REx@Skill v1.0.0

REx@Skill v1.0.0 — the first tagged release.

An agentic reverse-engineering skill for finding defects in compiled binaries:
seven subagents over one content-addressed evidence tree, and a pinned toolchain
so two runs are comparable.

curl -fsSL https://raw.githubusercontent.com/tihanyin/REx-skill/main/install.sh | sh
claude
> /re-analyze path/to/binary

What is in it

Claude Code skill	16 KB core + 12 references loaded on demand
7 subagents	recon → five independent stances → reconcile
/re-analyze	orchestrates all three phases
33 scripts	the pipeline and its parts
General skill	SKILL-RE.md, 3 638 lines, one self-contained file for any runner
DEVSHELL	Nix flake pinning Ghidra, qemu-user + 9 cross-sysroots, angr, z3, AFL++, valgrind, capa and ~40 more

The standard it holds to

A finding names four things — source, sink, broken guard, affected
principal — all located in the binary. Miss one and it is not reported as a bug,
only as an unproven lead. The deliverable always carries the findings, what was
ruled out with reasons, and what the host could not run.

Notable in this release

• pipeline_status.py — audits an evidence tree and names every stage that never
  ran, plus what its absence costs. A stage that did not run leaves no error
  behind, only an absent directory that reads exactly like "ran, found nothing".
• batch_analyze.sh — the whole pipeline across a directory, not just the
  decompiler. Handed a corpus, the natural move batches two stages and silently
  drops the rest.
• fuzz_target.sh — fuzzing aimed at the channel the program actually reads, and
  seeded from the probe battery. -- prog @@ against a program that reads stdin
  fuzzes nothing; a fuzzer started from AAAA never reaches 4294967296.
• bounds_worklist.py — arithmetic obligations in three tiers, tier 1 settled by
  the guard alone.

Reproducibility

nixpkgs        ffb3c9b700e759be2ef13237c9d8f953b32a1e46
nixpkgs-angr   ac62194c3917d5f474c1a844b6fd6da2db95077d
capa-rules     v9.4.0

Tested on Ubuntu 22.04.5 LTS (x86-64), Determinate Nix 3.22.4. The DEVSHELL is
optional — every script looks for what it needs and names what it cannot find.

---

Norbert Tihanyi · x.com/@TihanyiNorbert