Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-consolegit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-console)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-console"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-console/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-console"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-console.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.06298 |
| Opus 5 | $0.00053 | $0.03149 |
| Sonnet 5 | $0.00021 | $0.01260 |
| Haiku 4.5 | $0.00011 | $0.00630 |
Grade A, and why
re-console scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
现代主机与复古平台逆向（Switch NSO/NPDM、PS4/PS5 ORBIS、复古 ROM/存档）
何时使用 / 何时不用
- 用：Switch 程序容器解析——NSO0（代码段结构）、NPDM（程序元数据/权限面）、ExeFS/NCA 分区边界识别；持合法 keyset 时解密 NCA/NAX0 分区并提取代码段
- 用：PS4/PS5 ORBIS 主程序（eboot.bin）——加密边界识别、合法解密样本的 ELF 结构解析（PT_SCE_* 程序头）、SDK 版本与导入库指纹
- 用：Xbox 系容器（XBE/XEX2）解析与入口定位
- 用：复古平台 ROM——NES（iNES/NES 2.0）、GB/GBC、GBA、PSX 的 ROM 头解析、卡带格式、存档文件、Cheat 码分析
- 用：SDK 库指纹（Switch NX SDK、ORBIS SDK、Xbox XDK、devkit 工具链）辅助版本识别与函数匹配
- 不用：PC 端游戏（Unity/Unreal、Cheat Engine 内存修改）走 [[re-game]]
- 不用：移动端游戏（[[re-mobile]]）
- 不用：容器解析出代码段后的通用反编译/调试底座（交 [[re-binary-core]]，Ghidra/IDA 照常使用）
- 不用：改机/自制固件刷写、主机破解、零售媒体解密与内容保护规避、盗版/未授权 ROM 的获取与分发——本技能只提供文件格式与分析方法，样本须来自合法渠道（自有设备备份、开发机/官方 SDK 内容、已获授权资料）；卡带 dump 仅限自有卡带的分析用途，各司法辖区对个人备份的规定不同，由使用者自行确认
- 不用：单纯使用成品存档修改器/Cheat 工具（本技能是分析路径，不提供成品工具）
工具准备
所有工具先验证再使用。静态分析可免沙箱；涉及动态执行（模拟器运行 ROM、运行解密样本）默认沙箱 + 网络隔离（[[platform-tips]] 最高原则）。
反编译器（Ghidra / IDA 任选其一）
- Ghidra（免费，官方 release 包，需 JDK；部分发行版仓库有
apt install ghidra/pacman -S ghidra）：- Linux: 官方 release 包；macOS:
brew install --cask ghidra；Windows: 官方 zip - 验证:
analyzeHeadless -help（headless 模式）或 GUI 导入目标文件 - 架构覆盖：Switch 为 aarch64、PS4/PS5 为 x86-64、PSX 为 MIPS R3000（方法论见 [[re-mips]]）、GBA 为 ARM7TDMI（Thumb 处理见 [[re-arm]]）、NES 为 6502 系；GB 的 SM83 是 Z80 变体，Ghidra 无原生模块，用 Z80 近似或专用 Game Boy loader 插件（见坑 6）
- Linux: 官方 release 包；macOS:
- IDA：商业版架构模块齐全；Freeware 版架构支持范围以官方页面为准
- 导入 ROM 时按平台设基址：GBA 0x08000000（卡带映射区）、PSX 按 EXE 头 0x18 字段（典型 0x80010000，RAM 基址 0x80000000）；NES/GB 是固定地址空间 + bank 切换，需要 loader 支持 mapper/bank（见坑 6）
hactool —— Switch 容器解析（NSO0/NPDM/NCA）
- 来源与安装: GitHub
SciresM/hactoolreleases——1.4.0（2018 年发布的末版，支持 NSO0/NPDM 解析与解压，NPDM 可导出 JSON）提供 Windows 包（hactool-1.4.0-win.zip）；Linux/macOS 从源码构建（config.mk.template拷为config.mk后make，依赖 zlib/openssl） - 验证:
hactool --help显示完整选项 - 注：旧教程/文章常见的 hactoolnet（LibHac 项目附带 CLI）仓库已下线——2026-08 核实 GitHub 404（
Thealexbarney/LibHac已不存在），引用到 hactoolnet 的资料先验证链接可用性，功能缺口用 hactool + 自写解析脚本（pyelftools）补齐 - 密钥:
-k keys.txt指定 keyset（每行key_name = HEX）；默认读$HOME/.switch/prod.keys（-d时读 dev.keys）。解密 NCA/NAX0 需要对应 keyset，无密钥只能做结构层分析
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 159 lines · 107 tokens per session scan A 025f98f75478
re-console is a skill published in the GitHub repository dslsdzc/rev-skills (46 stars, last pushed 10d ago), licensed Apache-2.0. It adds 107 tokens to every session and 6,298 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.