Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-hw-chipgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-hw-chip)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-hw-chip"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-hw-chip/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-hw-chip"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-hw-chip.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02296 |
| Opus 5 | $0.00047 | $0.01148 |
| Sonnet 5 | $0.00019 | $0.00459 |
| Haiku 4.5 | $0.00009 | $0.00230 |
Grade A, and why
re-hw-chip scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
芯片/PCB 硬件逆向
何时使用 / 何时不用
- 用：物理芯片/板级分析（固件提取失败后的物理层）、芯片解密、硬件木马检测
- 不用：固件级分析（转 [[re-fw-extract]]）；接口提取（转 [[re-hardware-io]]）；无线信号（转 [[re-sdr]]）
工具准备
显微镜/探针台（观察与接触）
- 选购指引：体视显微镜（初检）→ 金相显微镜（裸片）；探针台按预算分级
- 验证: 无软件验证——以成像清晰度验收
decapping 设备与耗材（去封装）
- 化学 decap：发烟硝酸/硫酸 + 加热台（防护：通风橱/护目镜）；激光 decap：专用激光器（高成本，外包可选）
- 验证: 无软件验证——以裸露程度验收
逻辑分析仪（信号提取）
- 多平台: Saleae 类（配套软件各平台可用）或开源方案（sigrok/PulseView：
apt install sigrok-cli pulseview/brew install sigrok-cli pulseview（sigrok 无 PyPI 包）） - 验证:
pulseview --version
热成像（功耗/时序异常，可选）
- 选购指引：按分辨率与测温范围选型；验证: 成像验收
操作步骤
按顺序执行；全程注意防护与破坏性风险（步骤 1 不可逆）。
-
去封装（decapping）：
- 化学法：加热台预加热 → 滴加发烟硝酸溶解环氧 → 清洗（丙酮）→ 显微镜检查
- 激光法：激光逐层烧蚀（精度高，成本高）
- 风险控制：通风橱、防酸手套/护目镜、废弃液处理；先练习废片
- 验收：金属层可见、无过度腐蚀（伤及晶圆）
-
裸片分析：
- 显微成像（金相显微镜/电子显微镜）→ 金属层走线观察
- ROM/熔丝提取：成像 → 位图还原（金属层/多晶硅层图案 → 二进制）
- 产出：ROM 位图 → 数据（与 [[re-fw-extract]] 固件对照）
-
探针与信号提取：
- 探针台接触测试点（总线/时钟/数据线）
- FIB（聚焦离子束）：修改互连/暴露内部节点（高成本，外包）
- 信号嗅探：逻辑分析仪挂总线（时序对照数据手册）
- 注意：探针负载可能改变信号（见坑 2）
-
PCB 电路分析：
- 走线还原（万用表导通/成像 → 网络表）
- IC 标识识别（丝印 → 型号 → 数据手册 → 引脚功能）
- JTAG/SWD 引脚定位（测试点/走线特征 → 调试接口枚举）
-
硬件木马检测：
- 冗余逻辑特征（无功能路径的触发器/计数器）
- 功耗/时序异常（热成像 + 电流曲线对照基线）
- 触发条件分析（特定输入组合/温度/时间条件）
侧信道与故障注入
功耗侧信道（SPA/DPA）
- SPA（简单功耗分析）：单条或少数功耗曲线直接观察密钥相关操作（乘方运算位数、条件分支的电流差异），适合算法结构已知的场景
- DPA（差分功耗分析）：
- 采集原理：同一密钥下多次加解密，逐条记录功耗曲线
- 差分思路：按猜测密钥位分组（如按某轮 S-box 输出某一位为 0/1 分组），组内平均后相减；某猜测下出现显著尖峰，说明该中间值与功耗存在相关性
- 相关分析：对中间值比特与曲线逐点做相关性计算（CPA 思路），尖峰位置对应操作发生时刻，可反向验证猜测
- 采集设备（chipwhisperer 类）选购要点：
- 采样率：不低于目标时钟的数倍（超出奈奎斯特需求），高速时钟下需 GHz 级采样
- 触发同步：支持外部触发信号（以加解密开始时刻对齐），曲线逐条对齐是差分分析的前提
- 信噪比：高阻差分探头、短地线、屏蔽可降低噪声；噪声大时靠增加采集条数平均补偿
- 验证: 无软件验证——以已知密钥采集曲线，确认差分尖峰出现
故障注入（时钟毛刺/电压毛刺）
- 原理：时钟毛刺在目标指令执行时刻插入过窄的时钟周期，使取指/译码/执行失败，产生跳过分支、破坏中间值等效果；电压毛刺以瞬时欠压实现类似效果
- 参数扫描流程：
- 粗扫：宽度与相位（注入时刻）按大步长铺开，记录有反应的参数点
- 细分：对命中区域缩小步长，定位稳定窗口
- 复测：同一参数多次注入，确认效果可重放
- 结果判定：跳过分支（授权校验直接通过）、改返回值（校验函数返回被破坏）、无效果或崩溃（参数越界，回退重扫）
- 与去封装衔接：裸片探针可接触时钟/总线节点，毛刺注入点与功耗观测点重合，侧信道曲线可与探针波形互证；去封装后注入点选择更多（见上文步骤 1/3）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 119 lines · 94 tokens per session scan A 5f2ba191c290
re-hw-chip is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 94 tokens to every session and 2,296 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ot-ics-attack
A guide to assessing operational technology and industrial control systems such as SCADA, DCS, and PLC environments. These systems monitor and control physical processes and often use specialized network protocols.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.