1. NOW

   : Read

   MASTER-ROUTING.md

   (or run

   scripts/master-route.ps1 -Hint "..."

   ) to determine the PRIMARY module; refer to the three-axis table in

   routing.md

   for difficult cases.

2. NOW

   : Run

   scripts/case-init.ps1

   to create

   work/<case>/scope.md

   (see

   ops/scope-contract.md

   for the contract); No ACT on the target is allowed until auth is granted.

3. NOW

   : Mark lead/specialist according to

   ops/role-map.md

   ; immediately open the PRIMARY

   SKILL.md

   and execute the ACTION REQUIRED items.

4. NEXT

   : Read

   tool-index.md

   when using local tools; Do not guess paths; if tools are missing → run

   bootstrap-reverse.ps1

   (manifest only).

5. ACT

   : Execute tasks and append timeline / update workitems; structure conclusions using Evidence→Finding→Path (refer to

   ops/evidence-finding-path.md

   ).
6. Completion: Generate reports with

   docs-generator

   + desensitize

   field-journal

   ; refer to items 3–6 in the phase menu.

ops/IDENTITY.md

• MUST

  : Must be executed; failure to comply results in task failure.

• MUST NOT

  : Prohibited; failure to comply results in security violation.

• SHOULD

  : Should be done in principle; if not done, a reason must be provided.

• MAY

  : Optional action.

1. MASTER-ROUTING.md

   or

   scripts/master-route.ps1

   → PRIMARY module
2. Refer to the full three-axis table in

   routing.md

   for difficult cases
3. Open the

   SKILL.md

   file of the PRIMARY sub-module
4. Refer to

   tool-index.md

   when needing local tool paths

1. Obtain a target → First check the file type and select the corresponding analysis tool
2. Quick vulnerability spotting → Use strings / rabin2 -z / ltrace to look for direct clues
3. In-depth analysis → Use IDA for decompilation if needed; use Frida for dynamic hooking; use angr for symbolic execution
4. Switch approaches if one fails → Use dynamic analysis if static analysis doesn't work; check the so layer if the Java layer is insufficient; set breakpoints if page observation is not enough

MUST

• Each option is numbered (range 1-6)
• Each option describes a specific executable action (not an abstract direction)
• Must include at least one "Export report/write writeup" option
• Must include at least one "Continue in-depth analysis" or "Switch to another method" option
• Include a "Stop/pause/ask other questions" exit if necessary

undefined

1. Perform in-depth decompilation of sub_140001000 to restore the algorithm
2. Use Frida dynamic Hook to verify parameter conjectures
3. Export currently named functions and generate symbol migration YAML
4. Generate an analysis report for the current phase
5. Switch to radare2 for lightweight reconnaissance comparison
6. Pause, I need to confirm the previous evidence first

undefined

SKILL.md

CONTRIBUTING.md

• The routing matrix can correctly divert tasks
• The bootstrap system can automatically supplement dependencies
• The tool-index can reflect the status of new tools

• The local machine also has an anything-analyzer (port 23816) MCP server, providing browser automation, HTTP capture, and AI analysis capabilities

• tool-index.md

  records whether local reverse engineering tools are available, their actual paths, versions, and script references
• The

  Readme.md

  in the root directory provides general installation and access instructions for Claude Code, Codex CLI, and other code AI clients

powershell -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('Tool Name') -StartServices

scripts/bootstrap-manifest.json

JEB Pro is registered as a manual license installation capability: bootstrap only provides guidance, and will never download or circumvent commercial licenses. Reqable MCP only registers the official runtime of a fixed version, and users still need to install the Reqable desktop client themselves.

Tools not registered in the manifest (such as unblob/EMBA, etc.)

MUST

follow manual installation steps in the skill documentation; do not pretend they can be bootstrapped.

tool-index

field-journal/

RULES.md

• Template:

  field-journal/_template.md

• Index:

  field-journal/_index.md

• Precedents:

  field-journal/precedent-auth.md

  →

  precedent-reverse.md

  →

  precedent-pentest.md

• Check the index and precedents before starting a new task to reuse existing experience

• Have I completed the three-axis routing matching (target type + user intent + toolchain)?
• Have I read the SKILL.md of the target skill after successful routing?
• When routing failed to hit, did I propose adding a new skill instead of forcing a match?
• Did I use real tool paths based on

  tool-index

  ?