Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-firmwaregit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-firmware)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-firmware"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-firmware/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-firmware"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-firmware.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.01475 |
| Opus 5 | $0.00062 | $0.00737 |
| Sonnet 5 | $0.00025 | $0.00295 |
| Haiku 4.5 | $0.00012 | $0.00147 |
Grade A, and why
re-firmware scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
固件 / 嵌入式 / 硬件分析
完整工作流
- 初勘：[[re-triage]] —— file/哈希/熵确认固件类型、架构与字节序（未走 [[re-analyze]] 入口则先补做，读取
RE_*会话变量） - 提取：[[re-fw-extract]] —— binwalk/unblob 自动解包，magic 手工扫描，字节序判断
- rootfs：[[re-fw-rootfs]] —— 挂载/解包文件系统，启动脚本定位入口，配置/密钥/硬编码口令挖掘
- 仿真：[[re-fw-emulate]] —— 需要运行时用 QEMU 用户态优先（最轻方案，见 [[platform-tips]]），全系统按需
- 硬件接口：[[re-hardware-io]] —— 需实物板子时（JTAG/UART/flash 读取）；有固件文件先走 2-4，硬件是最后手段
- 通信：提取/运行中发现固件通信、回连、自定义协议 → [[re-protocol]]（netcap / proto-rev / crypto-*）
- 产出：结论 / 报告（按
RE_REPORT），哈希与证据存档（见 [[re-triage]]）
每步结果存档（证据路径 + sha256，见 [[re-triage]]），供报告引用；发现恶意样本/后门随时转 [[re-malware]]。
何时用哪个原子技能（选择树）
- 有固件文件（.bin / .img / 升级包）→ [[re-fw-extract]] 解包
- 已有 rootfs / 解包产物 → [[re-fw-rootfs]] 分析文件系统
- 需要运行固件观察行为 → [[re-fw-emulate]]（先确认架构，见 [[re-triage]]）
- 有实物板子 / 需要硬件提取 → [[re-hardware-io]]
- 汽车 ECU / CAN 总线 / OBD-UDS 诊断 → [[re-automotive]]
- 见通信（固件回连 / 自定义协议 / 加密通信）→ [[re-protocol]]
- 目标是 UEFI 固件（BIOS 更新包/DXE 驱动/bootkit）→ [[re-uefi]]（UEFITool 解析 + OVMF 仿真）
跨域联合
- 固件通信协议：[[re-firmware]] → [[re-protocol]]（netcap / proto-rev / crypto-* 识别与重建固件通信）
- 固件内恶意样本/后门：[[re-firmware]] → [[re-malware]]（沙箱行为分析见 [[re-sandbox]]）
- 固件内 ELF 深度静态分析：→ [[re-binary-core]]（[[re-format-elf]] / [[re-ghidra]]）
- 仿真动态分析默认沙箱 + 网络隔离（[[platform-tips]] 最高原则）
- 本网关被 [[re-analyze]] 的 triage.md「分析固件 / IoT 设备」路径调用（re-firmware → re-fw-extract → re-fw-rootfs → re-fw-emulate → 若见通信 re-protocol）
常见坑与陷阱
- 拿到固件跳过初勘直接 binwalk → 架构/字节序未知，解出的程序无法仿真 —— 先 [[re-triage]] 确认（大端 ARM/MIPS 常见）
- 自动解包失败就放弃 → 厂商自定义头/加密层最常见 —— 转 [[re-fw-extract]] 手工 magic 扫描 + dd 按偏移切分
- 一上来就要实物板子 → 成本高、有损坏风险 —— 有固件文件先走 提取→rootfs→仿真，[[re-hardware-io]] 是最后手段
- 仿真不隔离网络就跑固件 → 固件真实回连外网 —— 默认沙箱 + 网络隔离（[[platform-tips]] 最高原则），通信分析转 [[re-protocol]]
- rootfs 分析不看启动脚本 → 面对几十个二进制无从下手 —— 先 [[re-fw-rootfs]] 读 rcS / inittab / init.d 定位程序入口
- 启动链逐层校验（BootROM→FDL→SPL→U-Boot→system）：现象——patch 掉一层校验刷机仍失败，后面还卡在别的验证；原因——移动 SoC（Unisoc/展锐等）刷机链每层独立验签：BootROM→FDL1→FDL2→SPL Loader→U-Boot/LK→system，SPL 对 sml/trustos/uboot 做 RSA-2048 校验（DHTB+SIMGHDR 格式），失败进死循环；对策——沿整条链逐层追：①格式特征转常量：文件头 ASCII（如
DHTB）按 32 位小端转整数（1112819780），在上一层反编译中搜该常量定位校验入口；②失败陷阱=死循环（校验失败 branch 到 loop），patch 失败分支改 NOP/调整分支让它继续走；③FDL2 加载基址从 spd_dump 命令行第二个 FDL 地址拿（IDA/Ghidra 加载基址用这个，xref 才对得上）；④字符串搜索找"按分区名分发刷写逻辑"的入口；⑤硬件固化方案（RP2350 作 USB Host 自动重放握手注入）只做自动化，真正关键在逆向与魔改加载链
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 51 lines · 123 tokens per session scan A 3146187f0e54
re-firmware is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 13d ago), licensed Apache-2.0. It adds 123 tokens to every session and 1,475 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ot-ics-attack
A guide to assessing operational technology and industrial control systems such as SCADA, DCS, and PLC environments. These systems monitor and control physical processes and often use specialized network protocols.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.