菜单
Reverse engineering techniques — static and dynamic analysis, anti-analysis countermeasures, language and platform-specific patterns. Use when the target is a compiled binary, obfuscated code, firmware image, mobile app (APK/IPA), WebAssembly module, or bytecode.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Security research methodology — 5-phase workflow (intake → recon → enum → hunt → report). Routes to specialized technique modules. Use when the user asks to audit, penetration test, bug bounty, find vulnerabilities, exploit a target, or perform any security assessment.
AI/ML attack techniques — prompt injection, indirect/RAG poisoning, tool-calling manipulation, adversarial examples, model extraction, membership inference, training data extraction. Use when the target involves LLM agents, chatbots, ML model APIs, image classifiers, or federated learning systems.
Binary exploitation techniques — buffer overflow, format string, heap exploitation, ROP, kernel exploitation, sandbox escape, shellcode. Use when the target is a native binary (ELF/PE), remote service with memory corruption, or kernel module. Requires pwntools, GDB, and binary analysis tools.
Cryptography attack techniques — RSA, ECC, symmetric ciphers, hash collisions, PRNG attacks, lattice/LWE. Use when the challenge involves encryption, decryption, key recovery, nonce reuse, padding oracles, or cryptanalysis of custom schemes.
Forensic analysis techniques — disk, memory, network, steganography, side-channel analysis. Use when given a disk image (.dd, .E01, .raw), memory dump (.vmem, .raw), packet capture (.pcap, .pcapng), image/audio file with hidden data, or side-channel trace.
Malware analysis techniques — static triaging, dynamic sandboxing, PE/.NET analysis, C2 protocol identification. Use when analyzing a suspicious binary, script, document, or network capture from a potentially compromised system.
| name | reverse-engineering |
| description | Reverse engineering techniques — static and dynamic analysis, anti-analysis countermeasures, language and platform-specific patterns. Use when the target is a compiled binary, obfuscated code, firmware image, mobile app (APK/IPA), WebAssembly module, or bytecode. |
| license | MIT |
| compatibility | Requires filesystem-based agent with bash, Python 3, Ghidra/IDA/radare2, and debugging tools. |
| allowed-tools | Bash Read Write Edit Glob Grep WebSearch |
| metadata | {"user-invocable":"true","argument-hint":"<binary-path or platform>"} |
file binary
strings binary | head -100
xxd binary | head -20
binwalk -e binary # embedded files
readelf -h binary # architecture
objdump -d binary | head -50 # disassembly preview
| Task | Document |
|---|---|
| Disassembly, decompiler, symbol recovery, signature matching | Static Analysis |
| Debugger, tracing, hooking, emulation, symbolic execution | Dynamic Analysis |
| Anti-debug, anti-VM, packing, obfuscation, anti-disassembly | Anti-Analysis |
| Go, Rust, Swift, Kotlin, Haskell, C++ patterns; APK, iOS, WASM, .NET, Unity, embedded | Languages & Platforms |
| Tool reference — Ghidra, IDA, radare2, Binary Ninja, Frida, angr, Unicorn | Tools |
| Platform | Key Tools | First Step |
|---|---|---|
| ELF x86-64 | Ghidra + GDB | checksec, review decompiled main |
| Windows PE | IDA + x64dbg | Check sections, imports, TLS callbacks |
| Android APK | Jadx + Frida | Decompile to Java, hook with Frida |
| iOS IPA | Hopper + Frida | Check binary encryption, decrypted with frida-ios-dump |
| .NET | dnSpy / ILSpy | Open in dnSpy, check for obfuscation |
| WASM | wasm-decompile + Chrome DevTools | wasm-decompile module.wasm |
| Firmware | binwalk + QEMU | Extract filesystem, emulate if ARM/MIPS |
| Python .pyc | pycdc / decompyle3 | Decompile bytecode to source |