Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-packer-idgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-packer-id)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-packer-id"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-packer-id/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-packer-id"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-packer-id.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.02783 |
| Opus 5 | $0.00024 | $0.01392 |
| Sonnet 5 | $0.00010 | $0.00557 |
| Haiku 4.5 | $0.00005 | $0.00278 |
Grade A, and why
re-packer-id scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
壳与混淆器识别
何时使用 / 何时不用
- 用：拿到未知样本先确认是否加壳、确定壳名以选择脱壳路径；静态初勘发现熵高 / 节名异常 / 导入表极小（见 [[re-triage]] 输出）需要进一步确认
- 用：动态分析前判断"观察到的行为是壳的还是程序的"
- 不用：目标已是干净样本、直接看逻辑（转 [[re-binary-core]]）
- 不用：已知确切壳名、只差脱壳动作（直接 [[re-unpack-simple]] / [[re-unpack-advanced]]，识别步骤可跳过）
- 注意：识别不出 ≠ 无壳（签名库不全 / 小众壳），需用特征组合判断，必要时按未知壳走手动流程
工具准备
静态识别可免沙箱（[[platform-tips]] 最高原则：静态分析可免沙箱）；工具先验证再使用。
Detect It Easy（DIE，跨平台主力）
- Linux: 官方 GitHub release
Horsicq/Detect-It-Easy下载die_lin64_portable_<ver>.tar.gz解压即用（CLIdiec/ GUIdie）；Debian/Ubuntu 也可apt install die（仓库版较旧，签名库不全时用官方版） - macOS:
brew install --cask detect-it-easy - Windows: 官方 release
die_win64_portable_<ver>.zip解压，GUIdie.exe/ CLIdiec.exe - 验证:
diec --version
PEiD（Windows 老牌，补充 DIE）
- Windows 专用（Wine 下也可运行）：下载 PEiD 0.95（GitHub 镜像），建议配
PEiD 0.96/0.97签名库更新包；DIE 识别不出时用它交叉验证 - 验证: 打开 PEiD 加载样本能显示壳名 / 入口点特征
file / strings（初步特征）
- Linux:
apt install file binutils/dnf install file binutils/pacman -S file binutils - macOS: Xcode Command Line Tools 自带（
xcode-select --install） - Windows/WSL: WSL 内用 Linux 包
- 验证:
file --version、strings --version
熵计算（python3 为主，ent/binwalk 可选）
- python3:
apt install python3/ 多数系统自带；验证python3 --version - ent（可选）:
apt install ent/brew install ent；验证ent（无参打印 usage） - binwalk（可选，熵图）:
apt install binwalk/brew install binwalk；验证binwalk -E sample.exe | head
pefile（可选，PE 节/EP/导入表脚本）
- 全平台:
pip install pefile - 验证:
python3 -c "import pefile"
操作步骤
按顺序执行，每步记录结果（证据路径 + sha256，见 [[re-triage]]）。识别结论（壳名 / 未知壳 / 无壳 + OEP 线索）是脱壳路径的输入。
-
初步特征收集（file/strings）：
file sample.exe sha256sum sample.exe strings -n 6 sample.exe | head -30加壳样本通常：可读字符串极少、EP 附近有壳签名（UPX 头有
UPX!魔数、ASPack 等节名特征）；干净样本字符串丰富。 -
签名库扫描（DIE/PEiD）：
diec sample.exe # CLI 扫描；GUI 用 diePEiD（Windows）: 拖入样本，看壳名 / Entrypoint / Section / Overlay 四栏签名。结果三档：明确壳名（UPX 0.89~3.xx / ASPack / FSG / VMProtect…）、可疑特征（仅入口点或节名命中）、未识别。未识别不代表干净（见坑 1）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 133 lines · 48 tokens per session scan A 7f6897589f0b
re-packer-id is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 48 tokens to every session and 2,783 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.