ctf-agent-workstation

Automatically find gadgets and assemble ROP chains for pwn challenges with angrop (angr's ROP engine). Use ONLY when you actually need to BUILD a ROP chain — e.g. set registers for a syscall, ret2syscall/execve, ret2libc-style func_call, write "/bin/sh" to memory, stack pivot, or mprotect+shellcode. Trigger on: "build/craft a ROP chain", ret2syscall, execve ROP, set_regs, func_call chain, write_to_mem, add_to_mem, stack pivot, mprotect chain, chaining gadgets. Do NOT use for non-ROP exploitation (heap, format string, simple single-gadget ret2win), for plain gadget *lookup* (use ropper/ROPgadget), or for general angr symbolic execution.

Use when a single file falls into one of three trip-up cases the model reliably gets wrong without a recipe: (1) Corrupted-header repair where magic bytes / IHDR / SOI / EOI / CRC / central-directory fields have been clobbered and need precise byte-level reconstruction (PNG height-restore, JPEG marker repair, ZIP EOCD fixup); (2) Steganography extraction needing tool-specific invocations the model doesn't keep straight — zsteg (PNG/BMP only), steghide, stegseek with rockyou, outguess, openstego, LSB/bit-plane workflows; (3) Malicious office/PDF dissection via olevba, oledump, pcode2code, pdf-parser, peepdf where the macro/JS extraction sequence matters. Skip this skill when `exiftool` or `strings` already reveals the flag, when the file type doesn't match the recipe (e.g. zsteg on JPG), or for trivially-readable archives — try the cheap path first.

Use for packet captures where the answer needs tool-specific extraction recipes the model doesn't keep straight: USB HID keystroke decoding from `usb.capdata` (the keycode→character map is fiddly), TLS keylog reconstruction via SSLKEYLOGFILE, file carving from HTTP/SMB/FTP streams via Wireshark export-objects or tcpflow, credential extraction from unencrypted protocols, and non-obvious tshark display-filter / scapy reassembly work. Skip this skill when `strings cap.pcap | grep -aE 'flag\{'` solves it (often does for small CTF pcaps), for fully-encrypted captures with no keys available, and for QUIC/WireGuard captures where the HTTP/TLS-flavoured recipes don't apply — try the cheap path first.

Use ONLY when the disk image is in a forensic format that needs specialized mounting (.E01/EWF via ewfmount, .qcow2/.vmdk/.vhd via qemu-img convert, .AFF via affuse) OR when the task explicitly requires Sleuth Kit-style filesystem inspection: deleted-file recovery via inode (icat / tsk_recover), MFT parsing, slack/unallocated-space carving with bulk_extractor or foremost, or partition-offset arithmetic via mmls→fls. Skip this skill for plain raw/.dd/.img images that mount cleanly with `mount -o loop`, for ZIP/TAR/docker archives misidentified as "images", and for cases where `strings img | grep -aE 'flag\{'` already reveals the flag — try the cheap path first.

Use ONLY for full-system memory dumps (.lime, .raw, .mem, .vmem, full Windows crashdump) where the analysis requires Volatility 3 plugin syntax — the namespacing the model habitually gets wrong (`windows.pslist.PsList`, `linux.pslist.PsList`, `windows.malfind.Malfind`, etc.) — or Linux symbol generation via dwarf2json for custom kernels. Also use for mquire as a fallback when Vol3 symbol lookup fails. Skip this skill for single-process minidumps (gcore output, procdump for one PID — use gdb on the corefile instead), for ARM/Apple Silicon dumps where Vol3 support is patchy, and whenever `strings dump | grep -aE 'flag\{'` already reveals the answer — try the cheap path first.

Use for Android APK reverse engineering where the workflow specifically requires apktool (manifest, smali, resources, repackaging), jadx (DEX → Java/Kotlin decompilation with deobfuscation), or IDA Pro on bundled native .so libraries. The trip-ups this skill closes: deciding when JNI native libs hold the real logic vs. Java, the apktool→jadx sequencing, Java↔native function-name mapping (`Java_com_pkg_Class_method`), and packer/wrapper detection (Cordova, React Native, DexGuard). Skip for trivial APKs where `strings classes.dex | grep flag\{` solves it, for webview-only apps where the answer is a hardcoded URL, and for split APKs / .xapk / .aab bundles (use bundletool first).

Use when solving CTF challenges, debugging exploits, reviewing vulnerabilities, or making technical claims that should be verified with evidence. This skill forces hypotheses to be grounded through local reproduction, instrumentation, emulation, controlled probes, or other direct observations before relying on conclusions.

Analyze binaries using IDA Pro's Python Domain API (ida-domain) in headless mode (idalib). Use when examining program structure, functions, disassembly, cross-references, or strings without the GUI.

Debug Linux kernels using bata24/GEF (GDB Enhanced Features) via the GDB MCP. Use when doing kernel debugging, exploit development, slab/heap inspection, task/cred analysis, memory layout investigation, ROP gadget search, or any qemu-system kernel GDB session. Trigger on kernel debugging, GEF commands, slab analysis, task_struct, cred struct, pagetable, KASLR, kmalloc, SLUB, page tables, or kernel exploit development.