oimiragieo/reveng-debugging

authorized-scope-ethics

Use before any reverse-engineering or malware-analysis work to confirm authorization and evidence rules. DO NOT USE as a pentest or hacking playbook.

ceh-malware-static

Use when statically classifying an authorized malware-suspect PE without running it. DO NOT USE to write, spread, or execute malware.

cookbook-format-tricks

Use when identify() kind is surprising and you need a magic-byte first-move. DO NOT USE to forge file formats or malware droppers.

cookbook-static-first

Use when you need the cheapest static probes for an authorized binary before decompile. DO NOT USE for cracking or exploit recipes.

crypto-inventory-static

Use when inventorying cryptographic libraries and APIs in an authorized binary. DO NOT USE to crack, forge, or weaken cryptography.

eilam-own-app-audit

Use when auditing an operator-owned shipped binary for bugs via static inventory. DO NOT USE on third-party products or to weaponize findings.

eilam-reversing-foundations

Use when deciding how to reverse an authorized binary without wasting decompiler time. DO NOT USE for cracking, DRM bypass, or exploit development.

eilam-windows-formats

Use when explaining a Windows PE file layout from a reveng-debug inventory. DO NOT USE for patching binaries or forging signatures.

goppit-pe-layout

Use when mapping a PE inventory JSON onto PE file layout for an authorized binary. DO NOT USE to craft malicious PE files.

memory-evidence-labels

Use when someone claims a runtime memory fact and you must grade confidence. DO NOT USE to produce memory-corruption exploits.

memory-static-indicators

Use when relating PE security_flags and sections to possible memory layout without attaching. DO NOT USE to debug live malware or dump process memory without authorization and an explicit opt-in.

packer-detection

Use when deciding whether an authorized PE looks packed from static inventory. DO NOT USE to unpack, dump, or write a packer.

packer-honesty-limits

Use when a packing claim is about to be overstated from incomplete inventory. DO NOT USE to fill gaps with fake entropy or unpack recipes.

pe-iat-capability-map

Use when turning PE import/export lists into a capability map with honest confidence labels. DO NOT USE to infer observed execution from static imports.

pma-dynamic-evidence

Use when the operator already has sandbox/procmon logs and you must label runtime claims honestly. DO NOT USE to launch malware or attach a debugger to untrusted binaries.

pma-packing-signals

Use when inventory looks packed or import-poor and you must label packing as inferred not proven. DO NOT USE to unpack, decrypt, or execute samples.

pma-static-triage

Use when statically triaging an authorized Windows PE or similar binary with reveng-debug before any decompile. DO NOT USE for malware execution, unpacking exploits, or unauthorized targets.

program-understanding-map

Use when you must explain how an authorized program is structured from static evidence. DO NOT USE to reconstruct third-party products for cloning.

program-understanding-questions

Use when scoping an authorized RE question so you do not over-decompile. DO NOT USE as an excuse to skip doctor/identify.

rce-artifacts

Use when managing RE artifacts (inventory JSON, ledger, optional Ghidra JSON) for an authorized session. DO NOT USE to hide artifacts or destroy evidence.

rce-process

Use when structuring an authorized reverse-engineering investigation as observe/hypothesize/verify. DO NOT USE as a cracking or pwn playbook.

reveng-debug

Evidence-first debugging of shipped software you are authorized to inspect. Windows-first PE, ELF/Mach-O, JS, Electron, website clone via reveng-debug CLI plus gotcontext-chrome live capture, optional BYO Ghidra and reverse-engineer-app. Use to explain how a…

secplus-observe-vs-assume

Use when a claim about a binary or app is about to be stated as fact without evidence. DO NOT USE as a Security+ exam dump or attack guide.

leanrea

Reverse engineer shipped software with plain local CLI tools, no MCP needed. Covers Electron/JS bundles, native Mach-O/ELF/PE, Go/Rust/.NET/Flutter/WASM binaries, APKs, SQLite, pcaps, firmware and websites. Use to explain how a feature works, extract…