Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-idagit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-ida)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ida"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ida/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-ida"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-ida.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.03107 |
| Opus 5 | $0.00018 | $0.01554 |
| Sonnet 5 | $0.00007 | $0.00621 |
| Haiku 4.5 | $0.00004 | $0.00311 |
Grade A, and why
re-ida scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
IDA 逆向工作流
何时使用 / 何时不用
- 用：已有 IDA 授权/免费版，目标需要 FLIRT 库识别、Hex-Rays 反编译、idapython 批处理
- 用：大规模重复性标注/导出（无头批处理
idat64 -A -S，序列见 [[commands]]） - 不用：免费版无法处理时（无 Hex-Rays → 用 [[re-ghidra]] 兜底）；只需快速结论（[[re-triage]]）
- 不用：内存受限环境（大二进制卡顿，换 [[re-radare2]]）；纯命令行快速分析（[[re-radare2]] 更轻）
- 不用：macOS/Linux 目标动态调试（[[re-lldb]] / [[re-gdb]]）；IDA 调试器只对 Windows 本地目标价值最大
工具准备
参考 [[platform-tips]]——静态分析免沙箱；用 IDA 调试器做动态调试时按最高原则默认沙箱执行。
IDA（商业版 / 免费版）
- 下载: hex-rays.com（IDA Free 免费版，支持 x86/x64；其他架构与分析器需商业版）
- Windows: 安装程序直接运行；
choco install ida-free（社区包，或官网手动下载） - macOS/Linux: 官网 tar 包解压运行
ida/ida64（Windows 对应ida.exe/ida64.exe，无头用idat/idat64） - 验证: 启动后成功打开一个样本完成 auto-analysis，函数窗口有内容；
idat64 --help有输出；无头模式试跑idat64 -A -L"t.log" /bin/true能正常退出 - 版本差异: 7.5 起数据库统一
.i64（旧.idb/.idb64可升级）；8.x 需 64 位宿主；9.0 起 32/64 位安装合一、内置 FLIRT 签名管理器、idalib 无头 API——详见 [[gotchas]]
idapython（内置）
- IDA 6.8+ 内置 Python 环境，无需单独安装；IDA 9 用
idapyswitch（IDA 根目录）切换外部 Python（3.8–3.13） - 验证: 菜单
File > Script command（Shift+F2）执行print(idaapi.IDA_SDK_VERSION)输出版本
FLIRT 签名库
- IDA 自带
sig/目录（flair），应用后自动标注库函数；IDA 9 的签名管理器可在线下载更多签名 - 验证: 对已知 libc 程序应用签名后，
_init/malloc等被标注为库函数
操作步骤
-
导入与 auto-analysis：
File > New选择样本 → 等左下角AU: analyzing结束（无 AU 字样且分析日志停止）- 确认
Options > General > Analysis中 Auto-analysis 开启；确认segments与entry point已识别 - 无头批处理:
idat64 -A -S"myscript.py" -L"log.txt" sample（-A自动模式，Windows 用idat64.exe） - 无头脚本开头
ida_auto.auto_wait()等分析完成、结尾idc.qexit(0)退出——缺这两行会拿到空函数列表或进程挂住
-
FLIRT 识别库函数：
File > Load file > FLIRT signature file...选择匹配的.sig（MSVC 选mssdk、vc64rtf等；GNU 选libstdc++系列）- 识别后库函数名自动应用，函数窗口内库函数（浅色）与用户函数分离——直接聚焦非库函数
- 匹配失败（加壳/混淆库）→ 说明壳或自定义编译，转 [[re-anti-analysis]]
-
快捷键主线（静态分析日常）：
x交叉引用；n重命名（函数/变量）；y改类型（如int __cdecl f(int, char*)）；;注释（repeatable 用:）G跳地址；Alt+T文本搜索（字符串关键字）；Alt+B二进制搜索（字节模式）；Esc返回上级F5Hex-Rays 反编译；Tab在伪代码/汇编视图间切换- 完整快捷键与命令表见 [[commands]]
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 119 lines · 37 tokens per session scan A c2b51f49b7db
re-ida is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 37 tokens to every session and 3,107 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.