Complete Guide to Reverse Engineering Skill Modules in the reverse-skill Repository

The reverse-skill repository contains 13 specialized reverse engineering skill modules—self-contained Markdown files under the skills/ directory—that define structured workflows, tool dependencies, and routing logic for analyzing binaries from Go executables to browser extensions.

The reverse-skill project treats every capability as a modular unit, enabling AI agents and CLI tools to dynamically select the appropriate analysis path based on user intent. Each module adheres to a strict schema that includes workflow definitions, reference materials, and hierarchical routing context, ensuring consistent execution across diverse reverse engineering targets.

Architecture of Reverse Engineering Skill Modules

Every module in the repository follows a standardized template that enables automatic discovery and dispatch by the MASTER-ROUTING engine.

Core Schema Elements

According to the source code in skills/MASTER-ROUTING.md and the configuration at skills/config/routing.json, each skill module must contain:

• name: – A human-readable identifier used by the routing dispatcher to match user requests.
• description: – An intent-matching blurb that determines when the skill should activate.
• ACTION REQUIRED / 工作流 sections – Concrete, step-by-step procedures specifying tool checks and evidence collection workflows.
• references/ – Supporting cheat-sheets and external documentation specific to the target platform.
• scripts/ (optional) – Ready-made PowerShell or Bash helpers that the skill invokes directly (e.g., skills/radare2/scripts/recon.ps1).
• ## 路由上下文 – Metadata linking upstream (parent) and downstream (child) skills, enabling hierarchical routing chains.

This loose-coupling design allows the dispatcher to locate the best match without hard-coded logic, keeping the 13 reverse engineering capabilities instantly discoverable.

Available Reverse Engineering Skill Modules

The repository ships with 13 production-ready modules organized alphabetically below. Each entry includes its GitHub source path for direct access to the full workflow specifications.

General Reverse Engineering

skills/reverse-engineering/SKILL.md serves as the foundational module. It provides the overarching decision framework, universal tool-chain overview, and quick-win checklists applicable to any binary target. This module acts as the parent node for specialized downstream skills.

Binary Platform Analysis

skills/go-rust-reverse/SKILL.md – Handles stripped Go and Rust binaries using GoReSym for symbol recovery and panic-string extraction. Includes specific handling for Rust unwind tables.

skills/dotnet-reverse/SKILL.md – Covers .NET assembly decompilation, obfuscator detection (ConfuserEx, Dotfuscator), and metadata extraction via dnSpy or ILSpy command-line wrappers.

skills/mobile-reverse/SKILL.md – Focuses on iOS/macOS Mach-O binaries, Objective-C runtime analysis, and class-dump workflows for extracting method signatures.

skills/macos-reverse/SKILL.md – A deep-dive into macOS-specific nuances including code-signing validation (codesign -dvv), dyld shared cache analysis, and Swift/Objective-C interop.

Interactive Disassembler Integration

skills/ghidra-reverse/SKILL.md – Defines headless and GUI-based decompilation workflows using Ghidra's analyzeHeadless command, including script automation in Java or Python.

skills/ida-reverse/SKILL.md – Covers IDA Pro GUI workflows, IDC/IDAPython script integration, and batch processing modes for automated analysis.

skills/radare2/SKILL.md – CLI-centric analysis utilizing r2, rabin2, rasm2, and radiff2. Includes bundled PowerShell reconnaissance scripts for rapid triage.

Specialized Format Modules

skills/apk-reverse/SKILL.md – Android package reverse engineering via APKTool for DEX extraction, SO library inspection, and Frida hook deployment.

skills/js-reverse/SKILL.md – JavaScript obfuscation techniques, source-map recovery, and browser extension payload analysis using js-beautify and AST manipulation.

skills/browser-extension-reverse/SKILL.md – Dedicated to Chrome/Firefox extensions, covering manifest permission analysis (jq .permissions manifest.json) and content-script deobfuscation.

Advanced Domain Modules

skills/reverse-engineering/dsl-vm-reverse/SKILL.md – Custom virtual machine bytecode reversal, de-obfuscation strategies, and emulator creation for domain-specific languages.

skills/protocol-reverse/SKILL.md – Network protocol reverse engineering, state-machine extraction from packet captures, and fuzzing template generation using AFL++.

Practical Usage Examples

The following commands illustrate how each module translates its 工作流 section into actionable tool invocations. These examples assume the routing engine has already selected the appropriate skill based on the target artifact.

# General RE: Display quick-win checklist from the master skill

curl -s https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/skills/reverse-engineering/SKILL.md | grep "## Quick Wins"

# Go/Rust: Extract symbols from stripped Go binary using GoReSym

gorelsym -i sample_go.bin -o symbols.txt

# Ghidra: Headless decompilation with post-analysis script

analyzeHeadless . GhidraProject -import sample.bin -postScript Decompile.cs

# radare2: Automated reconnaissance via bundled script

powershell -File "$(pwd)/skills/radare2/scripts/recon.ps1" -TargetPath sample.exe -RunAnalysis

# IDA: Launch with predefined IDC script

ida64 -A -S"my_script.idc" sample.exe

# APK: Decode and inspect DEX strings

apktool d app.apk -o out && strings out/classes.dex | grep -i flag

# Mobile (iOS): Dump Objective-C headers

class-dump -H -o headers sample.app

# macOS: Verify code signature and entitlements

codesign -dvv sample.app

# JavaScript: Deobfuscate browser payload

js-beautify obf.js > pretty.js

# .NET: Extract assembly metadata

dnspy-cli -metadata sample.dll

# Browser Extension: Parse manifest permissions

jq .permissions manifest.json

# DSL/VM: Execute custom bytecode emulator

python3 vm_emulator.py custom.vm

# Protocol: Begin fuzzing with skill-provided templates

afl-fuzz -i inputs -o findings -- ./proto_client @@

Each command corresponds to specific steps documented in the respective skill's workflow section, ensuring tool availability checks precede execution.

Summary

• reverse-skill organizes capabilities into 13 discrete modules under the skills/ directory, each following a strict Markdown schema compatible with automated routing.
• The MASTER-ROUTING dispatcher (skills/MASTER-ROUTING.md) leverages skills/config/routing.json to match user intent to the appropriate module based on name: and description: fields.
• Modules cover the full reverse engineering spectrum: general workflows, Go/Rust/.NET binaries, macOS/iOS platforms, Ghidra/radare2/IDA toolchains, Android APKs, JavaScript/browser extensions, custom VMs, and network protocols.
• Each skill includes executable scripts/, reference documentation in references/, and hierarchical routing context (路由上下文) linking related skills.

Frequently Asked Questions

How does the routing system select between similar reverse engineering skill modules?

The routing engine parses the description: field and 路由上下文 (routing context) metadata in each skill file. For example, a request mentioning "stripped Go binary" triggers skills/go-rust-reverse/SKILL.md due to its description keywords, while "iOS app analysis" routes to skills/mobile-reverse/SKILL.md based on platform-specific terminology. The system supports parent-child relationships, allowing the general reverse engineering skill to delegate to specialized children.

What is required to add a new reverse engineering skill module?

Create a new directory under skills/ containing a SKILL.md file that implements the mandatory schema: name:, description:, workflow sections (ACTION REQUIRED or 工作流), and optionally a scripts/ subdirectory or references/ folder. Register the new skill in skills/config/routing.json to make it discoverable by the MASTER-ROUTING dispatcher.

Are the included scripts cross-platform compatible?

The repository primarily provides PowerShell scripts for Windows environments (e.g., skills/radare2/scripts/recon.ps1) and Bash equivalents for Unix systems where applicable. Each skill's SKILL.md specifies the required execution environment and prerequisite tool installations (e.g., GoReSym, APKTool, or jq) before attempting to run bundled automation.

Can these skill modules be used outside of automated routing systems?

Yes. Each SKILL.md functions as standalone documentation. Analysts can manually browse the files on GitHub or clone the repository to execute the documented command sequences directly. The modular structure ensures that workflows remain comprehensible without the routing infrastructure, serving as actionable playbooks for manual reverse engineering tasks.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}