Summary

This repository offers an open-source reverse engineering lab focused on automating analysis across CTF, Android (APK), and Windows (PE) domains. It integrates a 197-article knowledge base with over 100 MCP automation tools, enabling an agent-native, signal-driven workflow for security professionals and researchers to streamline complex tasks.

How It Works

The lab employs an agent-native, signal-driven workflow. Input signals trigger a kb_router to select relevant knowledge base (KB) articles, which define attack chains and map to specific MCP tools for execution. A strict directory-as-convention structure organizes samples, exports, and analysis artifacts, promoting repeatable processes.

Quick Start & Requirements

Installation is PowerShell-based. Clone the repo, run .\scripts\misc\bootstrap.ps1 for core scripts, then .\scripts\misc\install_tools.ps1 with domain-specific flags (e.g., -CTF, -Android, -Windows). Post-installation verification uses Python scripts like lab_healthcheck.py and ai_toolcheck.py. Primarily targets Windows environments.

Highlighted Details

• Knowledge Base: 197 articles covering CTF/Web (97), APK Reverse Engineering (17), PE Binary Analysis (18), and General (Crypto, Protocols, Cheating, Methodology - 12).
• Directory Structure: Standardized organization for samples/, exports/, patches/, notes/, reports/, scripts/, projects/, templates/, kb/, tools/, and cases/.
• Agent Workflow: Signal detection routes through KB lookup to MCP tool execution.
• Toolchains: Specialized toolsets for CTF, Android, and PE analysis.

Maintenance & Community

No specific details on maintainers, community channels, sponsorships, or roadmaps were found in the provided README.

Licensing & Compatibility

Licensed under GPL-3.0-only. This copyleft license requires derivative works to also be GPL-3.0, potentially restricting commercial use or integration with closed-source software.

Limitations & Caveats

A known bug causing AI jailbreaking is intentionally left unfixed. The reliance on PowerShell suggests a primary focus on Windows environments.