# Cybersecurity Domains Covered by reverse-skill: The Complete Modular Guide > Explore over 25 cybersecurity domains in the reverse-skill modular guide, from binary reverse engineering to LLM security. Master diverse security skills efficiently. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: deep-dive - Published: 2026-08-01 --- **The reverse-skill repository organizes over 25 distinct cybersecurity domains—from binary reverse engineering to LLM security—into a modular knowledge-router architecture defined in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md).** The *reverse-skill* project serves as a comprehensive **modular knowledge-router** that consolidates specialized offensive and defensive security workflows. According to the master index at [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md), the repository structures expertise into discrete "skill" modules, each targeting specific platforms, attack phases, or analysis methodologies across the full security lifecycle. ## Core Reverse Engineering Disciplines ### Binary Analysis and Disassembly The foundation of the repository rests on **General Reverse Engineering** (`reverse-engineering/`), covering core binary triage, static and dynamic analysis, and symbolic execution using GDB, Frida, angr, Unicorn, and Qiling. For open-source alternatives, the **`radare2/`** module provides CLI-driven disassembly, patching, and binary diffing capabilities via `r2`, `rabin2`, and `radiff2`. ### Mobile Platform Reversing The repository dedicates significant coverage to **Mobile Reverse Engineering**, split between Android and iOS ecosystems. The `apk-reverse/` module handles APK unpacking, jadx decompilation, Smali patching, and Frida hooking, while `mobile-reverse/` addresses iOS jailbreak bypasses and Mach-O analysis. For Apple-specific environments, **`macos-reverse/`** covers code signing, Objective-C/Swift analysis, and LaunchAgent exploitation. ### Managed and Native Code Analysis Specialized tracks exist for high-level languages. The **`dotnet-reverse/`** module focuses on managed PE analysis, de-obfuscation using dnSpy and Sharp* tools, and IL patching. For modern system languages, **`go-rust-reverse/`** extracts symbols via `pclntab`, analyzes panic strings, and handles module de-obfuscation. The **`js-reverse/`** domain targets front-end signature location, runtime sampling, and browser CDP hooking for JavaScript and Node.js environments. ## Offensive Security Operations ### Infrastructure and Network Testing The **`pentest-tools/`** module integrates a complete penetration-testing toolchain including Nmap, Nuclei, SQLMap, FFUF, and Hashcat, exposed via MCP (Model Context Protocol) for AI-driven automation. Complementary domains include **`wifi-wireless/`** for authorized Wi-Fi assessments and handshake capture, and **`radio-sdr/`** for software-defined radio labs. ### Cloud and Container Assessment **Cloud & Container Security** (`cloud-k8s/`) encompasses IAM and IMDS assessment, container escape techniques, and Kubernetes RBAC checks. This domain addresses modern cloud-native attack surfaces alongside traditional infrastructure. ### Active Directory and Windows Environments The **`windows-ad/`** module provides comprehensive coverage of enterprise Windows environments, including Kerberos attacks, AD CS exploitation, BloodHound enumeration, relay attacks, and domain-path enumeration. For desktop applications, **`thick-client/`** analyzes C/S binaries, local storage mechanisms, IPC, and update mechanisms. ## Advanced Exploitation and Research ### Binary Exploitation and Pwn The **`pwn-chain/`** and **`patch-diff-exploit/`** modules specialize in stack, heap, and kernel exploitation, symbol migration, and N-day patch diffing for PoC generation. These components support vulnerability research workflows from binary diff to working exploit. ### Firmware and Embedded Systems **Firmware Security** (`firmware-pentest/`) follows the OWASP FSTM workflow, utilizing EMBA for extraction and QEMU for emulation. The **`hardware-security/`** domain covers UART, JTAG, and SWD extraction, ROM dumping, and firmware flashing for IoT and embedded devices. ### Evasion and Anti-Analysis The **`edr-bypass-re/`** module focuses on endpoint detection and response evasion, covering hook/ETW/AMSI evasion techniques, direct syscalls, Hell’s Gate implementations, and hardware breakpoint manipulation. ## Emerging and Specialized Domains ### LLM and AI Security The **`llm-security/`** module addresses modern AI threats including prompt injection, tool abuse, agent obedience testing, and the OWASP LLM Top 10, reflecting the repository's coverage of emerging attack surfaces. ### Supply Chain Security **`supply-chain-security/`** handles SBOM generation, dependency scanning, and CI/CD pipeline hardening, ensuring coverage of software composition analysis and build pipeline security. ### Industrial Control Systems For critical infrastructure, **`ot-ics/`** covers Purdue model segmentation and PLC/SCADA vulnerability assessment, while **`protocol-reverse/`** analyzes custom binary protocols, Protobuf, gRPC, and PCAP frame layouts. ## Defensive and Forensic Operations ### Threat Hunting and Blue Team The **`threat-hunting/`** and **`ops/`** modules support hypothesis-driven hunting, Sigma rule creation, evidence-chain management, and timeline tracking for defensive operations. ### Digital Forensics **`digital-forensics/`** provides capabilities for memory and disk timeline analysis, PCAP tracing, and incident response preservation, complementing the offensive modules with investigative capabilities. ### Code Auditing and SAST The **`code-audit/`** module implements Semgrep and CodeQL workflows for dangerous API detection and authentication review, supporting static application security testing across the development lifecycle. ## Automation and Integration Architecture The repository exposes these domains through a unified routing system. The master router at `skills/scripts/master-route.ps1` interprets natural language hints to select appropriate skill modules, while `skills/scripts/bootstrap-reverse.ps1` initializes MCP servers for tool integration. ### Selecting a Domain via the Master Router ```powershell # Route to the Android APK reverse engineering module powershell -NoProfile -ExecutionPolicy Bypass ` -File skills/scripts/master-route.ps1 -Hint "android apk reverse" ``` This script consults [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) to match hints against the domain table and returns the primary skill path (e.g., [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md)). ### Initializing Analysis Tools (IDA Pro MCP) ```powershell # Bootstrap the IDA Pro MCP server for decompilation and cross-reference analysis powershell -NoProfile -ExecutionPolicy Bypass ` -File skills/scripts/bootstrap-reverse.ps1 -Capability @('idalib-mcp') -StartServices ``` The bootstrap script references [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)—the central registry of available local tools, versions, and paths—to load required capabilities. ### Executing Penetration Tests ```powershell # Run Nmap via the integrated pentest-tools wrapper powershell -NoProfile -ExecutionPolicy Bypass ` -File skills/pentest-tools/scripts/run-nmap.ps1 -Target "10.10.10.5" ``` ### Generating Documentation ```powershell # Generate automated reports and Mermaid diagrams post-analysis powershell -NoProfile -ExecutionPolicy Bypass ` -File skills/docs-generator/scripts/generate-report.ps1 -WorkItem "case-001" ``` The `docs-generator/` and `diagram-generator/` modules assemble evidence, findings, and timelines into publication-ready documents using Graphviz and PlantUML. ## Summary - **reverse-skill** organizes cybersecurity knowledge into **25+ modular domains** spanning reverse engineering, penetration testing, and defensive operations. - The **[`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md)** master index serves as the authoritative reference for all available modules and their capabilities. - Domains cover **full-spectrum operations**: from low-level binary exploitation (`pwn-chain/`, `firmware-pentest/`) to high-level cloud security (`cloud-k8s/`) and AI safety (`llm-security/`). - **Tool integration** occurs through MCP-based servers for IDA Pro, Ghidra, and Radare2, with routing scripts automating module selection. - The repository supports **both offensive and defensive workflows**, including threat hunting, digital forensics, and code auditing. ## Frequently Asked Questions ### What is the primary purpose of the reverse-skill repository? The repository functions as a **modular knowledge-router** that systematizes cybersecurity expertise into discrete, executable skill modules. It enables both automated and manual execution of complex security workflows across reverse engineering, penetration testing, and defensive operations, with each domain documented in its respective [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file. ### How does reverse-skill organize its cybersecurity domains? Domains are organized hierarchically in **[`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md)**, grouped by analysis type, target platform, or operational phase. Each domain resides in its own subdirectory (e.g., `skills/apk-reverse/`, `skills/windows-ad/`) containing specialized tooling, documentation, and routing logic. The [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) file maps natural language queries to specific domain modules. ### Can reverse-skill be used for both offensive and defensive security operations? Yes. The repository covers **offensive capabilities** such as exploit development (`pwn-chain/`), EDR bypass (`edr-bypass-re/`), and Active Directory attacks (`windows-ad/`), alongside **defensive operations** including threat hunting (`threat-hunting/`), digital forensics (`digital-forensics/`), and code auditing (`code-audit/`). The `attack-chain/` module specifically orchestrates multi-stage operations across both disciplines. ### What tools integrate with the reverse-skill framework? The framework integrates with industry-standard tools including **IDA Pro** and **Ghidra** (via MCP servers), **Radare2**, **Frida**, **Nmap**, **BloodHound**, **Semgrep**, and **CodeQL**. Tool availability and paths are managed through [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md), while specialized modules like `pentest-tools/` and `firmware-pentest/` provide wrappers for Nuclei, SQLMap, EMBA, and QEMU.