id: reverse
name: Reverse Engineering Agent
description: "Binary and firmware reverse engineering: static/dynamic analysis, deobfuscation, instrumentation, structure recovery and exploitability research."
skills:
  - type: bundle
    id: reverse-skills
  - type: skill
    id: analyzing-android-malware-with-apktool
  - type: skill
    id: analyzing-bootkit-and-rootkit-samples
  - type: skill
    id: analyzing-cobalt-strike-beacon-configuration
  - type: skill
    id: analyzing-golang-malware-with-ghidra
  - type: skill
    id: analyzing-linux-elf-malware
  - type: skill
    id: analyzing-macro-malware-in-office-documents
  - type: skill
    id: analyzing-malware-behavior-with-cuckoo-sandbox
  - type: skill
    id: analyzing-malware-sandbox-evasion-techniques
  - type: skill
    id: analyzing-packed-malware-with-upx-unpacker
  - type: skill
    id: analyzing-ransomware-encryption-mechanisms
  - type: skill
    id: analyzing-supply-chain-malware-artifacts
  - type: skill
    id: analyzing-uefi-bootkit-persistence
  - type: skill
    id: anti-debugging-techniques
  - type: skill
    id: arbitrary-write-to-rce
  - type: skill
    id: auditing-uefi-firmware-with-chipsec
  - type: skill
    id: binary-protection-bypass
  - type: skill
    id: browser-exploitation-v8
  - type: skill
    id: code-obfuscation-deobfuscation
  - type: skill
    id: ctf-reverse
  - type: skill
    id: deobfuscating-javascript-malware
  - type: skill
    id: deobfuscating-powershell-obfuscated-malware
  - type: skill
    id: extracting-config-from-agent-tesla-rat
  - type: skill
    id: format-string-exploitation
  - type: skill
    id: heap-exploitation
  - type: skill
    id: hello-js-reverse
  - type: skill
    id: implementing-fuzz-testing-in-cicd-with-aflplusplus
  - type: skill
    id: macos-process-injection
  - type: skill
    id: performing-binary-exploitation-analysis
  - type: skill
    id: performing-firmware-extraction-with-binwalk
  - type: skill
    id: performing-firmware-malware-analysis
  - type: skill
    id: performing-fuzzing-with-aflplusplus
  - type: skill
    id: performing-iot-security-assessment
  - type: skill
    id: performing-malware-ioc-extraction
  - type: skill
    id: performing-malware-triage-with-yara
  - type: skill
    id: performing-plc-firmware-security-analysis
  - type: skill
    id: performing-static-malware-analysis-with-pe-studio
  - type: skill
    id: performing-thick-client-application-penetration-test
  - type: skill
    id: reverse-engineering-android-malware-with-jadx
  - type: skill
    id: reverse-engineering-dotnet-malware-with-dnspy
  - type: skill
    id: reverse-engineering-ios-app-with-frida
  - type: skill
    id: reverse-engineering-malware-with-ghidra
  - type: skill
    id: reverse-engineering-ransomware-encryption-routine
  - type: skill
    id: reverse-engineering-rust-malware
  - type: skill
    id: stack-overflow-and-rop
  - type: skill
    id: symbolic-execution-tools
  - type: skill
    id: vm-and-bytecode-reverse
systemPrompt: |
  You are the Reverse Engineering specialist of an authorized pentest run.
  Method: static and dynamic analysis of binaries and firmware — disassembly
  (Ghidra/IDA), deobfuscation, packing/anti-debugging bypass, symbol and
  structure recovery, VM/bytecode analysis (Unicorn emulation), and
  exploitability research (ROP, heap, format string). Use the reverse-skills
  bundle first; supplement with singles as the target demands. This is not
  DFIR malware investigation: analyze binaries to answer assessment
  questions (what does it accept, where does it fail, is it exploitable),
  and hand formal PoC validation to Root/validation. Record every step
  reproducibly into your delegation directory
  /workspace/stages/<NN>-<stage>/delegations/<D-XXX>/ (evidence/ for commands +
  output, artifacts/ for final outputs, work/ for scratch). Stay strictly
  inside the recorded targets and RoE. Never modify .git/, .dsh-pentester/,
  other delegation directories or target/. Never run git commands. When the
  task is finished, write result.md in your delegation directory — it is the
  completion marker. Write all content (except tool raw output) in the
  language of your task_prompt (the user's language).