open-reverselab
LING71671 · LING71671/open-reverselab
An open-source AI reverse-engineering agent platform and MCP server for automated binary analysis, CTF, and malware research.
Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.
Preview
What you can do with it
- Automate the analysis of unknown executable files to detect potential malware.
- Use an AI agent to solve CTF challenges involving binary exploitation.
- Reverse-engineer proprietary software components to understand their functionality.
Safety check
No risky patterns found in the files we scanned.
Automated scan of the repo files. Always review code you run.
From the README
Open-ReverseLab — AI Reverse Engineering Agent & MCP Lab
Open-source AI-powered reverse-engineering platform for autonomous binary analysis, built for Claude Code, Codex, OpenCode and any MCP-compatible agent.
Ghidra · Frida · x64dbg · Rizin · PE · APK · Malware Analysis · CTF · Binary Analysis
An open-source reverse-engineering lab — executable knowledge base, 100+ MCP tools, Agent-native.
From an input signal to an evidence chain, every step is runnable.
English · 简体中文
:handshake: Sponsored by Sentry
Sentry supports openreverselab with a sponsored account — error monitoring and performance tracing for the lab's toolchain.
Since Aug 2026 — see SPONSORS.md for the full sponsor list and how to become one.
What is ReverseLab
ReverseLab is an opinionated, runnable attack-knowledge base for reverse engineers, security researchers, CTF players, and AI Agents. Every article is structured as Scenario → Input signal → Method → Attack chain → MCP tool mapping, so a human or an Agent can pick up at any entry signal and walk the chain to evidence.
- 5 boards spanning web, mobile, Windows, and cross-domain reverse work.
- 180+ articles organized by attack surface, not by tooling.
- 100+ MCP tools exposed through
reverse_lab_tools— curl, frida, ghidra, rizin, yara, triage, kb_router, … all callable from Claude Code, Codex, or any MCP-aware Agent. - Directory-as-convention: every artifact has a fixed home (
samples/,exports/,patches/,kb/,reports/). Drop-in a sample, follow the chain, ship the report.
The lab is built to be run, not browsed. If a step can't be executed, it doesn't belong in the KB.
Who is this for
| You are … | Start here |
|---|---|
| A CTF player stuck on a web/Android/PE challenge | Browse the CTF Website, APK Reverse, or PE Reverse board |
| A security researcher triaging a sample | Quick start → boards/<board>/AI-USAGE.md → sample_full_workup MCP tool |
| A reverse engineer who wants a workspace, not a tutorial | Repository layout — clone and start |
| An AI Agent developer wiring up reverse-engineering tools | For AI Agents — context chain, MCP smoke test, env snapshot protocol |
Quick links
:book: Knowledge Base :rocket: Quick start :handshake: Contributing :speech_balloon: Discord
Knowledge at a glance
kb/ 180+ articles, 5 boards
├── ctf-website/techniques/ 26 categories, 118 articles — Web attack surface
├── apk-reverse/techniques/ 8 categories, 23 articles — Android reverse
├── pe-reverse/techniques/ 9 categories, 24 articles — Windows PE / binary
├── general/techniques/ 5 categories, 17 articles — Crypto · Protocol · Cheat · IoT · SDR
└── windows/techniques/ platform-specific PE / config topics
| Board | Trigger signals | MCP entry points |
|---|---|---|
ctf-website | URL · HTTP · JWT · SQLi · SSRF · CVE · API · CSP · OAuth · CAPTCHA · Cloudflare · ReDoS · Slowloris · DoS · Paywall | http_probe, run_ctf_tool, kb_router |
apk-reverse | APK · DEX · adb · Frida · jadx · smali · SO · native | android_app_baseline, android_crypto_unpack_recipe, android_frida_* |
pe-reverse | PE · EXE · DLL · x64dbg · Ghidra · Procmon · packer · malware | triage_pe, ghidra_headless_analyze, make_x64dbg_breakpoint_script, sample_full_workup |
general | AES · DES · RSA · protobuf · game cheat · EAC / BE / Vanguard · firmware · JTAG · SDR | die_scan, ghidra_*, rizin_*, python_re_tool_* |
misc | MCP config · skill install · env health check | mcp_smoke_check, ai_toolcheck, lab_healthcheck |
The complete directory tree is available under kb/.
Quick start
Pick the path that matches your role, not your platform — the platform differences are below the role split.
For humans
Windows (recommended for first run) — double-click START_HERE.bat (or START_HERE.cmd) in the repo root. It checks Python, uv, Git, the reverse_lab_tools MCP server, runs real MCP smoke calls, and writes reports/misc/first-run-report.json plus reports/misc/mcp-smoke-report.json.
macOS / Linux — run ./START_HERE.sh from the repo root. It does the same first-run checks using POSIX shell wrappers under tools/bin/. Windows-only GUI/PE tools are skipped or reported as such.
Per-board install (after first-run passes)
# Pick the boards you actually need — the lab is modular.
.\scripts\misc\bootstrap.ps1 # core script wrappers (no downloads)
.\scripts\misc\install_tools.ps1 -CTF # Web tools (sqlmap, nuclei, ffuf, jwt_tool, …)
.\scripts\misc\install_tools.ps1 -Android # APK tools (apktool, jadx, frida, uber-apk-signer, …)
.\scripts\misc\install_tools.ps1 -Windows # PE tools (cutter, pe-bear, procmon, …)
.\scripts\misc\install_tools.ps1 -Common # Ghidra + Maven
macOS / Linux equivalent:
./scripts/misc/bootstrap.sh
export PATH="$PWD/tools/bin:$PWD/tools/ctf-website/bin:$PATH"
python scripts/misc/ai_toolcheck.py --board misc # verify the fresh-clone core
Install only the boards you need. Don't dump the full toolchain if you're only doing web CTF.
Windows Defender / antivirus note
After installing CTF / ExploitDB tools, Windows Defender may flag exploit samples or payload documentation — e.g. tools/ctf-website/exploitdb, kb/ctf-website/techniques/24-database/03-nosql-injection.md, docs/llms-full.txt. These contain security test payloads, webshells, shellcode, or ExploitDB samples and are expected components