Results for “hex”

Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA, or investigate a Windows Script Host dropper.

The English summary is being prepared. Showing the original description.

Analyzes malicious PDF documents: parsing the object structure for JavaScript, OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious streams without opening the document in a reader. Activates for requests to analyze a malicious PDF, inspect PDF JavaScript, or extract embedded payloads from a PDF.

The English summary is being prepared. Showing the original description.

Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with embedded payloads behind fake buttons, and HTML smuggling pages that reconstruct payloads in the browser from embedded blobs. Activates for requests to analyze a malicious OneNote file, detect HTML smuggling, or extract a smuggled/embedded payload.

The English summary is being prepared. Showing the original description.

Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.

The English summary is being prepared. Showing the original description.

Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a command from a .lnk.

The English summary is being prepared. Showing the original description.

Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.

The English summary is being prepared. Showing the original description.

Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.

The English summary is being prepared. Showing the original description.

Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by inventorying the archive, reading the manifest entry point, detecting obfuscators and string encryption, and flagging suspicious runtime, reflection, and networking class usage. Activates for requests to analyze a malicious JAR, inspect Java malware, or identify a Java RAT.

The English summary is being prepared. Showing the original description.

Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. Activates for requests to analyze an infostealer, identify targeted credential stores, or map stealer collection and exfiltration behavior.

The English summary is being prepared. Showing the original description.

Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build.

The English summary is being prepared. Showing the original description.

Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.

The English summary is being prepared. Showing the original description.

Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. Activates for requests to analyze a .NET sample, decompile MSIL, or unpack a managed loader.

The English summary is being prepared. Showing the original description.

Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.

The English summary is being prepared. Showing the original description.

Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. Activates for requests to analyze compiled Python malware, unpack a PyInstaller binary, or extract pyc modules from a frozen Python executable.

The English summary is being prepared. Showing the original description.

Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.

The English summary is being prepared. Showing the original description.

Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.

The English summary is being prepared. Showing the original description.

Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.

The English summary is being prepared. Showing the original description.

I Ching (易經) expert covering hexagram interpretation, traditional wisdom, and consultation methods

The English summary is being prepared. Showing the original description.

Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.

The English summary is being prepared. Showing the original description.

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use when architecting complex backend systems or refactoring existing applications for better maintainability.

The English summary is being prepared. Showing the original description.

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use when architecting complex backend systems or refactoring existing applications for better maintainability.

The English summary is being prepared. Showing the original description.

Master proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design to build maintainable, testable, and scalable systems.

The English summary is being prepared. Showing the original description.

Domain-Driven Design system for software development. Use when designing new systems with DDD principles, refactoring existing codebases toward DDD, generating code scaffolding (entities, aggregates, repositories, domain events), facilitating Event Storming sessions, creating bounded context maps, or performing code reviews with a DDD lens. Covers both strategic design (bounded contexts, subdomains, context maps, ubiquitous language) and tactical design (entities, value objects, aggregates, domain services, repositories). Supports all major architecture patterns (Hexagonal/Ports & Adapters, CQRS, Event Sourcing, Clean Architecture) with language-agnostic guidance and concrete examples in Python and TypeScript.

The English summary is being prepared. Showing the original description.

Analyze a local codebase and infer the architecture it is actually using, including repo kind, best-fit dominant architecture, directly evidenced coexisting patterns, major subsystem exceptions, confidence, docs-vs-code drift, and repo-fit hints for downstream agents. Use when prompts ask what architecture a repo uses, whether it is really hexagonal or just layered, what subtle patterns shape a repo or slice, how a target slice fits a hybrid monorepo, whether documented architecture matches implementation, or when `/tw-tk` needs a repo-dialect preflight before making a minimal change.

The English summary is being prepared. Showing the original description.