Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
日本語の概要は準備中です。原文の説明を表示しています。
zhaoxuya520/reverse-skill4.2万2026年9月22日 更新
無料GitHub で公開
competition-malware-config
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
含まれるファイル（3）
- SKILL.md2.7 KB
- agents/openai.yaml376 B
- references/malware-config.md1.2 KB
SKILL.md（原文）
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Competition Malware Config
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the decisive value is not just "what the sample does," but which config fields, stages, or network parameters the sample hides and when they become plaintext.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Preserve the original sample before unpacking or patching.
- Separate loader, payload, config blob, and post-decode behavior.
- Rank candidate config blobs by entropy, field shape, nearby strings, and decode helpers.
- Record the exact transform chain for each recovered field.
- Reproduce the decoded config or beacon parameters from the smallest possible path.
Workflow
1. Find The Config Boundary
- Inspect sections, resources, embedded archives, strings, imports, and decode helpers.
- Identify where config is stored: resource, overlay, encrypted blob, registry seed, network bootstrap, or stage2 memory.
- Keep one note of when each value becomes plaintext.
2. Reconstruct The Decode Chain
- Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse.
- Group all config fields from the same chain together instead of treating them as unrelated clues.
- Preserve hashes, offsets, keys, IVs, masks, and parsed fields in one compact evidence block.
3. Tie Config To Behavior
- Show which field affects which branch: beacon path, mutex, wallet, bot id, campaign, tasking route, persistence name, or process target.
- Correlate decoded config with PCAPs, process trees, or stage2 strings when possible.
Read This Reference
- Load
references/malware-config.mdfor the config-hunting checklist, staged-sample checklist, and evidence packaging rules.
What To Preserve
- Original artifact, unpacked layer, dumped stage, and parsed config as separate artifacts
- Offsets, hashes, decode helpers, keys, masks, and field names
- The branch or protocol step each recovered field actually influences
レビュー
まだレビューはありません。使ってみた感想をお寄せください。
同じリポジトリのスキル
概要と使いどころ
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
日本語の概要は準備中です。原文の説明を表示しています。
zhaoxuya520/reverse-skill4.2万2026年9月22日 更新
Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.
日本語の概要は準備中です。原文の説明を表示しています。
zhaoxuya520/reverse-skill4.2万2026年9月22日 更新
跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。 适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。 核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。 触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。
日本語の概要は準備中です。原文の説明を表示しています。
zhaoxuya520/reverse-skill4.2万2026年9月22日 更新
Use for authorized binary analysis in Binary Ninja, including HLIL/MLIL/LLIL inspection, strings/imports/exports, cross-references, types, patch review, Python API automation, and optional Binary Ninja MCP or localhost HTTP integration.
日本語の概要は準備中です。原文の説明を表示しています。
zhaoxuya520/reverse-skill4.2万2026年9月22日 更新
统一自动化入口。覆盖浏览器自动化（Playwright）和 Windows 桌面应用自动化（OpenReverse）。 浏览器场景：打开网页、点击、填表、爬取、截图、自动化登录、渗透页面交互。 桌面场景：操作 IDA/x64dbg 等 GUI 工具、Windows UI Automation、视觉驱动交互、桌面应用网络抓包。 触发关键词：浏览器自动化、桌面自动化、打开网页、填表、爬取、截图、自动化登录、Playwright、agent-browser、headless、OpenReverse、UIA、CUA、桌面操作、Windows 自动化。
日本語の概要は準備中です。原文の説明を表示しています。
zhaoxuya520/reverse-skill4.2万2026年9月22日 更新