# What Types of Tasks Are Covered by Routing Rules R4-R9 in reverse-skill? > Discover tasks covered by reverse-skill routing rules R4-R9. Explore VM analysis .NET deobfuscation IDA Pro radare2 firmware testing and malware analysis. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: deep-dive - Published: 2026-09-02 --- **Routing rules R4 through R9 in the reverse-skill framework handle six specialized reverse-engineering domains: custom virtual machine analysis, .NET binary deobfuscation, IDA Pro static analysis, radare2 workflows, firmware penetration testing, and comprehensive malware analysis.** The `reverse-skill` repository uses a priority-based routing system defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to automatically direct user requests to the appropriate skill module. Rules R4-R9 occupy specific priority slots after mobile and frontend rules, ensuring that complex binary analysis, decompilation, and security assessment tasks reach the correct specialized handlers. ## R4 – DSL VM Reverse Engineering Rule R4 targets **custom virtual machine analysis**, specifically domain-specific language (DSL) VMs and opcode-based interpreters often encountered in proprietary malware or firmware. According to the [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) definition at lines 36-42, this rule activates when users reference keywords such as `dsl vm`, `fireye`, `opcode vm`, `custom vm`, or the Chinese term `自定义虚拟机`. When triggered, the router loads [`reverse-engineering/dsl-vm-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reverse-engineering/dsl-vm-reverse/SKILL.md), providing workflows for reconstructing VM instruction sets and analyzing bytecode structures. ## R5 – .NET Reverse Engineering Rule R5 governs **.NET binary analysis and deobfuscation**, covering everything from C# decompilation to unpacking ConfuserEx-protected assemblies. The rule definition at lines 44-48 maps keywords including `.net`, `dnspy`, `de4dot`, `confuserex`, `csharp`, `dotnet`, and `c#` to the [`dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/dotnet-reverse/SKILL.md) module. This skill handles static analysis of managed code, unpacking obfuscated binaries, and navigating .NET metadata structures for reverse-engineering tasks. ## R6 – IDA Pro Binary Analysis Rule R6 provides comprehensive **static binary analysis using IDA Pro** (and compatible tools) for native ELF/SO binaries, JNI libraries, and low-level firmware components. Defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) at lines 50-55, R6 matches keywords such as `ida`, `decompile`, `disassembl`, `.so`, `.elf`, `jni`, and Chinese terms like `反编译` (decompile) and `静态分析二进制` (static binary analysis). The associated [`ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ida-reverse/SKILL.md) module delivers workflows for disassembly, pseudocode generation, and native library inspection. ## R7 – radare2 Suite Workflows Rule R7 specializes in **open-source binary analysis using the radare2 ecosystem**. Lines 57-63 in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) define this route with an extensive keyword list including `radare`, `r2`, `r2xsql`, `r2mcp`, `rabin2`, `rasm2`, `radiff2`, `rahash2`, and `rax2`. When invoked, the system loads [`radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/radare2/SKILL.md), enabling scripted disassembly, debugging, diffing, and binary manipulation workflows through the radare2 command-line interface and its auxiliary tools. ## R8 – Firmware Penetration Testing Rule R8 focuses on **embedded firmware extraction and vulnerability assessment**. Defined at lines 66-70, this rule responds to keywords like `firmware`, `binwalk`, `iot`, `emba`, `firmadyne`, `固件` (firmware), `路由器固件` (router firmware), and `嵌入式` (embedded). The [`firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/firmware-pentest/SKILL.md) module guides users through firmware unpacking, filesystem extraction using Binwalk, emulation with Firmadyne, and IoT vulnerability scanning techniques. ## R9 – Malware Analysis Rule R9 covers **full-stack static and dynamic malware analysis**, including sandbox execution and YARA rule development. Lines 73-78 in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) map terms such as `malware`, `yara`, `virus sample`, `pe-sieve`, `cape sandbox`, `恶意软件` (malicious software), `病毒样本` (virus sample), `木马分析` (trojan analysis), `ransomware`, `webshell`, and `backdoor` to the [`malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/malware-analysis/SKILL.md) module. This skill provides capabilities for behavioral analysis, memory forensics, and automated sandbox submission of suspicious binaries. ## Routing Priority and Selection Logic The master routing script processes the `keywords` arrays sequentially according to the priority list defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). Rules R4-R9 appear after higher-priority mobile and JavaScript rules (R1-R3), ensuring that ambiguous hints containing terms like "apk" route to mobile analysis rather than firmware extraction. The system selects the **PRIMARY** route by scanning keyword arrays until the first match is found. This ordering guarantees that requests specifically targeting custom VMs, .NET assemblies, IDA workflows, radare2 usage, firmware images, or malware samples reach the appropriate specialized handlers without collision. ## Triggering R4-R9 via Command Line You can test each routing rule by invoking the master routing script with hints containing the specific keywords. Replace `` with phrases matching the target domain: ```bash # Trigger R4: DSL VM analysis bash skills/scripts/master-route.sh --hint "analyse custom vm opcode" # Trigger R5: .NET deobfuscation bash skills/scripts/master-route.sh --hint "decrypt obfuscated .net binary" # Trigger R6: IDA Pro static analysis bash skills/scripts/master-route.sh --hint "static analysis of native .so file" # Trigger R7: radare2 workflow bash skills/scripts/master-route.sh --hint "use r2 to disassemble ELF" # Trigger R8: Firmware extraction bash skills/scripts/master-route.sh --hint "extract firmware with binwalk" # Trigger R9: Malware scanning bash skills/scripts/master-route.sh --hint "run yara scan on ransomware sample" ``` For Windows environments, execute the corresponding PowerShell commands as documented in [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md). ## Summary - **R4** handles custom and domain-specific virtual machine reverse engineering via [`reverse-engineering/dsl-vm-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reverse-engineering/dsl-vm-reverse/SKILL.md). - **R5** manages .NET binary deobfuscation and C# analysis through [`dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/dotnet-reverse/SKILL.md). - **R6** enables IDA Pro-centric static analysis of native binaries and JNI libraries using [`ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ida-reverse/SKILL.md). - **R7** provides radare2-based disassembly and debugging workflows via [`radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/radare2/SKILL.md). - **R8** covers firmware extraction and IoT penetration testing through [`firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/firmware-pentest/SKILL.md). - **R9** delivers comprehensive malware analysis capabilities including YARA and sandbox integration via [`malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/malware-analysis/SKILL.md). ## Frequently Asked Questions ### What file defines routing rules R4-R9 in reverse-skill? The [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) file serves as the single source of truth, with R4 defined at lines 36-42, R5 at 44-48, R6 at 50-55, R7 at 57-63, R8 at 66-70, and R9 at 73-78. ### How does the routing system decide between R4-R9 when keywords overlap? The master routing script evaluates rules in priority order, selecting the first route whose `keywords` array matches the user hint. R4-R9 occupy sequential slots after R1-R3, ensuring specific binary analysis terms take precedence over general mobile or web keywords only when those higher-priority terms are absent. ### What distinguishes R6 (IDA reverse) from R7 (radare2)? R6 targets commercial-grade static analysis with IDA Pro and related decompilation workflows for ELF/SO files and JNI components, while R7 specifically handles open-source radare2 ecosystem commands including `rabin2`, `rasm2`, and `radiff2` for scriptable disassembly and binary diffing. ### Can I trigger firmware analysis using Chinese keywords? Yes, R8 explicitly includes Chinese terms such as `固件`, `路由器固件`, and `嵌入式` in its keyword definition at lines 66-70, allowing native Chinese language hints to correctly route to the [`firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/firmware-pentest/SKILL.md) module.