Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/dslsdzc/rev-skillsnpx agentmods add skills/dslsdzc/rev-skills/re-fw-rootfsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-fw-rootfs)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fw-rootfs"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fw-rootfs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-fw-rootfs"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-fw-rootfs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01959 |
| Opus 5 | $0.00023 | $0.00979 |
| Sonnet 5 | $0.00009 | $0.00392 |
| Haiku 4.5 | $0.00005 | $0.00196 |
Grade A, and why
re-fw-rootfs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
固件文件系统分析（rootfs）
何时使用 / 何时不用
- 用：已有解包产物 / 文件系统镜像，需要找启动入口、配置、密钥、硬编码口令
- 用：需要定位固件内程序与架构（交叉二进制）
- 不用：还没有任何解包产物（先 [[re-fw-extract]]）
- 不用：需要运行固件程序观察行为（走 [[re-fw-emulate]]）
- 不用：需实物板子（走 [[re-hardware-io]]）
工具准备
所有工具先验证再使用。本技能纯静态分析可免沙箱（[[platform-tips]] 最高原则）；解出的程序要运行时转 [[re-fw-emulate]]。
解包工具（unblob / binwalk 产物优先）
- 已装则直接用 [[re-fw-extract]] 的解包产物；没装按该技能「工具准备」安装
- 验证:
unblob --version/binwalk --version
7-Zip（7z）—— 通用容器兜底
- Linux:
apt install p7zip-full/dnf install p7zip-plugins/pacman -S p7zip - macOS:
brew install p7zip - Windows:
choco install 7zip（或 7-zip.org 官方安装包） - 验证:
7z i | head -5（显示版本）
squashfs-tools（unsquashfs）
- Linux:
apt install squashfs-tools/dnf install squashfs-tools/pacman -S squashfs-tools - macOS:
brew install squashfs - Windows/WSL: WSL 内 Linux 版
- 验证:
unsquashfs -version
cramfs 解包（cramfsck）
- Linux:
apt install cramfsprogs（Debian/Ubuntu）；其他发行版无官方包 → 用 unblob 解 cramfs 兜底 - macOS/Windows: unblob 兜底
- 验证:
cramfsck -V
grep / ripgrep —— 配置与密钥搜索
- Linux:
apt install ripgrep/dnf install ripgrep/pacman -S ripgrep（grep 随发行版自带） - macOS:
brew install ripgrep - Windows:
choco install ripgrep（或 WSL） - 验证:
rg --version/grep --version
交叉 binutils（readelf / objdump 跨架构）
- Linux:
apt install binutils-arm-linux-gnueabi binutils-arm-linux-gnueabihf binutils-mipsel-linux-gnu binutils-mips-linux-gnu（Debian/Ubuntu；Fedora:dnf install binutils-arm-linux-gnu binutils-mips-linux-gnu） - macOS:
brew install binutils（greadelf）或brew install llvm（llvm-readelf） - WSL: Linux 版直接可用
- 验证:
arm-linux-gnueabi-readelf --version；本机 readelf 也能读交叉 ELF 头（readelf -h），属性级信息用交叉版readelf -A
操作步骤
按顺序执行，每步记下结果。
- 挂载/解包文件系统：
已用 [[re-fw-extract]] 解出则直接进入下一步，跳过此步。# squashfs（最常见） unsquashfs rootfs.squashfs -d rootfs_out # cpio initramfs mkdir rootfs_out && cd rootfs_out && cpio -idmv < ../initramfs.cpio # 通用兜底 7z x rootfs.img # cramfs（Debian 系） cramfsck -x rootfs_out rootfs.cramfs # ext 类镜像（需 root，只读挂载） mkdir mnt && mount -o loop,ro rootfs.img mnt
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 125 lines · 47 tokens per session scan A f1c44054d4c2
re-fw-rootfs is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 12d ago), licensed Apache-2.0. It adds 47 tokens to every session and 1,959 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ot-ics-attack
A guide to assessing operational technology and industrial control systems such as SCADA, DCS, and PLC environments. These systems monitor and control physical processes and often use specialized network protocols.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.