142 skills · sorted by relevance
固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。
The English summary is being prepared. Showing the original description.
Embedded firmware development for microcontrollers including memory-mapped I/O, GPIO, interrupts, timers, UART/SPI/I2C serial protocols, PWM generation, ADC sampling, interrupt-driven versus polled architectures, RTOS fundamentals, and the bring-up sequence from power-on reset through first printf. Covers AVR/Arduino, ARM Cortex-M, and ESP32 patterns. Use when writing, porting, debugging, or reviewing firmware that directly manipulates hardware peripherals.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs, and device-facing trust boundaries. Use when the user asks to unpack firmware, map partition layout, inspect bootloader or init chains, recover update keys or credentials, trace config loading, or explain how a device surface reaches the decisive artifact. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Core firmware context for the Megahub ESP32 project. Use when working on PlatformIO configuration, build scripts, library structure, main.cpp, or general ESP32 firmware development. Covers build system, project structure, common pitfalls, and debugging.
The English summary is being prepared. Showing the original description.
Investigate shipped applications, binaries, packages, and firmware with REA to explain features, compare versions, or guide reconstruction. Use decompiled code and runtime observations where needed, keeping observed facts, inferred behavior, and unresolved questions clearly separated.
Verify RuView changes with Rust and Python tests, output hashes that detect processing changes, and firmware hash records. Packages test logs and audit evidence into a witness bundle that recipients can check with a single command.
Detect and classify unusual readings from Cognitum Seed devices, including spikes, flatlines, and drift. Review anomaly scores, recommend quarantine for scores above 0.9, and save detected patterns for future reference.
Develop firmware and drivers for ARM Cortex-M microcontrollers, including Teensy, STM32, nRF52, and SAMD. Get complete modules with initialization and usage examples, plus guidance on interrupts, memory handling, data transfers, performance, and fault diagnosis.
Audit Secure Boot settings, revoked boot components, and EFI startup files on Linux and Windows. The skill helps identify missing protections and signs of bootkits, malicious software that runs before the operating system.
Turn an electronics or IoT idea into a working breadboard prototype. Get board and software recommendations, a plan for viewing sensor readings, and time and cost ranges tailored to experience, budget, and location.
Evaluate older Wi-Fi clients and embedded devices for KRACK and FragAttacks vulnerabilities. Covers test suites, likely patch status, practical impact, and reporting findings by device, firmware version, and vulnerability identifier.
Use this skill when the user is doing hands-on host-side DOCA PCC work to load a CUSTOM Programmable Congestion Control algorithm onto a BlueField DPU — creating per-port `doca_pcc` contexts, loading a `dpacc`-compiled `doca_pcc_app` onto the `doca_dev` for the RoCE-bearing port, parameterizing it, walking triple-axis capability discovery (DOCA cap-query + DPA-capable BlueField + firmware custom-PCC slot enabled), or debugging `DOCA_ERROR_*` from `doca_pcc_*`. Trigger even without explicit "DOCA PCC" phrasing — implicit forms include "loading my own congestion control onto a BF port", "DOCA_ERROR_NOT_PERMITTED on algorithm load", "DOCA_ERROR_DRIVER when I attach my custom algorithm", "my custom rate-update isn't affecting RoCE traffic", or "load succeeds but no on-wire change". Refuse and route elsewhere for DPA-side algorithm-body design, the `pcc_counters` CLI, default factory PCC in ConnectX firmware, or setting up the RDMA / RoCE traffic — those belong to other skills.
The English summary is being prepared. Showing the original description.
Use this skill when the user is invoking the DOCA PCC Counters tool — the `pcc_counters.sh` bash script under the DOCA tools directory — to arm and read the fixed firmware/hardware PCC (Programmable Congestion Control) diagnostic counters (CNP, RTT, WRED-drop, etc.) on a ConnectX / BlueField device via mst + the mlx5 debugfs `diag_cnt` interface. The script takes two positional args — `set | query` and an mst device path — with no `--help` or subcommands. Trigger even without "pcc_counters.sh" or "PCC counters": "how do I read the CNP / RTT / WRED-drop counters", "PCC counter stuck at zero", "the script says Bad Device", or "is congestion control dropping packets on this port?". Route elsewhere for writing a custom PCC algorithm (doca-pcc), factory firmware PCC config, DOCA install, or fleet-wide CC tuning.
The English summary is being prepared. Showing the original description.
Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems. Use when you need to analyze firmware files, identify file types, or extract ext2/3/4 or F2FS filesystems.
The English summary is being prepared. Showing the original description.
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
The English summary is being prepared. Showing the original description.
@arm-cortex-expert workflow skill. Use this skill when the user needs Senior embedded software engineer specializing in firmware and driver development for ARM Cortex-M microcontrollers (Teensy, STM32, nRF52, SAMD) and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
The English summary is being prepared. Showing the original description.
@arm-cortex-expert workflow skill. Use this skill when the user needs Senior embedded software engineer specializing in firmware and driver development for ARM Cortex-M microcontrollers (Teensy, STM32, nRF52, SAMD) and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
The English summary is being prepared. Showing the original description.
ESPHome device configuration, firmware, and IoT product development. Covers ESP32, ESP32-S3, ESP32-C3, ESP32-C6, ESP32-H2, ESP32-P4, ESP8266, RP2040, RP2350, nRF52, LibreTiny, Shelly, Sonoff, Tuya, BLE proxy, Matter firmware, Thread, Zigbee, GPIO, sensor YAML, LVGL displays, LED strips, voice assistant hardware, device flashing, Arduino conversion, alarm_control_panel, lock, valve, media_player, microphone, speaker, audio DAC, event entities, datetime entities, Z-Wave proxy, MIPI DSI displays, and DLMS smart meters. Also covers designing new ESPHome-based products: hardware selection, component sourcing, PCB design (KiCad), enclosures, 3D printing, CE/FCC certification, BOM optimization, and manufacturing from prototype to production scale.
The English summary is being prepared. Showing the original description.
This skill integrates **Boxxy sandbox boundary testing** with the complete Trail of Bits firmware extraction methodology. Use this for extracting and analyzing firmware in heavily obfuscated, containerized, or restricted environments.
The English summary is being prepared. Showing the original description.
Use when a task needs the judgment of an Embedded/Firmware Engineer — analyzing worst-case execution time for a hard real-time deadline, choosing static over dynamic memory allocation to avoid fragmentation on a long-uptime device, keeping an interrupt service routine minimal and deferring work to the main loop, synchronizing a variable shared between an ISR and main context to prevent a torn read, or verifying a hardware register interaction against the datasheet's exact timing rather than observed bench behavior.
The English summary is being prepared. Showing the original description.
Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.
The English summary is being prepared. Showing the original description.
Embedded firmware setup: STM32, ESP32, AVR, RP2040, Nordic nRF, Zephyr/RTOS, vendor SDKs, CMake/CMakePresets, VS Code/clangd, cross toolchains, flash/debug, Docker/CI. Use for MCU scaffolds, existing firmware modernization, BSPs, linker/startup files, SDK package selection, and embedded CI; prefer cpp-project-setup for host-side C++.
The English summary is being prepared. Showing the original description.
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.
The English summary is being prepared. Showing the original description.
Verify RuView pipeline output against a reference hash, package evidence for others to check, and review accuracy statements. The skill distinguishes measured, claimed, and synthetic results and requires real device logs for hardware validation.