Skip to content
cccskills
FreePublished on GitHub

recover-decompiler-failures

Use when Ghidra, decompile_failures.tsv, failed decompilation, packed stubs, bad function boundaries, unwind fragments, overlapping varnodes, or native binary reverse engineering needs fallback recovery with radare2/r2dec/assembly classification.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5 stars(GitHub 5 + cccskills 0)

Run score Not tested

See how to install

Files included (1)

  • SKILL.md2.7 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Recover Decompiler Failures

Core Rule

Treat a decompiler failure as a triage problem, not as proof the code is unrecoverable. First recover what another tool can emit; then classify the rest as packed/loader stub, unwind/bad-code fragment, bad boundary, or manual assembly.

Workflow

  1. Confirm the failing targets:
    • For Ghidra exports, scan decompile_failures.tsv and summary.txt.
    • Check duplicate library hashes before rerunning identical failures.
  2. Run the bundled script:
    python3 /root/.codex/skills/recover-decompiler-failures/scripts/recover_decompiler_failures.py \
      <ghidra-decompiled-root> \
      --out <output-dir> \
      --install-r2dec
    
  3. Read <output-dir>/recovery-report.tsv and <output-dir>/recovery-report.md.
  4. Use recovered *.r2dec.c when classification is recovered-pseudocode.
  5. Use *.radare2-pdc.txt only as low-confidence pseudo-code unless the control flow is coherent.
  6. For packed-or-loader-stub and unwind-or-bad-code-fragment, keep assembly as source of truth unless the user asks for manual unpacking or boundary cleanup.

Tool Choices

  • Prefer Ghidra output when it exists.
  • Use r2dec (pdd) for overlapping varnodes, bad Ghidra simplification, and ordinary function-boundary issues.
  • Use radare2 pdc as a fallback when r2dec cannot emit C.
  • Use assembly for packed startup/decompression stubs, invalid-instruction-heavy fragments, and exception unwind fragments.
  • Do not waste time repeatedly decompiling byte-identical DLLs. Reuse results and record the reuse.

Scripts

  • scripts/recover_decompiler_failures.py: scans Ghidra export folders or a single failure set, runs radare2/r2dec fallbacks, copies relevant assembly, dedupes identical binaries, and writes reports. Run --help for flags.

Common Failure Meaning

  • Exception while decompiling ... timeout on entry stubs with PUSHAD, POPAD, MOVS*.REP, jumps to empty/uninitialized regions: likely packed/loader/decompression stub.
  • Unwind@..., invalid opcodes, privileged I/O instructions, or nonsensical dense control flow: likely unwind table or data misidentified as code.
  • Overlapping input varnodes or Cannot properly adjust input varnodes on otherwise coherent functions: try r2dec; this is the best alternative-decompiler case.
  • Zero functions discovered in a PE DLL is not a failure by itself; preserve metadata/import/export/string indexes.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

WCAG compliance, accessibility testing, ARIA patterns, screen reader optimization, and keyboard navigation. Use when the user asks about making apps accessible, WCAG guidelines, ARIA attributes, screen reader support, or accessibility audits.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

Generate AI music using ACE-Step 1.5 via ACE Music's free API. Use when the user asks to create, generate, or compose music, songs, beats, instrumentals, or audio tracks. Supports lyrics, style prompts, covers, and repainting. Free API, no cost.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

A continuously adaptive skill suite that empowers Clawdbot to act as a versatile coder, business analyst, project manager, web developer, data analyst, and NAS metadata scraper. It intelligently discovers free resources, adapts to user context, and ensures reliable, proven guidance across multiple domains.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

High-fidelity intelligence gathering and data assimilation. Focuses on synthesizing fragmented data into a comprehensive target operational picture.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

Use when Codex needs proactive task queues, heartbeat routines, scheduled follow-up, or continuous work loops instead of waiting for prompts.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

See all skills by ProjectZeroDays

Report a problem with this skill