# 🗺 ЧТО КУДА ЮЗАТЬ — роутер по задачам

## Агentic-инструмент №1
**REA** (`our-skills/rea-full-course/`) — «реверси что угодно»: Electron/JS бандлы, APK, EVM, Go/Rust. Ставится `npx rea-agents@latest setup` в Claude Code/Codex/Cursor/Hermes. Полный курс: `research-what-we-did/rea-full-course-source.md`.

## По типу цели
| Цель | Скиллы/тулзы |
|---|---|
| Windows PE (user-mode) | `reverse-engineering-malware-with-ghidra` (top-level) + `win-dev-skills/windbg-user-*` (TTD reverse debugging, heap corruption) + `performing-static-malware-analysis-with-pe-studio` |
| Windows kernel/драйверы | `win-dev-skills/windbg-kernel-*` + `analyzing-windows-driver-malware` + `dissecting-boot-and-kernel-rootkits` (analyst-ai-pack) |
| .NET | `reverse-engineering-dotnet-malware-with-dnspy` + `analyzing-dotnet-malware-internals` |
| Android APK | `android-reverse-engineering-skill` (SimoneAvogadro, jadx/Frida end-to-end) + `apk-reverse` (7 скиллов: unpacking, dex2jar) + `analyzing-android-malware-with-apktool` + `analyzing-android-dex-malware` |
| iOS | `reverse-engineering-ios-app-with-frida` |
| Linux ELF | `analyzing-elf-binaries-on-linux` + `analyzing-linux-elf-malware` + `analyzing-linux-kernel-rootkits` |
| macOS Mach-O | `analyzing-mach-o-binaries-on-macos` |
| Go / Rust / Nim / exotic | `analyzing-golang-malware-with-ghidra`, `reverse-engineering-rust-malware`, `analyzing-rust-malware-internals`, `reverse-engineering-nim-and-other-exotic-binaries` |
| ARM | `reverse-engineering-arm-binaries` |
| Прошивки / UEFI / PLC / embedded | `rev-skills/` (143 скилла: binwalk, EMBA, чипы, протоколы) + `performing-firmware-extraction-with-binwalk` + `auditing-uefi-firmware-with-chipsec` + `performing-plc-firmware-security-analysis` + `analyzing-uefi-bootkit-persistence` |
| JS/Web реверс (сигнатуры сайтов) | `xbsReverseSkill/` (33: xiaohongshu/bilibili/douyin, wasm, sign-алгоритмы) + `js-reverse-automation--skill` + `deobfuscating-javascript-malware` |
| Офис/PDF/скрипты | `analyzing-macro-malware-in-office-documents`, `analyzing-pdf-malware-with-pdfid`, `deobfuscating-powershell-obfuscated-malware`, `analyzing-malicious-*` (analyst-ai-pack) |

## По этапу работы
| Этап | Чем |
|---|---|
| Триаж образца | `triaging-an-unknown-sample`, `identifying-file-types-and-formats`, `measuring-section-entropy-to-detect-packing`, `extracting-and-classifying-strings`, capa: `generating-capability-reports-with-capa` |
| Распаковка | `manually-unpacking-a-packed-binary`, `unpacking-upx-and-common-packers`, `analyzing-packed-malware-with-upx-unpacker`, `dumping-and-rebuilding-a-pe-from-memory` |
| Статика | Ghidra: `scripting-ghidra-headless-analysis` · IDA: `scripting-ida-with-idapython` · r2/rizin: `reverse-engineering-binaries-with-radare2-rizin`, `automating-analysis-with-r2pipe` · Binary Ninja: `reverse-engineering-binaries-with-binary-ninja` |
| Динамика | `performing-dynamic-analysis-in-a-sandbox`, `analyzing-malware-behavior-with-cuckoo-sandbox`, `performing-automated-malware-analysis-with-cape`, `debugging-malware-with-x64dbg`, `monitoring-process-and-file-behavior`, lab: `setting-up-an-isolated-malware-analysis-lab` |
| Анти-анализ | `identifying-anti-debugging-techniques`, `bypassing-anti-vm-and-sandbox-checks`, `detecting-sandbox-evasion-behavior`, `defeating-control-flow-flattening`, `defeating-string-and-api-obfuscation` |
| Шеллкоды/инъекции | `emulating-shellcode-with-unicorn`, `reverse-engineering-shellcode`, `recovering-injected-code-and-shellcode`, `resolving-dynamic-api-hashing`, `analyzing-position-independent-code`, `analyzing-heap-spray-exploitation` |
| Конфиги/C2/ключи | `building-config-extractors`, `decrypting-embedded-configuration`, `extracting-config-from-a-running-sample`, `extracting-encryption-keys-from-binaries`, `extracting-cobalt-strike-beacon-config`, `reverse-engineering-custom-c2-protocols`, `analyzing-cobalt-strike-beacon-configuration` |
| Память | `performing-memory-forensics-with-volatility3(+plugins)`, `analyzing-memory-dumps-with-volatility`, `analyzing-malware-in-memory-with-volatility3`, `detecting-process-injection-in-memory` |
| Символьное исполнение | `solving-malware-with-symbolic-execution` |
| Дифф/патч | `diffing-malware-samples-to-find-changes`, `patch-diffing-with-bindiff-and-diaphora` |
| YARA/детекты | `writing-yara-rules-from-reversed-code`, `scanning-samples-with-yara`, `performing-malware-triage-with-yara`, `performing-yara-rule-development-for-detection` |
| Отчёт | `writing-a-malware-analysis-report`, `performing-full-scope-malware-analysis` |
| CTF | `CTF-Sandbox-Orchestrator` (42 сценария) |
| Пентест-интеграция | `reverser-pentester`, `pentest-tools/src-hunter` |

## MCP-серверы для агента (что подключать)
- **REA** — универсальный (Electron/Ghidra/JADX/EVM) — `our-skills/rea-full-course`
- **ida-pro-mcp** — IDA GUI-attached (`~/.idapro/mcp.json`)
- **GhidraMCP / ghidra-mcp** — Ghidra headless/GUI
- **x64dbg-mcp / r2ai** — динамика Windows / r2
- Каталог + пробы: `research-what-we-did/mcp-catalogs.md`

## Золотой пайплайн (malware-образец)
DIE/entropy/strings триаж → распаковка → статика (Ghidra/IDA) → динамика (sandbox/x64dbg/Frida) → деобфускация → behavior/конфиг-экстрактор → diff с известными → YARA + отчёт

---
👻 [ииШко](https://t.me/AlStack)