What Types of Tasks Are Covered by Routing Rules R4-R9 in reverse-skill?

Routing rules R4 through R9 in the reverse-skill framework handle six specialized reverse-engineering domains: custom virtual machine analysis, .NET binary deobfuscation, IDA Pro static analysis, radare2 workflows, firmware penetration testing, and comprehensive malware analysis.

The reverse-skill repository uses a priority-based routing system defined in skills/config/routing.json to automatically direct user requests to the appropriate skill module. Rules R4-R9 occupy specific priority slots after mobile and frontend rules, ensuring that complex binary analysis, decompilation, and security assessment tasks reach the correct specialized handlers.

R4 – DSL VM Reverse Engineering

Rule R4 targets custom virtual machine analysis, specifically domain-specific language (DSL) VMs and opcode-based interpreters often encountered in proprietary malware or firmware. According to the routing.json definition at lines 36-42, this rule activates when users reference keywords such as dsl vm, fireye, opcode vm, custom vm, or the Chinese term 自定义虚拟机.

When triggered, the router loads reverse-engineering/dsl-vm-reverse/SKILL.md, providing workflows for reconstructing VM instruction sets and analyzing bytecode structures.

R5 – .NET Reverse Engineering

Rule R5 governs .NET binary analysis and deobfuscation, covering everything from C# decompilation to unpacking ConfuserEx-protected assemblies. The rule definition at lines 44-48 maps keywords including .net, dnspy, de4dot, confuserex, csharp, dotnet, and c# to the dotnet-reverse/SKILL.md module.

This skill handles static analysis of managed code, unpacking obfuscated binaries, and navigating .NET metadata structures for reverse-engineering tasks.

R6 – IDA Pro Binary Analysis

Rule R6 provides comprehensive static binary analysis using IDA Pro (and compatible tools) for native ELF/SO binaries, JNI libraries, and low-level firmware components. Defined in routing.json at lines 50-55, R6 matches keywords such as ida, decompile, disassembl, .so, .elf, jni, and Chinese terms like 反编译 (decompile) and 静态分析二进制 (static binary analysis).

The associated ida-reverse/SKILL.md module delivers workflows for disassembly, pseudocode generation, and native library inspection.

R7 – radare2 Suite Workflows

Rule R7 specializes in open-source binary analysis using the radare2 ecosystem. Lines 57-63 in routing.json define this route with an extensive keyword list including radare, r2, r2xsql, r2mcp, rabin2, rasm2, radiff2, rahash2, and rax2.

When invoked, the system loads radare2/SKILL.md, enabling scripted disassembly, debugging, diffing, and binary manipulation workflows through the radare2 command-line interface and its auxiliary tools.

R8 – Firmware Penetration Testing

Rule R8 focuses on embedded firmware extraction and vulnerability assessment. Defined at lines 66-70, this rule responds to keywords like firmware, binwalk, iot, emba, firmadyne, 固件 (firmware), 路由器固件 (router firmware), and 嵌入式 (embedded).

The firmware-pentest/SKILL.md module guides users through firmware unpacking, filesystem extraction using Binwalk, emulation with Firmadyne, and IoT vulnerability scanning techniques.

R9 – Malware Analysis

Rule R9 covers full-stack static and dynamic malware analysis, including sandbox execution and YARA rule development. Lines 73-78 in routing.json map terms such as malware, yara, virus sample, pe-sieve, cape sandbox, 恶意软件 (malicious software), 病毒样本 (virus sample), 木马分析 (trojan analysis), ransomware, webshell, and backdoor to the malware-analysis/SKILL.md module.

This skill provides capabilities for behavioral analysis, memory forensics, and automated sandbox submission of suspicious binaries.

Routing Priority and Selection Logic

The master routing script processes the keywords arrays sequentially according to the priority list defined in routing.json. Rules R4-R9 appear after higher-priority mobile and JavaScript rules (R1-R3), ensuring that ambiguous hints containing terms like "apk" route to mobile analysis rather than firmware extraction.

The system selects the PRIMARY route by scanning keyword arrays until the first match is found. This ordering guarantees that requests specifically targeting custom VMs, .NET assemblies, IDA workflows, radare2 usage, firmware images, or malware samples reach the appropriate specialized handlers without collision.

Triggering R4-R9 via Command Line

You can test each routing rule by invoking the master routing script with hints containing the specific keywords. Replace <hint> with phrases matching the target domain:

# Trigger R4: DSL VM analysis

bash skills/scripts/master-route.sh --hint "analyse custom vm opcode"

# Trigger R5: .NET deobfuscation

bash skills/scripts/master-route.sh --hint "decrypt obfuscated .net binary"

# Trigger R6: IDA Pro static analysis

bash skills/scripts/master-route.sh --hint "static analysis of native .so file"

# Trigger R7: radare2 workflow

bash skills/scripts/master-route.sh --hint "use r2 to disassemble ELF"

# Trigger R8: Firmware extraction

bash skills/scripts/master-route.sh --hint "extract firmware with binwalk"

# Trigger R9: Malware scanning

bash skills/scripts/master-route.sh --hint "run yara scan on ransomware sample"

For Windows environments, execute the corresponding PowerShell commands as documented in AGENTS.md.

Summary

• R4 handles custom and domain-specific virtual machine reverse engineering via reverse-engineering/dsl-vm-reverse/SKILL.md.

• R5 manages .NET binary deobfuscation and C# analysis through dotnet-reverse/SKILL.md.

• R6 enables IDA Pro-centric static analysis of native binaries and JNI libraries using ida-reverse/SKILL.md.

• R7 provides radare2-based disassembly and debugging workflows via radare2/SKILL.md.

• R8 covers firmware extraction and IoT penetration testing through firmware-pentest/SKILL.md.

• R9 delivers comprehensive malware analysis capabilities including YARA and sandbox integration via malware-analysis/SKILL.md.

Frequently Asked Questions

What file defines routing rules R4-R9 in reverse-skill?

The skills/config/routing.json file serves as the single source of truth, with R4 defined at lines 36-42, R5 at 44-48, R6 at 50-55, R7 at 57-63, R8 at 66-70, and R9 at 73-78.

How does the routing system decide between R4-R9 when keywords overlap?

The master routing script evaluates rules in priority order, selecting the first route whose keywords array matches the user hint. R4-R9 occupy sequential slots after R1-R3, ensuring specific binary analysis terms take precedence over general mobile or web keywords only when those higher-priority terms are absent.

What distinguishes R6 (IDA reverse) from R7 (radare2)?

R6 targets commercial-grade static analysis with IDA Pro and related decompilation workflows for ELF/SO files and JNI components, while R7 specifically handles open-source radare2 ecosystem commands including rabin2, rasm2, and radiff2 for scriptable disassembly and binary diffing.

Can I trigger firmware analysis using Chinese keywords?

Yes, R8 explicitly includes Chinese terms such as 固件, 路由器固件, and 嵌入式 in its keyword definition at lines 66-70, allowing native Chinese language hints to correctly route to the firmware-pentest/SKILL.md module.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}