MASTER-ROUTING.md Categories: Complete Guide to Reverse-Skill Routing Rules

The skills/MASTER-ROUTING.md file in the zhaoxuya520/reverse-skill repository defines 40 priority-ordered categories (R0–R39) that map keyword triggers to specific skill folders, enabling the master-route.ps1 script to automatically select the appropriate reverse engineering workflow.

The zhaoxuya520/reverse-skill framework uses a sophisticated routing system to direct security analysis tasks to specialized skill sets. At the heart of this system lies skills/MASTER-ROUTING.md, a priority-ordered table that categorizes reverse engineering tasks by artifact type, tool chain, and analysis technique. Understanding these MASTER-ROUTING.md categories is essential for leveraging the framework's automated workflow selection.

How the Category Routing System Works

The skills/MASTER-ROUTING.md file implements a fast-route decision table that operates on a "first match wins" priority system. Each category is identified by an R-code (R0 through R39) and consists of three components:

• ID: The R-code identifier (e.g., R1, R9, R0)
• Condition: Keyword triggers that signal the category (e.g., "APK", "smali", "jadx")
• PRIMARY skill folder: The target directory containing specialized tools and workflows (e.g., apk-reverse/, malware-analysis/)

When you provide a hint to the router, master-route.ps1 scans this table from highest to lowest priority, stopping at the first match to determine which skill folder to activate.

Mobile and Application Analysis Categories

The framework prioritizes mobile and managed code analysis with high-priority routing codes:

• R1 (apk-reverse/): Android-specific reverse engineering triggered by keywords APK, smali, jadx, or apktool
• R2 (mobile-reverse/): iOS and general mobile analysis triggered by IPA, iOS, Objection, MobSF, or mobile
• R3 (js-reverse/): JavaScript and frontend security triggered by JS签名, 前端加密, jshook, or CDP
• R5 (dotnet-reverse/): .NET binary analysis triggered by .NET, dnSpy, de4dot, or ConfuserEx
• R30 (browser-extension-reverse/): Browser extension analysis
• R31 (macos-reverse/): macOS and Mach-O binary analysis
• R32 (thick-client/): Thick client security assessments

Native Binary Reverse Engineering

For low-level binary analysis, the framework distinguishes between tool-specific workflows:

• R6 (ida-reverse/): Deep disassembly and decompilation using IDA or general 反编译/反汇编 workflows
• R7 (radare2/): Open-source reverse engineering with radare2 or r2
• R22 (ghidra-reverse/): NSA's Ghidra and other open-source decompilation tools
• R4 (reverse-engineering/dsl-vm-reverse/): Specialized virtual machine analysis for DSL VM, fireye, or custom opcode VMs
• R33 (go-rust-reverse/): Native binaries compiled in Go or Rust

Infrastructure and IoT Security

Hardware and embedded systems receive dedicated routing paths:

• R8 (firmware-pentest/): Firmware analysis using binwalk, IoT tools, or EMBA
• R28 (ot-ics/): Operational technology and industrial control systems (OT/ICS/工控)
• R34 (hardware-security/): Hardware debugging interfaces including UART and JTAG
• R38 (radio-sdr/): Radio frequency research and SDR (RF/SDR研究)
• R29 (wifi-wireless/): Wi-Fi and wireless penetration testing

Offensive Security and Exploitation

Red team and exploitation workflows are categorized by attack vector:

• R10 (attack-chain/): Full 攻击链 reconstruction, 红队 operations, lateral movement, and complete penetration testing
• R11 (pentest-tools/): Tool-specific assessments using Nmap, Nuclei, SQLMap, or SRC workflows
• R17 (pwn-chain/): Binary exploitation including pwn, ROP, and 堆栈利用 techniques
• R16 (patch-diff-exploit/): N-day vulnerability research and 补丁差分 analysis
• R18 (edr-bypass-re/): Endpoint detection evasion including EDR bypass and syscall manipulation

Threat Intelligence and Analysis

Defensive and analytical categories include high-priority malware detection:

• R9 (malware-analysis/): 恶意样本 analysis using YARA rules and 沙箱 environments (high priority)
• R27 (threat-hunting/): 威胁狩猎, detection engineering, and blue team operations
• R25 (digital-forensics/): 取证 analysis, memory dumps, and timeline reconstruction

API, Cloud, and Supply Chain Security

Modern application security categories cover cloud-native and dependency risks:

• R12 (api-security/): API security testing including GraphQL, BOLA, and JWT attacks
• R23 (cloud-k8s/): 云 infrastructure, containers, and K8s security
• R13 (supply-chain-security/): SBOM generation, Trivy scanning, and supply chain risk assessment
• R37 (identity-federation/): SAML and OIDC federal identity attacks

Specialized Reverse Engineering Domains

Niche technical categories support advanced binary analysis:

• R15 (binary-diff/): bindiff analysis, symbol migration, and PDB handling
• R21 (protocol-reverse/): 协议 reverse engineering including Protobuf and PCAP protocols
• R24 (windows-ad/): Windows environments, AD attacks, Kerberos, and AD CS exploitation
• R35 (database-security/): Database-specific security testing
• R36 (email-security/): 邮件 analysis and phishing campaign investigation

Emerging Technology and Automation

The framework includes categories for modern development and documentation workflows:

• R14 (llm-security/): LLM security, Prompt injection testing, and Agent security
• R19 (browser-automation/): Browser and desktop automation security
• R20 (docs-generator/): Report generation and writeup creation
• R39 (diagram-generator/): Architecture documentation using Mermaid, Graphviz, PlantUML, and 架构图 generation

Default and Fallback Categories

When no specific keywords match, the router defaults to the catch-all category:

• R0 (reverse-engineering/): 通用逆向 for generic reverse engineering, 反调试, OLLVM obfuscation, and unknown binary formats

According to the source code in skills/MASTER-ROUTING.md (lines 49-91), if the master-route.ps1 script fails to match any trigger keywords, it automatically selects R0 and suggests consulting the full three-axis matrix in skills/routing.md for manual category selection.

Implementing Category Selection in PowerShell

The skills/scripts/master-route.ps1 script processes your hint against the MASTER-ROUTING.md categories to return the appropriate PRIMARY path.

Run the router with a keyword hint:

# Trigger R1 (APK analysis) via keyword matching

powershell -File skills\scripts\master-route.ps1 -Hint "analyze apk sample"

Implement manual category detection in your own scripts:

$hint = "inspect iOS binary"
$master = Get-Content .\skills\MASTER-ROUTING.md
if($master -match 'R2.*?iOS') {
    $primary = 'mobile-reverse/'
    Write-Host "PRIMARY = $primary – iOS / Mobile reverse engineering"
}

Handle fallback scenarios when no category matches:

# When hint contains no recognizable keywords (triggers R0)

powershell -File skills\scripts\master-route.ps1 -Hint "unknown format"

# Output: Suggests opening routing.md for manual selection

Summary

• MASTER-ROUTING.md contains 40 categories (R0–R39) organized in priority order from specific mobile/binary analysis (R1-R5) to generic reverse engineering (R0).
• High-priority categories include APK analysis (R1), iOS/mobile (R2), JavaScript reversing (R3), and malware analysis (R9).
• Tool-specific routing distinguishes between IDA (R6), radare2 (R7), and Ghidra (R22) workflows.
• R0 serves as the default when no keywords match, directing users to the generic reverse-engineering/ folder or the detailed routing.md matrix.
• The master-route.ps1 script automates category selection by scanning the priority table and returning the PRIMARY skill folder path.

Frequently Asked Questions

What happens if my analysis hint doesn't match any category keywords?

If no keywords match the conditions defined in skills/MASTER-ROUTING.md, the master-route.ps1 script automatically defaults to R0 (reverse-engineering/). According to the implementation at lines 49-91, the script suggests opening skills/routing.md to consult the full three-axis decision matrix for manual category selection.

How does the priority ordering work in MASTER-ROUTING.md?

The table is organized from highest to lowest priority (R1 at the top, R0 at the bottom). The master-route.ps1 script evaluates your hint against each category sequentially and stops at the first match, ensuring specific categories like APK analysis (R1) take precedence over generic reverse engineering (R0).

What is the difference between the categories for IDA, radare2, and Ghidra?

R6 (ida-reverse/) routes to commercial IDA Pro workflows for deep disassembly. R7 (radare2/) selects the open-source radare2 toolchain. R22 (ghidra-reverse/) directs to the NSA's Ghidra framework and other open-source decompilers. Each maintains separate skill folders with tool-specific scripts and configurations.

Which category should I use for iOS mobile application analysis?

Use R2 (mobile-reverse/), which triggers on keywords including IPA, iOS, Objection, MobSF, and mobile. For Android APKs specifically, use R1 (apk-reverse/). If analyzing macOS binaries rather than iOS apps, the framework routes to R31 (macos-reverse/).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}