How reverse-skill Facilitates EDR Bypass Analysis Through Modular Skill Routing

The reverse-skill repository streamlines EDR bypass analysis by implementing a modular skill architecture that automatically routes research queries to curated knowledge modules containing hook surveys, tool indexes, and automated environment setup scripts.

EDR bypass analysis traditionally requires synthesizing fragmented documentation about API hooking, evasion techniques, and specialized reverse-engineering tools. The zhaoxuya520/reverse-skill open-source project solves this discoverability problem by treating EDR bypass methodologies as discrete, routable skills, enabling analysts to move from query to actionable research environment through a centralized routing system defined in skills/routing.md.

Skill-Based Architecture for EDR Evasion Research

The repository structures security knowledge as skills—self-contained directories that declare their scope, dependencies, and artifacts. For EDR bypass analysis, the project implements a dedicated skill entry that the routing engine maps to specific file system locations and reference materials.

Centralized Routing and Discovery

At the core of the discovery mechanism lies skills/routing.md, which serves as the master registry linking conceptual tags like "EDR bypass" to physical skill paths. The routing engine, implemented across skills/MASTER-ROUTING.md and skills/config/routing.json, parses these mappings to resolve user intents.

When an analyst queries for EDR bypass techniques, the router references the configuration to locate the skill definition:

// Example routing configuration structure from skills/config/routing.json
{
  "EDR bypass / evasion / AV bypass": "skills/edr-bypass-re",
  "attack-chain": "skills/attack-chain"
}

This indirection ensures that automated workflows, CI pipelines, or interactive clients can dynamically load the correct knowledge base without hardcoding paths.

Skill Declaration and Scope Definition

The skill definition file, referenced by the router as edr-bypass-re/SKILL.md, declares the analytical scope of the module. According to the routing table entries, this file enumerates specific objectives such as hook identification, unhooking strategy selection, and bypass payload creation. By formalizing these objectives in markdown frontmatter, the repository enables automated parsing of research goals and required tooling.

Curated Knowledge Base and Hook Surveys

Reverse-skill consolidates fragmented EDR research into structured reference documents located within the skill hierarchy. The primary reference material resides in skills/attack-chain/references/evasion-cheatsheet.md, which functions as a comprehensive hook survey.

This document catalogs real-world EDR hooking implementations, including:

• NtHook techniques targeting native API interception
• PE-Sieve memory scanning countermeasures
• SysWhispers3 direct system call implementations

By mapping these mechanisms to specific Windows APIs (e.g., NtCreateThreadEx, NtProtectVirtualMemory), the reference enables analysts to correlate behavioral detection patterns with specific bypass vectors. The file cross-references the broader attack chain documented in skills/attack-chain/SKILL.md, situating EDR evasion within the complete exploitation lifecycle from initial delivery to post-execution cleanup.

Automated Tooling and Environment Bootstrapping

The repository automates the provisioning of EDR bypass analysis environments through template generation and platform-specific bootstrap scripts.

Dynamic Tool Index Generation

The skills/tool-index.md.template file provides a platform-agnostic schema for listing required utilities. At runtime, this template generates skills/tool-index.md, which catalogs essential binaries including PE-Sieve, SysWhispers3, and API Monitor. Analysts can query this index programmatically to verify tool availability:

# Example: Extracting EDR bypass tools from the generated index

grep -A 2 "EDR\|hook\|evasion" skills/tool-index.md

Environment Setup Automation

For Linux-based analysis hosts, kali/scripts/bootstrap-reverse.sh automates the installation of the EDR bypass toolchain. The script accepts hint parameters to target specific skill domains:

# Bootstrap the environment with EDR bypass tooling

bash kali/scripts/bootstrap-reverse.sh --hint "edr-bypass"

This execution path installs PE-Sieve for memory analysis, configures Sysinternals utilities for hook detection, and clones SysWhispers3 for direct syscall research, ensuring reproducible analysis environments across different analyst machines.

Attack Chain Integration

EDR bypass analysis does not exist in isolation within the reverse-skill framework. The skills/attack-chain/SKILL.md file explicitly positions evasion techniques within the broader offensive operations workflow. This integration demonstrates where bypass mechanisms fit between initial delivery, execution, and subsequent persistence phases.

By linking the EDR bypass skill references to the attack chain documentation, the repository enables analysts to understand not just how to unhook EDR sensors, but when to deploy these techniques to maximize operational effectiveness. This contextual mapping prevents the common research pitfall of studying evasion mechanisms without considering their tactical application.

Practical Code Examples

The following examples demonstrate how to interact with the reverse-skill routing system and tooling infrastructure to facilitate EDR bypass analysis.

Querying the Skill Router

Resolve the physical path to the EDR bypass skill using the routing configuration:

import json
import pathlib

# Load the master routing configuration

router_path = pathlib.Path('skills/config/routing.json')
router = json.loads(router_path.read_text())

# Resolve the EDR bypass skill path

skill_key = "EDR bypass / evasion / AV bypass"
edr_skill_path = router.get(skill_key)

print(f"Loading EDR bypass skill from: {edr_skill_path}")

# Output: Loading EDR bypass skill from: skills/edr-bypass-re

Accessing Reference Materials

Programmatically locate the hook survey within the skill structure:

# Construct path to the evasion reference

ref_path = pathlib.Path(edr_skill_path) / "references" / "hook-survey.md"
if not ref_path.exists():
    # Fallback to attack-chain references as per routing aliases

    ref_path = pathlib.Path("skills/attack-chain/references/evasion-cheatsheet.md")

content = ref_path.read_text()

# Parse specific hooking techniques

Automating Tool Discovery

Search the generated tool index for EDR-specific utilities:

# PowerShell example for Windows environments

Select-String -Path skills/tool-index.md -Pattern "PE-Sieve|SysWhispers|unhook" | 
    ForEach-Object { $_.Line }

Summary

• Modular Routing: The skills/routing.md and skills/config/routing.json files map EDR bypass queries to dedicated skill directories, enabling dynamic discovery of research materials.
• Structured Knowledge: Reference documents like skills/attack-chain/references/evasion-cheatsheet.md consolidate hook surveys and bypass techniques into searchable, version-controlled markdown.
• Environment Automation: kali/scripts/bootstrap-reverse.sh and skills/tool-index.md.template provide reproducible setup for EDR analysis toolchains including PE-Sieve and SysWhispers3.
• Tactical Context: Integration with skills/attack-chain/SKILL.md ensures EDR bypass research is contextualized within full attack chain workflows rather than isolated techniques.

Frequently Asked Questions

How does reverse-skill route queries to EDR bypass analysis resources?

The repository uses a centralized routing system defined in skills/routing.md and implemented via skills/config/routing.json. When a query matches the "EDR bypass" tag, the router resolves the path to skills/edr-bypass-re (or equivalent skill directory) and loads the associated SKILL.md definition and reference materials automatically.

Where are specific EDR hooking techniques documented within the repository?

Detailed hooking methodologies are cataloged in skills/attack-chain/references/evasion-cheatsheet.md, which serves as a hook survey documenting specific implementations like NtHook, PE-Sieve detection methods, and SysWhispers3 direct syscall patterns. This file maps targeted Windows APIs to their corresponding bypass strategies.

How does the repository automate setup for EDR bypass toolchains?

The skills/tool-index.md.template generates a comprehensive tool list, while kali/scripts/bootstrap-reverse.sh executes automated installation of required utilities such as PE-Sieve and SysWhispers3. This ensures analysts can replicate the EDR bypass research environment without manual dependency resolution.

How is EDR bypass analysis integrated into broader offensive security workflows?

The skills/attack-chain/SKILL.md file explicitly positions EDR evasion within the complete attack lifecycle, linking bypass techniques to delivery, execution, and persistence phases. This integration ensures that researchers understand the tactical placement of unhooking and evasion methods during full-chain operations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}