reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/reverse-engineering-binaries-with-radare2-rizin/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/reverse-engineering-binaries-with-radare2-rizin/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: reverse-engineering-binaries-with-radare2-rizin
+description: 'Reverse engineers binaries using radare2/rizin interactively, covering analysis
+  initialization, navigation, disassembly and graph views, patching, and the visual mode workflow.
+  Activates for requests to reverse a binary with radare2 or rizin, learn r2 commands, or navigate
+  and disassemble a sample in r2.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - radare2
+  - rizin
+  - disassembly
+  - static-analysis
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027
+  - T1059
+  - T1587.001
+d3fend:
+  - D3-DA
+  - D3-SDA
+references:
+  - 'The radare2 book — https://book.rada.re/'
+  - 'Rizin documentation — https://rizin.re/'
+---
+
+# Reverse Engineering Binaries With radare2/rizin
+
+## When to Use
+
+- You want to statically reverse a binary with the radare2/rizin command set: analyze, navigate
+  functions, read disassembly/graphs, and patch.
+- You prefer a scriptable, terminal-based RE workflow.
+
+**Do not use** r2's debug mode (`-d`) to run untrusted samples on your host — for static RE, open
+without debugging. Work in an isolated environment.
+
+## Prerequisites
+
+- radare2 or rizin installed and the sample (read inertly).
+
+## Safety & Handling
+
+- Static analysis does not execute the sample; keep the working directory isolated.
+
+## Workflow
+
+### Step 1: Open and analyze
+
+```bash
+python scripts/analyst.py cheatsheet analyze
+```
+
+Prints the core sequence: open read-only (`r2 -e bin.cache=true sample`), `aaa` to analyze, `afl`
+to list functions, `iI`/`ie` for info/entrypoint.
+
+### Step 2: Navigate and disassemble
+
+Use `s <addr>`/`s main` to seek, `pdf` to print a function, `VV` for the graph view, and `axt` for
+cross-references.
+
+### Step 3: Annotate
+
+Rename with `afn`, add comments with `CC`, define data with `Cd`, and flag locations with `f`.
+
+### Step 4: Patch (optional)
+
+In write mode (`-w`), use `wa`/`wx` to assemble/patch and re-verify with `pdf`.
+
+## Validation
+
+- `aaa` completes and `afl` lists functions before deeper navigation.
+- Commands used are real r2/rizin commands (verifiable in the book).
+- Patches are re-disassembled to confirm the intended change.
+
+## Pitfalls
+
+- Forgetting `aaa`, leaving functions undefined.
+- Confusing radare2 and rizin command differences in scripts.
+- Opening with `-d` (debug/run) when only static analysis is intended.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the command cheatsheet tool.
+- The radare2 book and Rizin docs (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/reverse-engineering-binaries-with-radare2-rizin/references/api-reference.md

@@ -0,0 +1,34 @@
+# API Reference: Reverse Engineering Binaries With radare2/rizin
+
+## Overview
+
+`scripts/analyst.py` is a reference helper that prints curated radare2/rizin command cheatsheets
+grouped by task. It emits text only and never runs r2 or a sample.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | JSON, argparse |
+
+## Core functions
+
+### `cheatsheet(topic)`
+Returns commands for a topic, or all topics with `all`.
+
+## Topics
+
+`analyze`, `navigate`, `disassemble`, `xrefs`, `annotate`, `patch`, `strings`, `search`.
+
+## Usage
+
+```bash
+python scripts/analyst.py cheatsheet analyze
+python scripts/analyst.py cheatsheet all
+```
+
+## Sources
+
+- The radare2 book (command reference) — https://book.rada.re/
+- Rizin documentation — https://rizin.re/
+- r2 visual/graph mode and patching commands from official documentation

vendor-new/analyst-ai-pack/skills/reverse-engineering-binaries-with-radare2-rizin/scripts/analyst.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Print curated radare2/rizin command cheatsheets for common RE tasks.
+
+A reference helper that emits real r2/rizin commands grouped by task (analyze, navigate,
+disassemble, xrefs, annotate, patch, strings, search). It prints text only and never runs r2 or
+any sample.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+CHEATSHEETS = {
+    "analyze": [
+        ("r2 -e bin.cache=true sample", "open read-only with cache"),
+        ("aaa", "analyze all (functions, refs, strings)"),
+        ("aflj", "list functions as JSON"),
+        ("afl", "list functions"),
+        ("iI", "binary info"),
+        ("ie", "entrypoints"),
+    ],
+    "navigate": [
+        ("s main", "seek to main"),
+        ("s 0x401000", "seek to address"),
+        ("s-", "seek backward in history"),
+        ("VV", "interactive graph view of current function"),
+    ],
+    "disassemble": [
+        ("pdf", "print disassembly of function"),
+        ("pd 20", "print 20 instructions"),
+        ("pdc", "pseudo-decompile (if available)"),
+        ("pdr", "recursive disassembly"),
+    ],
+    "xrefs": [
+        ("axt 0x401000", "references TO this address"),
+        ("axf 0x401000", "references FROM this address"),
+        ("afx", "xrefs within the function"),
+    ],
+    "annotate": [
+        ("afn newname", "rename current function"),
+        ("CC comment text", "add a comment at current offset"),
+        ("f myflag", "set a flag at current offset"),
+        ("Cd 4", "define 4-byte data"),
+    ],
+    "patch": [
+        ("r2 -w sample", "open in write mode"),
+        ("wa nop", "assemble 'nop' at current offset"),
+        ("wx 9090", "write hex bytes"),
+        ("pdf", "re-verify the patch"),
+    ],
+    "strings": [
+        ("izj", "strings in data sections (JSON)"),
+        ("izzj", "strings in the whole file (JSON)"),
+        ("iij", "imports (JSON)"),
+    ],
+    "search": [
+        ("/ pattern", "search for a string"),
+        ("/x 4889", "search for hex bytes"),
+        ("/R pop rdi", "search for ROP gadget"),
+    ],
+}
+
+
+def cheatsheet(topic: str) -> dict:
+    if topic == "all":
+        return {t: [{"cmd": c, "desc": d} for c, d in items]
+                for t, items in CHEATSHEETS.items()}
+    items = CHEATSHEETS.get(topic)
+    if not items:
+        return {"error": "unknown topic", "topics": sorted(CHEATSHEETS)}
+    return {topic: [{"cmd": c, "desc": d} for c, d in items]}
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="radare2/rizin command cheatsheets")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("cheatsheet")
+    p.add_argument("topic", nargs="?", default="all")
+    args = parser.parse_args(argv)
+    print(json.dumps(cheatsheet(args.topic), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())