Reverse Lab

First-run onboarding for Reverse Lab. Use when a new case starts, when the user first talks to Reverse Lab, or when no state.json exists for the target they mention. Confirms authorization, target location, and goal one question at a time, checks the triage toolset, and creates the case state file.

Fast shell-first triage of a reverse-engineering target. Use when a Reverse Lab case has authorization and a work copy but no route yet, or when the user hands over a new file, app, or extracted child to identify. Identifies the type by file and magic bytes, runs one capped inventory call, and records SEEN/INFERRED/UNKNOWN findings.

Scenario-selection table for Reverse Lab. Use when triage has identified a target's type and you need the fastest real approach and the escalation path, or when an extracted firmware child needs routing. Maps each target type to its cheapest tool, a fallback, and when to escalate to decompilation.

Escalation path when triage and the router's fast path can't answer the goal. Use when you need real logic from native or stripped code, or source-level reading of managed or bundled code (Android, .NET, Electron/JS). Picks the lightest decompiler that works and reads call sequences, not every instruction.

How Reverse Lab uses the GhidraMCP connector for deep native analysis. Use when the router or decompile skill escalates to real control flow, xrefs, call graphs, or data types that shell tools can't give, or when the user asks to connect Ghidra. Covers setup, all 30 tools, call rules, limits, and confirm-before-edit.

Unpack firmware images and recursively route what's inside. Use when triage or the router identifies a firmware image, disk image, or opaque blob with embedded filesystems, or when an extraction yields more archives. Unpacks with binwalk or unblob, then sends each extracted file back through reverse-lab-router.

Evidence-first write-up for a Reverse Lab case, plus the clean-room rebuild path. Use when every part of the goal has evidence, when the user asks what you found, when a case is paused and needs a summary, or when the user wants a spec to rebuild a feature without copying the original.