reverse Engineering

Use this skill to run a complete, repeatable reverse-engineering workflow for endpoint security products. Apply the same structure to every product so outputs can be compared across analyses and future work can resume without rediscovery.

Instructions

The following script is designed to create artifacts that teams can use to hunt, new or interesting capabilities.

The following table top is based on the code here: https://github.com/code-scrap/DynamicWrapperDotNet

This script is self-contained. It should dynamically write a DLL to disk and load it in to cscript.exe

To Invoke cscript.exe stranger_things.js This example expects a 64bit system.

	filter Get-AppPackageTriageInfo {
	<#
	.SYNOPSIS

	A tool to perform rapid triage of decompressed application packages (.msix and .appx files).

	.DESCRIPTION

	Get-AppPackageTriageInfo parses key information from an uncompressed application package (.msix and .appx) without needing to first install it.

	#include <windows.h>
	#include <iostream>
	#include <dbghelp.h>
	#include <TlHelp32.h>


	#define IOCTL_BASE 0x80012008
	constexpr DWORD IREC_IOCTL(DWORD x) { return IOCTL_BASE + x; }
	#define IOTCL_IREC_OPEN_PROCESS IREC_IOCTL( 0x20 )
	static const char* DeviceName = R"(\\.\IREC)";

	<ns0:SiPolicy xmlns:ns0="urn:schemas-microsoft-com:sipolicy">
	<ns0:VersionEx>10.0.25290.0</ns0:VersionEx>
	<ns0:PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</ns0:PlatformID>
	<ns0:Rules>
	<ns0:Rule>
	<ns0:Option>Enabled:Unsigned System Integrity Policy</ns0:Option>
	</ns0:Rule>
	<ns0:Rule>
	<ns0:Option>Enabled:Advanced Boot Options Menu</ns0:Option>
	</ns0:Rule>

	SHA256,Name,Signer,Description
	04A85E359525D662338CAE86C1E59B1D7AA9BD12B920E8067503723DC1E03162,ADV64DRV.sys,"""FUJITSU LIMITED """,
	05F052C64D192CF69A462A5EC16DDA0D43CA5D0245900C9FCB9201685A2E7748,Agent64.sys,"""eSupport.com, Inc.""",DriverAgent Direct I/O for 64-bit Windows
	4045AE77859B1DBF13972451972EAAF6F3C97BEA423E9E78F1C2F14330CD47CA,Agent64.sys,Phoenix Technologies Ltd,DriverAgent Direct I/O for 64-bit Windows
	6948480954137987A0BE626C24CF594390960242CD75F094CD6AAA5C2E7A54FA,Agent64.sys,Phoenix Technologies Ltd,DriverAgent Direct I/O for 64-bit Windows
	8CB62C5D41148DE416014F80BD1FD033FD4D2BD504CB05B90EEB6992A382D58F,Agent64.sys,"""eSupport.com, Inc""",DriverAgent Direct I/O for 64-bit Windows
	B1D96233235A62DBB21B8DBE2D1AE333199669F67664B107BFF1AD49B41D9414,Agent64.sys,"""eSupport.com, Inc.""",DriverAgent Direct I/O for 64-bit Windows
	7196187FB1EF8D108B380D37B2AF8EFDEB3CA1F6EEFD37B5DC114C609147216D,ALSysIO64.sys,Artur Liberman,ALSysIO
	7F375639A0DF7FE51E5518CF87C3F513C55BC117DB47D28DA8C615642EB18BFA,ALSys

	Windows Registry Editor Version 5.00

	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\nltest.exe]
	"ReportingMode"=dword:00000001
	"MonitorProcess"="powershell.exe -Command \"Get-WmiObject win32_process -Filter 'ProcessID = %e' \| select CreationDate,ProcessId,CommandLine >> C:\\\\Test\\\\Logcmdline.txt\""

	<!doctype html>
	<html>
	<head>
	<meta name="viewport" content="width=device-width" />
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>Simple Transactional Email</title>
	<style>
	/* -------------------------------------
	GLOBAL RESETS
	------------------------------------- */