Reverse Engineering Skills Master Control

This directory contains a collection of reverse engineering-related skill modules. Each subdirectory is an independent module containing a

SKILL.md

file that describes its applicable scenarios, toolchain, and workflow.

CRITICAL: Routing Execution Contract (Must Be Executed Immediately)

After reading this document, you are not allowed to only reply "Read/Understood". You must execute the following steps in order:

```
NOW
```
: Read
```
MASTER-ROUTING.md
```
(or run
```
scripts/master-route.ps1 -Hint "..."
```
) to determine the PRIMARY module; refer to the three-axis table in
```
routing.md
```
for difficult cases.
```
NOW
```
: Run
```
scripts/case-init.ps1
```
to create
```
work/<case>/scope.md
```
(see
```
ops/scope-contract.md
```
for the contract); No ACT on the target is allowed until auth is granted.
```
NOW
```
: Mark lead/specialist according to
```
ops/role-map.md
```
; immediately open the PRIMARY
```
SKILL.md
```
and execute the ACTION REQUIRED items.
```
NEXT
```
: Read
```
tool-index.md
```
when using local tools; Do not guess paths; if tools are missing → run
```
bootstrap-reverse.ps1
```
(manifest only).
```
ACT
```
: Execute tasks and append timeline / update workitems; structure conclusions using Evidence→Finding→Path (refer to
```
ops/evidence-finding-path.md
```
).
Completion: Generate reports with
```
docs-generator
```
+ desensitize
```
field-journal
```
; refer to items 3–6 in the phase menu.

Identity: See

ops/IDENTITY.md

(lightweight routing package + tool bootstrap + journal; not a Z3r0-style platform).

If routing fails to hit a matching module, you must first supplement methodologies online and propose adding a new skill; do not force it into an unmatched module.

Instruction Semantic Levels (RFC 2119)

```
MUST
```
: Must be executed; failure to comply results in task failure.
```
MUST NOT
```
: Prohibited; failure to comply results in security violation.
```
SHOULD
```
: Should be done in principle; if not done, a reason must be provided.
```
MAY
```
: Optional action.

Current Modules

Module	Directory	Applicable Scenarios
General Reverse Engineering	`reverse-engineering/`	GDB / Frida / angr / Unicorn / Qiling / anti-analysis countermeasures / cross-language platform reverse engineering / CTF pattern library
APK Reverse Engineering	`apk-reverse/`	Android APK unpacking, jadx decompilation, smali modification, Frida Hook, repackaging, signing and installation
.NET / C# Reverse Engineering	`dotnet-reverse/`	Managed PE reverse engineering, dnSpyEx + de4dot deobfuscation (ConfuserEx/SmartAssembly/Babel), IL patch, Sharp* red team tool analysis, dnSpy MCP integration
IDA Pro Reverse Engineering	`ida-reverse/`	IDA Pro MCP HTTP server (72 tools): decompilation, disassembly, data flow tracking, cross-references
Frontend JS Reverse Engineering	`js-reverse/`	Browser-side signature location, encryption parameter analysis, runtime sampling, Node environment restoration; prioritize existing `js-reverse_*` modules; access jshookmcp when stronger browser/CDP/Hook capabilities are needed, but only after downloading/registering and enabling the MCP server
radare2 Analysis	`radare2/`	CLI binary reconnaissance, disassembly, patching: r2 / rabin2 / rasm2 / radiff2
CTF Competition Full Stack	`../CTF-Sandbox-Orchestrator/`	40+ sub-skills: Web/reverse/Pwn/cloud/container/AD/forensics/steganography/mobile/cryptography/ZIP, orchestrated uniformly by the master controller
Technical Documentation Writing	`docs-generator/`	Automatically generate reverse engineering reports, penetration testing reports, CTF writeups, signature reverse engineering reports after task completion
Evidence Graph Review	`case-review/`	Verify scope, Evidence→Finding→Path traceability, workitems, timeline and artifact hash
Browser and Desktop Automation	`browser-automation/`	Browser operations (Playwright) + Windows desktop application operations (OpenReverse UIA/CUA) + network monitoring
Cross-Version Symbol Migration	`binary-diff/`	Migrate symbols from old versions to new versions, derive missing PDBs, batch migrate function names after program updates
N-day Patch Diff → Exploitation	`patch-diff-exploit/`	Locate vulnerability points from vendor patches, write PoCs, weaponize N-day vulnerabilities (division of labor with binary-diff: this skill focuses on the attack side)
RE → Exploit Chain	`pwn-chain/`	Progress from reverse engineering to usable exploits: stack/heap/kernel pwn, pwntools, libc-database, stabilization from CTF to real remote scenarios
Firmware Penetration Chain	`firmware-pentest/`	OWASP FSTM 9 phases: extraction → EMBA automation → Firmadyne/QEMU simulation → AFL++ fuzzing → physical device exploitation
EDR Bypass Reverse Engineering	`edr-bypass-re/`	Red team scenarios: Reverse engineer EDR hook tables/ETW/AMSI → direct syscall / Hell's Gate / hardware breakpoint / call stack spoofing
Penetration Testing Toolchain	`pentest-tools/`	20+ penetration tools including Nmap/Nuclei/SQLMap/FFUF/Hashcat/Pentest Swarm, exposed to AI via MCP
Diagram Generation	`diagram-generator/`	Generate Mermaid/Graphviz/PlantUML diagrams from natural language (attack path diagrams, data flow diagrams, architecture diagrams, state machines)
Attack Chain Orchestration	`attack-chain/`	Command center for multi-stage attack path planning and execution; start cross-stage tasks such as complete penetration, HW drills, and external network to domain controller attacks from here
LLM/AI Security Testing	`llm-security/`	OWASP LLM + ASI Top 10: Prompt injection, tool abuse, memory poisoning, Agent hijacking, system prompt extraction, Agent compliance engineering
API Security Testing	`api-security/`	Full protocols including REST/GraphQL/WebSocket: BOLA/IDOR, JWT/OAuth attacks, 10-phase methodology
Supply Chain Security	`supply-chain-security/`	SBOM/SCA/CI-CD pipelines: dependency scanning, container security, build integrity, vulnerability reachability verification
Mobile Reverse Engineering	`mobile-reverse/`	Android + iOS: Frida/Objection dynamic instrumentation, SSL Pinning/Root/jailbreak detection bypass, OWASP MASTG
Malware Analysis	`malware-analysis/`	6-phase sample analysis, YARA/Sigma, anti-analysis detection, sandbox orchestration
DSL Virtual Machine Reverse Engineering	`reverse-engineering/dsl-vm-reverse/`	JS custom instruction set VM (IIFE + switch-case opcode); risk control/captcha engines, etc.
Ops Combat Contract	`ops/`	Scope / evidence chain / roles / timeline / identity / skill supply chain security
Community Skill Reference	`references/community-security-skills.md`	External security skill index and reference rules (blind installation prohibited)
Skill Supply Chain	`ops/skill-supply-chain.md`	External skill/MCP installation gate (AST10 streamlined)
RE Phase Gate	`reverse-engineering/references/re-agent-workflow.md`	triage→static→dynamic→synthesis
Authorized Reconnaissance Pipeline	`pentest-tools/references/recon-pipeline.md`	Scope gate + hit≠verification
Protocol Reverse Engineering	`protocol-reverse/`	Custom binary protocols / Protobuf / gRPC / PCAP frame layout
Ghidra Reverse Engineering	`ghidra-reverse/`	Open-source decompilation, headless mode, Ghidra MCP (main entry when IDA is unavailable)
Cloud / Container / K8s	`cloud-k8s/`	IMDS/IAM, container escape surfaces, Kubernetes RBAC
Windows / AD	`windows-ad/`	Kerberos, AD CS, BloodHound, relay and domain paths
Digital Forensics	`digital-forensics/`	Memory/disk timeline, PCAP tracing, IR preservation
Code Audit / SAST	`code-audit/`	Semgrep/CodeQL, white-box, dangerous API and authentication review
Threat Hunting	`threat-hunting/`	Hypothesis-driven hunting, Sigma detection engineering, blue team verification
OT / ICS Industrial Control	`ot-ics/`	Purdue zoning, PLC/SCADA, passive priority assessment
Wi-Fi / Wireless	`wifi-wireless/`	Authorized wireless assessment, handshake/PMKID, laboratory rules
Browser Extension Reverse Engineering	`browser-extension-reverse/`	Chrome/Firefox extensions, MV3 worker, permission surfaces
macOS / Mach-O	`macos-reverse/`	Signatures, ObjC/Swift, LaunchAgent, macOS samples
Thick Client	`thick-client/`	Desktop C/S, local storage, IPC, update channels
Go / Rust Reverse Engineering	`go-rust-reverse/`	Stripped-symbol Go/Rust, pclntab, panic strings
Hardware Debugging Interface	`hardware-security/`	UART/JTAG/SWD, read-only extraction, firmware handover
Database Security	`database-security/`	MySQL/PG/MSSQL/Mongo/Redis exposure and configuration
Email Security	`email-security/`	Phishing dissection, SPF/DKIM/DMARC, BEC
Federated Identity	`identity-federation/`	SAML/OIDC/OAuth SSO flows and mismatches
RF / SDR	`radio-sdr/`	Authorized radio frequency research, receive-only by default

Unified Entry Point

When encountering tasks related to reverse engineering, CTF, packet capture, frontend signatures, APK repackaging, or binary analysis, follow this order to proceed:

MASTER-ROUTING.md

scripts/master-route.ps1

→ PRIMARY module

Refer to the full three-axis table in
```
routing.md
```
for difficult cases
Open the
```
SKILL.md
```
file of the PRIMARY sub-module
Refer to
```
tool-index.md
```
when needing local tool paths

Workflow Ideas

These modules can be combined as needed:

Obtain a target → First check the file type and select the corresponding analysis tool
Quick vulnerability spotting → Use strings / rabin2 -z / ltrace to look for direct clues
In-depth analysis → Use IDA for decompilation if needed; use Frida for dynamic hooking; use angr for symbolic execution
Switch approaches if one fails → Use dynamic analysis if static analysis doesn't work; check the so layer if the Java layer is insufficient; set breakpoints if page observation is not enough

Next-Step Menu Pattern

After completing a phase, each sub-skill

MUST

provide users with 3-6 numbered next-step options to let users choose the direction. Do not advance across phases without user selection.

Format requirements:

Each option is numbered (range 1-6)
Each option describes a specific executable action (not an abstract direction)
Must include at least one "Export report/write writeup" option
Must include at least one "Continue in-depth analysis" or "Switch to another method" option
Include a "Stop/pause/ask other questions" exit if necessary

Example:

## Suggested Next Steps (Select a Number)

1. Perform in-depth decompilation of sub_140001000 to restore the algorithm
2. Use Frida dynamic Hook to verify parameter conjectures
3. Export currently named functions and generate symbol migration YAML
4. Generate an analysis report for the current phase
5. Switch to radare2 for lightweight reconnaissance comparison
6. Pause, I need to confirm the previous evidence first

Directory is Dynamically Expanding

This directory will continue to grow. When a new subdirectory is found, reading its

SKILL.md

will quickly inform you of its purpose.

When adding a new skill, follow the standard process in

CONTRIBUTING.md

to ensure:

The routing matrix can correctly divert tasks
The bootstrap system can automatically supplement dependencies
The tool-index can reflect the status of new tools

Related Resources

The local machine also has an anything-analyzer (port 23816) MCP server, providing browser automation, HTTP capture, and AI analysis capabilities
```
tool-index.md
```
records whether local reverse engineering tools are available, their actual paths, versions, and script references
The
```
Readme.md
```
in the root directory provides general installation and access instructions for Claude Code, Codex CLI, and other code AI clients

On-Demand Bootstrap

When the workflow detects missing tools, do not directly report an error. Uniformly call:

powershell

powershell -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('Tool Name') -StartServices

Supported capabilities (refer to

scripts/bootstrap-manifest.json

): jadx, apktool, jeb-pro, frida, frida-ps, idalib-mcp, reqable-mcp, jshookmcp, anything-analyzer, idapro, r2, rabin2, adb, agent-browser, ghidra-mcp, seclists, proxycat, burpsuite-mcp, nmap, pentestswarm, binwalk, yara, pwntools, bkcrack

JEB Pro is registered as a manual license installation capability: bootstrap only provides guidance, and will never download or circumvent commercial licenses. Reqable MCP only registers the official runtime of a fixed version, and users still need to install the Reqable desktop client themselves.
Tools not registered in the manifest (such as unblob/EMBA, etc.)
MUST
follow manual installation steps in the skill documentation; do not pretend they can be bootstrapped.

The

tool-index

will be automatically refreshed after bootstrap is completed.

Precedent Files

Before performing any reverse engineering/penetration operations, you

MUST

read the following files in order:

Reading Order	File	When to Read
#1	`field-journal/precedent-auth.md`	Must read every time you start (80 lines) — to pass security review
#2	`field-journal/precedent-reverse.md` or `precedent-pentest.md`	On demand — only load when AI is hesitant

#1 is a prerequisite, #2 is lazily loaded.

Automatic Evolution

After completing each reverse engineering/penetration task, you must write back experience to the

field-journal/

directory. See the "Mandatory Checklist After Task Completion" in

RULES.md

Template:
```
field-journal/_template.md
```
Index:
```
field-journal/_index.md
```

Precedents:

field-journal/precedent-auth.md

→

precedent-reverse.md

→

precedent-pentest.md

Check the index and precedents before starting a new task to reuse existing experience

Task Completion Self-Check (Must Pass Before Claiming Completion)

Have I completed the three-axis routing matching (target type + user intent + toolchain)?
Have I read the SKILL.md of the target skill after successful routing?
When routing failed to hit, did I propose adding a new skill instead of forcing a match?
Did I use real tool paths based on
```
tool-index
```
?

reverse-skill-router

NPX Install

Tags

SKILL.md Content (Chinese)