LING71671/open-reverselab

**Open-source AI-powered reverse-engineering platform for autonomous binary analysis, built for Claude Code, Codex, OpenCode and any MCP-compatible agent.**
Ghidra · Frida · x64dbg · Rizin · PE · APK · Malware Analysis · CTF · Binary Analysis
---
**An open-source reverse-engineering lab — executable knowledge base, 100+ MCP tools, Agent-native.**
*From an input signal to an evidence chain, every step is runnable.*
**English** · 简体中文
---
:handshake: Sponsored by Sentry
**Sentry** supports openreverselab with a sponsored account — error monitoring and performance tracing for the lab's toolchain.
Since Aug 2026 — see SPONSORS.md for the full sponsor list and how to become one.
---
What is ReverseLab
ReverseLab is an opinionated, runnable attack-knowledge base for reverse engineers, security researchers, CTF players, and AI Agents. Every article is structured as **Scenario → Input signal → Method → Attack chain → MCP tool mapping**, so a human or an Agent can pick up at any entry signal and walk the chain to evidence.
- **5 boards** spanning web, mobile, Windows, and cross-domain reverse work.
- **180+ articles** organized by attack surface, not by tooling.
- **100+ MCP tools** exposed through reverse_lab_tools — curl, frida, ghidra, rizin, yara, triage, kb_router, … all callable from Claude Code, Codex, or any MCP-aware Agent.
- **Directory-as-convention**: every artifact has a fixed home (samples/, exports/, patches/, kb/, reports/). Drop-in a sample, follow the chain, ship the report.
The lab is built to be run, not browsed. If a step can't be executed, it doesn't belong in the KB.
Who is this for
| You are … | Start here |
| --- | --- |
| A **CTF player** stuck on a web/Android/PE challenge | Browse the CTF Website, APK Reverse, or PE Reverse board |
| A **security researcher** triaging a sample | Quick start → boards/ /AI-USAGE.md → sample_full_workup MCP tool |
| A **reverse engineer** who wants a workspace, not a tutorial | Repository layout — clone and start |
| An **AI Agent** developer wiring up reverse-engineering tools | For AI Agents — context chain, MCP smoke test, env snapshot protocol |
Quick links
:book: Knowledge Base
   :rocket: Quick start
   :handshake: Contributing
   :speech_balloon: Discord
---
Knowledge at a glance
| Board | Trigger signals | MCP entry points |
| --- | --- | --- |
| ctf-website | URL · HTTP · JWT · SQLi · SSRF · CVE · API · CSP · OAuth · CAPTCHA · Cloudflare · ReDoS · Slowloris · DoS · Paywall | http_probe, run_ctf_tool, kb_router |
| apk-reverse | APK · DEX · adb · Frida · jadx · smali · SO · native | android_app_baseline, android_crypto_unpack_recipe, android_frida_* |
| pe-reverse | PE · EXE · DLL · x64dbg · Ghidra · Procmon · packer · malware | triage_pe, ghidra_headless_analyze, make_x64dbg_breakpoint_script, sample_full_workup |
| general | AES · DES · RSA · protobuf · game cheat · EAC / BE / Vanguard · firmware · JTAG · SDR | die_scan, ghidra_*, rizin_*, python_re_tool_* |
| misc | MCP config · skill install · env health check | mcp_smoke_check, ai_toolcheck, lab_healthcheck |
The complete directory tree is available under kb/.
---
Quick start
Pick the path that matches your role, not your platform — the platform differences are below the role split.
For humans
**Windows (recommended for first run)** — double-click START_HERE.bat (or START_HERE.cmd) in the repo root. It checks Python, uv, Git, the reverse_lab_tools MCP server, runs real MCP smoke calls, and writes reports/misc/first-run-report.json plus reports/misc/mcp-smoke-report.json.