# MASTER-ROUTING.md Categories: Complete Guide to Reverse-Skill Routing Rules

> Explore MASTER-ROUTING.md rules and discover how 40 priority-ordered categories map keywords to skill folders for automated reverse engineering workflows.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: tutorial
- Published: 2026-08-01

---

**The [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) file in the zhaoxuya520/reverse-skill repository defines 40 priority-ordered categories (R0–R39) that map keyword triggers to specific skill folders, enabling the `master-route.ps1` script to automatically select the appropriate reverse engineering workflow.**

The zhaoxuya520/reverse-skill framework uses a sophisticated routing system to direct security analysis tasks to specialized skill sets. At the heart of this system lies [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), a priority-ordered table that categorizes reverse engineering tasks by artifact type, tool chain, and analysis technique. Understanding these MASTER-ROUTING.md categories is essential for leveraging the framework's automated workflow selection.

## How the Category Routing System Works

The [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) file implements a **fast-route** decision table that operates on a "first match wins" priority system. Each category is identified by an **R-code** (R0 through R39) and consists of three components:

- **ID**: The R-code identifier (e.g., **R1**, **R9**, **R0**)
- **Condition**: Keyword triggers that signal the category (e.g., "APK", "smali", "jadx")
- **PRIMARY skill folder**: The target directory containing specialized tools and workflows (e.g., `apk-reverse/`, `malware-analysis/`)

When you provide a hint to the router, `master-route.ps1` scans this table from highest to lowest priority, stopping at the first match to determine which skill folder to activate.

## Mobile and Application Analysis Categories

The framework prioritizes mobile and managed code analysis with high-priority routing codes:

- **R1** (`apk-reverse/`): Android-specific reverse engineering triggered by keywords **APK**, **smali**, **jadx**, or **apktool**
- **R2** (`mobile-reverse/`): iOS and general mobile analysis triggered by **IPA**, **iOS**, **Objection**, **MobSF**, or **mobile**
- **R3** (`js-reverse/`): JavaScript and frontend security triggered by **JS签名**, **前端加密**, **jshook**, or **CDP**
- **R5** (`dotnet-reverse/`): .NET binary analysis triggered by **.NET**, **dnSpy**, **de4dot**, or **ConfuserEx**
- **R30** (`browser-extension-reverse/`): Browser extension analysis
- **R31** (`macos-reverse/`): macOS and Mach-O binary analysis
- **R32** (`thick-client/`): Thick client security assessments

## Native Binary Reverse Engineering

For low-level binary analysis, the framework distinguishes between tool-specific workflows:

- **R6** (`ida-reverse/`): Deep disassembly and decompilation using **IDA** or general **反编译**/**反汇编** workflows
- **R7** (`radare2/`): Open-source reverse engineering with **radare2** or **r2**
- **R22** (`ghidra-reverse/`): NSA's **Ghidra** and other open-source decompilation tools
- **R4** (`reverse-engineering/dsl-vm-reverse/`): Specialized virtual machine analysis for **DSL VM**, **fireye**, or custom opcode VMs
- **R33** (`go-rust-reverse/`): Native binaries compiled in **Go** or **Rust**

## Infrastructure and IoT Security

Hardware and embedded systems receive dedicated routing paths:

- **R8** (`firmware-pentest/`): **Firmware** analysis using **binwalk**, **IoT** tools, or **EMBA**
- **R28** (`ot-ics/`): Operational technology and industrial control systems (**OT**/**ICS**/**工控**)
- **R34** (`hardware-security/`): Hardware debugging interfaces including **UART** and **JTAG**
- **R38** (`radio-sdr/`): Radio frequency research and **SDR** (**RF**/**SDR**研究)
- **R29** (`wifi-wireless/`): **Wi-Fi** and wireless penetration testing

## Offensive Security and Exploitation

Red team and exploitation workflows are categorized by attack vector:

- **R10** (`attack-chain/`): Full **攻击链** reconstruction, **红队** operations, lateral movement, and complete penetration testing
- **R11** (`pentest-tools/`): Tool-specific assessments using **Nmap**, **Nuclei**, **SQLMap**, or **SRC** workflows
- **R17** (`pwn-chain/`): Binary exploitation including **pwn**, **ROP**, and **堆栈利用** techniques
- **R16** (`patch-diff-exploit/`): **N-day** vulnerability research and **补丁差分** analysis
- **R18** (`edr-bypass-re/`): Endpoint detection evasion including **EDR** bypass and **syscall** manipulation

## Threat Intelligence and Analysis

Defensive and analytical categories include high-priority malware detection:

- **R9** (`malware-analysis/`): **恶意样本** analysis using **YARA** rules and **沙箱** environments (high priority)
- **R27** (`threat-hunting/`): **威胁狩猎**, detection engineering, and blue team operations
- **R25** (`digital-forensics/`): **取证** analysis, memory dumps, and timeline reconstruction

## API, Cloud, and Supply Chain Security

Modern application security categories cover cloud-native and dependency risks:

- **R12** (`api-security/`): **API** security testing including **GraphQL**, **BOLA**, and **JWT** attacks
- **R23** (`cloud-k8s/`): **云** infrastructure, containers, and **K8s** security
- **R13** (`supply-chain-security/`): **SBOM** generation, **Trivy** scanning, and supply chain risk assessment
- **R37** (`identity-federation/`): **SAML** and **OIDC** federal identity attacks

## Specialized Reverse Engineering Domains

Niche technical categories support advanced binary analysis:

- **R15** (`binary-diff/`): **bindiff** analysis, symbol migration, and **PDB** handling
- **R21** (`protocol-reverse/`): **协议** reverse engineering including **Protobuf** and **PCAP** protocols
- **R24** (`windows-ad/`): **Windows** environments, **AD** attacks, **Kerberos**, and **AD CS** exploitation
- **R35** (`database-security/`): Database-specific security testing
- **R36** (`email-security/`): **邮件** analysis and phishing campaign investigation

## Emerging Technology and Automation

The framework includes categories for modern development and documentation workflows:

- **R14** (`llm-security/`): **LLM** security, **Prompt** injection testing, and **Agent** security
- **R19** (`browser-automation/`): Browser and desktop automation security
- **R20** (`docs-generator/`): Report generation and **writeup** creation
- **R39** (`diagram-generator/`): Architecture documentation using **Mermaid**, **Graphviz**, **PlantUML**, and **架构图** generation

## Default and Fallback Categories

When no specific keywords match, the router defaults to the catch-all category:

- **R0** (`reverse-engineering/`): **通用逆向** for generic reverse engineering, **反调试**, **OLLVM** obfuscation, and unknown binary formats

According to the source code in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) (lines 49-91), if the `master-route.ps1` script fails to match any trigger keywords, it automatically selects **R0** and suggests consulting the full three-axis matrix in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) for manual category selection.

## Implementing Category Selection in PowerShell

The `skills/scripts/master-route.ps1` script processes your hint against the MASTER-ROUTING.md categories to return the appropriate PRIMARY path.

Run the router with a keyword hint:

```powershell

# Trigger R1 (APK analysis) via keyword matching

powershell -File skills\scripts\master-route.ps1 -Hint "analyze apk sample"

```

Implement manual category detection in your own scripts:

```powershell
$hint = "inspect iOS binary"
$master = Get-Content .\skills\MASTER-ROUTING.md
if($master -match 'R2.*?iOS') {
    $primary = 'mobile-reverse/'
    Write-Host "PRIMARY = $primary – iOS / Mobile reverse engineering"
}

```

Handle fallback scenarios when no category matches:

```powershell

# When hint contains no recognizable keywords (triggers R0)

powershell -File skills\scripts\master-route.ps1 -Hint "unknown format"

# Output: Suggests opening routing.md for manual selection

```

## Summary

- **MASTER-ROUTING.md** contains 40 categories (R0–R39) organized in priority order from specific mobile/binary analysis (R1-R5) to generic reverse engineering (R0).
- **High-priority categories** include APK analysis (R1), iOS/mobile (R2), JavaScript reversing (R3), and malware analysis (R9).
- **Tool-specific routing** distinguishes between IDA (R6), radare2 (R7), and Ghidra (R22) workflows.
- **R0 serves as the default** when no keywords match, directing users to the generic `reverse-engineering/` folder or the detailed [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) matrix.
- The **`master-route.ps1`** script automates category selection by scanning the priority table and returning the PRIMARY skill folder path.

## Frequently Asked Questions

### What happens if my analysis hint doesn't match any category keywords?

If no keywords match the conditions defined in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), the `master-route.ps1` script automatically defaults to **R0** (`reverse-engineering/`). According to the implementation at lines 49-91, the script suggests opening [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) to consult the full three-axis decision matrix for manual category selection.

### How does the priority ordering work in MASTER-ROUTING.md?

The table is organized from highest to lowest priority (R1 at the top, R0 at the bottom). The `master-route.ps1` script evaluates your hint against each category sequentially and stops at the **first match**, ensuring specific categories like APK analysis (R1) take precedence over generic reverse engineering (R0).

### What is the difference between the categories for IDA, radare2, and Ghidra?

**R6** (`ida-reverse/`) routes to commercial IDA Pro workflows for deep disassembly. **R7** (`radare2/`) selects the open-source radare2 toolchain. **R22** (`ghidra-reverse/`) directs to the NSA's Ghidra framework and other open-source decompilers. Each maintains separate skill folders with tool-specific scripts and configurations.

### Which category should I use for iOS mobile application analysis?

Use **R2** (`mobile-reverse/`), which triggers on keywords including **IPA**, **iOS**, **Objection**, **MobSF**, and **mobile**. For Android APKs specifically, use **R1** (`apk-reverse/`). If analyzing macOS binaries rather than iOS apps, the framework routes to **R31** (`macos-reverse/`).