reverse-engineering

Files (91)

• SKILL.md
• SKILL.md · parts/binary-diff/
• prompt-template.md · parts/binary-diff/references/
• SKILL.md · parts/browser-extension-reverse/
• extension-analysis.md · parts/browser-extension-reverse/references/
• SKILL.md · parts/dotnet-reverse/
• common-workflow.md · parts/dotnet-reverse/references/
• obfuscators.md · parts/dotnet-reverse/references/
• sharp-tools.md · parts/dotnet-reverse/references/
• SKILL.md · parts/dsl-vm-reverse/
• SKILL.md · parts/ghidra-reverse/
• ghidra-cheatsheet.md · parts/ghidra-reverse/references/
• SKILL.md · parts/go-rust-reverse/
• go-rust-notes.md · parts/go-rust-reverse/references/
• SKILL.md · parts/ida-reverse/
• ida-mcp-cheatsheet.md · parts/ida-reverse/references/
• open.ps1 · parts/ida-reverse/scripts/
• start.ps1 · parts/ida-reverse/scripts/
• SKILL.md · parts/js-reverse/
• ast-deobfuscation.md · parts/js-reverse/references/
• automation-entry.md · parts/js-reverse/references/
• env-patching.md · parts/js-reverse/references/
• fallbacks.md · parts/js-reverse/references/
• instrumentation.md · parts/js-reverse/references/
• local-rebuild.md · parts/js-reverse/references/
• mcp-task-template.md · parts/js-reverse/references/
• node-env-rebuild.md · parts/js-reverse/references/
• output-contract.md · parts/js-reverse/references/
• task-artifacts.md · parts/js-reverse/references/
• task-input-template.md · parts/js-reverse/references/
• tool-defaults.md · parts/js-reverse/references/
• SKILL.md · parts/macos-reverse/
• macho-triage.md · parts/macos-reverse/references/
• SKILL.md · parts/mobile-reverse/
• anti-detection-bypass.md · parts/mobile-reverse/references/
• frida-objection-deep.md · parts/mobile-reverse/references/
• ios-reverse-guide.md · parts/mobile-reverse/references/
• decode.ps1 · parts/mobile-reverse/scripts/
• decode.sh · parts/mobile-reverse/scripts/
• frida-run.ps1 · parts/mobile-reverse/scripts/
• frida-run.sh · parts/mobile-reverse/scripts/
• manifest-summary.ps1 · parts/mobile-reverse/scripts/
• rebuild-sign-install.ps1 · parts/mobile-reverse/scripts/
• rebuild-sign-install.sh · parts/mobile-reverse/scripts/
• SKILL.md · parts/protocol-reverse/
• protocol-workflow.md · parts/protocol-reverse/references/
• SKILL.md · parts/radare2/
• cheatsheet.md · parts/radare2/references/
• recon.ps1 · parts/radare2/scripts/
• recon.sh · parts/radare2/scripts/
• SKILL.md · parts/reverse-api-engineer/
• LICENSE · parts/reverse-api-engineer/references/
• README.md · parts/reverse-api-engineer/references/
• PROMPT.md · parts/reverse-api-engineer/references/design/
• README.md · parts/reverse-api-engineer/references/design/
• design-system.md · parts/reverse-api-engineer/references/design/
• examples.md · parts/reverse-api-engineer/references/design/
• INDEX.md · parts/reverse-api-engineer/references/examples/apple/
• QUICKSTART.md · parts/reverse-api-engineer/references/examples/apple/
• README.md · parts/reverse-api-engineer/references/examples/apple/
• …and 31 more

SKILL.md (first lines)

# reverse-engineering — targets, methods, technique library

> Home branch in Memora: `root/skill/reverse-engineering`.
>
> Work on copies inside the task's case directory. Never run an unknown sample,
> patch an original, or expand scope without a reason.

## Choosing a part

| Target | Part |
|---|---|
| Android APK & iOS IPA: unpack, decompile, smali, repackage, Frida, pinning | `parts/mobile-reverse/` |
| Cross-version symbol migration, BinDiff/Diaphora work | `parts/binary-diff/` |
| Chrome/Firefox extension: manifest, workers, message passing | `skills/reverse-engineering/parts/browser-extension-reverse/` |
| .NET / C# assembly (IL, obfuscators, dnSpy, de4dot) | `parts/dotnet-reverse/` |
| WASM-like custom VM, DSL interpreter, JS risk engine | `parts/dsl-vm-reverse/` |
| Ghidra headless or GUI, decompiler, MCP workflows | `parts/ghidra-reverse/` |
| Stripped Go or Rust binary: pclntab, metadata, panic strings | `parts/go-rust-reverse/` |
| IDA Pro workflows and scripting | `parts/ida-reverse/` |
| Frontend JavaScript: signature chains, page observation, hooks | `parts/js-reverse/` |
| macOS / Mach-O: codesign, Objective-C/Swift recovery | `parts/macos-reverse/` |
| Custom binary protocol, Protobuf/gRPC, WebSocket frames, PCAP | `parts/protocol-reverse/` |
| radare2 from the command line | `parts/radare2/` |
| Website → typed API client: capture HAR, generate Python/TS/Go/Java | `parts/reverse-api-engineer/` |

## Technique library (`references/`)

Read only the reference file the target requires:

- `references/tools.md`, `references/tools-dynamic.md`, `references/tools-advanced.md` — static/dynamic/deobfuscation toolchains (GDB, Ghidra, r2, IDA, Frida, angr, x64dbg, Qiling, VMProtect, LIEF).
- `references/anti-analysis.md` — anti-debug, anti-VM, anti-DBI, MBA simplification.
- `references/patterns.md`, `references/patterns-ctf.md`, `references/patterns-ctf-2.md`, `references/patterns-ctf-3.md` — VM opcodes, self-modifying code, lattice/crypto patterns.
- `references/languages.md`, `references/languages-compiled.md`, `references/languages-platforms.md` — Python bytecode, UEFI, Go, Rust, Swift, Kotlin, C++, Electron.
- `references/platforms.md`, `references/platforms-hardware.md`, `references/elf-analysis.md`, `references/go-reverse.md`, `references/kernel-driver-reverse.md`, `references/crypto-decode-tools.md`, `references/field-notes.md`, `references/awesome-re-resources.md`.

## Rules

- Walk `root/skill/reverse-engineering` (and the project root) in Memora before starting; record verified offsets, structures, and dead-ends as nodes.
- Use `ask_questions` when choosing between static reconstruction vs. dynamic instrumentation, or before running any sample on the host.
- State-changing operations happen on copies inside the task folder, never on the original artifact.

## Related

`security` (surface assessments, `skills/security/parts/malware-analysis/`), `browser` (extension runtime, HAR capture), `dev` (writing the clean port or client).

From youlianvr/oper-share, CC-BY-4.0.

More from youlianvr/oper-share