Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-x64dbggit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-x64dbg)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-x64dbg"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-x64dbg/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-x64dbg"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-x64dbg.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.03677 |
| Opus 5 | $0.00019 | $0.01839 |
| Sonnet 5 | $0.00008 | $0.00735 |
| Haiku 4.5 | $0.00004 | $0.00368 |
Grade A, and why
re-x64dbg scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x64dbg 动态调试（Windows）
何时使用 / 何时不用
- 用：Windows 原生目标（PE）动态调试；attach/启动/断点/内存搜索；脱壳后 Scylla 修复 IAT
- 不用：Linux 目标（走 [[re-gdb]]）；macOS 目标（[[re-lldb]]）；WSL 内分析（跨边界不可 attach，见 [[platform-tips]] WSL 分支）
- 不用：只读内存不交互（Windows 侧用 procdump/DumpIt + Volatility，见 [[platform-tips]] Windows 分支）
- 不用：无 UI 的自动化跑批/大量脚本操作（重活交给命令框与脚本，见 [[commands]]）
- 用：需要寄存器/内存级证据链的验证场景（授权校验路径、解密时刻、调用参数），动态结论落 [[analysis-contract]]
工具准备
参考 [[platform-tips]] Windows 分支——attach 需要管理员权限；内存转储工具链 procdump/DumpIt。
x64dbg
- 下载: GitHub
x64dbg/x64dbgrelease（zip 解压即用，x64dbg.exe；同包内 x32dbg.exe 管 32 位目标） - Windows:
choco install x64dbg - 验证: 打开 x64dbg.exe，
File > Open加载任意 exe 能停在入口 - 版本: 2023 年 v1.0 为唯一正式稳定版；2025.06.30 起改 CalVer 大版本（类型系统重做、AVX-512、脚本引擎重写）；快照版（dev 滚动）比 release 新但有回归风险——正式分析用 release，详见 [[gotchas]]
- 界面三件套: CPU 视图（反汇编/寄存器/内存/栈四窗格）、底部命令框（表达式+命令，见 [[commands]]）、视图切换 Alt+C / Alt+M / Alt+B 等
Scylla（IAT 修复插件）
- 新版 x64dbg 官方 release 已内置（插件目录 plugins/ 下有 Scylla，Ctrl+I 打开）
- 独立版: GitHub
NtQuery/Scyllarelease - 验证: x64dbg 插件菜单出现 Scylla，能 Attach 到进程并列出模块
OllyDbg（旧 32 位）
- 下载: 官网 ollydbg.de（仅 32 位，x64dbg 出现前的主力）
- 验证: 打开加载 32 位 exe 正常
- 注意: 插件/脚本/数据库与 x64dbg 不通用（见 [[gotchas]]）
操作步骤
-
附加与启动两种模式（先选对入口方式）：
- 启动（
File > Open/ F3 / 拖拽 exe 到窗口）：调试器从进程创建就接管，默认停在系统断点（ntdll）；Alt+F9跑到用户代码 - 断点时机:
Options > Settings > Events标签可勾选 System/Entry Breakpoint、System/User TLS Callbacks、DLL Load/Unload、Thread Create/Exit、Exit Breakpoint——需要断入口前逻辑（TLS 回调、构造函数、DLL 加载）时在这里开对应事件，错过无法重放 - 附加（
File > Attach/ Alt+A，管理员权限）：进程已在运行，早期初始化已执行完——防调试/防附加逻辑可能已跑过，错过就补不回来；多线程进程附加后先 F12 暂停再下断，避免线程竞态；结束用detach/Alt+F2 - 无窗口服务/后台进程: attach 后按进程名/pid 过滤
- 动态前先静态初勘: [[re-triage]] 哈希/壳识别 → [[re-format-pe]] 看节区权限与入口——决定断点下在哪、要不要先处理反调试
- 附加失败（权限/保护）见坑 1、3
- 启动（
-
断点族：
F2地址/符号处软断点（INT3）；Shift+F2条件断点，例:[401000]==0x90（仅当内存值满足）、eax==0x1000；断点窗口Alt+B管理（Space 启停、Delete 删除、双击改条件/日志）- 硬件断点: 选中行右键 > Hardware breakpoint（执行/读/写），或命令
bph——走 DR 寄存器，最多 4 个，可断数据访问，不修改代码字节（抗完整性校验） - 内存断点:
Alt+M内存窗口选中区域右键 > Set Memory BPX（访问/写入触发，GUARD_PAGE 实现）——查密钥解密时刻、脱壳自解密代码常用 - 日志/命令断点: 断点窗口右键设 log 表达式与命中命令，不中断只记录——批量验证调用参数
- 断点不命中先查模块加载:
Alt+E模块窗口看目标模块是否已加载；跨重载下断点用API名或模块.函数形式（如bp kernel32.VirtualAlloc），模块重载后自动生效
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 121 lines · 39 tokens per session scan A 7b50077f7a41
re-x64dbg is a skill published in the GitHub repository dslsdzc/rev-skills (54 stars, last pushed 14d ago), licensed Apache-2.0. It adds 39 tokens to every session and 3,677 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or…
conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.