reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/automating-analysis-with-r2pipe/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/automating-analysis-with-r2pipe/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: automating-analysis-with-r2pipe
+description: 'Automates radare2/rizin analysis through r2pipe to script function enumeration, string
+  and import extraction, and cross-reference queries across samples programmatically. Activates for
+  requests to automate radare2 with r2pipe, script rizin analysis, or batch-extract functions and
+  xrefs from binaries.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - radare2
+  - rizin
+  - r2pipe
+  - automation
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027
+  - T1059
+  - T1587.001
+d3fend:
+  - D3-DA
+  - D3-SDA
+references:
+  - 'radare2 r2pipe documentation — https://github.com/radareorg/radare2-r2pipe'
+  - 'radare2 command reference — https://book.rada.re/'
+---
+
+# Automating Analysis With r2pipe
+
+## When to Use
+
+- You want to script radare2/rizin to extract functions, imports, strings, and cross-references
+  programmatically, across one or many samples.
+- You are building a repeatable triage pipeline on top of r2's analysis commands.
+
+**Do not use** r2 to debug/run the sample here — this skill drives static analysis commands
+(`aaa`, `aflj`, `izj`, `iij`). Run inside an isolated environment.
+
+## Prerequisites
+
+- radare2 (or rizin) installed and the `r2pipe` Python package (the script degrades gracefully and
+  reports unavailability if absent).
+
+## Safety & Handling
+
+- r2 static analysis does not execute the sample; keep the working directory isolated.
+
+## Workflow
+
+### Step 1: Confirm r2pipe availability
+
+```bash
+python scripts/analyst.py check
+```
+
+Reports whether `r2pipe` and an `r2`/`rizin` binary are available.
+
+### Step 2: Extract an analysis summary
+
+```bash
+python scripts/analyst.py summary sample.bin
+```
+
+Opens the binary, runs analysis (`aaa`), and collects functions (`aflj`), imports (`iij`), and
+strings (`izj`) as structured JSON.
+
+### Step 3: Query cross-references
+
+For a function of interest, gather xrefs to/from to map call relationships.
+
+### Step 4: Aggregate
+
+Combine per-sample summaries for comparison and signature development.
+
+## Validation
+
+- The summary returns non-empty functions/imports for a normal binary.
+- JSON commands (`*j`) are parsed, not screen-scraped text.
+- Missing r2pipe/r2 is reported clearly rather than crashing.
+
+## Pitfalls
+
+- Forgetting to run `aaa` before querying functions (empty results).
+- Mixing radare2 and rizin command differences in scripted output.
+- Very large binaries making `aaa` slow — scope analysis as needed.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the automation wrapper.
+- r2pipe and radare2 command references (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/automating-analysis-with-r2pipe/references/api-reference.md

@@ -0,0 +1,44 @@
+# API Reference: Automating Analysis With r2pipe
+
+## Overview
+
+`scripts/analyst.py` drives radare2/rizin static analysis through r2pipe: it runs `aaa` and collects
+functions (`aflj`), imports (`iij`), and strings (`izj`) as JSON. r2pipe is optional; `check`
+reports availability. It drives static analysis commands only and does not run the sample in a
+debugger.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| r2pipe | latest | radare2/rizin automation (optional; summary requires it) |
+| radare2/rizin | latest | the analysis engine |
+| (stdlib) | — | shutil, JSON |
+
+## Core functions
+
+### `check()`
+Reports r2pipe availability and which r2/rizin binary is on PATH.
+
+### `summary(path)`
+Returns function count/list, imports, and strings via JSON commands.
+
+## Key r2 commands used
+
+- `aaa` — analyze all.
+- `aflj` — list functions (JSON).
+- `iij` — imports (JSON).
+- `izj` — strings in data sections (JSON).
+
+## Usage
+
+```bash
+python scripts/analyst.py check
+python scripts/analyst.py summary sample.bin
+```
+
+## Sources
+
+- r2pipe documentation — https://github.com/radareorg/radare2-r2pipe
+- radare2 command reference (The radare2 book) — https://book.rada.re/
+- JSON command suffix (`*j`) convention from radare2 documentation

vendor-new/analyst-ai-pack/skills/automating-analysis-with-r2pipe/scripts/analyst.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Automate radare2/rizin static analysis through r2pipe.
+
+`check` reports tool availability. `summary` opens a binary, runs static analysis (aaa), and
+collects functions (aflj), imports (iij), and strings (izj) as JSON. r2pipe is optional; without
+it the script reports that automation is unavailable. Drives static analysis commands only and
+does not run the sample in a debugger.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import sys
+
+try:
+    import r2pipe  # type: ignore
+    HAVE_R2PIPE = True
+except ImportError:
+    HAVE_R2PIPE = False
+
+
+def _r2_binary() -> str | None:
+    for name in ("radare2", "r2", "rizin"):
+        if shutil.which(name):
+            return name
+    return None
+
+
+def check() -> dict:
+    return {
+        "r2pipe_available": HAVE_R2PIPE,
+        "r2_binary": _r2_binary(),
+        "ready": HAVE_R2PIPE and _r2_binary() is not None,
+    }
+
+
+def _cmdj(r2, command: str):  # noqa: ANN001
+    try:
+        return r2.cmdj(command) or []
+    except Exception:
+        return []
+
+
+def summary(path: str) -> dict:
+    if not HAVE_R2PIPE:
+        return {"error": "r2pipe not installed", "r2pipe_available": False}
+    r2 = r2pipe.open(path, flags=["-2"])  # -2 closes stderr noise
+    try:
+        r2.cmd("aaa")
+        funcs = _cmdj(r2, "aflj")
+        imports = _cmdj(r2, "iij")
+        strings = _cmdj(r2, "izj")
+        result = {
+            "function_count": len(funcs),
+            "functions": [{"name": f.get("name"), "offset": f.get("offset"),
+                           "size": f.get("size")} for f in funcs[:200]],
+            "imports": [i.get("name") for i in imports if i.get("name")][:200],
+            "strings": [s.get("string") for s in strings if s.get("string")][:200],
+        }
+    finally:
+        r2.quit()
+    return result
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Automate r2/rizin via r2pipe")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    sub.add_parser("check")
+    ps = sub.add_parser("summary")
+    ps.add_argument("file")
+    args = parser.parse_args(argv)
+    if args.cmd == "check":
+        print(json.dumps(check(), indent=2))
+    else:
+        print(json.dumps(summary(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())