114건 · 관련도순
Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by inventorying the archive, reading the manifest entry point, detecting obfuscators and string encryption, and flagging suspicious runtime, reflection, and networking class usage. Activates for requests to analyze a malicious JAR, inspect Java malware, or identify a Java RAT.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. Activates for requests to analyze a .NET sample, decompile MSIL, or unpack a managed loader.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. Activates for requests to analyze compiled Python malware, unpack a PyInstaller binary, or extract pyc modules from a frozen Python executable.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and its crates.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys sample, or assess a BYOVD/kernel driver threat.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Automates radare2/rizin analysis through r2pipe to script function enumeration, string and import extraction, and cross-reference queries across samples programmatically. Activates for requests to automate radare2 with r2pipe, script rizin analysis, or batch-extract functions and xrefs from binaries.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Builds reusable malware configuration extractors by applying a declarative JSON spec (offsets, decode layers, field definitions) to a sample to produce structured, defanged config. Activates for requests to build a config extractor, write a reusable family config parser, or run a spec-driven configuration extraction.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Defeats control-flow-flattening obfuscation by identifying the dispatcher/state- variable structure and reconstructing the original control flow so the logic becomes readable. Activates for requests to defeat control-flow flattening, deobfuscate an OLLVM-flattened function, or recover original control flow from a dispatcher loop.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Recovers obfuscated strings and resolves dynamically loaded APIs in malware: reversing XOR/stack-string/encoding schemes and mapping API-hash lookups back to function names. Activates for requests to deobfuscate strings, decode stack strings, or resolve API hashing in a binary.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Compares two related malware samples to surface what changed between variants using section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for requests to diff two samples, compare malware variants, or measure similarity between two binaries for variant tracking.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Rebuilds a usable PE file from a memory dump by fixing the section alignment (virtual-to-raw), correcting the entry point, and preparing for import table reconstruction. Activates for requests to rebuild a dumped PE, fix a memory-dumped executable, or convert a process dump into an analyzable file.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Bypasses anti-VM and sandbox checks during analysis by locating the specific detection routines (artifact strings, timing, CPUID/hypervisor bit) and planning patches or environment hardening so the sample detonates. Activates for requests to bypass anti-VM checks, defeat sandbox detection, or make an evasive sample run for analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Apply this opinionated workflow when reverse-engineering legacy or undocumented systems: scope, explore the code, trace data flows, document in EARS format, flag uncertainties. For code archaeology, onboarding, and requirements extraction.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Local-only regression / benchmark skill for ui-clone-skills maintainers. Drives the standard ui-reverse-engineering pipeline against the canonical reference site (https://realfood.gov) and records AE/SSIM, iteration count, gate fail counts, and outcome to benchmark/history.csv so prompt / sub-doc / model-version drift surfaces as a trend. Trigger phrases: "run benchmark" / "regression benchmark" / "benchmark clone". The Makefile no longer has a `benchmark` target — setup is inline bash in this skill (Step 1 below). Internal: NOT registered in `.claude-plugin/plugin.json` `skills`. Not part of the public 3-skill marketplace surface. Maintainer tooling only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Clone or recreate a live website URL, page, or section as React + Tailwind with extracted DOM, CSS, assets, responsive layout, motion, and interactions. Use for live-URL implementation or fidelity repair; not capture-only or diff-only requests.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Plan and run safe reverse engineering, decompilation, disassembly, instrumentation, de-obfuscation, and anti-analysis countermeasures for binaries, firmware, mobile apps, WebAssembly, JavaScript bundles, and .NET assemblies. Use for behavior reconstruction, cross-layer Electron tracing, REA, reversing strategy, decompiler selection, binary analysis, malware-style triage, unpacking, deobfuscation, defeating anti-debug or anti-VM checks, Wakaru, Ghidra, IDA, RetDec, radare2, Rizin, Frida, angr, YARA, or command scripts that capture analysis stats.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reverse engineer and security-test Telegram bots — API analysis, callback interception, exploit discovery, and vulnerability documentation
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment, or ransomware decryption feasibility.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.