Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-ebpfgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-ebpf)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ebpf"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ebpf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ebpf"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ebpf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.04562 |
| Opus 5 | $0.00051 | $0.02281 |
| Sonnet 5 | $0.00020 | $0.00912 |
| Haiku 4.5 | $0.00010 | $0.00456 |
Grade B, and why
re-ebpf scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **运行期定位**: `sudo bpftool prog list` 列出全部已加载 prog（id/type/name/tag/map_ids/btf_id），核对样本特征（name/tag/加载时间） How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
eBPF 程序逆向与对抗分析（BPF-64、progs/maps、xlated）
何时使用 / 何时不用
- 用：BPF-64 指令集（8 字节定长指令、r0-r10 寄存器、lddw/alu32/helper 调用约定）层面的程序分析
- 用：三种来源形态——BCC（运行期编译，多只剩内核态 prog）、libbpf（常规 BPF ELF，.maps/.BTF 齐全）、手工字节码（bpf_insn 数组/预编译 blob，无元数据）
- 用：三用途——跟踪取证（bpftrace/bcc 程序功能还原）、恶意 eBPF（内核驻留/加载链/规避手法）、EDR 对抗（bpf hook 识别与反制）
- 用：progs/maps 关联还原、hook 点（kprobe/tracepoint/cgroup/xdp/tc/fentry）识别、helper 调用号到内核 API 的语义映射
- 不用：经典内核模块（.ko 驱动）——走 [[re-kernel]]
- 不用：seccomp/套接字过滤器等传统 cBPF（经典 BPF，指令集与 BPF-64 不同，本技能不覆盖）
- 不用：仅需分析宿主加载器二进制的通用场景（[[re-binary-core]]）；链上 BPF 字节码（Solana 类）语义表不同，走 [[re-blockchain]]
- 注意：helper 调用号与内核结构布局随版本漂移，分析环境内核版本与样本目标版本尽量一致（见坑 3）
工具准备
所有工具先验证再使用。加载/运行 BPF 程序到内核需要 root（或 CAP_BPF/CAP_SYS_ADMIN）；恶意样本（内核驻留/规避类）的动态分析默认在隔离虚拟机 + 快照中进行（[[re-sandbox]]，[[platform-tips]] 最高原则）；仅只读查询（prog list/dump xlated）风险较低，但同样建议在可控环境核对内核版本一致性。
bpftool —— 核心工具（prog/map 查询与 xlated 反汇编）
- Debian/Ubuntu:
apt install bpftool（Debian bullseye 起有独立包；Ubuntu 19.10+ 亦可装linux-tools-common+linux-tools-generic——前者只是 wrapper，真实二进制在linux-tools-$(uname -r)内核配套包里）；旧版 Debian（buster 及更早）无独立包，从内核源码编译tools/bpf/bpftool或克隆 libbpf/bpftool 仓库构建 - Fedora:
dnf install bpftool（官方仓库）；Arch:pacman -S bpftool - Windows: 无 Linux 内核 eBPF 运行环境（微软 ebpf-for-windows 为独立实现，非 Linux 内核形态），在 WSL2（Linux 内核）内按发行版安装；macOS: 无内核 eBPF 支持，用 Linux 虚拟机
- 验证:
bpftool version；查询类命令加sudo（bpftool prog list、bpftool prog dump xlated id N、bpftool feature probe、bpftool map show/dump id N、bpftool net show、bpftool btf dump file /sys/kernel/btf/vmlinux）
llvm-objdump —— 静态反汇编 BPF ELF
- Debian/Ubuntu:
apt install llvm；Fedora:dnf install llvm；Arch:pacman -S llvm；macOS:brew install llvm（llvm-objdump 在 /opt/homebrew/opt/llvm/bin/） - 验证:
llvm-objdump --version；反汇编:llvm-objdump -d prog.o（ELF e_machine=EM_BPF(247) 自动识别，无需指定目标）；GNU objdump（binutils 2.29+ 带 bpf 目标）也可作备选 - 注意: 静态反汇编的是源码编译产物，与内核中执行形态（xlated）有差异（见坑 2）
bpftrace —— 跟踪取证还原（被分析的 bpftrace/bcc 程序还原时对照用）
- Debian/Ubuntu:
apt install bpftrace；Fedora:dnf install bpftrace；Arch:pacman -S bpftrace - 验证:
bpftrace --version；bpftrace -d -e 'probe { ... }'输出其生成的 BPF 指令，用于对照 xlated dump 还原脚本行为
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 119 lines · 101 tokens per session scan B b6d53689f575
re-ebpf is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 101 tokens to every session and 4,562 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.