菜单
Reconstruct the logic of Windows PE executables and DLLs (.exe/.dll). Covers import-address-table analysis, Windows API capability mapping, entrypoint/WinMain discovery, decompilation, unpacking (UPX), and solving input-gated checks. Use for Windows PE/exe/dll targets.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Reconstruct the logic of Android apps from an .apk (or .dex/.jar). Covers manifest/entrypoint analysis, jadx Java decompilation, smali inspection, native .so analysis, and finding network endpoints, secrets, and obfuscated logic. Use for Android apk/dex targets.
Reconstruct the logic of Linux/Unix ELF executables, shared objects, and relocatable object files (.o), plus Mach-O. Covers entrypoint discovery, import/syscall mapping, function decompilation, and solving input-gated branches. Use for ELF/.o/.so/Mach-O targets.
Reconstruct logic from embedded firmware — Intel-HEX (.hex), raw flash/ROM images (.bin/.img), and MCU dumps. Covers HEX→bin conversion with base-address recovery, CPU/arch identification, carving (binwalk), capstone disassembly with the right load base, and vector-table/entrypoint analysis. Use for .hex and raw firmware targets.
First-contact workflow for any unknown black-box artifact (apk, .o, .hex, exe, ELF, PE, Mach-O, firmware, archive). Identifies format/arch/packing and routes to the right format-specific analysis skill. Use this at the start of every reverse-engineering task on an unfamiliar file.
| name | analyzing-blackbox-pe-exe |
| description | Reconstruct the logic of Windows PE executables and DLLs (.exe/.dll). Covers import-address-table analysis, Windows API capability mapping, entrypoint/WinMain discovery, decompilation, unpacking (UPX), and solving input-gated checks. Use for Windows PE/exe/dll targets. |
| license | Apache-2.0 |
| metadata | {"domain":"reverse-engineering","formats":"pe, exe, dll"} |
PE32/PE32+ executables and DLLs. Analysis is performed on Linux with rizin/Ghidra (no Windows execution).
Triage for arch (x86/x86_64/arm64), pe_kind (exe/dll), and packing. A
high-entropy section list or UPX hint means unpack first:
unpack mode=upx (or mode=auto). Re-triage the unpacked file.
Import Address Table = capability map. symbols what=imports. Group the
Windows APIs to infer behavior:
WS2_32 (socket,connect,send), WinHTTP/WinINet
(InternetOpen,HttpSendRequest), URLDownloadToFile.CreateProcess, VirtualAlloc(Ex), WriteProcessMemory,
CreateRemoteThread, LoadLibrary, GetProcAddress.RegSetValue, CreateService, Schedule.CryptAcquireContext, BCrypt*, CryptEncrypt.IsDebuggerPresent, CheckRemoteDebuggerPresent, GetTickCount,
Sleep, NtQueryInformationProcess.
For DLLs, symbols what=exports lists the callable surface (and ordinals).Strings & resources. strings_scan for C2 URLs, registry paths, mutex
names, command lines, embedded scripts. PE resources/overlays can hide payloads —
unpack mode=binwalk to carve, then re-triage.
Entrypoint → logic. decompile mode=func name=entry (or the address from
triage). For GUI apps trace to WinMain; for services to ServiceMain. Then
decompile mode=list and decompile the API-heavy functions found in step 2.
Dynamic-import / API resolution. Watch for LoadLibrary+GetProcAddress
patterns (hidden imports) and stack-string / XOR-decoded API names — decompile
the resolver and recover names statically.
Input-gated logic. Key checks, activation, or C2 auth comparisons: get the
success/fail addresses from decompilation and run
symexec find=<success> avoid=<fail> input=stdin|arg. (angr loads PE too.)
Identity/arch/subsystem · packer & unpacking · IAT capability map · entrypoint & key functions · C2/registry/mutex strings · anti-analysis tricks · solved inputs · overall behavior summary.