<p align="center">
<img src="app_logo.svg" alt="Seep Reverse Lab Logo" width="120" height="120">
</p>
<h1 align="center">Seep Reverse Lab</h1>
<p align="center">
<strong>Agent-Native ยท Multi-Platform Reverse Engineering ยท CWE-602 Authorization Audit ยท Autonomous Security Workbench</strong>
</p>
<p align="center">
<a href="https://github.com/angusdevgo/seep-reverse-lab"><img src="https://img.shields.io/badge/Release-v1.6.0-brightgreen.svg?style=for-the-badge&logo=github" alt="Release"></a>
<a href="https://github.com/angusdevgo/seep-reverse-lab/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-GPL--3.0-blue.svg?style=for-the-badge" alt="License"></a>
<img src="https://img.shields.io/badge/Platform-Windows%20%7C%20Android%20%7C%20Linux-0078D6?style=for-the-badge&logo=windows" alt="Platform">
<img src="https://img.shields.io/badge/Architecture-x86%20%7C%20x64%20%7C%20ARM64-orange?style=for-the-badge" alt="Architecture">
</p>
<p align="center">
<img src="https://img.shields.io/badge/MCP%20Tools-23%20Integrated-purple?style=for-the-badge&logo=fastapi" alt="MCP Tools">
<img src="https://img.shields.io/badge/Verifier-52%2F52%20Passed-brightgreen?style=for-the-badge&logo=checkmarx" alt="Verifier">
<img src="https://img.shields.io/badge/Knowledge%20Base-289%20Journals-teal?style=for-the-badge" alt="Knowledge Base">
<img src="https://img.shields.io/badge/Paradigms-14%20Cases%20(A~N)-blue?style=for-the-badge" alt="Paradigms">
<img src="https://img.shields.io/badge/MANUAL%20SOPs-9%20Tactical%20Guides-red?style=for-the-badge" alt="MANUAL SOPs">
<a href="https://linux.do/"><img src="https://img.shields.io/badge/Community-LINUX%20DO-23272A?style=for-the-badge&logo=discourse" alt="LINUX DO"></a>
</p>
<p align="center">
[ <strong>English</strong> | <a href="README.zh.md">ไธญๆๆๆกฃ</a> ]
</p>
<p align="center">
<a href="#-project-overview">Overview</a> โข
<a href="#-how-it-works">Architecture</a> โข
<a href="#-30-second-demo">Demo</a> โข
<a href="#๏ธ-mcp-tool-matrix">MCP Matrix</a> โข
<a href="#-quick-start--deployment">Quick Start</a> โข
<a href="#-technical-scope">Scope</a> โข
<a href="#-agent-execution-contract">Agent Contract</a> โข
<a href="#-disclaimer">Disclaimer</a>
</p>
---
> ๐ **Attribution & Reference Sources**:
> - Mobile reverse engineering methodology & verification test suite referenced from: [**newliver666/apk-reverse**](https://github.com/newliver666/apk-reverse) (MIT License).
> - Security research lab framework, Zero-Waste Recon signal routing & agent execution protocols referenced from: [**GeniusHu-tgty/Open-tgtylab**](https://github.com/GeniusHu-tgty/Open-tgtylab) (GPL-3.0 License).
> - Reverse engineering knowledge base, attack graph boards & MCP automation ecosystem referenced from: [**LING71671/open-reverselab**](https://github.com/LING71671/open-reverselab) (GPL-3.0 License).
> - Community support & technical discussions: [**LINUX DO**](https://linux.do/).
---
## ๐ Project Overview
Seep consolidates fragmented reverse engineering toolchains (Radare2 / JADX / Apktool / Frida / IDA), operational knowledge bases, prompt engineering contracts, and battle-tested field experience into an **Agent-Native Autonomous Workbench**.
Users provide plain-language technical goals; the agent autonomously performs platform identification, vulnerability type classification, surgical binary patching, and closed-loop evidence delivery.
### Five Core Pain Points Solved
| Pain Point | Solution |
|---|---|
| ๐ง **Toolchain Fragmentation** | 23 MCP tools wrapping Radare2, JADX, Apktool, Frida โ unified API, zero manual switching |
| ๐ง **Agent Decision Drift** | `softseep` orchestrator: two-stage auto-classification (Platform ร 9 Task Types) + 7-gate decision tree |
| ๐ก๏ธ **Model Refusal in Security Audits** | Three-tier mitigation: `BLOCK_NONE` injection + transparent terminology mapping + cognitive redirection |
| ๐ **Ephemeral Knowledge** | 289 technical field journals + 14 desensitized paradigms + "search KB before executing" enforced discipline |
| ๐ฆ **Setup Friction** | One-click `install.ps1` โ supports Pi Agent, Claude Code, DeepSeek Harness (DSH), Codex / OpenCode |
---
## โ๏ธ How It Works
```
User Input (plain language โ "bypass the premium check in FooBar.apk")
โ
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Lab Mode State Machine (disk-backed ~/.pi/agent/lab-mode.flag) โ
โ โข Colloquial โ compliance terminology auto-mapping โ
โ โข BLOCK_NONE injection + cognitive redirection (anti-refusal) โ
โ โข Context persists across model switches & context compression โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ softseep Master Orchestrator โ
โ โ Platform โ Windows PE / Android APK / Linux ELF / Web โ
โ โก Task Type โ 9 Paradigms ร 7 Gates (G0โG6 decision tree) โ
โ โข Route โ apkseep / ida-reverse / seep MCP / KB โ
โโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโ
โ โ โ
โผ โผ โผ
seep MCP IDA Pro MCP KB Search
23 tools (optional) 289 journals
(Radare2/JADX/ (Zero-Waste Recon)
Apktool/Frida)
โ
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Context Budget Control (v1.1 noise reduction) โ
โ โข seep_r2_decompile: full / fold (โ60% tokens) / summary (โ90%) โ
โ โข seep_r2_disasm: full / branch (control-flow only) โ
โ โข seep_r2_xrefs: paginated, limit=10, total stats header โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ
โผ
PoC Generated โ Sandbox Execution โ Self-Healing Loop
โ
โผ
Airplane-Mode Confirmation (CWE-602 iron-clad proof)
โ
โผ
3-Part Consulting-Grade Security Report โ
```
---
## โก 30-Second Demo
<p align="center">
<img src="docs/images/agent-workflow.png" alt="Seep Autonomous Reversing & CWE-602 Audit Workflow" width="880">
</p>
Once deployed, just talk to your agent in plain language:
```
lab: analyze FooBar.apk โ find the premium check and bypass it
```
The agent autonomously:
1. **`seep_auto_triage`** โ identifies DEX + ARM64 SO, no packer detected
2. **`seep_apk_decompile`** with `output_mode=fold` โ extracts control-flow skeleton only *(saves ~60% tokens)*
3. **`seep_kb_search`** โ finds matching CWE-602 pattern from field journal #142
4. **`seep_apk_gen_hook`** โ generates `hook_verify.js` Frida script
5. Executes on connected device โ captures stdout, **self-heals** `ClassNotFoundException`, re-runs
6. Airplane-mode confirmation โ โ **`seep_gen_security_report`** โ 3-part audit report delivered
> Total elapsed time on a typical client app: **8โ20 minutes**, fully unattended.
---
## โก Core Capabilities
- ๐ฏ **Natural Language Intent Resolution**: Binary magic bytes + semantic verb mapping โ correct toolchain, no flags to memorize
- ๐ **CWE-602 Authorization Audit**: Minutes to determine if a feature gate is local-boolean or server-authoritative
- ๐ก๏ธ **Authenticode Signature Preservation**: DLL search-order hijacking (`version.dll` / `sentry.dll`) keeps host binary signature intact
- ๐ **PoC Self-Healing Loop**: Frida error โ root-cause mapping โ auto-fix โ re-execute (up to 3 attempts, then structured handoff)
- ๐ **14 Industrial Architecture Paradigms**: Monolithic offline PE โ multi-process IPC โ VM arbitration โ .NET keygen โ weak RSA bypass โ Java agent โ .NET VM bypass *(fully desensitized, Projects A through N)*
- ๐ **Transport-Layer Compliance Relay & Auto-Retry**: Pure stdlib localhost relay with streaming refusal auto-retry cascade (`S1-review-checklist` โ `S2-review-framed` โ `S3-review-en`), preserving target paths without semantic drift. Unit tests 84/84 passing.
- โก **DeepSeek Harness (DSH) Self-Healing Launcher**: 4s fast cold-start with automated zombie cleanup, web token URL extraction, and MCP verification suite (`start-dsh.ps1` / `stop-dsh.ps1`).
- ๐ก๏ธ **Measured Anti-Refusal Defense**: Gemini-safe prompt reshaping (`gemini-safe.flag`), L1 observable decision logging (`l1-log.flag`), and native `BLOCK_NONE` payload gating.
- ๐ **Offline-Ready**: All toolchains pre-bundled (251 MB), zero network dependencies after setup
---
## ๐ Directory Structure
<details>
<summary>๐ Full Directory Tree (click to expand)</summary>
```
Seep\ (251 MB)
โโโ README.md โ This file (English default)
โโโ README.zh.md โ Chinese documentation (ไธญๆๆๆกฃ)
โโโ CLAUDE.md โ Project-level instructions for Claude Code
โโโ .mcp.json โ Project-level MCP registration (Claude Code / OpenCode)
โโโ DSH-PROFILE.md โ DeepSeek Harness Cordis plugin config template
โโโ check.bat โ โญ Double-click one-shot health verifier (Windows)
โโโ check.ps1 โ PowerShell health verifier entry point
โโโ VERSION โ Current version marker
โโโ CHANGELOG.md โ User-facing release notes
โ
โโโ Tool\
โ โโโ skill\ โ 9 specialized reverse engineering skills
โ โ โโโ softseep\ โ โญ Master orchestrator (Router + 8 on-demand references)
โ โ โโโ apkseep\ โ End-to-end Android APK/DEX/SO skill (115 files)
โ โ โโโ ida-reverse\ โ IDA Pro automated spawning & MCP coordination
โ โ โโโ client-license-validation-bypass\ โ Cross-runtime license attack playbook
โ โ โโโ safe-skills\ โ 5 standalone tool packages
โ โ
โ โโโ mcp\ โ MCP Engine
โ โ โโโ seep_mcp_server.py โ Core server: 23 native reversing & KB tools
โ โ โโโ mcp.json.template โ Global MCP client configuration template
โ โ โโโ Tool\ โ โ ๏ธ Hardcoded relative runtime path (do not rename)
โ โ โโโ safe\ โ Pre-bundled cross-platform toolchains
โ โ โ โโโ jadx\ โ 75 MB (v1.5.6)
โ โ โ โโโ radare2\ โ 39 MB (v6.2.2 full suite)
โ โ โ โโโ apktool\ โ 24 MB (v3.0.3)
โ โ โ โโโ hook-mcp\ โ Frida / LSPosed instrumentation templates
โ โ โ โโโ ida-pro-mcp\ โ IDA bridge adapter
โ โ โ โโโ js-reverse-mcp\โ Web / JS debugging engine
โ โ โ โโโ playwright-mcp\โ Headless browser automation
โ โ โโโ reverselab\ โ 289 field journals + attack chains
โ โ
โ โโโ prompts\ โ Agent coordination specs & runtime extensions
โ โ โโโ SYSTEM.md โ Pi Agent system instructions
โ โ โโโ AGENTS.md โ Cross-agent portable instructions
โ โ โโโ extensions\ โ BLOCK_NONE injection + terminology mapping
โ โ
โ โโโ cases\ โ 14 desensitized industrial paradigm projects (A ~ N, incl. version-evolution archive v2)
โ โโโ upstream\ โ Upstream verification & attribution layer (3 Full mirrors)
โ โ โโโ apk-reverse\ โ newliver666/apk-reverse (Android RE & offline test suite)
โ โ โโโ open-tgtylab\ โ GeniusHu-tgty/Open-tgtylab (Security lab framework & workflows)
โ โ โโโ open-reverselab\ โ LING71671/open-reverselab (Knowledge base, boards & MCP ecosystem)
โ โโโ docs\ โ Engineering reference docs
โ โโโ scripts\ โ Workspace automation scripts
โ โโโ compliance-relay\ โ ๐ Transport-layer compliance relay (stdlib-only, 3 protocols)
โ
โโโ setup\ โ Automated install, repair, update, uninstall & verify scripts
โโโ MANUAL\ โ 9 Tactical SOP guides
โโโ PREREQUISITES.md โ Environment & dependency requirements
โโโ IDA-PRO.md โ Commercial IDA Pro integration (native idalib + stdio modes)
โโโ ANTI-DEBUG.md โ Anti-debug bypass dictionary & proxy DLL framework
โโโ UNPACKING.md โ UPX/MPRESS/Themida/VMP unpacking SOP
โโโ POC-VALIDATION.md โ Frida self-healing loop & PoC sandbox validation
โโโ DEPLOYMENT.md โ Comprehensive deployment & multi-Agent setup guide
โโโ DEPLOYMENT-CHECKLIST.md โ Official deployment baseline checklist (51 items)
โโโ CROSS-PLATFORM.md โ Cross-platform (Windows/Linux/macOS) execution guide
โโโ COMPLIANCE-RELAY.md โ Transport-layer compliance relay & auto-retry architecture
โโโ MODEL-REFUSAL-MATRIX.md โ Measured refusal matrix & Gemini-safe prompt reshaping
```
</details>
---
## ๐ ๏ธ MCP Tool Matrix
The bundled `seep` MCP server exposes **23 native tools** across five functional groups:
| Category | Tool | Functionality | Token Mode |
|---|---|---|---|
| **Health** | `seep_status` | Verifies Radare2, JADX, Apktool, KB readiness | โ |
| | `seep_ida_status` | Probes IDA Pro MCP service connectivity | โ |
| **Binary (R2)** | `seep_r2_info` | Architecture, bitness, DEP/ASLR/Canary/PIE | โ |
| | `seep_r2_strings` | Extracts strings with regex + section filtering | `limit=` |
| | `seep_r2_functions` | Functions, imports, exports, entry points | `limit=` |
| | `seep_r2_disasm` | Disassembly with cross-references | `full` / `branch` |
| | `seep_r2_decompile` | C-like pseudocode via pdc engine | `full` / `fold` / `summary` |
| | `seep_r2_xrefs` | Cross-reference graph, paginated | `limit=10` default |
| | `seep_r2_diff` | Code / hex diff between two binaries | โ |
| | `seep_r2_asm` | Assemble โ disassemble machine code | โ |
| | `seep_r2_cmd` | Raw Radare2 pipeline commands | โ |
| **Android** | `seep_apk_info` | APK manifest, permissions, signatures (no Java) | โ |
| | `seep_apk_decompile` | JADX full Java source decompilation | โ |
| | `seep_apk_unpack` | Apktool resource + Smali disassembly | โ |
| | `seep_apk_smali_search` | Smali pattern search (crypto keys, auth gates) | `limit=` |
| | `seep_apk_gen_hook` | Ready-to-run Frida hooks with stack traces | โ |
| **Knowledge Base** | `seep_kb_search` | Full-text search across 289 field journals | `limit=` |
| | `seep_kb_read` | Full technical reference retrieval by topic | โ |
| | `seep_kb_checklist` | Emergency triage checklists & attack matrices | โ |
| | `seep_kb_payloads` | Security test seeds (JWT, SSRF, SSTI, SQLi) | โ |
| **Orchestration** | `seep_task_init` | Initializes isolated audit sandbox directory | โ |
| | `seep_auto_triage` | Automated full-sample health check | โ |
| | `seep_gen_security_report` | Synthesizes 3-part compliance security report | โ |
> ๐ก **Context Budget Control** (v1.1): `seep_r2_decompile` with `output_mode=fold` reduces token consumption by ~60%; `summary` mode by ~90%. Use `seep_r2_xrefs` instead of raw `axt` to avoid flooding the context window with hundreds of references.
---
## ๐ Quick Start & Deployment
### 1. Prerequisites
- **OS**: Windows 10 / 11 x64 (recommended) or compatible Linux / macOS
- **Runtimes**: Python 3.11+, Node.js 18+, Git
### 2. One-Click Setup (Cross-Platform)
**Windows (PowerShell)**:
```powershell
cd setup
powershell -ExecutionPolicy Bypass -File .\install.ps1
```
**Linux / macOS (Bash)**:
```bash
chmod +x setup/install.sh
./setup/install.sh
```
> **What this does automatically**: Unpacks dependency archives (`node_modules.zip`) โ validates pre-bundled tools โ installs Python `mcp` libraries โ registers MCP servers โ resolves physical paths โ runs full self-check.
### 3. Multi-Agent Setup
| Agent | Instruction File | MCP Config | Setup Procedure |
|---|---|---|---|
| **Pi Agent** | `Tool/prompts/SYSTEM.md` | `~/.pi/agent/mcp.json` | `install.ps1` writes user configs & skills automatically. **Restart Pi** after installation. |
| **Claude Code** | `CLAUDE.md` (project root) | `.mcp.json` (project root) | Run `powershell .\setup\generate-configs.ps1` to resolve paths, then launch `claude` in root. |
| **DeepSeek Harness** | `Tool/prompts/AGENTS.md` | `DSH-PROFILE.md` | Run `setup\generate-configs.ps1` to produce `cordis.generated.yml` (official `- insert:` format), use `dsh web --patch ...` or paste into profile. |
| **OpenCode / Codex** | `AGENTS.md` (project root) | `opencode.jsonc` | Generated by `setup\generate-configs.ps1` (compliant with official OpenCode `mcp` schema), launch `opencode` in root. |
> ๐ **Comprehensive Multi-Agent Guide**: For detailed step-by-step setup, cross-platform caveats, and exhaustive troubleshooting FAQ, see [**MANUAL/DEPLOYMENT.md**](MANUAL/DEPLOYMENT.md).
### 4. Updating an Existing Installation
Already deployed? No need to re-clone or copy files by hand. The updater is **idempotent and lossless** โ your model credentials and any custom MCP servers you added are never overwritten.
- **Easiest for Windows**: Double-click **`update.bat`** in the repository root for zero-command automatic upgrade.
- **In-Agent Prompt**: Simply type **"update workbench"** (or "ๆดๆฐๅทฅไฝๅฐ") in your Agent chat, and it will execute the updater and report back.
- **CLI Commands**:
```powershell
# Windows
powershell -ExecutionPolicy Bypass -File .\setup\update.ps1
```
```bash
# Linux / macOS
./setup/update.sh
```
It will: stash local changes โ `git pull` โ print the changelog โ back up your config โ incrementally sync skills/prompts/MCP entries โ verify user data was preserved โ run the full health check.
| Flag | Effect |
|---|---|
| `-DryRun` / `--dry-run` | Show what would happen, modify nothing |
| `-Check` / `--check` | Check if a newer version is available without pulling |
| `-NoPull` / `--no-pull` | Skip `git pull` (for ZIP-based installs) |
> โ ๏ธ **Always fully restart your Agent session** after updating so the new skills and extensions load.
> See [CHANGELOG.md](CHANGELOG.md) for what changed in each version.
### 4b. Upstream Declarative Sync & Zero-Spillover Architecture
Seep packages mirrors of upstream open-source repositories (`apk-reverse`, `open-tgtylab`, `open-reverselab`). To eliminate manual merging and prevent upstream updates from polluting unrelated modules, the workbench enforces a **strict-boundary declarative sandboxing architecture**:
- **Declarative Rule Manifest**: `setup/upstream-rules.json` strictly binds each upstream repo to its own target directory and allowed boundary whitelist.
- **Physical Zero-Spillover Gate**: `setup/sync-upstream.py` (pure stdlib) asserts real canonical paths before copying. If upstream A tries to write into directory B, directory C, or the main project, it throws a `SpilloverSecurityViolation` and aborts.
- **Isolated CI Pull Requests**: `.github/workflows/upstream-sync.yml` monitors upstream repositories on schedule. When upstream A is updated, it creates a dedicated branch and PR whose diff touches strictly `Tool/upstream/A/`.
- **Local One-Click Sync**:
```powershell
powershell -ExecutionPolicy Bypass -File .\setup\sync-upstream.ps1 -Target apk-reverse
```
### 5. Uninstalling
Removes only what the workbench itself installed. Your model credentials, sessions and any MCP servers you added yourself are never touched.
```powershell
powershell -ExecutionPolicy Bypass -File ./setup/uninstall.ps1 -DryRun # preview first
powershell -ExecutionPolicy Bypass -File ./setup/uninstall.ps1 # then run
```
```bash
./setup/uninstall.sh --dry-run && ./setup/uninstall.sh
```
Everything affected is backed up to `~/.pi/agent/backup-uninstall-<timestamp>/` first, and `-Restore <dir>` reverses the operation. See [MANUAL/DEPLOYMENT.md](MANUAL/DEPLOYMENT.md).
### 6. Verify Your Deployment
Run the 9-dimension health verifier (52 checks) against `MANUAL/DEPLOYMENT-CHECKLIST.md` using any of these methods:
| Method | Command |
|---|---|
| โญ Double-click (easiest) | `check.bat` in project root |
| PowerShell | `powershell -ExecutionPolicy Bypass -File .\check.ps1` |
| Agent chat | Send `check` (or `doctor` / `ๆฃๆฅ`) โ agent runs and reports inline |
<p align="center">
<img src="docs/images/verifier-check.png" alt="Seep Health Verifier Dashboard (51 Checks Passed across 9 Dimensions)" width="880">
</p>
---
## ๐ฎ Workflow & Lab Mode
### Lab Mode Protocol (Disk-Backed State Machine)
```
Activate: lab: # or: lab: analyze FooBar.exe
Deactivate: exit lab
```
- State stored in `~/.pi/agent/lab-mode.flag` โ **persists across model switches & context compression**
- Once activated: terminology auto-mapping, anti-refusal overrides, and shortcut expansion are live
- Casual chat outside lab mode passes through unmodified โ zero interference
### Task Shortcuts (Active in Lab Mode)
| Shortcut | Action |
|---|---|
| `poc <target>` | CWE-602 client-side authorization audit + verification code |
| `find-auth <target>` | Locate license, subscription, expiry, hardware-binding functions |
| `hook <function>` | Generate Frida hook with stack trace + return-value override |
| `gen-patch <offset>` | Binary patch bytes or proxy DLL scaffold |
| `triage <sample>` | Full triage: architecture, imports, packers, strings |
| `check` | Run 7-section workbench health verifier inline |
| `report` | Synthesize active directory evidence โ 3-part audit report |
---
## ๐ฌ Technical Scope
<details>
<summary>Click to expand full technical scope</summary>
### 1. Client-Side Authorization Audit (CWE-602)
**Authority Attribution**: Airplane mode + loopback hijacking + timestamp offset testing to classify gates as server-authoritative vs. local-boolean within minutes.
**Fourteen Industrial Paradigms** โ all fully desensitized:
| Project | Architecture | Key Technique |
|---|---|---|
| **A** | Monolithic offline PE | Scalar return override (`mov eax,1; ret`) |
| **B** | Multi-process hybrid | Proxy DLL dispatch + 3-tier state persistence (v12.0 โ v6.8.1 evolution: single winhttp naked thunk hijack + auto-update blocker) |
| **C** | Resource template + UI | Bijective bit-permutation decoding + IAT hook on `SetDlgItemTextW` |
| **D** | Recompile-induced non-uniform shift | **AOB dual-state signature migration** (3 versions) + PE gating + ACL locking + **optional-site version adaptation** + **runtime call-stack locating** |
| **E** | EXECryptor VM arbitration | 2-point Call redirection to memory stubs |
| **F** | .NET dynamic deobfuscation | Harmony memory dump + 96-bit combined hash keygen |
| **G** | Self-referential SHA-384 | 5-byte function-entry patch + watchdog persistence |
| **H** | Ed25519 pubkey replacement | In-place ciphertext replacement via derived keystream |
| **I** | Weak-modulus RSA | Sliding-window bypass + activation injection on export entry |
| **J** | Online Card/Key Authorization | Protocol decryption + memory patching + local credential spoofing |
| **K** | .NET WPF + Themida Packing | Memory dump unpacking + privilege decision branching + registry state freeze |
| **L** | Qt5 C++ Client | Proxy DLL hook + 11 privilege decision constant-folds + local LLM translation gateway |
| **M** | Java + install4j Dual-Layer | DLL search-order hijack (version.dll IAT hook) + JVM native ClassFile bytecode patching (burp.Zfqu / burp.Zwxg.Zu) + license/AI token preference seeding |
| **N** | .NET x64 + VM Obfuscation | Runtime memory extraction + privilege flag inversion + silent auto-injection |
### 2. Android & DEX/SO Analysis
- Surgical DEX same-length patching with automated Adler-32 / SHA-1 recalculation
- Packer classification: Java2C / native payload / extraction shell / private DEX-VMP
- Runtime anti-analysis: root detection bypass, SSL pinning circumvention, Frida-RPC bridging
- Repack pipeline: STORED `resources.arsc` + 4-byte Zipalign + v1+v2+v3 signing
### 3. Binary / Native (PE / ELF / Mach-O)
- Headless Radare2: architecture ID, entropy scan, symbol recovery, C-like decompilation
- Full IDA Pro MCP integration: Hex-Rays decompilation, xrefs, struct recovery
- Anti-tamper defeat: deliberate crash stubs, raw `svc` syscall detection, kernel anti-debug
### 4. CTF & Challenge Workflows
- Attack-network routing: Signal โ `seep_kb_search` โ template assembly โ MCP execution
- Web: JWT, KID injection, SSRF chains, SSTI, deserialization gadget chains, Protobuf decoding
- Seed libraries (`seep_kb_payloads`) + emergency checklists (`seep_kb_checklist`)
</details>
---
## ๐ค Agent Execution Contract
- **G-Auth Gate**: Confirm testing authorization on every new target. No authorization = stop.
- **7-Gate Decision Tree (G0โG6)**: Classify authority ownership (Server vs. Client) before touching any code.
- **Two-Strike Rule**: Same-shaped failure twice โ refute the technical model, fall back to classification. Third variation is strictly prohibited.
- **Zero-Waste Recon**: Signal detected โ `seep_kb_search` โ pre-existing tool โ execute. Never write scripts from scratch without checking the KB first.
- **Definition of Done**: Target hash โ RVA identification โ PoC execution โ offline airplane-mode confirmation โ 3-part structured delivery. Console log alone is not evidence.
---
## ๐ Deliverable Specification
All client-side vulnerability assessments follow a consulting-grade 3-part structure:
1. **Vulnerability Detail & Risk** โ Exact RVA / file offsets, call chain, CWE-602 mapping, business severity
2. **Reproduction & PoC** โ 100% reproducible instructions, proxy DLL source, or Frida script + offline confirmation evidence
3. **Defense-in-Depth Remediation**:
- `SetDefaultDllDirectories` โ prevent DLL hijacking
- `ProcessDynamicCodePolicy` โ prevent executable memory injection
- Server-side authority via cryptographic signatures and short-lived tokens
---
## ๐ค Acknowledgements & License
- **License**: This project is licensed under the **GNU General Public License v3.0 (GPL-3.0)**.
- Special thanks to [**newliver666/apk-reverse**](https://github.com/newliver666/apk-reverse) (MIT License) for the foundational Android reverse engineering paradigm and verification methodology.
- Special thanks to [**GeniusHu-tgty/Open-tgtylab**](https://github.com/GeniusHu-tgty/Open-tgtylab) (GPL-3.0 License) for the security research lab framework and Zero-Waste Recon routing architecture.
- Special thanks to [**LING71671/open-reverselab**](https://github.com/LING71671/open-reverselab) (GPL-3.0 License) for the comprehensive reverse engineering knowledge base, attack boards, and MCP automation ecosystem.
- Gratitude to the [**LINUX DO**](https://linux.do/) community for technical exchange, insight, and research collaboration.
---
## โ๏ธ Disclaimer
**This repository is intended solely for authorized security research, white-box auditing, compliance vulnerability testing, and educational CTF training.**
- **Explicit Authorization Required**: Written authorization from the asset owner is mandatory before analyzing any target.
- **No Warranty**: All methodologies are provided "as is" based on sandbox measurements.
- **Isolated Testing**: Conduct all analysis in isolated VMs or sandboxes. Testing against production systems or unauthorized networks is prohibited.
- **Limitation of Liability**: Authors assume no liability for misuse, unauthorized testing, or violations of applicable laws.
---
## โญ Star History
<a href="https://www.star-history.com/?repos=angusdevgo%2FSeep-Reverse-Lab&type=timeline&logscale=&releases=&legend=bottom-right">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=angusdevgo/Seep-Reverse-Lab&type=timeline&theme=dark&logscale&legend=top-left" />
<source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=angusdevgo/Seep-Reverse-Lab&type=timeline&logscale&legend=top-left" />
<img alt="Star History Chart" src="https://api.star-history.com/chart?repos=angusdevgo/Seep-Reverse-Lab&type=timeline&logscale&legend=top-left" />
</picture>
</a>