菜单
First-contact workflow for any unknown black-box artifact (apk, .o, .hex, exe, ELF, PE, Mach-O, firmware, archive). Identifies format/arch/packing and routes to the right format-specific analysis skill. Use this at the start of every reverse-engineering task on an unfamiliar file.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Reconstruct the logic of Android apps from an .apk (or .dex/.jar). Covers manifest/entrypoint analysis, jadx Java decompilation, smali inspection, native .so analysis, and finding network endpoints, secrets, and obfuscated logic. Use for Android apk/dex targets.
Reconstruct the logic of Linux/Unix ELF executables, shared objects, and relocatable object files (.o), plus Mach-O. Covers entrypoint discovery, import/syscall mapping, function decompilation, and solving input-gated branches. Use for ELF/.o/.so/Mach-O targets.
Reconstruct logic from embedded firmware — Intel-HEX (.hex), raw flash/ROM images (.bin/.img), and MCU dumps. Covers HEX→bin conversion with base-address recovery, CPU/arch identification, carving (binwalk), capstone disassembly with the right load base, and vector-table/entrypoint analysis. Use for .hex and raw firmware targets.
Reconstruct the logic of Windows PE executables and DLLs (.exe/.dll). Covers import-address-table analysis, Windows API capability mapping, entrypoint/WinMain discovery, decompilation, unpacking (UPX), and solving input-gated checks. Use for Windows PE/exe/dll targets.
| name | triaging-unknown-binary |
| description | First-contact workflow for any unknown black-box artifact (apk, .o, .hex, exe, ELF, PE, Mach-O, firmware, archive). Identifies format/arch/packing and routes to the right format-specific analysis skill. Use this at the start of every reverse-engineering task on an unfamiliar file. |
| license | Apache-2.0 |
| metadata | {"domain":"reverse-engineering","formats":"apk, elf, pe, macho, dex, ihex, firmware, archive"} |
Before any deep analysis you must know what you are holding. This skill is the entry router: identify the artifact, then hand off to the matching skill.
Identify. Run the triage tool on the target. It returns format, arch,
endianness, bits, entropy/packing, linked libraries, and a recommended plan.
UPX/packer hint → unpack first (see step 3).Route by format:
| format | go to skill |
|---|---|
elf, object, macho | analyzing-blackbox-elf-object |
pe | analyzing-blackbox-pe-exe |
apk, dex, jar | analyzing-blackbox-android-apk |
ihex, rawfw | analyzing-blackbox-firmware-hex |
zip/archive | unpack (archive) then re-triage each payload |
unknown | strings_scan + unpack (binwalk) to find embedded data |
Unpack when needed. Packed/compressed/container files: use the unpack
tool (mode auto). Then re-run triage on the extracted payload — the real
target is usually inside.
Cheap signal before deep work. Run strings_scan and symbols early — URLs,
crypto constants, imported APIs, and exported names often reveal the program's
purpose before you disassemble a single function.
triage → unpack (if needed) → symbols + strings_scan → pick interesting
functions → disasm / decompile them → for input-gated branches (license,
password, opaque predicate) use symexec to solve for the input → write the
logic report (identity, entrypoints, key functions, data, external I/O,
findings).
symexec reasons over code paths without
running the host program.triage tool's recommended_plan field names the next skill to load.