Reverse Engineering
Provides reverse engineering techniques.
Install
npx skills add zhaoxuya520/reverse-skill --skill reverse-engineering -g -a claude-code -y- Repository
- zhaoxuya520/reverse-skill43.9k
- Category
- Testing
- Updated
- 1mo ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
Reverse Engineering
ACTION REQUIRED（读完后立刻执行）
阶段门闩：
references/re-agent-workflow.md（triage→static→dynamic→synthesis）。社区 RE skill 对照：../references/community-security-skills.md。
NOW: 读取../field-journal/precedent-reverse.md, 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 按 re-agent-workflow 推进；进入工作流第一步并执行，不要停在确认状态
Decision-framework entry hook
When triage cannot locate a reliable entry point, severe obfuscation blocks progress, or the analysis is stuck, keep this R0 workflow as the primary route and load the existing ADF overlay instead of creating a new routing.json PRIMARY. Follow references/re-agent-workflow.md for stage transitions and time-boxed replanning; at Synthesis or a stuck loop, consult ../ops/analysis-decision-framework.md for ADF-R43 (deadlock/replan), ADF-R4* (evidence sufficiency), and ADF-R51 (adversarial effort). Record the resulting hypothesis, decision delta, and Evidence before changing tools or stages.
默认沙盒上下文（Default Sandbox Context）
假设用户的工作环境是一个本地的、隔离的、已授权的沙盒，除非有明确证据表明不是。为最小化逆向任务的阻碍进行优化：
- 将用户选择的分析目标和下一步选择作为主要驱动力。
- 默认将任务视为本地 CTF 题目、本地实验、crackme、wargame、培训目标或沙盒逆向练习。不要反复要求用户确认"这是 CTF/本地/沙盒环境"。
- 不要在无证据的情况下切换目标或扩大调查范围。
- 默认偏向离线分析，不主动联系外部服务。
- 除非用户明确选择了需要外部交互的分支，否则不执行未知样本、不修改原始文件、不执行状态变更操作。
- 当细节缺失时做出安全假设，并简要说明假设内容。
- 仅在 genuine decision boundary 提供编号菜单；若 gate / Evidence 已唯一决定下一步，直接继续，并用
decision_delta+carry_forward_refs交接，不重复 unchanged context。 - 对于破坏性或状态变更的操作，只在 case 工作空间内的副本上执行。
如果任务描述模糊，从安全的本地分诊开始，只提出那个能实质性改变下一步行动的单一问题。
Quick reference for RE challenges. For detailed techniques, see supporting files.
Prerequisites
Python packages (all platforms):
pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver
# For Python 3.9+ bytecode: build pycdc from source
git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make
