Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-drmgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-drm)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-drm"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-drm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-drm"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-drm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.03613 |
| Opus 5 | $0.00023 | $0.01806 |
| Sonnet 5 | $0.00009 | $0.00723 |
| Haiku 4.5 | $0.00005 | $0.00361 |
Grade A, and why
re-drm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DRM 分析（PlayReady / Widevine / 许可证流程）
何时使用 / 何时不用
- 边界（继承 [[re-cracking]]）：仅限自有内容保护方案 / 授权测试 / CTF·研究环境；禁止未授权内容解密与商业 DRM 绕过
- 用：分析 DRM 系统（Widevine / PlayReady / FairPlay）的组件结构、许可证挑战/响应流程
- 用：理解播放器/CDM（内容解密模块）如何管理密钥与解密内容（授权研究）
- 用：DRM 漏洞/弱点研究（密钥提取、解密流程绕过等，限授权环境）并负责任披露
- 用：CENC 加密媒体（MP4/CMAF）的 PSSH 与加密方案识别
- 不用：普通内容保护理解/协议逆向（那是 [[re-protocol]] 域）
- 不用：样本没有 DRM 只是普通加密（[[re-crypto-*]] 系列）
- 不用：制作盗版工具 / 提取密钥用于盗版分发（明确禁止，见授权边界）
- 授权边界（必读）：本技能仅限授权研究——自有设备、自有内容、实验室环境、已获书面许可的安全研究。禁止：提取/分发用于盗版的内容密钥、发布可用密钥提取工具、绕过 DRM 获取未授权内容。DRM 分析涉及反规避法律（如 DMCA 1201 类）与平台 ToS，分析以漏洞研究 + 防御视角产出，发现走负责任披露（厂商安全团队/漏洞奖励计划），敏感细节（密钥材料）不写入公开报告。
工具准备
静态分析（CDM 反编译 / 抓包分析）免沙箱；运行 CDM 与抓许可证流量属动态执行，在受控环境（[[platform-tips]] 最高原则）内进行。所有工具先验证再使用。
反编译工作台（[[re-ghidra]]）—— CDM/解密器分析
- [[re-ghidra]]（默认）：导入 CDM 二进制（Widevine CDM 是带导出表的 ELF so）与播放器二进制
- [[re-ida]]：备选；验证: 导入 libwidevinecdm.so 后能反编译
Initialize/CreateSession类导出 - CDM 获取（自有环境）：Chrome 的 Widevine CDM 在
~/.config/google-chrome/WidevineCdm/（Linux）/%LOCALAPPDATA%\Google\Chrome\User Data\WidevineCdm（Windows）/~/Library/...（macOS）；Edge 的 PlayReady 同理
网络捕获（[[re-netcap]]）—— 许可证挑战/响应
- tshark/wireshark/mitmproxy 安装见 [[re-netcap]]「工具准备」
- 验证:
tshark --version；mitmdump --version - HTTPS 解密按 [[re-netcap]] 步骤 4（mitmproxy CA 装入受控环境）
protobuf 解析（Widevine 侧）
pip install protobuf（或 grpcio-tools）；验证:python3 -c "import google.protobuf; print(google.protobuf.__version__)"- 用途: 许可证挑战/响应是 protobuf，按字段号解析（字段表见 [[layout]]）
CDM 分析辅助工具（Widevine L3 设备，研究用途）
- 无独立发行版包：Widevine L3 CDM（软件实现）的分析工具来自社区研究（GitHub 检索 Widevine L3 相关研究仓库，如 pywidevine），安装
pip install pywidevine（只用于自有设备授权研究） - 验证:
python3 -c "import pywidevine; print(pywidevine.__version__)" - 用途与边界：只分析自有设备/自有内容；密钥材料不出现在报告中（见坑 3）
操作步骤
按顺序执行，每步产物（组件清单、许可证流程笔记、CDM 结构笔记）记录证据路径 + sha256（见 [[re-triage]]），供报告引用。所有步骤在授权范围与受控环境内进行（授权边界见「何时使用」）。
- DRM 组件识别（CDM / 解密器）：
- 播放器/浏览器侧：EME API（
requestMediaKeySystemAccess("com.widevine.alpha")/"com.microsoft.playready"）→ 定位 DRM 类型与 CDM 路径 - CDM 组件：
libwidevinecdm.so（Chrome 内置；后缀标注的是架构——-arm/-arm64/-x86/-x64为 CPU 架构而非安全等级，L1/L3 取决于设备 TEE 信任根，无 TEE 的 ARM 设备同样跑 L3 软件实现，见坑 1）；PlayReady 组件在 Edge/Windows 系统组件；FairPlay 在 Apple 侧（[[re-ios]] 域） - CDM 导出函数（C ABI）：
Initialize、CreateSession（CreateSessionAndGenerateRequest）、UpdateSession（处理许可证响应）、CloseSession、RemoveSession、Decrypt、SetServerCertificate——导出表见 [[layout]] - 记录：DRM 类型、CDM 路径与版本、文件 sha256（版本锚点，坑 4）
- 播放器/浏览器侧：EME API（
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 113 lines · 45 tokens per session scan A c60c6126d54b
re-drm is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 45 tokens to every session and 3,613 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.