Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-fw-extractgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-fw-extract)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fw-extract"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fw-extract/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fw-extract"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fw-extract.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.05215 |
| Opus 5 | $0.00035 | $0.02608 |
| Sonnet 5 | $0.00014 | $0.01043 |
| Haiku 4.5 | $0.00007 | $0.00522 |
Grade A, and why
re-fw-extract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.
固件提取与解包
何时使用 / 何时不用
- 用：拿到固件文件（.bin / .img / 升级包 / IoT 镜像）需要解开看内容
- 用：需要判断固件打包方式、架构与字节序
- 不用：已是文件系统镜像 / rootfs（直接走 [[re-fw-rootfs]]）
- 不用：需要运行固件观察行为（走 [[re-fw-emulate]]）
- 不用：需实物板子硬件提取（走 [[re-hardware-io]]）
工具准备
所有工具先验证再使用。解包与 magic 扫描是纯静态分析，可免沙箱（[[platform-tips]] 最高原则）；解出产物要运行时转 [[re-fw-emulate]]。
binwalk —— 自动解包主力
- Linux:
apt install binwalk（Debian/Ubuntu 仓库版为 2.x）/dnf install binwalk/pacman -S binwalk - pip（跨平台、版本新、签名库全，推荐）:
pip install binwalk - macOS:
brew install binwalk（或 pip 版） - Windows/WSL: Windows 本机无官方包，用 WSL 内 Linux/pip 版
- 验证:
binwalk --version（2.x）或binwalk --help（老版）
unblob —— 更准的自动解包（推荐主力）
- 跨平台:
pip install unblob（依赖较多，建议 venv:python3 -m venv venv && venv/bin/pip install unblob） - 各发行版基本无官方包，用 pip
- 验证:
unblob --version
dd —— 按偏移切分
- Linux/macOS: coreutils 自带（macOS 自带 /usr/bin/dd）
- Windows/WSL: WSL 内 Linux 版；Windows 本机用 Git Bash 自带 dd 或 WSL
- 验证:
dd --version
hexdump —— 十六进制查看与手工 magic 扫描
- Linux:
apt install bsdmainutils（Debian/Ubuntu）/dnf install util-linux（Fedora/RHEL，含 hexdump） - macOS: 自带 /usr/bin/hexdump
- Windows/WSL: WSL 内 Linux 版
- 验证:
hexdump -C /dev/null（无报错即可用；macOS 版无--version）
sasquatch —— 老式/厂商魔改 squashfs 解包
- Linux: 源码编译（
git clone https://github.com/devttys0/sasquatch，需apt install zlib1g-dev liblzma-dev build-essential后make） - macOS: 同上源码编译（需 Xcode Command Line Tools）
- Windows/WSL: WSL 内编译
- 验证:
sasquatch -h输出用法（编译产物在仓库子目录，需加入 PATH）
操作步骤
按顺序执行，每步记下结果。
-
自动解包（unblob 优先，binwalk 兜底）：
unblob firmware.bin # 更准，自动识别 50+ 容器格式并递归解包 # 或 binwalk： binwalk firmware.bin # 先列出签名与偏移 binwalk -Me firmware.bin # -M 递归 -e 提取产物：
firmware.bin/（unblob）或_firmware.bin.extracted/（binwalk）目录。解出的文件系统转 [[re-fw-rootfs]]，ELF 转 [[re-binary-core]]。 -
magic 手工扫描（自动解包不全时）：
hexdump -C firmware.bin | head -40 # 或按 binwalk 报告的偏移核对： dd if=firmware.bin bs=1 skip=<偏移> count=16 | hexdump -C常见魔数：JPEG
FF D8 FF、gzip1F 8B、squashfshsqs、cramfs45 3D CD 28（小端，大端反序）、U-Boot27 05 19 56、jffs285 19、ELF7F 45 4C 46。识别出一个就按该格式处理。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 169 lines · 70 tokens per session scan A b3f05c8d4d32
re-fw-extract is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 70 tokens to every session and 5,215 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ot-ics-attack
A guide to assessing operational technology and industrial control systems such as SCADA, DCS, and PLC environments. These systems monitor and control physical processes and often use specialized network protocols.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.