Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-loadergit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-loader)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-loader"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-loader/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-loader"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-loader.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.03099 |
| Opus 5 | $0.00024 | $0.01550 |
| Sonnet 5 | $0.00010 | $0.00620 |
| Haiku 4.5 | $0.00005 | $0.00310 |
Grade A, and why
re-loader scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
加载器 / 投放器分析（下载链 / 内存加载 / 模块拼接）
何时使用 / 何时不用
- 用：样本是"下载器/投放器"——体积小、动态获取后续载荷、运行时在内存里加载/拼接最终模块
- 用：多层载荷链（下载器 → 解压 → 内存加载 → 最终 RAT/勒索/挖矿）的逐层还原
- 用：反射式加载 / 进程空洞 / 模块拼接类投递技术分析
- 不用：样本本身就是完整载荷（静态可看到全部功能，走 [[re-triage]] / [[re-binary-core]]）
- 不用：只做静态字符串提取（先 [[re-triage]] 初勘，下载器特征不明显时静态先行）
- 注意：动态分析强制前置（[[re-sandbox]]，[[platform-tips]] 最高原则）——下载器必须运行才能观察下载链；网络隔离下分析
工具准备
所有工具先验证再使用。本技能是动态分析为主——运行环境与监控工具直接复用下列技能（装法见各技能），本技能额外补两个提取用工具。
动态环境（复用，运行强制前置）
- [[re-sandbox]]：VM 快照 + 网络隔离（INetSim 是下载链喂料的关键——模拟 HTTP 接收下载请求并可回放录制响应，坑 1）
- [[re-tracing]]：strace / ltrace / ProcMon / APIMonitor——下载、解压、进程操作的调用级跟踪
- [[re-behavior]]：procmon / sysdig / bpftrace——进程树、注入检测（进程空洞/APC/反射式加载）
- [[re-memdump]]：gcore 默认转储——内存中载荷提取
- 验证: 沙箱快照就绪 +
strace -V+gcore --help可用
python3 + pefile —— 内存模块解析/拼接校验（可选但常用）
- python3 装法见 [[re-proto-rev]] 工具准备
pip install pefile- 验证:
python3 -c "import pefile; print(pefile.__version__)"
pe-sieve / hollows_hunter —— Windows 内存进程扫描（可选）
- 来源: GitHub hasherezade/pe-sieve releases 与 hasherezade/hollows_hunter releases，解压即用（Windows）
- 用途: 扫描进程内存，提取反射式加载/进程空洞的 PE 模块（步骤 3 的自动化帮手）
- 验证:
pe-sieve.exe /?输出用法
载荷脱壳（复用）
- [[re-anti-analysis]]（[[re-packer-id]] / [[re-unpack-simple]] / [[re-unpack-advanced]]）：载荷落地后常加壳，脱壳产物回沙箱复跑验证
操作步骤
按顺序执行，每步记录证据（路径 + sha256，见 [[re-triage]]）；每层载荷的"来源"（URL/路径/内存偏移）与 sha256 是报告核心（[[re-ioc]]）。
-
初始样本识别（下载器 vs 完整载荷）：
file loader.bin && sha256sum loader.bin ls -la loader.bin # 下载器通常小（几 KB~几百 KB） strings -n 6 loader.bin | grep -iE 'http|url|download|temp|\.exe|\.dll' | head -30- 下载器特征：体积小、strings 含 URL/路径、导入表网络与解压 API 多（WinINet/WinHTTP/URLDownloadToFile、CryptAPI、RtlDecompressBuffer）；完整载荷反之（功能全在自身）
- 哈希先查 VT/社区（[[re-ti]]）确认家族与已有结论，别从零开始
- 判定为下载器 → 步骤 2；已经是完整载荷 → 转 [[re-binary-core]] 静态或 [[re-malware]] 行为
-
下载/解压链跟踪：
# Linux 沙箱内 strace -ff -o out -e trace=network,file,process ./loader.bin grep -E 'connect|sendto|openat|execve' out.* | head -50 # Windows 沙箱内: ProcMon 过滤 网络操作/文件写入/进程创建 三个类别- 网络: INetSim 记录样本请求的 URL 与参数（下载目标、User-Agent、分片参数）；断网拿不到后续层 → 把录制响应回放喂料（坑 1）
- 解压: 观察 RtlDecompressBuffer / 7z / Expand 类调用与临时文件写入路径（%TEMP% 常见）；每层产物
sha256sum存档 - 链不触发 → 反沙箱延迟/交互检测（坑 3），回 [[re-sandbox]] 环境伪装
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 119 lines · 48 tokens per session scan A ecbdecebe6fd
re-loader is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 48 tokens to every session and 3,099 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.