Use for Android APK reverse engineering in D:\reverseENV, including unpacking, jadx/apktool analysis, smali edits, rebuild/sign/install, Frida hooks, API extraction, fingerprinting, and routing native .so work to native/IDA skills.
Use when processing D:\reverseENV article knowledge-base intake: converting PDFs/HTML/Markdown drafts from article\pending into clean Markdown articles, classifying them under article\, updating docs\article-index.md, clearing processed pending inputs, and validating encoding, links, and Git diffs.
Use for PE/ELF/DLL/SO binary reverse engineering in D:\reverseENV with IDA Pro and ida-multi-mcp, including IDALib session setup, function analysis, decompile/disassembly, xrefs, types, renaming, comments, and evidence capture.
Use for JavaScript reverse engineering with js-reverse-mcp/CDP in D:\reverseENV when full Chrome DevTools Protocol debugging, breakpoints, stepping, runtime sampling, or local browser reconstruction is required and ruyi anti-detection is not the primary need.
Use for Android native .so reverse engineering, anti-debug/anti-Frida/root/emulator/integrity bypass, syscall filtering, memory dump/fix, stealth hooks, IDA handoff, patching, and TLS capture workflows in D:\reverseENV.
Use for Web protocol recovery in D:\reverseENV, including signature/encryption chain recovery, request reproduction, Python collector generation, evidence-backed API reconstruction, and traffic-to-code workflows.
Use for proxy selection, extraction, validation, and injection in D:\reverseENV, including Kuaidaili, Cliproxy, proxycheck.py, capture/browser integration, and reverse-engineering traffic workflows.
Use for fast CLI binary reconnaissance and lightweight disassembly/patch triage in D:\reverseENV with radare2, especially before deeper IDA analysis or when a scriptable terminal workflow is preferable.
Use for reverse engineering task routing in D:\reverseENV when no more specific project skill is explicitly selected. Classifies target type, chooses APK/native/Web JS/binary tooling, coordinates phased analysis, and enforces report/findings/triage deliverables.
Use only as supporting generic CTF/general reverse engineering background in D:\reverseENV. Do not use as the primary router when reverse-coordinator, apk-reverse, native-reverse, ida-reverse, ruyi-reverse, or radare2 applies.
Use as the default Web JavaScript reverse engineering entrypoint in D:\reverseENV, especially for browser automation, anti-detection, fingerprinting, trace, runtime observation, signature chain analysis, and ruyi-mcp workflows.
Use for Web JS Node environment patching in D:\reverseENV after ruyi-reverse or js-reverse evidence capture, including isolated runtime gates, cURL/HAR checks, trace API coverage matrix, Node leakage checks, fixtures validation, and TLS-client validation without polluting the main project Node/MCP environment.
MCP server "ida-multi-mcp" as configured in wangligong123/reverseENV. Launched with D:\reverse_ENV\.venv\Scripts\python.exe -m ida_multi_mcp. Needs 1 environment variable to run.
MCP server "ruyi-mcp" as configured in wangligong123/reverseENV. Launched with D:\reverse_ENV\tools\node\node.exe D:\reverse_ENV\mcp\ruyi-mcp\build\src\index.j.
A repository instruction file for reverse_ENV, covering environment setup for reverse engineering, required checks, constraints, and collaboration rules.
A set of project-specific instructions for Claude Code in the reverse_ENV repository. It covers required checks before work, repository entry points, and collaboration rules.