Use when carrying Ghidra-derived symbols, functions, or addresses into LLDB confirmation and writing the dynamic result back to project evidence.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Use when carrying Ghidra-derived symbols, functions, or addresses into LLDB confirmation and writing the dynamic result back to project evidence.
folder
offensive-macos-gatehouse-ghidra-lldb
source
skillz-wave4
trigger_phrases
["bridge ghidra lldb","ghidra to lldb","lldb anchors","confirm this static anchor"]
Gatehouse โ Ghidra To LLDB
Channel boundary:REPO_MODE=analysis. Gatehouse confirms static hypotheses
in a lab-safe way. It does not start dynamic testing until LAB_SAFETY.md
permits the host, user, rollback, and test shape.
When To Use
A Ghidra function, symbol, or address needs runtime confirmation.
A source/Electron/dossier claim has a concrete binary anchor.
Static and dynamic notes are starting to diverge.
Workflow
Read LAB_SAFETY.md, CORPUS.md, the dossier, and the relevant Ghidra evidence path.
Prefer symbol anchors when available. Treat raw addresses as uncertain until image slide and architecture slice are verified.
Use ghidra-scripts/export_lldb_anchors.py or a Ghidra MCP query to collect anchors.
Use macre-vm-mcplldb_run_anchors or lldb_run to capture image list, registers, backtrace, and targeted memory/state.
Save the transcript under artifacts/ or findings/analysis/, then update Scriptorium and HANDOFF.md.
Stop And Ask Before
Attaching to a running PID.
Running GUI apps, daemons, helpers, installers, or updaters.
Ignoring slide, slice, SIP, timeout, or symbol-resolution uncertainty.
