القائمة
Strong activation entry for AlgoKiller ciphertext-recovery mode. Bind an ARM64 trace, force-load the ciphertext-recovery methodology, and start cipher / algorithm recovery from a target ciphertext.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
ARM64 trace 密文还原方法论。当用户给出一段 ARM64 执行 trace 文件并要求从某段密文/header/token/加密结果反向还原加密、签名或编码算法时使用。提供候选算法穷举、key schedule 提取、轮函数提取、魔改检测、表查找证据、闭环验证的完整方法论。激活此 skill 前应已通过 ak MCP 的 bind_trace 工具绑定 trace 文件并选择 mode=ciphertext。
ARM64 trace 通用证据分析方法论。当用户给出一段 ARM64 执行 trace 文件并询问字段含义、执行流、检测点、数据来源、call 边界、buffer 生命周期等开放问题（不属于纯密文还原）时使用。提供搜索键选择、单一目的搜索纪律、call 边界解析、字段语义分层、执行流抽取与检测点分析的完整方法论。激活此 skill 前应已通过 ak MCP 的 bind_trace 工具绑定 trace 文件并选择 mode=general。
Strong activation entry for AlgoKiller general trace-analysis mode. Bind an ARM64 trace, force-load the trace-analysis methodology, and answer field semantics / execution flow / detection-point / data-flow questions.
| name | ciphertext |
| description | Strong activation entry for AlgoKiller ciphertext-recovery mode. Bind an ARM64 trace, force-load the ciphertext-recovery methodology, and start cipher / algorithm recovery from a target ciphertext. |
| argument-hint | <absolute_trace_path> <task description with target ciphertext> |
| disable-model-invocation | true |
You are now entering AlgoKiller ciphertext-recovery mode. High-discipline analysis; drift = hallucination.
MANDATORY FIRST STEPS — execute in order:
Load the full methodology from the ak:ciphertext-recovery skill. Read it completely before any tool call. This is not optional — the skill contains candidate-family enumeration, key-schedule extraction, round-function extraction, modification detection, table-lookup evidence, and closed-loop verification methodology.
Parse the user input below. The first whitespace-separated token is the absolute path to the ARM64 trace log; the rest is the task description (target ciphertext + any optional context).
Call MCP tool ak.bind_trace with that path and mode="ciphertext". Do not proceed if bind fails.
Proceed with the methodology from the skill. Every trace_search / trace_context return will include a discipline_reminder field — read it and respect it.
NON-NEGOTIABLE RULES (skill expands each):
write_artifact recovered Python (.py) + analysis report (.md).User input:
$ARGUMENTS