open-reverselab

Name: open-reverselab
Author: LING71671

878stars232forks

How to install open-reverselab?

ling71671/open-reverselab

$git clone https://github.com/LING71671/open-reverselab

Installs into the current project.

Summary

Open-source reverse engineering lab — 178-article knowledge base, 100+ MCP automation tools, covering CTF pentesting / APK reverse engineering / PE binary analysis / cryptography & protocol cracking / game cheating analysis. Agent-native, directory-as-convention.

Files · 1

View on GitHub

README.md

1	# ReverseLab
2
3	Open-source reverse engineering lab — 178-article knowledge base, 100+ MCP automation tools, covering CTF pentesting / APK reverse engineering / PE binary analysis / cryptography & protocol cracking / game cheating analysis. Agent-native, directory-as-convention.
4
5	> [中文版](README.zh.md)
6
7	## Routing
8
9	```
10	Signal → kb_router(board=) → kb_read_file → Attack chain → MCP tool mapping → Execution
11	```
12
13	\| Signal Type \| Board \| KB Categories / Files \| MCP Tool Family \|
14	\|---\|---\|---\|---\|
15	\| HTTP/Web/API/CVE/Cloud/CAPTCHA \| `ctf-website` \| 26/118 \| `http_probe` `run_ctf_tool` `kb_router` \|
16	\| APK/DEX/SO/Frida/Java \| `apk-reverse` \| 8/20 \| `android_app_baseline` `android_crypto_unpack_recipe` `android_frida_*` \|
17	\| PE/x64/x86/malware/driver \| `pe-reverse` \| 9/22 \| `triage_pe` `ghidra_headless_analyze` `make_x64dbg_breakpoint_script` `sample_full_workup` \|
18	\| Crypto/Protocol/Cheat/IoT/Radio \| `general` \| 5/17 \| `die_scan` `ghidra_` `rizin_` `python_re_tool_*` \|
19
20	## Knowledge Base
21
22	```
23	kb/
24	├── ctf-website/techniques/ 26 categories, 118 articles — Full web attack surface
25	├── apk-reverse/techniques/ 8 categories, 20 articles — APK/DEX reverse engineering
26	├── pe-reverse/techniques/ 9 categories, 22 articles — PE binary analysis
27	└── general/techniques/ 5 categories, 17 articles — Cryptography / Protocols / Kernel / Cheating / Methodology
28	```
29
30	Each technique file follows this structure: `Scenario → Input signal → Method → Attack chain → MCP tool mapping`
31
32	Agent workflow: detect signal → `kb_router` lookup → `kb_read_file` → execute via MCP tool mapping.
33
34	## Boards
35
36	\| Board \| Trigger Signals \|
37	\|---\|---\|
38	\| `boards/ctf-website` \| URL, HTTP, JWT, SQLi, SSRF, CVE, API, CSP, OAuth, CAPTCHA, Cloudflare, ReDoS, Slowloris, DoS, Paywall \|
39	\| `boards/android` \| APK, DEX, adb, Frida, jadx, smali, SO, native \|
40	\| `boards/windows` \| PE, EXE, DLL, x64dbg, Ghidra, Procmon, packer, malware \|
41	\| `boards/general` \| AES/DES/RSA, protobuf, game cheat, EAC/BE/Vanguard, firmware, JTAG, SDR \|
42	\| `boards/misc` \| MCP config, skill installation, environment health check \|
43
44	## Directory Convention
45
46	```
47	samples/ → Original samples + _quarantine/ + unpacked/
48	exports/ → Tool outputs (triage / IOC / YARA / Sigma / Procmon / Ghidra summaries)
49	patches/ → Patch artifacts (original samples are never modified)
50	notes/ → Analysis notes
51	reports/ → Final reports
52	scripts/ → Automation scripts
53	projects/ → Ghidra project files
54	templates/ → Note / report / rule templates
55	kb/ → Reusable attack knowledge base
56	tools/ → Toolchain
57	cases/ → Lightweight index — no large file copies
58	```
59
60	## Installation
61
62	On Windows, beginners can double-click `START_HERE.bat` or `START_HERE.cmd`
63	from the repository root. It checks Python, uv, Git, workspace layout, and
64	`reverse_lab_tools` MCP; creates core wrappers; runs real MCP tool calls; gives
65	install advice for missing items; and writes `reports/misc/first-run-report.json`
66	plus `reports/misc/mcp-smoke-report.json`.
67
68	On macOS/Linux, run `./START_HERE.sh` from the repository root. It performs the
69	same first-run checks and uses POSIX shell wrappers under `tools/bin/`; optional
70	Windows GUI/PE tools are skipped or reported as Windows-only. Platform-specific
71	release artifacts can stay separate: Windows full-toolchain releases ship
72	`.bat`/PowerShell and GUI tools, while macOS/Linux releases ship the Python,
73	MCP, shell-wrapper, and native CLI paths.
74
75	To have an AI Agent perform setup for you, copy the [AI install prompt](templates/prompts/ai-install.en.md) into Codex or Claude Code.
76	If you are not sure where to start, open [START.md](START.md).
77
78	```powershell
79	git clone https://github.com/LING71671/open-reverselab.git
80	cd open-reverselab
81	python scripts/misc/first_run_check.py # Check workspace + reverse_lab_tools MCP
82	uv run --project tools/skills/mcp/ReverseLabToolsMCP python scripts/misc/mcp_smoke_check.py --write-report
83	.\scripts\misc\bootstrap.ps1 # Core script wr

People who liked this also viewed

6 picks

Type

open-reverselab

878stars232forks

View on GitHub

How to install open-reverselab?

ling71671/open-reverselab

$git clone https://github.com/LING71671/open-reverselab

Installs into the current project.

Summary

Files · 1

View on GitHub

README.md

1	# ReverseLab
2
3	Open-source reverse engineering lab — 178-article knowledge base, 100+ MCP automation tools, covering CTF pentesting / APK reverse engineering / PE binary analysis / cryptography & protocol cracking / game cheating analysis. Agent-native, directory-as-convention.
4
5	> [中文版](README.zh.md)
6
7	## Routing
8
9	```
10	Signal → kb_router(board=) → kb_read_file → Attack chain → MCP tool mapping → Execution
11	```
12
13	\| Signal Type \| Board \| KB Categories / Files \| MCP Tool Family \|
14	\|---\|---\|---\|---\|
15	\| HTTP/Web/API/CVE/Cloud/CAPTCHA \| `ctf-website` \| 26/118 \| `http_probe` `run_ctf_tool` `kb_router` \|
16	\| APK/DEX/SO/Frida/Java \| `apk-reverse` \| 8/20 \| `android_app_baseline` `android_crypto_unpack_recipe` `android_frida_*` \|
17	\| PE/x64/x86/malware/driver \| `pe-reverse` \| 9/22 \| `triage_pe` `ghidra_headless_analyze` `make_x64dbg_breakpoint_script` `sample_full_workup` \|
18	\| Crypto/Protocol/Cheat/IoT/Radio \| `general` \| 5/17 \| `die_scan` `ghidra_` `rizin_` `python_re_tool_*` \|
19
20	## Knowledge Base
21
22	```
23	kb/
24	├── ctf-website/techniques/ 26 categories, 118 articles — Full web attack surface
25	├── apk-reverse/techniques/ 8 categories, 20 articles — APK/DEX reverse engineering
26	├── pe-reverse/techniques/ 9 categories, 22 articles — PE binary analysis
27	└── general/techniques/ 5 categories, 17 articles — Cryptography / Protocols / Kernel / Cheating / Methodology
28	```
29
30	Each technique file follows this structure: `Scenario → Input signal → Method → Attack chain → MCP tool mapping`
31
32	Agent workflow: detect signal → `kb_router` lookup → `kb_read_file` → execute via MCP tool mapping.
33
34	## Boards
35
36	\| Board \| Trigger Signals \|
37	\|---\|---\|
38	\| `boards/ctf-website` \| URL, HTTP, JWT, SQLi, SSRF, CVE, API, CSP, OAuth, CAPTCHA, Cloudflare, ReDoS, Slowloris, DoS, Paywall \|
39	\| `boards/android` \| APK, DEX, adb, Frida, jadx, smali, SO, native \|
40	\| `boards/windows` \| PE, EXE, DLL, x64dbg, Ghidra, Procmon, packer, malware \|
41	\| `boards/general` \| AES/DES/RSA, protobuf, game cheat, EAC/BE/Vanguard, firmware, JTAG, SDR \|
42	\| `boards/misc` \| MCP config, skill installation, environment health check \|
43
44	## Directory Convention
45
46	```
47	samples/ → Original samples + _quarantine/ + unpacked/
48	exports/ → Tool outputs (triage / IOC / YARA / Sigma / Procmon / Ghidra summaries)
49	patches/ → Patch artifacts (original samples are never modified)
50	notes/ → Analysis notes
51	reports/ → Final reports
52	scripts/ → Automation scripts
53	projects/ → Ghidra project files
54	templates/ → Note / report / rule templates
55	kb/ → Reusable attack knowledge base
56	tools/ → Toolchain
57	cases/ → Lightweight index — no large file copies
58	```
59
60	## Installation
61
62	On Windows, beginners can double-click `START_HERE.bat` or `START_HERE.cmd`
63	from the repository root. It checks Python, uv, Git, workspace layout, and
64	`reverse_lab_tools` MCP; creates core wrappers; runs real MCP tool calls; gives
65	install advice for missing items; and writes `reports/misc/first-run-report.json`
66	plus `reports/misc/mcp-smoke-report.json`.
67
68	On macOS/Linux, run `./START_HERE.sh` from the repository root. It performs the
69	same first-run checks and uses POSIX shell wrappers under `tools/bin/`; optional
70	Windows GUI/PE tools are skipped or reported as Windows-only. Platform-specific
71	release artifacts can stay separate: Windows full-toolchain releases ship
72	`.bat`/PowerShell and GUI tools, while macOS/Linux releases ship the Python,
73	MCP, shell-wrapper, and native CLI paths.
74
75	To have an AI Agent perform setup for you, copy the [AI install prompt](templates/prompts/ai-install.en.md) into Codex or Claude Code.
76	If you are not sure where to start, open [START.md](START.md).
77
78	```powershell
79	git clone https://github.com/LING71671/open-reverselab.git
80	cd open-reverselab
81	python scripts/misc/first_run_check.py # Check workspace + reverse_lab_tools MCP
82	uv run --project tools/skills/mcp/ReverseLabToolsMCP python scripts/misc/mcp_smoke_check.py --write-report
83	.\scripts\misc\bootstrap.ps1 # Core script wr

People who liked this also viewed

6 picks

Type