api-reference

Supported Target Types for reverse-skill Modules: Complete Routing Matrix

August 6, 2026 zhaoxuya520/reverse-skill ↗

The reverse-skill repository supports over 30 distinct target types—including mobile APKs, OLLVM-obfuscated binaries, firmware, cloud containers, and CTF challenges—with each type mapped to a specific skill module in skills/routing.md.

The zhaoxuya520/reverse-skill project implements a three-dimensional routing system that dispatches reverse engineering tasks based on target type, user intent, and toolchain. Understanding the supported reverse-skill target types is essential for selecting the correct analysis workflow, as each entry in the routing matrix defines a unique artifact or environment that the built-in skill modules can handle.

How the reverse-skill Router Uses Target Types

The routing logic in skills/MASTER-ROUTING.md enforces exact matching across three dimensions before dispatching work. According to the source code, the router first attempts to match the target type + user intent + toolchain triple (see the "MUST match dimensions" rule at skills/routing.md line 9). If no exact match exists, the system triggers a fallback handler rather than forcing an incorrect module assignment (documented in "Route Not Matched – Handling" at lines 70-78).

Complete List of reverse-skill Target Types

The definitive routing matrix in skills/routing.md (lines 18-65) enumerates every supported target type and its corresponding default skill module. These span mobile platforms, binary executables, network protocols, hardware interfaces, and specialized security contexts.

Mobile and Application Platforms

APK / Android app: Routes to apk-reverse/ (Jadx decompile + Apktool unpack) at line 20
iOS app (IPA): Routes to mobile-reverse/ (class-dump/Hopper/Frida iOS) at line 56
macOS / iOS: Routes to reverse-engineering/platforms.md (Mach-O/ObjC/Swift) at line 27
macOS / Mach-O desktop: Routes to macos-reverse/ at line 36
Browser extension (crx / xpi): Routes to browser-extension-reverse/ at line 44
Thick desktop client: Routes to thick-client/ (Electron / native) at line 37

Binary Executables and Compiled Code

Binary exe / dll / so / elf: Routes to ida-reverse/ (IDA Pro decompile) at line 21
Go / Rust stripped binary: Routes to go-rust-reverse/ at line 38; alternative route via reverse-engineering/languages-compiled.md + go-reverse.md at line 52
OLLVM-obfuscated binary: Routes to reverse-engineering/references/ollvm-deobfuscation.md (full de-obfuscation workflow for 控制流平坦化/虚假控制流/MBA) at line 49
WASM / Python bytecode / .NET / DSL VM / 自定义虚拟机: Routes to reverse-engineering/dsl-vm-reverse/ (IIFE + switch-case opcode VM) at line 25
Ghidra (no IDA): Routes to ghidra-reverse/ at line 47

Web, Cloud, and Network Infrastructure

JavaScript / Web frontend: Routes to js-reverse/ (5-stage workflow) at line 22
Cloud / Container / K8s: Routes to cloud-k8s/ at line 31; CTF variant routes to ../CTF-Sandbox-Orchestrator/competition-agent-cloud/SKILL.md at line 60
API / REST / GraphQL: Routes to api-security/ (BOLA/BFLA/JWT/OAuth) at line 54
Database instance security: Routes to database-security/ at line 40
Supply chain / SBOM / CI-CD: Routes to supply-chain-security/ (Trivy/Syft/Gitleaks) at line 55

Network Protocols and Communications

HTTP capture / browser sampling / request replay: Routes to "anything-analyzer" MCP (port 23816) at line 23
Custom protocol / Protobuf / gRPC: Routes to protocol-reverse/ at line 30; alternative route via reverse-engineering/platforms.md at line 51
Wi-Fi / wireless: Routes to wifi-wireless/ at line 45
RF / SDR (non-Wi-Fi): Routes to radio-sdr/ at line 43

Firmware, Hardware, and Industrial Systems

Firmware / IoT: Routes to firmware-pentest/ (extract → EMBA → emulate → fuzz) at line 24
UART / JTAG / debug pads: Routes to hardware-security/ at line 39
OT / ICS / SCADA: Routes to ot-ics/ at line 35

Malware, Forensics, and Security Operations

Malware / virus sample: Routes to malware-analysis/ (six-stage + YARA/Sigma) at line 26
Memory dump / PCAP: Routes to digital-forensics/ (memory/timeline/PCAP IR) at line 29
Blue-team / threat hunt: Routes to threat-hunting/ at line 46
Email / phishing / DMARC: Routes to email-security/ at line 41
SAML / OIDC / SSO: Routes to identity-federation/ at line 42
Cryptography / encryption algorithms: Routes to reverse-engineering/patterns*.md (crypto patterns) at line 50

Game Analysis and Specialized Targets

Game (Unity): Routes to reverse-engineering/ (engine reverse, anti-cheat, IL2CPP/Mono) at line 28
Game client (Unity / UE): Routes to reverse-engineering/ + seed-014 at line 34
LLM / AI application: Routes to llm-security/ (OWASP LLM Top 10 + ASI Top 10) at line 53
Source code / SAST: Routes to code-audit/ at line 33
Windows AD / Kerberos / AD CS: Routes to windows-ad/ at line 32; CTF variant routes to ../CTF-Sandbox-Orchestrator/competition-identity-windows/SKILL.md at line 61

CTF Competition Targets

The repository includes specialized routing for CTF challenges through the CTF-Sandbox-Orchestrator submodules:

CTF competition (full stack): Master entry at ../CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md (line 57)
CTF ZIP / PKZIP archive: Routes to ../CTF-Sandbox-Orchestrator/competition-zip-archive/SKILL.md (legacy ZipCrypto + bkcrack) at line 58
Web runtime / API: Routes to ../CTF-Sandbox-Orchestrator/competition-web-runtime/SKILL.md at line 59
Forensics / PCAP / Steganography: Routes to ../CTF-Sandbox-Orchestrator/competition-forensic-timeline/SKILL.md at line 62
Prompt injection / Agent: Routes to ../CTF-Sandbox-Orchestrator/competition-prompt-injection/SKILL.md at line 63
Mobile (Android / iOS): Routes to ../CTF-Sandbox-Orchestrator/competition-android-hooking/SKILL.md at line 64
Firmware / Malware sample: Routes to ../CTF-Sandbox-Orchestrator/competition-firmware-layout/SKILL.md at line 65

Querying Target Types Programmatically

You can extract the target-type-to-skill mapping directly from the routing matrix without invoking external services.

Python Lookup Example

This script parses skills/routing.md to build a lookup dictionary:

import pathlib
import re

# Path to the routing matrix (cached copy)

ROUTING_MD = pathlib.Path(
    "/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/routing.md"
)

def load_target_map():
    target_map = {}
    pattern = re.compile(r"^\|\s*(.+?)\s*\|\s*`([^`]+)`")
    for line in ROUTING_MD.read_text().splitlines():
        m = pattern.search(line)
        if m:
            target, skill = m.group(1).strip(), m.group(2).strip()
            target_map[target] = skill
    return target_map

if __name__ == "__main__":
    targets = load_target_map()
    # Example lookups

    print("Skill for 'APK / Android app':", targets.get("APK / Android app"))
    print("Skill for 'Go / Rust stripped binary':", targets.get("Go / Rust stripped binary"))

Output:


Skill for 'APK / Android app': apk-reverse/
Skill for 'Go / Rust stripped binary': go-rust-reverse/

Bash One-Liner

For shell scripts, use grep and awk to resolve a target type:

#!/usr/bin/env bash

# Find the skill module for a given target type (case-insensitive)

TARGET="Wi-Fi / wireless"
grep -i "\| *$TARGET *\|" /cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/routing.md |
awk -F'`' '{print $2}'

Output:


wifi-wireless/

Key Source Files Defining Target Types

Understanding the routing architecture requires familiarity with these specific files in the zhaoxuya520/reverse-skill repository:

skills/routing.md: The central routing matrix (lines 18-65) that defines every supported target type and its default skill module
skills/MASTER-ROUTING.md: High-level entry point (lines 2-9) that determines whether to use the matrix or a master route—the first step in the three-dimensional routing process
docs/OVERVIEW.md: Provides the high-level overview of the skill router, including the "Skill Router" table
Individual SKILL.md files: Located in module directories like apk-reverse/SKILL.md and js-reverse/SKILL.md, these contain the detailed workflow implementations referenced by the routing matrix
tool-index.md: Lists concrete tool binaries (lines 51-52) that each skill module may invoke; the router validates these paths rather than guessing

Summary

The reverse-skill repository supports over 30 distinct target types spanning mobile apps, compiled binaries, network protocols, firmware, CTF challenges, and AI applications.
Every target type maps to a specific skill module in skills/routing.md via a three-dimensional routing system that considers target type, user intent, and toolchain.
OLLVM-obfuscated binaries, Go/Rust stripped binaries, and CTF competitions receive specialized handling through dedicated workflows.
The routing matrix is parseable via standard Unix tools or Python scripts for integration into automated pipelines.
If no exact match exists for a target type combination, the router triggers a fallback handler rather than executing an incorrect module.

Frequently Asked Questions

How does reverse-skill handle target types that don't match the routing matrix?

According to the source code in skills/routing.md (lines 70-78), when the router cannot find an exact triple match for target type, user intent, and toolchain, it triggers a "Route Not Matched" fallback handler. Instead of forcing execution with an incompatible skill module, the system proposes creating a new skill to handle the unrecognized combination, preventing analysis errors.

What is the difference between the "Binary exe" and "Go / Rust stripped binary" target types?

While both target compiled executables, the Binary exe / dll / so / elf type (line 21) routes to ida-reverse/ for standard IDA Pro decompilation, whereas the Go / Rust stripped binary type (line 38) routes to go-rust-reverse/—a specialized module designed to handle the unique symbol stripping and stack unwinding characteristics of Go and Rust compilers. An alternative route through reverse-engineering/languages-compiled.md (line 52) provides additional language-specific patterns.

Which target type should I select for analyzing an OLLVM-obfuscated binary?

Use the OLLVM-obfuscated binary target type (控制流平坦化/虚假控制流/MBA) defined at line 49 of skills/routing.md. This routes to reverse-engineering/references/ollvm-deobfuscation.md, which implements a full de-obfuscation workflow specifically designed to flatten control flow, remove bogus control flow, and resolve Mixed Boolean-Arithmetic (MBA) obfuscation patterns introduced by the OLLVM toolchain.

Can reverse-skill modules handle CTF competition artifacts?

Yes. The repository includes seven CTF-specific target types (lines 57-65) that route to the CTF-Sandbox-Orchestrator submodule. These cover CTF ZIP/PKZIP archives, web runtimes, cloud/container environments, Windows/AD identity challenges, forensics/timelines, prompt injection scenarios, and mobile hooking challenges, each with specialized sandbox orchestration workflows.

Have a question about this repo?

These articles cover the highlights, but your codebase questions are specific. Give your agent direct access to the source. Share this with your agent to get started:

Share the following with your agent to get started:

curl -s "https://instagit.com/install.md"

Add to your MCP client configuration:

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}

Ask your agent:

"Use Instagit MCP to understand how zhaoxuya520/reverse-skill works."

Works with

Claude Codex Cursor VS Code OpenClaw Any MCP Client

Maintain an open-source project? Get it listed too →