Reverser Skill Catalog

Playbooks

Skill	Use for
`/skills/standard/reverser/triage/SKILL.md`	First-pass ELF/PE/Mach-O triage
`/skills/standard/reverser/firmware/SKILL.md`	Router / IoT firmware extraction
`/skills/standard/reverser/packer-unpacking/SKILL.md`	UPX / ASPack / Themida / VMProtect
`/skills/standard/reverser/virtualized-protectors/SKILL.md`	VMProtect / VMP2 / Themida workflow
`/skills/standard/reverser/rop-chain/SKILL.md`	Gadget hunting for exploit dev
`/skills/standard/reverser/anti-debug-bypass/SKILL.md`	IsDebuggerPresent, ptrace, NtGlobalFlag
`/skills/standard/reverser/ghidra/SKILL.md`	Deep Ghidra analysis — decompile, xrefs, imports, P-code
`/skills/standard/reverser/windows-internals/SKILL.md`	Defensive driver exposure assessment in disposable Windows VMs
`/skills/standard/reverser/game-security/SKILL.md`	Self-hosted game client, protocol, replay, and server-authority research

Check which reversing tools the active runtime exposes. Hosted runs use an isolated REA/Ghidra companion and mirrored GUI; standalone OSS starts the reversing workload for REA native analysis.
bin_identify — format, arch, NX/PIE
bin_packer — entropy + signature
If packed → follow the packer-unpacking skill, re-identify after unpack
bin_strings — category=url/ip/crypto/secret/version to seed the graph
bin_symbols_report — risk bucket classification
Version strings → cve_lookup + cve_by_package
In hosted runs, the engagement agent passes a discovered /workspace binary to rea_open_binary and discovers available native tools with rea_find_tools. In standalone OSS, call rea_find_tools(binary_path, query) to pin the binary and discover the active Ghidra provider's tools.
Inspect functions and cross-references with REA native tools, preserving each Evidence ID and bundle manifest. Hosted GUI visibility is a separate readback claim. In standalone OSS, use rea_call_tool for deep analysis and bin_r2_script as a fallback when REA is unavailable.
Record every observation in the knowledge graph