Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-address-spacegit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-address-space)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-address-space"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-address-space/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-address-space"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-address-space.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.01960 |
| Opus 5 | $0.00048 | $0.00980 |
| Sonnet 5 | $0.00019 | $0.00392 |
| Haiku 4.5 | $0.00010 | $0.00196 |
Grade A, and why
re-address-space scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
地址空间换算（PIE / ASLR / 基址 / RVA-VA）
入口判定（Decision Gate）
地址相关问题
├── 静态文件（无运行态）: VA/RVA/文件偏移换算 ──→ 本技能（步骤 1-2）
├── 运行态（进程/内存）: 基址确定（PIE/ASLR）──→ 本技能（步骤 3）+ /proc/pid/maps
├── 跨工具对齐（Ghidra 显示 vs 运行时 vs angr）──→ 本技能（步骤 4）
└── 固件加载地址 vs 链接地址差 ──→ 本技能（步骤 5）
何时使用 / 何时不用
- 用：任何「这个地址对不上」问题——反编译器显示地址 ≠ 运行时地址 ≠ find 到的地址
- 用：PIE/ASLR 二进制需要换算运行时基址（frida
Module.base/ gdbinfo proc mappings/ maps 文件） - 用：RVA/VA 互转、文件偏移与虚拟地址互转、固件加载地址与链接地址差
- 不用：只是读 ELF 头/节表（走 [[re-format-elf]]）
- 不用：运行时内存布局细查（走 [[re-memdump]] / [[re-gdb]]）
工具准备
所有工具先验证再使用。全部为静态/轻量命令，可免沙箱。
readelf / objdump（binutils）—— 文件侧基址与段信息
- Linux:
apt install binutils/dnf install binutils/pacman -S binutils（多数预装） - 验证:
readelf --version；objdump --version
gdb —— 运行态基址（跨 OS，见 [[re-gdb]]）
- 安装与验证见 [[re-gdb]] 工具准备
python3 —— 换算脚本
- 安装与验证见 [[re-python]] 工具准备
操作步骤
-
确定文件侧基址（静态）：
readelf -l target | grep LOAD # 首个 LOAD 段 p_vaddr 即链接基址（ET_EXEC 固定；ET_DYN/PIE 为 0 起相对） readelf -h target | grep Type # EXEC（固定基址）/ DYN（PIE，运行时才定基址）- 链接基址（link-time base）：非 PIE = p_vaddr 首个 LOAD；PIE = 0（所有地址是相对偏移）
- 文件偏移 ↔ VA：
VA = p_vaddr + (file_offset - p_offset)（按段匹配，别用全文件线性换算）
-
RVA / VA 换算：
RVA = VA - ImageBase（PE 语境） VA = RVA + ImageBase- ELF 无统一 ImageBase 概念——用「链接基址 + 段偏移」；PE 用节表（RVA → 文件偏移按节）
- 32/64 位宽度影响地址表示，不影响换算逻辑
-
运行态基址（PIE / ASLR）：
cat /proc/<pid>/maps | head -5 # 加载基址 = 首个映射（r--p，file offset 0x0）起点（Linux） gdb -p <pid> -ex 'info proc mappings' -ex detach # 或 gdb 侧（跨平台）- 布局差异（separate-code）：gcc 默认 PIE 下首个 LOAD 是 R-- 段（p_vaddr=0），代码段在其后（p_vaddr=0x1000 起）；老式布局（无 separate-code）首个 LOAD 即 R E（p_vaddr=0）——取加载基址用首个映射（r--p）起点；若用首个 r-xp 起点须减去该段自身 p_vaddr，两种布局结果才一致
- frida：
Module.findBaseAddress("libtarget.so")或Process.getModuleByName(...).base - 运行时地址 = 链接地址 + load bias——bias = 运行时基址 - 链接基址；PIE 每次运行 bias 不同（ASLR），脚本必须动态取
- 换算：
runtime_addr = link_addr + bias（如链接 0x1000 的符号在运行时0x1000 + 0x7f0000000000）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 101 lines · 97 tokens per session scan A 783d10fe54e3
re-address-space is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 97 tokens to every session and 1,960 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.