メニュー
RPC 程序漏洞挖掘
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
IVAgent 测试与评估工作流。修改代码后运行回归测试、LLM 语义评测和日志分析。当用户要求测试、验证、评估或回归检查时使用。
系统测试通用 workflow：对 IDA 伪代码视图执行自主漏洞挖掘
系统测试 workflow: baseband_nas_tft_overflow_01
系统测试 workflow: baseband_rlc_reassembly_01
系统测试 workflow: bluetooth_gatt_underflow_01
系统测试 workflow: bt_l2cap_fragment_uaf_01
| name | rpc-server-analysis |
| description | RPC 程序漏洞挖掘 |
| engine | ida |
| target_type | binary |
| strategy_hints | {"max_depth":"建议调用链深度为 3-5 层","concurrency":"可根据函数数量动态决定并发度"} |
| taint_sources | ["payload (攻击者控制的消息数据)","payload_len (数据长度)"] |
| tags | ["rpc","binary","message_handler"] |
从二进制中分析 handle_type_xxx (由于是 c++ 程序，实际搜索应该为 .*handle_type.*) 命名的函数，他们会处理用户输入，挖掘其中的漏洞
// ============================================
void dispatch_message(const RpcMessage* msg) {
size_t payload_len = msg->header.data_len;
const uint8_t* payload = msg->payload;
switch (msg->header.msg_type) {
case MSG_TYPE_1: handle_type_1(payload, payload_len); break;
case MSG_TYPE_2: handle_type_2(payload, payload_len); break;
case MSG_TYPE_3: handle_type_3(payload, payload_len); break;
case MSG_TYPE_4: handle_type_4(payload, payload_len); break;
case MSG_TYPE_5: handle_type_5(payload, payload_len); break;
case MSG_TYPE_6: handle_type_6(payload, payload_len); break;
case MSG_TYPE_7: handle_type_7(payload, payload_len); break;
case MSG_TYPE_8: handle_type_8(payload, payload_len); break;
case MSG_TYPE_9: handle_type_9(payload, payload_len); break;
case MSG_TYPE_10: handle_type_10(payload, payload_len); break;
case MSG_TYPE_11: handle_type_11(payload, payload_len); break;
case MSG_TYPE_12: handle_type_12(payload, payload_len); break;
case MSG_TYPE_13: handle_type_13(payload, payload_len); break;
case MSG_TYPE_14: handle_type_14(payload, payload_len); break;
case MSG_TYPE_15: handle_type_15(payload, payload_len); break;
case MSG_TYPE_16: handle_type_16(payload, payload_len); break;
case MSG_TYPE_17: handle_type_17(payload, payload_len); break;
case MSG_TYPE_18: handle_type_18(payload, payload_len); break;
case MSG_TYPE_19: handle_type_19(payload, payload_len); break;
case MSG_TYPE_20: handle_type_20(payload, payload_len); break;
default:
printf("Unknown message type: %u\n", msg->header.msg_type);
break;
}
}