菜单
Analyzes binary files for vulnerabilities and develops exploits. Use when working with ELF/PE executables, pwn challenges, buffer overflow, heap exploitation, ROP chains, format string bugs, or shellcode development.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Breaks cryptographic systems and decrypts ciphertext. Use when working with RSA, AES, XOR, classical ciphers, hash functions, or when challenge involves encryption, decryption, keys, or mathematical crypto attacks.
Extracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files.
Reverses and exploits mobile applications. Use when working with Android APK files, iOS IPA files, mobile app reversing, Frida hooking, or app security analysis challenges.
Analyzes network traffic and exploits protocols. Use when working with PCAP files, Wireshark captures, packet analysis, protocol exploitation, traffic forensics, or data exfiltration detection.
Gathers intelligence from public sources. Use when searching for usernames, geolocating images, investigating social media, analyzing domains, or solving information gathering challenges.
Escapes Python sandbox restrictions. Use when working with restricted Python eval/exec environments, sandbox escapes, filtered input challenges, or Python jail challenges.
基于 SOC 职业分类
| name | binary-analysis |
| description | Analyzes binary files for vulnerabilities and develops exploits. Use when working with ELF/PE executables, pwn challenges, buffer overflow, heap exploitation, ROP chains, format string bugs, or shellcode development. |
| allowed-tools | Bash, Read, Write, Grep, Glob |
Progress:
- [ ] Run checksec (identify protections)
- [ ] Identify binary type and dangerous functions
- [ ] Find vulnerability (BOF/format string/heap)
- [ ] Calculate offsets
- [ ] Develop exploit with pwntools
- [ ] Test locally, then remote
# 1. File identification
file <binary>
# 2. Security features
checksec --file=<binary>
# 3. Interesting strings
strings <binary> | grep -iE "flag|ctf|password|correct|wrong|win|shell|secret"
# 4. Function symbols
nm <binary> 2>/dev/null | grep -E " T | t " | head -20
# 5. Dangerous functions
objdump -d <binary> 2>/dev/null | grep -E "gets|strcpy|sprintf|scanf|system|exec"
# 6. Auto vulnerability scan
cwe_checker <binary>
| Topic | Reference |
|---|---|
| Protections & Vuln Detection | reference/protections.md |
| Exploitation Templates | reference/exploits.md |
| Advanced Tools | reference/tools.md |
# Generate cyclic pattern
python3 -c "from pwn import *; print(cyclic(200))"
# Find offset
python3 -c "from pwn import *; print(cyclic_find(0x61616167))"
# Find ROP gadgets
ROPgadget --binary <binary> | grep "pop rdi"
# Find one_gadget
one_gadget <libc>
| Tool | Purpose |
|---|---|
| checksec | Check binary protections |
| pwntools | Exploit development |
| ROPgadget | Find ROP gadgets |
| one_gadget | Find libc one-shot gadgets |
| cwe_checker | Auto vuln detection |
| qira | Runtime analysis |
| Triton | Symbolic execution |