Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-angrgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-angr)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-angr"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-angr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-angr"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-angr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.05050 |
| Opus 5.5 | $0.00014 | $0.02020 |
| Sonnet 5.5 | $0.00007 | $0.01010 |
| Haiku 4.5 | $0.00004 | $0.00505 |
Grade A, and why
re-angr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
angr 符号执行（符号化输入 / 自动求解）
何时使用 / 何时不用
- 用：CTF 逆向题——输入在长循环 / 深比较链里逐字节校验（校验通过地址已知或可定位），人工逆推繁琐易错
- 用：已知"输入必须到达某地址 / 避开某地址"，想把路径条件交给求解器（find / avoid 模式）
- 用：输入来源复杂（argv / 文件 / 标准输入），需要按通道符号化后求解
- 不用：简单 XOR / 明文比较（一屏伪代码内）——人工更快（[[re-binary-core]]）
- 不用：校验含不可符号化内容（环境相关值、随机数、未符号化输入）——会无解或误解（见坑 3）
- 不用：需要精确约束集合而非一条路径时——纯约束求解用 [[re-z3]] 更轻（见坑 2）
- 注意：符号执行是把双刃剑——先人工定位关键校验函数缩小符号化范围（见坑 2）；运行验证走沙箱（[[re-analyze/platform-tips]] 最高原则）
工具准备
参考 [[re-analyze/platform-tips]] 最高原则——用求解结果运行目标验证时默认沙箱；angr 本身是进程内仿真器，不接触真实系统调用，求解过程无需沙箱。
angr（pip 安装）
pip install angr（Linux / macOS / Windows 均可；Windows 下 pip 装 win32 wheel，WSL 内安装 Linux 版亦可）- Python 版本兼容性（重点）：angr 9.3.0 起要求 Python 3.12+（
requires-python >=3.12；当前主线 10.x 同）；9.2.x 不是固定区间——下限随补丁版本抬高（9.2.91 要求 ≥3.8，9.2.203 已要求 ≥3.10），不能按「9.2.x」整线判断。装前以目标版本的 PyPIrequires-python为准（pip index versions angr看可用版本），再按系统 Python 选：- 系统自带 Python 3.12+（Ubuntu 24.04 默认 3.12）→ 直接
pip install angr（当前主线 10.x；Python >=3.12） - 系统为 Python 3.11 及以下 →
pip install "angr<9.3"（9.2.x 线），别硬装 9.3+ - 多版本并存用 venv 隔离：
python3.12 -m venv ~/venvs/angr && source ~/venvs/angr/bin/activate（或brew install [email protected]/py -3.12 -m venv angr-venv）
- 系统自带 Python 3.12+（Ubuntu 24.04 默认 3.12）→ 直接
- 装前先升级基础工具：
pip install --upgrade pip setuptools wheel（避免原生组件编译失败） - Linux 建议补
binutils（angr 处理 / 重写二进制会调 objcopy）：apt install binutils - 验证:
python3 -c "import angr; print(angr.__version__)"
python3
- Linux:
apt install python3（多数自带）；macOS:brew install python；Windows: 官方安装包 /choco install python - 验证:
python3 --version
目标二进制
- 原始样本副本（先备份：符号执行不修改文件，但建模要反复对照，见坑 5）+ [[re-triage]] 初勘产物（架构 / 位数 / 是否静态链接 / 是否带壳）
- 验证:
file target确认架构与位数（arm 目标 angr 支持，注意字节序）
操作步骤
按顺序执行，每步记录结果（地址 / 约束 / 求解脚本 / flag，证据路径见 [[re-triage]]）。先人工后自动化：符号化范围越小越稳（见坑 2）。
- 输入适配（Input Adapter）：确定符号源（symbol source）：
- 反编译定位输入读取点：
read/scanf/fgets/getline/main(int argc, char **argv)的 argv 使用处（[[re-ghidra]] / [[re-ida]] / [[re-radare2]]） - 按符号源类型选择接入方式（CTF 的 stdin 只是其中一种——真实目标输入可能是网络包/文件映射/JNI 参数/自定义字节码）：
- 反编译定位输入读取点：
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed 1b0822f308f9
- 1mo ago Changed 3a72a6d1e9ca
- 1mo ago Changed · +1 lines 9068a021d9b4
- 2mo ago First seen · 133 lines · 36 tokens per session scan A 036b48e9d82a
re-angr is a skill published in the GitHub repository dslsdzc/rev-skills (214 stars, last pushed 21d ago), licensed Apache-2.0. It adds 36 tokens to every session and 5,050 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.