Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-kernelgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-kernel)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-kernel"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-kernel/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-kernel"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-kernel.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.03720 |
| Opus 5 | $0.00022 | $0.01860 |
| Sonnet 5 | $0.00009 | $0.00744 |
| Haiku 4.5 | $0.00004 | $0.00372 |
Grade A, and why
re-kernel scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
内核逆向（Windows 驱动 / rootkit）
何时使用 / 何时不用
- 用：.sys 驱动/内核模块静态逆向（DriverEntry、IRP 分派、设备对象）；rootkit 特征分析（SSDT hook / inline hook / 隐藏进程）；用户态⇄驱动交互（DeviceIoControl）还原
- 用：与 [[re-windbg]] 内核调试配合做运行时验证
- 用：驱动型恶意样本（加载器/反作弊/EDR 对抗）的驱动侧还原
- 不用：只需内核运行时调试/崩溃 dump 定位（
!analyze -v直接走 [[re-windbg]]） - 不用：Linux 内核模块（本技能以 Windows 为对象；Linux 侧走 [[re-format-elf]] + [[re-gdb]]/kprobes 思路另行处理）
- 不用：UEFI/引导阶段（bootkit）——固件侧走 [[re-uefi]]
工具准备
参考 [[platform-tips]]——驱动加载/内核调试属动态执行，默认沙箱（调试机 VM）内进行；分析产物静态部分免沙箱。
反编译产物（驱动结构插件）
- [[re-ghidra]]（默认）：导入 .sys 后自动分析，Data Type Manager 导入 Windows 内核类型（
ntddk.h相关头文件或内置 WDK 类型）——结构字段名直接参与反编译，质量远高于裸偏移 - [[re-ida]]：FLIRT 内核签名 + 类型库；idapython 批量标注
- 验证: 导入 .sys 后 DriverEntry 能反编译出带参数签名的函数（x64:
DriverEntry(PDRIVER_OBJECT, PUNICODE_STRING)）
WinDbg 内核调试（[[re-windbg]]）
- 双机/VM 串口（COM Named Pipe）或 KDNET（NET），配置见 [[re-windbg]]「工具准备」
- 验证: 内核会话
lm能看到目标驱动模块，.reload /f <驱动名>加载符号
符号
- Microsoft 公共符号:
srv*C:\symbols*https://msdl.microsoft.com/download/symbols - 驱动自带 PDB: 与 .sys 同名放符号路径，
.reload /f生效 - 验证:
!process 0 0输出带nt!符号前缀函数名
测试签名（VM 内加载驱动）
- 目标机（调试 VM）管理员：
bcdedit /set testsigning on重启生效（需关闭 Secure Boot）——测试签名驱动才能加载 - 验证:
bcdedit /enum {current}里 testsigning 为 Yes；!drvobj能看到加载的驱动 - 注意: 生产机/加固环境不开测试签名；分析只在调试 VM 内做（见 [[gotchas]]）
操作步骤
按顺序执行，每步存档（驱动 sha256、IRP 表截图/笔记，[[re-triage]] 存证）。
-
驱动入口 DriverEntry 定位：
- PE 入口（AddressOfEntryPoint）= 链接器入口，.sys 通常即 DriverEntry（或 EP 处 stub 一跳进入，见坑 5）
- 签名特征:
DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)（x64 参数 rcx/rdx）；返回 STATUS_SUCCESS 才加载成功，失败路径常含 IoDeleteDevice 清理 - DriverEntry 还常注册
DriverUnload（卸载时清理/撤销 IOCTL）——恶意驱动常留空实现防卸载 - 从 DriverEntry 追踪:
IoCreateDevice调用、注册 MajorFunction 的数组赋值循环——这就是分发表的来源
-
IRP 分发表（MajorFunction）：
- DriverObject->MajorFunction 是 28 项的函数指针数组（IRP_MJ_* 0x00-0x1B；x64 偏移 0x70，用符号字段名即可）——DriverEntry 里逐项赋值或整段
RtlCopyMemory - 对每项非默认 handler 反编译（签名
NTSTATUS (*)(PDEVICE_OBJECT, PIRP)） - 关注顺序:
IRP_MJ_DEVICE_CONTROL（0x0E，用户态交互）、IRP_MJ_INTERNAL_DEVICE_CONTROL（0x0F）、IRP_MJ_CREATE（0x00）/IRP_MJ_CLOSE（0x02）、IRP_MJ_READ（0x03）/IRP_MJ_WRITE（0x04） - 每个 handler 里看:
IoGetCurrentIrpStackLocation(irp)取参数 → 分支处理（IOCTL 码分派） - handler 内先看参数校验（InputBufferLength/OutputBufferLength 检查）——长度校验缺失是驱动类漏洞常见成因（漏洞面分析转 [[re-vuln]] 思路）
- DriverObject->MajorFunction 是 28 项的函数指针数组（IRP_MJ_* 0x00-0x1B；x64 偏移 0x70，用符号字段名即可）——DriverEntry 里逐项赋值或整段
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 120 lines · 43 tokens per session scan A 6ac448fcda6a
re-kernel is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 43 tokens to every session and 3,720 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.