How the Field Journal in reverse-skill Powers Intelligent Task Execution

The field journal in reverse-skill functions as a persistent knowledge base that closes the feedback loop between execution and experience, enabling AI agents to reuse proven workflows, avoid documented pitfalls, and continuously improve reverse engineering outcomes.

The zhaoxuya520/reverse-skill repository implements a feedback-driven architecture where the field journal serves as the central memory system. Located in skills/field-journal/, this markdown-based knowledge store captures complete execution chains, toolchain configurations, and "踩坑" (pitfall) tables from completed analyses. By feeding this collective intelligence back into the routing pipeline, the system transforms isolated tasks into self-learning iterations.

What Is the Field Journal in reverse-skill?

The field journal is the repository’s structured knowledge base that bridges the gap between execution and experience. Unlike static documentation, it functions as a living archive where each completed analysis contributes reusable lessons for future agents.

According to the source code, the journal resides in the skills/field-journal/ directory and consists of:

• _index.md – The central registry that catalogs all available entries for quick lookup.
• Seed entries (e.g., seed-001_elf-packed-loader.md) – Concrete case studies documenting specific reverse engineering scenarios.
• Runtime-generated reports – New entries created post-execution that record toolchain notes, execution flows, and recovered code snippets.

This architecture ensures that every task benefits from the accumulated experience of previous runs.

The Three-Stage Feedback Loop

The field journal contributes to task execution through a continuous three-stage cycle: pre-task consultation, execution-time routing, and post-task enrichment.

Pre-Task Lookup

Before initiating a new analysis, the agent scans the journal index to locate relevant historical entries. In skills/field-journal/_index.md (lines 1‑7), the system maintains a curated list of past "seed" or real-project entries that match the current scenario.

This lookup enables the agent to:

• Instantly reuse proven workflows documented in entries like seed-001_elf-packed-loader.md.
• Avoid known pitfalls recorded in previous "踩坑" tables.
• Select appropriate toolchains based on prior successful configurations.

Execution-Time Integration

During task execution, the routing core described in docs/OVERVIEW.md (lines 15‑18) directs the agent to the appropriate skill module. After the skill completes its analysis, the system generates a structured report and writes reusable lessons back into the journal.

As implemented in docs/OVERVIEW.md (lines 55‑58), this write-back step ensures that successful execution chains, discovered decryption routines, and anti-debugging bypasses are immediately preserved for future retrieval.

Post-Task Enrichment

Newly created entries are stored alongside existing seed files, following the repository’s markdown conventions. Each entry records:

• The complete execution chain from initial file identification to final payload extraction.
• Detailed "踩坑" (pitfall) tables documenting obstacles encountered and solutions applied.
• Reusable code snippets and toolchain notes (e.g., specific readelf or r2 command sequences).

Future agents retrieve this knowledge via the index, guaranteeing that subsequent tasks leverage the collective experience of the entire project.

Working with the Field Journal

The repository provides programmatic interfaces for interacting with the journal at each stage of the feedback loop.

Querying Historical Entries

To locate relevant prior work, agents can search the journal for keywords matching the current target:

# Find any entry that mentions “ELF” and “self‑extract”

grep -iRl "elf.*self‑extract" skills/field-journal/ | head -n 5

This returns a list of markdown files (e.g., seed-001_elf-packed-loader.md) containing applicable workflows.

Recording New Discoveries

After task completion, the following Python pattern creates a new journal entry following repository conventions:

import datetime, pathlib

def add_journal_entry(title, content):
    today = datetime.date.today().isoformat()
    filename = f"{today}_{title.replace(' ', '-').lower()}.md"
    path = pathlib.Path("skills/field-journal") / filename
    with path.open("w", encoding="utf-8") as f:
        f.write(f"# {title}\n\n")

        f.write(content)

# Example usage after completing an ELF analysis

add_journal_entry(
    "ELF loader – custom LZSS",
    """## 完整执行链路

1. file → 确认 ELF
2. readelf / rabin2 → 解析 PHDR
3. IDA/Ghidra → 定位 LZSS 解压循环
4. Python 重写 → dump payload
...
"""
)

The script generates a timestamped markdown file that automatically becomes visible in the index, preserving the execution chain and recovered techniques.

Integrating with Routing Logic

The primary routing script referenced in skills/scripts/master-route.ps1 demonstrates how the journal influences live execution decisions:

# In master-route.ps1 – after routing but before tool selection

$journal = Get-ChildItem "skills/field-journal" -Filter "*elf*loader*.md" | Select-Object -First 1
if ($journal) {
    Write-Host "Found prior ELF loader experience: $($journal.Name)"
    # Could inject extra tool hints or script parameters here

}

By checking for historical entries before selecting tools, the routing system can inject proven parameters or skip redundant analysis steps.

Summary

• The field journal in zhaoxuya520/reverse-skill serves as the repository’s persistent memory, stored in skills/field-journal/ as markdown files.
• Pre-task lookup via _index.md allows agents to reuse proven workflows and avoid documented pitfalls before execution begins.
• During execution, the routing core (docs/OVERVIEW.md lines 15‑18) directs tasks and triggers report generation, while lines 55‑58 handle writing reusable lessons back to the journal.
• Post-task enrichment creates new entries (like seed-001_elf-packed-loader.md) that capture execution chains, "踩坑" tables, and reusable code snippets for future retrieval.
• The system transforms individual reverse engineering tasks into collective learning iterations, with the journal acting as the feedback mechanism that improves routing accuracy over time.

Frequently Asked Questions

What file format does the field journal use?

The field journal uses markdown files stored in the skills/field-journal/ directory. Each entry follows a consistent structure with ATX headers, execution chain documentation, and pitfall tables, making them both human-readable and programmatically parseable by the routing system.

How does the routing core access the field journal?

According to docs/OVERVIEW.md (lines 15‑18), the routing core directs agents to appropriate skills during execution. When a skill completes, the system references the journal during the reporting phase (lines 55‑58) to write back lessons. Additionally, skills/scripts/master-route.ps1 demonstrates runtime lookup patterns that query the journal before tool selection to inject historical context.

Where are new journal entries stored after task completion?

New entries are written directly into skills/field-journal/ following the repository naming convention of {date}_{descriptive-title}.md. These files automatically integrate with the central _index.md registry, ensuring immediate availability for future pre-task lookups without requiring manual catalog updates.

What specific knowledge gets captured in journal entries?

Each entry captures the complete execution chain (step-by-step analysis flow), "踩坑" (pitfall) tables documenting obstacles and solutions, toolchain notes (specific commands for readelf, rabin2, IDA Pro, or Ghidra), and reusable code snippets for decryption routines or unpacking scripts. This comprehensive capture ensures that future agents inherit not just results, but the full methodological context.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}