Skill Claude CodeCodex
CONSTRUCT: assemble asm text (a file or --code) into machine-code bytes with the LLVM/clang integrated assembler — x64/x86/arm64/arm — emitted as hex, a C array, a raw blob, or JSON. Backed by clang (no fragile native python binding), so it works cross-arch anywhere clang does. The write-side partner of emulate-code…
Skill Claude CodeCodex
Find fixed-stride record tables compiled into a binary (song lists, level tables, item stats), infer each column's type from the data, extract them to JSON/CSV, and diff two builds record by record. Use when content lives in static tables rather than data files and a function-level diff would miss it entirely — added…
Skill Claude CodeCodex
Fast format-agnostic first look at any file, pure-stdlib: identify format from magic bytes (and route to the right analyzer), chunked Shannon entropy (packed/encrypted regions), string extraction with interesting-string surfacing (URLs/IPs/onion/shell/paths/exec-APIs), and an embedded-signature scan (mini-binwalk…
Skill Claude CodeCodex
Match functions across two builds of a binary with Google BinDiff: per-function similarity and confidence, renamed or moved functions, and functions added or removed. Use for patch diffing (what did this update actually change?), porting symbols from a named build onto a stripped one, malware variant comparison, and…
Skill Claude CodeCodex
Carve and recursively extract embedded files from a firmware image or blob (filesystems, bootloaders, nested archives) with binwalk. The heavy sibling of bin-triage's embedded-signature preview. Prereq-gated on binwalk; honest blind spot with an install hint when absent.
Skill Claude CodeCodex
CONSTRUCT: compile C/C++/ObjC source into a native artifact (exe / .o / .s / LLVM IR) with clang (falls back to cc/gcc). For building PoCs, test harnesses, stubs, and shared libs rekit needs. Cross-compiles via --target/--arch. Compiles only — does NOT run the result (feed the output to exec-observe/emulate-code…
Skill Claude CodeCodex
Dump decrypted DEX and CompactDex images from a RUNNING Android app's memory with Rekit's clean-room Apache-2.0 device tool (ptrace on a rooted aarch64 device). Defeats class-loading packers by reading the image after the app decrypts it. Does not launch the app or execute a sample on the host. BYO rooted device +…
Skill Claude CodeCodex
Match functions between two builds of a program with Diaphora, recover symbol names from a build that has them onto stripped builds, and emit per-function pseudocode diffs documenting what changed. Use for version lineage archaeology, renaming stripped binaries from an unstripped sibling, and reconstructing…
Skill Claude CodeCodex
Read-only forensic inventory of raw disk images and large media blobs: hash a selected byte range, parse MBR/GPT partition maps, validate ext/NTFS/FAT/ISO filesystem candidates, and locate archive and evidence signatures with absolute byte and LBA offsets. Use before carving or filesystem recovery to map…
Skill Claude CodeCodex
Static triage of .NET / CLR managed assemblies (.dll/.exe) with dnfile: runtime version, assembly + referenced assemblies, type/method counts, IL-only vs mixed-mode, strong-name signing, unmanaged module refs, and the P/Invoke (DllImport) native-API surface classified by capability. Emits DOTNET. atoms. Parses CLR…
Skill Claude CodeCodex
Decompile a .NET / CLR assembly (IL) back to C# with the ilspycmd dotnet tool. Static: reads metadata + IL, never runs the assembly. Prereq-gated on ilspycmd (needs the .NET runtime); honest blind spot with an install hint when absent. Pair with dotnet-analyze for the P/Invoke surface.
Skill Claude CodeCodex
Static triage of ELF binaries (Linux/BSD) with pyelftools: class/arch/type, sections + per-section entropy (packing), needed libraries, RPATH/RUNPATH, imported symbols classified by capability (network/exec/inject/load/crypto), and hardening (PIE/NX/RELRO). Emits BINARY. atoms. Reads structure only — never runs the…
Skill Claude CodeCodex
Emulate a raw code/shellcode blob on a virtual CPU (x86/x64/arm/arm64) with Unicorn and report the final register state, instruction count, and memory writes. Contained: the bytes run on an emulated CPU, not the host (memory-only; no host syscalls unless wired) — the safe way to 'run' shellcode or an isolated function.
Skill Claude CodeCodex
Create and operate persistent Unicorn or Qiling emulation sessions across separate agent, CLI, or MCP calls. Use for iterative reverse engineering that requires stepping, register or memory changes, address/syscall/API hooks, traces, branch snapshots, or repeated inspection without restarting the emulated target.…
Skill Claude CodeCodex
DYNAMIC: run a target in a fresh working directory with a timeout and capture its behavior — exit code, stdout/stderr, wall-clock time, and files it creates. EXECUTES the target; use the tracer skills for syscall, API, or network visibility. Run only where you accept the target's risk.
Skill Claude CodeCodex
Recover allocated, deleted, or all files from an ext, NTFS, FAT, or other Sleuth Kit-supported filesystem at an explicit image sector offset. Use after disk-image-scan validates a filesystem start. Runs tskrecover without mounting the source, emits an fls metadata-address/MFT record-to-name map, safely renames…
Skill Claude CodeCodex
Recover structurally complete classic ZIP and RAR4 archives from raw disk images or media blobs, preserving absolute byte offsets, SHA-256 identities, validation method, and duplicate relationships in a JSONL manifest. Use after disk-image-scan or for direct archive carving from unallocated space. Pure Python; reads…
Skill Claude CodeCodex
DYNAMIC: inspect an authorized Android app's Java runtime through Frida: list loaded classes, enumerate method signatures, or install observation-only hooks that report arguments and return values without intentionally changing them. Use for runtime discovery when static APK/DEX analysis is insufficient. Attaches to…
Skill Claude CodeCodex
DYNAMIC: spawn an authorized target under Frida and trace selected exported APIs using signatures parsed from a user-supplied API Monitor XML tree. Reports typed argument names, safe string previews, return values, hook coverage, and bounded events. The proprietary definition corpus is never shipped and stays…
Skill Claude CodeCodex
DYNAMIC: spawn a target under Frida and trace a curated set of network/exec/file/crypto API calls (dynamic instrumentation, no debugger). Logs the calls the sample makes. EXECUTES the target; consent-gated. BYO frida-trace (pip install frida-tools).
Skill Claude CodeCodex
Decompile a native binary (ELF/PE/Mach-O) with full Ghidra headless analysis — higher fidelity than native-decompile (rizin pdg) for hard targets. Runs analyzeHeadless with a bundled Ghidra script that decompiles every function to one C file. Static: analyses + decompiles, never runs the binary. Prereq-gated on…
Skill Claude CodeCodex
Drive git through plain verbs — clone, status, commit, branch, switch, stash, push, pull, remote-add, merge, cherry-pick, tag, worktree-add/list/remove, undo, discard, reset-hard — for harnesses or smaller models that can't or shouldn't hand-write git commands, refspecs, or worktree plumbing. Every op runs git…
Skill Claude CodeCodex
Non-interactive hex dump of a file or byte range (offset + hex + ASCII), with total size and sha256. Pure-Python stdlib, no dependencies. Reads bytes only — never executes the input.
Skill Claude CodeCodex
Compare files exactly or with deliberate text normalization, compare directory trees, find duplicate files, calculate SHA-256 and CRC32 identities, and read bounded line ranges. Use for change analysis, duplicate/orphan discovery, checksum verification, or focused source inspection. Pure-stdlib and read-only; never…