Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-variantgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-variant)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-variant"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-variant/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-variant"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-variant.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.03077 |
| Opus 5 | $0.00036 | $0.01538 |
| Sonnet 5 | $0.00014 | $0.00615 |
| Haiku 4.5 | $0.00007 | $0.00308 |
Grade A, and why
re-variant scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
二进制变体/补丁对比
何时使用 / 何时不用
- 用：补丁前后对比（漏洞定位）、家族变体关联、样本溯源、N-day 分析
- 用：同源代码复用识别（共享函数/库代码判断）
- 用：修复覆盖审计——多分支版本逐一对比修复样本，核对哪些版本修了、哪些没修
- 用：漏洞研究——修复前后结构与行为差异的完整还原（补丁 → 缺陷模式）
- 不用：单样本深度分析（走 [[re-binary-core]] 通用路径）
- 不用：无对比基线（只有单个样本、无第二版本可对比）——先走单样本路径
- 不用：行为层面比较（动态行为差异走 [[re-behavior]]；本技能只比静态代码结构）
- 不用：需要语义级还原的对比（先 [[re-cpp-abi]] 还原 ABI/符号语义，再回到本技能做差异定位）
工具准备
BinDiff / Diaphora（函数匹配插件）
- BinDiff（Google/Zynamics 系，Windows 商业工具，官方安装包）：IDA 插件为主；BinDiff 6 起官方支持 Ghidra（需 BinExport 插件导出）；BinExport 亦支持 Binary Ninja——导出格式可桥接多反编译器
- Diaphora: 多平台开源（
git clone https://github.com/joxeankoret/diaphora），IDA 插件为主（Ghidra 侧支持持续推进中） - 无 IDA 环境替代：qbindiff（Quarkslab，读 BinExport/quokka 导出）、ghidriff（headless Ghidra 对比）
- 典型流程: 反编译器内 BinExport 导出 → 工具载入两样本 → 匹配 → 结果（相似度/变更集）导出为报告；BinExport 插件与反编译器版本需匹配（见 [[gotchas]]）
- 验证: 插件在反编译器内可加载，能导出/导入匹配结果
radiff2 / rz-diff（rizin 命令行对比）
- Linux:
apt install rizin/pacman -S rizin；macOS:brew install rizin；Windows: 官方安装包 - 验证:
rz-diff --version；radiff2 随 radare2 包（apt install radare2类） - 用途: 无 GUI 的快速函数级对比与批量脚本化（见步骤 1 命令）；radiff2 做字节/指令级快查（
radiff2 -s字节、-C指令）——小文件快查用，函数级对比用 rz-diff
readelf（符号对齐辅助）
- 安装与验证见 [[re-cpp-abi]] 工具准备
- 用途:
readelf -s（符号表/动态符号）与readelf -d（动态节）做导入导出对齐与配对核对
配对辅助（对比前置）
- 哈希/基线:
sha256sum；架构/编译器判定: [[re-imports]] 导入表与工具链指纹——配对前先确认可比性（同架构/同工具链，见坑 1、3） - 验证:
sha256sum --version - 壳检查: [[re-packer-id]] 识别加壳；加壳样本先脱壳（[[re-unpack-simple]]）再对比——壳代码会污染匹配（见 [[gotchas]] 反例组）
操作步骤
按顺序执行，每步产物存档（路径 + sha256，见 [[re-triage]]）；最终差异清单按 [[analysis-contract]] 数据契约传递。
-
配对准备（先确认可比性再对比）：
- 记录基线：两样本的 sha256、架构（x86_64/ARM 等）、位数、编译器指纹（版本字符串/导入库集合，[[re-imports]]）
- 可比性判定：同架构 + 同工具链 → 函数级全量匹配；跨架构/异编译器 → 降级为逻辑层对比（调用图/常量/字符串），标注局限
- 位数/字节序：32/64 位混合或大小端混合不直接比——统一到同位数同字节序再匹配
- 符号状态：strip/未 strip 决定匹配策略（未 strip 直接符号对齐，见步骤 2）
-
函数匹配：
# 命令行快速对比（rizin 系）：函数级匹配（-B 自动分析后按函数对比，含相似度列） rz-diff -B -t functions sample_v1 sample_v2 | head -30- 匹配维度：指令哈希（相同代码）、调用图（子图同构）、导入导出对齐、字符串/常量引用
- 数据引用维度：全局常量/字符串引用作函数身份指纹——重构/重排后比指令哈希稳定，跨版本匹配的可靠锚点
- 工具（BinDiff/Diaphora）输出：matched / changed / new / deleted 函数集
- 输出解读：matched 相同、changed 变化、new/deleted 功能增减——changed 进步骤 3，new/deleted 提示功能面差异，逐类给后续动作
- strip 后符号缺失：靠结构匹配（入口特征/调用模式/常量锚定）——匹配维度权重调整见坑 1 与 [[decision-tree]]
- 地址差异处理：PIE/重定位后函数地址不同——按符号名/函数序对齐，不比裸地址（见坑 2）
- 名称/注释迁移：工具支持把已命名函数的名称/注释迁移到匹配函数——已知样本先标注再对比，半自动还原新样本符号；迁移名称标注来源，仅作辅助锚点（见 [[gotchas]] 符号组）
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 119 lines · 72 tokens per session scan A 9ae6a8e0c95e
re-variant is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 72 tokens to every session and 3,077 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.