Reverse engineering skills, built on your own files

What the agent does for you

• Filesread_file, grep and glob find and open exports in your working folder; write_file and edit_file keep your notes, and a counter tracks files touched.
• Shellruns commands such as your disassembler's export command or a Python script, and reports the real exit code when the command ends.
• Webweb_search finds documentation and http_get reads one page, for example a calling-convention reference; check what you read.
• Screenshots and imagesocr reads text from a screenshot of a disassembler window, and gen_image saves image files for your notes.
• Orchestrationtask runs sub-agents in parallel on separate listings, run_on_model sends a hard step to a bigger model, and skill stores a reusable playbook.
• Approval modesAuto-run acts at once, Ask first pauses before actions that change something, and Plan only writes a plan and runs nothing.
• Cronruns a saved prompt on a schedule, for example a weekly prompt that lists the open questions in your notes file.
• Modelsconnect a cloud AI provider, a model running locally on your PC or the built-in model, and press Test to check the endpoint.

Two sessions in detail

Recover how an old checksum routine works

Reverse engineering an unknown checksum algorithm in your own old program starts with its exported listing. Begin in Plan only, where the agent writes the steps and runs nothing. Then switch mode, let grep find the loop in the listing, and let read_file open the lines around it. The agent explains what each instruction does to the running total, and write_file saves the explanation to notes/checksum.md. Plans survive restarts. A routine that sums bytes looks different in assembly from one that rotates bits, and the notes record which one you found. Compare the notes with your original source, run your own test, and accept the diff only when both agree.

Write a Python helper for a file header

Reverse engineering coding in practice means small scripts around the analysis, and anyone aiming for career growth in malware analysis or reverse engineering soon writes some. Describe the file you want to read, for example the PE header of a program you built, and the agent writes header.py with write_file. Shell runs your Python command on a copy and reports the real exit code. Check the script first. Read it in the diff and confirm that it only reads bytes from the copy and does not execute it. If the command fails, the agent reads the error and edit_file shows the fix as a diff. Run the script on a second copy and keep the output in your notes.