re

Files (1)

• SKILL.md

SKILL.md (first lines)

# /re — REVERSE ENGINEERING

## Purpose

`/re` is a universal reverse-engineering entry point. It is not limited to crackmes or `.exe` files. It can work with executables, DLLs/shared libraries, binaries, firmware images, dumps, and other files supported by the selected analysis tool and installed tooling.

The default backend is **IDA Pro**. Two alternate debugger backends are built in:

- `x64dbg` for Windows user-mode debugging.
- `gdb` for targets supported by the installed GDB build.

`gdp` is accepted as an alias for `gdb` because the command form is part of Max Prompter's public command set.

Use `/re` only for software the user owns, has permission to inspect, or is explicitly authorized to analyze. The workflow should favor static analysis first, avoid executing unknown files merely because they were named, and clearly distinguish observations from assumptions.

## Command syntax

### Default IDA Pro

```text
/re <program name>
/re <absolute or relative path>
```

Examples:

```text
/re myapp.exe
/re mylibrary.dll
/re .\samples\program.exe
/re C:\work\samples\firmware.bin
```

### Explicit debugger/backend

```text
/re ida <program or path>
/re x64dbg <program or path>
/re gdb <program or path>
/re gdp <program or path>
```

Examples:

```text
/re x64dbg myapp.exe
/re gdb ./server
/re gdp ./server
/re x64dbg C:\work\sample.dll
```

### Active-process mode

When no target is supplied, or when the named target is not found as a file, scan currently running processes and show matching candidates.

```text
/re
/re x64dbg
/re gdb
/re gdp
```

A user may also explicitly target a PID when invoking the helper scripts:

```text
python scripts/re/resolve_target.py --pid 1234
python scripts/re/launch_debugger.py --tool x64dbg --pid 1234
```

Do not silently select one process when multiple candidates match. Show PID, process name, path when accessible, architecture when known, and access limitations, then let the user choose.

### Resume the active session

```text
/re
```

If `.max-prompter/re/RE_SESSION.json` exists and the user did not provide a new backend or target, treat the session as the current RE context.

## What `/re` does

The high-level workflow is:

```text
/re request
      ↓
parse backend + target intent
      ↓
resolve local file OR scan active processes
      ↓
fingerprint target when a file is available
      ↓
resolve selected debugger
      ↓
launch/attach where supported
      ↓
persist RE session
      ↓
ask for / process the natural-language analysis query
      ↓
produce evidence-backed findings
```

Every stage must have an explicit success/failure state. Never say a debugger was launched when the launcher process immediately exited.

## Backend rules

### IDA Pro — default

Prefer IDA Pro for static analysis, disassembly, cross-references, graph views, type reconstruction, and decompilation when Hex-Rays is installed.

For a local file:

```text
ida64.exe target.exe
```

or the 32-bit equivalent when appropriate. Current Hex-Rays documentation supports graphical launch with `ida input-file` / `ida64 input-file`; batch automation can use `-A` together with `-S` scripts. citeturn825372search21

From bvts/max-the-prompter, MIT.

More from bvts/max-the-prompter