Commit Graph
10 Commits
Author SHA1 Message Date
Harry 0a4019d56f fix(router): clamp hot path to routing.json and real auth gate
Keep reverse-skill a skill router, not a platform. RULES hot path is master-route then case-init then PRIMARY. MASTER-ROUTING priority is verified against routing.json. precedent-auth no longer grants. CTF is one R41 pointer, not 40 competition routes. open.ps1 never deletes .i64/.idb. Route-scope parse is line-anchored and last-match. Tests: 168 routing cases, parse-contracts, title-safety in CI.
2026-08-18 14:58:22 +01:00
yhc e489f9ad6a fix(verify): run #77 anchors before fail gate; strip BEL in links
Move ADF/BSC assertions out of Write-Host string so they update $fail.
Use Ok/Bad + Test-Path/Get-Content (no phantom Assert-File*).
Assert re-agent-workflow hooks blindspot cookbook.
Remove ASCII BEL from ADF/workflow markdown link labels.
2026-08-15 08:58:36 +08:00
yhc 038e69fd5b feat(ops): blindspot cookbook R52-R81 (#77 batch 2)
Add analysis-blindspot-cookbook for language/obfuscation/behavior/format/
agent-meta recipes. Detection-oriented; no bypass tutorials. Hook ADF §5,
re-agent-workflow, verify anchors. Not a third master workflow.
2026-08-14 21:09:20 +08:00
yhc ec61a6f951 feat(ops): analysis decision framework R1-R51 (#77)
Add analysis-decision-framework cookbook (P0 full / P1 short / P2 index).
R4* validated sufficiency (compatible >=1 bind). Thin hooks in evidence-
finding-path, re-agent-workflow Synthesis, RULES(+zh), verify anchors.
Not a second master workflow; keep #65 gates and A-T/U-AV superior.
2026-08-14 20:26:03 +08:00
yhc 241fa77be0 feat(workflow): non-PE multi-format cookbook U-AV (#65)
Add nonpe-format-cookbook for BAT/PS/VBA/JS/SYS/DLL/Android recipes.
Wire re-agent-workflow §3.4, malware/js/apk/kernel skills, verify asserts.
Dedup DLL Delay-Load with A-T R; detection-only for wiper/BYOVD/reflective.
2026-08-12 21:09:04 +08:00
yhc 31708a99ae feat(workflow): anti-debug/obfuscation cookbook A-T (#65) 2026-08-12 18:52:29 +08:00
yhc 831ab83083 fix(workflow): feasibility gate + side-path patches 6-10 (#65)
- User-command feasibility gate: obey goals not blind step order;
  blocked steps require explain + confirm; forced steps mark quality
- Redo-X clarified: named step or confirmed prerequisite path;
  unpack is prerequisite not substitute for import Evidence
- Patch 6: post-unpack self-check crash -> dynamic CreateFile/GetFileSize
- Patch 7+10: TLS -> EP -> sensitive API -> ExitProcess dump baseline
- Patch 8: high-risk API cluster hints when import table is huge
- Patch 9: SHOULD time-boxes (15min static / ~200 steps dynamic), overridable
- Wire RULES (en/zh), agent-obedience, malware, r2/ida; extend verify asserts
2026-08-12 15:06:38 +08:00
yhc 5d73e05e89 fix(workflow): IAT repair iron rule + vuln thin overlay (issue #65)
- Map reporter six-phase malware RE flow into re-agent-workflow with
  IAT repair fail-fast (E-iat-repair-fail -> dynamic API breakpoints)
- Equivalent import anchors for .NET; E-exports for DLL/SYS; clean IAT
  and sandbox no-behavior side paths
- Wire radare2/ida/malware hard gates + RULES/obedience rebuttals
- Add optional thin vuln report overlay (not a 3rd default full flavor)
- Extend verify-routing-coherence assertions; smoke+verify x3 pass
2026-08-12 11:57:38 +08:00
yhc 00f62eec49 fix(workflow): hard-gate import table check and redo-same-step (issue #65)
- radare2/ida-reverse/malware-analysis: MUST record imports as Evidence before next phase
- re-agent-workflow: triage gate blocks Dynamic without imports summary
- RULES (+zh) and agent-obedience: redo named step X, no substitute
2026-08-11 19:30:33 +08:00
zhaoxuya520 9c28c6ca10 release: v1.0.1 2026-08-08 18:32:33 +08:00