Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hypnguyen1209/offensive-claude --skill reverse-engineeringgit clone --depth 1 https://github.com/hypnguyen1209/offensive-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hypnguyen1209/offensive-claude/reverse-engineering)<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/reverse-engineering"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/reverse-engineering.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.03342 |
| Opus 5 | $0.00041 | $0.01671 |
| Sonnet 5 | $0.00016 | $0.00668 |
| Haiku 4.5 | $0.00008 | $0.00334 |
Grade A, and why
reverse-engineering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reverse Engineering
When to Activate
- Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
- Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
- Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
- Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
- Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
- Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
- Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.
Technique Map
| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| Binary triage (format/arch/mitigations/strings/imports) | T1592.002, T1518.001 | CWE-1395 | references/static-triage-decompilation.md | scripts/triage.py |
| Headless decompilation (Ghidra 11.4 / r2 / IDA) | T1592.002 | CWE-noinfo | references/static-triage-decompilation.md | scripts/triage.py |
| AI/MCP-assisted RE (Sidekick / GhidrAssistMCP / LLM4Decompile) | T1592.002 | CWE-noinfo | references/static-triage-decompilation.md | - |
| Dynamic debugging (GDB/GEF, x64dbg, conditional bps) | T1622 | CWE-noinfo | references/dynamic-instrumentation.md | - |
| Frida 17 instrumentation + SSL-pin/JNI hooking | T1622, T1562.001 | CWE-noinfo | references/dynamic-instrumentation.md | scripts/frida_universal.js |
| Symbolic / concolic execution (angr, Triton) | T1480.001 | CWE-noinfo | references/dynamic-instrumentation.md | scripts/deflatten_triton.py |
| Anti-debug detection & bypass (PEB/ptrace/HW-bp/timing) | T1622, T1497.001 | CWE-noinfo | references/anti-reversing-bypass.md | scripts/antidebug_unhook.py |
| Anti-VM / sandbox-evasion neutralization | T1497, T1497.003 | CWE-noinfo | references/anti-reversing-bypass.md | scripts/antidebug_unhook.py |
| Packer unpack → OEP dump (UPX/runtime packers) | T1027.002, T1620 | CWE-noinfo | references/anti-reversing-bypass.md | scripts/antidebug_unhook.py |
| String / API-hash deobfuscation (Unicorn emulation) | T1027.013, T1140, T1027.007 | CWE-noinfo | references/deobfuscation.md | scripts/string_decrypt_emu.py |
| OLLVM control-flow-flattening de-flattening | T1027.009, T1027 | CWE-noinfo | references/deobfuscation.md | scripts/deflatten_triton.py |
| VM-protector devirtualization (VMProtect 3.x / Themida) | T1027.009 | CWE-noinfo | references/deobfuscation.md | scripts/deflatten_triton.py |
| Firmware extraction (binwalk/squashfs/QEMU emulation) | T1542.001 | CWE-1263 | references/firmware-uefi.md | scripts/uefi_triage.py |
| UEFI/BIOS RE + Secure Boot bypass research | T1542.001, T1542.003 | CWE-347 | references/firmware-uefi.md | scripts/uefi_triage.py |
| Patch diffing → n-day root cause (BinDiff/Diaphora/ghidriff) | T1203, T1592.002 | CWE-noinfo | references/patch-diffing-protocol.md | scripts/patchdiff_fetch.py |
| Protocol / file-format inference (Netzob/Kaitai) | T1592.002 | CWE-noinfo | references/patch-diffing-protocol.md | scripts/proto_infer.py |
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/anti-reversing-bypass.md 7.7 KB
- references/coverage-reachability.md 3.2 KB
- references/deobfuscation.md 8.6 KB
- references/dynamic-instrumentation.md 7.9 KB
- references/firmware-uefi.md 8.6 KB
- references/patch-diffing-protocol.md 8.4 KB
- references/rr-time-travel.md 3.1 KB
- references/static-triage-decompilation.md 8.2 KB
- scripts/antidebug_unhook.py 5.9 KB runs code
- scripts/cve_diff.py 9.6 KB runs code
- scripts/deflatten_triton.py 5.9 KB runs code
- scripts/frida_universal.js 8.3 KB runs code
- scripts/ghidra/DecompileToC.java 1.8 KB
- scripts/patchdiff_fetch.py 5.3 KB runs code
- scripts/proto_infer.py 7.1 KB runs code
- scripts/rr_root_cause.sh 3.3 KB runs code
- scripts/string_decrypt_emu.py 6.0 KB runs code
- scripts/triage.py 9.2 KB runs code
- scripts/uefi_triage.py 6.2 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 127 lines · 81 tokens per session scan A 06fab97c2abc
reverse-engineering is a skill published in the GitHub repository hypnguyen1209/offensive-claude (355 stars, last pushed 20d ago), licensed MIT. It adds 81 tokens to every session and 3,342 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audit-ppmplugin
Statically audit a built .ppmplugin before wrap testing. Checks archive layout, manifest compatibility, bundle consistency, Android DEX integrity and SDK leakage, iOS framework structure, native source-to-receiver alignment, and the PCF composite-key/sendAsync transport contract. Reports CRITICAL, WARNING, and INFO…
debug-extension
Diagnose and fix failures in a built third-party .ppmplugin control: crashes, silent no-ops, PCF error outputs, or incorrect behavior. Uses the reported symptom, shared/error-codes.md, and file-level evidence to trace the manifest, Android/iOS modules, PCF dispatch, and build configuration. Produces a ranked…
generate-ppmplugin-manifest
Validate, reconcile to the chosen target(s), and stage the manifest.json for a .ppmplugin bundle. In the normal flow the committed ./manifest.json already exists (authored by /generate-native-extension), so this stage reads it, runs the plugin's upload-compatibility checks locally as a pre-flight gate (name regex…
diagnose
Root-cause a failing or wrong empirical result with a disciplined reproduce → minimise → hypothesise → instrument → fix loop, instead of guessing-and-poking. Use when the user says "why is my regression wrong", "this number changed", "my script errors out", "the result won't reproduce", "debug this", "this estimate…
exploiting-linux-kernel-vulnerabilities
Methodology for discovering and exploiting Linux kernel memory-corruption vulnerabilities (UAF, OOB read/write, race/TOCTOU, type confusion) during authorized engagements, covering reachability analysis, building stable read/write primitives from a single bug, defeating KASLR/SMEP/SMAP/KPTI, slab/buddy heap grooming…
exploiting-format-string-vulnerabilities
Methodology for exploiting format string bugs where attacker-controlled data reaches the format argument of printf-family functions, enabling stack/memory disclosure (info leaks for ASLR/PIE/canary defeat) and arbitrary write primitives (%n) to hijack control flow via GOT/.finiarray overwrites.