Borrowing it
Nothing to install: this file belongs to dslsdzc/rev-skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dslsdzc/rev-skills/main/.claude/skills/re-shellcode/SKILL.mdgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-shellcode)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-shellcode"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-shellcode/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-shellcode"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-shellcode.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.03941 |
| Opus 5 | $0.00022 | $0.01971 |
| Sonnet 5 | $0.00009 | $0.00788 |
| Haiku 4.5 | $0.00004 | $0.00394 |
Grade A, and why
re-shellcode scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Shellcode 分析
何时使用 / 何时不用
- 用：拿到的是"裸代码 blob"（无 PE/ELF/Mach-O 文件头）——漏洞利用载荷、文档/脚本解出的第二层载荷、释放器写进内存的代码
- 用：载荷带自解码（XOR/ROL 解码循环、msfvenom 类编码器生成）——静态看是乱码，需要先还原再分析
- 用：需要"无环境跑起来"验证载荷行为（架构不匹配/无宿主进程/不想在真实进程触发）——Unicorn 模拟
- 用：回答"这段代码调用哪些 API、想干什么"（API hash 解析）
- 不用：有文件格式头的完整程序（那是 [[re-binary-core]] 域）
- 不用：只需初勘结论（file/hash/熵，那是 [[re-triage]]）
- 注意：模拟执行属动态执行，默认在沙箱内进行（[[re-analyze/platform-tips]] 最高原则）；纯静态提取/解码分析可免沙箱，但把解码产物落盘后真实执行验证时必须进 [[re-sandbox]]
工具准备
所有工具先验证再使用。本技能静态解码可免沙箱；模拟执行默认沙箱内进行（[[re-analyze/platform-tips]] 最高原则）。
python3 —— 解码/模拟脚本运行环境
- Linux:
apt install python3 python3-pip/dnf install python3 python3-pip/pacman -S python python-pip（多数自带） - macOS:
brew install python（或 Xcode CLT 自带）；Windows: python.org 安装包（勾选 Add to PATH）或choco install python；WSL 内 Linux 版 - 验证:
python3 --version
unicorn —— 模拟执行主力（pip，Python 3）
- 全平台:
pip install unicorn（Python 3） - 验证:
python3 -c "import unicorn; print(unicorn.__version__)"
capstone —— 反汇编输出（pip，Python 3）
- 全平台:
pip install capstone - 验证:
python3 -c "import capstone; print(capstone.__version__)"
binwalk —— 从宿主文件里扫出嵌入 blob
- Linux:
apt install binwalk/dnf install binwalk/pacman -S binwalk - macOS:
brew install binwalk - Windows: WSL 内 Linux 版（或 GitHub release 预编译 exe）
- 验证:
binwalk --help
xxd —— 十六进制查看/特征定位
- Debian/Ubuntu:
apt install xxd（新版独立包，旧版在 vim-common）；Fedora:dnf install xxd（F38+ 独立子包，旧版 vim-common）；Arch:pacman -S xxd - macOS: 自带（vim 附送）；Windows: 无自带——用 WSL 或 PowerShell
Format-Hex - 验证:
xxd -v
objdump（binutils）—— 裸二进制反汇编扫描
- Linux:
apt install binutils/dnf install binutils/pacman -S binutils（多数发行版预装） - macOS: 自带；Windows: 用 rizin 或 Ghidra 替代
- 验证:
objdump --version
反汇编器 —— 按 RE_DECOMPILER 或环境选
- [[re-radare2]]（rizin，命令行/低内存，Raw Binary 支持好，推荐）；[[re-ghidra]]（GUI，Import File → Raw Binary 选架构）
- 安装与验证见对应技能工具准备
scdbg —— 可选（shellcode 调试器）
- GitHub 检索
Nypreo/scdbgreleases 下载（Windows 可执行文件；Linux 可在 Wine 下运行，或直接用 Unicorn 方案替代） - 验证:
scdbg.exe -f blob.bin能输出反汇编与模拟结果
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines ae5c0ec35601
- 9d ago First seen · 185 lines · 43 tokens per session scan A ac4a34e20f89
re-shellcode is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed today), licensed Apache-2.0. It adds 43 tokens to every session and 3,941 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-arm-binaries
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.