LOREA
LOREA is a coding agent fine-tuned for
Wine development, DXVK/DXMT
(D3D→Vulkan / D3D→Metal), Windows / Linux / macOS internals, and reverse
engineering, designed to drive the LOREA/OCLI agent CLI's
<tools>{...}</tools>
tool-calling. It runs
fully locally on Apple Silicon via
MLX.
Flagship: v3-re-30b/ — the RE model
| |
|---|
| Base | Qwen/Qwen3-Coder-30B-A3B-Instruct (Apache-2.0, MoE — 30B total / ~3B active) |
| Quantized base | mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit |
| Method | LoRA (8 layers), 1000 iters, seq 1536, lr 5e-5 (MLX) |
| Val loss | 1.77 → 1.25 |
| Adapter | v3-re-30b/adapters.safetensors (~269 MB) |
What it knows
- Wine / DXVK / DXMT code (C / C++ / Rust / Objective-C / Metal)
- Reverse engineering: x86-64 disassembly → C, PE / ELF / Mach-O formats, calling conventions
- Linux internals: syscalls, ELF loading, ptrace, the Wine architecture
- macOS internals: Mach exception ports, IOKit matching (
IOServiceAddMatchingNotification), dyld, the Obj-C runtime, libdispatch (_dispatch_assert_queue_fail), Rosetta 2 (%gs / TLS)
- Emits tool calls:
<tools>{"name":"grep","arguments":{"pattern":"vkCreateDevice","path":"."}}</tools>
Use it (MLX)
1pip install mlx-lm
2python -m mlx_lm generate \
3 --model mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit \
4 --adapter-path ./v3-re-30b \
5 --prompt "Explain how a macOS IOKit matching notification can fire on the wrong dispatch queue."
6# or fuse into a standalone model:
7python -m mlx_lm fuse \
8 --model mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit \
9 --adapter-path ./v3-re-30b --save-path ./lorea-30b
Also in this repo: cyber-30b/ — LOREA-cyber (authorized red-team / security)
A second adapter on the same base, specialized for authorized offensive security and
security analysis. The original v3-re-30b/ model above is unchanged and remains the default; this
one coexists alongside it. LOREA-cyber reasons like an ethical red-team penetration tester across
the full kill chain and pairs every technique with detection and remediation.
| |
|---|
| Base | Qwen/Qwen3-Coder-30B-A3B-Instruct (same as above) |
| Method | LoRA (8 layers), 1000 iters, seq 1536, lr 5e-5 (MLX) |
| Val loss | 1.77 → 0.965 |
| Adapter | cyber-30b/adapters.safetensors (~269 MB) |
What it does
- Authorized pentest kill chain — recon, enumeration, web / network / Active Directory / cloud
exploitation, privilege escalation, lateral movement, post-exploitation, reporting — each mapped
to MITRE ATT&CK with detection and remediation
- CVE / vulnerability analysis, detection engineering (Sigma / YARA / Suricata), and binary
exploitation & RE for exploit dev (CTF / educational)
- Refuses misuse: trained to confirm authorization and scope first, and to refuse + redirect for
unauthorized attacks, malware / ransomware / C2, credential theft, or anything harmful
Responsible use
For authorized, scoped, lawful security work only — systems you own or are contracted to test,
CTFs, labs, and education. The companion CLI additionally enforces a hard runtime guard that blocks
destructive/malicious tool calls regardless of model output. You are responsible for lawful use.
Use it (MLX)
1python -m mlx_lm generate \
2 --model mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit \
3 --adapter-path ./cyber-30b \
4 --prompt "I'm authorized to test 10.10.50.0/24 (signed scope). Plan the recon phase."
Training data
Wine / DXVK / DXMT source; Linux kernel + macOS open-source internals (XNU, dyld,
objc4, libdispatch); synthesized x86-64 disasm↔source pairs; ~380 expert,
adversarially fact-checked RE/Linux/macOS Q&A; and a broad multi-language code
sample. Plus conversational + tool-calling data so it chats normally and
finalizes after a tool result (no loops).
| Source | License |
|---|
| Wine | LGPL-2.1+ |
| DXVK | zlib |
| DXMT | upstream |
| XNU / dyld / objc4 / libdispatch | Apple OSS (APSL / Apache-2.0) |
| Linux kernel | GPL-2.0 |
| RE/Linux/macOS Q&A, disasm pairs | original (synthetic) |
License & limitations
Apache-2.0, matching the base. Built with Qwen3-Coder-30B-A3B (© Alibaba,
Apache-2.0). See NOTICE.
It's a LoRA on a 30B — strong at domain vocabulary, concepts, and tool-driving,
but it can be wrong on deep specifics. Review its output, especially for
reverse engineering. Provided as-is, no warranty.
An earlier 14B adapter (Qwen2.5-Coder-14B) lives in this repo's history.
