Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-deobfuscategit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-deobfuscate)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-deobfuscate"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-deobfuscate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-deobfuscate"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-deobfuscate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.05937 |
| Opus 5 | $0.00026 | $0.02968 |
| Sonnet 5 | $0.00010 | $0.01187 |
| Haiku 4.5 | $0.00005 | $0.00594 |
Grade A, and why
re-deobfuscate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
反混淆（花指令 / 控制流平坦化 / 字符串加密）
何时使用 / 何时不用
- 用：反编译产物出现花指令（反汇编碎片、恒等跳转）、控制流平坦化（if/while 全变 switch 分发）、字符串加密（静态只见密文数组）；需要还原算法 / 授权逻辑
- 用：CTF 反混淆题目；脱壳后仍有代码混淆的样本（[[re-anti-analysis]] 工作流第 5 步）
- 不用：干净代码（直接 [[re-binary-core]] 分析）
- 不用：只需绕过保护、不关心算法（动态 patch / hook 更省，见 [[re-gdb]] / [[re-frida]]）
- 不用：壳层混淆（那是壳的解压逻辑——先脱壳 [[re-unpack-simple]] / [[re-unpack-advanced]]）
- 注意：反混淆是迭代过程——还原一层验证一层，先备份原文件
工具准备
反编译产物（还原的工作台）
- [[re-ghidra]]：
apt install ghidra/brew install --cask ghidra（官方 release zip 也可），验证analyzeHeadless -help；或 [[re-ida]] / [[re-radare2]] 的反编译视图。先产出反编译代码，再针对混淆点处理
idapython（批量脚本化）
- IDA 内置（8.x/9.x 自带 Python 3）；命令行跑脚本：
idat64 -A -S"script.py" sample.exe - 验证: IDA 内
File > Script Command能执行 Python
rizin 脚本（批量 patch / 查询）
- Linux:
apt install rizin/dnf install rizin/pacman -S rizin；macOS:brew install rizin；Windows/WSL: WSL 内 Linux 包 - 验证:
rizin -v；配合pip install r2pipe用 Python 驱动
D-810（IDA 插件，可选）
- 原仓 GitLab
eshard/d810（GitHub 镜像zhkl0228/d810，原仓 README 已 fork 注明）release，复制到 IDAplugins/目录（要求 IDA 7.5+ / Python 3.7+，来源：官方 README） - 功能：控制流平坦化自动还原（Deobfuscate 菜单）
- 验证: IDA 菜单出现 D-810 项
python3（仿真 / 批量解密）
apt install python3（多数系统自带）；按需pip install pefile r2pipe- 验证:
python3 --version
操作步骤
按顺序执行，每步记录结果（证据路径 + sha256，见 [[re-triage]]）。修改前先备份原文件（见坑 1）。
-
花指令清除（patch NOP / 跳转修复）：
- 识别特征：恒等跳转（
jz/jnz下一句即目标）、call+pop取址、插入的垃圾指令（xor eax,eax后无意义）、反汇编器误入垃圾字节形成的碎片。 - 清除：把垃圾指令 patch 成 NOP，修复被扰乱的跳转目标——
- rizin:
wx 90 @ 0x401000（单字节 NOP）；批量用脚本按特征扫描填充 - Ghidra: 选中区域右键 Patch Instruction；IDA:
Edit > Patch Program > Assemble
- rizin:
- 修复函数边界：Ghidra 选中范围按
C强制标记代码 / 右键 Create Function；反汇编器漏分析的段手动定义。 - 每步 patch 后重新反汇编确认无 "undefined" 指令（见坑 1）。
- 识别特征：恒等跳转（
-
控制流平坦化识别与还原（D-810 / 手动）：
- 识别特征：大量基本块收敛到单一 dispatcher（
switch分发循环）、状态变量（dispatcher 的索引）在每个块尾部被改写、原 if/while 分支块被拆成小块。 - 自动：IDA + D-810 →
Deobfuscate菜单 →Flattened code，选中平坦化函数一键还原（失败回落手动）。 - 手动：先定位 dispatcher 的 switch 变量 → 跟踪其写入点（每块尾部）→ 把各 case 目标按状态变量连接回原始控制流；用 idapython / rizin 脚本导出 dispatcher 的目标表辅助连线。
- 状态变量找错是最大风险（见坑 2）——先用 D-810 自动，手动时先确认变量确实参与 dispatcher 索引。
- 识别特征：大量基本块收敛到单一 dispatcher（
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 125 lines · 51 tokens per session scan A 956eee81c1d0
re-deobfuscate is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 51 tokens to every session and 5,937 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.