protocol-reverse-engineering

29.9k

wshobson

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.

transformer-lens-interpretability

21.8k

davila7

Provides guidance for mechanistic interpretability research using TransformerLens to inspect and manipulate transformer internals via HookPoints and activation caching. Use when reverse-engineering model algorithms, studying attention patterns, or performing activation patching experiments.

protocol-reverse-engineering

18.0k

sickn33

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocol...

firmware-analyst

18.0k

sickn33

Expert firmware analyst specializing in embedded systems, IoT security, and hardware reverse engineering.

idapython

5.9k

mrexodia

IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.

reverse-engineering-tools

2.7k

gmh5225

Guide for reverse engineering tools and techniques used in game security research. Use this skill when working with debuggers, disassemblers, memory analysis tools, binary analysis, or decompilers for game security research.

mobile-security

2.7k

gmh5225

Guide for mobile game security on Android and iOS platforms. Use this skill when working with Android/iOS reverse engineering, mobile game hacking, APK analysis, root/jailbreak detection bypass, or mobile anti-cheat systems.

llvm-obfuscation

790

gmh5225

Expertise in LLVM-based code obfuscation techniques including OLLVM, control flow flattening, string encryption, virtualization, and anti-analysis methods. Use this skill when working on code protection, anti-reverse engineering, or implementing custom obfuscation passes.

binary-lifting

790

gmh5225

Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations.

logicmso

661

BrownFineSecurity

Analyze digital and analog captures from Saleae Logic MSO devices. Decode protocols like UART, SPI, I2C from exported binary files. Use when analyzing logic analyzer captures for CTF challenges, hardware reverse engineering, or protocol decoding.

apktool

661

BrownFineSecurity

Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.

deep-analysis

611

cyberkaida

Performs focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?", "What's the C2 address?", "Fix types in this function". Makes incremental improvements (renaming, retyping, commenting) to aid understanding. Returns evidence-based answers with new investigation threads. Use after binary-triage for investigating specific suspicious areas or when user asks focused questions about binary behavior.

ctf-crypto

611

cyberkaida

Solve CTF cryptography challenges by identifying, analyzing, and exploiting weak crypto implementations in binaries to extract keys or decrypt data. Use for custom ciphers, weak crypto, key extraction, or algorithm identification.

ctf-pwn

611

cyberkaida

Solve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for buffer overflows, format strings, heap exploits, ROP challenges, or any pwn/exploitation task.

binary-triage

611

cyberkaida

Performs initial binary triage by surveying memory layout, strings, imports/exports, and functions to quickly understand what a binary does and identify suspicious behavior. Use when first examining a binary, when user asks to triage/survey/analyze a program, or wants an overview before deeper reverse engineering.

ctf-rev

611

cyberkaida

Solve CTF reverse engineering challenges using systematic analysis to find flags, keys, or passwords. Use for crackmes, binary bombs, key validators, obfuscated code, algorithm recovery, or any challenge requiring program comprehension to extract hidden information.

reverse-engineering-api

439

Kalil0321 Reverse Api Engineer Reverse Engineering Api

Reverse engineer web APIs by capturing browser traffic (HAR files) and generating production-ready Python API clients. Use when the user wants to create an API client for a website, automate web interactions, or understand undocumented APIs. Activate on tasks mentioning "reverse engineer", "API client", "HAR file", "capture traffic", or "automate website".

evm-analysis

376

a5c-ai

Deep EVM bytecode analysis and decompilation capabilities for smart contract security, gas optimization, and reverse engineering. Provides tools for analyzing opcodes, storage layouts, proxy patterns, and bytecode verification.

Ghidra/IDA Reverse Engineering Skill

376

a5c-ai

Deep integration with Ghidra and IDA Pro for binary analysis and reverse engineering

binary-re-tool-setup

188

aiskillstore

Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu missing", "tool not installed", "configure gdb", "cross-compiler"

patch-diff-analyzer

89

HacktronAI

Specialized in reverse-engineering compiled binaries (JARs, DLLs). Use this when the user asks to compare versions, find security fixes, or analyze binary patches.

path-tracing-reverse

62

letta-ai

This skill provides guidance for reverse engineering compiled binaries to produce equivalent source code. It applies when tasks require analyzing executables, extracting algorithms and constants, and recreating identical program behavior in source form. Use when the goal is byte-for-byte or pixel-perfect reproduction of binary output.

gcode-to-text

62

letta-ai

Decode and interpret text content from G-code files by analyzing toolpath geometry and coordinate patterns. This skill should be used when extracting text, letters, or symbols that are encoded as movement commands in G-code files (e.g., 3D printing, CNC engraving, laser cutting). Applies to tasks like identifying what text a G-code file will print/engrave, reverse-engineering embossed or engraved text from toolpaths, or visualizing G-code geometry to reveal hidden content.

model-extraction-relu-logits

62

letta-ai

Guidance for extracting weight matrices from black-box ReLU neural networks using only input-output queries. This skill applies when tasks involve model extraction attacks, recovering hidden layer weights from neural networks, or reverse-engineering ReLU network parameters from query access.

vulnerable-secret

62

letta-ai

This skill provides guidance for extracting secrets from vulnerable executables. It should be used when tasks involve binary analysis, reverse engineering executables to find hidden flags/secrets, or exploiting buffer overflows and other vulnerabilities to extract protected data. Applicable to CTF challenges, security research, and authorized penetration testing scenarios.

path-tracing

62

letta-ai

Guide for reverse-engineering and recreating programmatically-generated ray-traced images. This skill should be used when tasks involve analyzing a target image to determine rendering parameters, implementing path tracing or ray tracing algorithms, matching scene geometry and lighting, or achieving high similarity scores between generated and target images.

ipsw

43

blacktop

Apple firmware and binary reverse engineering with the ipsw CLI tool. Use when analyzing iOS/macOS binaries, disassembling functions in dyld_shared_cache, dumping Objective-C headers from private frameworks, downloading IPSWs or kernelcaches, extracting entitlements, analyzing Mach-O files, or researching Apple security. Triggers on requests involving Apple RE, iOS internals, kernel analysis, KEXT extraction, or vulnerability research on Apple platforms.

ida-domain-scripting

27

HexRaysSA

Write and execute Python scripts using the IDA Domain API for reverse engineering. Analyze binaries, extract functions, strings, cross-references, decompile code, work with IDA Pro databases (.i64/.idb). Use when user wants to analyze binaries, reverse engineer executables, or automate IDA Pro tasks.

bg3se-macos-ghidra

24

tdimino

Develop the BG3 Script Extender macOS port using Ghidra for reverse engineering. Use this skill when: (1) Working on bg3se-macos port development or debugging (2) Using Ghidra to discover offsets, function addresses, or data structures in BG3 (3) Implementing new Lua APIs (Ext.*, Osi.*) for macOS Script Extender (4) Porting Windows BG3SE features to macOS ARM64 (5) Understanding ECS architecture, Osiris integration, or stats system (6) Analyzing ARM64 assembly or calling conventions for game hooks (7) Writing or modifying Ghidra Python scripts for BG3 analysis

binary-re:tool-setup

23

2389-research

Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu missing", "tool not installed", "configure gdb", "cross-compiler"

rt-ica

23

Jamie-BitFlight

Reverse Thinking - Information Completeness Assessment. Mandatory pre-planning checkpoint that blocks planning until prerequisites are verified. Use when receiving specs, PRDs, tickets, RFCs, architecture designs, or any multi-step engineering task. Integrates with CoVe-style planning pipelines. Invoke BEFORE creating plans, delegating to agents, or defining acceptance criteria.

find-CCSPlayerController_InventoryUpdateThink

22

hzqst

Find and identify the CCSPlayerController_InventoryUpdateThink wrapper function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the InventoryUpdateThink think function wrapper by searching for the think function name string in schema registration and tracing through the schema structure to find the wrapper function pointer.

find-CSource2GameEntities_CheckTransmit-AND-CCheckTransmitInfo

22

hzqst

Find and identify the CSource2GameEntities::CheckTransmit (virtual function) and CCheckTransmitInfo (struct) in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the CSource2GameEntities::CheckTransmit function by searching for the assertion string pattern and analyzing xrefs.

find-CBaseEntity_SetMoveType

22

hzqst

Find and identify the CBaseEntity_SetMoveType function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the SetMoveType function by searching for the "env_shake %s with" debug string and analyzing cross-references to find the matching code pattern.

find-ClientPrint

22

hzqst

Find and identify the ClientPrint function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the ClientPrint function by searching for known localization string references like "#Player_Cash_Award_ExplainSuicide_TeammateGotCash" and analyzing cross-references to find the print function.

find-CCSPlayer_WeaponServices_Weapon_GetSlot

22

hzqst

Find and identify the CCSPlayer_WeaponServices_Weapon_GetSlot function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the Weapon_GetSlot function by searching for a known string in a caller function and tracing the call target.

find-CSpawnGroupMgrGameSystem_SpawnGroupActuallyShutdown

22

hzqst

Find and identify the CSpawnGroupMgrGameSystem_SpawnGroupActuallyShutdown function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the SpawnGroupActuallyShutdown function by searching for known format string references and analyzing cross-references.

find-CBasePlayerPawn_RemovePlayerItem

22

hzqst

Find and identify the CBasePlayerPawn_RemovePlayerItem function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the RemovePlayerItem function by searching for the "DestroyWeapon" string reference and analyzing cross-references.

find-CEntityIdentity_SetEntityName

22

hzqst

Find and identify the CEntityIdentity_SetEntityName function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the SetEntityName function on CEntityIdentity, which sets the targetname of an entity. Triggers: CEntityIdentity_SetEntityName, SetEntityName, entity name, set entity name

find-CSpawnGroupMgrGameSystem_GetSpawnGroups

22

hzqst

Find and identify the CSpawnGroupMgrGameSystem_GetSpawnGroups function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the GetSpawnGroups function by searching for known format string references and analyzing cross-references.

find-CBaseEntity_IsAlive-AND-CBaseEntity_GetEyePosition-AND-CBasePlayerPawn_GetEyePosition

22

hzqst

Find and identify the CBaseEntity_IsAlive, CBaseEntity_GetEyePosition and CBasePlayerPawn_GetEyePosition virtual functions in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate these functions. CBaseEntity_IsAlive checks m_lifeState == 0 (LIFE_ALIVE). CBasePlayerPawn_GetEyePosition retrieves the player eye position via camera services. Trigger: CBaseEntity_IsAlive, CBasePlayerPawn_GetEyePosition, IsAlive, GetEyePosition

find-CSpawnGroupMgrGameSystem_SpawnGroupPrecache

22

hzqst

Find and identify the CSpawnGroupMgrGameSystem_SpawnGroupPrecache function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the SpawnGroupPrecache function by searching for known format string references and analyzing cross-references.

find-CCSGameRules_GoToIntermission

22

hzqst

Find and identify the CCSGameRules_GoToIntermission function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the GoToIntermission function by searching for the "Going to intermission..." string reference.

find-Host_Say-AND-UTIL_SayTextFilter-AND-UTIL_SayTextFilter2

22

hzqst

Find and identify the Host_Say, UTIL_SayTextFilter and UTIL_SayTextFilter2 in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the Host_Say, UTIL_SayTextFilter and UTIL_SayTextFilter2 function by searching for the "%s %s @ %s:" string reference and analyzing cross-references.

find-TraceFunc-AND-g_GameTraceManager

22

hzqst

Find and identify the TraceFunc function and g_GameTraceManager global variable in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate TraceFunc by analyzing the FindUseEntity function and identifying the trace call with CTraceFilter vftable setup and the g_GameTraceManager global pointer.

find-CBaseTrigger_PassesTriggerFilters

22

hzqst

Find and identify the CBaseTrigger_PassesTriggerFilters virtual function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the PassesTriggerFilters function by first finding CBaseTrigger_StartTouch and extracting the first virtual call offset from its decompiled code.

find-CNavMesh_GetNearestNavArea

22

hzqst

Find and identify the CNavMesh_GetNearestNavArea function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the CNavMesh_GetNearestNavArea function by searching for the string "CNavMesh::GetNearestNavArea" and finding the function that references it.

find-CBaseEntity_Precache

22

hzqst

IDA Pro string analysis and function reverse engineering workflow. Connect to IDA Pro via ida-pro-mcp for binary analysis to locate the CBaseEntity_Precache function. Use cases: (1) Search for specific strings in binary files (2) Find cross-references (xrefs) to strings (3) Decompile functions that reference strings and view pseudocode (4) Locate specific code segments in pseudocode (5) Rename functions and variables to improve readability (6) Analyze function call relationships and data flow Trigger: CBaseEntity_Precache