IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida modules (50+), idautils iterators, and common…
A repeatable method for rebuilding a website from its source, deployed files, or browser behavior. It covers simple HTML sites, app-based sites, and sites whose visuals rely heavily on WebGL, Canvas, or Three.js.
Turn minified, bundled, or transpiled JavaScript back into readable modules. Use when you encounter unreadable production JS — a webpack/esbuild/Metro/Rollup bundle, a minified vendor script, Babel/TypeScript/SWC-transpiled output, or a single mangled .js file — and need to read, audit, debug it, or recover a…
Solve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for buffer overflows, format strings, heap exploits, ROP challenges, or any pwn/exploitation task.
Solve CTF reverse engineering challenges using systematic analysis to find flags, keys, or passwords. Use for crackmes, binary bombs, key validators, obfuscated code, algorithm recovery, or any challenge requiring program comprehension to extract hidden information.
Performs focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?", "What's the C2 address?", "Fix types in this function". Makes incremental improvements (renaming…
Lazy-senior-dev discipline for all code written in this repo — YAGNI, reuse-before-write, stdlib/native/dependency before custom, shortest working diff after understanding the real flow. Use whenever writing, modifying, refactoring, or reviewing code in edge. The ponytail: comment marker (18 sites in lib/) flags…
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to…
Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe, ntdll.dll, win32k.sys, ci.dll, or cng.sys to find changed syscalls, symbols, types, mitigation flags, callbacks…
Layer 3 deep documentation methodology. Per-module behavioral specifications, external and behavioral integration contracts, behavior documentation, end-to-end user journey analysis. Transforms Layer 2 synthesis into implementable behavioral specifications. Loaded by the analyzer agent during Layer 3.
Layer 2 synthesis methodology. Feature discovery, architecture reverse engineering, API extraction, cross-source synthesis with conflict resolution, module mapping. Transforms raw Layer 1 intelligence into structured synthesis documents. Loaded by the analyzer agent during Layer 2.
Layer 1 skill for source code analysis — decompose any codebase into analyzable units, extract behavioral claims with provenance. Supports three target shapes (source tree, bundle, decompiled binary), with per-language grep patterns and analysis templates.
Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
Review a decompilation matching change the way a decomp maintainer would - first verifying the match is real (fakematch / NONMATCHING-banner / wrong-compiler checks), then whether the recovered source is admissible, then what it costs the host port. Use when reviewing or preparing a matching PR/branch/diff in a decomp…
Execute the sm64ds-decomp translation-unit rebuild/verify loop - reconstruct a merged TU in srctu/, compile it with the pinned mwccarm, byte-verify every member, run the relocation audits, and take it up the shadow -> text-verified -> link-verified ladder. Use when merging one-function files into a real .cpp, when…
Find which classes shared an original .cpp translation unit in sm64ds-decomp, so a C++ conversion PR ships the right set of classes together instead of splitting a file the ROM says is one. Use before slicing a per-class migration PR, when deciding whether two classes belong in one header, when eligible.py rejects a…
Compile TH08 functions with the repository VC7 build and compare configured COFF functions against the hash-attested 1.00d target using config/match-units.toml and scripts/compare-function.py. Use for focused code-generation tuning, relocation diagnosis, or exact-match verification.
Reconstruct bounded functions from the original Japanese TH08 1.00d executable using hash-attested target evidence, upstream GensokyoClub source, and explicitly labeled TH06/TH07 corroboration. Use for TH08 disassembly, ABI recovery, function naming, layout recovery, source migration, or implementation work.
Generate and interpret target-pinned TH08 instruction and ABI fact packets with scripts/typed-re.py. Use for stack layout, register homes, access widths, direct calls, return cleanup, or VC7 source-shape diagnosis before strict comparison.
Capture one Mira detection case as a structured record. Use when Codex needs to turn a concrete finding, experiment, command output, or risk-environment clue into a reusable case with smells, key clues, judgment seeds, and next checks under the Mira knowledge pipeline.
Route Mira detection findings into a reusable knowledge pipeline. Use when Codex needs to turn a new detection clue, risk-environment observation, or research note into topic confirmation, case capture, topic maintenance, and article update suggestions inside the Mira repository.