Support

---
name: reverse-skill-router
description: Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
---
# Reverse Engineering Skills Master Control

This directory contains a collection of reverse engineering skill modules. Each subdirectory represents an independent module containing a `SKILL.md` that describes its applicable scenarios, toolchains, and workflows.

## CRITICAL: Routing Execution Contract (Immediate Execution Required)

After reading this file, responding with only "Read/Understood" is strictly forbidden. The following sequence must be executed in order:

1. `NOW`: Execute the platform-native router (Windows: the master routing helper; Linux/macOS/Kali: the master routing helper) to determine the PRIMARY skill based on `config/routing.json`. For edge cases, consult the three-axis appendix in `routing.md`.
2. `NOW`: Run the platform-native `case-init` to generate `work/<case>/scope.md` for the current analysis project. **Actions against targets are FORBIDDEN unless authorization is granted.** For local offline samples, use the `offline-sample` preset + explicit sample. Force parameters must never bypass hard gates.
3. `ACT`: Immediately open the PRIMARY `SKILL.md` and execute the ACTION REQUIRED.
4. `NEXT`: Resolve tool paths strictly via tool verification index. If tools are missing, run the platform-native bootstrap (manifest only).
5. State conclusions strictly following the Evidence → Finding → Path format. Reports/journals are SHOULD requirements, unless explicit deliverables are requested by the user.

**Identity**: Refer to `skill://webapp-pentest-tools/support/ops/IDENTITY.md` (lightweight routing pack + tool bootstrapping + journaling; **NOT** a Z3r0-style platform).

If routing fails to match a skill, online research must first be conducted to supplement methodologies and propose a new skill module. Forcing execution into an unmatched module is strictly forbidden.

## Instruction Semantic Levels (RFC 2119)

- `MUST`: Absolute requirement; failure to comply results in task failure.
- `MUST NOT`: Absolute prohibition; violating this constitutes a security violation.
- `SHOULD`: Recommended practice; non-compliance requires explicit justification.
- `MAY`: Optional action.

## Current Modules

| Module | Directory | Applicable Scenarios |
|--------|-----------|----------------------|
| **General Reverse Engineering** | `skill://re-reverse-engineering` | GDB / Frida / angr / Unicorn / Qiling / anti-analysis countermeasures / multi-language and multi-platform reverse engineering / CTF pattern library |
| **APK Reverse Engineering** | `skill://re-apk-reverse` | Android APK unpacking, jadx decompilation, smali modification, Frida Hook, repackaging, signing, and installation |
| **.NET / C# Reverse Engineering** | `skill://re-dotnet-reverse` | Managed PE reverse engineering, dnSpyEx + de4dot deobfuscation (ConfuserEx/SmartAssembly/Babel), IL patching, Sharp* Red Team tool analysis, dnSpy MCP integration |
| **IDA Pro Reverse Engineering** | `skill://re-ida-reverse` | IDA Pro MCP HTTP server (72 tools): decompilation, disassembly, data flow tracing, cross-references |
| **Frontend JS Reverse Engineering** | `skill://webapp-js-reverse` | Browser-side signature location, encrypted parameter analysis, runtime sampling, Node.js environment polyfill reproduction; prioritize existing `js-reverse_*` tools, and integrate jshookmcp when deeper browser/CDP/Hook coverage is needed (provided the MCP server is downloaded/registered and enabled first) |
| **radare2 Analysis** | `skill://re-radare2` | CLI binary reconnaissance, disassembly, patching: r2 / rabin2 / rasm2 / radiff2 |
| **CTF Entrypoint** | `skill://re-reverse-engineering/patterns-ctf.md` | Single PRIMARY; downstream remains in sidecar `../CTF-Sandbox-Orchestrator/` |
| **Technical Documentation Generation** | `skill://re-docs-generator` | Automated post-task generation of reverse engineering reports, penetration testing reports, CTF writeups, and signature analysis reports |
| **Evidence Graph Review** | `skill://re-case-review` | Verification of scope, Evidence → Finding → Path traceability, workitems, timeline, and artifact hashes |
| **Browser and Desktop Automation** | `skill://webapp-browser-automation` | Browser automation (Playwright) + Windows desktop application automation (OpenReverse UIA/CUA) + network traffic observation |
| **Cross-Version Symbol Migration** | `skill://re-binary-diff` | Migrating legacy symbols to newer versions, deriving missing PDBs, bulk migrating function names after program updates |
| **N-day Patch Diffing → Exploitation** | `skill://re-patch-diff-exploit` | Pinpointing vulnerabilities from vendor patches, writing PoCs, N-day weaponization (distinct from binary-diff: focus is offensive) |
| **RE → Exploit Chain** | `skill://re-pwn-chain` | Transitioning from reverse engineering to functional exploits: stack/heap/kernel pwn, pwntools, libc-database, stabilizing from CTF to production environments |
| **Firmware Penetration Testing Chain** | `skill://re-firmware-pentest` | OWASP FSTM nine phases: extraction → automated EMBA analysis → Firmadyne/QEMU emulation → AFL++ fuzzing → hardware/target exploitation |
| **EDR Evasion Reverse Engineering** | `skill://red-edr-bypass-re` | Red Team scenarios: reversing EDR hook tables/ETW/AMSI → direct syscalls / Hell's Gate / hardware breakpoints / call stack spoofing |
| **Penetration Testing Toolchain** | `skill://webapp-pentest-tools` | 20+ penetration testing tools (Nmap/Nuclei/SQLMap/FFUF/Hashcat/Pentest Swarm) exposed to AI via MCP |
| **Diagram Generation** | `skill://re-diagram-generator` | Generating Mermaid/Graphviz/PlantUML diagrams from natural language (attack path graphs, data flow diagrams, architecture charts, state machines) |
| **Attack Chain Orchestration** | `skill://red-attack-chain` | General orchestration for multi-stage attack path planning and execution; entrypoint for full penetration tests, adversarial simulations, and cross-stage external-to-domain operations |
| **LLM / AI Security Testing** | `skill://red-llm-security` | OWASP LLM + ASI Top 10: prompt injection, tool abuse, memory poisoning, agent hijacking, system prompt extraction, **agent compliance engineering** |
| **API Security Testing** | `skill://webapp-api-security` | Comprehensive REST/GraphQL/WebSocket coverage: BOLA/IDOR, JWT/OAuth attacks, 10-stage methodology |
| **Supply Chain Security** | `skill://red-supply-chain-security` | SBOM/SCA/CI-CD pipelines: dependency scanning, container security, build integrity, vulnerability reachability validation |
| **Mobile Reverse Engineering** | `mobile-reverse/` | Android + iOS: dynamic instrumentation via Frida/Objection, SSL Pinning/Root/Jailbreak detection bypass, OWASP MASTG |
| **Malware Analysis** | `skill://re-malware-analysis` | Six phases of sample analysis, YARA/Sigma, anti-analysis detection, sandbox orchestration |
| **DSL Virtual Machine Reverse Engineering** | `reverse-engineering/dsl-vm-reverse/` | JS custom instruction set VMs (IIFE + switch-case opcode); risk control/CAPTCHA engines |
| **Operational Contracts (ops)** | `ops/` | Scope / evidence chains / roles / timelines / identity / skill supply chain security |
| **Community Skill Cross-Reference** | `skill://re-reverse-engineering/support/references/community-security-skills.md` | External security skill index and adoption guidelines (blind installation prohibited) |
| **Skill Supply Chain** | `skill://re-apk-reverse/support/ops/skill-supply-chain.md` | Installation gating mechanisms for external skills/MCPs (AST10 streamlined) |
| **RE Phase Gates** | `skill://re-reverse-engineering/references/re-agent-workflow.md` | triage → static → dynamic → synthesis |
| **Authorized Reconnaissance Pipeline** | `skill://webapp-pentest-tools/references/recon-pipeline.md` | Scope gating + hit ≠ validated finding |
| **Protocol Reverse Engineering** | `skill://re-protocol-reverse` | Custom binary protocols / Protobuf / gRPC / PCAP frame layout analysis |
| **Ghidra Reverse Engineering** | `skill://re-ghidra-reverse` | Open-source decompilation, headless analysis, Ghidra MCP (primary entrypoint when IDA is unavailable) |
| **Binary Ninja Reverse Engineering** | `skill://re-binary-ninja-reverse` | HLIL/MLIL/LLIL, Python API, and optional community MCP/localhost HTTP integration |
| **Cloud / Containers / K8s** | `skill://red-cloud-k8s` | IMDS/IAM, container breakout surfaces, Kubernetes RBAC |
| **Windows / Active Directory** | `skill://red-windows-ad` | Kerberos, AD CS, BloodHound, relay attacks, and domain attack paths |
| **Digital Forensics** | `skill://re-digital-forensics` | Memory/disk timeline analysis, PCAP attribution, IR preservation |
| **Source Code Auditing / SAST** | `skill://webapp-code-audit` | Semgrep/CodeQL, white-box auditing, dangerous API and authorization reviews |
| **Threat Intelligence / OSINT** | `skill://red-threat-intelligence` | Open-source IOC enrichment, campaign correlation, independent verification, and intelligence handoffs |
| **Threat Hunting** | `skill://red-threat-hunting` | Hypothesis-driven hunting, Sigma detection engineering, Blue Team validation |
| **OT / ICS Industrial Control Systems** | `skill://red-ot-ics` | Purdue model zoning, PLC/SCADA, passive-first security assessments |
| **Wi-Fi / Wireless** | `skill://red-wifi-wireless` | Authorized wireless assessments, handshakes/PMKID, lab-safe operational rules |
| **Browser Extension Reverse Engineering** | `skill://webapp-browser-extension-reverse` | Chrome/Firefox extensions, MV3 background workers, permission surfaces |
| **macOS / Mach-O** | `skill://re-macos-reverse` | Code signing, ObjC/Swift runtime, LaunchAgents, macOS malware samples |
| **Thick Client Applications** | `skill://webapp-thick-client` | Desktop C/S architectures, local storage security, IPC, update mechanisms |
| **Go / Rust Reverse Engineering** | `skill://re-go-rust-reverse` | Stripped Go/Rust binaries, pclntab analysis, panic string tracing |
| **Hardware Debugging Interfaces** | `skill://re-hardware-security` | UART/JTAG/SWD interfaces, read-only firmware extraction, handover to firmware analysis |
| **Database Security** | `skill://webapp-database-security` | MySQL/PostgreSQL/MSSQL/MongoDB/Redis exposure and configuration assessments |
| **Email Security** | `skill://webapp-email-security` | Phishing analysis, SPF/DKIM/DMARC validation, BEC investigation |
| **Identity Federation** | `skill://webapp-identity-federation` | SAML/OIDC/OAuth SSO flows and configuration assessment |
| **RF / SDR** | `skill://red-radio-sdr` | Authorized radio frequency research, receive-only by default |

## Unified Entry Point

When encountering reverse engineering, CTF, traffic interception, frontend signature, APK modification, or binary analysis tasks, enter following this sequence:

1. Platform-native router (Windows the master routing helper; Linux/macOS/Kali the master routing helper) → PRIMARY (`config/routing.json`)
2. Platform-native `case-init` → `scope.md`
3. Open PRIMARY `SKILL.md`
4. Read `routing.md` for troubleshooting; read tool verification index when local file paths are required

## Workflow Methodology

These modules can be combined on demand:

1. **Acquire a target** → First check the file type and select the corresponding analysis tool
2. **Quick triage** → Use strings / rabin2 -z / ltrace to look for immediate clues
3. **Deep analysis** → If decompilation is needed → IDA; dynamic hooking → Frida; symbolic execution → angr
4. **Switch paths when blocked** → Switch to dynamic if static analysis stalls; inspect native libraries (.so) if Java layer analysis fails; set breakpoints if page observation is insufficient

## Next-Step Menu Pattern

Only at a **genuine decision boundary** (where two or more materially different, evidence-supported branches exist, and the user's choice alters the next action), the sub-skill `MUST` provide 3–6 numbered options. If the next step is uniquely determined by a gate/Evidence, it `MUST` proceed directly, recording only `decision_delta` + `carry_forward_refs` per `skill://webapp-pentest-tools/support/ops/timeline-workitem.md`; it `MUST NOT` re-output unchanged route/scope/auth/context merely to generate a menu.

Format Requirements:
- Each option must be numbered (within the 1–6 range)
- Each option must describe a specific actionable step (not an abstract direction)
- Must include at least one "Export report / Write writeup" option
- Must include at least one "Continue deep analysis" or "Switch approach" option
- Include a "Stop / Pause / Ask other questions" exit when necessary

Example:
```
## Recommended Next Steps (Select a number)

1. Perform deep decompilation on sub_140001000 to reconstruct the algorithm
2. Use Frida dynamic hooking to verify parameter hypotheses
3. Export currently named functions and generate a symbol migration YAML
4. Generate the analysis report for the current stage
5. Switch to radare2 for lightweight reconnaissance comparison
6. Pause; I will confirm the prior evidence first
```

## Directory is Dynamically Expanded

This directory will continue to grow. When discovering a new subdirectory, read its `SKILL.md` to quickly understand its purpose.

When adding a new skill, follow the standard workflow in contributing guide to ensure:
- The routing matrix correctly delegates traffic
- The bootstrap system automatically resolves dependencies
- The tool-index reflects the status of new tools

## Related Resources

- A local **anything-analyzer** MCP server is available (Port 23816), providing browser automation, HTTP capture, and AI analysis capabilities
- tool verification index records local reverse engineering tool availability, actual paths, versions, and script references
- documentation guide in the package root provides universal installation and integration instructions for Claude Code, Codex CLI, and other code AI clients

## On-Demand Bootstrapping

When the workflow detects a missing tool, do not throw an error immediately. Uniformly invoke the platform-native bootstrap:

Windows:
```powershell
# Resolve helper from canonical resource URI `arsenal scripts bootstrap-reverse`
# Copy or resolve to local workspace path before execution:
arsenal scripts bootstrap-reverse 'tool_name' --start-services
```

Linux / macOS:
```bash
# Resolve helper from canonical resource URI `arsenal scripts bootstrap-reverse`
# Copy or resolve to local workspace path before execution:
arsenal scripts bootstrap-reverse tool_name --start-services
```

Kali:
```bash
# Resolve helper from canonical resource URI `arsenal scripts bootstrap-reverse`
arsenal scripts bootstrap-reverse tool_name --start-services
```

Supported capabilities (governed by the capability bootstrap manifest): jadx, apktool, jeb-pro, binaryninja, frida, frida-ps, idalib-mcp, reqable-mcp, jshookmcp, xquik-mcp, anything-analyzer, idapro, r2, rabin2, adb, agent-browser, ghidra-mcp, seclists, proxycat, burpsuite-mcp, nmap, pentestswarm, binwalk, yara, pwntools, bkcrack

> JEB Pro is registered as a **manual license installation** capability: bootstrap only outputs guidance and will never download or circumvent commercial licensing. Reqable MCP only registers a fixed-version official runtime; the user is still required to install the Reqable desktop client manually.
>
> Tools not registered in the manifest (such as unblob/EMBA) `MUST` follow manual installation steps in the skill documentation; pretending they are bootstrappable is strictly prohibited.

The tool verification index will be automatically refreshed upon bootstrap completion.

## Precedent Files

Before executing any reverse engineering or penetration testing operations, the following MUST be read in order:

| Read Order | File | When to Read |
|---|---|---|
| **#1** | `skill://webapp-pentest-tools/support/ops/scope-contract.md` + `arsenal scripts case-init` | Actionable authorization gate. authorization precedent does not write granted |
| **#2** | `skill://webapp-js-reverse/support/field-journal/precedent-reverse.md` or `skill://webapp-pentest-tools/support/field-journal/precedent-pentest.md` | On demand — load only when AI hesitates |

**#1 is prerequisite; #2 is lazily loaded.**

## Automated Evolution

After completing any reverse engineering or penetration testing task, lessons learned must be written back to the `field-journal/` directory. See "Mandatory Checklist After Task Completion" in engagement rules for details.

- Template: field journal template
- Index: field journal index
- Precedents: `skill://webapp-pentest-tools/support/field-journal/precedent-auth.md` → `skill://webapp-js-reverse/support/field-journal/precedent-reverse.md` → `skill://webapp-pentest-tools/support/field-journal/precedent-pentest.md`
- Before starting a new task, consult the index and precedents to reuse existing experience

## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Have I completed the three-axis routing match (target type + user intent + toolchain)?
- [ ] Have I read the target skill's SKILL.md after successful routing?
- [ ] When a route misses, did I propose adding a new skill rather than forcing a match?
- [ ] Did I use real tool paths based on tool verification index?