LOREA

LOREA is a coding agent fine-tuned for Wine development, DXVK/DXMT (D3D→Vulkan / D3D→Metal), Windows / Linux / macOS internals, and reverse engineering, designed to drive the LOREA/OCLI agent CLI's <tools>{...}</tools> tool-calling. It runs fully locally on Apple Silicon via MLX.

Flagship: v3-re-30b/ — the RE model

Base	Qwen/Qwen3-Coder-30B-A3B-Instruct (Apache-2.0, MoE — 30B total / ~3B active)
Quantized base	mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit
Method	LoRA (8 layers), 1000 iters, seq 1536, lr 5e-5 (MLX)
Val loss	1.77 → 1.25
Adapter	v3-re-30b/adapters.safetensors (~269 MB)

What it knows

• Wine / DXVK / DXMT code (C / C++ / Rust / Objective-C / Metal)
• Reverse engineering: x86-64 disassembly → C, PE / ELF / Mach-O formats, calling conventions
• Linux internals: syscalls, ELF loading, ptrace, the Wine architecture
• macOS internals: Mach exception ports, IOKit matching (IOServiceAddMatchingNotification), dyld, the Obj-C runtime, libdispatch (_dispatch_assert_queue_fail), Rosetta 2 (%gs / TLS)
• Emits tool calls: <tools>{"name":"grep","arguments":{"pattern":"vkCreateDevice","path":"."}}</tools>

Use it (MLX)

pip install mlx-lm
python -m mlx_lm generate \
  --model mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit \
  --adapter-path ./v3-re-30b \
  --prompt "Explain how a macOS IOKit matching notification can fire on the wrong dispatch queue."
# or fuse into a standalone model:
python -m mlx_lm fuse \
  --model mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit \
  --adapter-path ./v3-re-30b --save-path ./lorea-30b

Also in this repo: cyber-30b/ — LOREA-cyber (authorized red-team / security)

A second adapter on the same base, specialized for authorized offensive security and security analysis. The original v3-re-30b/ model above is unchanged and remains the default; this one coexists alongside it. LOREA-cyber reasons like an ethical red-team penetration tester across the full kill chain and pairs every technique with detection and remediation.

Base	Qwen/Qwen3-Coder-30B-A3B-Instruct (same as above)
Method	LoRA (8 layers), 1000 iters, seq 1536, lr 5e-5 (MLX)
Val loss	1.77 → 0.965
Adapter	cyber-30b/adapters.safetensors (~269 MB)

What it does

• Authorized pentest kill chain — recon, enumeration, web / network / Active Directory / cloud exploitation, privilege escalation, lateral movement, post-exploitation, reporting — each mapped to MITRE ATT&CK with detection and remediation
• CVE / vulnerability analysis, detection engineering (Sigma / YARA / Suricata), and binary exploitation & RE for exploit dev (CTF / educational)
• Refuses misuse: trained to confirm authorization and scope first, and to refuse + redirect for unauthorized attacks, malware / ransomware / C2, credential theft, or anything harmful

Responsible use

For authorized, scoped, lawful security work only — systems you own or are contracted to test, CTFs, labs, and education. The companion CLI additionally enforces a hard runtime guard that blocks destructive/malicious tool calls regardless of model output. You are responsible for lawful use.

Use it (MLX)

python -m mlx_lm generate \
  --model mlx-community/Qwen3-Coder-30B-A3B-Instruct-4bit \
  --adapter-path ./cyber-30b \
  --prompt "I'm authorized to test 10.10.50.0/24 (signed scope). Plan the recon phase."

Training data

Wine / DXVK / DXMT source; Linux kernel + macOS open-source internals (XNU, dyld, objc4, libdispatch); synthesized x86-64 disasm↔source pairs; ~380 expert, adversarially fact-checked RE/Linux/macOS Q&A; and a broad multi-language code sample. Plus conversational + tool-calling data so it chats normally and finalizes after a tool result (no loops).

Source	License
Wine	LGPL-2.1+
DXVK	zlib
DXMT	upstream
XNU / dyld / objc4 / libdispatch	Apple OSS (APSL / Apache-2.0)
Linux kernel	GPL-2.0
RE/Linux/macOS Q&A, disasm pairs	original (synthetic)

License & limitations

Apache-2.0, matching the base. Built with Qwen3-Coder-30B-A3B (© Alibaba, Apache-2.0). See NOTICE.

It's a LoRA on a 30B — strong at domain vocabulary, concepts, and tool-driving, but it can be wrong on deep specifics. Review its output, especially for reverse engineering. Provided as-is, no warranty.

---

An earlier 14B adapter (Qwen2.5-Coder-14B) lives in this repo's history.