reverse-skills-max: initial public release (restored, redacted, hardened)

USE-MAP.md

@@ -0,0 +1,51 @@
+# 🗺 ЧТО КУДА ЮЗАТЬ — роутер по задачам
+
+## Агentic-инструмент №1
+**REA** (`our-skills/rea-full-course/`) — «реверси что угодно»: Electron/JS бандлы, APK, EVM, Go/Rust. Ставится `npx rea-agents@latest setup` в Claude Code/Codex/Cursor/Hermes. Полный курс: `research-what-we-did/rea-full-course-source.md`.
+
+## По типу цели
+| Цель | Скиллы/тулзы |
+|---|---|
+| Windows PE (user-mode) | `reverse-engineering-malware-with-ghidra` (top-level) + `win-dev-skills/windbg-user-*` (TTD reverse debugging, heap corruption) + `performing-static-malware-analysis-with-pe-studio` |
+| Windows kernel/драйверы | `win-dev-skills/windbg-kernel-*` + `analyzing-windows-driver-malware` + `dissecting-boot-and-kernel-rootkits` (analyst-ai-pack) |
+| .NET | `reverse-engineering-dotnet-malware-with-dnspy` + `analyzing-dotnet-malware-internals` |
+| Android APK | `android-reverse-engineering-skill` (SimoneAvogadro, jadx/Frida end-to-end) + `apk-reverse` (7 скиллов: unpacking, dex2jar) + `analyzing-android-malware-with-apktool` + `analyzing-android-dex-malware` |
+| iOS | `reverse-engineering-ios-app-with-frida` |
+| Linux ELF | `analyzing-elf-binaries-on-linux` + `analyzing-linux-elf-malware` + `analyzing-linux-kernel-rootkits` |
+| macOS Mach-O | `analyzing-mach-o-binaries-on-macos` |
+| Go / Rust / Nim / exotic | `analyzing-golang-malware-with-ghidra`, `reverse-engineering-rust-malware`, `analyzing-rust-malware-internals`, `reverse-engineering-nim-and-other-exotic-binaries` |
+| ARM | `reverse-engineering-arm-binaries` |
+| Прошивки / UEFI / PLC / embedded | `rev-skills/` (143 скилла: binwalk, EMBA, чипы, протоколы) + `performing-firmware-extraction-with-binwalk` + `auditing-uefi-firmware-with-chipsec` + `performing-plc-firmware-security-analysis` + `analyzing-uefi-bootkit-persistence` |
+| JS/Web реверс (сигнатуры сайтов) | `xbsReverseSkill/` (33: xiaohongshu/bilibili/douyin, wasm, sign-алгоритмы) + `js-reverse-automation--skill` + `deobfuscating-javascript-malware` |
+| Офис/PDF/скрипты | `analyzing-macro-malware-in-office-documents`, `analyzing-pdf-malware-with-pdfid`, `deobfuscating-powershell-obfuscated-malware`, `analyzing-malicious-*` (analyst-ai-pack) |
+
+## По этапу работы
+| Этап | Чем |
+|---|---|
+| Триаж образца | `triaging-an-unknown-sample`, `identifying-file-types-and-formats`, `measuring-section-entropy-to-detect-packing`, `extracting-and-classifying-strings`, capa: `generating-capability-reports-with-capa` |
+| Распаковка | `manually-unpacking-a-packed-binary`, `unpacking-upx-and-common-packers`, `analyzing-packed-malware-with-upx-unpacker`, `dumping-and-rebuilding-a-pe-from-memory` |
+| Статика | Ghidra: `scripting-ghidra-headless-analysis` · IDA: `scripting-ida-with-idapython` · r2/rizin: `reverse-engineering-binaries-with-radare2-rizin`, `automating-analysis-with-r2pipe` · Binary Ninja: `reverse-engineering-binaries-with-binary-ninja` |
+| Динамика | `performing-dynamic-analysis-in-a-sandbox`, `analyzing-malware-behavior-with-cuckoo-sandbox`, `performing-automated-malware-analysis-with-cape`, `debugging-malware-with-x64dbg`, `monitoring-process-and-file-behavior`, lab: `setting-up-an-isolated-malware-analysis-lab` |
+| Анти-анализ | `identifying-anti-debugging-techniques`, `bypassing-anti-vm-and-sandbox-checks`, `detecting-sandbox-evasion-behavior`, `defeating-control-flow-flattening`, `defeating-string-and-api-obfuscation` |
+| Шеллкоды/инъекции | `emulating-shellcode-with-unicorn`, `reverse-engineering-shellcode`, `recovering-injected-code-and-shellcode`, `resolving-dynamic-api-hashing`, `analyzing-position-independent-code`, `analyzing-heap-spray-exploitation` |
+| Конфиги/C2/ключи | `building-config-extractors`, `decrypting-embedded-configuration`, `extracting-config-from-a-running-sample`, `extracting-encryption-keys-from-binaries`, `extracting-cobalt-strike-beacon-config`, `reverse-engineering-custom-c2-protocols`, `analyzing-cobalt-strike-beacon-configuration` |
+| Память | `performing-memory-forensics-with-volatility3(+plugins)`, `analyzing-memory-dumps-with-volatility`, `analyzing-malware-in-memory-with-volatility3`, `detecting-process-injection-in-memory` |
+| Символьное исполнение | `solving-malware-with-symbolic-execution` |
+| Дифф/патч | `diffing-malware-samples-to-find-changes`, `patch-diffing-with-bindiff-and-diaphora` |
+| YARA/детекты | `writing-yara-rules-from-reversed-code`, `scanning-samples-with-yara`, `performing-malware-triage-with-yara`, `performing-yara-rule-development-for-detection` |
+| Отчёт | `writing-a-malware-analysis-report`, `performing-full-scope-malware-analysis` |
+| CTF | `CTF-Sandbox-Orchestrator` (42 сценария) |
+| Пентест-интеграция | `reverser-pentester`, `pentest-tools/src-hunter` |
+
+## MCP-серверы для агента (что подключать)
+- **REA** — универсальный (Electron/Ghidra/JADX/EVM) — `our-skills/rea-full-course`
+- **ida-pro-mcp** — IDA GUI-attached (`~/.idapro/mcp.json`)
+- **GhidraMCP / ghidra-mcp** — Ghidra headless/GUI
+- **x64dbg-mcp / r2ai** — динамика Windows / r2
+- Каталог + пробы: `research-what-we-did/mcp-catalogs.md`
+
+## Золотой пайплайн (malware-образец)
+DIE/entropy/strings триаж → распаковка → статика (Ghidra/IDA) → динамика (sandbox/x64dbg/Frida) → деобфускация → behavior/конфиг-экстрактор → diff с известными → YARA + отчёт
+
+---
+👻 [ииШко](https://t.me/AlStack)