Use when carrying Ghidra-derived symbols, functions, or addresses into LLDB confirmation and writing the dynamic result back to project evidence.
Installation
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Use when carrying Ghidra-derived symbols, functions, or addresses into LLDB confirmation and writing the dynamic result back to project evidence.
folder
offensive-macos-gatehouse-ghidra-lldb
source
skillz-wave4
trigger_phrases
["bridge ghidra lldb","ghidra to lldb","lldb anchors","confirm this static anchor"]
Gatehouse — Ghidra To LLDB
Channel boundary:REPO_MODE=analysis. Gatehouse confirms static hypotheses
in a lab-safe way. It does not start dynamic testing until LAB_SAFETY.md
permits the host, user, rollback, and test shape.
When To Use
A Ghidra function, symbol, or address needs runtime confirmation.
A source/Electron/dossier claim has a concrete binary anchor.
Static and dynamic notes are starting to diverge.
Workflow
Read LAB_SAFETY.md, CORPUS.md, the dossier, and the relevant Ghidra evidence path.
Prefer symbol anchors when available. Treat raw addresses as uncertain until image slide and architecture slice are verified.
Use ghidra-scripts/export_lldb_anchors.py or a Ghidra MCP query to collect anchors.
Use macre-vm-mcplldb_run_anchors or lldb_run to capture image list, registers, backtrace, and targeted memory/state.
Save the transcript under artifacts/ or findings/analysis/, then update Scriptorium and HANDOFF.md.
Stop And Ask Before
Attaching to a running PID.
Running GUI apps, daemons, helpers, installers, or updaters.
Ignoring slide, slice, SIP, timeout, or symbol-resolution uncertainty.
