{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/crackme03/README.md",
    "https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/crackme03/report.md",
    "https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/VEHMeme/README.md",
    "https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/VEHMeme/report.md",
    "https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/mcp-job-security/README.md",
    "https://github.com/mrexodia/mcp-reversing-dataset/tree/523ce22b9b0d3371f6dfc8f344e604064dc0ef97"
  ],
  "category": "learning",
  "description_en": "Three worked examples by mrexodia of a language model reverse-engineering crackme binaries in IDA Pro through his IDA Pro MCP server. Each folder holds the input binary, a README giving its origin, the prompt and the model, the agent's own report and the exported session transcript, so readers can follow every tool call, rename, retype and comment the agent made on the database. The tasks cover a small Linux password check, an obfuscated Linux flag checker and a Windows crackme that, according to the agent's report, routes its checks through vectored exception handling.",
  "description_zh": "mrexodia 发布的三个实例，展示语言模型借助他编写的 IDA Pro MCP 服务器在 IDA Pro 中逆向分析 crackme 二进制。每个文件夹都包含输入二进制、说明其来源、所用提示词和模型的 README、智能体自己撰写的报告以及导出的会话记录，读者可以逐一查看智能体对数据库的每次工具调用、重命名、类型修改和注释。三个任务分别是一个简单的 Linux 密码校验程序、一个经过混淆的 Linux flag 校验程序，以及一个 Windows crackme；据智能体的报告，它借助向量化异常处理来执行校验。",
  "entry_url": "https://awesomerea.org/resources/mcp-reversing-dataset/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/mcp-reversing-dataset/",
  "evidence_url": "https://github.com/mrexodia/mcp-reversing-dataset/blob/523ce22b9b0d3371f6dfc8f344e604064dc0ef97/README.md",
  "group": "learn",
  "id": "mcp-reversing-dataset",
  "json_url": "https://awesomerea.org/resources/mcp-reversing-dataset/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/mcp-reversing-dataset/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/mcp-reversing-dataset/index.md",
  "name": "MCP Reversing Dataset (mrexodia)",
  "name_zh": "MCP 逆向数据集（mrexodia）",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Three tasks, committed between 2025-03-28 and 2025-04-14 and unchanged since. Each folder's README gives the input, the prompt and the model, next to the agent's report.md and an exported task-history.md transcript; crackme03 adds the agent's solve.py and a launcher that runs the ELF through WSL. All three runs used Claude 3.7 Sonnet in Roo Cline or Roo Code with the author's IDA Pro MCP server.",
    "The repository bundles the three challenge binaries it analyzes: VEHMeme.exe, a Windows crackme the README credits to Brit and xenocidewiki from an earlier CTF; crackme03.elf, compiled with GCC 11.4.0 on Ubuntu 22.04 from a NoraCodes crackmes source file; and transformed.elf, described as a modified version of babush's mcp-job-security obfuscation project. They are small CTF-style samples rather than commercial software, but the repository states no redistribution terms for them.",
    "Following a run needs IDA Pro, which is commercial, the IDA Pro MCP server and an MCP client. The prompts ask the model to rename, retype and comment the database and write a report, and the crackme03 prompt forbids brute forcing. The transcripts are single, unscored runs: the crackme03 report records a password confirmed by running the binary, the mcp-job-security report names the flag it extracted, and the VEHMeme report explains the exception-based check without stating a flag. These are author-published results.",
    "There is no license file, so reuse terms for the transcripts and reports are unstated; the README welcomes contributions, but only the original three tasks exist."
  ],
  "requirements_zh": [
    "共三个任务，提交于 2025-03-28 至 2025-04-14 之间，此后未再更新。每个文件夹的 README 说明输入、提示词和模型，旁边是智能体撰写的 report.md 和导出的 task-history.md 会话记录；crackme03 另附智能体编写的 solve.py，以及一个通过 WSL 运行该 ELF 的启动脚本。三次运行都在 Roo Cline 或 Roo Code 中使用 Claude 3.7 Sonnet，并配合作者的 IDA Pro MCP 服务器。",
    "仓库附带所分析的三个挑战二进制：VEHMeme.exe 是 README 注明出自 Brit 和 xenocidewiki、来自早年一场 CTF 的 Windows crackme；crackme03.elf 由 NoraCodes crackmes 中的一个源文件在 Ubuntu 22.04 上用 GCC 11.4.0 编译而成；transformed.elf 则被描述为 babush 的 mcp-job-security 混淆项目的修改版本。它们是小型 CTF 式样本而非商业软件，但仓库未说明其再分发条款。",
    "按记录跟做需要商业软件 IDA Pro、IDA Pro MCP 服务器以及一个 MCP 客户端。提示词要求模型对数据库进行重命名、修改类型、添加注释并撰写报告，crackme03 的提示词还禁止暴力破解。这些会话记录都是未经评分的单次运行：crackme03 的报告记录了经运行二进制确认的密码，mcp-job-security 的报告给出了它提取的 flag，VEHMeme 的报告解释了基于异常的校验机制，但没有给出 flag。这些均为作者发布的结果。",
    "仓库没有许可证文件，因此会话记录和报告的复用条款不明；README 欢迎贡献，但目前只有最初的三个任务。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mrexodia/mcp-reversing-dataset",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}