Reverse Skill

https://github.com/zhaoxuya520/reverse-skill
Admin
Reverse Skill is a cybersecurity skills router and tool orchestration system that guides AI coding...
Tokens:150,544
Snippets:1,779
Trust Score:9.1
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Initialize Project

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/references/templates.md

Standard command sequence to install dependencies and start the development server.

```bash
yarn install && yarn dev
```

--------------------------------

### Setup Ghidra directory

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md

Prepares the directory for manual Ghidra installation.

```bash
mkdir -p ~/tools/ghidra
# Download latest release from https://github.com/NationalSecurityAgency/ghidra/releases
# unzip ghidra_*.zip into ~/tools/ghidra
```

--------------------------------

### Initialize anything-analyzer

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

Commands to install dependencies and start the development server for anything-analyzer.

```powershell
pnpm install
pnpm dev
```

--------------------------------

### Manual Tool Installation Guide

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md

Instructions for installing essential penetration testing tools when Docker is not available.

```markdown
⚠️ **渗透工具未安装**

**推荐方案（需要 Docker）**：
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**轻量方案（逐个安装）**：
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: 从 https://github.com/ffuf/ffuf/releases 下载

**安装后告诉我，我继续当前任务。**
```

--------------------------------

### Setup and Run Firmware Analysis Toolkit

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emulation-and-fuzz.md

Commands to clone, install, configure, and execute the Firmware Analysis Toolkit.

```bash
git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat
cd ~/tools/fat
sudo pip3 install -r requirements.txt

# 编辑 fat.config 指向 Firmadyne 路径
vim fat.config

# 跑
sudo ./fat.py /path/to/firmware.bin
```

--------------------------------

### Setup and Emulation for AArch64

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/platforms-hardware.md

Commands to install toolchains, run binaries via QEMU, and debug using GDB.

```bash
# Install cross-toolchain and emulator
apt install gcc-aarch64-linux-gnu gdb-multiarch qemu-user-static

# Run AArch64 binary on x86 host
qemu-aarch64-static -L /usr/aarch64-linux-gnu/ ./arm64_binary

# Debug with GDB
qemu-aarch64-static -g 12345 -L /usr/aarch64-linux-gnu/ ./arm64_binary &
gdb-multiarch -ex 'set arch aarch64' -ex 'target remote :1234' ./arm64_binary

# With library preloading (for challenges that ship libc)
qemu-aarch64-static -g 12345 -E LD_PRELOAD=./libc.so.6 -L ./lib ./arm64_binary
```

--------------------------------

### Setup Unicorn Emulation

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md

Initializes a 64-bit x86 Unicorn instance, maps memory segments, and starts execution.

```python
from unicorn import *
from unicorn.x86_const import *

mu = Uc(UC_ARCH_X86, UC_MODE_64)

# Map code segment
mu.mem_map(0x400000, 0x10000)
mu.mem_write(0x400000, code_bytes)

# Map stack
mu.mem_map(0x7fff0000, 0x10000)
mu.reg_write(UC_X86_REG_RSP, 0x7fff0000 + 0xff00)

# Run
mu.emu_start(start_addr, end_addr)
```

--------------------------------

### Install radare2 from source

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md

Clones the repository and runs the installation script for radare2.

```bash
git clone https://github.com/radareorg/radare2 ~/tools/radare2-src
cd ~/tools/radare2-src
sys/install.sh
r2 -v
```

--------------------------------

### Qiling Installation

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-dynamic.md

Commands to install the Qiling framework and download the necessary root filesystem.

```bash
pip install qiling
# Download rootfs for target OS:
git clone https://github.com/qilingframework/rootfs
```

--------------------------------

### Setup Android platform-tools

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md

Prepares the directory and adds Android platform-tools to the PATH.

```bash
mkdir -p ~/tools/android-platform-tools
# Download platform-tools-latest-linux.zip from Android Developers
# unzip into ~/tools/android-platform-tools
export PATH="$HOME/tools/android-platform-tools/platform-tools:$PATH"
adb version
```

--------------------------------

### Install ordinary capabilities

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md

Installs specified capabilities without configuring an Agent client.

```bash
bash skills/scripts/bootstrap-reverse.sh jadx apktool frida
```

--------------------------------

### Install anything-analyzer

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Clone and build the anything-analyzer tool.

```bash
mkdir -p ~/tools
git clone https://github.com/Mouseww/anything-analyzer ~/tools/anything-analyzer
cd ~/tools/anything-analyzer
corepack enable
pnpm install
pnpm dev
```

--------------------------------

### Install capabilities

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Installs specified capabilities without configuring an MCP client.

```bash
/bin/bash skills/scripts/bootstrap-reverse.sh jadx apktool frida
```

--------------------------------

### Install Frida Tools

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-dynamic.md

Install the necessary Frida packages and verify the installation.

```bash
pip install frida-tools frida
# Verify
frida --version
```

--------------------------------

### Install Frida via pipx

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Install Frida tools and verify the installation.

```bash
pipx install frida-tools
frida --version
frida-ps --version
```

--------------------------------

### Example User Request

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/OVERVIEW.md

A sample prompt for initiating an APK signature verification analysis.

```text
Analyze the signature verification logic in this APK.
```

--------------------------------

### Install reverse-skill toolchain

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/RELEASE_NOTES_v1.0.0.md

Clone the repository and execute the platform-specific script to refresh the tool index.

```bash
git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill
# Windows
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1
# Linux / macOS
bash skills/scripts/refresh-tool-index.sh
```

--------------------------------

### Fetch Resource via API

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/references/templates.md

Example of performing a GET request with query parameters using the API client.

```typescript
const { data } = await api.get("/resource", { limit: 10 });
```

--------------------------------

### Start IDA Pro Chain

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

Commands to start the IDA MCP HTTP service and open a target sample file.

```powershell
# Start the IDA MCP HTTP service
powershell -File "<SKILL_ROOT>\ida-reverse\scripts\start.ps1"

# Open a sample
powershell -File "<SKILL_ROOT>\ida-reverse\scripts\open.ps1" -Path "C:\path\to\sample.exe" -TimeoutSeconds 600
```

--------------------------------

### Install angr

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-dynamic.md

Install the angr framework using pip.

```bash
pip install angr
```

--------------------------------

### Register MCP clients

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Installs capabilities and registers them with a specific MCP host.

```bash
/bin/bash skills/scripts/bootstrap-reverse.sh jshookmcp --mcp-host=codex
/bin/bash skills/scripts/bootstrap-reverse.sh anything-analyzer --mcp-host=claude
/bin/bash skills/scripts/bootstrap-reverse.sh burpsuite-mcp --mcp-host=both
```

--------------------------------

### Install and use GDB extensions

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-advanced.md

Commands for setting up and utilizing pwndbg and GEF for enhanced debugging.

```bash
# pwndbg (most popular for CTF)
# https://github.com/pwndbg/pwndbg
git clone https://github.com/pwndbg/pwndbg && cd pwndbg && ./setup.sh

# Key pwndbg commands:
pwndbg> context           # Show registers, stack, code, backtrace
pwndbg> vmmap             # Memory map (like /proc/self/maps)
pwndbg> search -s "flag{" # Search memory for string
pwndbg> telescope $rsp 20 # Smart stack dump
pwndbg> cyclic 200        # Generate De Bruijn pattern
pwndbg> hexdump $rdi 64   # Pretty hex dump
pwndbg> got               # Show GOT entries
pwndbg> plt               # Show PLT entries

# GEF (alternative)
# https://github.com/hugsy/gef
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

# Key GEF commands:
gef> xinfo $rdi           # Detailed info about address
gef> checksec             # Binary security features
gef> heap chunks          # Heap chunk listing
gef> pattern create 100   # De Bruijn pattern
```

--------------------------------

### Install Homebrew and baseline security tools

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Installs the Homebrew package manager and a comprehensive suite of security and development utilities.

```bash
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

brew install \
  git curl wget jq unzip gnu-tar \
  python node openjdk \
  jadx apktool android-platform-tools \
  radare2 graphviz plantuml \
  nmap sqlmap ffuf hashcat binwalk

python3 -m pip install --user pipx
python3 -m pipx ensurepath
```

--------------------------------

### Structured Guidance Template

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

The required format for communicating installation failures to the user.

```markdown
⚠️ **[Tool Name] automatic installation failed. Manual action is required.**

**Problem**: [Specific error message]

**Possible causes**:
- [Cause 1, e.g. network unavailable]
- [Cause 2, e.g. missing prerequisite]

**Manual installation steps**:
1. [Step 1]
2. [Step 2]

**After verification succeeds, tell me and I will continue the current task.**
```

--------------------------------

### Install src-hunter via Marketplace

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/README.en.md

Commands to add and install the skill using the Claude Code plugin manager.

```bash
/plugin marketplace add MyuriKanao/src-hunter-skill
/plugin install src-hunter@src-hunter
```

--------------------------------

### Install baseline security tools on Debian-based Linux

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md

Installs essential system utilities, language runtimes, and security tools via apt, followed by configuring pipx for Python tool isolation.

```bash
sudo apt update
sudo apt install -y \
  git curl wget ca-certificates unzip tar jq \
  python3 python3-venv python3-pip pipx \
  openjdk-17-jdk nodejs npm \
  graphviz plantuml nmap sqlmap ffuf hashcat binwalk

python3 -m pipx ensurepath
```

--------------------------------

### Emulate ARM Binaries

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/platforms.md

Setup cross-toolchains and use QEMU to emulate ARM binaries for debugging.

```bash
# Cross-toolchain
apt install gcc-arm-linux-gnueabihf gdb-multiarch

# QEMU emulation
qemu-arm -L /usr/arm-linux-gnueabihf/ ./arm_binary
qemu-arm -g 1234 ./arm_binary    # Start GDB server on port 1234
gdb-multiarch -ex 'target remote :1234' ./arm_binary

# ARM vs Thumb: ARM instructions are 4 bytes, Thumb are 2 bytes
# LSB of function pointer indicates mode: 0=ARM, 1=Thumb
# Ghidra: Right-click → Processor Options → ARM/Thumb mode
```

--------------------------------

### Rebuild, Sign, and Install with rebuild-sign-install.ps1

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md

Handles the full lifecycle of rebuilding an APK, including alignment, signing, and optional installation.

```powershell
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
```

--------------------------------

### Qiling Basic Emulation

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-dynamic.md

Examples of emulating Linux, Windows, and ARM/MIPS binaries using the Qiling framework.

```python
from qiling import Qiling
from qiling.const import QL_VERBOSE

# Linux ELF emulation
ql = Qiling(["./binary", "arg1"], "rootfs/x8664_linux",
            verbose=QL_VERBOSE.DEFAULT)
ql.run()

# Windows PE emulation (no Windows needed!)
ql = Qiling(["rootfs/x86_windows/bin/binary.exe"], "rootfs/x86_windows")
ql.run()

# ARM/MIPS emulation (IoT firmware)
ql = Qiling(["rootfs/arm_linux/bin/binary"], "rootfs/arm_linux")
ql.run()
```

--------------------------------

### Manage Python environments with uv

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/UV-AND-DOWNLOAD-SECURITY.md

Commands for creating a virtual environment and installing dependencies using uv.

```bash
uv venv
uv pip install -r requirements.txt
```

--------------------------------

### Example Configuration Report Format

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

The standard output format for the configuration report after platform detection and rules loading.

```markdown
✅ **Reverse-Engineering Skill Routing Pack Configured Successfully**

**Installation path**: C:\Users\xxx\Desktop\reverse-skill
**System detected**: Windows / Kali Linux / generic Linux / macOS / other
**Deployment document**: <actual platform document read>
**Tool status**:
- Available: node, python, pip, ...
- Missing (auto-install when needed): jadx, radare2, ...
- Missing (manual installation required): zipalign, apksigner, IDA Pro

**Tool index**: <tool-index.md / tool-index.json path>
**Rules written to**: <write location>
**Note**: Future reverse-engineering / penetration-testing / security tasks will be routed automatically. Missing tools will be installed automatically when needed.
**Ops**: Before target ACT, ensure case scope (`case-init` / `ops/scope-contract`) has auth granted + a valid network/offline-sample profile.
```

--------------------------------

### Install jadx from GitHub

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md

Downloads and extracts the latest jadx release, then adds it to the system PATH.

```bash
mkdir -p ~/tools/jadx
curl -L https://github.com/skylot/jadx/releases/latest/download/jadx-1.5.5.zip -o /tmp/jadx.zip
unzip -q /tmp/jadx.zip -d ~/tools/jadx
export PATH="$HOME/tools/jadx/bin:$PATH"
jadx --version
```

--------------------------------

### Configure MCP Servers

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

Example configuration for defining MCP server endpoints and command-line arguments for various tools.

```json
{
  "mcpServers": {
    "anything-analyzer": {
      "url": "http://localhost:23816/mcp",
      "headers": { "Authorization": "Bearer <token from local mcp-server-config.json>" }
    },
    "idapro": { "url": "http://127.0.0.1:13337/mcp" },
    "jshook": { "command": "npx", "args": ["-y", "@jshookmcp/jshook@0.3.4"], "env": { "JSHOOK_BASE_PROFILE": "search" } },
    "burpsuite": { "command": "node", "args": ["<package root>/burp-mcp-full/mcp-bridge.js"] }
  }
}
```

--------------------------------

### Verify installation and routing

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/RELEASE_NOTES_v1.0.0.md

Run the smoke test and routing coherence verification scripts to ensure the environment is correctly configured.

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
```

--------------------------------

### Execute Core Routing and Case Initialization

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

Use these commands to verify routing and initialize a test case for offline APK analysis.

```text
Windows:
  powershell -File skills/scripts/master-route.ps1 -Hint "offline apk"
  powershell -File skills/scripts/case-init.ps1 -Hint "offline apk" -CaseName verify-sample -Preset offline-sample -Sample ".\sample.apk"

Linux / macOS / Kali:
  bash skills/scripts/master-route.sh --hint "offline apk"
  bash skills/scripts/case-init.sh --hint "offline apk" --case-name verify-sample --preset offline-sample --sample ./sample.apk
```

--------------------------------

### x64dbg Launch and Shortcuts

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-dynamic.md

Basic commands for launching binaries and common keyboard shortcuts for debugging operations.

```bash
# Launch
x64dbg.exe binary.exe         # 64-bit
x32dbg.exe binary.exe         # 32-bit

# Essential shortcuts
F2      → Toggle breakpoint
F7      → Step into
F8      → Step over
F9      → Run
Ctrl+G  → Go to address
Ctrl+F  → Find pattern in memory
```

--------------------------------

### Execute core routing and case initialization on Linux/macOS

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

Run these commands to initialize cases and manage routing without requiring PowerShell.

```bash
bash skills/scripts/master-route.sh --hint "offline apk"
bash skills/scripts/case-init.sh --hint "offline apk" --case-name my-sample --preset offline-sample --sample ./app.apk
bash skills/scripts/case-guard.sh --case-root work/my-sample
bash skills/scripts/bootstrap-reverse.sh --list
```

--------------------------------

### Install radare2 Ghidra Plugin

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md

Installs the native Ghidra decompiler plugin for the radare2 framework.

```bash
r2pm -ci r2ghidra
```

--------------------------------

### Mobile Security Tool Installation Commands

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/android-advanced.md

Common installation commands for Frida and Objection tools.

```bash
pip install frida-tools
```

```bash
pip install objection
```

--------------------------------

### Perform Basic Path Exploration

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-dynamic.md

Load a binary and use the simulation manager to find a target address while avoiding failure paths.

```python
import angr
import claripy

# Load binary
proj = angr.Project('./binary', auto_load_libs=False)

# Find address of "Correct!" print, avoid "Wrong!" print
# Get these from disassembly (objdump -d or Ghidra)
FIND_ADDR = 0x401234    # Address of success path
AVOID_ADDR = 0x401256   # Address of failure path

# Create simulation manager and explore
simgr = proj.factory.simgr()
simgr.explore(find=FIND_ADDR, avoid=AVOID_ADDR)

if simgr.found:
    found = simgr.found[0]
    # Get stdin that reaches the target
    print("Flag:", found.posix.dumps(0))  # fd 0 = stdin
```

--------------------------------

### Identify IDA Pro installation paths

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Common installation locations for IDA Pro on macOS.

```text
/Applications/IDA Professional.app
/Applications/IDA Free.app
/Applications/IDA Pro *.app
```

--------------------------------

### Install macOS Reverse Engineering Tools

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md

Installs standard debugging and analysis utilities via Homebrew.

```bash
brew install gdb radare2 binutils apktool upx ghidra
```

--------------------------------

### 识别 Go 二进制特征

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/go-reverse.md

通过字符串特征和工具快速判断二进制文件是否由 Go 编译。

```bash
# 字符串特征
strings binary | grep -E "runtime\.|go\.buildid|GOROOT"

# rabin2 侦察
rabin2 -z binary | grep -i "runtime"

# 文件大小异常大（静态链接 runtime）
# 典型 Hello World: C ~20KB, Go ~2MB
```

--------------------------------

### Emulate Binaries with Qiling

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-advanced.md

Demonstrates setting up a Qiling instance, hooking addresses, syscalls, and Windows APIs to bypass anti-debug checks.

```python
from qiling import Qiling
from qiling.const import QL_VERBOSE

# Emulate Linux ELF
ql = Qiling(["./binary"], "rootfs/x8664_linux",
            verbose=QL_VERBOSE.DEBUG)

# Hook specific address
@ql.hook_address
def hook_check(ql, address, size):
    if address == 0x401234:
        ql.arch.regs.rax = 0  # Bypass check
        ql.log.info("Anti-debug bypassed")

# Hook syscall
@ql.hook_syscall(name="ptrace")
def hook_ptrace(ql, request, pid, addr, data):
    return 0  # Always succeed

# Hook API (Windows)
@ql.set_api("IsDebuggerPresent", target=ql.os.user_defined_api)
def hook_isdebug(ql, address, params):
    return 0

ql.run()
```

--------------------------------

### 常用 Go 逆向命令速查

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/go-reverse.md

常用的 Go 逆向工具命令行操作。

```bash
# GoReSym：导出符号
GoReSym -t -d -p binary > symbols.json
GoReSym -t -d -p binary -o ida_script.py  # 生成 IDA 脚本

# redress：分析 stripped 二进制
redress -src binary          # 源文件路径
redress -pkg binary          # 包结构
redress -type binary         # 类型信息
redress -interface binary    # 接口信息
redress -filepath binary     # 完整文件路径

# GoResolver：去混淆 Garble
GoResolver -binary binary -output resolved.json

# GoStringUngarbler：解密 Garble 字符串
GoStringUngarbler -i binary -o deobfuscated_binary

# 快速判断 Go 版本
strings binary | grep "go1\."
GoReSym -p binary | grep "Version"
```

--------------------------------

### Install Linux Reverse Engineering Tools

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md

Installs standard debugging and analysis utilities via the apt package manager.

```bash
apt install gdb radare2 binutils strace ltrace apktool upx
```

--------------------------------

### Debug MBR with QEMU and GDB

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/platforms-hardware.md

Starts a QEMU instance with a GDB stub and attaches a GDB client to debug the boot process at the MBR entry point.

```bash
# Boot with GDB stub on port 1234; -S pauses execution at start
qemu-system-x86_64 -fda disk.img -s -S

# In another terminal, attach GDB
gdb -ex "set architecture i8086" \
    -ex "target remote :1234" \
    -ex "break *0x7c00" \
    -ex "continue"

# Common MBR entry point is 0x7c00 (BIOS loads MBR here)
# Step through bootloader, inspect registers and memory:
(gdb) x/20i $pc
(gdb) info registers
(gdb) x/16xb 0x7c00
```

--------------------------------

### Initialize Tooling

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/competition-zip-archive/SKILL.md

Commands to refresh the tool index and bootstrap the reverse engineering environment on Windows and Kali.

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 -Capability bkcrack
```

```bash
bash kali/scripts/bootstrap-reverse.sh bkcrack
```

--------------------------------

### Install Python Reverse Engineering Packages

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md

Installs core Python libraries for binary analysis and emulation. Requires a C++ compiler for building pycdc from source.

```bash
pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver
# For Python 3.9+ bytecode: build pycdc from source
git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make
```

--------------------------------

### Bootstrap reverse environment on Kali Linux

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

Use the dedicated entrypoint for Kali Linux environments.

```bash
bash kali/scripts/bootstrap-reverse.sh
```

--------------------------------

### Automatic Configuration Process

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

The step-by-step workflow for AI agents to initialize the environment and route tasks.

```text
0. ⚠️ Run the platform-native refresh-tool-index first to generate skills/tool-index.md (see warning above)
1. Detect the actual installation path of this package (derived from the location of this file, i.e., the directory containing README.md)
2. Detect the local operating system and distribution:
   - Windows → continue with this README and the PowerShell script path
   - Kali Linux → read kali/README-kali.md
   - Generic Linux (Ubuntu / Debian / Mint / Pop!_OS, etc.) → read docs/platforms/linux.md
   - macOS → read docs/platforms/macos.md
   - Other / unknown → read docs/PLATFORMS.md and choose the closest deployment path
3. Follow the platform-specific deployment document to check toolchains, script entry points, MCP configuration, and path conventions
4. Use the native bootstrap entry for the current platform; Linux/macOS do not require PowerShell for the core routing/case flow
5. Read RULES.md → execute all instructions inside it (CRITICAL block, global injection, precedent-auth, routing)
6. Route via skills/MASTER-ROUTING.md or:
   - Windows: `powershell -File skills/scripts/master-route.ps1 -Hint "<task>"`
   - Linux/macOS/Kali: `bash skills/scripts/master-route.sh --hint "<task>"`
7. **Ops gate (MUST):** initialize the case using the native platform entry:
   - Windows: `powershell -File skills/scripts/case-init.ps1 -Hint "<task>"`
   - Linux/macOS/Kali: `bash skills/scripts/case-init.sh --hint "<task>"`
   Both default case artifacts to the caller analysis project's `work/<case>/`. Set `auth.status=granted` + a valid network profile before target ACT. An authorized local sample may remain `offline` when an explicit sample is supplied through the `offline-sample` preset. `-Force`/`--force` never bypasses the scope hard gate. Evidence chain: `skills/ops/evidence-finding-path.md`. Roles: `skills/ops/role-map.md`. Identity: `skills/ops/IDENTITY.md`.
8. Open PRIMARY SKILL.md → execute ACTION REQUIRED. Append timeline/workitems under the case dir.
9. Before report handoff, run `python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strict` and resolve every error.
10. Continue the behavior chain → report via docs-generator + field-journal.
```

--------------------------------

### Decompilation with RetDec

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-advanced.md

Installation and usage commands for the RetDec decompiler CLI.

```bash
# Install
pip install retdec-decompiler
# Or use web: https://retdec.com/decompilation/

# CLI
retdec-decompiler binary
# Outputs: binary.c (decompiled C), binary.dsm (disassembly)

# Specific function
retdec-decompiler --select-ranges 0x401000-0x401100 binary
```

--------------------------------

### Flag Format Example

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/references/security-report-templates.md

Standard format for displaying a captured flag.

```text
flag{...}
```

--------------------------------

### Environment validation checklist

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md

Verifies the installation and version of required tools and dependencies.

```bash
java -version
python3 --version
node -v
npm -v
npx -v
jadx --version || true
apktool --version || true
adb version || true
frida --version || true
r2 -v || true
brew list --formula | grep -E 'jadx|apktool|radare2|graphviz|plantuml' || true
bash skills/scripts/refresh-tool-index.sh
```

--------------------------------

### Initialize Tool Index

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/CLAUDE.md

Generates the tool-index.md file required for fresh clones across different operating systems.

```bash
# Windows
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1

# macOS / Linux
bash skills/scripts/refresh-tool-index.sh

# Kali
bash kali/scripts/refresh-tool-index.sh
```

--------------------------------

### Flash Control Referer

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md

Example of using Flash to control the Referer header.

```text
# Flash可以控制Referer
# 编译SWF发送自定义Referer
```

--------------------------------

### Task-Oriented Documentation Example

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/SKILL.md

Demonstrates the difference between feature-oriented and task-oriented documentation structures.

```markdown
<!-- Bad: Feature-oriented -->
## AuthService Class
The AuthService class provides authentication methods...

<!-- Good: Task-oriented -->
## Authenticating Users
To authenticate a user, call login() with credentials:
```

--------------------------------

### AI Failure-Handling Flow

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md

The mandatory sequence of operations when an automated installation script fails.

```text
1. Call the platform-native bootstrap (`bootstrap-reverse.ps1` on Windows, `bootstrap-reverse.sh` on Linux/macOS, Kali bootstrap under `kali/scripts/`)
2. Verify whether the tool is usable after installation
3. If it is still unavailable → do not retry → immediately output structured guidance
```

--------------------------------

### Project and Analysis Workflow

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md

Standard steps for initializing a Ghidra project and performing initial analysis.

```text
□ 新建 Project → Import 文件 → Analyze（默认分析器）
□ 记录语言/编译器识别结果与基址
□ 标记入口、导出表、字符串 xref
```

--------------------------------

### Install src-hunter via Git

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/README.en.md

Clone the repository directly into the local Claude skills directory.

```bash
git clone https://github.com/MyuriKanao/src-hunter-skill.git ~/.claude/skills/src-hunter
```

--------------------------------

### Execute AFL++ QEMU Mode Fuzzing

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emulation-and-fuzz.md

Steps to build QEMU support, prepare seeds, and initiate fuzzing on a binary.

```bash
# 1. 准备 AFL++ qemu 后端（架构对应）
cd ~/tools/aflpp/qemu_mode
CPU_TARGET=mipsel ./build_qemu_support.sh

# 2. 准备种子语料
mkdir -p in/
echo "GET / HTTP/1.0" > in/seed1

# 3. 启动 fuzz
afl-fuzz -Q -i in/ -o out/ -- \
  qemu-mipsel-static -L squashfs-root/ \
  squashfs-root/usr/sbin/httpd

# 4. 监控覆盖率
afl-whatsup out/
```

--------------------------------

### Recommended Lightweight Docker Profile

Source: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/sandbox-profile.md

Suggested tool distribution for users managing their own Docker environments.

```text
最小：nmap + nuclei + sqlmap 容器或 pentestMCP 类镜像
移动：jadx + apktool + frida 宿主机
逆向：宿主机 IDA/r2 + tool-index
```
Tokens:
Raw