Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-crypto-decryptgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-crypto-decrypt)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-crypto-decrypt"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-crypto-decrypt/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-crypto-decrypt"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-crypto-decrypt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.04369 |
| Opus 5 | $0.00021 | $0.02184 |
| Sonnet 5 | $0.00008 | $0.00874 |
| Haiku 4.5 | $0.00004 | $0.00437 |
Grade A, and why
re-crypto-decrypt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
加密数据还原
何时使用 / 何时不用
- 用：需要把密文（数据 blob / 流量 / 配置段）还原成明文
- 用：算法与密钥已知（或已由 [[re-crypto-id]] / [[re-crypto-keys]] 得出），需要批量解密
- 用：从样本里还原解密逻辑并重写为独立可复用的脚本
- 不用：算法/密钥都未知（先 [[re-crypto-id]] → [[re-crypto-keys]]）
- 不用：静态可读的明文（[[re-triage]] 熵低直接读）
- 不用：想跑原样本看输出（那是 [[re-behavior]] / [[re-sandbox]] 的活——解密脚本是为了脱离样本复现）
工具准备
所有工具先验证再使用。本技能处理的是转储/反编译产物与密文数据，运行样本环节在 [[re-sandbox]] 内（[[platform-tips]] 最高原则）。
python3 + pycryptodome —— 解密脚本主力
- Linux:
apt install python3 python3-pip/dnf install python3 python3-pip/pacman -S python python-pip - macOS:
brew install python - Windows: python.org 安装包（勾选 Add to PATH）；WSL 内 Linux 版
- 加密库:
pip install pycryptodome（AES/DES/RSA/ChaCha 等标准算法） - 验证:
python3 -c "from Crypto.Cipher import AES; print('ok')"；python3 --version
目标程序转储/反编译产物 —— 还原算法的依据
- 转储: [[re-memdump]] 默认转储（gcore）——定位密文输入点与解密调用现场
- 反编译: [[re-ghidra]] / [[re-ida]] / [[re-radare2]] 的产物（函数反编译视图）
- 验证:
file out是 ELF core；反编译器里能找到目标函数（ghidra/rizin可启动）
angr（可选）—— 符号执行补足难还原的逻辑
- 全平台:
pip install angr（Python 3.8+，依赖多，建议 venv:python3 -m venv venv && venv/bin/pip install angr） - 验证:
venv/bin/python -c "import angr; print(angr.__version__)" - 用途: 反编译分支爆炸/混淆严重时，用符号执行求解密函数输出（加载目标二进制 → 设密文输入为符号 → 约束求解）
操作步骤
按顺序执行，每步记下结果。前提：算法（[[re-crypto-id]]）与密钥（[[re-crypto-keys]]）已确认或至少有一方候选；脚本与验证结果（明文样本 + sha256）存档供报告引用。
-
证伪"密文"：先定位真实密文边界（跳过此步是加密分析最常见的失败方式）：
- 高熵段可能是"伪密文"——容器/压缩数据流被误当加密层（如 zip 数据本体、附加在图片后的压缩流）。压缩数据熵同样是 8.0，与加密不可区分
- 先做整体结构观察：文件头/尾魔数、格式 marker 分布（JPEG 逐段统计大小）、尾部已知结构当锚点（zip EOCD 的
cd_offset/cd_size反推数据起点，EOCD 签名是已知明文） - 找格式结束标记用第一个（JPEG EOI
FFD9、PNG IEND），不是最后一个——数据流里碰巧出现的标记字节对会把分析带偏（曾把 zip 数据中的FFD9误当图片结尾，把数据流当密文穷举） - 同尺寸文件先比尾部 16 字节/整体哈希——"换头副本"（同一 payload 的第二种封装，仅头部不同）直接省掉一整条支线
- 压缩率是信号：解压后明显变大的层说明内容有结构（可压=编码/明文），接近 1:1 说明内层已压缩或加密
- 确认是孤立高熵 blob 后再进入步骤 1 的密文定位
-
定位解密函数（交叉引用密文输入点）：
- 从密文偏移出发：[[re-crypto-id]] 步骤 2 的高熵区偏移 → 反编译器里找读取该偏移/该全局变量的函数 → 沿调用链看谁写入了它（写入方常是解密函数）
- 从 API 出发：[[re-crypto-keys]] 步骤 4 找到的
Crypt*/EVP_*调用点就是候选；观察入参的密文指针是否指向步骤 2 的偏移 - 动态辅助: [[re-gdb]] / [[re-x64dbg]] 在候选函数下断点（沙箱内），打印入参/返回值，确认它输出可读明文
- 找不到明确函数 → 密文可能由内联展开的算法处理（无调用边界），回 [[re-crypto-id]] 用数据特征定位（常量表引用处）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 119 lines · 42 tokens per session scan A 885f609e373b
re-crypto-decrypt is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 42 tokens to every session and 4,369 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.