SKILL: Reverse Engineering Router — 5-Second Decision Guide

AI LOAD INSTRUCTION: Meta-routing skill for reverse engineering tasks. Load this FIRST when facing any RE target to quickly determine the correct analysis path. Do NOT start analysis without routing — wrong initial direction wastes 80%+ of effort. This skill routes to specialized skills; it does NOT contain analysis techniques itself.

0. RELATED ROUTING (destination skills)

• mobile-dynamic-re — Frida/Substrate dynamic hooking on iOS/Android
• emulation-re — Unicorn/unidbg/Chomper offline emulation
• native-static-re — IDA/Ghidra static analysis of native binaries
• web-reverse-engineering — Web frontend JS/WASM reverse
• binary-protection-bypass — ELF protection bypass for exploitation
• anti-debugging-techniques — Anti-debug detection and bypass
• symbolic-execution-tools — angr/Z3 automated solving
• vm-and-bytecode-reverse — Custom VM/bytecode analysis
• code-obfuscation-deobfuscation — Deobfuscation techniques
• re-escalation — When current approach fails repeatedly

1. RAPID ASSESSMENT (ask these 4 questions)

Before choosing a path, determine:

1. Target type: What am I analyzing? (iOS app / Android app / Web JS / Native binary / Protocol / Firmware)
2. Available assets: What do I have? (source? IDA db? jailbroken device? rooted device? traffic capture? binary only?)
3. Objective: What's the goal? (algorithm extraction / signature reproduction / vulnerability / bypass detection / protocol decode)
4. Protection level: What defenses are present? (none / obfuscation / anti-debug / anti-hook / VM protection / multi-layer)

2. DECISION TREE — Route by Target Type

What is the target?
│
├── iOS App (Mach-O ARM64)
│   ├── Have jailbroken device + want dynamic analysis?
│   │   └── → mobile-dynamic-re (Frida/Substrate hooking)
│   ├── No jailbreak OR need offline reproduction?
│   │   └── → emulation-re (Chomper for iOS ARM64 emulation)
│   ├── Pure static analysis (IDA/Ghidra decompilation)?
│   │   └── → native-static-re (ARM64 Mach-O patterns)
│   └── Has anti-debug/anti-jailbreak detection?
│       └── → anti-debugging-techniques FIRST, then retry dynamic
│
├── Android App (.so / DEX)
│   ├── Have rooted device + Frida available?
│   │   └── → mobile-dynamic-re (Frida Java/Native hooking)
│   ├── No root OR need offline reproduction?
│   │   └── → emulation-re (unidbg for Android .so emulation)
│   ├── Java/Kotlin layer only (no native)?
│   │   └── → jadx decompilation + Xposed (covered in mobile-dynamic-re §Android)
│   └── Packed/encrypted APK?
│       └── → Unpack first (BlackDex/Frida dump), then re-assess
│
├── Web Frontend (JavaScript / WASM)
│   └── → web-reverse-engineering
│       ├── API signature/encryption? → §4 Algorithm Reverse
│       ├── Anti-bot/anti-crawler? → §5-§6 Detection Bypass
│       └── WASM module? → §4.5 WASM Reverse
│
├── Native Binary (ELF/PE, CTF or general)
│   ├── Goal is exploitation (pwn)?
│   │   └── → binary-protection-bypass → symbolic-execution-tools
│   ├── Goal is algorithm extraction?
│   │   └── → native-static-re (decompile + analyze)
│   ├── Has custom VM/bytecode?
│   │   └── → vm-and-bytecode-reverse
│   ├── Heavy obfuscation (CFF/opaque predicates/junk)?
│   │   └── → code-obfuscation-deobfuscation
│   └── Need automated solving (keygen/crackme)?
│       └── → symbolic-execution-tools (angr/Z3)
│
├── Network Protocol
│   ├── HTTP(S) API with encryption? → web-reverse-engineering §1
│   ├── Custom binary protocol? → Wireshark + native-static-re
│   └── Protobuf/gRPC? → protobuf-decoder tools + traffic analysis
│
└── Firmware / Embedded
    ├── Has DWARF debug info? → dwarf-expert + native-static-re
    └── Bare-metal / RTOS? → native-static-re + emulation-re (Qiling/Unicorn)

3. MULTI-LAYER TARGETS — Combination Strategy

When target has multiple protection layers, follow this priority order:

Rule: Always clear detection layers before attempting analysis layers.

4. APPROACH SELECTION MATRIX

5. ESCALATION TRIGGERS

If you've been working for >15 min without progress, STOP and check:

1. Am I in the right skill? Re-run this decision tree
2. Am I at the right layer? (fighting detection when should be analyzing logic, or vice versa)
3. Should I switch approach? Load re-escalation for systematic strategy upgrade

6. COMPLEXITY ESTIMATION

Before starting, estimate effort:

If estimated time exceeds available budget, consider: (a) narrowing scope, (b) accepting partial results, (c) trying a completely different angle.