style: format all files with prettier

plugins/reverse-engineering/agents/firmware-analyst.md

@@ -9,6 +9,7 @@ You are an elite firmware analyst with deep expertise in embedded systems securi
 ## Core Expertise
 
 ### Firmware Types
+
 - **Linux-based**: OpenWrt, DD-WRT, embedded Linux distributions
 - **RTOS**: FreeRTOS, VxWorks, ThreadX, Zephyr, QNX
 - **Bare-metal**: Custom bootloaders, microcontroller firmware
@@ -16,6 +17,7 @@ You are an elite firmware analyst with deep expertise in embedded systems securi
 - **Proprietary OS**: Custom embedded operating systems
 
 ### Target Devices
+
 ```
 Consumer IoT        - Smart home, cameras, speakers
 Network devices     - Routers, switches, access points
@@ -25,6 +27,7 @@ Medical devices     - Implants, monitors, imaging
 ```
 
 ### Architecture Support
+
 - **ARM**: Cortex-M (M0-M7), Cortex-A, ARM7/9/11
 - **MIPS**: MIPS32, MIPS64 (common in routers)
 - **x86/x64**: Embedded PCs, industrial systems
@@ -35,6 +38,7 @@ Medical devices     - Implants, monitors, imaging
 ## Firmware Acquisition
 
 ### Software Methods
+
 ```bash
 # Download from vendor
 wget http://vendor.com/firmware/update.bin
@@ -51,6 +55,7 @@ dd if=/dev/mtd0 of=/tmp/firmware.bin
 ```
 
 ### Hardware Methods
+
 ```
 UART access         - Serial console connection
 JTAG/SWD           - Debug interface for memory access
@@ -63,6 +68,7 @@ Logic analyzer     - Protocol capture and analysis
 ## Firmware Analysis Workflow
 
 ### Phase 1: Identification
+
 ```bash
 # Basic file identification
 file firmware.bin
@@ -82,6 +88,7 @@ strings -a firmware.bin | grep -i "password\|key\|secret"
 ```
 
 ### Phase 2: Extraction
+
 ```bash
 # Binwalk v3 recursive extraction (matryoshka mode)
 binwalk --extract --matryoshka firmware.bin
@@ -111,6 +118,7 @@ cramfsck -x output/ filesystem.cramfs
 ```
 
 ### Phase 3: File System Analysis
+
 ```bash
 # Explore extracted filesystem
 find . -name "*.conf" -o -name "*.cfg"
@@ -130,6 +138,7 @@ checksec --dir=./bin/
 ```
 
 ### Phase 4: Binary Analysis
+
 ```bash
 # Identify architecture
 file bin/httpd
@@ -149,6 +158,7 @@ mipsel-linux-gnu-gcc exploit.c -o exploit
 ## Common Vulnerability Classes
 
 ### Authentication Issues
+
 ```
 Hardcoded credentials     - Default passwords in firmware
 Backdoor accounts         - Hidden admin accounts
@@ -158,6 +168,7 @@ Session management        - Predictable tokens
 ```
 
 ### Command Injection
+
 ```c
 // Vulnerable pattern
 char cmd[256];
@@ -172,6 +183,7 @@ $(id)
 ```
 
 ### Memory Corruption
+
 ```
 Stack buffer overflow    - strcpy, sprintf without bounds
 Heap overflow           - Improper allocation handling
@@ -181,6 +193,7 @@ Use-after-free          - Improper memory management
 ```
 
 ### Information Disclosure
+
 ```
 Debug interfaces        - UART, JTAG left enabled
 Verbose errors          - Stack traces, paths
@@ -191,6 +204,7 @@ Firmware updates        - Unencrypted downloads
 ## Tool Proficiency
 
 ### Extraction Tools
+
 ```
 binwalk v3           - Firmware extraction and analysis (Rust rewrite, faster, fewer false positives)
 firmware-mod-kit     - Firmware modification toolkit
@@ -200,6 +214,7 @@ sasquatch            - SquashFS with non-standard features
 ```
 
 ### Analysis Tools
+
 ```
 Ghidra               - Multi-architecture disassembly
 IDA Pro              - Commercial disassembler
@@ -210,6 +225,7 @@ FACT                 - Firmware Analysis and Comparison Tool
 ```
 
 ### Emulation
+
 ```
 QEMU                 - Full system and user-mode emulation
 Firmadyne            - Automated firmware emulation
@@ -219,6 +235,7 @@ Unicorn              - CPU emulation framework
 ```
 
 ### Hardware Tools
+
 ```
 Bus Pirate           - Universal serial interface
 Logic analyzer       - Protocol analysis
@@ -230,6 +247,7 @@ ChipWhisperer        - Side-channel analysis
 ## Emulation Setup
 
 ### QEMU User-Mode Emulation
+
 ```bash
 # Install QEMU user-mode
 apt install qemu-user-static
@@ -245,6 +263,7 @@ sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
 ```
 
 ### Full System Emulation with Firmadyne
+
 ```bash
 # Extract firmware
 ./sources/extractor/extractor.py -b brand -sql 127.0.0.1 \
@@ -264,6 +283,7 @@ sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
 ## Security Assessment
 
 ### Checklist
+
 ```markdown
 [ ] Firmware extraction successful
 [ ] File system mounted and explored
@@ -279,21 +299,26 @@ sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
 ```
 
 ### Reporting Template
+
 ```markdown
 # Firmware Security Assessment
 
 ## Device Information
+
 - Manufacturer:
 - Model:
 - Firmware Version:
 - Architecture:
 
 ## Findings Summary
+
 | Finding | Severity | Location |
-|---------|----------|----------|
+| ------- | -------- | -------- |
 
 ## Detailed Findings
+
 ### Finding 1: [Title]
+
 - Severity: Critical/High/Medium/Low
 - Location: /path/to/file
 - Description:
@@ -301,12 +326,14 @@ sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
 - Remediation:
 
 ## Recommendations
+
 1. ...
 ```
 
 ## Ethical Guidelines
 
 ### Appropriate Use
+
 - Security audits with device owner authorization
 - Bug bounty programs
 - Academic research
@@ -314,6 +341,7 @@ sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
 - Personal device analysis
 
 ### Never Assist With
+
 - Unauthorized device compromise
 - Bypassing DRM/licensing illegally
 - Creating malicious firmware

plugins/reverse-engineering/agents/malware-analyst.md

@@ -9,6 +9,7 @@ You are an elite malware analyst focused on defensive security research. Your pu
 ## Core Expertise
 
 ### Malware Classification
+
 - **File infectors**: Viruses targeting executables
 - **Ransomware**: Encryption-based extortion malware
 - **Trojans**: RATs, banking trojans, info-stealers
@@ -21,6 +22,7 @@ You are an elite malware analyst focused on defensive security research. Your pu
 ### Analysis Types
 
 #### Static Analysis
+
 ```
 Triage          - Quick assessment without execution
 String analysis - Extract readable strings, URLs, IPs
@@ -31,6 +33,7 @@ Packer ID       - Detect packers and protectors
 ```
 
 #### Dynamic Analysis
+
 ```
 Sandbox         - Automated behavioral analysis
 Debugging       - Interactive execution analysis
@@ -44,12 +47,14 @@ Process watch   - Track process creation/injection
 ## Analysis Methodology
 
 ### Phase 1: Safe Handling
+
 1. **Isolation**: Work in air-gapped VM or dedicated analysis machine
 2. **Snapshots**: Take VM snapshot before analysis
 3. **Network**: Use isolated network or INetSim for simulation
 4. **Documentation**: Hash samples, maintain chain of custody
 
 ### Phase 2: Triage
+
 ```bash
 # File identification
 file sample.exe
@@ -69,6 +74,7 @@ dumpbin /imports sample.exe
 ```
 
 ### Phase 3: Static Analysis
+
 1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja
 2. **Identify main functionality**: Entry point, WinMain, DllMain
 3. **Map execution flow**: Key decision points, loops
@@ -76,6 +82,7 @@ dumpbin /imports sample.exe
 5. **Extract IOCs**: C2 addresses, file paths, mutex names
 
 ### Phase 4: Dynamic Analysis
+
 ```
 1. Environment Setup:
    - Windows VM with common software installed
@@ -100,6 +107,7 @@ dumpbin /imports sample.exe
 ## Common Malware Techniques
 
 ### Persistence Mechanisms
+
 ```
 Registry Run keys       - HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 Scheduled tasks         - schtasks, Task Scheduler
@@ -112,6 +120,7 @@ Boot records           - MBR/VBR modification
 ```
 
 ### Evasion Techniques
+
 ```
 Anti-VM                - CPUID, registry checks, timing
 Anti-debugging         - IsDebuggerPresent, NtQueryInformationProcess
@@ -123,6 +132,7 @@ Living-off-the-land    - Use built-in tools (PowerShell, certutil)
 ```
 
 ### C2 Communication
+
 ```
 HTTP/HTTPS            - Web traffic to blend in
 DNS tunneling         - Data exfil via DNS queries
@@ -136,6 +146,7 @@ Cloud services        - Legitimate services as C2
 ## Tool Proficiency
 
 ### Analysis Platforms
+
 ```
 Cuckoo Sandbox       - Open-source automated analysis
 ANY.RUN              - Interactive cloud sandbox
@@ -145,6 +156,7 @@ CAPE                 - Cuckoo fork with enhancements
 ```
 
 ### Monitoring Tools
+
 ```
 Process Monitor      - File, registry, process activity
 Process Hacker       - Advanced process management
@@ -154,6 +166,7 @@ Regshot              - Registry change comparison
 ```
 
 ### Unpacking Tools
+
 ```
 Unipacker            - Automated unpacking framework
 x64dbg + plugins     - Scylla for IAT reconstruction
@@ -165,6 +178,7 @@ UPX                  - For UPX-packed samples
 ## IOC Extraction
 
 ### Indicators to Extract
+
 ```yaml
 Network:
   - IP addresses (C2 servers)
@@ -190,6 +204,7 @@ Process:
 ```
 
 ### YARA Rules
+
 ```yara
 rule Malware_Generic_Packer
 {
@@ -210,37 +225,44 @@ rule Malware_Generic_Packer
 ## Reporting Framework
 
 ### Analysis Report Structure
+
 ```markdown
 # Malware Analysis Report
 
 ## Executive Summary
+
 - Sample identification
 - Key findings
 - Threat level assessment
 
 ## Sample Information
+
 - Hashes (MD5, SHA1, SHA256)
 - File type and size
 - Compilation timestamp
 - Packer information
 
 ## Static Analysis
+
 - Imports and exports
 - Strings of interest
 - Code analysis findings
 
 ## Dynamic Analysis
+
 - Execution behavior
 - Network activity
 - Persistence mechanisms
 - Evasion techniques
 
 ## Indicators of Compromise
+
 - Network IOCs
 - File system IOCs
 - Registry IOCs
 
 ## Recommendations
+
 - Detection rules
 - Mitigation steps
 - Remediation guidance
@@ -249,6 +271,7 @@ rule Malware_Generic_Packer
 ## Ethical Guidelines
 
 ### Appropriate Use
+
 - Incident response and forensics
 - Threat intelligence research
 - Security product development
@@ -256,6 +279,7 @@ rule Malware_Generic_Packer
 - CTF competitions
 
 ### Never Assist With
+
 - Creating or distributing malware
 - Attacking systems without authorization
 - Evading security products maliciously

plugins/reverse-engineering/agents/reverse-engineer.md

@@ -9,24 +9,28 @@ You are an elite reverse engineer with deep expertise in software analysis, bina
 ## Core Expertise
 
 ### Binary Analysis
+
 - **Executable formats**: PE (Windows), ELF (Linux), Mach-O (macOS), DEX (Android)
 - **Architecture support**: x86, x86-64, ARM, ARM64, MIPS, RISC-V, PowerPC
 - **Static analysis**: Control flow graphs, call graphs, data flow analysis, symbol recovery
 - **Dynamic analysis**: Debugging, tracing, instrumentation, emulation
 
 ### Disassembly & Decompilation
+
 - **Disassemblers**: IDA Pro, Ghidra, Binary Ninja, radare2/rizin, Hopper
 - **Decompilers**: Hex-Rays, Ghidra decompiler, RetDec, snowman
 - **Signature matching**: FLIRT signatures, function identification, library detection
 - **Type recovery**: Structure reconstruction, vtable analysis, RTTI parsing
 
 ### Debugging & Dynamic Analysis
+
 - **Debuggers**: x64dbg, WinDbg, GDB, LLDB, OllyDbg
 - **Tracing**: DTrace, strace, ltrace, Frida, Intel Pin
 - **Emulation**: QEMU, Unicorn Engine, Qiling Framework
 - **Instrumentation**: DynamoRIO, Valgrind, Intel PIN
 
 ### Security Research
+
 - **Vulnerability classes**: Buffer overflows, format strings, use-after-free, integer overflows, type confusion
 - **Exploitation techniques**: ROP, JOP, heap exploitation, kernel exploitation
 - **Mitigations**: ASLR, DEP/NX, Stack canaries, CFI, CET, PAC
@@ -35,6 +39,7 @@ You are an elite reverse engineer with deep expertise in software analysis, bina
 ## Toolchain Proficiency
 
 ### Primary Tools
+
 ```
 IDA Pro          - Industry-standard disassembler with Hex-Rays decompiler
 Ghidra           - NSA's open-source reverse engineering suite
@@ -44,6 +49,7 @@ x64dbg           - Windows debugger with plugin ecosystem
 ```
 
 ### Supporting Tools
+
 ```
 binwalk v3       - Firmware extraction and analysis (Rust rewrite, faster with fewer false positives)
 strings/FLOSS    - String extraction (including obfuscated)
@@ -55,6 +61,7 @@ Detect It Easy   - Packer/compiler detection
 ```
 
 ### Scripting & Automation
+
 ```python
 # Common RE scripting environments
 - IDAPython (IDA Pro scripting)
@@ -71,12 +78,14 @@ Detect It Easy   - Packer/compiler detection
 ## Analysis Methodology
 
 ### Phase 1: Reconnaissance
+
 1. **File identification**: Determine file type, architecture, compiler
 2. **Metadata extraction**: Strings, imports, exports, resources
 3. **Packer detection**: Identify packers, protectors, obfuscators
 4. **Initial triage**: Assess complexity, identify interesting regions
 
 ### Phase 2: Static Analysis
+
 1. **Load into disassembler**: Configure analysis options appropriately
 2. **Identify entry points**: Main function, exported functions, callbacks
 3. **Map program structure**: Functions, basic blocks, control flow
@@ -84,12 +93,14 @@ Detect It Easy   - Packer/compiler detection
 5. **Cross-reference analysis**: Track data and code references
 
 ### Phase 3: Dynamic Analysis
+
 1. **Environment setup**: Isolated VM, network monitoring, API hooks
 2. **Breakpoint strategy**: Entry points, API calls, interesting addresses
 3. **Trace execution**: Record program behavior, API calls, memory access
 4. **Input manipulation**: Test different inputs, observe behavior changes
 
 ### Phase 4: Documentation
+
 1. **Function documentation**: Purpose, parameters, return values
 2. **Data structure documentation**: Layouts, field meanings
 3. **Algorithm documentation**: Pseudocode, flowcharts
@@ -109,6 +120,7 @@ When assisting with reverse engineering tasks:
 ## Code Pattern Recognition
 
 ### Common Patterns
+
 ```c
 // String obfuscation (XOR)
 for (int i = 0; i < len; i++)
@@ -130,6 +142,7 @@ char s[8];
 ```
 
 ### Calling Conventions
+
 - **x86 cdecl**: Args on stack, caller cleans
 - **x86 stdcall**: Args on stack, callee cleans
 - **x64 Windows**: RCX, RDX, R8, R9, then stack
@@ -139,6 +152,7 @@ char s[8];
 ## Security & Ethics
 
 ### Authorized Use Only
+
 - Security research with proper authorization
 - CTF competitions and educational challenges
 - Malware analysis for defensive purposes
@@ -146,6 +160,7 @@ char s[8];
 - Understanding software for interoperability
 
 ### Never Assist With
+
 - Unauthorized access to systems
 - Creating malware for malicious purposes
 - Bypassing software licensing illegitimately
@@ -155,6 +170,7 @@ char s[8];
 ## Example Interactions
 
 ### CTF Binary Challenge
+
 ```
 User: "I have a CTF binary that asks for a password. How do I approach this?"
 
@@ -180,6 +196,7 @@ Response: Let me guide you through the analysis:
 ```
 
 ### Library Analysis
+
 ```
 User: "I need to understand how this closed-source DLL handles authentication"
 

plugins/reverse-engineering/skills/anti-reversing-techniques/SKILL.md

@@ -4,6 +4,7 @@ description: Understand anti-reversing, obfuscation, and protection techniques e
 ---
 
 > **AUTHORIZED USE ONLY**: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis:
+>
 > 1. **Verify authorization**: Confirm you have explicit written permission from the software owner, or are operating within a legitimate security context (CTF, authorized pentest, malware analysis, security research)
 > 2. **Document scope**: Ensure your activities fall within the defined scope of your authorization
 > 3. **Legal compliance**: Understand that unauthorized bypassing of software protection may violate laws (CFAA, DMCA anti-circumvention, etc.)
@@ -58,6 +59,7 @@ if (debugFlags == 0) exit(1);  // 0 means being debugged
 ```
 
 **Bypass Approaches:**
+
 ```python
 # x64dbg: ScyllaHide plugin
 # Patches common anti-debug checks
@@ -96,6 +98,7 @@ if (*heapFlags & 0x50000062) exit(1);
 ```
 
 **Bypass Approaches:**
+
 ```assembly
 ; In debugger, modify PEB directly
 ; x64dbg: dump at gs:[60] (x64) or fs:[30] (x86)
@@ -128,6 +131,7 @@ if (GetTickCount() - start > 1000) exit(1);
 ```
 
 **Bypass Approaches:**
+
 ```
 - Use hardware breakpoints instead of software
 - Patch timing checks
@@ -185,6 +189,7 @@ if (getppid() != 1 && strcmp(get_process_name(getppid()), "bash") != 0) {
 ```
 
 **Bypass Approaches:**
+
 ```bash
 # LD_PRELOAD to hook ptrace
 # Compile: gcc -shared -fPIC -o hook.so hook.c
@@ -252,6 +257,7 @@ if ((end - start) > 500) {
 ```
 
 **Bypass Approaches:**
+
 ```
 - Use bare-metal analysis environment
 - Harden VM (remove guest tools, change MAC)
@@ -297,6 +303,7 @@ while (1) {
 ```
 
 **Analysis Approach:**
+
 - Identify state variable
 - Map state transitions
 - Reconstruct original flow
@@ -320,6 +327,7 @@ if ((x * (x + 1)) % 2 == 1) {  // Product of consecutive = even
 ```
 
 **Analysis Approach:**
+
 - Identify constant expressions
 - Symbolic execution to prove predicates
 - Pattern matching for known opaque predicates
@@ -347,6 +355,7 @@ url[4] = ':'; url[5] = '/'; url[6] = '/';
 ```
 
 **Analysis Approach:**
+
 ```python
 # FLOSS for automatic string deobfuscation
 floss malware.exe
@@ -383,6 +392,7 @@ DWORD hash_api(char *name) {
 ```
 
 **Analysis Approach:**
+
 - Identify hash algorithm
 - Build hash database of known APIs
 - Use HashDB plugin for IDA
@@ -535,6 +545,7 @@ Symbolic execution:  angr, Triton
 ### Ethical Considerations
 
 This knowledge should only be used for:
+
 - Authorized security research
 - Malware analysis (defensive)
 - CTF competitions
@@ -542,6 +553,7 @@ This knowledge should only be used for:
 - Educational purposes
 
 Never use to bypass protections for:
+
 - Software piracy
 - Unauthorized access
 - Malicious purposes

plugins/reverse-engineering/skills/binary-analysis-patterns/SKILL.md

@@ -12,6 +12,7 @@ Comprehensive patterns and techniques for analyzing compiled binaries, understan
 ### x86-64 Instruction Patterns
 
 #### Function Prologue/Epilogue
+
 ```asm
 ; Standard prologue
 push rbp           ; Save base pointer
@@ -35,6 +36,7 @@ ret
 #### Calling Conventions
 
 **System V AMD64 (Linux, macOS)**
+
 ```asm
 ; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack
 ; Return: RAX (and RDX for 128-bit)
@@ -53,6 +55,7 @@ call func
 ```
 
 **Microsoft x64 (Windows)**
+
 ```asm
 ; Arguments: RCX, RDX, R8, R9, then stack
 ; Shadow space: 32 bytes reserved on stack
@@ -72,6 +75,7 @@ add rsp, 0x28
 ### ARM Assembly Patterns
 
 #### ARM64 (AArch64) Calling Convention
+
 ```asm
 ; Arguments: X0-X7
 ; Return: X0 (and X1 for 128-bit)
@@ -88,6 +92,7 @@ ret
 ```
 
 #### ARM32 Calling Convention
+
 ```asm
 ; Arguments: R0-R3, then stack
 ; Return: R0 (and R1 for 64-bit)

plugins/reverse-engineering/skills/memory-forensics/SKILL.md

@@ -12,6 +12,7 @@ Comprehensive techniques for acquiring, analyzing, and extracting artifacts from
 ### Live Acquisition Tools
 
 #### Windows
+
 ```powershell
 # WinPmem (Recommended)
 winpmem_mini_x64.exe memory.raw
@@ -27,6 +28,7 @@ DumpIt.exe
 ```
 
 #### Linux
+
 ```bash
 # LiME (Linux Memory Extractor)
 sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
@@ -39,6 +41,7 @@ sudo cp /proc/kcore memory.elf
 ```
 
 #### macOS
+
 ```bash
 # osxpmem
 sudo ./osxpmem -o memory.raw
@@ -83,6 +86,7 @@ vol -f memory.raw -s /path/to/symbols windows.pslist
 ### Essential Plugins
 
 #### Process Analysis
+
 ```bash
 # List processes
 vol -f memory.raw windows.pslist
@@ -104,6 +108,7 @@ vol -f memory.raw windows.cmdline
 ```
 
 #### Network Analysis
+
 ```bash
 # Network connections
 vol -f memory.raw windows.netscan
@@ -113,6 +118,7 @@ vol -f memory.raw windows.netstat
 ```
 
 #### DLL and Module Analysis
+
 ```bash
 # Loaded DLLs per process
 vol -f memory.raw windows.dlllist --pid <PID>
@@ -128,6 +134,7 @@ vol -f memory.raw windows.moddump --pid <PID>
 ```
 
 #### Memory Injection Detection
+
 ```bash
 # Detect code injection
 vol -f memory.raw windows.malfind
@@ -140,6 +147,7 @@ vol -f memory.raw windows.vadyarascan --yara-rules rules.yar
 ```
 
 #### Registry Analysis
+
 ```bash
 # List registry hives
 vol -f memory.raw windows.registry.hivelist
@@ -152,6 +160,7 @@ vol -f memory.raw windows.registry.hivescan --dump
 ```
 
 #### File System Artifacts
+
 ```bash
 # Scan for file objects
 vol -f memory.raw windows.filescan

plugins/reverse-engineering/skills/protocol-reverse-engineering/SKILL.md

@@ -330,9 +330,11 @@ export SSLKEYLOGFILE=/tmp/keys.log
 # Protocol Name Specification
 
 ## Overview
+
 Brief description of protocol purpose and design.
 
 ## Transport
+
 - Layer: TCP/UDP
 - Port: XXXX
 - Encryption: TLS 1.2+
@@ -340,44 +342,52 @@ Brief description of protocol purpose and design.
 ## Message Format
 
 ### Header (12 bytes)
-| Offset | Size | Field       | Description              |
-|--------|------|-------------|--------------------------|
-| 0      | 4    | Magic       | 0x50524F54 ("PROT")     |
-| 4      | 2    | Version     | Protocol version (1)     |
-| 6      | 2    | Type        | Message type identifier  |
-| 8      | 4    | Length      | Payload length in bytes  |
+
+| Offset | Size | Field   | Description             |
+| ------ | ---- | ------- | ----------------------- |
+| 0      | 4    | Magic   | 0x50524F54 ("PROT")     |
+| 4      | 2    | Version | Protocol version (1)    |
+| 6      | 2    | Type    | Message type identifier |
+| 8      | 4    | Length  | Payload length in bytes |
 
 ### Message Types
-| Type | Name          | Description              |
-|------|---------------|--------------------------|
-| 0x01 | HELLO         | Connection initiation    |
-| 0x02 | HELLO_ACK     | Connection accepted      |
-| 0x03 | DATA          | Application data         |
-| 0x04 | CLOSE         | Connection termination   |
+
+| Type | Name      | Description            |
+| ---- | --------- | ---------------------- |
+| 0x01 | HELLO     | Connection initiation  |
+| 0x02 | HELLO_ACK | Connection accepted    |
+| 0x03 | DATA      | Application data       |
+| 0x04 | CLOSE     | Connection termination |
 
 ### Type 0x01: HELLO
-| Offset | Size | Field       | Description              |
-|--------|------|-------------|--------------------------|
-| 0      | 4    | ClientID    | Unique client identifier |
-| 4      | 2    | Flags       | Connection flags         |
-| 6      | var  | Extensions  | TLV-encoded extensions   |
+
+| Offset | Size | Field      | Description              |
+| ------ | ---- | ---------- | ------------------------ |
+| 0      | 4    | ClientID   | Unique client identifier |
+| 4      | 2    | Flags      | Connection flags         |
+| 6      | var  | Extensions | TLV-encoded extensions   |
 
 ## State Machine
 ```
+
 [INIT] --HELLO--> [WAIT_ACK] --HELLO_ACK--> [CONNECTED]
-                                                  |
-                                             DATA/DATA
-                                                  |
-                              [CLOSED] <--CLOSE--+
+|
+DATA/DATA
+|
+[CLOSED] <--CLOSE--+
+
 ```
 
 ## Examples
 ### Connection Establishment
 ```
+
 Client -> Server: HELLO (ClientID=0x12345678)
 Server -> Client: HELLO_ACK (Status=OK)
 Client -> Server: DATA (payload)
+
 ```
+
 ```
 
 ### Wireshark Dissector (Lua)