Skill Claude CodeCodex
Pull indicators of compromise from a file or directory (URLs, IPs, domains, emails, md5/sha1/sha256 hashes, .onion, CVEs, BTC/ETH addresses, registry keys) — from text and from strings mined out of binaries. Every value is DEFANGED in output (hxxp://evil[.]com, 1[.]2[.]3[.]4) so a report can't ship a live IOC. Pure…
Skill Claude CodeCodex
Dump a decrypted iOS app binary (FairPlay 砸壳) from a jailbroken device via frida-ios-dump: attaches to the running app with Frida and writes the decrypted Mach-O from memory so it can be loaded into IDA/Ghidra/Hopper. BYO the frida-ios-dump toolchain + a jailbroken device with frida-server. Does NOT execute a sample…
Skill Claude CodeCodex
Build a bounded code property graph and focused data-flow or usage slice with pinned Joern. Use when reverse engineering or security analysis needs interprocedural source context beyond syntax trees. Static and offline; never executes target code.
Skill Claude CodeCodex
Detect covert/evasive tactics in JavaScript/TypeScript: Unicode steganography (invisible/zero-width/bidi chars, confusable-homoglyph punctuation and letters), XOR/char-code/escape string hiding, and environment-keyed conditional behavior (timezone/locale/geo/proxy). Emits judgment-free parallax atoms (XFRM.UNICODE /…
Skill Claude CodeCodex
Deobfuscate and unpack obfuscated JavaScript (webcrack): reverses string arrays, folds constants, deflattens control flow, unminifies, and splits webpack/browserify bundles. Encoded string arrays are decoded by running the decoder inside an isolated-vm sandbox — not the whole program.
Skill Claude CodeCodex
Recover the original, un-minified sources from a JavaScript source map's sourcesContent — turning a bundled/minified .js back into a readable file tree. Accepts a .map (JSON) or a .js that references one via //# sourceMappingURL (inline data: map or sibling .map). Pure stdlib, read-only; path-traversal guarded (strips…
Skill Claude CodeCodex
Statically decode constant-key XOR / charCode string obfuscation in JavaScript so a downstream scanner can read the hidden strings (C2 URLs, victim domains, timezone names, shell commands). Finds decode sites with regex/heuristics — a String.fromCharCode(x ^ KEY) / x ^ KEY applied over a STATIC encoded literal (int…
Skill Claude CodeCodex
Decompile Java / Android bytecode (.apk / .dex / .jar / .class) back to Java source with jadx. Static: reads bytecode, never runs it. Prereq-gated on the jadx CLI (which needs a JRE); when jadx is absent the skill reports the honest blind spot with an install hint.
Skill Claude CodeCodex
Static triage of Mach-O binaries (macOS/iOS executables, dylibs, bundles, kexts) with macholib: arch/fat slices, file type, PIE, linked dylibs, RPATH, code-signature presence, and encryption (LCENCRYPTIONINFO). Emits BINARY. atoms. Reads structure only — never runs the binary.
Skill Claude CodeCodex
CONSTRUCT: generate a deterministic, conservative no-runtime executable that exits with a chosen status: Linux ELF (x8664/i386), Windows PE (PE32+/PE32), or a static macOS arm64 Mach-O research artifact. Emits bytes, verifies its own header invariants, measures/hash-inspects the result, and labels proof honestly.…
Skill Claude CodeCodex
Decompile a native binary (ELF/PE/Mach-O) to C-like pseudocode with rizin's built-in Ghidra decompiler (pdg over all functions). Static: analyses and decompiles, never runs the target. Prereq-gated on rizin/r2; honest blind spot with an install hint when absent. Pair with elf/pe/macho-analyze.
Skill Claude CodeCodex
Disassemble PE, ELF, or Mach-O binaries to function-oriented assembly without executing them. Automatically uses llvm-objdump/objdump, then falls back to Rizin/radare2 analysis for stripped binaries. Writes the complete listing to disassembly.txt and reports instruction/function-line counts.
Skill Claude CodeCodex
Lift a bounded raw x86, amd64, or aarch64 machine-code region into LLVM IR or bitcode with pinned Remill. Use for semantic analysis of an isolated function, shellcode, or decoder stub. Static and offline: never executes the bytes; rejects whole executable containers.
Skill Claude CodeCodex
DYNAMIC: capture a target's network traffic to a pcap while it runs (tcpdump), then summarize packets, talking-to IPs, and DNS queries. Point --iface at a sinkholed interface for safer detonation. EXECUTES the target and captures on an interface (usually needs root); consent-gated.
Skill Claude CodeCodex
Resolve Windows DLL ordinal imports to exported symbol names from a vendored static database (ws232/wsock32, oleaut32). Stripped or by-ordinal imports become readable. Pure static lookup — reads no input file, runs no target.
Skill Claude CodeCodex
Static triage of Windows PE binaries (EXE/DLL) with pefile: machine/arch, subsystem, entry/imagebase, sections + per-section entropy (packing) and RWX flags, imports classified by capability (inject/exec/network/anti-debug/persist/crypto), exports, TLS callbacks, overlay, and Authenticode presence. Emits BINARY.…
Skill Claude CodeCodex
Convert between PE file alignments via hasherezade's peunmapper (libpeconv): UNMAP a memory dump back to raw-file alignment, MAP raw→virtual, or REALIGN. Essential for finishing a memory dump into a loadable EXE. Windows-only vendored binary. Static: reads bytes, writes a converted file, runs no target.
Skill Claude CodeCodex
Statically survey source trees for anti-analysis and protection patterns across C/C++, Objective-C, assembly, Rust, Go, Python, JavaScript/TypeScript, Java/Kotlin, C#, and Swift. Finds anti-debug/VM checks, runtime API resolution, executable-memory changes, early execution, custom sections, inline assembly…
Skill Claude CodeCodex
Detect covert/evasive tactics in Python: hidden code execution (exec/eval/compile of base64/hex/zlib/marshal output, pickle deserialization, dynamic import, chr()/\x string building), environment-keyed evasion (platform/VM/sandbox/analyst detection, timezone/locale, debugger/tracer checks), and Unicode steganography.…
Skill Claude CodeCodex
Decompile Python bytecode (.pyc / compiled code objects) back to source with decompyle3. Best for CPython 3.7-3.8 bytecode (e.g. PyInstaller-extracted payloads); reports honestly when the bytecode version is out of range. Static: reads bytecode, never runs it.
Skill Claude CodeCodex
Carve the Python out of a PyInstaller executable: locate the appended CArchive, extract every entry, and unpack the inner PYZ into individual .pyc files with reconstructed headers — ready for pyc-decompile. Pure stdlib. Static: parses archive structures and marshal.loads the PYZ TOC (deserialization, not execution)…
Skill Claude CodeCodex
Dump, realign, and rebuild Import Address Tables of Windows PE binaries through Rekit's Python adapter for the external libscylla engine. Supports process enumeration, live dump, IAT search/parse/fix, XML tree round-trip, and reference scanning. Windows-only; bring your own arch-matched libscylla DLL and comply with…
Skill Claude CodeCodex
Emulate a FULL binary (PE/ELF/Mach-O/…) with the Qiling framework: loads the program and emulates the OS/syscalls against a BYO rootfs, so a Linux ELF or Windows PE can be detonated on this host cross-arch/cross-OS WITHOUT native execution or a VM. Contained: syscalls hit Qiling's emulation, not the host kernel.…
Skill Claude CodeCodex
Cross-format static recon of a native binary with radare2: drives r2 headless (-q -c, JSON commands) in one session for binary info, sections + per-section entropy, imports, exports, entry points, analysed functions, and decoded strings (incl. UTF-16). r2 auto-detects ELF/PE/Mach-O/DEX/..., so one skill covers them…