Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-angrgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-angr)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-angr"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-angr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-angr"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-angr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.04908 |
| Opus 5 | $0.00018 | $0.02454 |
| Sonnet 5 | $0.00007 | $0.00982 |
| Haiku 4.5 | $0.00004 | $0.00491 |
Grade A, and why
re-angr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
angr 符号执行（符号化输入 / 自动求解）
何时使用 / 何时不用
- 用：CTF 逆向题——输入在长循环 / 深比较链里逐字节校验（校验通过地址已知或可定位），人工逆推繁琐易错
- 用：已知"输入必须到达某地址 / 避开某地址"，想把路径条件交给求解器（find / avoid 模式）
- 用：输入来源复杂（argv / 文件 / 标准输入），需要按通道符号化后求解
- 不用：简单 XOR / 明文比较（一屏伪代码内）——人工更快（[[re-binary-core]]）
- 不用：校验含不可符号化内容（环境相关值、随机数、未符号化输入）——会无解或误解（见坑 3）
- 不用：需要精确约束集合而非一条路径时——纯约束求解用 [[re-z3]] 更轻（见坑 2）
- 注意：符号执行是把双刃剑——先人工定位关键校验函数缩小符号化范围（见坑 2）；运行验证走沙箱（[[platform-tips]] 最高原则）
工具准备
参考 [[platform-tips]] 最高原则——用求解结果运行目标验证时默认沙箱；angr 本身是进程内仿真器，不接触真实系统调用，求解过程无需沙箱。
angr（pip 安装）
pip install angr（Linux / macOS / Windows 均可；Windows 下 pip 装 win32 wheel，WSL 内安装 Linux 版亦可）- Python 版本兼容性（重点）：按 angr 主版本对号入座（以 PyPI 元数据为准）——angr 9.2.x 支持 Python 3.8–3.11；angr 9.3.0 起要求 Python 3.12+（
requires-python >=3.12）。装前先pip index versions angr（或查 PyPI）确认当前主版本，再按系统 Python 选：- 系统自带 Python 3.12+（Ubuntu 24.04 默认 3.12）→ 直接
pip install angr（最新 9.3.x 线） - 系统为 Python 3.11 及以下 →
pip install "angr<9.3"（9.2.x 线），别硬装 9.3+ - 多版本并存用 venv 隔离：
python3.12 -m venv ~/venvs/angr && source ~/venvs/angr/bin/activate（或brew install [email protected]/py -3.12 -m venv angr-venv）
- 系统自带 Python 3.12+（Ubuntu 24.04 默认 3.12）→ 直接
- 装前先升级基础工具：
pip install --upgrade pip setuptools wheel（避免原生组件编译失败） - Linux 建议补
binutils（angr 处理 / 重写二进制会调 objcopy）：apt install binutils - 验证:
python3 -c "import angr; print(angr.__version__)"
python3
- Linux:
apt install python3（多数自带）；macOS:brew install python；Windows: 官方安装包 /choco install python - 验证:
python3 --version
目标二进制
- 原始样本副本（先备份：符号执行不修改文件，但建模要反复对照，见坑 5）+ [[re-triage]] 初勘产物（架构 / 位数 / 是否静态链接 / 是否带壳）
- 验证:
file target确认架构与位数（arm 目标 angr 支持，注意字节序）
操作步骤
按顺序执行，每步记录结果（地址 / 约束 / 求解脚本 / flag，证据路径见 [[re-triage]]）。先人工后自动化：符号化范围越小越稳（见坑 2）。
- 输入适配（Input Adapter）：确定符号源（symbol source）：
-
反编译定位输入读取点：
read/scanf/fgets/getline/main(int argc, char **argv)的 argv 使用处（[[re-ghidra]] / [[re-ida]] / [[re-radare2]]） -
按符号源类型选择接入方式（CTF 的 stdin 只是其中一种——真实目标输入可能是网络包/文件映射/JNI 参数/自定义字节码）：
符号源 接入方式 stdin（标准输入） project.factory.full_init_state(stdin=claripy.BVS('in', 32*8))argv（命令行参数） project.factory.full_init_state(args=["./target", claripy.BVS("arg1", 64*8)])file（文件输入） state.fs.insert('/tmp/in', angr.SimFile('in', content=claripy.BVS('in', 32*8)))——fopen 后即符号化；按 fd 操作用state.posix.fd[0]（fd 0=stdin；fd 1/2 是 stdout/stderr，勿混）memory（mmap/堆/全局缓冲区） 直接符号化目标内存区： state.memory.store(addr, claripy.BVS('buf', n*8))——程序从该地址读入即符号化（mmap 文件、解密缓冲、共享内存通用）network buffer（网络包/recv） hook recv/read使缓冲符号化：state.memory.store(buf_addr, BVS('pkt', len*8))或 hook 返回符号指针——网络解析器目标通用jni argument（Android native 入参） 对 JNIEnv方法参数做符号化：从GetByteArrayElements/GetStringUTFChars返回处符号化（配合 [[re-android-native]]/[[re-frida]] 确认入参形态）custom VM bytecode（自定义 VM 指令流） 把字节码缓冲区整体符号化 + 约束操作码范围（0x00-0x0F 类）——VM 逆向的符号执行路径（[[re-deobfuscate]] 联动）
-
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 133 lines · 36 tokens per session scan A 036b48e9d82a
re-angr is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 36 tokens to every session and 4,908 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.