Use this skill when the analysis already has some strings, handler candidates, or decompiled code and the next goal is to reconstruct the wire protocol or command model.

Minimum evidence package

Before reconstructing fields, gather at least:

command strings, JSON keys, or opcode constants
one decode or parse function
one dispatch or handler function
one encode or send function, if present
transport clues from imports, strings, or telemetry

If ida-pro-mcp is connected, the minimum MCP pass is:

find_regex for command words, verbs, framing strings, and JSON tags
xrefs_to on those strings or constants
decompile the decode, dispatch, and encode candidates
callgraph from the receive path or top dispatcher
export_funcs when local diffing or field extraction is needed

Objectives

Produce:

a command map,

Use this skill when the analysis already has some strings, handler candidates, or decompiled code and the next goal is to reconstruct the wire protocol or command model.

Minimum evidence package

Before reconstructing fields, gather at least:

command strings, JSON keys, or opcode constants
one decode or parse function
one dispatch or handler function
one encode or send function, if present
transport clues from imports, strings, or telemetry

If ida-pro-mcp is connected, the minimum MCP pass is:

find_regex for command words, verbs, framing strings, and JSON tags
xrefs_to on those strings or constants
decompile the decode, dispatch, and encode candidates
callgraph from the receive path or top dispatcher
export_funcs when local diffing or field extraction is needed

Objectives

Produce:

a command map,

Reverse Protocol Reconstruction

Minimum evidence package

Objectives

Reverse Protocol Reconstruction

Minimum evidence package

Objectives

Workflow

Phase 1: gather protocol clues

Phase 2: identify boundaries

Phase 3: command and message map

Phase 4: defensive interpretation

Output format

Protocol Reconstruction Summary

Executive Summary

Facts

Inferences

Message / Command Candidates

Flow Hypothesis

Gaps

Validation Plan

Continuous Learning V2

Continuous Learning V2

Continuous Learning V2

Continuous Learning

Continuous Learning

Pytorch Patterns