How reverse-skill Routes Queries Using Keywords and Regex Patterns

The reverse-skill repository routes user queries using a priority-based regex matching system defined in skills/config/routing.json, where each route specifies must, exclude, and mustAll patterns to determine the appropriate skill module.

The open-source reverse-skill project implements an intelligent routing layer that maps natural language queries to specialized reverse-engineering skill modules. At the core of this system lies a single configuration file—skills/config/routing.json—that defines how keywords and regex patterns classify incoming requests across 40+ distinct routing rules (R0 through R44).

Routing Configuration Structure

The JSON Schema

Each route in skills/config/routing.json contains a keywords array where individual matching objects define inclusion and exclusion criteria. According to the source code, these objects utilize four specific fields:

• must — A regular expression or plain word that must appear in the user query for the route to match.
• exclude — A regex pattern that, if detected, immediately disqualifies the query from this route.
• mustAll — An array of additional regexes where every pattern must match simultaneously.
• note — Human-readable documentation describing the intent behind the pattern.

When a user query satisfies at least one must condition (plus any mustAll requirements when present) without triggering an exclude pattern, the route becomes a candidate. The engine accumulates scores across all routes and selects the winner based on the priority list defined at the end of the JSON file. lines 186-221

Route Categories and Regex Patterns

Mobile and APK Reverse Engineering

Route R1 handles Android package analysis using patterns that detect APK-specific tooling and concepts:

\bapk\b|smali|jadx|apktool|\bandroid\b|android.?reverse|安卓|反编译.?apk|apk.?加固|重打包|root.?detect|root.?检测|证书.?校验|certificate.?pinning|pinning.?绕过|签名.?校验

Route R2 manages broader mobile reverse engineering for both Android and iOS, implementing sophisticated conditional logic. It matches 越狱 but excludes LLM-related contexts like 模型|提示词|llm|prompt|jailbreak|garak, while requiring jailbreak to co-occur with mobile-specific terms via mustAll: ios|iphone|ipad|mobile|objection|ipa. lines 24-27

Binary Analysis and Disassembly Tools

Route R6 targets IDA Pro usage with patterns for decompilation and native analysis:

\bida\b|decompile|disassembl|反编译|反汇编|静态.?分析.?二进制|\.so\b|\.elf\b|so.?文件|native.?分析|jni

Route R7 identifies radare2 workflows through tool-specific command patterns:

radare|\br2\b|r2xsql|r2mcp|r2http|radius2|r2pm|rabin2|rasm2|radiff2|rahash2|rax2

Route R22 matches Ghidra-specific queries including ghidra|ghidra.?mcp|analyzeheadless|无.?ida|开源.?反编译. lines 176-177

Web Frontend and API Security

Route R3 captures JavaScript reverse engineering and frontend security:

js.?reverse|webpack|cryptojs|frontend.?sign|jshook|cdp|encrypted.?param|前端.?签名|js.?逆向|加密.?参数|webpack.?逆向|抓包|http.?capture|请求.?重放|request.?replay|js.?加密|js.?解密|前端.?加密

Route R12 handles API security testing with an exclusion clause for OAuth2/OIDC when matching \boauth\b, specifically excluding oauth2|oidc|saml|sso|openid|联邦|单点 to prevent collision with identity federation routes. lines 98-100

Windows and Active Directory

Route R24 specializes in Windows domain penetration testing, matching tools like bloodhound|kerberoast|as-?rep|certipy|ntlm.?relay|dc.?sync|impacket|mimikatz while excluding full-chain penetration testing terms to avoid collision with R10: 完整.?渗透|从外网|打到域控|attack.?chain|full.?pentest. lines 90-92

Cloud and Container Security

Route R23 identifies Kubernetes and cloud security queries through patterns like:

kubernetes|\bk8s\b|container.?escape|docker.?escape|kube-?bench|cloud.?secur|imds|169\.254\.169\.254|容器.?逃逸|云.?安全|k8s.?渗透|s3|对象存储|存储桶

Malware Analysis and Threat Intelligence

Route R9 uses a mustAll constraint requiring sandbox to appear alongside malware indicators: malware|virus|恶意|木马|样本|cape|any\.run|triage. lines 76-78

Route R44 implements sophisticated OSINT detection, requiring social media terms (twitter|tweet|x\.com) to co-occur with threat indicators via mustAll: ioc|threat|malware|campaign|actor|phish|scam|impersonat|indicator|情报|威胁|恶意|钓鱼|诈骗|仿冒. lines 218-221

Specialized Technical Domains

Route R17 for exploit development uses boundary-aware patterns:

\bpwn\b|rop|ret2libc|heap.?overflow|stack.?overflow|buffer.?overflow|kernel.?pwn|exploit.?dev|pwntools|栈溢出|堆溢出|格式化.?字符串

Route R33 detects Go and Rust binaries through language-specific signatures:

\bgolang\b|\brustc\b|go.?binary|go.?二进|go.?语言|go.?程序|stripped.?go|gore.?sym|go.?malware|rust.?binary|go.?逆向|rust.?逆向

Matching Algorithm Implementation

The routing engine implements case-insensitive regex evaluation in Python. As implemented in the repository's dispatch logic, the matching function follows this pattern:

def matches_route(query: str, route: dict) -> bool:
    for kw in route["keywords"]:
        # `must` must be present

        if not re.search(kw["must"], query, re.I):
            continue
        # optional exclusions

        if "exclude" in kw and re.search(kw["exclude"], query, re.I):
            continue
        # optional must‑all list

        if "mustAll" in kw:
            if not all(re.search(p, query, re.I) for p in kw["mustAll"]):
                continue
        return True
    return False

The engine iterates over all routes defined in skills/config/routing.json, applies the scoring logic, and resolves ties using the priority array. The fallback route R0 captures general reverse-engineering queries, though it specifically excludes frida when APK contexts are detected to ensure proper routing to R1.

Working with the Routing System

Loading and Querying the Configuration

Developers can programmatically interact with the routing rules by loading the JSON configuration and implementing the matching logic:

import json, re, pathlib

# Load routing config

with open(
    pathlib.Path(__file__).parent / "skills/config/routing.json", encoding="utf-8"
) as f:
    routing = json.load(f)

def route_query(query: str) -> str:
    """Return the route ID that best matches the query."""
    scores = {}
    for rid, rdef in routing["routes"].items():
        if any(
            re.search(kw["must"], query, re.I)
            and not kw.get("exclude", "").strip() and not any(
                re.search(exc, query, re.I) for exc in kw.get("exclude", "").split("|")
            )
            for kw in rdef["keywords"]
        ):
            scores[rid] = scores.get(rid, 0) + 1
    # Resolve ties by priority order

    for rid in routing["priority"]:
        if rid in scores:
            return rid
    return routing["meta"]["fallbackId"]   # default fallback (R0)

# Example usage

queries = [
    "如何使用 apktool 进行 apk 反编译？",
    "想要抓取 HTTPS 请求并重放",
    "我要分析一个 Windows AD 环境的 Kerberoasting",
]
for q in queries:
    print(q, "=>", route_query(q))

Executing this script produces route classifications based on the regex patterns:

如何使用 apktool 进行 apk 反编译？ => R1
想要抓取 HTTPS 请求并重放 => R3
我要分析一个 Windows AD 环境的 Kerberoasting => R24

Summary

• Centralized Configuration: All routing logic lives in skills/config/routing.json, making the system maintainable and transparent.
• Multi-Field Matching: Routes use must for required patterns, exclude for negative filtering, and mustAll for conjunctive requirements.
• Priority-Based Resolution: When multiple routes match, the priority array determines the winner, with R0 serving as the general fallback.
• Language-Aware Patterns: The regexes support both English and Chinese technical terminology (e.g., 反编译, 抓包, 越狱).
• Extensible Architecture: New routing rules can be added by defining additional entries in the JSON without modifying the core matching engine.

Frequently Asked Questions

How does the routing engine prevent false positives between similar domains?

The engine uses exclusion patterns to disambiguate overlapping terminology. For example, Route R2 excludes 模型|提示词|llm|prompt when matching 越狱 to avoid confusion with LLM jailbreaking discussions. Similarly, Route R24 excludes full-chain penetration testing keywords to prevent Windows AD queries from routing to the general attack chain handler (R10).

What is the difference between the must and mustAll fields?

The must field requires at least one pattern to match within a keyword object. The mustAll field, present in routes like R2, R9, and R44, requires every pattern in its array to match simultaneously. For instance, Route R44 requires both social media terms and threat intelligence indicators via mustAll to trigger OSINT routing.

Where is the fallback route defined when no specific patterns match?

The fallback route R0 is defined in skills/config/routing.json with the identifier specified in the meta.fallbackId field. This route captures general reverse-engineering queries using broad patterns like ollvm|anti-?debug|unicorn|angr|gdb, though it excludes specialized domains (like APK contexts for Frida queries) to ensure more specific routes take precedence.

How can I validate that my routing rules work correctly?

The repository includes verification scripts in skills/scripts/verify-routing-coherence.ps1 that validate synchronization between the JSON configuration and documentation tables. Additionally, skills/scripts/test-routing.sh and test-routing.ps1 provide test harnesses to exercise the routing logic against sample queries, ensuring that pattern modifications do not break existing classifications.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}