Review a decompilation matching change the way a decomp maintainer would - first verifying the match is real (fakematch / NONMATCHING-banner / wrong-compiler checks), then whether the recovered source is admissible, then what it costs the host port. Use when reviewing or preparing a matching PR/branch/diff in a decomp…
Execute the sm64ds-decomp translation-unit rebuild/verify loop - reconstruct a merged TU in srctu/, compile it with the pinned mwccarm, byte-verify every member, run the relocation audits, and take it up the shadow -> text-verified -> link-verified ladder. Use when merging one-function files into a real .cpp, when…
Find which classes shared an original .cpp translation unit in sm64ds-decomp, so a C++ conversion PR ships the right set of classes together instead of splitting a file the ROM says is one. Use before slicing a per-class migration PR, when deciding whether two classes belong in one header, when eligible.py rejects a…
Compile TH08 functions with the repository VC7 build and compare configured COFF functions against the hash-attested 1.00d target using config/match-units.toml and scripts/compare-function.py. Use for focused code-generation tuning, relocation diagnosis, or exact-match verification.
Reconstruct bounded functions from the original Japanese TH08 1.00d executable using hash-attested target evidence, upstream GensokyoClub source, and explicitly labeled TH06/TH07 corroboration. Use for TH08 disassembly, ABI recovery, function naming, layout recovery, source migration, or implementation work.
Generate and interpret target-pinned TH08 instruction and ABI fact packets with scripts/typed-re.py. Use for stack layout, register homes, access widths, direct calls, return cleanup, or VC7 source-shape diagnosis before strict comparison.
Detect and reverse Java/Android obfuscation with jddlab - ProGuard/R8 renaming, string encryption, control-flow flattening and commercial protectors, using java-deobfuscator, simplify and dex2jar. Use when decompiled code is obfuscated or strings are encrypted.
Analyze an app's native (.so) / JNI code with jddlab - map Java native methods to symbols, extract JNI bindings, and decompile ARM/ARM64 with Ghidra headless. Use when security logic (keys, pinning, root/tamper checks) lives in native libraries.
Bypass Android TLS/certificate pinning with jddlab to intercept HTTPS - android-unpinner, Frida gadget injection (apk-patcher), objection, or manual smali patches. Use when a proxy (Burp/mitmproxy) shows no traffic because of certificate pinning.
Rust CLI reference for the headless-ghidra pipeline. Covers command syntax, flags, output contract, artifact paths, and workspace layout for all ghidra-agent-cli subcommands. Load when: constructing a ghidra-agent-cli command, interpreting its output, resolving a flag or artifact path question, or debugging CLI…
Thoroughly analyze a single function by first recovering its type definitions, constant definitions, vtables, function name and signature, then producing the final decompilation. Use when the user wants a complete per-function analysis following the strict recovery order: types → constants → vtables → function…
Entry skill for the Headless Ghidra YAML-first reverse-engineering pipeline. Use when the user asks to analyze, decompile, triage, resume, or iterate on a binary target with Ghidra/headless-ghidra. Reads artifacts/ /pipeline-state.yaml, routes P0–P4 phase skills, runs gate checks, and manages review pauses. Performs…