# Reverse Engineering Skills in reverse-skill: APK, IDA Pro, Ghidra, and 12 Specialized Workflows

> Master reverse engineering with zhaoxuya520/reverse-skill. Explore 12 specialized workflows for APK analysis, IDA Pro, Ghidra, firmware, and hardware security. Enhance your skills today.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: getting-started
- Published: 2026-08-30

---

**The reverse-skill repository bundles 12 distinct reverse engineering capabilities—from Android APK analysis and IDA Pro automation to firmware penetration testing and hardware security testing—into modular, script-driven workflows under the `skills/` directory.**

The **reverse-skill** open-source project by zhaoxuya520 organizes complex reverse engineering tasks into discrete, reusable modules. Each skill encapsulates a specific **reverse engineering** workflow, complete with deterministic scripts, tool-index integration, and step-by-step documentation in individual [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files.

## Core Reverse Engineering Skills Supported

The repository structures each capability as a standalone directory under `skills/`, containing PowerShell or Bash scripts, dependency checklists, and evidence-gathering templates.

### Mobile and Application Analysis

- **apk-reverse**: Targets Android application packages for static analysis, smali patching, recompilation, and **Frida**-based dynamic hooking. Integrates `jadx`, `apktool`, `frida`, and `adb`, with optional fallback to `ida-reverse` or `radare2` for native `.so` binaries. See [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) for the complete workflow checklist.

- **mobile-reverse**: Generalized mobile binary analysis for iOS Mach-O and Android native libraries. Acts as a meta-skill delegating to underlying IDA Pro, Ghidra, or Radare2 engines based on binary type and user hints.

- **macos-reverse**: macOS-specific Mach-O reverse engineering with code-signing validation and notch-aware analysis pipelines. Maps to `ida-reverse`, `ghidra-reverse`, and `radare2` toolchains.

- **js-reverse**: JavaScript and TypeScript static analysis, including Webpack unpacking and obfuscation removal. Utilizes `node`, `js-hook-mcp`, and `deobfuscator-tool` for Chrome DevTools Protocol (CDP) and Frida hooking.

- **dotnet-reverse**: .NET and Mono assembly decompilation with IL inspection and protection bypass capabilities. Primary tooling includes `dnSpy` and `dotnet-decompiler`, with optional IDA Pro integration for mixed-mode assemblies.

### Binary Analysis and Disassembly Engines

- **ida-reverse**: Full-featured **IDA Pro** automation supporting PE, ELF, Mach-O, APK, DLL, and SO formats. Implements MCP (Model Context Protocol) server integration via `idalib-mcp`, controlled through helper scripts `start.ps1` and `open.ps1` located in `skills/ida-reverse/scripts/`.

- **ghidra-reverse**: Open-source alternative to IDA Pro emphasizing headless (batch) decompilation and script-driven analysis. Supports optional `ghidra-mcp` bridge and `ghidriff` for binary comparison. Configuration resides in [`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md).

- **radare2**: Lightweight CLI-only analysis for rapid triage when GUI tools are unavailable. Leverages `r2` and `r2pipe` for fast function listing and string extraction without overhead.

### Specialized Runtime and Firmware

- **go-rust-reverse**: Addresses stripped **Go** and **Rust** binaries through symbol recovery, name demangling, and de-obfuscation. Uses `go-decompiler`, `rust-demangle`, and `ghidriff` for differential analysis of compiled artifacts.

- **firmware-pentest**: End-to-end firmware extraction, emulation, and fuzzing pipelines. Integrates `binwalk` for extraction, `qemu` for emulation, and `angr` for symbolic execution, documented in [`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md).

- **hardware-security**: Hardware debugging interface triage including JTAG and SWD protocols. Implements `openocd` and `pyOCD` for firmware dumping from embedded devices, with guidance in [`skills/hardware-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/hardware-security/SKILL.md).

### Differential Analysis

- **binary-diff** (via `patch-diff-exploit`): Differential analysis between binary versions to locate security patches, generate exploits, and scaffold patch-based attacks. Primary tooling includes `ghidriff` and custom `binary-diff` utilities.

## Architecture and Routing System

The repository employs a centralized routing layer to dispatch user requests to the appropriate skill module. The **routing core** defined in [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) and [`routing-benchmark.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing-benchmark.json) parses user hints (e.g., "apk reverse", "ida", "firmware") and maps them to specific [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files.

The **tool-index** system—implemented via [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) and `refresh-tool-index.ps1`—auto-detects locally installed binaries and populates path mappings in `$HOME/tools/`. This enables automatic bootstrapping when a required tool is missing, handled by `skills/scripts/bootstrap-reverse.*` scripts.

Each skill enforces **evidence-gathering** through "Task Completion Self-Check" checklists, ensuring analysis artifacts (extracted strings, function signatures, reports) are recorded before workflow completion.

## Hands-On Examples for Each Skill

Below are minimal, runnable commands extracted from the repository’s script library. All paths are relative to the repository root.

### Android APK Static Analysis

Decompile Java sources and extract smali, then generate a manifest summary:

```powershell

# Decode APK and extract resources

pwsh -File "skills/apk-reverse/scripts/decode.ps1" -ApkPath "D:\Downloads\sample.apk" -Clean

# Analyze AndroidManifest.xml for permissions and entry points

pwsh -File "skills/apk-reverse/scripts/manifest-summary.ps1" -ManifestPath "apktool_out\AndroidManifest.xml"

```

### IDA Pro MCP Server Automation

Start the MCP HTTP server and open a target binary with progress monitoring:

```powershell

# Spin up the MCP server (background process)

pwsh -File "skills/ida-reverse/scripts/start.ps1"

# Open malware sample with 600-second timeout and System32 auto-copy

pwsh -File "skills/ida-reverse/scripts/open.ps1" -Path "C:\Samples\malware.exe" -TimeoutSeconds 600

```

### Headless Ghidra Batch Processing

Run unattended analysis on a directory of binaries using Ghidra’s headless analyzer:

```bash

# Import and analyze with post-script export

analyzeHeadless /home/user/ghidra_projects SampleProj \
  -import /data/binaries/sample.bin \
  -postScript ExportDecomp.py

```

### Rapid Radare2 Triage

Perform function listing and string analysis in a single command:

```bash

# Open binary, analyze functions (afl), grep strings for 'http', then quit

r2 -A sample.bin -c "afl; iz~'http'; q"

```

### Go and Rust Symbol Recovery

Execute symbol extraction against stripped binaries:

```powershell

# Recover function names from Go/Rust compiled executables

pwsh -File "skills/go-rust-reverse/scripts/extract-symbols.ps1" -BinPath "bin/myapp"

```

## Key Configuration Files and Directory Structure

| Component | File Path | Purpose |
|-----------|-----------|---------|
| **Skill Definition** | `skills/<skill>/SKILL.md` | Workflow scope, tool requirements, and step-by-step guides for each reverse engineering discipline. |
| **Routing Config** | [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Maps hint strings to specific skill directories and execution contexts. |
| **Tool Index** | `skills/scripts/refresh-tool-index.ps1` / `.sh` | Auto-detects installed tools (jadx, apktool, Ghidra, etc.) and generates path mappings. |
| **Bootstrap Scripts** | `skills/scripts/bootstrap-reverse.*` | Handles automated installation of missing dependencies. |
| **Skill Scripts** | `skills/<skill>/scripts/*.ps1` | Executable workflows (e.g., `decode.ps1`, `start.ps1`, `extract-symbols.ps1`). |
| **Evidence Templates** | `skills/*/references/*.md` | Checklists ensuring consistent artifact documentation across analyses. |

## Summary

- The **reverse-skill** repository provides **12 specialized reverse engineering skills** covering mobile, desktop, firmware, and hardware targets.
- Each skill is encapsulated under `skills/<skill-name>/` with a dedicated [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md), executable scripts, and evidence templates.
- The **routing system** ([`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md), [`routing-benchmark.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing-benchmark.json)) automatically dispatches tasks based on user hints.
- **Tool-index automation** (`refresh-tool-index.*`) handles path resolution and bootstrapping for tools like IDA Pro, Ghidra, and Frida.
- Scripts support both **interactive GUI workflows** (IDA Pro, Ghidra GUI) and **headless automation** (Ghidra headless, Radare2, batch processing).

## Frequently Asked Questions

### What specific reverse engineering tools does reverse-skill automatically configure?

The repository automatically detects and configures paths for **IDA Pro**, **Ghidra**, **Radare2**, **JADX**, **Apktool**, **Frida**, **ADB**, **dnSpy**, **Binwalk**, **QEMU**, **OpenOCD**, and **Ghidriff** through the `refresh-tool-index` scripts. If a tool is missing, the bootstrap scripts in `skills/scripts/` attempt automated installation or prompt for manual path configuration.

### How does the routing system determine which skill to execute?

The routing core consults [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) and [`routing-benchmark.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing-benchmark.json) to match user-provided hints (e.g., "apk reverse", "ida", "firmware pentest") against registered skill signatures. Once matched, it loads the corresponding [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and executes the entry-point scripts defined in that skill's `scripts/` directory.

### Can reverse-skill operate in fully headless environments without GUI access?

Yes. The **ghidra-reverse** and **radare2** skills are designed specifically for headless operation. Ghidra utilizes `analyzeHeadless` for batch processing, while Radare2 provides pure CLI analysis. Even the **ida-reverse** skill supports MCP-based automation that can run IDA Pro in automated modes without manual GUI interaction.

### Which skill should I use for analyzing stripped Go or Rust binaries?

Use the **go-rust-reverse** skill located at `skills/go-rust-reverse/`. It specializes in recovering function symbols from stripped Go binaries using `go-decompiler` and demangling Rust symbols with `rust-demangle`, outputting recovered names for import into Ghidra or IDA Pro.