JerryLinLinLin

Cheatsheet for Microsoft Sysinternals Process Monitor (Procmon) on Windows. Use it for general dynamic analysis and troubleshooting of applications, services, installers, and system activity: file and Registry access, process/thread and DLL activity,…

Cheatsheet for using the Microsoft Sysinternals command-line tools on Windows from a shell. Use it whenever a task involves a Sysinternals/PsTools utility — PsExec, PsList, PsService, PsLogList, ProcDump, Handle, ListDLLs, Autoruns/autorunsc, Sigcheck,…

Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics…

Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form',…

Cheatsheet for static reverse engineering, binary inspection, and memory-dump analysis with the rizin bundle (rz-retdec `pdz`, rz-ghidra `pdg`, jsdec `pdd`, rz-libyara, FLIRT). Use for any format Rizin parses: PE (.exe/.dll/.sys), Windows MDMP/DMP, ELF/core,…

Cheatsheet for dynamic instrumentation and security analysis of Windows binaries with Frida and the frida-tools CLI (frida REPL, frida-trace, frida-ps). Use it for runtime/dynamic analysis of a Windows process, DLL, or .exe: hooking and tracing Win32/Native…

Cheatsheet for gsudo — a sudo for Windows — to run commands elevated (as admin) or elevate the current shell in-place, without a separate admin window. Use it for essentially any gsudo / "sudo on Windows" task: elevating the current CMD / PowerShell / WSL /…

Cheatsheet for Mandiant Speakeasy, a Windows user-mode and kernel-mode binary emulation framework. Use it to emulate Windows PE executables, DLLs, drivers, or x86/x64 shellcode for reverse engineering, behavioral analysis, malware analysis, authorized…

Cheatsheet for mitmdump — the mitmproxy command-line tool — on Windows to intercept, capture, inspect, modify, replay, filter, and analyze HTTP/HTTPS/TCP/WebSocket/DNS traffic. Use it for essentially any mitmdump/mitmproxy CLI task: standing up a MITM/HTTP(S)…

Windows-only PowerShell cheatsheet for writing, reviewing, debugging, and translating reliable commands and .ps1 scripts. Use whenever you work in PowerShell on Windows, especially for quoting, escaping, interpolation, here-strings, regex and wildcard layers,…

Windows-only cheatsheet for Detect It Easy's console executable (`diec.exe`) to identify file formats, compilers, linkers, packers, protectors, and other signatures; run deep, heuristic, aggressive, recursive, entropy, and file-information scans; emit JSON,…

Create, import, preservation-edit, convert, and validate Microsoft Threat Modeling Tool .tm7 files through a constrained JSON interchange format and bundled PowerShell scripts. Use when an agent must author or change a TM7 threat-model diagram, trust…