Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-anti-cheatgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-anti-cheat)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-anti-cheat"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-anti-cheat/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-anti-cheat"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-anti-cheat.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.03424 |
| Opus 5 | $0.00028 | $0.01712 |
| Sonnet 5 | $0.00011 | $0.00685 |
| Haiku 4.5 | $0.00006 | $0.00342 |
Grade A, and why
re-anti-cheat scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
反作弊对抗分析（EAC / BattlEye / 内存校验）
何时使用 / 何时不用
- 用：分析反作弊组件（EAC / BattlEye / Vanguard 等）的驱动与服务、检测机制如何工作
- 用：游戏进程被反作弊拒绝/踢出后，理解"检测到了什么"（防御与研读视角）
- 用：反作弊驱动的静态逆向（DriverEntry、IRP、内存校验逻辑）与内核调试观察
- 不用：制作或分发作弊程序 / 在真实游戏环境实施绕过（明确禁止，见授权边界）
- 不用：只是游戏自身逻辑（内存修改、CE）→ [[re-game]]
- 不用：普通驱动分析（[[re-kernel]]）；用户态反调试（[[re-evasion]]）
- 授权边界（必读）：本技能仅限授权研究——自有设备、自有游戏账号、实验室环境、已获书面许可的安全研究。禁止：制作/分发作弊软件、在在线游戏中使用绕过手段获取不当优势、将检测机制分析用于破坏。所有动态实验在隔离沙箱（[[platform-tips]] 最高原则）内进行；分析结论以防御与研究视角产出（理解检测面 → 改进检测），不产出可操作的绕过工具。
工具准备
反作弊分析=驱动逆向 + 内核调试，全程隔离沙箱（[[platform-tips]] 最高原则）。所有工具先验证再使用。
驱动分析底座（[[re-kernel]]）
- 驱动静态：DriverEntry / IRP 分派 / 回调还原方法见 [[re-kernel]]「操作步骤」
- 反编译：[[re-ghidra]]（默认，导入 .sys 后 Data Type Manager 载入内核类型）
- 验证: 导入 EAC/BE 驱动 .sys 后 DriverEntry 能反编译
内核调试（[[re-windbg]]）
- 双机/VM 串口（COM Named Pipe）或 KDNET 配置见 [[re-windbg]]「工具准备」
- 内核调试是分析反作弊驱动的唯一动态手段（用户态 attach 被驱动拒绝，见坑 1）
- 验证: 内核会话
lm能看到目标反作弊驱动模块，.reload /f <驱动名>加载符号
用户态快速定位（[[re-x64dbg]] / [[re-windbg]]）
- [[re-x64dbg]]：受保护进程之外的辅助组件（加载器、服务端）快速查看
- 受保护进程（PPL）直接 attach 不可行——理解 PPL 保护是环境认知的一部分（见坑 1）
- 验证:
x64dbg能打开普通目标 exe
系统工具（服务/驱动枚举）
- Windows 内置：
sc query/driverquery/fltmc（文件系统过滤驱动列表） - Sysinternals（微软官网）: Process Explorer（
process explorer查看受保护进程标记）、Sysmon - 验证:
driverquery输出驱动列表；sc query EasyAntiCheat（EAC 服务名按版本变化）
操作步骤
按顺序执行，每步产物（组件清单、IRP 表、校验逻辑笔记）记录证据路径 + sha256（见 [[re-triage]]），供报告引用。所有步骤在授权范围与沙箱内进行（授权边界见「何时使用」）。
-
反作弊组件识别（驱动 / 服务）：
driverquery /v | findstr /i "anti cheat easy battle" # 驱动层组件 sc query | findstr /i "anti cheat easy battle vanguard" # 服务层组件 fltmc # 文件系统过滤驱动（完整性校验常在此）- 典型组件：EAC（EasyAntiCheat.sys + 用户态加载器）、BE（BEDaisy.sys + 用户态服务）、Vanguard（vgk.sys 驱动 + 常驻服务）；各厂商还有更新服务/反篡改守护
- 记录：组件清单（驱动名/服务名/安装路径）+ 驱动文件 sha256（版本锚点，见坑 3）+ 自保护状态（PPL 等）
-
驱动校验分析（内存扫描 / 完整性）：
- 静态还原（[[re-kernel]] 方法）：DriverEntry → IRP 分发表（
IRP_MJ_DEVICE_CONTROL等）→ 用户态 IOCTL 交互界面；重点找：- 完整性校验：定时/触发式校验游戏进程代码段与数据段哈希（
MmCopyVirtualMemory/KeStackAttachProcess类读取目标进程内存后计算） - 内存扫描：按特征扫描游戏进程内存（寻找修改后的代码/注入模块）
- 回调注册：
PsSetCreateProcessNotifyRoutine（监控进程创建）、PsSetLoadImageNotifyRoutine（监控模块加载）——校验逻辑的触发入口
- 完整性校验：定时/触发式校验游戏进程代码段与数据段哈希（
- 用户态组件：加载器与服务（[[re-binary-core]] 反编译）——心跳、报告通道、更新检查
- 产物：检测机制清单（触发点 → 校验内容 → 处置动作）
- 静态还原（[[re-kernel]] 方法）：DriverEntry → IRP 分发表（
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 105 lines · 56 tokens per session scan A 9f64388eecda
re-anti-cheat is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 56 tokens to every session and 3,424 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
minecraft-async
Manage a preinstalled local Minecraft Java client asynchronously for CTF and automation workflows. Use when an agent needs to launch Minecraft in offline mode with alternate usernames, inspect Minecraft logs, focus or type into the X11 game window, send chat or slash commands quickly, or join a multiplayer server by…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.