| Native exe/dll/elf/so, unknown binary | REA open_binary → analyze_function / pseudocode; else references/reverse-engineering/README.md (triage→static→dynamic→synthesis) |
| Managed PE (.NET/C#) | REA inspect_managed_artifact; else references/dotnet-reverse/ |
| ASAR / Electron / bundled JS | REA analyze_javascript_application; else references/js-reverse/ |
| APK / Android | REA inspect_android_package; else references/apk-reverse/, references/mobile-reverse/ |
| ZIP/APK/IPA/MSIX/DMG member inventory | REA open_binary (archive route) |
| Firmware image | REA inspect_firmware_regions / extract_firmware; else references/firmware-pentest/ |
| ELF layout/symbols/mitigations (offline) | REA inspect_binary_layout; else references/radare2/ |
| Linux x86-64 core dump | REA inspect_recorded_crash |
| PE resources | REA inspect_pe_resources |
| EVM bytecode blob | REA inspect_evm_interface |
| Open browser page / Electron runtime | REA list_browser_targets / list_electron_targets; else references/browser-automation/ |
| HAR / mitmproxy capture | REA inspect_web_network_capture |
| Go/Rust stripped binary | references/go-rust-reverse/, REA Ghidra provider |
| Kernel driver / LKM / .sys | references/reverse-engineering/kernel-driver-reverse.md |
| OLLVM / control-flow-flattening obfuscation | references/reverse-engineering/references/ollvm-deobfuscation.md |
| Custom VM / DSL VM (JS opcode switch) | references/reverse-engineering/dsl-vm-reverse/ |
| Custom protocol / Protobuf / PCAP | references/protocol-reverse/, references/digital-forensics/ |
| Malware sample | references/malware-analysis/ (six-stage, YARA/Sigma) |
| Version diffing / symbol migration | references/binary-diff/; N-day patch→exploit: references/patch-diff-exploit/ |
| Exploit development after RE | references/pwn-chain/ (stack/heap/kernel, pwntools) |
| Anti-debug / anti-VM / packing | references/reverse-engineering/anti-analysis.md |
| CTF challenge (any category) | references/ctf-sandbox/ → references/CTF-Sandbox-Orchestrator/ |
| macOS / iOS / Mach-O | references/macos-reverse/, references/mobile-reverse/ |
| Thick desktop client | references/thick-client/; extension: references/browser-extension-reverse/ |
| Hardware (UART/JTAG/SWD) | references/hardware-security/ |
| Authorized pentest / web / API / AD / cloud / wireless | references/pentest-tools/, api-security/, windows-ad/, cloud-k8s/, wifi-wireless/, attack-chain/ (multi-stage) |
| Code audit / SBOM / secrets scan | references/code-audit/, supply-chain-security/ |
| Forensics / threat hunting / OSINT | references/digital-forensics/, threat-hunting/, threat-intelligence/ |
| Ambiguous route | bash references/scripts/master-route.sh --hint "<task>" (rule SSoT: references/config/routing.json); fallback matrix: references/routing.md |