GitHub - schlarpc/re-shell: Nix-powered agentic reverse engineering environment · GitHub

/" data-turbo-transient="true" />

Skip to content

Search/

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

schlarpc

re-shell

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star<br>11

main

BranchesTags

Go to file

CodeOpen more actions menu

Latest commit

History<br>23 Commits<br>23 Commits

Folders and files<br>NameNameLast commit message<br>Last commit date<br>.claude/skills

.claude/skills

.envrc

.envrc

.gitignore

.gitignore

.npmrc

.npmrc

CLAUDE.md

CLAUDE.md

README.md

README.md

flake.lock

flake.lock

flake.nix

flake.nix

package-lock.json

package-lock.json

package.json

package.json

pyproject.toml

pyproject.toml

uv.lock

uv.lock

View all files

Repository files navigation

re-shell

A Nix flake-based reverse engineering environment designed for use with Claude Code. Drop in a binary, capture, or archive and ask Claude to analyze it -- the right tools and context activate automatically.

Quick start

# Enter the environment (or use direnv)<br>nix develop

# Drop a file into the repo root and start Claude Code<br>cp ~/Downloads/suspicious.exe .<br>claude

# Then just ask:<br># "Reverse engineer suspicious.exe"<br># "Decompile this APK and find hardcoded API keys"<br># "Analyze this HAR file for undocumented API endpoints"

How it works

The environment bundles a full reverse engineering toolchain (Ghidra, radare2, Frida, mitmproxy, YARA, and more) into a reproducible Nix dev shell. Claude Code is configured via CLAUDE.md with discipline-specific skills that auto-activate based on file type and context:

Skill<br>Activates on<br>Example files

Windows RE<br>PE binaries, .NET assemblies, drivers<br>.exe, .dll, .sys

Android RE<br>Android packages, DEX bytecode<br>.apk, .xapk

Web RE<br>HTTP captures, API traffic, protobufs<br>.har, .proto

When Claude detects relevant context, the matching skill loads specialized tool documentation and workflows -- no manual configuration needed.

Adding tools

The environment is self-modifying. If an analysis needs a tool that isn't installed, Claude can add it:

Python packages: uv add then direnv reload

Node.js packages: npm install then direnv reload

System tools: add to flake.nix then direnv reload

Output directories

tmp/ -- Intermediate work products (gitignored)

artifacts/ -- Final deliverables like reports and analysis notes (gitignored)

About<br>Nix-powered agentic reverse engineering environment<br>Resources<br>Readme<br>Activity<br>Stars<br>11 stars<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository

Releases

Packages

Contributors

Languages

You can’t perform that action at this time.