Reverse engineering tools per mode; raw firmware in decompile; skill

- AgentConfig.reverse_tools (Settings -> Agents & commands) gives any mode
  binary_info and decompile; the clean-room check of the tools applies to
  craft only (ToolCtx.clean_room = clean room && craft).
- decompile: optional processor (Ghidra language id) and base_address for raw
  images (BinaryLoader); separate cache per processor/address.
- Skill "reverse-engineering": identify, convert HEX, processor table for
  common chips, decompile, explore, notes in analysis/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/reverse.rs

@@ -142,7 +142,10 @@ impl Tool for Decompile {
         "Decompile an executable or library with Ghidra (x86/x64/ARM/MIPS/PowerPC/68k …, PE, ELF, \
          Mach-O, raw DOS). Writes pseudo-C for every function plus strings, imports and exports \
          into .codecraft/decompiled/<name>/ and returns an overview. Can take several minutes for \
-         large programs; results are cached per file."
+         large programs; results are cached per file. Raw firmware images (.bin without a file \
+         format) need `processor` (Ghidra language id, e.g. \"ARM:LE:32:Cortex\" for Cortex-M, \
+         \"ARM:LE:32:v8\", \"AVR8:LE:16:atmega256\", \"Xtensa:LE:32:default\" for ESP32) and usually \
+         `base_address` (load address, e.g. \"0x08000000\" for STM32 flash)."
             .into()
     }
     fn schema(&self) -> Value {
@@ -151,7 +154,9 @@ impl Tool for Decompile {
             "properties": {
                 "path": {"type": "string"},
                 "max_functions": {"type": "integer", "description": "Limit for very large binaries (default: all)"},
-                "force": {"type": "boolean", "description": "Re-run even if cached"}
+                "force": {"type": "boolean", "description": "Re-run even if cached"},
+                "processor": {"type": "string", "description": "Ghidra language id for raw images, e.g. ARM:LE:32:Cortex (default: detected from the file format)"},
+                "base_address": {"type": "string", "description": "Load address of a raw image, e.g. 0x08000000"}
             },
             "required": ["path"]
         })
@@ -171,7 +176,20 @@ impl Tool for Decompile {
             bail!("{} is not a file", path.display());
         }
         let name = path.file_name().and_then(|n| n.to_str()).unwrap_or("binary").replace(|c: char| !c.is_ascii_alphanumeric() && c != '.' && c != '-', "_");
-        let out_dir = ctx.cwd.join(".codecraft/decompiled").join(format!("{name}-{}", file_hash(&path)?));
+        let processor = input["processor"].as_str().map(str::trim).filter(|s| !s.is_empty()).map(String::from);
+        let base = input["base_address"].as_str().map(str::trim).filter(|s| !s.is_empty()).map(String::from);
+        if processor.as_deref().is_some_and(|p| !p.chars().all(|c| c.is_ascii_alphanumeric() || ":_-.".contains(c))) {
+            bail!("invalid processor id (expected e.g. ARM:LE:32:Cortex)");
+        }
+        if base.as_deref().is_some_and(|b| !b.trim_start_matches("0x").chars().all(|c| c.is_ascii_hexdigit())) {
+            bail!("invalid base_address (expected e.g. 0x08000000)");
+        }
+        // Another processor or load address is another analysis.
+        let variant = match (&processor, &base) {
+            (None, None) => String::new(),
+            (p, b) => format!("-{}", crate::blobs::hash(format!("{p:?}{b:?}").as_bytes()).get(..8).unwrap_or("")),
+        };
+        let out_dir = ctx.cwd.join(".codecraft/decompiled").join(format!("{name}-{}{variant}", file_hash(&path)?));
         if out_dir.join(".done").exists() && !input["force"].as_bool().unwrap_or(false) {
             return Ok(ToolOutput::text(format!("(cached)\n{}", summarize(&out_dir, &ctx.cwd)?)));
         }
@@ -183,7 +201,15 @@ impl Tool for Decompile {
         let scripts = scripts_dir().display().to_string();
         let max = input["max_functions"].as_u64().map(|n| n.to_string()).unwrap_or_else(|| "2147483647".into());
         let (p, proj, out) = (path.display().to_string(), project.display().to_string(), out_dir.display().to_string());
-        let args = vec![proj.as_str(), "cc", "-import", p.as_str(), "-scriptPath", scripts.as_str(), "-postScript", "CodeCraftExport.java", out.as_str(), max.as_str(), "-deleteProject", "-max-cpu", "2"];
+        let mut args = vec![proj.as_str(), "cc", "-import", p.as_str()];
+        // Raw firmware: the binary loader with the given processor and load address.
+        if let Some(proc_id) = processor.as_deref() {
+            args.extend(["-processor", proc_id]);
+        }
+        if let Some(addr) = base.as_deref() {
+            args.extend(["-loader", "BinaryLoader", "-loader-baseAddr", addr]);
+        }
+        args.extend(["-scriptPath", scripts.as_str(), "-postScript", "CodeCraftExport.java", out.as_str(), max.as_str(), "-deleteProject", "-max-cpu", "2"]);
         let java = tools.join("jdk").display().to_string();
         let mut cmd = match &ctx.sandbox {
             Some(spec) => {