Reverse Engineering Skills Master Control

This directory contains a series of reverse engineering skill modules. Each subdirectory is an independent module containing a SKILL.md describing its use cases, toolchain, and workflow.

CRITICAL: Routing Execution Contract (Must Execute Immediately)

After reading this file, responding with only "read/understood" is NOT allowed. You MUST execute in order:

1. NOW: Read MASTER-ROUTING.md (or run scripts/master-route.ps1 -Hint "...") to determine PRIMARY; for difficult cases, read routing.md three-axis table.
2. NOW: scripts/case-init.ps1 creates work/<case>/scope.md (contract per ops/scope-contract.md); ACT on target is forbidden until auth is granted.
3. NOW: Tag lead/specialist per ops/role-map.md; immediately open PRIMARY SKILL.md and execute ACTION REQUIRED.
4. NEXT: Read tool-index.md when local tools are involved; guessing paths is forbidden; missing tools → bootstrap-reverse.ps1 (manifest only).
5. ACT: Execute and append timeline / update workitems; conclusions use Evidence→Finding→Path (ops/evidence-finding-path.md).
6. End: docs-generator report + redacted field-journal; stage menu 3–6 items.

Identity: See ops/IDENTITY.md (lightweight routing package + tool bootstrap + journal; not a Z3r0-style platform).

If routing cannot match, you must first search online to supplement methodology and propose a new skill; force-fitting into a mismatched module is forbidden.

Instruction Semantics (RFC 2119)

• MUST: Must execute; violation means task failure.
• MUST NOT: Forbidden; violation is a security breach.
• SHOULD: Should be done in principle; must explain if not done.
• MAY: Optional action.

Current Modules

Unified Entry Point

When encountering reverse engineering, CTF, packet capture, frontend signature, APK repackaging, or binary analysis tasks, enter in this order:

1. MASTER-ROUTING.md or scripts/master-route.ps1 → PRIMARY
2. For difficult cases, read routing.md full three-axis table
3. Open the PRIMARY sub-module SKILL.md
4. Read tool-index.md when local paths are needed

Workflow Approach

These modules can be combined as needed:

1. Get a target → Check file type first, select the appropriate analysis tool
2. Quick wins → strings / rabin2 -z / ltrace to look for direct clues
3. Deep analysis → Decompile → IDA; Dynamic Hook → Frida; Symbolic execution → angr
4. Switch approaches when stuck → Static fails, try dynamic; Java layer fails, check native .so; observation insufficient, set breakpoints

Next-Step Menu Pattern

After completing a stage, each sub-skill MUST provide the user with 3-6 numbered next-step options for the user to choose direction. Do not advance across stages without user selection.

Format requirements:

• Each option numbered (range 1-6)
• Each option describes a specific executable action (not an abstract direction)
• Include at least one "export report / write writeup" option
• Include at least one "continue deeper analysis" or "try a different approach" option
• Include a "stop/pause/ask other questions" exit when necessary

Example:

## Suggested Next Steps (pick a number)

1. Deep decompile sub_140001000, recover algorithm
2. Use Frida dynamic Hook to verify parameter hypothesis
3. Export currently named functions, generate symbol migration YAML
4. Generate analysis report for the current stage
5. Switch to radare2 for lightweight reconnaissance comparison
6. Pause, let me review the previous evidence

This Directory Grows Dynamically

This directory continues to grow. When discovering new subdirectories, read their SKILL.md to quickly understand their purpose.

When adding new skills, follow the standard process in CONTRIBUTING.md, ensuring:

• The routing matrix correctly distributes traffic
• The bootstrap system can automatically install dependencies
• The tool-index reflects new tool status

Related Resources

• The local machine also has an anything-analyzer (port 23816) MCP server, providing browser automation, HTTP capture, and AI analysis capabilities
• tool-index.md records whether local reverse engineering tools are available, actual paths, versions, and script references
• The Readme.md in the package root provides general installation and integration instructions for Claude Code, Codex CLI, and other code AI clients

Bootstrap On Demand

When a workflow discovers missing tools, do not error directly. Use the unified call:

powershell -NoProfile -ExecutionPolicy Bypass -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('tool_name') -StartServices

Supported capabilities (per scripts/bootstrap-manifest.json):jadx、apktool、frida、frida-ps、idalib-mcp、jshookmcp、reqable-mcp、anything-analyzer、idapro、r2、rabin2、adb、agent-browser、ghidra-mcp、nmap、seclists、proxycat、burpsuite-mcp、pentestswarm、binwalk、pwntools、yara

JEB Pro is registered as a manual license installation capability: bootstrap only outputs guidance, never downloads or circumvents commercial licenses. Reqable MCP only registers a fixed version of the official runtime; users must install the Reqable desktop client themselves.

Tools not registered in the manifest (e.g., unblob/EMBA/Foundry) MUST follow manual installation steps in skill documentation; pretending they can be bootstrapped is forbidden.

The tool-index is automatically refreshed after bootstrap completes.

Precedent Files

Before executing any reverse engineering/penetration operations, MUST read in order:

#1 preloaded, #2 lazy-loaded.

Auto-Evolution

After completing each reverse engineering/penetration task, experience must be written back to the field-journal/ directory. See the "Post-Task Hard Checklist" in RULES.md.

• template: field-journal/_template.md
• index: field-journal/_index.md
• precedent: field-journal/precedent-auth.md → precedent-reverse.md → precedent-pentest.md
• Before starting a new task, check the index and precedents to reuse existing experience

Task Completion Checklist (MUST pass before claiming completion)

• Did I complete the three-axis routing match (target type + user intent + toolchain)?
• Did I read the target skill's SKILL.md after successful routing?
• When routing missed, did I propose a new skill instead of force-matching?
• Did I use real tool paths based on tool-index?