Boundary Conditions Between RIO Attack-Chain and R24 Windows/AD Routing

The boundary between the RIO (DynamoRIO-based instrumentation) attack-chain and the R24 Windows/AD routing is enforced by the central routing engine in skills/MASTER-ROUTING.md, which ensures that reverse-engineering instrumentation checks run only within the RIO pipeline while Active Directory operations route cleanly through R24 without cross-contamination.

The zhaoxuya520/reverse-skill repository implements a modular skill-routing system where the RIO attack-chain detection logic for dynamic analysis tools must remain strictly isolated from R24 Windows/AD routing directives. Understanding the precise boundary conditions—defined by trigger logic, environmental pre-conditions, and mutual exclusion rules—prevents instrumentation overhead from contaminating domain-controller operations and ensures each skill executes within its intended environmental context.

What Defines the RIO Attack-Chain?

The RIO (Reverse I/O) attack-chain resides within the reverse-engineering skillset and focuses on detecting runtime instrumentation frameworks that analysts attach to binaries.

Instrumentation Detection Logic

According to the source code in skills/reverse-engineering/anti-analysis.md, the attack-chain identifies active instrumentation via the Test-DynamoRIO function. This detection mechanism scans for the presence of DynamoRIO or Pin libraries in the process memory space. The logic executes only when the host has the DynamoRIO runtime or Pin libraries available; otherwise, the routine returns "no instrumentation" and the reverse-engineering pipeline continues.

# PowerShell detection logic from skills/reverse-engineering/anti-analysis.md

Import-Module $PSScriptRoot\..\..\scripts\instrumentation.ps1

if (Test-DynamoRIO) {
    Write-Host "⚠️ DynamoRIO detected – aborting reverse‑engineering step."
    exit 1
}

Mutual Exclusion Behavior

When the RIO attack-chain detects instrumentation, it aborts further reverse-engineering analysis to prevent contaminated results. This creates a hard boundary: if instrumentation is present, the system does not proceed to subsequent stages, ensuring that any binary analysis results remain untainted by dynamic analysis tools.

What Defines R24 Windows/AD Routing?

The R24 routing entry point belongs to the Windows/Active Directory skillset and handles tasks targeting domain controllers, Kerberos, or AD CS infrastructure.

Routing Configuration and Triggers

The routing definition lives in skills/MASTER-ROUTING.md and the JSON mapping in skills/config/routing.json. The R24 identifier activates when user-provided hints match Windows/AD scenarios—specifically keywords like "kerberoast", "domain trust", or "ad". Upon activation, the engine routes execution to skills/windows-ad/SKILL.md.

# Bash routing logic from skills/MASTER-ROUTING.md

if [[ "$HINT" == *"kerberoast"* ]] || [[ "$HINT" == *"ad"* ]]; then
    # Route identifier R24 points to windows-ad/SKILL.md

    ./skills/scripts/run-skill.sh --id R24 --hint "$HINT"
fi

Environmental Pre-conditions

Unlike the RIO chain, R24 requires a target environment that is either a Windows domain controller or a machine joined to Active Directory. Additionally, the presence of AD-specific tools such as BloodHound or ldapsearch is mandatory. If these tools are missing, the routing engine triggers a dependency error rather than attempting execution.

Boundary Conditions and Execution Flow

The separation between RIO and R24 is enforced through five distinct boundary conditions that govern trigger logic, environmental requirements, data flow, and error handling.

Trigger Condition Boundaries

RIO triggers activate upon binary execution under instrumentation, detected via the anti-analysis module. R24 triggers activate via string-matching routing hints in the master configuration. These triggers are evaluated sequentially by the central engine; a hint matching R24 bypasses RIO detection entirely, while a binary analysis task without AD hints enters the RIO pipeline.

Environmental Pre-condition Boundaries

The RIO attack-chain requires the DynamoRIO or Pin runtime environment to perform meaningful detection, whereas R24 requires Active Directory domain membership and specific penetration-testing tools. These disjoint environmental requirements ensure that the two skills operate in fundamentally different contexts—one in a reverse-engineering lab potentially running instrumentation, the other in a domain network.

Mutual Exclusion and Data Flow

The routing engine enforces mutual exclusion at the architectural level. When the workflow selects R24, the system invokes the Windows/AD module without importing or executing any RIO detection code from skills/reverse-engineering/anti-analysis.md. Conversely, when operating within the RIO pipeline, the system does not load AD-specific modules. This clean separation prevents cross-contamination.

However, an explicit hand-off is possible. After a clean RIO detection (no instrumentation found), the workflow may transition to R24 if the task involves AD-related binary analysis:

# Explicit hand-off from RIO to R24 after clean detection

if (-not (Test-DynamoRIO)) {
    # Assume the binary belongs to a compromised AD host

    & "./skills/scripts/run-skill.sh" -Id "R24" -Hint "extract binaries from domain controller"
}

Error Handling Boundaries

Failure modes remain isolated within their respective boundaries. RIO errors—such as failure to load DynamoRIO libraries—trigger a graceful fallback that logs the event but keeps the task within the reverse-engineering pipeline. R24 errors—such as missing AD tools—trigger a routing error that prompts the user to install dependencies before re-execution, as validated by skills/scripts/verify-routing-coherence.ps1.

Summary

• The RIO attack-chain in skills/reverse-engineering/anti-analysis.md detects DynamoRIO/Pin instrumentation via the Test-DynamoRIO function and aborts analysis if instrumentation is present.
• The R24 Windows/AD routing in skills/MASTER-ROUTING.md and skills/config/routing.json routes tasks to skills/windows-ad/SKILL.md when hints indicate Kerberos or Active Directory targets.
• Boundary conditions enforce mutual exclusion: R24 execution skips RIO detection entirely, while RIO operates only within the reverse-engineering pipeline.
• Environmental requirements are disjoint: RIO requires instrumentation runtimes; R24 requires domain controllers and tools like BloodHound.
• Error handling remains contained—RIO failures log gracefully within the analysis pipeline, while R24 failures trigger dependency alerts via the routing validation script.

Frequently Asked Questions

What happens if both RIO instrumentation and R24 routing conditions are detected simultaneously?

The central routing engine evaluates task hints before executing any detection logic. If a hint triggers the R24 route, the system proceeds directly to the Windows/AD module in skills/windows-ad/SKILL.md without invoking the Test-DynamoRIO function. The RIO attack-chain executes only when the task is explicitly routed to the reverse-engineering pipeline, ensuring that Active Directory operations never run under instrumentation checks unless manually invoked via an explicit hand-off script.

Where is the RIO detection logic located in the source code?

The primary detection logic resides in skills/reverse-engineering/anti-analysis.md, specifically within the Pin/DynamoRIO Detection section. This file contains the Test-DynamoRIO function that checks for the presence of instrumentation libraries. The module is imported via skills/scripts/instrumentation.ps1 as shown in the detection snippets.

How does the routing engine prevent cross-contamination between reverse-engineering and AD skills?

The engine enforces separation through mutual exclusion rules defined in skills/MASTER-ROUTING.md. When the route identifier resolves to R24, the execution shell spawned by ./skills/scripts/run-skill.sh loads only the Windows/AD environment variables and modules, explicitly excluding the reverse-engineering instrumentation imports. This architectural isolation ensures that DynamoRIO detection overhead does not impact AD enumeration performance or results.

Can R24 routing invoke RIO detection explicitly if needed?

Yes, but it requires an explicit hand-off rather than implicit inclusion. After the R24 pipeline completes its initial AD reconnaissance, a script may invoke the instrumentation check by calling the PowerShell module from skills/reverse-engineering/anti-analysis.md directly. However, this is not the default behavior; it must be coded as a separate step, such as the conditional execution block shown in the data flow example, to maintain the integrity of the boundary conditions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}