Detailed Analysis
A developer named Owen Pawl has released Cerberus RE, a Claude Code (and Codex) skill purpose-built for reverse engineering Apple binaries, marking a rebrand and substantial expansion of an earlier project called ghidra-re-skill. The tool positions itself as a "local Apple-focused reverse-engineering workbench" that stitches together three established tools—Ghidra for static analysis, LLDB for debugging, and Frida for dynamic instrumentation—into a repeatable workflow loop. Rather than replacing these industry-standard tools, Cerberus RE acts as an orchestration layer that allows an AI coding agent to move fluidly between static disassembly, live debugging, and runtime instrumentation, three modes of analysis that human reverse engineers typically juggle manually and often clumsily. The project is open-sourced on GitHub, and the author explicitly invites community contributions, signaling an intent to grow this into a shared infrastructure piece for the Apple security research community rather than a one-off personal utility.
The practical use cases cited are notable for their specificity and technical depth. The author describes using Cerberus RE to reverse-engineer undocumented and private Apple frameworks, decode opaque protobuf blobs commonly found in Apple's internal databases, and—most strikingly—build tooling around Shortpy, a Python representation of Shortcuts that Apple reportedly introduced in a recent beta. Figuring out class structures for implementing features in an undocumented, beta-stage Apple technology is exactly the kind of exploratory, iterative, evidence-driven work that benefits from an AI agent capable of forming hypotheses, testing them against binary evidence, and revising course. This is reverse engineering as detective work, not rote pattern-matching, and it illustrates how Claude Code is increasingly being applied to open-ended technical investigation rather than conventional software authorship.
A key architectural detail is the recommendation to pair Cerberus RE with a companion tool called long-run-agent-skill for "managing state and durable, evidence-based reasoning." This points to one of the harder problems in applying LLM agents to reverse engineering: binary analysis is often a long-horizon task requiring the agent to accumulate findings, track hypotheses, and reference prior evidence across sessions that may span far longer than a single context window comfortably allows. By explicitly designing for external state management and evidence tracking, the author is addressing a known failure mode of agentic coding tools—context loss and hallucinated conclusions—which is especially dangerous in security research where incorrect inferences about binary behavior can be costly or misleading.
This release fits into a broader pattern of specialized "skills" emerging around Claude Code, where developers extend the base agent with domain-specific tooling, prompting scaffolds, and workflow logic tailored to niche technical disciplines. Reverse engineering, security research, and jailbreak/undocumented-API archaeology have long been labor-intensive, expertise-gated fields; tools like Cerberus RE suggest that agentic AI is beginning to lower the barrier to entry for this work by automating the tedious cross-referencing between disassembly, live process inspection, and runtime hooking. It also reflects a maturing ecosystem around Claude Code specifically, where the community is building composable, interoperable skill modules (this one explicitly designed to interlock with another skill for state management) rather than monolithic single-purpose scripts. As Apple and other platform vendors increasingly gate functionality behind private frameworks and undocumented formats, tools that make AI-assisted reverse engineering more systematic and reproducible are likely to become more common, raising both productivity gains for legitimate research and renewed questions about how AI agents will reshape the balance between platform vendors and the researchers who probe their systems.
Read original article →