Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dslsdzc/rev-skills/re-binary-corenpx skills add dslsdzc/rev-skills --skill re-binary-coregit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-binary-core)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-binary-core"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-binary-core.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00269 | $0.04086 |
| Opus 5 | $0.00134 | $0.02043 |
| Sonnet 5 | $0.00054 | $0.00817 |
| Haiku 4.5 | $0.00027 | $0.00409 |
Grade A, and why
re-binary-core scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
软件逆向核心
完整工作流
- 环境：探测 + 偏好（若未走 [[re-analyze]] 入口，先补做，读取
RE_*会话变量） - 初勘：[[re-triage]] —— file/hash/熵/strings，确认文件类型与架构
- 格式解析：按类型走 [[re-format-pe]] / [[re-format-elf]] / [[re-format-macho]]
- 导入导出：[[re-imports]] —— 库指纹、IAT/符号，识别链接了什么
- 反编译：按
RE_DECOMPILER走 [[re-ghidra]] / [[re-ida]] / [[re-radare2]]（未装 → 按对应技能「工具准备」安装；默认推荐 Ghidra） - 动态（按需，默认沙箱）：[[re-gdb]] / [[re-x64dbg]] / [[re-lldb]]（按 OS）+ [[re-tracing]] + [[re-memdump]]
- 产出：结论 / 报告（按
RE_REPORT）
分析方法论
本网关适用的通用分析方法论（用户实战经验），各技能坑与陷阱引用此处。
入口分析
- R1 入口点≠main：EP 是初始化入口，经 CRT/TLS/loader 才到 main
- R2 字符串交叉引用优先于函数猜测：关键字符串→XREF 回溯
- R3 没有字符串≠没有逻辑：编码/哈希/运行时拼接/解密生成，追踪使用点
- R4 函数边界异常→检查反编译假象：手写汇编/混淆/尾调用/无 frame pointer，不完全相信 decompiler
调用分析
- R5 call 很少≠逻辑简单：函数指针/虚表/回调/切换跳表间接调用
- R6 间接调用异常→查函数指针来源：追踪寄存器/内存中目标地址来源
- R7 虚函数分析→先找 vtable：对象指针→vptr→vtable→函数集合
内存与数据结构
- R8 结构体识别不要只看字段访问：结合初始化位置/生命周期/多处使用
- R9 malloc/free 跟踪对象生命周期：创建点和释放点定含义
- R10 全局变量先找引用不找定义：全局区噪声高
API/行为
- R11 API 调用只是结果不是逻辑：分析参数来源和调用上下文
- R12 异常处理可能是控制流：SEH/C++ exception/signal handler 承担正常跳转
- R13 系统调用层比 API 更可信：hook/封装/替换时向下追到 syscall
混淆分析
- R14 控制流平坦化→看状态变量：调度器+状态变量+情况块
- R15 垃圾代码比例高→不逐条分析：找外部影响/数据流/真实调用
- R16 opaque predicate→验证条件是否恒定：永真/永假判断
动态调试
- R17 断点失效→不一定没执行：自修改代码/内存重映射/异常机制/反调试绕过
- R18 单步异常→查反调试：陷阱旗/时间检测/异常处理
- R19 看见解密数据→立刻保存：下一阶段可能清除
PE/ELF 深层
- R20 内存布局比文件布局重要：loader 后的映射状态才是运行时真相
- R21 section 名称不可信：看权限/熵/内容
- R22 重定位信息影响 dump：地址不一致时先查 relocation
情报与初勘
- R23 三表先行：file（格式）→ 分区熵（代码/数据/密文分布）→ strings（宽窄字符都要扫，壳会转宽字符串）——任何深挖之前这三步做完，避免 80% 的方向性错误
- R24 熵要分区采样：整体 4KB 熵 7.9 ≠ 全部密文——入口区 64B 熵 5.6 可能是真代码；用 64B/1KB 窗口扫描找明文/密文边界；高熵≠加密：可能是压缩、VMProtect 变异、或数据，判断加密前先排除压缩与混淆
- R25 导入表两面性：(a) 导入表极小（几个函数）= 壳/动态解析信号；(b) 死导入：IAT 有桩但 .text 零调用点 = LoadLibrary+GetProcAddress 动态加载，静态导入结论作废（c) 导入表数字≠API 面：COM 接口（d3d11 等）1 个导入背后几百个 vtable 方法，真实调用面永远在导入表之外
- R26 构建路径/日志函数名是最强情报：
G:\BuildAgent\...\Graphics_Renderer_D3D11.cpp泄露整个渲染器架构；Renderer::CreateAdapter()还原初始化链——优先于函数猜测
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 154 lines · 269 tokens per session scan A 1a811cd2f067
re-binary-core is a skill published in the GitHub repository dslsdzc/rev-skills (40 stars, last pushed 7d ago), licensed Apache-2.0. It adds 269 tokens to every session and 4,086 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
reverse-engineering-shellcode
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.