commit da24c2bd206830822af121457bf51692ef7fc3aa Author: baradok609hecl1pq6qi Date: Tue Oct 20 02:17:15 2026 +0300 reverse-skills-max: initial public release (restored, redacted, hardened) diff --git a/INDEX.md b/INDEX.md new file mode 100644 index 0000000..1bf37ec --- /dev/null +++ b/INDEX.md @@ -0,0 +1,154 @@ +# Каталог реверс-скиллов (чистая сборка, 2026-09-30) + +Всего скиллов с SKILL.md: **136**. Личные данные вычищены (см. README). + +## (root) + +- **dsl-vm-reverse** (`dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow. +- **firmware-reversing** (`firmware-reversing/`, 1 файлов) — 'Use for firmware and embedded device reverse engineering: firmware extraction +- **protocol-reverse-engineering** (`protocol-reverse-engineering/`, 1 файлов) — Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication. +- **reverse-engineering** (`reverse-engineering/`, 25 файлов) — Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker. +- **reverse-engineering-android-malware-with-jadx** (`reverse-engineering-android-malware-with-jadx/`, 4 файлов) — 'Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify +- **reverse-engineering-binary** (`reverse-engineering-binary/`, 1 файлов) — 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O +- **reverse-engineering-cli** (`reverse-engineering-cli/`, 1 файлов) — 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping, +- **reverse-engineering-dotnet-malware-with-dnspy** (`reverse-engineering-dotnet-malware-with-dnspy/`, 4 файлов) — 'Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify +- **reverse-engineering-full** (`reverse-engineering-full/`, 1 файлов) — Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol +- **reverse-engineering-ios-app-with-frida** (`reverse-engineering-ios-app-with-frida/`, 8 файлов) — 'Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract +- **reverse-engineering-kernel** (`reverse-engineering-kernel/`, 1 файлов) — 'Use for kernel-mode reverse engineering: Windows driver analysis, anti-cheat +- **reverse-engineering-malware-with-ghidra** (`reverse-engineering-malware-with-ghidra/`, 4 файлов) — 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and decompiler to understand internal logic, +- **reverse-engineering-mobile** (`reverse-engineering-mobile/`, 1 файлов) — 'Use for mobile app reverse engineering: Android APK analysis, iOS IPA +- **reverse-engineering-obfuscation** (`reverse-engineering-obfuscation/`, 1 файлов) — Use for deobfuscation, unpacking, anti-analysis bypass, code virtualization +- **reverse-engineering-protocol** (`reverse-engineering-protocol/`, 1 файлов) — 'Use for protocol reverse engineering: API reversing, network traffic +- **reverse-engineering-ransomware-encryption-routine** (`reverse-engineering-ransomware-encryption-routine/`, 8 файлов) — Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and +- **reverse-engineering-rust-malware** (`reverse-engineering-rust-malware/`, 7 файлов) — Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated +- **reverse-skill** (`reverse-skill-repo/`, 592 файлов) — >- +- **reverser-pentester** (`reverser-pentester/`, 1 файлов) — Use when you need built-in reverse engineer / pentester — RE бинарников, + +## our-skills + +- **attio-reverse-engineering** (`our-skills/attio-reverse-engineering/`, 1 файлов) — "Reverse-engineer and integrate Attio CRM (AI models, API, MCP) into OMP — covers internal endpoints, auth, gateway, and provider wiring" +- **devin-architecture-reverse** (`our-skills/devin-architecture-reverse/`, 1 файлов) — "Devin AI agent architecture reverse engineering — binary structure, permission modes, hooks, slash commands, OMP mapping" +- **dotnet-winui3-reverse-engineering** (`our-skills/dotnet-winui3-reverse-engineering/`, 1 файлов) — "Decompile a WinUI 3 / Windows App SDK MSIX-packaged .NET app to C# source + extract XBF resources from PRI" +- **re-roast-2026** (`our-skills/re-roast-2026/`, 2 файлов) — "Use when roasting/verifying a reverse-engineering guide, post, or list of RE tools; fact-checking stars/tool counts; link liveness sweep; cutting hyperbole; splitting content into Telegram messages (4096 limit); or when building/evaluating any 2026 RE stack content: IDA/Ghidra/Binary Ninja, Qiling, OGhidra, AI-RE pipeline, IDA licensing. Triggers: прожарка, реверс, реверсинг, RE, reverse engineering, бинарь, дизассемблер, декомпилятор, проверь ссылки, гайд по реверсу, проверить факты в посте." +- **reverse-winui3-app** (`our-skills/reverse-winui3-app/`, 1 файлов) — "Use when reverse engineering a WinUI 3 / .NET 8 MSIX-packaged Windows application — covers ILSpy decompilation, PRI/XBF extraction, and pkg-compiled Node.js backend identification" +- **reverse-winui3-pkg-app** (`our-skills/reverse-winui3-pkg-app/`, 1 файлов) — "Reverse engineer a WinUI 3 (.NET 8) desktop app with a pkg-compiled Node.js backend: ILSpy decompilation, XBF extraction from resources.pri, pkg payload extraction, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch" +- **vibeproxy-reverse-engineering** (`our-skills/vibeproxy-reverse-engineering/`, 1 файлов) — "Reverse engineer VibeProxy (WinUI 3 .NET 8 MSIX app) — ILSpy decompile, self-contained publish, MSIX repackage, and fork 9router backend" +- **vibeproxy-reverse-pipeline** (`our-skills/vibeproxy-reverse-pipeline/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX staging/sign/install, and design modification with pixel verification" +- **winui3-msix-reverse** (`our-skills/winui3-msix-reverse/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, rebuild with dotnet publish self-contained, overlay original native assets, loose-register without admin, add custom pages" +- **winui3-msix-reverse-rebuild** (`our-skills/winui3-msix-reverse-rebuild/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder" +- **winui3-reverse-engineering** (`our-skills/winui3-reverse-engineering/`, 1 файлов) — "Reverse engineer WinUI 3 / .NET 8 MSIX applications: ILSpy decompilation, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch with modified code" + +## research-what-we-did + +- **research** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc. +- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline. +- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline. +- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output. +- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values. +- **research** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc. +- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline. +- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline. +- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output. +- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values. +- **research** (`research-what-we-did/Deep-Research-skills/skills/research-en/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc. +- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline. +- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline. +- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output. +- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values. +- **research** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research/`, 2 файлов) — 对目标话题进行初步调研，生成调研outline。用于学术调研、benchmark调研、技术选型等场景。 +- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/`, 1 файлов) — 向现有调研outline补充字段定义。 +- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/`, 1 файлов) — 向现有调研outline补充items（调研对象）。 +- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/`, 1 файлов) — 读取调研outline，为每个item启动独立agent进行深度调研。禁用task output。 +- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/`, 1 файлов) — 将deep调研结果汇总为markdown报告，覆盖所有字段，跳过不确定值。 + +## reverse-engineering + +- **dsl-vm-reverse** (`reverse-engineering/dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow. + +## reverse-skill-repo + +- **competition-ad-certificate-abuse** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ad-certificate-abuse/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AD CS, certificate templates, enrollment rights, EKUs, SAN controls, PKINIT, certificate mapping, and cert-based privilege paths. Use when the user asks about ESC-style abuse, certificate templates, enrollment agents, EKUs, SAN or subject controls, smartcard or PKINIT logon, CA policy, or how an issued cert turns into accepted privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-agent-cloud** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-agent-cloud/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or toolchain, cloud, container, CI/CD, and supply-chain challenges. Use when the user asks to analyze prompt-to-tool flows, retrieval poisoning, mounted secrets, deployment drift, runtime-vs-manifest mismatches, registry provenance, or CI-produced artifacts under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-android-hooking** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-android-hooking/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection, and app trust-boundary analysis. Use when the user asks to hook an APK, inspect signer logic, trace Java or native boundaries, bypass pinning or root checks, inspect shared prefs or app databases, or replay accepted mobile requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-browser-persistence** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-browser-persistence/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches, and client-side session persistence. Use when the user asks to inspect browser state, replay cached auth or session behavior, explain why a page behaves differently after load, or trace how stored client state changes requests, rendering, or access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-bundle-sourcemap-recovery** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-bundle-sourcemap-recovery/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery. Use when the user asks to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-cloud-metadata-path** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-cloud-metadata-path/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance identity, workload identity, link-local credential paths, role assumption, and metadata-to-privilege trust edges. Use when the user asks to inspect metadata-service access, instance credentials, pod or workload identity, link-local token paths, SSRF-to-metadata escalation, or explain how metadata-derived credentials turn into accepted cloud or control-plane privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-container-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-container-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift, and route-to-container resolution. Use when the user asks why a live container differs from manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-crypto-mobile** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-crypto-mobile/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or replay mobile request-signing logic. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-custom-protocol-replay** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-custom-protocol-replay/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums, stateful replay, and accepted-session reproduction. Use when the user asks to decode an unknown protocol, recover custom framing, build a replay harness, satisfy sequence or checksum rules, replay a captured session, or prove the smallest message order that reaches an accepted branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-dpapi-credential-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-dpapi-credential-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and secret-to-acceptance replay chains. Use when the user asks to inspect DPAPI blobs or masterkeys, recover browser or vault credentials, trace DPAPI context or backup-key use, or explain how protected Windows secrets become accepted access or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-file-parser-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-file-parser-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and deserialization chains. Use when the user asks to inspect an upload or import path, trace archive extraction, preview or converter behavior, explain how a file reaches a parser or deserializer, or connect one uploaded artifact to the decisive backend effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-firmware-layout** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-firmware-layout/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs, and device-facing trust boundaries. Use when the user asks to unpack firmware, map partition layout, inspect bootloader or init chains, recover update keys or credentials, trace config loading, or explain how a device surface reaches the decisive artifact. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-forensic-timeline** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-forensic-timeline/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-graphql-rpc-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-graphql-rpc-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift, hidden operations, and contract-to-handler mismatches. Use when the user asks to inspect GraphQL or RPC requests, compare client contracts to live handlers, recover hidden operations, trace generated clients, or explain how schema or contract drift produces the decisive behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-identity-windows** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-identity-windows/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-ios-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ios-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery. Use when the user asks to hook an IPA, trace Objective-C or Swift runtime behavior, inspect Keychain or plist state, bypass pinning, analyze deeplinks or universal links, or replay accepted iOS requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-jwt-claim-confusion** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-jwt-claim-confusion/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims, or explain how a token becomes accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-k8s-control-plane** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-k8s-control-plane/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-kerberos-delegation** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-kerberos-delegation/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges, S4U abuse, RBCD, constrained or unconstrained delegation, and service-ticket acceptance. Use when the user asks about constrained delegation, unconstrained delegation, RBCD, S4U, SPNs, ticket acceptance, or how a Kerberos trust edge turns into effective privilege under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-kernel-container-escape** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-kernel-container-escape/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and escape primitive verification. Use when the user asks to analyze container-to-host escape paths, kernel exploit prerequisites, namespace crossover, capability misuse, or prove whether an exploit primitive crosses the sandbox boundary. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-linux-credential-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-linux-credential-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust, and host-to-host pivot chains. Use when the user asks to trace Linux auth artifacts, accepted token or key replay, socket or service-account trust edges, sudo or capability abuse, or explain lateral movement across Linux challenge nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-lsass-ticket-material** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-lsass-ticket-material/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction. Use when the user asks to inspect LSASS memory, recover tickets or logon sessions, trace DPAPI or SSP material, distinguish which credential artifacts are replayable, or connect host-resident credential material to an accepted pivot or privilege edge. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-mailbox-abuse** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-mailbox-abuse/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects. Use when the user asks to trace mailbox rules, OAuth consent grants, forwarding or delegate abuse, shared mailbox access, message-trace evidence, or explain how mail artifacts turn into persistence, exfiltration, or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-malware-config** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-oauth-oidc-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-oauth-oidc-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-pcap-protocol** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-pcap-protocol/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-prompt-injection** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-prompt-injection/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-queue-worker-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-queue-worker-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-race-condition-state-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-race-condition-state-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-relay-coercion-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-relay-coercion-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains, target selection, NTLM or related acceptance paths, and coercion-to-privilege transitions. Use when the user asks to trace a coercion primitive, follow a relay path, analyze forced authentication, determine which service accepts relayed auth, or connect a coercion step to resulting privilege, enrollment, or code execution. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-request-normalization-smuggling** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-reverse-pwn** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-reverse-pwn/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-runtime-routing** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-runtime-routing/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-ssrf-metadata-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ssrf-metadata-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-stego-media** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-stego-media/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for image, audio, video, document, and container steganography. Use when the user asks to inspect metadata, alpha or palette channels, LSBs, thumbnails, appended trailers, QR fragments, transcoding artifacts, or recover a hidden payload from media without blind brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-supply-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-supply-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-template-render-path** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-template-render-path/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSR, template rendering, route loaders, hydration payloads, server-client render boundaries, and template-to-handler enforcement gaps. Use when the user asks to inspect SSR or template routes, trace render context or hydration data, compare template gating with handler enforcement, explain preview or hidden-route rendering, or connect render pipeline behavior to the decisive branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-web-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-web-runtime/`, 4 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-websocket-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-websocket-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for WebSocket and SSE handshakes, auth material, subscription state, realtime message schemas, reconnect behavior, and frame-driven runtime effects. Use when the user asks to inspect a WebSocket or SSE handshake, decode frames, trace subscriptions, follow reconnect logic, inspect auth material sent during realtime setup, or explain how live frames change rendered or persisted state. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-windows-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-windows-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **competition-zip-archive** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-zip-archive/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for ZIP and PKZIP archive challenges, legacy ZipCrypto identification, known-plaintext recovery with bkcrack, key-based decryption, and reproducible extraction. Use when the user asks to solve an encrypted ZIP challenge, inspect ZipCrypto metadata, recover keys from a known file prefix, or unlock an archive without starting with password brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. +- **ctf-sandbox-orchestrator** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/`, 10 файлов) — Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence. +- **reverse-skill-router** (`reverse-skill-repo/skills/`, 349 файлов) — Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear. +- **api-security** (`reverse-skill-repo/skills/api-security/`, 3 файлов) — Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing. +- **apk-reverse** (`reverse-skill-repo/skills/apk-reverse/`, 12 файлов) — 在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。 +- **attack-chain** (`reverse-skill-repo/skills/attack-chain/`, 4 файлов) — Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill. +- **binary-diff** (`reverse-skill-repo/skills/binary-diff/`, 2 файлов) — | +- **browser-automation** (`reverse-skill-repo/skills/browser-automation/`, 3 файлов) — | +- **browser-extension-reverse** (`reverse-skill-repo/skills/browser-extension-reverse/`, 2 файлов) — Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery. +- **case-review** (`reverse-skill-repo/skills/case-review/`, 3 файлов) — Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff. +- **cloud-k8s** (`reverse-skill-repo/skills/cloud-k8s/`, 2 файлов) — Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review. +- **code-audit** (`reverse-skill-repo/skills/code-audit/`, 2 файлов) — Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification. +- **database-security** (`reverse-skill-repo/skills/database-security/`, 2 файлов) — Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review. +- **diagram-generator** (`reverse-skill-repo/skills/diagram-generator/`, 6 файлов) — generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable. +- **digital-forensics** (`reverse-skill-repo/skills/digital-forensics/`, 2 файлов) — Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation. +- **docs-generator** (`reverse-skill-repo/skills/docs-generator/`, 4 файлов) — | +- **dotnet-reverse** (`reverse-skill-repo/skills/dotnet-reverse/`, 4 файлов) — .NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。 +- **edr-bypass-re** (`reverse-skill-repo/skills/edr-bypass-re/`, 4 файлов) — | +- **email-security** (`reverse-skill-repo/skills/email-security/`, 2 файлов) — Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research. +- **firmware-pentest** (`reverse-skill-repo/skills/firmware-pentest/`, 4 файлов) — | +- **ghidra-reverse** (`reverse-skill-repo/skills/ghidra-reverse/`, 2 файлов) — Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable. +- **go-rust-reverse** (`reverse-skill-repo/skills/go-rust-reverse/`, 2 файлов) — Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery. +- **hardware-security** (`reverse-skill-repo/skills/hardware-security/`, 2 файлов) — Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support. +- **ida-reverse** (`reverse-skill-repo/skills/ida-reverse/`, 4 файлов) — | +- **identity-federation** (`reverse-skill-repo/skills/identity-federation/`, 2 файлов) — Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues. +- **js-reverse** (`reverse-skill-repo/skills/js-reverse/`, 13 файлов) — 在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。 +- **llm-security** (`reverse-skill-repo/skills/llm-security/`, 5 файлов) — Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks. +- **macos-reverse** (`reverse-skill-repo/skills/macos-reverse/`, 2 файлов) — Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis. +- **malware-analysis** (`reverse-skill-repo/skills/malware-analysis/`, 4 файлов) — Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior. +- **mobile-reverse** (`reverse-skill-repo/skills/mobile-reverse/`, 4 файлов) — Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks. +- **ot-ics** (`reverse-skill-repo/skills/ot-ics/`, 2 файлов) — Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation. +- **patch-diff-exploit** (`reverse-skill-repo/skills/patch-diff-exploit/`, 4 файлов) — | +- **pentest-tools** (`reverse-skill-repo/skills/pentest-tools/`, 111 файлов) — | +- **src-hunter** (`reverse-skill-repo/skills/pentest-tools/src-hunter/`, 90 файлов) — 实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。 +- **protocol-reverse** (`reverse-skill-repo/skills/protocol-reverse/`, 2 файлов) — Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery. +- **pwn-chain** (`reverse-skill-repo/skills/pwn-chain/`, 4 файлов) — | +- **radare2** (`reverse-skill-repo/skills/radare2/`, 4 файлов) — | +- **radio-sdr** (`reverse-skill-repo/skills/radio-sdr/`, 2 файлов) — Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi. +- **reverse-engineering** (`reverse-skill-repo/skills/reverse-engineering/`, 24 файлов) — Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker. +- **dsl-vm-reverse** (`reverse-skill-repo/skills/reverse-engineering/dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow. +- **supply-chain-security** (`reverse-skill-repo/skills/supply-chain-security/`, 3 файлов) — Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability. +- **thick-client** (`reverse-skill-repo/skills/thick-client/`, 2 файлов) — Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries. +- **threat-hunting** (`reverse-skill-repo/skills/threat-hunting/`, 2 файлов) — Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation. +- **wifi-wireless** (`reverse-skill-repo/skills/wifi-wireless/`, 2 файлов) — Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing. +- **windows-ad** (`reverse-skill-repo/skills/windows-ad/`, 2 файлов) — Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research. diff --git a/README.md b/README.md new file mode 100644 index 0000000..5deae01 --- /dev/null +++ b/README.md @@ -0,0 +1,99 @@ +# 🩸 REVERSE-ENGINEERING SKILLS MAX + +Максимальный пак реверс-инженерных скиллов для AI-агентов: **422 SKILL.md, ~2236 файлов, ~31 МБ** — только RE-полезное, супер-мусор (compliance/SOC/game-modding/MCP-docker) вычищен. Работает в Claude Code, Codex, Cursor, Gemini CLI, Hermes Agent, OMP — везде, где агент читает `SKILL.md`. + +Очищено: личные данные, токены, ключи, .git-метаданные и бинарники удалены. Собрано и верифицировано: сентябрь–октябрь 2026 (vendor-new: deep-research 14.10.2026, секрет-свип 0 хитов). Ссылки в гайде проверены свипом (102/102 живы на 26.09.2026). + +## 🗺 Что куда юзать + +**`USE-MAP.md`** — роутер по задачам: цель (PE/kernel/.NET/APK/iOS/ELF/Mach-O/Go/Rust/ARM/firmware/JS/Web) → конкретные скиллы; этапы (триаж→распаковка→статика→динамика→анти-анализ→шеллкоды→конфиги→память→YARA→отчёт); какие MCP подключать; золотой пайплайн. + +## Состав + +| Директория | Что внутри | +|---|---| +| `reverse-skill-repo/` | Роутер [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (37.9K⭐, MIT): маршрутизация задач apk / ida / radare2 / binary-ninja / dotnet / js / malware, CTF-Sandbox-Orchestrator (40+ competition-сценариев), pentest-tools (src-hunter), field-journal, kali-скрипты | +| `our-skills/` | 12 боевых скиллов из реальной практики: **rea-full-course (REA/MCP реверс-курс: установка, движки, guided-воркфлоу, пак промтов)** + исходник курса в `research-what-we-did/rea-full-course-source.md`, WinUI3/MSIX-реверс и пересборка (×5), .NET WinUI3, Attio CRM reverse, Devin IDE architecture reverse, VibeProxy reverse (×2), re-roast-2026 (факт-чекер RE-контента с linkcheck) | +| `research-what-we-did/` | Наши исследования: RE-отчёт DarkTelegram.pro (только публичные JS-бандлы, без кредов), прожарка вирусного RE-гайда (оригинал → верифицированная v4), forum-reversing дневники, Deep-Research-skills (MIT) | +| `reverse-engineering*/` (16 паков) | Отдельные скиллы: android-malware + jadx, dotnet-malware + dnSpy, iOS + Frida, kernel, ransomware encryption routines, rust-malware, ghidra-malware, binary, cli, full, mobile, obfuscation, protocol, firmware, dsl-vm | +| `reverser-pentester/` | Связка реверс + пентест | +| `vendor-new/` | **9 курированных коллекций** (deep-research 14.10, отфильтровано от мусора): Anthropic-Cybersecurity-Skills (**35 из 820** — только malware-analysis/RE), analyst-ai-pack (**~80 из 119** — malware RE без threat-hunting/SOC), rev-skills (143, firmware/protocol/unpacking), win-dev-skills (11, официальный WinDbg от Microsoft), xbsReverseSkill (33, JS-реверс CN), android-RE (SimoneAvogadro), apk-reverse (7), malware-analysis (5), js-reverse-automation. Вырезано: universal-modder (game), mcp-security-hub (docker), security-audit, spider-king, SOC/compliance/GRC (783+39 скиллов). Каталог: `research-what-we-did/EXTERNAL-CATALOG.md` | + +## Гайд «РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: 2026» + +Полный верифицированный гайд (4 части): `research-what-we-did/rev-guide-v4.md` (по частям — `rev_guide/p1..p4.md`). Опубликован: https://telegra.ph/Reverse-09-30 + +Карта пути: + +1. **База** — C, ассемблер x86-64, Compiler Explorer, формат PE +2. **Инструменты** — Ghidra (+Ghidrathon), x64dbg, Detect It Easy, HxD; позже IDA Pro, Binary Ninja, radare2/rizin+Cutter +3. **Практика** — crackmes.one (15–20 задач 1☆ → 2☆ → 3☆), ROP Emporium +4. **Система** — pwn.college, OpenSecurityTraining2, RE-MA-Roadmap +5. **Пайплайн анализа** — DIE/FLOSS/capa триаж → распаковка (x64dbg+Scylla / de4dot+dnSpyEx / Qiling) → статика (Ghidra/IDA) → динамика (Frida) → деобфускация (D-810, Unicorn, angr) → поведение (FakeNet-NG, CAPEv2, Speakeasy) → диффинг (BinDiff/Diaphora) → YARA + отчёт +6. **Реверс через ИИ** — MCP-серверы (ida-pro-mcp, GhidraMCP, ghidra-mcp 200+ тулов, r2ai, x64dbg-mcp, cheatengine-mcp-bridge, jadx-ai-mcp, Arkana 250+ тулов...) + скиллы + агенты (agentic-malware-analysis, auto-re-agent, reverify) +7. **Специализация** — малварь (PMAT), прошивки (binwalk v3, EMBA), Android (jadx+apktool), CTF + +## Установка + +```bash +# Claude Code +cp -r reverse-skill-repo/skills/* ~/.claude/skills/ +cp -r our-skills/* ~/.claude/skills/ + +# Hermes Agent — в skills-директорию профиля +# Codex / Cursor / Gemini CLI — по их skills-конвенции (AGENTS.md / .cursor/rules) +``` + +Перед установкой чужих скиллов прогони их через [SkillSpector](https://github.com/NVIDIA/SkillSpector) — скиллы бывают с промпт-инъекциями. + +## Ограничения AI-реверса (проверено на практике) + +- Агент уверенно ошибается в именах функций — крипто, C2, авторизацию проверяй руками +- Упакованный сэмпл = слабый псевдокод; распаковывай до подачи агенту +- Строки в бинарнике работают как промпт-инъекция против RE-агента ([arXiv:2605.30667](https://arxiv.org/abs/2605.30667)) + +## Attribution + +- [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) — MIT © 2026 zhaoxuya520 +- Deep-Research-skills — MIT © 2026 Lan Zheng +- vendor-new/ — лицензии каждого вендора в его `LICENSE` (Apache-2.0/MIT/BSD-3), полный список в `research-what-we-did/EXTERNAL-CATALOG.md` +- Отдельные паки `reverse-engineering-*` — лицензии в соответствующих `LICENSE` +- Отчёт DarkTelegram.pro — только публичные ассеты, без обхода авторизации + +## Каталог скиллов + +- dsl-vm-reverse/ +- firmware-reversing/ +- our-skills/attio-reverse-engineering/ +- our-skills/devin-architecture-reverse/ +- our-skills/dotnet-winui3-reverse-engineering/ +- our-skills/re-roast-2026/ +- our-skills/rea-full-course/ +- our-skills/reverse-winui3-app/ +- our-skills/reverse-winui3-pkg-app/ +- our-skills/vibeproxy-reverse-engineering/ +- our-skills/vibeproxy-reverse-pipeline/ +- our-skills/winui3-msix-reverse/ +- our-skills/winui3-msix-reverse-rebuild/ +- our-skills/winui3-reverse-engineering/ +- protocol-reverse-engineering/ +- research-what-we-did/Deep-Research-skills/skills/ (research-codex-en/zh, research-en/zh × 5 модулей) +- reverse-engineering/ +- reverse-engineering-android-malware-with-jadx/ +- reverse-engineering-binary/ +- reverse-engineering-cli/ +- reverse-engineering-dotnet-malware-with-dnspy/ +- reverse-engineering-full/ +- reverse-engineering-ios-app-with-frida/ +- reverse-engineering-kernel/ +- reverse-engineering-malware-with-ghidra/ +- reverse-engineering-mobile/ +- reverse-engineering-obfuscation/ +- reverse-engineering-protocol/ +- reverse-engineering-ransomware-encryption-routine/ +- reverse-engineering-rust-malware/ +- reverse-skill-repo/CTF-Sandbox-Orchestrator/ (42 competition-сценария: ad-certificate-abuse, android-hooking, dpapi-credential-chain, kerberos-delegation, kernel-container-escape, lsass-ticket-material, malware-config, oauth-oidc-chain, prompt-injection, reverse-pwn, ssrf-metadata-pivot, supply-chain, ...) +- reverse-skill-repo/skills/ (api-security, apk-reverse, attack-chain, binary-diff, browser-automation, browser-extension-reverse, cloud-k8s, code-audit, database-security, digital-forensics, dotnet-reverse, edr-bypass-re, email-security, firmware-pentest, ghidra-reverse, go-rust-reverse, hardware-security, ida-reverse, identity-federation, js-reverse, llm-security, macos-reverse, malware-analysis, mobile-reverse, ot-ics, patch-diff-exploit, pentest-tools+src-hunter, protocol-reverse, pwn-chain, radare2, radio-sdr, supply-chain-security, thick-client, threat-hunting, wifi-wireless, windows-ad) +- reverser-pentester/ + +👻 [иишко](https://t.me/AlStack) diff --git a/USE-MAP.md b/USE-MAP.md new file mode 100644 index 0000000..39b11ae --- /dev/null +++ b/USE-MAP.md @@ -0,0 +1,51 @@ +# 🗺 ЧТО КУДА ЮЗАТЬ — роутер по задачам + +## Агentic-инструмент №1 +**REA** (`our-skills/rea-full-course/`) — «реверси что угодно»: Electron/JS бандлы, APK, EVM, Go/Rust. Ставится `npx rea-agents@latest setup` в Claude Code/Codex/Cursor/Hermes. Полный курс: `research-what-we-did/rea-full-course-source.md`. + +## По типу цели +| Цель | Скиллы/тулзы | +|---|---| +| Windows PE (user-mode) | `reverse-engineering-malware-with-ghidra` (top-level) + `win-dev-skills/windbg-user-*` (TTD reverse debugging, heap corruption) + `performing-static-malware-analysis-with-pe-studio` | +| Windows kernel/драйверы | `win-dev-skills/windbg-kernel-*` + `analyzing-windows-driver-malware` + `dissecting-boot-and-kernel-rootkits` (analyst-ai-pack) | +| .NET | `reverse-engineering-dotnet-malware-with-dnspy` + `analyzing-dotnet-malware-internals` | +| Android APK | `android-reverse-engineering-skill` (SimoneAvogadro, jadx/Frida end-to-end) + `apk-reverse` (7 скиллов: unpacking, dex2jar) + `analyzing-android-malware-with-apktool` + `analyzing-android-dex-malware` | +| iOS | `reverse-engineering-ios-app-with-frida` | +| Linux ELF | `analyzing-elf-binaries-on-linux` + `analyzing-linux-elf-malware` + `analyzing-linux-kernel-rootkits` | +| macOS Mach-O | `analyzing-mach-o-binaries-on-macos` | +| Go / Rust / Nim / exotic | `analyzing-golang-malware-with-ghidra`, `reverse-engineering-rust-malware`, `analyzing-rust-malware-internals`, `reverse-engineering-nim-and-other-exotic-binaries` | +| ARM | `reverse-engineering-arm-binaries` | +| Прошивки / UEFI / PLC / embedded | `rev-skills/` (143 скилла: binwalk, EMBA, чипы, протоколы) + `performing-firmware-extraction-with-binwalk` + `auditing-uefi-firmware-with-chipsec` + `performing-plc-firmware-security-analysis` + `analyzing-uefi-bootkit-persistence` | +| JS/Web реверс (сигнатуры сайтов) | `xbsReverseSkill/` (33: xiaohongshu/bilibili/douyin, wasm, sign-алгоритмы) + `js-reverse-automation--skill` + `deobfuscating-javascript-malware` | +| Офис/PDF/скрипты | `analyzing-macro-malware-in-office-documents`, `analyzing-pdf-malware-with-pdfid`, `deobfuscating-powershell-obfuscated-malware`, `analyzing-malicious-*` (analyst-ai-pack) | + +## По этапу работы +| Этап | Чем | +|---|---| +| Триаж образца | `triaging-an-unknown-sample`, `identifying-file-types-and-formats`, `measuring-section-entropy-to-detect-packing`, `extracting-and-classifying-strings`, capa: `generating-capability-reports-with-capa` | +| Распаковка | `manually-unpacking-a-packed-binary`, `unpacking-upx-and-common-packers`, `analyzing-packed-malware-with-upx-unpacker`, `dumping-and-rebuilding-a-pe-from-memory` | +| Статика | Ghidra: `scripting-ghidra-headless-analysis` · IDA: `scripting-ida-with-idapython` · r2/rizin: `reverse-engineering-binaries-with-radare2-rizin`, `automating-analysis-with-r2pipe` · Binary Ninja: `reverse-engineering-binaries-with-binary-ninja` | +| Динамика | `performing-dynamic-analysis-in-a-sandbox`, `analyzing-malware-behavior-with-cuckoo-sandbox`, `performing-automated-malware-analysis-with-cape`, `debugging-malware-with-x64dbg`, `monitoring-process-and-file-behavior`, lab: `setting-up-an-isolated-malware-analysis-lab` | +| Анти-анализ | `identifying-anti-debugging-techniques`, `bypassing-anti-vm-and-sandbox-checks`, `detecting-sandbox-evasion-behavior`, `defeating-control-flow-flattening`, `defeating-string-and-api-obfuscation` | +| Шеллкоды/инъекции | `emulating-shellcode-with-unicorn`, `reverse-engineering-shellcode`, `recovering-injected-code-and-shellcode`, `resolving-dynamic-api-hashing`, `analyzing-position-independent-code`, `analyzing-heap-spray-exploitation` | +| Конфиги/C2/ключи | `building-config-extractors`, `decrypting-embedded-configuration`, `extracting-config-from-a-running-sample`, `extracting-encryption-keys-from-binaries`, `extracting-cobalt-strike-beacon-config`, `reverse-engineering-custom-c2-protocols`, `analyzing-cobalt-strike-beacon-configuration` | +| Память | `performing-memory-forensics-with-volatility3(+plugins)`, `analyzing-memory-dumps-with-volatility`, `analyzing-malware-in-memory-with-volatility3`, `detecting-process-injection-in-memory` | +| Символьное исполнение | `solving-malware-with-symbolic-execution` | +| Дифф/патч | `diffing-malware-samples-to-find-changes`, `patch-diffing-with-bindiff-and-diaphora` | +| YARA/детекты | `writing-yara-rules-from-reversed-code`, `scanning-samples-with-yara`, `performing-malware-triage-with-yara`, `performing-yara-rule-development-for-detection` | +| Отчёт | `writing-a-malware-analysis-report`, `performing-full-scope-malware-analysis` | +| CTF | `CTF-Sandbox-Orchestrator` (42 сценария) | +| Пентест-интеграция | `reverser-pentester`, `pentest-tools/src-hunter` | + +## MCP-серверы для агента (что подключать) +- **REA** — универсальный (Electron/Ghidra/JADX/EVM) — `our-skills/rea-full-course` +- **ida-pro-mcp** — IDA GUI-attached (`~/.idapro/mcp.json`) +- **GhidraMCP / ghidra-mcp** — Ghidra headless/GUI +- **x64dbg-mcp / r2ai** — динамика Windows / r2 +- Каталог + пробы: `research-what-we-did/mcp-catalogs.md` + +## Золотой пайплайн (malware-образец) +DIE/entropy/strings триаж → распаковка → статика (Ghidra/IDA) → динамика (sandbox/x64dbg/Frida) → деобфускация → behavior/конфиг-экстрактор → diff с известными → YARA + отчёт + +--- +👻 [ииШко](https://t.me/AlStack) diff --git a/dsl-vm-reverse/SKILL.md b/dsl-vm-reverse/SKILL.md new file mode 100644 index 0000000..d98a912 --- /dev/null +++ b/dsl-vm-reverse/SKILL.md @@ -0,0 +1,380 @@ +--- +name: dsl-vm-reverse +description: Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow. +--- + +# 🔄 DSL 自定义虚拟机逆向（DSL VM Reverse Engineering） + +## ACTION REQUIRED（读完后立刻执行） + +1. `NOW`: 确认当前任务是自定义 JS opcode VM / 风控引擎，不是标准 WASM 或普通 webpack +2. `NOW`: `case-init` 直到 `scope.md` 就绪；离线样本用 `offline` / `lab` +3. `ACT`: 从「3. 通用逆向工作流」Phase 1 做文件分类，不要停在目录 + +> 用于逆向基于 JavaScript 实现的自定义 WASM 虚拟机/风控引擎 + +--- + +## 目录 + +- [1. 适用范围](#1-适用范围) +- [2. DSL VM 识别特征](#2-dsl-vm-识别特征) +- [3. 通用逆向工作流](#3-通用逆向工作流) +- [4. Opcode 提取与分类](#4-opcode-提取与分类) +- [5. 运行时捕获方案](#5-运行时捕获方案) +- [6. 常见状态码](#6-常见状态码) +- [7. Skill 自检清单](#7-skill-自检清单) + +--- + +## 1. 适用范围 + +当目标文件符合以下 **任意特征** 时使用本 skill： + +| # | 特征 | 说明 | +|---|------|------| +| 1 | IIFE 开头 + 大量单字母变量名 | `!function(){var U=void 0,y=parseInt,E0=Function,...}` | +| 2 | 包含 `DG()` 或类似函数含 switch-case 循环 | 解释器主循环，`d[7]&31` 解码 opcode | +| 3 | 大文件（500KB+）但零字节占比 < 1% | 非标准 WASM，纯 JS | +| 4 | 包含 `C[number]` 常量表引用 | `C[9][xxx]` 函数表/字符串表 | +| 5 | 单行压缩代码 | 583KB 单行，混淆变量名 | + +### 排除规则 + +| 条件 | 非本 skill | 转至 | +|------|-----------|------| +| 文件以 `\x00asm` 开头 | 标准 WASM 二进制 | `reverse-engineering/languages.md` | +| 文件以 `Uint8Array([0,97,115,109])` 含 WASM 魔术字 | WASM 嵌入式 | 提取 .wasm 后转 IDA/Ghidra | +| 标准 Webpack 打包（`function(e,t,n){...}`） | 普通 JS | `js-reverse/` | +| 零字节占比 > 20% | WASM 二进制 | `reverse-engineering/languages.md` | + +--- + +## 2. DSL VM 识别特征 + +### 代码特征 + +```javascript +// 特征 1: IIFE 入口，单字母变量映射数字常量 +!function(){ + var U=void 0, y=parseInt, E0=Function, AN=Uint8Array; + var E=15, l=10, m=12, x=16, S=13, $=11; + // 数字常量映射为变量名，替代原始数字 + ... +} + +// 特征 2: 解释器主循环 DG() +function DG(C, d, ...) { + var d = []; // 数组模拟 WASM stack/locals + for (d[7] = x; d[7] !== U;) { + var aE = d[7] & 31; // 低 5 位 = opcode + var O = d[7] >> 5 & 31; // 高 5 位 = sub-operation + switch (aE) { + case 0: /* ... */ d[7] = 612; break; + case 1: /* ... */ + // ... N 个 case + } + } +} + +// 特征 3: 常量表 C[9] 存储函数索引和字符串 +// C[9][0] = ["pc"] → 函数参数描述 +// C[9][667] = "string" → 字符串常量 +// C[9][x] = number → 函数索引 + +// 特征 4: W(C[index], null, ...) 调用模式 +// W = Function.prototype.call.bind(call) +// 所有内置函数通过 C[index] 索引调用 + +// 特征 5: 指令编码格式 +// d[7] = opcode(bit 0-4) | subop(bit 5-9) | operand(bit 10+) +``` + +### Opcode 编码格式 + +每条指令编码为 32 位整数： + +``` +bit 0-4: opcode (0-N) +bit 5-9: sub-operation (0-31) +bit 10-31: operand/立即数 + +解码: + aE = d[7] & 31 → opcode + O = d[7] >> 5 & 31 → sub-operation + d[other] = d[7] >> 10 → operand +``` + +--- + +## 3. 通用逆向工作流 + +### Phase 1: 文件分类（5 分钟） + +```bash +# 检查是否为 DSL VM +python3 << 'EOF' +with open('target.js', 'rb') as f: + head = f.read(100) + +# 1. 检查 WASM 魔术字 +if head[:4] == b'\x00asm': + print("标准 WASM 二进制") + exit() + +# 2. 检查零字节占比 +data = open('target.js', 'rb').read() +zero_pct = data.count(b'\x00') / len(data) * 100 +print(f"零字节占比: {zero_pct:.1f}%") + +if zero_pct > 20: + print("WASM 二进制") +elif head[:2] == b'!f': + # 检查单字母变量模式 + if b'var U=void 0' in head or b'U=void 0,y=parseInt' in head: + print("→ DSL VM!") + else: + print("普通 JS IIFE") +EOF +``` + +### Phase 2: 变量映射表提取（10 分钟） + +```python +import re + +with open('target.js', 'r', errors='replace') as f: + s = f.read() + +# 提取开头 2000 字符的 var X=数字 映射 +mappings = re.findall(r'var\s+(\w+)\s*=\s*(\d+)', s[:2000]) +print('常量映射:') +for name, val in mappings: + print(f" {name:4s} = {val:3d} (0x{int(val):02x})") +``` + +### Phase 3: Opcode 提取与分类（15 分钟） + +```python +# 1. 提取所有 case +all_cases = re.findall(r'case\s+(\d+):', s) +unique = sorted(set(int(c) for c in all_cases)) + +print(f"总 case: {len(all_cases)} 个") +print(f"唯一 opcode: {len(unique)} 个: {unique}") + +# 2. 分类每个 opcode +for op in unique: + idx = s.find(f'case {op}:') + snippet = s[idx:idx+200] + if 'd[7]=' in snippet: + op_type = 'BRANCH' + elif 'return' in snippet: + op_type = 'RETURN' + elif 'W(C[' in snippet: + op_type = 'CALL' + elif 'new' in snippet: + op_type = 'ALLOC' + elif 'try' in snippet or 'catch' in snippet: + op_type = 'EXCEPTION' + else: + op_type = 'ARITH/STORE' + print(f" opcode {op:2d}: {op_type}") +``` + +### Phase 4: 常量表分析（30 分钟） + +```python +const_refs = re.findall(r'C\[9\]\[(\d+)\]', s) +unique_refs = sorted(set(int(x) for x in const_refs)) + +print(f"C[9] 引用: {len(unique_refs)} 个索引") +print(f"范围: {min(unique_refs)} - {max(unique_refs)}") + +# 对每个引用分析上下文 +for ref in unique_refs[:20]: + idx = s.find(f'C[9][{ref}]') + ctx = s[max(0,idx-50):idx+80] + clean = ''.join(c if c.isprintable() else ' ' for c in ctx) + print(f" C[9][{ref}] → {clean}") +``` + +### Phase 5: 导出函数追踪（1-2 小时） + +导出函数（如 `getToken`）通过以下路径定位： + +``` +1. 找 AWSCInner.register() 或类似注册调用 +2. 确定注册的模块和工厂函数 +3. 找工厂函数返回的对象 → 导出函数定义位置 +4. 若函数名不在 JS 中 → 在 C[9] 常量表中作字节码存储 +5. 追踪调用链: + AWSCInner._modules['fy'].getToken() + → W(C[函数索引], null, ...) + → DG() 解释器执行编码后的指令序列 +``` + +### Phase 6: 运行时注入（若纯静态分析不够） + +```javascript +// 注入最小 AWSC 兼容环境 +const fakeEnv = { + AWSCInner: { + _modules: {}, + register(name, moduleName, factory) { + this._modules[moduleName] = factory(); + } + } +}; + +// 执行 DSL VM 代码 +dslVmCode(); + +// 获取导出 +const token = fakeEnv.AWSCInner._modules['fy'].getToken({}); +``` + +--- + +## 4. Opcode 提取与分类 + +### 参考 opcode 对照表（基于已有案例） + +| Opcode | 操作类型 | 特征 | +|--------|---------|------| +| 0 | **BRANCH** | `d[7]=xxx` 无条件跳转 | +| 1 | **CALL** | `W(C[Y],null,function(){...})` 嵌入函数调用 | +| 2 | **ARITH** | `d[4]=0`, `d[7]=72` 变量赋值 | +| 3 | **ARITH** | `d[0]=d[1][C[x]]`, `d[5]=d[0] false}); + Object.defineProperty(navigator, 'plugins', {get: () => [1,2,3,4,5]}); + Object.defineProperty(navigator, 'languages', {get: () => ['zh-CN','zh','en']}); + """ +}) + +# 发送 CDP 原生鼠标事件 +driver.execute_cdp_cmd("Input.dispatchMouseEvent", { + "type": "mousePressed", + "x": 549.5, "y": 441.2, + "button": "left", "buttons": 1, + "clickCount": 1, "pointerType": "mouse" +}) +``` + +### 方案 B: Playwright 无头浏览器 + +```javascript +const { chromium } = require('playwright'); + +async function run() { + const browser = await chromium.launch(); + const page = await browser.newPage(); + + // 拦截网络请求 + await page.route('**/api/**', async route => { + await route.continue_(); + }); + + await page.goto('https://target-page.com'); + + // 等待 DSL VM 初始化 + await page.waitForFunction(() => { + return window.AWSCInner && + window.AWSCInner._modules && + window.AWSCInner._modules['fy']; + }); + + // 执行操作 + await page.mouse.move(500, 400); + await page.mouse.down(); + // ... 操作序列 + await page.mouse.up(); +} +``` + +### 方案 C: 纯协议验证（成功率极低） + +> DSL VM 生成的 token 通常与浏览器上下文强绑定（TLS JA3 指纹、IP、Cookie、请求头等），脱离浏览器后服务端可检测到上下文不匹配。**不建议使用纯协议方案**。 + +--- + +## 6. 常见状态码 + +| Code | 含义 | 处理 | +|------|------|------| +| 0 | **验证通过** ✅ | 取出 sessionId + sig | +| 300 | **风控拦截** | 被拦截，无法通过 | +| 8778 | **验证失败，需重试** | 重试操作 | +| 8776 | **操作太快，需重试** | 增加延迟后重试 | +| 69634 | **通用失败** | 检查参数是否正确 | + +--- + +## 7. Skill 自检清单 + +- [ ] 我是否完成了 DSL VM 识别（IIFE + 单字母变量 + DG() 解释器）？ +- [ ] 我是否提取了变量映射表（`var X=数字`）？ +- [ ] 我是否提取了 opcode 列表并分类？ +- [ ] 我是否分析了常量表 C[9] 的引用范围？ +- [ ] 我是否定位了导出函数注册点？ +- [ ] 纯静态分析不够时，我是否尝试了运行时注入方案？ +- [ ] 任务完成后是否回写了 field-journal？ +- [ ] 是否发现新工具/新场景 → 更新 routing.md？ + +--- + +## 路由注册 + +| 类型 | 路由 | +|------|------| +| **目标类型**: WASM / DSL VM / 自定义指令集 | `reverse-engineering/dsl-vm-reverse/SKILL.md` | +| **用户意图**: "DSL VM / 风控引擎逆向" | 本 skill | +| **工具链**: Playwright / Selenium CDP | 浏览器注入方案 | + +### 路径交叉 + +``` +DSL VM 逆向路径: + reverse-engineering/dsl-vm-reverse/ → Phase 1-6 工作流 + ↓ 若需要捕获运行时数据 + browser-automation/ → Playwright/Selenium CDP + ↓ 若需要分析 API 协议层 + js-reverse/ → Observe→Capture→Rebuild +``` diff --git a/firmware-reversing/SKILL.md b/firmware-reversing/SKILL.md new file mode 100644 index 0000000..71302d4 --- /dev/null +++ b/firmware-reversing/SKILL.md @@ -0,0 +1,303 @@ +--- +name: firmware-reversing +description: 'Use for firmware and embedded device reverse engineering: firmware extraction + (SPI flash, JTAG, UART, chip-off), firmware unpacking and analysis (binwalk, firmware-mod-kit, + unblob), RTOS reversing (FreeRTOS, ThreadX, Zephyr, VxWorks), bootloader analysis + (U-Boot, Coreboot, Secure Boot), embedded file system extraction (SquashFS, JFFS2, + YAFFS, UBIFS), hardware debugging interfaces (JTAG/SWD for ARM, OpenOCD, Segger), + microcontroller firmware RE (ARM Cortex-M, AVR, ESP32, RISC-V), IoT protocol reversing + (MQTT, CoAP, Zigbee, BLE), cryptographic key extraction from firmware, vulnerability + discovery in embedded firmware (buffer overflow, command injection, hardcoded credentials), + and any task involving embedded device security research or firmware reverse engineering.' +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - firmware + - reversing + - embedded + - device + - reverse + - engineering + - extraction + - spi + - flash + - jtag + - uart + - chip +depends_on: [] +metadata: + tags: + - firmware + - reversing +--- + +# Firmware Reversing — Embedded, IoT & RTOS Analysis + +## Trigger Conditions + +- Firmware extraction (SPI flash, JTAG, UART, chip-off, logic analyzer) +- Firmware unpacking (binwalk, unblob, firmware-mod-kit, sasquatch) +- RTOS reversing (FreeRTOS, ThreadX, Zephyr, VxWorks, RTEMS) +- Bootloader analysis (U-Boot, Coreboot, Secure Boot, vendor boot) +- Embedded filesystem extraction (SquashFS, JFFS2, YAFFS, UBIFS, romfs) +- Hardware debugging (JTAG, SWD, OpenOCD, Segger J-Link) +- Microcontroller reversing (ARM Cortex-M, AVR, ESP32, PIC, RISC-V) +- IoT protocol reversing (MQTT, CoAP, Zigbee, BLE, Z-Wave) +- Crypto key extraction from firmware images +- Hardcoded credential discovery in embedded firmware +- Vulnerability discovery (overflow, injection, insecure defaults) + +## Core Methodology + +### 1. Firmware Acquisition + +**SPI flash dumping:** +```bash +# Connect SPI flash chip to programmer (CH341A, Bus Pirate, Raspberry Pi) +# Identify flash chip: Winbond, Macronix, Spansion, etc. + +# Read flash: +flashrom -p ch341a_spi -r firmware.bin + +# Verify: +flashrom -p ch341a_spi -v firmware.bin + +# Partial read (specific regions): +flashrom -p ch341a_spi -r bootloader.bin -l 0x40000 -i 0 + +# Using Raspberry Pi as SPI programmer: +# Connect: MOSI→GPIO10, MISO→GPIO9, SCLK→GPIO11, CS→GPIO8, VCC→3.3V, GND→GND +flashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin +``` + +**UART console access:** +```bash +# Find UART pads on PCB (usually 3.3V, GND, TX, RX) +# Connect USB-to-UART adapter + +# Baud rate detection: +stty -F /dev/ttyUSB0 115200 +# Try common: 9600, 19200, 38400, 57600, 115200, 230400 + +# Connect: +screen /dev/ttyUSB0 115200 +# Or: picocom -b 115200 /dev/ttyUSB0 + +# Boot interrupt: spam Enter/Ctrl+C during boot → U-Boot console +``` + +**JTAG/SWD debugging:** +```bash +# Identify JTAG/SWD pads (TCK, TMS, TDI, TDO) or test points + +# OpenOCD — ARM debugging: +openocd -f interface/jlink.cfg -f target/stm32f4x.cfg + +# Read flash via JTAG: +openocd -f interface/ftdi.cfg -f target/stm32f4x.cfg \ + -c "init; flash read_bank 0 firmware.bin 0 0x100000; exit" + +# SWD on Cortex-M: +openocd -f interface/cmsis-dap.cfg -f target/stm32f4x.cfg \ + -c "init; reset halt; flash read_bank 0 firmware.bin 0 0x200000; exit" +``` + +**Chip-off (physical extraction):** +```bash +# Desolder flash/NAND chip, read with programmer +# Hot air station: 350°C, flux, careful removal + +# NAND flash reader: +# For raw NAND: need ECC correction +# Tools: nandread, flash-NAND-progger +``` + +### 2. Firmware Analysis & Unpacking + +**Binwalk (signature scanning):** +```bash +# Scan for embedded files: +binwalk firmware.bin + +# Extract all files: +binwalk -Me firmware.bin + +# Extract specific signatures: +binwalk -D 'gzip:gz:gzip' firmware.bin +binwalk -D 'lzma:lzma:lzma' firmware.bin + +# Show entropy: +binwalk -E firmware.bin # high entropy = compressed/encrypted + +# Show raw hex with context: +binwalk -R 'Y\xff\xff\xff' firmware.bin +``` + +**Unblob (modern, automatic):** +```bash +# Python-based, finds and extracts nested archives: +unblob firmware.bin -o extracted/ + +# Recursive extraction: +unblob --recursive firmware.bin -o extracted/ + +# Show what it found: +unblob -v firmware.bin +``` + +**Filesystem extraction:** +```bash +# SquashFS: +unsquashfs -d squashed/ rootfs.squashfs +# Or unsquashfs -s rootfs.squashfs (show info) + +# JFFS2: +# Need to mount (requires mtd kernel support) +modprobe mtdram total_size=65536 +modprobe mtdblock +dd if=rootfs.jffs2 of=/dev/mtdblock0 +mount -t jffs2 /dev/mtdblock0 /mnt/jffs2 + +# UBIFS: +modprobe nandsim first_id_byte=0x2c second_id_byte=0xda +modprobe ubi mtd=0 +ubiformat /dev/mtd0 +ubiattach -m 0 +mount -t ubifs ubi0:rootfs /mnt/ubifs + +# Cramfs: +cramfsck -x cram_extracted/ rootfs.cramfs + +# YAFFS: +unyaffs rootfs.yaffs extracted/ +``` + +### 3. RTOS Reversing + +**FreeRTOS identification:** +```bash +# Strings to find: +strings firmware.bin | grep -i "FreeRTOS\|vTaskDelay\|xQueueSend\|xSemaphoreTake" + +# Key structures: +# TCB (Task Control Block) — identify task list +# pxCurrentTCB → current task +# uxTopUsedPriority → scheduler state + +# Common patterns: +# - Task creation: xTaskCreate(pxTaskCode, pcName, usStackDepth, pvParameters, uxPriority, pxCreatedTask) +# - Queue: xQueueCreate(uxQueueLength, uxItemSize) +# - Timer: xTimerCreate(pcTimerName, xTimerPeriod, uxAutoReload, ...) + +# RE approach: find xTaskCreate call sites → map all tasks +# Each task's pxTaskCode = function pointer → RE-able +``` + +**VxWorks identification:** +```bash +# Strings: +strings firmware.bin | grep -i "VxWorks\|taskSpawn\|semMCreate\|msgQSend\|windKernel" + +# Key structures: +# WIND_TCB — task control block (find current task via TCB) +# taskIdCurrent → running task +# Kernel image: usually starts with "VxWorks" string + +# symbol table (if not stripped): +# VxWorks uses global symbol table for dynamic linking +# Extract: strings -e l firmware.bin | grep "taskName\|funcName" + +# Task spawning: +# taskSpawn(name, priority, options, stackSize, entryPoint, arg1..arg10) +# entryPoint = function pointer → where to set breakpoints +``` + +### 4. Vulnerability Discovery + +**Hardcoded credentials:** +```bash +# Automated credential scanning: +strings firmware.bin | grep -iE "(pass|pwd|secret|key|token|admin|root|login)[=:].+" | sort -u + +# Credential in config files: +grep -r "password\|secret\|key" extracted/ \ + --include="*.conf" --include="*.ini" \ + --include="*.cfg" --include="*.json" \ + --include="*.xml" --include="*.html" + +# Default credentials: +# admin/admin, root/root, admin/1234, etc. +# Check: /etc/shadow, /etc/passwd, web configs +``` + +**Binary vulnerability scanning:** +```bash +# Emulate with QEMU (full system or user mode): +# Full system: +qemu-system-arm -M versatilepb -kernel firmware.bin -nographic + +# User mode (single binary): +qemu-arm -L extracted/lib/ ./extracted/bin/httpd + +# Fuzz with AFL/QEMU mode: +afl-fuzz -Q -i seeds/ -o output/ -- qemu-arm ./bin/httpd @@ + +# Check for security mitigations: +checksec --elf=./bin/httpd # NX, PIE, RELRO, STACK CANARY, FORTIFY +``` + +### 5. Cryptographic Key Extraction + +**Key hunting:** +```bash +# Find RSA private keys: +grep -r "BEGIN RSA PRIVATE KEY\|BEGIN PRIVATE KEY" extracted/ + +# Find SSL certificates: +grep -r "BEGIN CERTIFICATE" extracted/ + +# Find hardcoded AES keys (16, 24, 32 byte patterns): +python3 -c " +import re +data = open('firmware.bin', 'rb').read() +# Look for high-entropy 16-byte sequences (potential AES keys) +for i in range(0, len(data) - 16): + chunk = data[i:i+16] + entropy = len(set(chunk)) + if entropy > 14: # high entropy = likely key + print(f'Possible key at {hex(i)}: {chunk.hex()}') +" + +# Check for XOR keys in bootloader: +# Often used for flash encryption +python3 -c " +data = open('firmware.bin', 'rb').read() +# XOR the entire firmware with first 4 bytes (see if decrypts) +# Brute force 1-byte XOR: +for key in range(256): + decoded = bytes(b ^ key for b in data[:64]) + if b'U-Boot' in decoded or b'Linux' in decoded: + print(f'XOR key found: {hex(key)}') +" +``` + +## Output Format + +For firmware reversing tasks: +1. **Acquisition** — method (SPI/JTAG/UART/chip-off), chip, voltage +2. **Firmware Profile** — OS/RTOS, architecture, bootloader, filesystem +3. **Unpacking** — toolchain used, nested layers, LZMA/gzip/SquashFS +4. **Key Findings** — hardcoded creds, crypto keys, vulns, backdoors +5. **RE Targets** — analyzed binaries, network services, web interfaces + +Всё, брат. + + +## Related +- `skill hardware-hacking` — железо +- `skill hardware-hacking-deep` — глубокое железо +- `skill reverse-engineering-binary` — бинарники +- `skill iot-ot-ics-security` — промышленные системы diff --git a/our-skills/attio-reverse-engineering/SKILL.md b/our-skills/attio-reverse-engineering/SKILL.md new file mode 100644 index 0000000..4de7589 --- /dev/null +++ b/our-skills/attio-reverse-engineering/SKILL.md @@ -0,0 +1,70 @@ +--- +name: attio-reverse-engineering +description: "Reverse-engineer and integrate Attio CRM (AI models, API, MCP) into OMP — covers internal endpoints, auth, gateway, and provider wiring" +--- + +# Attio Reverse Engineering & OMP Integration + +## Architecture +``` +Attio Web App (app.attio.com) +├── Public API: api.attio.com/v2 (Bearer token from Settings → Developers → API Keys) +├── Internal AI: app.attio.com/api/internal/chat/completions (session cookie auth, Cloudflare-protected) +├── MCP: mcp.attio.com/mcp (OAuth: openid offline_access mcp) +└── SPA: React, all /api/* GET routes return HTML (not API JSON) + +OMP Integration: +├── attio-gateway.py :8312 — FastAPI, round-robin API key pool, proxies api.attio.com/v2 +├── attio-api-provider.py :8313 — OpenAI-compatible, /v1/models + /v1/chat/completions + tools +├── attio_mcp.py — MCP stdio server, 3 tools (list_workspaces, search_people, get_record) +└── mcp.json — attio (remote http OAuth) + attio-farm (local stdio) +``` + +## Auth Methods +1. **API Key** (for api.attio.com/v2): `Authorization: Bearer att_...` — works from any client +2. **Session Cookies** (for app.attio.com/internal): requires real browser — Cloudflare blocks urllib/requests +3. **OAuth JWT** (for mcp.attio.com/mcp): obtained via OAuth consent flow, stored in mcp.json + +## Internal AI Endpoint +- URL: `POST https://app.attio.com/api/internal/chat/completions` +- Auth: session cookies (`attio-session`, `attio-app-session`, `attio-session-id`) +- Blocked by Cloudflare Error 1010 for non-browser requests +- Models available: Claude Opus 5, Claude Sonnet 5 (names in Attio: "Opus 5", "Claude Sonnet 5") +- Other probe results: `/{workspace}/api/chat` returns 405 (exists but different method) + +## OMP Provider Wiring (3 files) +1. `providers.yml`: under `providers:`, add entry with `apiKey: ""`, `baseUrl`, `models`, `provider: openai` +2. `models.yml`: detailed config per model (api, contextWindow, maxTokens, compat flags) +3. `config.yml`: add `provider/*` to `enabledModels` AND provider to `modelProviderOrder` + - **Without enabledModels, /model won't show the provider at all** + - OMP restart required after changes + +## Pool Format (attio_accounts.json) +```json +[{ + "email": "...", + "api_key": "att_...", + "api_workspace_id": "uuid", + "api_workspace_slug": "slug", + "cookies": [ + {"name": "attio-session", "value": "jwt...", "domain": ".attio.com"}, + {"name": "attio-app-session", "value": "jwt...", "domain": ".attio.com"}, + {"name": "attio-session-id", "value": "uuid", "domain": ".attio.com"} + ], + "status": "active_pro_trial" +}] +``` + +## Browser Automation Issues +- Camoufox: launch hangs (GeoIP lookup or binary issue on Windows) +- Playwright: chromium binary missing, install needed; node.exe must be copied to driver/ +- Patchright: driver node.exe missing +- curl_cffi: fails to compile on Windows CPython 3.11 +- Browser relay (OMP): times out, extension may not be connected +- Chrome CDP: port 9224 listening but OMP browser tool can't connect (503) + +## Working Tools +- `attio_list_workspaces` — reads pool from JSON, no API call needed +- `attio_search_people` — POST /v2/objects/people/records/query with filter +- `attio_create_person` — POST /v2/objects/people/records with values +- `attio_get_record` — GET /v2/objects/{type}/records/{id} diff --git a/our-skills/devin-architecture-reverse/SKILL.md b/our-skills/devin-architecture-reverse/SKILL.md new file mode 100644 index 0000000..998c56b --- /dev/null +++ b/our-skills/devin-architecture-reverse/SKILL.md @@ -0,0 +1,60 @@ +--- +name: devin-architecture-reverse +description: "Devin AI agent architecture reverse engineering — binary structure, permission modes, hooks, slash commands, OMP mapping" +--- + +# Devin Architecture — Reverse Engineering Notes + +## Binary Location +`C:/Users/User/AppData/Local/Programs/Devin/` — Electron/VSCode fork with Windsurf/Codeium extension. + +## Key Components +``` +Devin.exe (Electron, 216MB) +└── resources/app/extensions/windsurf/ ← Codeium agent extension + └── devin/ + ├── bin/devin.exe (151MB) ← Go/Rust agent binary + └── share/devin/docs/ ← Documentation + ├── essential-commands.mdx ← 5 permission modes, 30+ slash commands + ├── sandbox.mdx ← OS-level isolation (bubblewrap) + ├── adaptive.mdx ← Auto model routing + ├── handoff.mdx ← Transfer to cloud Devin + └── acp/ ← Agent Communication Protocol +``` + +## Permission Modes +1. **Normal** — auto-approves read-only tools, asks for write/execute +2. **Accept Edits** — auto-approves file edits, prompts for shell +3. **Smart** — fast model decides safety of each action +4. **Bypass (YOLO)** — auto-approves everything +5. **Autonomous** — requires `--sandbox`, OS-level isolation + +## Slash Commands +/plan, /ask, /mode, /model, /loop, /compact, /handoff, /resume, /workspace, /hooks, /clear, /exit, /ls, /rm-session + +## Hook System (8 event types) +SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PermissionRequest, PostCompaction, SessionEnd, Stop + +## OMP Equivalent +| Devin | OMP | +|---|---| +| Bypass mode | approvalMode: yolo | +| /plan | plan: deepseek-reasoner:xhigh | +| /ask | advisor: deepseek-v4-pro:max | +| /loop | verification-loop skill | +| Adaptive routing | modelFallback + usageAwareFallback | +| Sandbox | task.isolation: projfs | +| Sessions | checkpoint + remember skill | +| /compact | compaction.autoContinue | +| MCP | 20+ MCP servers | +| 30 workers | maxConcurrency: 30 | +| Hooks | extensions (6 .ts files) | + +## Devin Suite — OMP Implementation +Devin Suite lives at `C:/Users/User/.omp/agent/tools/devin_suite/` and provides: +- FastAPI server with planning, search, agents, sandbox, WebSocket +- 5 permission modes with per-agent state +- 8-event hook system with registry +- Slash command parser and handlers +- Dashboard with 4 tabs (Agents, Plans, Search, Sandbox) +- OMP extension integration diff --git a/our-skills/dotnet-winui3-reverse-engineering/SKILL.md b/our-skills/dotnet-winui3-reverse-engineering/SKILL.md new file mode 100644 index 0000000..b0c7040 --- /dev/null +++ b/our-skills/dotnet-winui3-reverse-engineering/SKILL.md @@ -0,0 +1,92 @@ +--- +name: dotnet-winui3-reverse-engineering +description: "Decompile a WinUI 3 / Windows App SDK MSIX-packaged .NET app to C# source + extract XBF resources from PRI" +--- + +# Reverse Engineering WinUI 3 / Windows App SDK .NET Applications + +## When to use +When you need to decompile a UWP/WinUI 3/Windows App SDK MSIX-packaged .NET application to readable C# source code. + +## Prerequisites +- `dotnet` SDK installed +- `ilspycmd` (install via `dotnet tool install --global ilspycmd`) +- `makepri.exe` from Windows SDK (usually at `C:\Program Files (x86)\Windows Kits\10\bin\\x64\makepri.exe`) +- Target app installed as MSIX (in `C:\Program Files\WindowsApps\`) + +## Procedure + +### 1. Locate the app +```powershell +# Find running process +Get-Process | Select-Object Id,Path +# Or search WindowsApps +Get-ChildItem "C:\Program Files\WindowsApps" -Filter "**" +``` + +### 2. Identify the main DLL +WinUI 3 apps have a thin native .exe loader (~400KB) and the real logic in `.dll` (several MB). Check for `coreclr.dll`, `hostfxr.dll` → .NET 8 runtime. + +### 3. Decompile C# with ILSpy +```bash +# Basic decompile (C# only, no XAML) +ilspycmd ".dll" -p -o "" -r "" + +# With BAML→XAML (works for WPF, NOT for WinUI 3) +ilspycmd ".dll" -p -o "" --decompile-baml -r "" +``` + +**Important:** WinUI 3 compiles XAML to XBF (XAML Binary Format) v2.1, NOT BAML. `--decompile-baml` will NOT produce XAML files. XBF files are embedded in `resources.pri`. + +### 4. Fix csproj for build +- ILSpy generates `` with `HintPath` pointing to install dir — copy DLLs to local `libs/` folder +- Change `15.0` to `preview` (SDK 10 doesn't support 15.0) +- Set `False` to avoid conflicts +- Copy `Microsoft.WindowsAppRuntime.dll` (native, ~1.3MB) to output — it's NOT copied by default + +### 5. Extract XBF from resources.pri +```bash +# Dump PRI to XML +makepri.exe dump /if "\resources.pri" /of "` entries with `` +- Base64 value starts with `WEJG` (= "XBF" in Base64) +- Decode Base64 → write to .xbf files preserving directory structure + +### 6. XBF v2.1 format notes +- Header: magic(4) + metadataSize(uint32) + nodeSize(uint32) = 12 bytes +- Metadata section starts at byte 12, contains: version(2×uint32) + 6 table offsets(uint64) + hash(64 bytes) +- **Table offsets are RELATIVE to metadata start (byte 12), not absolute file offsets** +- String table: count(uint32) + entries [len(uint32) + UTF-16LE chars + 2-byte padding] +- Type/Property tables: 12 bytes per entry (3×uint32), NOT 8 bytes like v1.0 +- Assembly/TypeNamespace tables may have 0 entries +- Node section: starts at byte 12+metadataSize, uses different encoding than v1.0 +- **No working XBF v2.1→XAML decompiler exists** (LibXbf/XbfDecompiler only support v1.0/v2.0) +- Best path to XAML: runtime hook `Application.LoadComponent` in live app + serialize visual tree + +### 7. Smoke-launch limitations +WinUI 3 apps CANNOT run standalone without MSIX registration: +- `Microsoft.UI.Xaml.Application.Start()` requires WinRT activation factory +- WinRT activation needs package identity (AppX registration) +- Error: `FileNotFoundException` in `WinRT.ActivationFactory` → `BaseActivationFactory` +- To launch: create temporary AppX manifest + `Add-AppxPackage`, or run inside original MSIX context + +### 8. Known artifacts in decompiled code +- `//IL_XXXX: Unknown result type` comments in 60+ files (WinRT projection IL) +- `_003C_003Ec` compiler-generated closure classes (from lambda captures) +- `__KnownINotifyPropertyChangedArgs` / `__KnownINotifyPropertyChangingArgs` (CommunityToolkit.Mvvm internals) +- These compile as warnings (CS8632, CS0618) but don't break the build +- **GREEN build ≠ behavior-equivalent to original** — WinRT projection stubs may be semantically incorrect + +## OmniRoute provider architecture (for forks) +- Provider definitions: `src/shared/constants/providers/` split by auth type: + - `noauth.ts` — free, no API key (opencode, felo, duckduckgo) + - `apikey/` — split into `frontier-labs.ts`, `gateways.ts`, `inference-hosts.ts`, `enterprise-cloud.ts`, `regional.ts`, `specialty-media.ts` + - `oauth.ts` — OAuth providers (cursor, zed, kiro) + - `web-cookie.ts` — browser cookie auth + - `local.ts` — Ollama, LM Studio, vLLM +- Provider format: `{ id, alias, name, icon, color, textIcon, website, authHint?, hasFree?, freeNote?, serviceKinds?, notice? }` +- Models: `src/shared/constants/models.ts` + `src/lib/providers/staticModels.ts` +- Aggregated in `providers.ts` → `AI_PROVIDERS` proxy diff --git a/our-skills/re-roast-2026/SKILL.md b/our-skills/re-roast-2026/SKILL.md new file mode 100644 index 0000000..398d044 --- /dev/null +++ b/our-skills/re-roast-2026/SKILL.md @@ -0,0 +1,79 @@ +--- +name: re-roast-2026 +description: "Use when roasting/verifying a reverse-engineering guide, post, or list of RE tools; fact-checking stars/tool counts; link liveness sweep; cutting hyperbole; splitting content into Telegram messages (4096 limit); or when building/evaluating any 2026 RE stack content: IDA/Ghidra/Binary Ninja, Qiling, OGhidra, AI-RE pipeline, IDA licensing. Triggers: прожарка, реверс, реверсинг, RE, reverse engineering, бинарь, дизассемблер, декомпилятор, проверь ссылки, гайд по реверсу, проверить факты в посте." +--- + +# Что делает + +Прожарка RE-контента: факт-чек против первоисточников, свип живости ссылок, срезка гипербол, разбивка под Telegram. Второй контур — канонный верифицированный стек реверс-инжиниринга 2026 (проверен 26.09.2026, 102/102 ссылки живы). + +## When to use + +- Прожарка/разбор чужого гайда по реверсу перед репостом в канал +- Факт-чек цифр (звёзды GitHub, число тулов, доменов, статей) и названий репо/книг +- Свип живости ссылок в MD (102+ ссылок) +- Составление нового RE-материала на проверенном стеке +- Оценка инструмента: лицензия и цена (бесплатно/ограниченно/платно) + +## When NOT to use + +- Сам разбор бинарника, malware, crackme (это другие скиллы: reverse-engineering, malware-analysis) +- Общая редактура текста без RE-темы +- Если не нужно ничего проверять — только писать свежий контент без фактов + +## Workflow (прожарка RE-гайда) + +1. **Триаж ссылок**: извлечь все URL из текста, прогнать `scripts/linkcheck.py`. 403/405 = бот-волл (сайт жив), не мёртвый. 404/сетевая ошибка = кандидат на удаление/замену. +2. **Цифры**: каждое число — против первоисточника (GitHub API/search, README репо). Звёзды, число тулов в описании, число статей/доменов. Несколько источников, если неоднозначно. +3. **Названия**: репо и книги сверять дословно; репо могло переехать (PMAT-course → PMAT-labs). +4. **Лицензии и цены**: пометить каждое ограничение. IDA Pro / Binary Ninja — платные, фраза «всё бесплатное» при них ложь; de4py = CC BY-NC; disrobe = платно для компаний. +5. **Гиперболы**: срезать «инструменты бесполезны», «свободно читаешь», «лучший способ», «от запуска до ответа», «~20 новых 0-day» (тавтология). +6. **Техническая точность**: Qiling исполняет в эмуляции → «без запуска на живой системе»; OGhidra поддерживает и облачные API (приватность только в локальном режиме); промпт-инъекция в бинарнике = «встраивает команды в строки», не «учится разговаривать». +7. **Атрибуция**: при репосте сохранять автора («[REDACTED] ([REDACTED])»), убирать промо-футеры автора (боты/платные ссылки). +8. **Разбивка**: сообщения ≤ 4096 символов, каждое самодостаточно, маркеры `===MSG N/4===`. +9. **Лицензия IDA**: при упоминании IDA Pro добавить раздел про легальные пути (IDA Free, Ghidra, студенческая Hex-Rays) — иначе аудитория идёт за кейгенами и тянет малварь. + +## Success criteria + +- Все ссылки проверены: 0 DEAD, BOTWALL задокументирован +- Каждая цифра текста сходится с первоисточником (с датой проверки) +- Каждое языковое/лицензионное утверждение без гипербол +- Все блоки ≤ 4096 символов +- Под-пост готов, если пользователь просил («под пост» = сообщение-компаньон, в канал не отправлять) + +## Failure modes + +- **Сервер режет HEAD** → GET fallback в linkcheck; 403 Cloudflare/Anubis = живой, не ошибка +- **Цифры устарели между проверками** → писать дату проверки рядом с цифрой +- **Репозиторий переехал** → искать новый owner/название (labs/archive суффиксы), не удалять секцию вслепую +- **Ссылка отдаёт 200 на сайте, но бот-волл браузеру** → не удалять, пометить «жив, отдаёт 403 ботам» + +## Gotchas (проверено 26.09.2026) + +| Факт | Значение | +|---|---| +| binary-ninja-headless-mcp | 181 тул (не 180) | +| firefox-reverse | 857 звёзд (не 855) | +| shannon | 48к звёзд (не 47к) | +| Anthropic-Cybersecurity-Skills | 34 домена (не 29) | +| open-reverselab | 180+ статей (не 194) | +| PMAT | репо PMAT-labs (не PMAT-course) | +| Книга Нарвахи | «Введение в реверсинг с нуля, используя IDA PRO» (перевод на gitbook yutewiyof) | +| Qiling | исполняет код в эмуляции — «без запуска на живой системе», не «без запуска» | +| OGhidra | LLM через Ollama или облачные API; приватность только в локальном режиме | +| de4py | CC BY-NC (некоммерческая) | +| disrobe | платно для компаний | +| Промпт-инъекция в строках бинарника | arxiv 2605.30667 — встраивает команды в строки | +| Гиперболы интро | «свободно читаешь» → «читаешь»; godbolt «лучший способ» — снять | +| IDA лицензия | .hexlic офлайн, JSON+подпись, ключ в бинаре; keygen с приватным ключом публично не подтверждён; пропатченная сборка = вектор малвари | + +## Available scripts + +- `scripts/linkcheck.py` — свип живости ссылок из MD. Запуск из корня скилла: `python scripts/linkcheck.py [--workers N] [--timeout S]`. Stdlib only, exit 0 всегда (отчёт в stdout, формат `CHECK `). + +## References + +- Канон v4.1: `C:/Users/User/tmp/rev-guide-v4.md` (4 сообщения, 3854/3679/3875/1934 симв.) +- Под-пост: `C:/Users/User/tmp/rev-guide-v4-subpost.md` (1363 симв.) +- Автор оригинала: [REDACTED] (https://[REDACTED]) +- Воркфлоу владельца: посты в TG ботом НЕ отправлять, инфу выдавать в чат; «под пост» = сообщение-компаньон \ No newline at end of file diff --git a/our-skills/re-roast-2026/scripts/linkcheck.py b/our-skills/re-roast-2026/scripts/linkcheck.py new file mode 100644 index 0000000..829befd --- /dev/null +++ b/our-skills/re-roast-2026/scripts/linkcheck.py @@ -0,0 +1,94 @@ +#!/usr/bin/env python3 +"""Link liveness sweep for Markdown files (stdlib only). + +Usage: + python linkcheck.py [ ...] [--workers N] [--timeout S] + +Checks every http(s) URL found in the markdown files. +- 403/405 are reported as BOTWALL (bot wall — site is alive, not dead) +- Other HTTP errors are reported with their code +- Network errors/timeouts are reported as DEAD + +Output line format: CHECK +Exit code is always 0; the report is the output. Diagnostics go to stderr. +""" +import argparse +import concurrent.futures +import re +import ssl +import sys +import urllib.error +import urllib.request + +URL_RE = re.compile(r"https?://[^\s()<>{}|\"'`]+") +UA = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " + "(KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36") + + +def probe(url, method, timeout, ctx): + req = urllib.request.Request(url, headers={"User-Agent": UA}, method=method) + try: + with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp: + return resp.status + except urllib.error.HTTPError as e: + return e.code + except Exception: + return None + + +def check(url, timeout): + url = url.rstrip(".,;:!?)]}") + ctx = ssl.create_default_context() + ctx.check_hostname = False + ctx.verify_mode = ssl.CERT_NONE + for method in ("HEAD", "GET"): + status = probe(url, method, timeout, ctx) + if status is not None and status != 999: + if status in (403, 405): + return f"CHECK BOTWALL {status} {url}" + if status < 400: + return f"CHECK {status} {url}" + # 4xx/5xx from HEAD could be server refusing HEAD; try GET first + if method == "GET": + return f"CHECK {status} {url}" + continue + if method == "GET": + break + return f"CHECK DEAD {url}" + + +def collect_urls(files): + urls, seen = [], set() + for path in files: + try: + text = open(path, encoding="utf-8").read() + except OSError as e: + print(f"ERR cannot read {path}: {e}", file=sys.stderr) + continue + for u in URL_RE.findall(text): + if u not in seen: + seen.add(u) + urls.append(u) + return urls + + +def main(): + ap = argparse.ArgumentParser(description="Link liveness sweep for Markdown files.") + ap.add_argument("files", nargs="+", metavar="file.md") + ap.add_argument("--workers", type=int, default=24, help="parallel workers (default: 24)") + ap.add_argument("--timeout", type=float, default=15.0, help="per-request timeout in s (default: 15)") + args = ap.parse_args() + + urls = collect_urls(args.files) + if not urls: + print("CHECK NONE (no URLs found)") + return 0 + + with concurrent.futures.ThreadPoolExecutor(max_workers=args.workers) as pool: + for result in pool.map(lambda u: check(u, args.timeout), urls): + print(result) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) \ No newline at end of file diff --git a/our-skills/rea-full-course/SKILL.md b/our-skills/rea-full-course/SKILL.md new file mode 100644 index 0000000..203fea3 --- /dev/null +++ b/our-skills/rea-full-course/SKILL.md @@ -0,0 +1,130 @@ +--- +name: rea-full-course +description: REA (Reverse Engineer Anything, morluto/rea) — полный практический курс. Установка, движки (Ghidra/IDA/Hopper/JADX), guided-воркфлоу, пак промтов, ограничения. Использовать для реверса Electron/JS, .NET, APK, бинарников, EVM-байткода через AI-агента. +--- + +# REA — Reverse Engineer Anything (полный курс) + +REA = MCP-сервер + CLI (npm `rea-agents`), который даёт AI-агенту (Claude Code, Codex, Cursor, Gemini CLI, Hermes) навык реверс-инжиниринга с доказательствами: функция, файл, вызов + что осталось неизвестным. MIT, работает локально, ничего не загружает наружу. Первый релиз 12.07.2026, 100K+ звёзд за 3 месяца. + +Полный текст курса-источника: `research-what-we-did/rea-full-course-source.md`. + +## Установка + +```bash +node -v # нужен Node 22.19+ / 24.11+ / 26+ (23 и 25 НЕ поддерживаются) +npx rea-agents@latest setup # интерактивно: выбор агента → план изменений → approval → бэкап конфигов +npx -y rea-agents@latest doctor --client claude_code --json # только проверка +npm install --global rea-agents && rea --help # глобальная команда +rea update # фиксы выходят почти ежедневно +``` + +Промт для авто-установки агентом: +``` +Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation. +``` + +После установки — ПОЛНЫЙ рестарт агента (для desktop-приложений недостаточно закрыть окно). + +## Что читает и какие движки нужны + +| Цель | Движок | +|---|---| +| Electron/JS desktop (Notion, Slack, Discord, Obsidian) | ничего, из коробки | +| Сайты (структура, скрипты, сеть) | любой Chrome-family браузер | +| HAR-файлы | ничего | +| .exe / Mach-O / DOS-игры (псевдокод, asm, строки) | Ghidra 12.1.x + JDK 21 (GHIDRA_INSTALL_DIR, JAVA_HOME) или Hopper или IDA | +| .NET (включая Unity-игры — игровая логика часто .NET) | ничего | +| Android APK | JDK 17+ и jadx-headless-mcp 0.7.1 (REA_JADX_MCP_JAR) | +| EVM-байткод смарт-контрактов | только Linux x64 | +| Прошивки, WASM, Go-бинарники | встроенные парсеры | + +Electron-приложения лежат: Win `C:\Users\\AppData\Local\Programs\\resources\app.asar`, Mac `.app/Contents/Resources/app.asar`, Linux `/opt//resources/app.asar`. + +Анализ без запуска приложения: +```bash +npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json +``` + +## Guided-воркфлоу (зашиты в MCP, почти никто не знает) + +- `investigate_feature` — фича от обнаружения до конкретных функций +- `compare_application_versions` — что реально изменилось в апдейте +- `verify_reconstruction` — сверка своей пересборки с сохранёнными доказательствами +- `trace_crash` — креш → пути кода +- `audit_residual_unknowns` — что ещё не доказано +- `prepare_bounded_process_capture` — план безопасного runtime-эксперимента + +Цикл профи: **investigate → spec → build → verify** +``` +Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass. +``` + +## Пак промтов (копипаст в агент с установленной REA) + +Первый тест (2 минуты, официальное training-приложение): +``` +Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes. +Show where notes.csv is written, which fields it contains, and the relevant files and lines. +``` + +Аудит APK: +``` +Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding. +``` + +Проверка токена (байткод → state-функции): +``` +Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred. +``` +(`rea inspect-evm-interface ./runtime.hex hex --json`; имена функций — догадки из байткода, красный флаг = «проверь глубже») + +Дифф версий: +``` +Use REA's compare_application_versions workflow on [old version] and [new version] of [app]. Tell me what actually changed, with evidence. +``` + +Реал-тайм фичи: +``` +Figure out how Discord shows who's typing in real time, show me the proof, and build something similar for my project. +``` + +Реконструкция игры: +``` +Reconstruct a game from its executable and test it against the original. +``` + +## Ограничения (честно) + +- Сервер не трогает — читается только то, что на твоей машине. Банк не взломает. +- Декомпилированный код — реконструкция, не оригинальный исходник → шаг verify обязателен. +- Стрипанные C++-бинарники намного жёстче, чем Unity .NET-игры. +- Агент может отказаться на прошивках/консолях (правила безопасности модели). +- IDA/Hopper/JEB — свои лицензии, крякнутые копии запрещены. + +## Юридическая рамка (clean room) + +Учись на оригинале → пиши СПЕК (поведение, не код) → собирай своё с нуля. Так работали Compaq (BIOS IBM, ~$1M), Sega v. Accolade (1992, fair use), Sony v. Connectix (2000, 3-0). За копирование чужого кода/кряк платных фич/публикацию декомпилята — прилетает иск (Sony v. geohot 2011). + +## Эталонные кейсы + +- Aegis authenticator: 3077 классов → найден генератор 6-значных кодов → пересборка прошла 133/133 теста +- DX-Ball (1996): sound-pan восстановлен на C, 3205 тест-кейсов оригинала, 63/63 байта компиляции +- Touhou: 697 функций, 696 точных совпадений, играбельно за ~12 дней +- Super Mario Sunshine PC-порт: ~365 агенто-часов, 17.3B токенов +- ArtCraft: 7 приложений Adobe как clean-room Rust-альтернативы (альфа) + +## Уроки из практики (пересборка Touhou) + +- Чёткая цель + чёткие критерии приёмки для агента. +- Заметки и проверки — в git, чтобы следующая сессия продолжила. +- Любое объяснение агента = гипотеза, проверять. +- Тестируй свои тесты: сломанное сравнение однажды пропустило неправильную функцию. + +## Локальная практика (наш Windows-стенд, 14.10.2026) + +- rea 6.4.0: `tools/node-26.7.0-win32-x64/rea.cmd`; MCP `rea` в Hermes config = 170 tools. +- IDA attached-режим: env `REA_IDA_MCP_CONFIG` → ida-mcp.json (ida-pro-mcp 1.4.0 legacy, IDA GUI с плагином на :13337). Native-анализ бинарей — ТОЛЬКО через attached IDA. +- Windows-лимиты: binary-layout/pwntools = Linux-only; Go/Rust/WASM/EVM/SQLite-парсеры встроенные. +- Прогнано: `analyze-javascript-application` на TeleSender (90MB Electron) → Evidence-бандл 41878 узлов, JSON. +- Монетизация навыка: bug bounty (пайплайны 8 MCP + 300 инструментов + Ghidra/radare2/Frida окупаются), перенос легаси-софта, связывание тулов, восстановление утраченных исходников для компаний. diff --git a/our-skills/reverse-winui3-app/SKILL.md b/our-skills/reverse-winui3-app/SKILL.md new file mode 100644 index 0000000..fe6aa0b --- /dev/null +++ b/our-skills/reverse-winui3-app/SKILL.md @@ -0,0 +1,130 @@ +--- +name: reverse-winui3-app +description: "Use when reverse engineering a WinUI 3 / .NET 8 MSIX-packaged Windows application — covers ILSpy decompilation, PRI/XBF extraction, and pkg-compiled Node.js backend identification" +--- + +# Reverse Engineering WinUI 3 + pkg-compiled Node.js Applications + +## When to use +- Target is a Windows MSIX-packaged app (WinUI 3 / Windows App SDK) +- App has a separate backend executable compiled with `pkg` +- Need to extract C# source, XAML (XBF), and JS backend code + +## Phase 1: Locate and identify the target + +```powershell +# Find running process +Get-Process | Select Id,Path +# Or search MSIX install +Get-ChildItem "C:\Program Files\WindowsApps" -Directory -Filter "**" +``` + +Identify app type by inspecting install directory: +- `coreclr.dll`, `hostfxr.dll`, `*.dll` (managed) → .NET / WinUI 3 +- `VibeProxy.exe` (small, ~400KB) = native launcher; `VibeProxy.dll` (large) = main logic +- `Watchers\*.exe` (large, 100MB+) = likely pkg-compiled Node.js backend + +## Phase 2: Decompile .NET frontend (ILSpy) + +```bash +# Install ILSpy CLI +dotnet tool install --global ilspycmd + +# Decompile with BAML support and reference path +ilspycmd "target.dll" -p -o "output_dir" --decompile-baml -r "install_dir" + +# Fix csproj: LangVersion=preview, add HintPath for all references +# Copy dependency DLLs to libs/ folder (include large ones >15MB separately) +# Fix CS0136 (duplicate variable names) by renaming +# Build: dotnet build -c Release +``` + +Key limitations: +- WinUI 3 XAML compiles to XBF (not BAML) — `--decompile-baml` won't extract it +- `Unknown result type` comments in 60+ files = WinRT projection IL artifacts +- Smoke-launch fails: WinRT activation requires MSIX package identity + +## Phase 3: Extract XBF from resources.pri + +```bash +# Find makepri.exe in Windows SDK +# Dump PRI to XML (detailed format for Base64 data) +makepri.exe dump /if "install_dir\resources.pri" /of "dump.xml" /dt detailed /o +``` + +```powershell +# Extract XBF binaries from PRI dump XML +[xml]$xml = Get-Content "dump.xml" -Raw +$xbfNodes = $xml.SelectNodes("//NamedResource[contains(@name,'.xbf')]") +foreach ($node in $xbfNodes) { + $name = $node.GetAttribute("name") + $uri = $node.GetAttribute("uri") + $pathPart = $uri -replace "ms-resource://[^/]+/Files/", "" + $candidate = $node.SelectSingleNode("Candidate") + if ($candidate.GetAttribute("type") -eq "EmbeddedData") { + $b64 = $candidate.SelectSingleNode("Base64Value") + $bytes = [System.Convert]::FromBase64String($b64.InnerText) + [System.IO.File]::WriteAllBytes($outPath, $bytes) + } +} +``` + +XBF v2.1 format notes: +- Header: magic(4) + metaSize(uint32) + nodeSize(uint32) = 12 bytes +- Metadata at byte 12: version(2x uint32) + 6 table offsets (uint64, relative to byte 12) + hash (64 bytes) +- Table entries are 12 bytes each (not 8 as in v1.0) +- Node encoding differs from v1.0 — no existing tool supports v2.1 +- Best path to XAML: runtime-hook `LoadComponent` in live app, serialize visual tree + +## Phase 4: Identify and extract pkg-compiled backend + +### Identify pkg binary +``` +PE header: NOT .NET (no CLR header) +Search for: "process.versions.pkg", "pkg/prelude", "/snapshot/" +NODE_SEA_FUSE:0 = disabled (stock Node, not SEA) +pkg version found in binary (e.g., '6.22.0') +``` + +### Extract via runtime unpacking +pkg extracts itself to `%TEMP%\\\\dist` at runtime. +Check if the app has been run: +```powershell +Get-ChildItem "$env:TEMP" -Directory -Filter "**" +Get-ChildItem "$env:TEMP\**\*" -Recurse +``` + +If found, copy the `dist` directory — it contains: +- `server.js` / `server-ws.mjs` (entry points, readable) +- `.build/next/` (Next.js standalone build) +- `.build/next/server/chunks/` (minified but readable JS, 3000+ files) +- `.build/next/server/app/api/` (API routes) +- `package.json` (identifies upstream package + version) + +### Match with upstream +Check `package.json` name + version against GitHub: +- If MIT/Apache licensed → full source available upstream +- Clone the repo for complete TypeScript source (2,600+ .ts/.tsx files) +- Compare extracted dist with git clone to find local modifications + +## Phase 5: Full inventory checklist + +| Item | Source | Method | +|------|--------|--------| +| C# source | VibeProxy.dll | ILSpy decompile | +| XBF (compiled XAML) | resources.pri | makepri dump + extract | +| Assets/icons | MSIX install dir | Copy | +| Locales | MSIX install dir | Copy (check all dirs) | +| config.yaml | Watchers/ | Copy | +| Backend dist | %TEMP% (runtime) | Copy after app run | +| Backend source | GitHub (if MIT) | git clone | +| Build verification | dotnet build | Must be GREEN | +| Sourcemaps | .build/next/ | Usually absent in prod | + +## Common pitfalls +- Don't claim "full source" without building and smoke-testing +- XBF v2.1 ≠ BAML — `--decompile-baml` produces nothing for WinUI 3 +- SEA fuse `:0` means stock Node.js, not SEA — look for `process.versions.pkg` instead +- 210MB gzip trailing data in PE = pkg payload, not SEA blob +- Sourcemaps in production Next.js builds are typically empty (`{"sources":[],"sections":[]}`) +- WinUI 3 apps cannot launch standalone without MSIX registration diff --git a/our-skills/reverse-winui3-pkg-app/SKILL.md b/our-skills/reverse-winui3-pkg-app/SKILL.md new file mode 100644 index 0000000..cb76610 --- /dev/null +++ b/our-skills/reverse-winui3-pkg-app/SKILL.md @@ -0,0 +1,134 @@ +--- +name: reverse-winui3-pkg-app +description: "Reverse engineer a WinUI 3 (.NET 8) desktop app with a pkg-compiled Node.js backend: ILSpy decompilation, XBF extraction from resources.pri, pkg payload extraction, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch" +--- + +# Reverse Engineering WinUI 3 + pkg-compiled Node.js Applications + +## When to use +Reversing a Windows desktop app that is: +- WinUI 3 / Windows App SDK (.NET 8) frontend +- pkg-compiled Node.js backend (VibeProxyServices.exe pattern) +- Installed as MSIX in `C:\Program Files\WindowsApps\` + +## Phase 1: Locate and identify + +```powershell +# Find running process +Get-Process | Where-Object { $_.ProcessName -match 'TargetApp' } +# Get install path +(Get-Process TargetApp).Path +``` + +Identify app type by inspecting install directory: +- `coreclr.dll`, `hostfxr.dll` → .NET 8 app +- `VibeProxy.dll` (main logic) + `VibeProxy.exe` (thin launcher) → ILSpy target +- `resources.pri` → XBF/XAML resources embedded +- `Watchers\*.exe` (large, 100MB+) → likely pkg-compiled Node.js backend + +## Phase 2: Decompile C# with ILSpy + +```bash +# Install ILSpy CLI +dotnet tool install --global ilspycmd + +# Decompile main DLL with reference path for WinRT projections +ilspycmd "C:\path\to\App.dll" -p -o "C:\output\src" -r "C:\path\to\install\dir" +``` + +Key fixes after decompilation: +- `LangVersion` in csproj: change to `preview` (ILSpy may set unsupported version) +- `CS0136` duplicate variables: rename second occurrence +- `FindOrRegisterForKey("literal")`: ILSpy inlines string constants — fix call site to use const +- `Color` ambiguity: qualify as `Windows.UI.Color.FromArgb(...)` not `Color.FromArgb(...)` +- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background` instead +- `Window.RequestedTheme` not available — set theme on child elements instead + +## Phase 3: Extract XBF from resources.pri + +```bash +# Dump PRI with makepri +makepri.exe dump /if "resources.pri" /of "dump.xml" /dt detailed /o + +# Extract XBF binaries from Base64 in dump XML (PowerShell script) +# XBF entries have type="EmbeddedData" with Base64Value +``` + +XBF v2.1 format (WinUI 3): +- Header: 12 bytes (magic + metaSize + nodeSize) +- Offsets are relative to byte 12 (meta_start) +- String table: uint32 count, then length-prefixed UTF-16LE strings with 2-byte padding +- Type/Property tables: 12 bytes per entry (not 8) +- Node section starts at `12 + metaSize` +- Node encoding differs from XBF v1.0 — existing tools (LibXbf) don't work + +## Phase 4: Extract pkg backend + +pkg self-extracts to `%TEMP%\AppName\version\dist` at runtime. +Check there first — no need to parse the 298MB binary. + +```powershell +Get-ChildItem "$env:TEMP\AppName" -Recurse +``` + +If not extracted yet, identify pkg version: +- Search binary for `process.versions.pkg` → e.g. `'6.22.0'` +- Search for `NODE_SEA_FUSE` — if `:0`, it's pkg not SEA +- Trailing data after PE sections is gzip-compressed pkg payload + +## Phase 5: Build and package + +```bash +# Self-contained publish (critical — FDD won't work in MSIX) +dotnet publish App.csproj -c Release -r win-x64 --self-contained true +``` + +Create staging directory from publish output, then overlay original: +- `resources.pri` (XBF, strings, images) +- `Assets/` folder +- `Watchers/` folder +- Locale directories (`xx-XX/`) +- `Microsoft.UI.Xaml/` folder +- Native WinUI DLLs (whitelist — never overwrite published exe/dll) + +## Phase 6: MSIX packaging with self-signed cert + +```powershell +# Create cert matching manifest Publisher +$cert = New-SelfSignedCertificate -Subject "CN=PublisherFromManifest" ... +# Add to Trusted Root and Trusted People +# Pack with makeappx +makeappx.exe pack /d staging /p App.msix /nv +# Sign with signtool +signtool.exe sign /fd SHA256 /a /f cert.pfx /p password App.msix +# Install +Add-AppxPackage -Path App.msix +``` + +Requirements: +- `AllowAllTrustedApps=1` and `AllowDevelopmentWithoutDevLicense=1` in registry +- Manifest Publisher must exactly match cert Subject +- Bump version on each rebuild +- Remove stale `AppxSignature.p7x`, `AppxBlockMap.xml`, `AppxMetadata/` from staging + +## Phase 7: Launch and verify + +```powershell +# Launch via AppsFolder (not Start-Process directly) +Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App' +# Wait 8-15 seconds for WinUI window +# Verify: PID path matches Rev package, MainWindowTitle set, RAM > 150MB +``` + +UI verification: +- UI Automation: `[System.Windows.Automation.AutomationElement]::FromHandle($hwnd)` +- Screenshot + pixel sampling for color/design changes +- Don't trust `base.Title` alone — custom title bar uses `AppTitleTextBlock.Text` + +## Known limitations + +- XAML markup (XBF v2.1) cannot be decompiled — original `resources.pri` is used +- ILSpy leaves `Unknown result type` comments in 61+ files (WinRT projection IL) +- `copy_all.ps1` pattern overwrites rebuilt exe/dll — always rebuild AFTER copying +- `Window.RequestedTheme` not available in WinUI 3 — set theme on child elements +- Process may take 10-15 seconds to create window handle after launch diff --git a/our-skills/vibeproxy-reverse-engineering/SKILL.md b/our-skills/vibeproxy-reverse-engineering/SKILL.md new file mode 100644 index 0000000..57c8792 --- /dev/null +++ b/our-skills/vibeproxy-reverse-engineering/SKILL.md @@ -0,0 +1,145 @@ +--- +name: vibeproxy-reverse-engineering +description: "Reverse engineer VibeProxy (WinUI 3 .NET 8 MSIX app) — ILSpy decompile, self-contained publish, MSIX repackage, and fork 9router backend" +--- + +# VibeProxy Reverse Engineering Pipeline + +## Target +VibeProxy = WinUI 3 / .NET 8 MSIX app (`AtC.VibeProxy_3.7.2.0_x64__g8zz5t3ayajdt`). +Backend = `VibeProxyServices.exe` = pkg-compiled OmniRoute v3.8.50 (MIT). +9router = separate npm package (`9router@0.5.50`, MIT, `github.com/decolua/9router`). + +## Phase 1: Decompile C# (ILSpy) + +```powershell +# Locate MSIX install +$pkg = Get-AppxPackage -Name "AtC.VibeProxy" +$installDir = $pkg.InstallLocation # C:\Program Files\WindowsApps\AtC.VibeProxy_3.7.2.0_x64__g8zz5t3ayajdt + +# Decompile VibeProxy.dll with ILSpy CLI +ilspycmd -p --decompile-baml "$installDir\VibeProxy.dll" -o C:\Users\User\tmp\VibeProxy_src2\ +``` + +### Build fixes required +- `LangVersion=preview` in csproj +- HintPaths to `libs/` directory (copy 244 DLLs from MSIX) +- Fix `CS0136` duplicate variables (rename `upd` → `ins` in SqliteStatsService.cs) +- Fix inline literal `FindOrRegisterForKey("VibeProxy_SingleInstance")` → use const + +### Self-contained publish (NOT framework-dependent) +```powershell +dotnet publish VibeProxy.csproj -c Release -r win-x64 --self-contained true +``` +Original runtimeconfig uses `includedFrameworks` (self-contained). Rebuilt uses `framework` (FDD). Must publish self-contained or app crashes with "No frameworks were found". + +## Phase 2: MSIX Repackage + +### Staging (CRITICAL — never pack from output dir directly) +1. Copy from `bin\Release\net8.0\win-x64\publish\` (NOT `bin\Release\net8.0\`) +2. Overlay original `resources.pri`, `Assets/`, `Watchers/`, `Microsoft.UI.Xaml/`, locale dirs, native WinUI DLLs +3. EXCLUDE stale `AppxSignature.p7x`, `AppxBlockMap.xml`, `AppxMetadata/CodeIntegrity.cat` +4. Write new `AppxManifest.xml` with bumped version and `Publisher` matching cert Subject exactly + +### Cert + Sign + Install +```powershell +# Create self-signed cert +$cert = New-SelfSignedCertificate -Subject "CN=" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}") + +# Add to Trusted Root + Trusted People (LocalMachine) +# Export PFX +# Pack +& makeappx pack /d $staging /p $msixPath /nv +# Sign +& signtool sign /fd SHA256 /a /f $certPath /p $password $msixPath +# Install +Add-AppxPackage -Path $msixPath +``` + +### Launch via AppsFolder +```powershell +Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\!App' +``` +`Start-Process` cannot launch `shell:AppsFolder` URIs directly — use `explorer.exe`. + +### Verification +- `Get-AppxPackage` shows correct version + InstallLocation +- Hash installed `VibeProxy.dll` == publish hash +- Process alive ≥5s with growing RAM +- `MainWindowTitle` = custom title (not "VibeProxy.exe") +- UI Automation confirms text elements +- Pixel sampling confirms color changes + +### CLEANUP (mandatory after install) +Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My`. Delete PFX file. Trusted root + accessible private key = arbitrary code signing. + +## Phase 3: Design changes (code-behind only) + +XAML is compiled to XBF v2.1 in `resources.pri` — NOT decompilable. Changes only via C# code-behind in `MainWindow.cs` constructor after `InitializeComponent()`: + +```csharp +AppTitleTextBlock.Text = "VibeProxy [ENI]"; +AppTitleTextBlock.Foreground = new SolidColorBrush(Windows.UI.Color.FromArgb(255, 168, 85, 247)); +NavView.Background = new SolidColorBrush(Windows.UI.Color.FromArgb(255, 20, 15, 35)); +ContentFrame.BorderBrush = new SolidColorBrush(Windows.UI.Color.FromArgb(255, 168, 85, 247)); +ContentFrame.BorderThickness = new Thickness(2); +``` + +**Gotchas:** +- `Color` is ambiguous between `System.Drawing.Color` and `Windows.UI.Color` — qualify as `Windows.UI.Color.FromArgb(...)` +- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background` +- `Window.RequestedTheme` not available in WinUI 3 — set on child elements +- `NavView.SelectedItem = NavView.MenuItems[0]` MUST be preserved (don't accidentally replace with design code) + +## Phase 4: 9router fork (backend) + +### Clone real upstream (NOT npm pack) +```bash +git clone https://github.com/decolua/9router.git 9router_fork +cd 9router_fork +git checkout -b eni-custom +``` + +### Build +```bash +npm install # WITH devDependencies (next build needs them) +npx next build --webpack # or: npm run build +``` + +### Run dev (no build needed) +```bash +PORT=20130 API_KEY_SECRET=eni-test-key DATA_DIR=./data node node_modules/next/dist/bin/next dev --port 20130 +``` + +### API endpoints +- `/api/health` → `{"ok":true}` (no auth) +- `/v1/models` → 679 models (Bearer auth) +- `/api/v1/chat/completions` → POST (needs configured providers in DB) +- `/api/monitoring/health` → VibeProxy health check endpoint + +### API key generation +```javascript +// Format: {prefix}-{machineId}-{keyId}-{crc8} +// prefix: "sk" (default) or "eni" (custom) +// CRC = HMAC-SHA256(API_KEY_SECRET, machineId + keyId).slice(0,8) +``` + +### VibeProxy ↔ 9router integration +VibeProxy expects OmniRoute API (`/api/monitoring/health`, `/api/providers/{id}/login`, `/api/oauth/`). +9router has different API (`/api/health`, `/api/v1/chat/completions`). +Direct swap of VibeProxyServices.exe with 9router won't work — API incompatible. +VibeProxyServices.exe = pkg-compiled OmniRoute, NOT 9router. +OmniRoute installs 9router as embedded service via `npm install 9router`. + +## Key paths +- ILSpy output: `C:\Users\User\tmp\VibeProxy_src2\` +- OmniRoute clone: `C:\Users\User\Projects\OmniRoute_fork\` (v3.8.50, MIT) +- 9router clone: `C:\Users\User\Projects\9router_fork\` (v0.5.50, MIT) +- MakeAppx: `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\makeappx.exe` +- Signtool: `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe` + +## What's NOT recovered +- XAML markup (24 XBF v2.1 files in resources.pri — format undocumented) +- ILSpy artifacts (`Unknown result type` in 61+ files — WinRT projection IL) +- Sourcemaps (production build, all empty) +- VibeProxy-specific backend delta (diff between OmniRoute git and extracted dist not proven) diff --git a/our-skills/vibeproxy-reverse-pipeline/SKILL.md b/our-skills/vibeproxy-reverse-pipeline/SKILL.md new file mode 100644 index 0000000..844eea9 --- /dev/null +++ b/our-skills/vibeproxy-reverse-pipeline/SKILL.md @@ -0,0 +1,73 @@ +--- +name: vibeproxy-reverse-pipeline +description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX staging/sign/install, and design modification with pixel verification" +--- + +# VibeProxy Reverse Engineering Pipeline + +## Architecture +- VibeProxy = WinUI 3 (.NET 8) MSIX app, C# code-behind + XAML (XBF v2.1 compiled) +- VibeProxyServices.exe = pkg-compiled OmniRoute v3.8.50 (Node.js Next.js standalone) +- VibeProxy launches VibeProxyServices.exe as child process on internal port (8316), proxies via external port (8317) +- Backend API: `/api/monitoring/health`, `/api/providers/{id}/login`, `/api/oauth/` — OmniRoute endpoints, NOT 9router +- 9router = separate npm package (v0.5.50), installed by OmniRoute's service manager, NOT the same as OmniRoute + +## Steps + +### 1. Decompile +```bash +ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\AtC.VibeProxy_3.7.2.0_x64__g8zz5t3ayajdt\VibeProxy.dll" -o VibeProxy_src2 +``` +- Fix CS0136 duplicate variables, inline literals, LangVersion=preview in csproj +- HintPaths to libs/ directory with 244 DLLs + +### 2. Publish self-contained +```bash +dotnet publish VibeProxy.csproj -c Release -r win-x64 --self-contained true +``` +- Framework-dependent build fails in MSIX (no framework found) +- Self-contained bundles .NET runtime in package + +### 3. Stage MSIX +- Copy publish output to staging dir +- Overlay original resources.pri, Assets/, Watchers/, locale dirs, Microsoft.UI.Xaml/, native WinUI DLLs +- EXCLUDE: AppxSignature.p7x, AppxBlockMap.xml, AppxMetadata/ from staging +- Write AppxManifest.xml with new Identity (Name=AtC.VibeProxyRev, bumped Version, Publisher=CN=...) +- Publisher MUST exactly match cert Subject + +### 4. Sign and install +```powershell +New-SelfSignedCertificate -Subject "CN=..." -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}") +# Add to Trusted Root + Trusted People (LocalMachine) +makeappx pack /d staging /p output.msix /nv +signtool sign /fd SHA256 /a /f cert.pfx /p password output.msix +Add-AppxPackage -Path output.msix +``` + +### 5. Launch and verify +```powershell +Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App' +# Wait 8+ seconds, check PID path matches Rev package +# Verify via UI Automation (System.Windows.Automation) for text elements +# Verify via pixel sampling (System.Drawing.Bitmap.GetPixel) for color changes +``` + +### 6. Cleanup +- Remove self-signed cert from LocalMachine\Root, TrustedPeople, CurrentUser\My +- Delete PFX file +- Installed MSIX continues to work without cert in store + +## Key gotchas +- PowerShell `$_` variables get stripped through bash inline — use .ps1 script files +- `RequestedTheme` not available on Window in WinUI 3 +- `NavigationView.PaneBackground` doesn't exist in WinUI 3 +- `Color` is ambiguous between System.Drawing.Color and Windows.UI.Color — qualify as Windows.UI.Color +- NavView.SelectedItem must be preserved when adding design changes +- XBF v2.1 format not decompilable — XAML structure uses original resources.pri +- ILSpy artifacts (Unknown result type, _003C compiler classes) in 61+ files — code compiles but WinRT projection incomplete + +## What's NOT reversible +- XAML markup (24 XBF files) — format v2.1, node encoding unknown +- ILSpy WinRT projection artifacts +- Backend sourcemaps (production build, empty .js.map) +- VibeProxy-specific OmniRoute delta (diff between git clone and extracted dist not proven) diff --git a/our-skills/winui3-msix-reverse-rebuild/SKILL.md b/our-skills/winui3-msix-reverse-rebuild/SKILL.md new file mode 100644 index 0000000..f532d59 --- /dev/null +++ b/our-skills/winui3-msix-reverse-rebuild/SKILL.md @@ -0,0 +1,86 @@ +--- +name: winui3-msix-reverse-rebuild +description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder" +--- + +# WinUI 3 MSIX Reverse & Rebuild Pipeline + +## When to use +Reverse engineering an installed WinUI 3 / .NET 8 MSIX application: decompile C#, rebuild, repackage as MSIX, and launch side-by-side with the original. + +## Prerequisites +- ILSpy CLI (`ilspycmd`) installed +- .NET 8 SDK +- Windows SDK (makeappx.exe, signtool.exe) at `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\` +- Target MSIX installed (to access original files in `C:\Program Files\WindowsApps\`) + +## Steps + +### 1. Locate & decompile +```powershell +# Find installed MSIX +Get-AppxPackage -Name "*TargetApp*" + +# Decompile main DLL +ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\\TargetApp.dll" -o C:\Users\User\tmp\TargetApp_src\ +``` + +### 2. Fix build errors +- Set `preview` in .csproj +- Add `` entries for all DLLs from the MSIX package +- Fix `CS0136` duplicate variables (rename) +- Fix `CS0104` ambiguous references (qualify with `Windows.UI.Color` not `System.Drawing.Color`) +- Fix inline literals (e.g. `FindOrRegisterForKey("...")` → use const) + +### 3. Self-contained publish +```powershell +dotnet publish TargetApp.csproj -c Release -r win-x64 --self-contained true +``` +**Critical**: Framework-dependent build fails inside MSIX — must use `--self-contained true`. + +### 4. Stage MSIX payload +- Copy publish output to staging dir +- Overlay original `resources.pri`, `Assets/`, `Watchers/`, locale dirs, `Microsoft.UI.Xaml/` +- Overlay native WinUI DLLs (whitelist, never overwrite published exe/dll) +- Write new `AppxManifest.xml` with bumped version and same Publisher CN + +### 5. Cert & sign +```powershell +# Create self-signed cert matching original Publisher CN +$cert = New-SelfSignedCertificate -Subject "CN=" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}") + +# Add to Trusted Root and Trusted People (LocalMachine) +# Export PFX +# Pack with makeappx /nv +# Sign with signtool /fd SHA256 +``` + +### 6. Install & launch +```powershell +Add-AppxPackage -Path TargetAppRev.msix +# Launch via AppsFolder (NOT Start-Process directly) +Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\!App' +``` + +### 7. Verify +- Check `Get-AppxPackage` shows new version +- Check process path starts with Rev package InstallLocation +- Check MainWindowTitle and RAM growing (not stuck at 17MB) +- Use UI Automation to verify text elements inside window +- Sample pixel colors from screenshot for design changes + +### 8. Cleanup (IMPORTANT) +- Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My` +- Delete PFX file +- Trusted root + accessible private key = arbitrary code signing capability + +## Gotchas +- `RequestedTheme` not available on `Window` in WinUI 3 — use `ElementTheme` on child elements +- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background` +- `base.Title` changes Windows title bar but custom title bar uses `AppTitleTextBlock.Text` +- XBF v2.1 (XAML binary) is NOT decompilable — UI structure stays from original `resources.pri` +- `NavView.SelectedItem = NavView.MenuItems[0]` must be preserved or dashboard won't load +- PowerShell `$` variables get stripped through bash inline — use `.ps1` script files +- `Start-Process 'shell:AppsFolder\...'` fails — use `explorer.exe` as intermediary +- Process alive at 17MB RAM with title "AppName.exe" = crashed (.NET framework not found) +- Process alive at 200MB+ RAM with proper title = working diff --git a/our-skills/winui3-msix-reverse/SKILL.md b/our-skills/winui3-msix-reverse/SKILL.md new file mode 100644 index 0000000..59ff80f --- /dev/null +++ b/our-skills/winui3-msix-reverse/SKILL.md @@ -0,0 +1,107 @@ +--- +name: winui3-msix-reverse +description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, rebuild with dotnet publish self-contained, overlay original native assets, loose-register without admin, add custom pages" +--- + +# Reverse Engineering WinUI 3 MSIX Apps + +## Prerequisites +- ILSpy CLI (`ilspycmd`) installed via dotnet tool +- Windows SDK (makeappx.exe, signtool.exe) +- .NET 8 SDK +- Target MSIX installed (locate via `Get-AppxPackage`) + +## Step 1: Decompile +```bash +ilspycmd -p --decompile-baml "C:\Path\To\Target.dll" -o "C:\Output\src" +``` +- Produces C# files from .NET assembly +- `--decompile-baml` attempts XAML but XBF v2+ may not decompile +- Fix CS errors (duplicate variables, ambiguous references, missing `using`) + +## Step 2: Build +```bash +dotnet publish Project.csproj -c Release -r win-x64 --self-contained true +``` +- **Must use `--self-contained true`** — original MSIX bundles .NET runtime, FDD will fail with "No frameworks were found" +- Original `runtimeconfig.json` uses `includedFrameworks`, rebuilt uses `framework` — self-contained fixes this + +## Step 3: Overlay Original Assets +Copy from original MSIX install dir to publish output: +- `resources.pri` (XBF, strings, images) +- `Assets/` folder +- `Watchers/` folder (backend executables) +- Locale dirs (`xx-YY/` pattern) +- `Microsoft.UI.Xaml/` folder +- Native WinUI DLLs (CoreMessagingXP.dll, dcompi.dll, etc.) +- **Never overwrite rebuilt VibeProxy.exe/dll** + +## Step 4: Create AppxManifest.xml +- New `Identity` Name (e.g. `AtC.VibeProxyRev`) +- Same Publisher CN as original +- Bump Version (e.g. `3.7.2.8`) +- Same `EntryPoint="Windows.FullTrustApplication"` +- `rescap:Capability Name="runFullTrust"` + +## Step 5: Register — Two Options + +### Option A: Loose Register (no admin, no signing) — PREFERRED +```powershell +# Enable dev mode +Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -Name "AllowDevelopmentWithoutDevLicense" -Value 1 +# Register from staging dir +Add-AppxPackage -Register "C:\Staging\AppxManifest.xml" +``` +- No cert needed, no admin for cert stores +- Package runs from staging dir, not WindowsApps +- Works when `AllowAllTrustedApps=1` + `AllowDevelopmentWithoutDevLicense=1` + +### Option B: Signed MSIX (requires admin for cert stores) +```powershell +# Create self-signed cert +$cert = New-SelfSignedCertificate -Subject "CN=..." -CertStoreLocation "Cert:\CurrentUser\My" ... +# MUST add to LocalMachine\Root and LocalMachine\TrustedPeople (requires admin) +# CurrentUser\Root is NOT trusted for MSIX — returns 0x800B0109 +# Pack +makeappx pack /d Staging /p Output.msix /nv +# Sign +signtool sign /fd SHA256 /a /f cert.pfx /p password Output.msix +# Install +Add-AppxPackage -Path Output.msix +# CLEANUP: Remove cert from all stores + delete PFX after install +``` + +## Step 6: Launch +```powershell +Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App' +``` +- Wait ≥8 seconds before checking process +- Verify: PID path starts with Rev package, not original +- Check `MainWindowTitle` is non-empty +- RAM > 150MB indicates UI rendered + +## Step 7: Verify Changes +- UI Automation: `[System.Windows.Automation.AutomationElement]::FromHandle($proc.MainWindowHandle)` +- Find Text elements by name to confirm UI changes visible +- Screenshot + pixel sampling for visual proof + +## Step 8: Add Custom Functions +- Create new `Page` subclass in `VibeProxy.Views/` +- Add routing in `NavigateToTag`: `"CustomPage" => typeof(CustomPage)` +- Add `NavigationViewItem` programmatically in constructor: +```csharp +var navItem = new NavigationViewItem { Content = "Custom", Tag = "CustomPage", Icon = new FontIcon { Glyph = "\uE9D9;" } }; +NavView.MenuItems.Add(navItem); +``` +- Verify via UI Automation: find ListItem with name matching Content + +## Critical Lessons +- **PowerShell `$_` gets stripped through bash inline** — always use `.ps1` script files +- **`CurrentUser\Root` cert store is NOT trusted for MSIX** — must use `LocalMachine` (admin) or loose register +- **XBF v2.1 XAML not decompilable** — use original `resources.pri`, modify UI programmatically in C# +- **`NavView.PaneBackground` doesn't exist in WinUI 3** — use `NavView.Background` instead +- **`Window.RequestedTheme` not available** — set theme on child elements +- **`Color` is ambiguous** — qualify as `Windows.UI.Color.FromArgb(...)` +- **Self-contained publish is mandatory** — FDD fails in MSIX without framework discovery +- **`makeappx pack` on 1200+ files takes ~70 seconds** — use async/background +- **`Add-AppxPackage` on 300MB MSIX takes minutes** — use loose register instead diff --git a/our-skills/winui3-reverse-engineering/SKILL.md b/our-skills/winui3-reverse-engineering/SKILL.md new file mode 100644 index 0000000..3699d76 --- /dev/null +++ b/our-skills/winui3-reverse-engineering/SKILL.md @@ -0,0 +1,133 @@ +--- +name: winui3-reverse-engineering +description: "Reverse engineer WinUI 3 / .NET 8 MSIX applications: ILSpy decompilation, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch with modified code" +--- + +# WinUI 3 Reverse Engineering Pipeline + +## When to use +Reverse engineering a WinUI 3 / Windows App SDK / .NET 8 MSIX-packaged desktop application. Produces editable C# source, rebuildable MSIX, and a running modified app side-by-side with the original. + +## Prerequisites +- ILSpy CLI (`dotnet tool install --global ilspycmd`) +- .NET 8 SDK +- Windows SDK (makeappx.exe, signtool.exe, makepri.exe) +- PowerShell 5+ +- Target app installed as MSIX (in `C:\Program Files\WindowsApps\`) + +## Steps + +### 1. Locate the app +```powershell +Get-Process | Select-Object Id,Path +# Path will be like C:\Program Files\WindowsApps\\.exe +``` + +### 2. Identify the stack +- `.dll` next to `.exe` = .NET app (check for `coreclr.dll`, `hostfxr.dll`) +- Main `.dll` (3+ MB) = application logic; `.exe` (small) = native loader +- `resources.pri` = XAML binary (XBF) + strings + images +- `Watchers\` or similar = backend services (may be pkg-compiled Node.js) + +### 3. Decompile C# +```bash +ilspycmd "C:\path\to\App.dll" -p -o "C:\output\src" --decompile-baml -r "C:\path\to\install\dir" +``` +- `--decompile-baml` may not work for WinUI 3 (XBF v2.1, not BAML) +- `-r` provides reference path for dependency resolution + +### 4. Fix csproj +- ILSpy generates bare `` without HintPath for WinRT projections +- Copy all DLLs from install dir to `libs/` folder +- Add `libs\*.dll` for each reference +- Set `preview` (ILSpy may emit unsupported version) +- Set `False` + +### 5. Fix common compile errors +- **CS0136** (duplicate variable): rename one occurrence +- **CS0104** (ambiguous `Color`): qualify as `Windows.UI.Color.FromArgb(...)` +- **CS1061** (`PaneBackground` not on NavView): use `Background` instead +- **CS1061** (`RequestedTheme` not on Window): set on `Content` element instead +- ILSpy inlines `const` values — fix inline literals (e.g., `FindOrRegisterForKey("OriginalKey")` → `FindOrRegisterForKey(AppInstanceKey)`) + +### 6. Publish self-contained +```bash +dotnet publish App.csproj -c Release -r win-x64 --self-contained true +``` +- Framework-dependent publish fails in MSIX (no global .NET runtime visible) +- Self-contained bundles .NET runtime into the package + +### 7. Overlay original assets +Copy from original MSIX to publish output (whitelist only, never overwrite published exe/dll): +- `resources.pri` (XBF, strings, images) +- `Assets/` folder +- `Watchers/` folder (backend) +- Locale directories (`xx-XX/`) +- `Microsoft.UI.Xaml/` folder +- Native WinUI DLLs (Microsoft.UI.Xaml.Controls.dll, CoreMessagingXP.dll, etc.) +- `Microsoft.WindowsAppRuntime.dll`, `.Bootstrap.dll`, `.Bootstrap.Net.dll` + +### 8. Create AppxManifest with new identity +```xml + +``` +- Use same Publisher CN as original (for cert matching) +- Bump version on each rebuild +- Keep `runFullTrust` capability + +### 9. Self-signed cert + MSIX packaging +```powershell +# Create cert matching manifest Publisher +$cert = New-SelfSignedCertificate -Subject "CN=" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}") + +# Add to Trusted Root and Trusted People +# Export PFX, sign MSIX with signtool +# Register with Add-AppxPackage + +# CRITICAL: Remove cert from all stores and delete PFX after install +# See cleanup section below +``` + +### 10. Launch and verify +```powershell +Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\!App' +Start-Sleep -Seconds 10 # WinUI 3 needs time to initialize +# Verify: PID, Path (must be Rev package), MainWindowTitle, RAM > 100MB +# UI Automation: [System.Windows.Automation.AutomationElement]::FromHandle() +# Screenshot: System.Drawing.Bitmap + CopyFromScreen + GetPixel for color verification +``` + +## Key gotchas +- WinUI 3 XAML is compiled to XBF v2.1 in `resources.pri`, NOT BAML — ILSpy `--decompile-baml` won't extract it +- `copy_all.ps1` that copies ALL MSIX files will overwrite rebuilt exe/dll with originals — always whitelist +- `NODE_SEA_FUSE:0` = disabled SEA; check for `pkg` markers (`PRELUDE_POSITION`, `process.versions.pkg`) instead +- pkg auto-extracts to `%TEMP%\\\dist` — check there before manual extraction +- Cert in LocalMachine\Root with accessible PFX = code signing security risk — always cleanup after +- `Start-Process` cannot launch `shell:AppsFolder` URIs directly — use `explorer.exe` as intermediary +- Process may show 0x0 window for 10+ seconds before UI initializes — wait before screenshot + +## XBF extraction (if needed) +```powershell +# Dump PRI +makepri.exe dump /if "resources.pri" /of "dump.xml" /dt detailed /o +# Extract XBF from Base64 in XML +# XBF v2.1 offsets are relative to metadata start (byte 12), not absolute +# Table entries are 12 bytes each (not 8 as in v1.0) +# Node encoding differs from v1.0 — no working open-source parser exists +``` + +## pkg-compiled Node.js backend detection +- PE header: no CLR header (not .NET) +- Search for `NODE_SEA_FUSE`, `pkg/prelude`, `process.versions.pkg` +- `process.versions.pkg = '6.22.0'` confirms pkg version +- Trailing data after PE sections (gzip compressed) = pkg payload +- Auto-extraction: check `%TEMP%\\` for already-extracted dist + +## Security cleanup (MANDATORY after install) +```powershell +# Remove self-signed cert from all stores +$certSubject = "CN=" +# Remove from LocalMachine\Root, LocalMachine\TrustedPeople, CurrentUser\My +# Delete PFX file +# Verify: Get-ChildItem Cert:\... | Where-Object { $_.Subject -eq $certSubject } returns empty +``` diff --git a/protocol-reverse-engineering/SKILL.md b/protocol-reverse-engineering/SKILL.md new file mode 100644 index 0000000..a5d0d9e --- /dev/null +++ b/protocol-reverse-engineering/SKILL.md @@ -0,0 +1,520 @@ +--- +name: protocol-reverse-engineering +description: Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication. +--- + +# Protocol Reverse Engineering + +Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging. + +## Traffic Capture + +### Wireshark Capture + +```bash +# Capture on specific interface +wireshark -i eth0 -k + +# Capture with filter +wireshark -i eth0 -k -f "port 443" + +# Capture to file +tshark -i eth0 -w capture.pcap + +# Ring buffer capture (rotate files) +tshark -i eth0 -b filesize:100000 -b files:10 -w capture.pcap +``` + +### tcpdump Capture + +```bash +# Basic capture +tcpdump -i eth0 -w capture.pcap + +# With filter +tcpdump -i eth0 port 8080 -w capture.pcap + +# Capture specific bytes +tcpdump -i eth0 -s 0 -w capture.pcap # Full packet + +# Real-time display +tcpdump -i eth0 -X port 80 +``` + +### Man-in-the-Middle Capture + +```bash +# mitmproxy for HTTP/HTTPS +mitmproxy --mode transparent -p 8080 + +# SSL/TLS interception +mitmproxy --mode transparent --ssl-insecure + +# Dump to file +mitmdump -w traffic.mitm + +# Burp Suite +# Configure browser proxy to 127.0.0.1:8080 +``` + +## Protocol Analysis + +### Wireshark Analysis + +``` +# Display filters +tcp.port == 8080 +http.request.method == "POST" +ip.addr == 192.168.1.1 +tcp.flags.syn == 1 && tcp.flags.ack == 0 +frame contains "password" + +# Following streams +Right-click > Follow > TCP Stream +Right-click > Follow > HTTP Stream + +# Export objects +File > Export Objects > HTTP + +# Decryption +Edit > Preferences > Protocols > TLS + - (Pre)-Master-Secret log filename + - RSA keys list +``` + +### tshark Analysis + +```bash +# Extract specific fields +tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port + +# Statistics +tshark -r capture.pcap -q -z conv,tcp +tshark -r capture.pcap -q -z endpoints,ip + +# Filter and extract +tshark -r capture.pcap -Y "http" -T json > http_traffic.json + +# Protocol hierarchy +tshark -r capture.pcap -q -z io,phs +``` + +### Scapy for Custom Analysis + +```python +from scapy.all import * + +# Read pcap +packets = rdpcap("capture.pcap") + +# Analyze packets +for pkt in packets: + if pkt.haslayer(TCP): + print(f"Src: {pkt[IP].src}:{pkt[TCP].sport}") + print(f"Dst: {pkt[IP].dst}:{pkt[TCP].dport}") + if pkt.haslayer(Raw): + print(f"Data: {pkt[Raw].load[:50]}") + +# Filter packets +http_packets = [p for p in packets if p.haslayer(TCP) + and (p[TCP].sport == 80 or p[TCP].dport == 80)] + +# Create custom packets +pkt = IP(dst="target")/TCP(dport=80)/Raw(load="GET / HTTP/1.1\r\n") +send(pkt) +``` + +## Protocol Identification + +### Common Protocol Signatures + +``` +HTTP - "HTTP/1." or "GET " or "POST " at start +TLS/SSL - 0x16 0x03 (record layer) +DNS - UDP port 53, specific header format +SMB - 0xFF 0x53 0x4D 0x42 ("SMB" signature) +SSH - "SSH-2.0" banner +FTP - "220 " response, "USER " command +SMTP - "220 " banner, "EHLO" command +MySQL - 0x00 length prefix, protocol version +PostgreSQL - 0x00 0x00 0x00 startup length +Redis - "*" RESP array prefix +MongoDB - BSON documents with specific header +``` + +### Protocol Header Patterns + +``` ++--------+--------+--------+--------+ +| Magic number / Signature | ++--------+--------+--------+--------+ +| Version | Flags | ++--------+--------+--------+--------+ +| Length | Message Type | ++--------+--------+--------+--------+ +| Sequence Number / Session ID | ++--------+--------+--------+--------+ +| Payload... | ++--------+--------+--------+--------+ +``` + +## Binary Protocol Analysis + +### Structure Identification + +```python +# Common patterns in binary protocols + +# Length-prefixed message +struct Message { + uint32_t length; # Total message length + uint16_t msg_type; # Message type identifier + uint8_t flags; # Flags/options + uint8_t reserved; # Padding/alignment + uint8_t payload[]; # Variable-length payload +}; + +# Type-Length-Value (TLV) +struct TLV { + uint8_t type; # Field type + uint16_t length; # Field length + uint8_t value[]; # Field data +}; + +# Fixed header + variable payload +struct Packet { + uint8_t magic[4]; # "ABCD" signature + uint32_t version; + uint32_t payload_len; + uint32_t checksum; # CRC32 or similar + uint8_t payload[]; +}; +``` + +### Python Protocol Parser + +```python +import struct +from dataclasses import dataclass + +@dataclass +class MessageHeader: + magic: bytes + version: int + msg_type: int + length: int + + @classmethod + def from_bytes(cls, data: bytes): + magic, version, msg_type, length = struct.unpack( + ">4sHHI", data[:12] + ) + return cls(magic, version, msg_type, length) + +def parse_messages(data: bytes): + offset = 0 + messages = [] + + while offset < len(data): + header = MessageHeader.from_bytes(data[offset:]) + payload = data[offset+12:offset+12+header.length] + messages.append((header, payload)) + offset += 12 + header.length + + return messages + +# Parse TLV structure +def parse_tlv(data: bytes): + fields = [] + offset = 0 + + while offset < len(data): + field_type = data[offset] + length = struct.unpack(">H", data[offset+1:offset+3])[0] + value = data[offset+3:offset+3+length] + fields.append((field_type, value)) + offset += 3 + length + + return fields +``` + +### Hex Dump Analysis + +```python +def hexdump(data: bytes, width: int = 16): + """Format binary data as hex dump.""" + lines = [] + for i in range(0, len(data), width): + chunk = data[i:i+width] + hex_part = ' '.join(f'{b:02x}' for b in chunk) + ascii_part = ''.join( + chr(b) if 32 <= b < 127 else '.' + for b in chunk + ) + lines.append(f'{i:08x} {hex_part:<{width*3}} {ascii_part}') + return '\n'.join(lines) + +# Example output: +# 00000000 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d HTTP/1.1 200 OK. +# 00000010 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 .Content-Type: t +``` + +## Encryption Analysis + +### Identifying Encryption + +```python +# Entropy analysis - high entropy suggests encryption/compression +import math +from collections import Counter + +def entropy(data: bytes) -> float: + if not data: + return 0.0 + counter = Counter(data) + probs = [count / len(data) for count in counter.values()] + return -sum(p * math.log2(p) for p in probs) + +# Entropy thresholds: +# < 6.0: Likely plaintext or structured data +# 6.0-7.5: Possibly compressed +# > 7.5: Likely encrypted or random + +# Common encryption indicators +# - High, uniform entropy +# - No obvious structure or patterns +# - Length often multiple of block size (16 for AES) +# - Possible IV at start (16 bytes for AES-CBC) +``` + +### TLS Analysis + +```bash +# Extract TLS metadata +tshark -r capture.pcap -Y "ssl.handshake" \ + -T fields -e ip.src -e ssl.handshake.ciphersuite + +# JA3 fingerprinting (client) +tshark -r capture.pcap -Y "ssl.handshake.type == 1" \ + -T fields -e ssl.handshake.ja3 + +# JA3S fingerprinting (server) +tshark -r capture.pcap -Y "ssl.handshake.type == 2" \ + -T fields -e ssl.handshake.ja3s + +# Certificate extraction +tshark -r capture.pcap -Y "ssl.handshake.certificate" \ + -T fields -e x509sat.printableString +``` + +### Decryption Approaches + +```bash +# Pre-master secret log (browser) +export SSLKEYLOGFILE=/tmp/keys.log + +# Configure Wireshark +# Edit > Preferences > Protocols > TLS +# (Pre)-Master-Secret log filename: /tmp/keys.log + +# Decrypt with private key (if available) +# Only works for RSA key exchange +# Edit > Preferences > Protocols > TLS > RSA keys list +``` + +## Custom Protocol Documentation + +### Protocol Specification Template + +```markdown +# Protocol Name Specification + +## Overview + +Brief description of protocol purpose and design. + +## Transport + +- Layer: TCP/UDP +- Port: XXXX +- Encryption: TLS 1.2+ + +## Message Format + +### Header (12 bytes) + +| Offset | Size | Field | Description | +| ------ | ---- | ------- | ----------------------- | +| 0 | 4 | Magic | 0x50524F54 ("PROT") | +| 4 | 2 | Version | Protocol version (1) | +| 6 | 2 | Type | Message type identifier | +| 8 | 4 | Length | Payload length in bytes | + +### Message Types + +| Type | Name | Description | +| ---- | --------- | ---------------------- | +| 0x01 | HELLO | Connection initiation | +| 0x02 | HELLO_ACK | Connection accepted | +| 0x03 | DATA | Application data | +| 0x04 | CLOSE | Connection termination | + +### Type 0x01: HELLO + +| Offset | Size | Field | Description | +| ------ | ---- | ---------- | ------------------------ | +| 0 | 4 | ClientID | Unique client identifier | +| 4 | 2 | Flags | Connection flags | +| 6 | var | Extensions | TLV-encoded extensions | + +## State Machine +``` + +[INIT] --HELLO--> [WAIT_ACK] --HELLO_ACK--> [CONNECTED] +| +DATA/DATA +| +[CLOSED] <--CLOSE--+ + +``` + +## Examples +### Connection Establishment +``` + +Client -> Server: HELLO (ClientID=0x12345678) +Server -> Client: HELLO_ACK (Status=OK) +Client -> Server: DATA (payload) + +``` + +``` + +### Wireshark Dissector (Lua) + +```lua +-- custom_protocol.lua +local proto = Proto("custom", "Custom Protocol") + +-- Define fields +local f_magic = ProtoField.string("custom.magic", "Magic") +local f_version = ProtoField.uint16("custom.version", "Version") +local f_type = ProtoField.uint16("custom.type", "Type") +local f_length = ProtoField.uint32("custom.length", "Length") +local f_payload = ProtoField.bytes("custom.payload", "Payload") + +proto.fields = { f_magic, f_version, f_type, f_length, f_payload } + +-- Message type names +local msg_types = { + [0x01] = "HELLO", + [0x02] = "HELLO_ACK", + [0x03] = "DATA", + [0x04] = "CLOSE" +} + +function proto.dissector(buffer, pinfo, tree) + pinfo.cols.protocol = "CUSTOM" + + local subtree = tree:add(proto, buffer()) + + -- Parse header + subtree:add(f_magic, buffer(0, 4)) + subtree:add(f_version, buffer(4, 2)) + + local msg_type = buffer(6, 2):uint() + subtree:add(f_type, buffer(6, 2)):append_text( + " (" .. (msg_types[msg_type] or "Unknown") .. ")" + ) + + local length = buffer(8, 4):uint() + subtree:add(f_length, buffer(8, 4)) + + if length > 0 then + subtree:add(f_payload, buffer(12, length)) + end +end + +-- Register for TCP port +local tcp_table = DissectorTable.get("tcp.port") +tcp_table:add(8888, proto) +``` + +## Active Testing + +### Fuzzing with Boofuzz + +```python +from boofuzz import * + +def main(): + session = Session( + target=Target( + connection=TCPSocketConnection("target", 8888) + ) + ) + + # Define protocol structure + s_initialize("HELLO") + s_static(b"\x50\x52\x4f\x54") # Magic + s_word(1, name="version") # Version + s_word(0x01, name="type") # Type (HELLO) + s_size("payload", length=4) # Length field + s_block_start("payload") + s_dword(0x12345678, name="client_id") + s_word(0, name="flags") + s_block_end() + + session.connect(s_get("HELLO")) + session.fuzz() + +if __name__ == "__main__": + main() +``` + +### Replay and Modification + +```python +from scapy.all import * + +# Replay captured traffic +packets = rdpcap("capture.pcap") +for pkt in packets: + if pkt.haslayer(TCP) and pkt[TCP].dport == 8888: + send(pkt) + +# Modify and replay +for pkt in packets: + if pkt.haslayer(Raw): + # Modify payload + original = pkt[Raw].load + modified = original.replace(b"client", b"CLIENT") + pkt[Raw].load = modified + # Recalculate checksums + del pkt[IP].chksum + del pkt[TCP].chksum + send(pkt) +``` + +## Best Practices + +### Analysis Workflow + +1. **Capture traffic**: Multiple sessions, different scenarios +2. **Identify boundaries**: Message start/end markers +3. **Map structure**: Fixed header, variable payload +4. **Identify fields**: Compare multiple samples +5. **Document format**: Create specification +6. **Validate understanding**: Implement parser/generator +7. **Test edge cases**: Fuzzing, boundary conditions + +### Common Patterns to Look For + +- Magic numbers/signatures at message start +- Version fields for compatibility +- Length fields (often before variable data) +- Type/opcode fields for message identification +- Sequence numbers for ordering +- Checksums/CRCs for integrity +- Timestamps for timing +- Session/connection identifiers diff --git a/research-what-we-did/00-source-iishko-original.md b/research-what-we-did/00-source-iishko-original.md new file mode 100644 index 0000000..c65d1c5 --- /dev/null +++ b/research-what-we-did/00-source-iishko-original.md @@ -0,0 +1,96 @@ +# ИСХОДНИК — пост [REDACTED] (26.09.2026 22:43–22:54) — то что мы прожарили + +Сохранён для диффа с `rev-guide-v4.md`. Все ошибки (180 тулов, 855, 47к, 29 доменов, 194 статьи, PMAT-course, «всё бесплатное», Qiling «без запуска») — здесь в оригинале. + +--- + +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 + +Полный путь от нуля до самостоятельного анализа бинарников: база, инструменты, пайплайн, реверс через ИИ, материалы. Всё бесплатное или с free-версией. + +ШАГ 1. БАЗА + +Без этого инструменты бесполезны: + +- C — указатели, память, структуры, строки +- Ассемблер x86-64 — регистры, стек, calling conventions, переходы +- Compiler Explorer (https://godbolt.org/) — пишешь функцию на C, видишь её ассемблер. Лучший способ понять, что делает компилятор +- Формат PE (https://learn.microsoft.com/windows/win32/debug/pe-format) — заголовки, секции, таблица импортов + +Результат: свободно читаешь ассемблерный листинг простой функции. + +ШАГ 2. ИНСТРУМЕНТЫ + +- Ghidra (https://github.com/NationalSecurityAgency/ghidra) — дизассемблер + декомпилятор, бесплатный. Основной инструмент для обучения, скриптится на Python через Ghidrathon (https://github.com/mandiant/Ghidrathon) +- x64dbg (https://x64dbg.com/) — отладчик Windows +- Detect It Easy (https://github.com/horsicq/Detect-It-Easy) — определение компилятора, протектора, упаковщика +- HxD (https://mh-nexus.de/hxd/) — hex-редактор + +Позже пригодятся: IDA Pro (https://hex-rays.com/) — эталонный декомпилятор Hex-Rays; Binary Ninja (https://binary.ninja/) — API для автоматизации; radare2 (https://github.com/radareorg/radare2) / rizin (https://github.com/rizinorg/rizin) + Cutter (https://github.com/rizinorg/cutter) — консольный стек. + +ШАГ 3. ПРАКТИКА + +- crackmes.one (https://crackmes.one/) — задачи по реверсу, сложность 1–6 +- Порядок: 15–20 задач 1☆, затем 10–15 задач 2☆, затем 3☆ +- Осваиваются: поиск точки входа, паттерн проверки пароля, простые анти-отладочные приёмы +- ROP Emporium (https://ropemporium.com/) — exploitation по шагам + +Результат: самостоятельно разбираешь небольшой бинарь от запуска до ответа. + +ШАГ 4. СИСТЕМА + +- pwn.college (https://pwn.college/) — бесплатные модули от ASU: ассемблер, основы RE, автопроверка, 15–25 задач на модуль +- OpenSecurityTraining2 (https://p.ost2.fyi/) — реверс C++, символьное исполнение, отладчики, UEFI +- RE-MA-Roadmap (https://github.com/x86byte/RE-MA-Roadmap) — roadmap от нуля до malware-аналитика + +ШАГ 5. ПАЙПЛАЙН АНАЛИЗА БИНАРЯ + +Порядок, по которому разбирают реальные сэмплы. Перед запуском чего-либо живого: виртуалка + снапшот, без общих папок и реальной сети. + +1. Триаж без запуска: DIE — упаковщик/компилятор; FLOSS (https://github.com/mandiant/flare-floss) — строки, включая обфусцированные; capa (https://github.com/mandiant/capa) — capabilities с маппингом на ATT&CK +2. Распаковка: натив — x64dbg до OEP, дамп, IAT чинит Scylla (https://github.com/NtQuery/Scylla); .NET — de4dot-форк (https://github.com/kant2002/de4dot), разбор в dnSpyEx (https://github.com/dnSpyEx/dnSpy); без запуска — Qiling (https://github.com/qilingframework/qiling) +3. Статика: Ghidra/IDA — декомпиляция, xrefs, переименование +4. Динамика: отладчик для проверки гипотез; Frida (https://frida.re/) — хуки на функции, снятие конфигов +5. Деобфускация: D-810 (https://gitlab.com/eshard/d810) — MBA и flattening в декомпиляторе IDA; эмуляция и трейсинг — Unicorn (https://github.com/unicorn-engine/unicorn), Qiling, angr (https://github.com/angr/angr) +6. Поведение: FakeNet-NG (https://github.com/mandiant/flare-fakenet-ng) — перехват трафика; CAPEv2 (https://github.com/kevoreilly/capev2) — сэндбокс; Speakeasy (https://github.com/mandiant/speakeasy) — эмуляция малвари и драйверов без VM +7. Диффинг версий: BinDiff (https://github.com/google/bindiff) / Diaphora (https://github.com/joxeankoret/diaphora) — что изменил вендор, где была дыра +8. Выход: YARA-правило (https://github.com/VirusTotal/yara), IOC, отчёт + +Шаг 6 — реверс через ИИ — во 2-м и 3-м сообщениях. + +--- + +(2/4) ШАГ 6. РЕВЕРС ЧЕРЕЗ ИИ: MCP-СЕРВЕРЫ + +IDA Pro: ida-pro-mcp (12.3к, mrexodia) · ida-mcp (официальный Hex-Rays, MIT, IDA 9.4+) · IDA-NO-MCP (2к) · ida-multi-mcp · ida-mcp-rs (Rust headless) +Ghidra: GhidraMCP (10.2к, LaurieWired) · ghidra-mcp (bethington, 4к, «200+ тулов») · ReVa (840) · GhidrAssistMCP · GhidraGPT · PyGhidra-MCP · OGhidra (LLNL, «локальные LLM, сэмплы не уходят в облако») +r2/Binja: radare2-mcp (официальный) · r2ai · binary_ninja_mcp · binary-ninja-headless-mcp («180 тулов») · Rikugan +Отладчики: x64dbg-mcp · cheatengine-mcp-bridge (1.5к) · windbg-mcp +Малварь/Android/.NET/Python: Qu1cksc0pe · Reversecore_MCP · Arkana · remnux-mcp-server · jadx-ai-mcp (2.8к) · apktool-mcp-server · de4py · disrobe · TriageMCP + +--- + +(3/4) СКИЛЛЫ + +reverse-skill (37.9к, роутер) · Anthropic-Cybersecurity-Skills (33.4к, «817 скиллов по 29 доменам») · ctf-skills (3.3к) · android-reverse-engineering-skill (7.9к) · Trail of Bits skills (7.2к) · Claude-Red (6.9к) · Claude-Code-CyberSecurity-Skill (22) · open-reverselab (1.2к, «база на 194 статьи») · REA +SkillSpector (NVIDIA, 18.4к) — сканер скиллов. + +АГЕНТЫ: agentic-malware-analysis · auto-re-agent (2к) · reverify (1.2к) · firefox-reverse (855) · anything-analyzer (3.7к) · FIRERPA (8.4к) · shannon (47к) + +ДАТАСЕТЫ: mcp-reversing-dataset · AgentRE-Bench · CrackMeBench (arXiv:2605.10597) + +ОГРАНИЧЕНИЯ: агент уверенно ошибается в именах функций; упакованный сэмпл = слабый псевдод; строки как промпт-инъекция (arXiv:2605.30667) — «малварь учится разговаривать с твоим ассистентом» +Каталоги: awesome-ai-reverse · Awesome-RE-MCP · mcp-security-hub + +--- + +(4/4) ШАГ 7. СПЕЦИАЛИЗАЦИЯ + +Малварь: PMAT (https://github.com/HuskyHacks/PMAT-course) — 404, мёртв +Прошивки: binwalk v3 · EMBA +Android: jadx + apktool +CTF: ctftime.org, Flare-On + +МАТЕРИАЛЫ: intro-rev-ida-pro («Реверсинг с IDA Pro от 0» Нарвахи) · книги: PMA, PRE, Ghidra Book, RE for Beginners · Awesome-Reversing · YouTube: OALabs, LiveOverflow, Gynvael Coldwind (без ссылок) + +👻 [REDACTED] (https://[REDACTED]) · промо-футер «Бесплатное API (t.me/[REDACTED])» ×4 сообщения — убран при репосте diff --git a/research-what-we-did/Deep-Research-skills/LICENSE b/research-what-we-did/Deep-Research-skills/LICENSE new file mode 100644 index 0000000..49c5a7e --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Lan Zheng + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/research-what-we-did/Deep-Research-skills/README.md b/research-what-we-did/Deep-Research-skills/README.md new file mode 100644 index 0000000..3658e9c --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/README.md @@ -0,0 +1,170 @@ +# Deep Research Skill for Claude Code / OpenCode / Codex + +[English](README.md) | [中文](README.zh.md) + +> If you find this project helpful, please give it a star! :star: + +> Inspired by [RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context](https://arxiv.org/abs/2511.18743) + +A structured research workflow skill for Claude Code, OpenCode, and Codex, supporting two-phase research: outline generation (extensible) and deep investigation. Human-in-the-loop design ensures precise control at every stage. + +![Deep Research Skills Workflow](workflow.png) + +## Use Cases + +- **Academic Research**: Paper surveys, benchmark reviews, literature analysis +- **Technical Research**: Technology comparison, framework evaluation, tool selection +- **Market Research**: Competitor analysis, industry trends, product comparison +- **Due Diligence**: Company research, investment analysis, risk assessment + +## Installation + +```bash +git clone https://github.com/Weizhena/deep-research-skills.git +cd deep-research-skills +``` + +### Claude Code +```bash +# English version +cp -r skills/research-en/* ~/.claude/skills/ + +# Chinese version +cp -r skills/research-zh/* ~/.claude/skills/ + +# Required: Install agent and modules +cp agents/web-search-agent.md ~/.claude/agents/ +cp -r agents/web-search-modules ~/.claude/agents/ + +# Required: Install Python dependency +pip install pyyaml +``` + +### OpenCode (default: gpt-5.4) +```bash +# Skills (same as Claude Code) +cp -r skills/research-en/* ~/.claude/skills/ # or research-zh for Chinese + +# Required: Enable web search for current shell +export OPENCODE_ENABLE_EXA=1 + +# Optional: make it permanent +echo 'export OPENCODE_ENABLE_EXA=1' >> ~/.bashrc +source ~/.bashrc + +# Required: Install agent and modules +cp agents/web-search-opencode.md ~/.config/opencode/agents/web-search.md +cp -r agents/web-search-modules ~/.config/opencode/agents/ + +# Required: Install Python dependency +pip install pyyaml +``` + +> **Important**: In OpenCode, ANY model's websearch requires `OPENCODE_ENABLE_EXA=1`. A plain `export` only affects the current shell; writing it to `~/.bashrc` makes it persistent. Without it, you only get `web fetch`, which is weaker for the deep research phase. + +### Codex +```bash +# English version +mkdir -p ~/.codex/skills ~/.codex/agents +cp -r skills/research-codex-en/* ~/.codex/skills/ + +# Chinese version +mkdir -p ~/.codex/skills ~/.codex/agents +cp -r skills/research-codex-zh/* ~/.codex/skills/ + +# Required: Install web researcher agent and modules +cp agents-codex/web-researcher.toml ~/.codex/agents/ +cp -r agents-codex/web-search-modules ~/.codex/agents/ + +# Required: Install Python dependency +pip install pyyaml +``` + +Add or update `~/.codex/config.toml` using either method below: + +**Option A: Automatic script** + +```bash +cd deep-research-skills +bash scripts/install-codex.sh +``` + +**Option B: Manual edit** + +```toml +suppress_unstable_features_warning = true + +[features] +multi_agent = true +default_mode_request_user_input = true + +[agents.web_researcher] +description = "Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation, or compilation of findings from multiple sources." +config_file = "agents/web-researcher.toml" +``` + +## Commands + +> **Claude Code 2.1.0+**: Direct `/skill-name` trigger is now supported! +> +> **Older versions**: Use `run /skill-name` format instead. +> +> **Codex**: You can trigger these skills from `/skills` -> `List Skills`, or ask naturally, for example `Use the research skill to build an outline for AI Agent Demo 2025`. + +| Command (2.1.0+) | Description | +|------------------|-------------| +| `/research` | Generate research outline with items and fields | +| `/research-add-items` | Add more research items to existing outline | +| `/research-add-fields` | Add more field definitions to existing outline | +| `/research-deep` | Deep research each item with parallel agents | +| `/research-report` | Generate markdown report from JSON results | + +## Workflow & Example + +> **Example**: Researching "AI Agent Demo 2025" + +### Phase 1: Generate Outline +``` +/research AI Agent Demo 2025 +``` +💡 **What will happen**: Tell it your topic → It creates a research list for you + +**You get**: A list of 17 AI Agents to research (ChatGPT Agent, Claude Computer Use, Cursor, etc.) + what info to collect for each + +### (Optional) Not satisfied? Add more +``` +/research-add-items +/research-add-fields +``` +💡 **What will happen**: Add more research items or field definitions + +### Phase 2: Deep Research +``` +/research-deep +``` +💡 **What will happen**: AI automatically searches the web for each item, one by one + +**You get**: Detailed info for each Agent (company, release date, pricing, tech specs, reviews...) + +### Phase 3: Generate Report +``` +/research-report +``` +💡 **What will happen**: All data → One organized report + +**You get**: `report.md` - A complete markdown report with table of contents, ready to read or share + +## Need Help? + +If you have questions, ask Claude Code, OpenCode, or Codex to explain this project: +``` +Help me understand this project: https://github.com/Weizhena/deep-research-skills +``` + +## References + +- RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context + +## License + +MIT diff --git a/research-what-we-did/Deep-Research-skills/README.zh.md b/research-what-we-did/Deep-Research-skills/README.zh.md new file mode 100644 index 0000000..8f22842 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/README.zh.md @@ -0,0 +1,175 @@ +# Deep Research Skill for Claude Code / OpenCode / Codex + +[English](README.md) | [中文](README.zh.md) + +> 如果喜欢就请 star 一下吧！:star: + +> 灵感来源：[RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context](https://arxiv.org/abs/2511.18743) + +适用于 Claude Code、OpenCode 和 Codex 的结构化调研工作流技能，支持两阶段调研：outline生成（可扩展）和深度调查。人在回路设计确保每个阶段的精确控制。 + +![Deep Research Skills 工作流](workflow.png) + +## 使用场景 + +- **学术研究**：论文综述、benchmark评测、文献分析 +- **技术研究**：技术对比、框架评估、工具选型 +- **市场研究**：竞品分析、行业趋势、产品比较 +- **尽职调查**：公司研究、投资分析、风险评估 + +## 安装 + +```bash +git clone https://github.com/Weizhena/deep-research-skills.git +cd deep-research-skills +``` + +### Claude Code +```bash +# 中文版 +cp -r skills/research-zh/* ~/.claude/skills/ + +# 英文版 +cp -r skills/research-en/* ~/.claude/skills/ + +# 必需：安装agent和模块 +cp agents/web-search-agent.md ~/.claude/agents/ +cp -r agents/web-search-modules ~/.claude/agents/ + +# 必需：安装Python依赖 +pip install pyyaml +``` + +### OpenCode (默认: gpt-5.4) +```bash +# Skills (同 Claude Code) +cp -r skills/research-zh/* ~/.claude/skills/ # 或 research-en 英文版 + +# 必需：为当前 shell 启用 web search +export OPENCODE_ENABLE_EXA=1 + +# 可选：写入 ~/.bashrc，永久生效 +echo 'export OPENCODE_ENABLE_EXA=1' >> ~/.bashrc +source ~/.bashrc + +# 必需：安装agent和模块 +cp agents/web-search-opencode.md ~/.config/opencode/agents/web-search.md +cp -r agents/web-search-modules ~/.config/opencode/agents/ + +# 必需：安装Python依赖 +pip install pyyaml +``` + +> **重要**：在 OpenCode 中，任何模型要想使用 `websearch`，需要设置 `OPENCODE_ENABLE_EXA=1`。单纯 `export` 只对当前 shell 生效；写入 `~/.bashrc` 后才是永久生效。不设置时，只有 `web fetch`，对深度调研阶段会弱很多。 + +### Codex +```bash +# 英文版 +mkdir -p ~/.codex/skills ~/.codex/agents +cp -r skills/research-codex-en/* ~/.codex/skills/ + +# 中文版 +mkdir -p ~/.codex/skills ~/.codex/agents +cp -r skills/research-codex-zh/* ~/.codex/skills/ + +# 必需：安装 web researcher agent 和模块 +cp agents-codex/web-researcher.toml ~/.codex/agents/ +cp -r agents-codex/web-search-modules ~/.codex/agents/ + +# 必需：安装 Python 依赖 +pip install pyyaml +``` + +使用以下两种方式之一更新 `~/.codex/config.toml`： + +**方式 A：自动脚本** + +```bash +cd deep-research-skills +bash scripts/install-codex.sh +``` + +**方式 B：手动编辑** + +```toml +suppress_unstable_features_warning = true + +[features] +multi_agent = true +default_mode_request_user_input = true + +[agents.web_researcher] +description = "Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation, or compilation of findings from multiple sources." +config_file = "agents/web-researcher.toml" +``` + +## 命令 + +> **Claude Code 2.1.0+**：现已支持直接 `/skill-name` 触发！ +> +> **旧版本**：请使用 `run /skill-name` 格式。 +> +> **Codex**：可以通过 `/skills` -> `List Skills` 选择这些 skills，也可以用自然语言触发，例如 `Use the research skill to build an outline for AI Agent Demo 2025`。 + +| 命令 (2.1.0+) | 描述 | +|---------------|------| +| `/research` | 生成包含items和fields的调研outline | +| `/research-add-items` | 向现有outline添加更多调研对象 | +| `/research-add-fields` | 向现有outline添加更多字段定义 | +| `/research-deep` | 使用并行agents对每个item进行深度调研 | +| `/research-report` | 从JSON结果生成markdown报告 | + +## 工作流 & 示例 + +> **示例**：调研 "AI Agent Demo 2025" + +### 阶段1：生成Outline +``` +/research AI Agent Demo 2025 +``` +💡 **会发生什么**：告诉它你要研究什么 → 它帮你列出调研清单 + +对于 Codex，可以这样说： +``` +Use the research skill to build an outline for AI Agent Demo 2025 +``` + +**你会得到**：17个待调研的AI Agent清单（ChatGPT Agent、Claude Computer Use、Cursor等）+ 每个要收集哪些信息 + +### （可选）不满意？继续添加 +``` +/research-add-items +/research-add-fields +``` +💡 **会发生什么**：补充更多调研对象或字段定义 + +### 阶段2：深度调研 +``` +/research-deep +``` +💡 **会发生什么**：AI自动上网搜索每个item的详细信息，逐个完成 + +**你会得到**：每个Agent的详细资料（公司、发布日期、定价、技术规格、用户评价...） + +### 阶段3：生成报告 +``` +/research-report +``` +💡 **会发生什么**：所有数据 → 一份整理好的报告 + +**你会得到**：`report.md` - 带目录的完整Markdown报告，可直接阅读或分享 + +## 遇到问题？ + +如果过程中有什么不懂的，可以让 Claude Code、OpenCode 或 Codex 帮你理解这个项目： +``` +帮我理解这个项目: https://github.com/Weizhena/deep-research-skills +``` + +## 参考文献 + +- RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context + +## 许可证 + +MIT diff --git a/research-what-we-did/Deep-Research-skills/agents-codex/web-researcher.toml b/research-what-we-did/Deep-Research-skills/agents-codex/web-researcher.toml new file mode 100644 index 0000000..5165f12 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents-codex/web-researcher.toml @@ -0,0 +1,130 @@ +model = "gpt-5.4" +model_reasoning_effort = "high" +sandbox_mode = "read-only" +web_search = "live" + +developer_instructions = """ +DONT USE ANY SKILLS. +You are an elite internet researcher specializing in finding relevant information across diverse online sources. Your expertise lies in creative search strategies, thorough investigation, and comprehensive compilation of findings. + +**Core Capabilities:** +- You excel at crafting multiple search query variations to uncover hidden gems of information +- You systematically explore GitHub Issues, Reddit, Stack Overflow, Stack Exchange, technical forums, official documentation, blog posts, Dev.to, Medium, Hacker News, Discord, X/Twitter, Google Scholar, arXiv, Hugging Face Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM Digital Library, IEEE Xplore, CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent Cloud and Alibaba Cloud developer communities +- You never settle for surface-level results - you dig deep to find the most relevant and helpful information +- You are particularly skilled at debugging assistance, finding others who've encountered similar issues +- You understand context and can identify patterns across disparate sources + +**Research Methodology:** + +0. **Get Current Date**: Run `date +%Y-%m-%d` to get today's date for time-sensitive searches. + +1. **Query Generation Phase**: When given a topic or problem, you will: + - Generate 5-10 different search query variations to maximize coverage + - Include technical terms, error messages, library names, and common misspellings + - Think of how different people might describe the same issue (novice vs. expert terminology) + - Consider searching for both the problem AND potential solutions + - Use exact phrases in quotes for error messages + - Include version numbers and environment details when relevant + + **Scenario-Specific Query Strategies (MANDATORY Module Loading)**: + Before using live web search, you MUST inspect the relevant strategy module file(s) under `~/.codex/agents/web-search-modules/`. Based on the research type, read the corresponding file(s): + + - **Debugging/GitHub Issues** → Read `github-debug.md` + Sources: GitHub Issues (open/closed) + + - **Best Practices/Comparative Research** → Read `general-web.md` + Sources: Reddit, Official Docs, Blogs, Hacker News, Dev.to, Medium, Discord, X/Twitter + + - **Academic Paper Search** → Read `academic-papers.md` + Sources: Google Scholar, arXiv, HuggingFace Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM DL, IEEE Xplore + + - **Chinese Tech Community** → Read `chinese-tech.md` + Sources: CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent/Alibaba Cloud + + - **Technical Q&A** → Read `stackoverflow.md` + Sources: Stack Overflow, Stack Exchange, technical forums + + DO NOT skip this step. Do not start web research before reading at least one relevant module. + + **Module Routing**: Each search may be routed to one or multiple modules: + - **Single module**: When the task clearly belongs to one domain, load only that module + - e.g. "search vllm memory leak issue" → Read `github-debug` only + - **Multi-module**: When complex tasks require cross-domain coverage, load multiple modules + - e.g. "transformers OOM problem" → Read `github-debug` + `stackoverflow` + `chinese-tech` + - e.g. "attention mechanism papers and open-source implementations" → Read `academic-papers` + `github-debug` + - The agent recommends modules based on task content; users can also specify explicitly + +2. **Source Prioritization**: Systematically search across sources defined in the routed modules above. Each module specifies its own prioritized source list. When multiple modules are routed, merge their source lists and deduplicate. + +3. **Information Gathering Standards**: You will: + - Read beyond the first few results - valuable information is often buried + - Look for patterns in solutions across different sources + - Pay attention to dates to ensure relevance (note if solutions are outdated) + - Note different approaches to the same problem and their trade-offs + - Identify authoritative sources and experienced contributors + - Check for updated solutions or superseded approaches + - Verify if issues have been resolved in newer versions + +4. **Compilation Standards**: When presenting findings, you will: + - **Caller's requested format takes priority** - satisfy their requirements first + - Start with key findings summary (2-3 sentences) + - Organize information by relevance and reliability + - Provide direct links to all sources + - Include relevant code snippets or configuration examples + - Note any conflicting information and explain the differences + - Highlight the most promising solutions or approaches + - Include timestamps, version numbers, and environment details when relevant + - Clearly mark experimental or unverified solutions + +**Quality Assurance:** +- Verify information across multiple sources when possible +- Clearly indicate when information is speculative or unverified +- Date-stamp findings to indicate currency +- Distinguish between official solutions and community workarounds +- Note the credibility of sources (official docs vs. random blog post vs. maintainer comment) +- Flag deprecated or outdated information +- Highlight security implications if relevant +- **Self-check before presenting**: Have I explored diverse sources? Any gaps? Is info current? Actionable next steps? +- **If insufficient info found**: State what was searched, explain limitations, suggest alternatives or communities to ask + +**Standard Output Format**: + +``` +=== IF caller specified format === +[Caller's requested format/content] + +## Sources and References ← ALWAYS REQUIRED +1. [Link with description] +2. [Link with description] + +=== ELSE use standard format === +## Executive Summary +[Key findings in 2-3 sentences - what you found and the recommended path forward] + +## Detailed Findings +[Organized by relevance/approach, with clear headings] + +### [Approach/Solution 1] +- Description +- Source links +- Code examples if applicable +- Pros/Cons +- Version/environment requirements + +### [Approach/Solution 2] +[Same structure] + +## Sources and References ← ALWAYS REQUIRED +1. [Link with description] +2. [Link with description] + +## Recommendations +[If applicable - your analysis of the best approach based on findings] + +## Additional Notes +[Caveats, warnings, areas needing more research, or conflicting information] +``` + +Remember: You are not just a search engine - you are a research specialist who understands context, can identify patterns, and knows how to find information that others might miss. Your goal is to provide comprehensive, actionable intelligence that saves time and provides clarity. Every research task should leave the user better informed and with clear next steps. + +""" diff --git a/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/academic-papers.md b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/academic-papers.md new file mode 100644 index 0000000..56139e4 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/academic-papers.md @@ -0,0 +1,28 @@ +# Academic Papers Module + +> 从 web-search-agent.md 提取的学术论文搜索专用策略 + +**触发场景**: 论文查找、学术研究、算法原理 + +## 搜索源 (Academic Sources) +- **Google Scholar** (scholar.google.com) - comprehensive academic search engine +- **arXiv** (arxiv.org) - preprints in physics, math, CS, and related fields +- **Hugging Face Papers** (huggingface.co/papers) - daily/monthly trending ML/AI papers with community upvotes +- **bioRxiv** (biorxiv.org) - preprints in biology and life sciences +- **ResearchGate** (researchgate.net) - academic social network with papers and author profiles +- **Semantic Scholar** (semanticscholar.org) - AI-powered academic search +- **ACM Digital Library** and **IEEE Xplore** - CS and engineering papers + +## 查询策略 (1.3 Academic Paper Search) +- Use Google Scholar as primary source with advanced search operators +- Search by author names, paper titles, DOI numbers, institutions, and publication years +- Use quotation marks for exact titles and author name combinations +- Include year ranges to find seminal works and recent publications +- Look for related papers and citation patterns to identify seminal works +- Search for preprints on arXiv, bioRxiv, and institutional repositories +- Check author profiles and ResearchGate for publications and PDFs +- Identify open-access versions and legal paper download sources +- Track citation networks to understand research evolution +- Note impact factors, h-index, and citation counts for relevance assessment +- Search for conference proceedings, journals, and workshop papers +- Identify funding agencies and research grants for context \ No newline at end of file diff --git a/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/chinese-tech.md b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/chinese-tech.md new file mode 100644 index 0000000..5fcada8 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/chinese-tech.md @@ -0,0 +1,20 @@ +# Chinese Tech Module + +> 从 web-search-agent.md 提取的中文技术社区专用策略 + +**触发场景**: 中文技术问题、国内框架、中文社区解决方案 + +## 搜索源 (Chinese Technical Sites) +- **CSDN** (csdn.net) - China's largest IT community with extensive technical articles and solutions +- **Juejin** (juejin.cn) - high-quality Chinese developer community with modern tech focus +- **SegmentFault** (segmentfault.com) - Chinese Q&A platform similar to Stack Overflow +- **Zhihu** (zhihu.com) - Chinese knowledge-sharing platform with technical discussions +- **Cnblogs** (cnblogs.com) - Chinese blogging platform with deep technical content +- **OSChina** (oschina.net) - Chinese open source community and technical news +- **V2EX** (v2ex.com) - Chinese developer community with active discussions +- **Tencent Cloud** and **Alibaba Cloud** developer communities - enterprise-level solutions + +## 查询策略 (Bilingual Research) +- **For bilingual research**: Generate queries in both English and Chinese (中文) +- Use Chinese technical terms and common translations (e.g., "报错" for errors, "解决方案" for solutions) +- Search Chinese sites with Chinese keywords for better results from Chinese developer communities diff --git a/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/general-web.md b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/general-web.md new file mode 100644 index 0000000..1146397 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/general-web.md @@ -0,0 +1,27 @@ +# General Web Module + +> 从 web-search-agent.md 提取的通用网页搜索策略 + +**触发场景**: 通用信息、新闻、产品对比、最佳实践 + +## 搜索源 +- **Reddit** (r/programming, r/webdev, r/javascript, and topic-specific subreddits) - real-world experiences +- **Official documentation** and changelogs - authoritative information +- **Blog posts** and tutorials - detailed explanations +- **Hacker News** discussions - high-quality technical discourse +- **Dev.to** (dev.to) - developer community with high-quality technical articles +- **Medium** (medium.com) - technical blog platform with in-depth articles +- **Discord** - official discussion channels for many open source projects +- **X/Twitter** - technical announcements and discussions from developers and maintainers + +## 查询策略 (1.2 Best Practices & Comparative Research) +- Look for official recommendations first +- Cross-reference with community consensus +- Find examples from production codebases +- Identify anti-patterns and common pitfalls +- Note evolving best practices and deprecated approaches +- Create structured comparisons with clear criteria +- Find real-world usage examples and case studies +- Look for performance benchmarks and user experiences +- Identify trade-offs and decision factors +- Consider scalability, maintenance, and learning curve diff --git a/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/github-debug.md b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/github-debug.md new file mode 100644 index 0000000..1a14e3a --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/github-debug.md @@ -0,0 +1,18 @@ +# GitHub Debug Module + +> 从 web-search-agent.md 提取的 GitHub/Debug 专用策略 + +**触发场景**: 项目bug、error调试、issue查找、版本特定问题 + +## 搜索源 +- **GitHub Issues** (both open and closed) - excellent for known bugs and workarounds + +## 查询策略 (1.1 Debugging Assistance) +- Search for exact error messages in quotes +- Look for issue templates that match the problem pattern +- Find workarounds, not just explanations +- Check if it's a known bug with existing patches or PRs +- Look for similar issues even if not exact matches +- Identify if the issue is version-specific +- Search for both the library name + error and more general descriptions +- Check closed issues for resolution patterns diff --git a/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/stackoverflow.md b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/stackoverflow.md new file mode 100644 index 0000000..2dfedee --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/stackoverflow.md @@ -0,0 +1,9 @@ +# Stack Overflow Module + +> 从 web-search-agent.md 提取的技术问答专用策略 + +**触发场景**: 编程问答、代码实现、API用法 + +## 搜索源 +- **Stack Overflow** and other Stack Exchange sites - technical Q&A +- **Technical forums** and discussion boards - community wisdom diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-agent.md b/research-what-we-did/Deep-Research-skills/agents/web-search-agent.md new file mode 100644 index 0000000..6d3c781 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-agent.md @@ -0,0 +1,127 @@ +--- +name: web-search-agent +description: Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation of a topic, or compilation of findings from diverse sources. +model: opus +--- + +You are an elite internet researcher specializing in finding relevant information across diverse online sources. Your expertise lies in creative search strategies, thorough investigation, and comprehensive compilation of findings. + +**Core Capabilities:** +- You excel at crafting multiple search query variations to uncover hidden gems of information +- You systematically explore GitHub Issues, Reddit, Stack Overflow, Stack Exchange, technical forums, official documentation, blog posts, Dev.to, Medium, Hacker News, Discord, X/Twitter, Google Scholar, arXiv, Hugging Face Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM Digital Library, IEEE Xplore, CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent Cloud and Alibaba Cloud developer communities +- You never settle for surface-level results - you dig deep to find the most relevant and helpful information +- You are particularly skilled at debugging assistance, finding others who've encountered similar issues +- You understand context and can identify patterns across disparate sources + +**Research Methodology:** + +0. **Get Current Date**: Run `date +%Y-%m-%d` to get today's date for time-sensitive searches. + +1. **Query Generation Phase**: When given a topic or problem, you will: + - Generate 5-10 different search query variations to maximize coverage + - Include technical terms, error messages, library names, and common misspellings + - Think of how different people might describe the same issue (novice vs. expert terminology) + - Consider searching for both the problem AND potential solutions + - Use exact phrases in quotes for error messages + - Include version numbers and environment details when relevant + + **Scenario-Specific Query Strategies (MANDATORY Module Loading)**: + Before executing any WebSearch or WebFetch, you MUST use the Read tool to load the relevant strategy module(s) from `~/.claude/agents/web-search-modules/`. Based on the research type, read the corresponding file(s): + + - **Debugging/GitHub Issues** -> Read `github-debug.md` + Sources: GitHub Issues (open/closed) + + - **Best Practices/Comparative Research** -> Read `general-web.md` + Sources: Reddit, Official Docs, Blogs, Hacker News, Dev.to, Medium, Discord, X/Twitter + + - **Academic Paper Search** -> Read `academic-papers.md` + Sources: Google Scholar, arXiv, HuggingFace Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM DL, IEEE Xplore + + - **Chinese Tech Community** -> Read `chinese-tech.md` + Sources: CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent/Alibaba Cloud + + - **Technical Q&A** -> Read `stackoverflow.md` + Sources: Stack Overflow, Stack Exchange, technical forums + + DO NOT skip this step. DO NOT call WebSearch or WebFetch before loading at least one module. + + **Module Routing**: Each search may be routed to one or multiple modules: + - **Single module**: When the task clearly belongs to one domain, load only that module + - e.g. "search vllm memory leak issue" -> Read `github-debug` only + - **Multi-module**: When complex tasks require cross-domain coverage, load multiple modules + - e.g. "transformers OOM problem" -> Read `github-debug` + `stackoverflow` + `chinese-tech` + - e.g. "attention mechanism papers and open-source implementations" -> Read `academic-papers` + `github-debug` + - The agent recommends modules based on task content; users can also specify explicitly + +2. **Source Prioritization**: Systematically search across sources defined in the routed modules above. Each module specifies its own prioritized source list. When multiple modules are routed, merge their source lists and deduplicate. + +3. **Information Gathering Standards**: You will: + - Read beyond the first few results - valuable information is often buried + - Look for patterns in solutions across different sources + - Pay attention to dates to ensure relevance (note if solutions are outdated) + - Note different approaches to the same problem and their trade-offs + - Identify authoritative sources and experienced contributors + - Check for updated solutions or superseded approaches + - Verify if issues have been resolved in newer versions + +4. **Compilation Standards**: When presenting findings, you will: + - **Caller's requested format takes priority** - satisfy their requirements first + - Start with key findings summary (2-3 sentences) + - Organize information by relevance and reliability + - Provide direct links to all sources + - Include relevant code snippets or configuration examples + - Note any conflicting information and explain the differences + - Highlight the most promising solutions or approaches + - Include timestamps, version numbers, and environment details when relevant + - Clearly mark experimental or unverified solutions + +**Quality Assurance:** +- Verify information across multiple sources when possible +- Clearly indicate when information is speculative or unverified +- Date-stamp findings to indicate currency +- Distinguish between official solutions and community workarounds +- Note the credibility of sources (official docs vs. random blog post vs. maintainer comment) +- Flag deprecated or outdated information +- Highlight security implications if relevant +- **Self-check before presenting**: Have I explored diverse sources? Any gaps? Is info current? Actionable next steps? +- **If insufficient info found**: State what was searched, explain limitations, suggest alternatives or communities to ask + +**Standard Output Format**: + +``` +=== IF caller specified format === +[Caller's requested format/content] + +## Sources and References ← ALWAYS REQUIRED +1. [Link with description] +2. [Link with description] + +=== ELSE use standard format === +## Executive Summary +[Key findings in 2-3 sentences - what you found and the recommended path forward] + +## Detailed Findings +[Organized by relevance/approach, with clear headings] + +### [Approach/Solution 1] +- Description +- Source links +- Code examples if applicable +- Pros/Cons +- Version/environment requirements + +### [Approach/Solution 2] +[Same structure] + +## Sources and References ← ALWAYS REQUIRED +1. [Link with description] +2. [Link with description] + +## Recommendations +[If applicable - your analysis of the best approach based on findings] + +## Additional Notes +[Caveats, warnings, areas needing more research, or conflicting information] +``` + +Remember: You are not just a search engine - you are a research specialist who understands context, can identify patterns, and knows how to find information that others might miss. Your goal is to provide comprehensive, actionable intelligence that saves time and provides clarity. Every research task should leave the user better informed and with clear next steps. diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-modules/academic-papers.md b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/academic-papers.md new file mode 100644 index 0000000..c39fa01 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/academic-papers.md @@ -0,0 +1,28 @@ +# Academic Papers Module + +> 从 web-search-agent.md 提取的学术论文搜索专用策略 + +**触发场景**: 论文查找、学术研究、算法原理 + +## 搜索源 (Academic Sources) +- **Google Scholar** (scholar.google.com) - comprehensive academic search engine +- **arXiv** (arxiv.org) - preprints in physics, math, CS, and related fields +- **Hugging Face Papers** (huggingface.co/papers) - daily/monthly trending ML/AI papers with community upvotes +- **bioRxiv** (biorxiv.org) - preprints in biology and life sciences +- **ResearchGate** (researchgate.net) - academic social network with papers and author profiles +- **Semantic Scholar** (semanticscholar.org) - AI-powered academic search +- **ACM Digital Library** and **IEEE Xplore** - CS and engineering papers + +## 查询策略 (1.3 Academic Paper Search) +- Use Google Scholar as primary source with advanced search operators +- Search by author names, paper titles, DOI numbers, institutions, and publication years +- Use quotation marks for exact titles and author name combinations +- Include year ranges to find seminal works and recent publications +- Look for related papers and citation patterns to identify seminal works +- Search for preprints on arXiv, bioRxiv, and institutional repositories +- Check author profiles and ResearchGate for publications and PDFs +- Identify open-access versions and legal paper download sources +- Track citation networks to understand research evolution +- Note impact factors, h-index, and citation counts for relevance assessment +- Search for conference proceedings, journals, and workshop papers +- Identify funding agencies and research grants for context diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-modules/chinese-tech.md b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/chinese-tech.md new file mode 100644 index 0000000..5fcada8 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/chinese-tech.md @@ -0,0 +1,20 @@ +# Chinese Tech Module + +> 从 web-search-agent.md 提取的中文技术社区专用策略 + +**触发场景**: 中文技术问题、国内框架、中文社区解决方案 + +## 搜索源 (Chinese Technical Sites) +- **CSDN** (csdn.net) - China's largest IT community with extensive technical articles and solutions +- **Juejin** (juejin.cn) - high-quality Chinese developer community with modern tech focus +- **SegmentFault** (segmentfault.com) - Chinese Q&A platform similar to Stack Overflow +- **Zhihu** (zhihu.com) - Chinese knowledge-sharing platform with technical discussions +- **Cnblogs** (cnblogs.com) - Chinese blogging platform with deep technical content +- **OSChina** (oschina.net) - Chinese open source community and technical news +- **V2EX** (v2ex.com) - Chinese developer community with active discussions +- **Tencent Cloud** and **Alibaba Cloud** developer communities - enterprise-level solutions + +## 查询策略 (Bilingual Research) +- **For bilingual research**: Generate queries in both English and Chinese (中文) +- Use Chinese technical terms and common translations (e.g., "报错" for errors, "解决方案" for solutions) +- Search Chinese sites with Chinese keywords for better results from Chinese developer communities diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-modules/general-web.md b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/general-web.md new file mode 100644 index 0000000..1146397 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/general-web.md @@ -0,0 +1,27 @@ +# General Web Module + +> 从 web-search-agent.md 提取的通用网页搜索策略 + +**触发场景**: 通用信息、新闻、产品对比、最佳实践 + +## 搜索源 +- **Reddit** (r/programming, r/webdev, r/javascript, and topic-specific subreddits) - real-world experiences +- **Official documentation** and changelogs - authoritative information +- **Blog posts** and tutorials - detailed explanations +- **Hacker News** discussions - high-quality technical discourse +- **Dev.to** (dev.to) - developer community with high-quality technical articles +- **Medium** (medium.com) - technical blog platform with in-depth articles +- **Discord** - official discussion channels for many open source projects +- **X/Twitter** - technical announcements and discussions from developers and maintainers + +## 查询策略 (1.2 Best Practices & Comparative Research) +- Look for official recommendations first +- Cross-reference with community consensus +- Find examples from production codebases +- Identify anti-patterns and common pitfalls +- Note evolving best practices and deprecated approaches +- Create structured comparisons with clear criteria +- Find real-world usage examples and case studies +- Look for performance benchmarks and user experiences +- Identify trade-offs and decision factors +- Consider scalability, maintenance, and learning curve diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-modules/github-debug.md b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/github-debug.md new file mode 100644 index 0000000..1a14e3a --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/github-debug.md @@ -0,0 +1,18 @@ +# GitHub Debug Module + +> 从 web-search-agent.md 提取的 GitHub/Debug 专用策略 + +**触发场景**: 项目bug、error调试、issue查找、版本特定问题 + +## 搜索源 +- **GitHub Issues** (both open and closed) - excellent for known bugs and workarounds + +## 查询策略 (1.1 Debugging Assistance) +- Search for exact error messages in quotes +- Look for issue templates that match the problem pattern +- Find workarounds, not just explanations +- Check if it's a known bug with existing patches or PRs +- Look for similar issues even if not exact matches +- Identify if the issue is version-specific +- Search for both the library name + error and more general descriptions +- Check closed issues for resolution patterns diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-modules/stackoverflow.md b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/stackoverflow.md new file mode 100644 index 0000000..2dfedee --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-modules/stackoverflow.md @@ -0,0 +1,9 @@ +# Stack Overflow Module + +> 从 web-search-agent.md 提取的技术问答专用策略 + +**触发场景**: 编程问答、代码实现、API用法 + +## 搜索源 +- **Stack Overflow** and other Stack Exchange sites - technical Q&A +- **Technical forums** and discussion boards - community wisdom diff --git a/research-what-we-did/Deep-Research-skills/agents/web-search-opencode.md b/research-what-we-did/Deep-Research-skills/agents/web-search-opencode.md new file mode 100644 index 0000000..dfca18c --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/agents/web-search-opencode.md @@ -0,0 +1,137 @@ +--- +description: Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation of a topic, or compilation of findings from diverse sources. +mode: subagent +model: openai/gpt-5.4 +temperature: 0.4 +tools: + read: true + write: false + edit: false + bash: true + glob: false + grep: false + web_search: true + web_fetch: true +--- + +You are an elite internet researcher specializing in finding relevant information across diverse online sources. Your expertise lies in creative search strategies, thorough investigation, and comprehensive compilation of findings. + +**Core Capabilities:** +- You excel at crafting multiple search query variations to uncover hidden gems of information +- You systematically explore GitHub Issues, Reddit, Stack Overflow, Stack Exchange, technical forums, official documentation, blog posts, Dev.to, Medium, Hacker News, Discord, X/Twitter, Google Scholar, arXiv, Hugging Face Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM Digital Library, IEEE Xplore, CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent Cloud and Alibaba Cloud developer communities +- You never settle for surface-level results - you dig deep to find the most relevant and helpful information +- You are particularly skilled at debugging assistance, finding others who've encountered similar issues +- You understand context and can identify patterns across disparate sources + +**Research Methodology:** + +0. **Get Current Date**: Run `date +%Y-%m-%d` to get today's date for time-sensitive searches. + +1. **Query Generation Phase**: When given a topic or problem, you will: + - Generate 5-10 different search query variations to maximize coverage + - Include technical terms, error messages, library names, and common misspellings + - Think of how different people might describe the same issue (novice vs. expert terminology) + - Consider searching for both the problem AND potential solutions + - Use exact phrases in quotes for error messages + - Include version numbers and environment details when relevant + + **Scenario-Specific Query Strategies (MANDATORY Module Loading)**: + Before executing any WebSearch or WebFetch, you MUST use the Read tool to load the relevant strategy module(s) from `~/.config/opencode/agents/web-search-modules/`. Based on the research type, read the corresponding file(s): + + - **Debugging/GitHub Issues** -> Read `github-debug.md` + Sources: GitHub Issues (open/closed) + + - **Best Practices/Comparative Research** -> Read `general-web.md` + Sources: Reddit, Official Docs, Blogs, Hacker News, Dev.to, Medium, Discord, X/Twitter + + - **Academic Paper Search** -> Read `academic-papers.md` + Sources: Google Scholar, arXiv, HuggingFace Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM DL, IEEE Xplore + + - **Chinese Tech Community** -> Read `chinese-tech.md` + Sources: CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent/Alibaba Cloud + + - **Technical Q&A** -> Read `stackoverflow.md` + Sources: Stack Overflow, Stack Exchange, technical forums + + DO NOT skip this step. DO NOT call WebSearch or WebFetch before loading at least one module. + + **Module Routing**: Each search may be routed to one or multiple modules: + - **Single module**: When the task clearly belongs to one domain, load only that module + - e.g. "search vllm memory leak issue" -> Read `github-debug` only + - **Multi-module**: When complex tasks require cross-domain coverage, load multiple modules + - e.g. "transformers OOM problem" -> Read `github-debug` + `stackoverflow` + `chinese-tech` + - e.g. "attention mechanism papers and open-source implementations" -> Read `academic-papers` + `github-debug` + - The agent recommends modules based on task content; users can also specify explicitly + +2. **Source Prioritization**: Systematically search across sources defined in the routed modules above. Each module specifies its own prioritized source list. When multiple modules are routed, merge their source lists and deduplicate. + +3. **Information Gathering Standards**: You will: + - Read beyond the first few results - valuable information is often buried + - Look for patterns in solutions across different sources + - Pay attention to dates to ensure relevance (note if solutions are outdated) + - Note different approaches to the same problem and their trade-offs + - Identify authoritative sources and experienced contributors + - Check for updated solutions or superseded approaches + - Verify if issues have been resolved in newer versions + +4. **Compilation Standards**: When presenting findings, you will: + - **Caller's requested format takes priority** - satisfy their requirements first + - Start with key findings summary (2-3 sentences) + - Organize information by relevance and reliability + - Provide direct links to all sources + - Include relevant code snippets or configuration examples + - Note any conflicting information and explain the differences + - Highlight the most promising solutions or approaches + - Include timestamps, version numbers, and environment details when relevant + - Clearly mark experimental or unverified solutions + +**Quality Assurance:** +- Verify information across multiple sources when possible +- Clearly indicate when information is speculative or unverified +- Date-stamp findings to indicate currency +- Distinguish between official solutions and community workarounds +- Note the credibility of sources (official docs vs. random blog post vs. maintainer comment) +- Flag deprecated or outdated information +- Highlight security implications if relevant +- **Self-check before presenting**: Have I explored diverse sources? Any gaps? Is info current? Actionable next steps? +- **If insufficient info found**: State what was searched, explain limitations, suggest alternatives or communities to ask + +**Standard Output Format**: + +``` +=== IF caller specified format === +[Caller's requested format/content] + +## Sources and References <- ALWAYS REQUIRED +1. [Link with description] +2. [Link with description] + +=== ELSE use standard format === +## Executive Summary +[Key findings in 2-3 sentences - what you found and the recommended path forward] + +## Detailed Findings +[Organized by relevance/approach, with clear headings] + +### [Approach/Solution 1] +- Description +- Source links +- Code examples if applicable +- Pros/Cons +- Version/environment requirements + +### [Approach/Solution 2] +[Same structure] + +## Sources and References <- ALWAYS REQUIRED +1. [Link with description] +2. [Link with description] + +## Recommendations +[If applicable - your analysis of the best approach based on findings] + +## Additional Notes +[Caveats, warnings, areas needing more research, or conflicting information] +``` + +Remember: You are not just a search engine - you are a research specialist who understands context, can identify patterns, and knows how to find information that others might miss. Your goal is to provide comprehensive, actionable intelligence that saves time and provides clarity. Every research task should leave the user better informed and with clear next steps. diff --git a/research-what-we-did/Deep-Research-skills/scripts/install-codex.sh b/research-what-we-did/Deep-Research-skills/scripts/install-codex.sh new file mode 100644 index 0000000..71acbf3 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/scripts/install-codex.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +set -euo pipefail + +CODEX_HOME="${CODEX_HOME:-$HOME/.codex}" +CONFIG_PATH="$CODEX_HOME/config.toml" + +mkdir -p "$CODEX_HOME" + +python3 - "$CONFIG_PATH" <<'PY' +import re +import sys +from pathlib import Path + +config_path = Path(sys.argv[1]) +text = config_path.read_text(encoding="utf-8") if config_path.exists() else "" + +blocks = { + "features": """[features] +multi_agent = true +default_mode_request_user_input = true +""", + "agents.web_researcher": """[agents.web_researcher] +description = "Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation, or compilation of findings from multiple sources." +config_file = "agents/web-researcher.toml" +""", +} + +for section, block in blocks.items(): + pattern = rf"(?ms)^\[{re.escape(section)}\]\n.*?(?=^\[|\Z)" + if re.search(pattern, text): + text = re.sub(pattern, block, text) + else: + text = text.rstrip() + ("\n\n" if text.strip() else "") + block + +text = re.sub(r"(?m)^suppress_unstable_features_warning\s*=.*\n?", "", text).strip() +text = 'suppress_unstable_features_warning = true\n\n' + text + +config_path.write_text(text.rstrip() + "\n", encoding="utf-8") +PY + +echo "Updated Codex config at $CONFIG_PATH" diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/SKILL.md new file mode 100644 index 0000000..a6fe12f --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/SKILL.md @@ -0,0 +1,30 @@ +--- +name: research-add-fields +description: Add field definitions to existing research outline. +--- + +# Research Add Fields - Supplement Research Fields + +## Trigger +`/research-add-fields` + +## Workflow + +### Step 1: Auto-locate Fields File +Find `*/fields.yaml` file in current working directory, auto-read existing fields definitions. + +### Step 2: Get Supplement Source +Ask user to choose: +- **A. User direct input**: User provides field names and descriptions +- **B. Web Search**: Launch agent to search common fields in this domain + +### Step 3: Display and Confirm +- Display suggested new fields list +- User confirms which fields to add +- User specifies field category and detail_level + +### Step 4: Save Update +Append confirmed fields to fields.yaml, save file. + +## Output +Updated `{topic}/fields.yaml` file (in-place modification, requires user confirmation) diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/SKILL.md new file mode 100644 index 0000000..f28c764 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/SKILL.md @@ -0,0 +1,28 @@ +--- +name: research-add-items +description: Add items (research objects) to existing research outline. +--- + +# Research Add Items - Supplement Research Objects + +## Trigger +`/research-add-items` + +## Workflow + +### Step 1: Auto-locate Outline +Find `*/outline.yaml` file in current working directory, auto-read. + +### Step 2: Get Supplement Sources in Parallel +Simultaneously: +- **A. Ask user**: What items to supplement? Any specific names? +- **B. Ask if Web Search needed**: Launch agent to search for more items? + +### Step 3: Merge and Update +- Append new items to outline.yaml +- Display to user for confirmation +- Avoid duplicates +- Save updated outline + +## Output +Updated `{topic}/outline.yaml` file (in-place modification) diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/SKILL.md new file mode 100644 index 0000000..2764cbe --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/SKILL.md @@ -0,0 +1,98 @@ +--- +name: research-deep +description: Read research outline, launch independent agent for each item for deep research. Disable task output. +--- + +# Research Deep - Deep Research + +## Trigger +`/research-deep` + +## Workflow + +### Step 1: Auto-locate Outline +Find `*/outline.yaml` file in current working directory, read items list, execution config (including items_per_agent). + +### Step 2: Resume Check +- Check completed JSON files in output_dir +- Skip completed items + +### Step 3: Batch Execution +- Batch by batch_size (need user approval before next batch) +- Each agent handles items_per_agent items +- Launch web-search-agent (background parallel, disable task output) + +**Parameter Retrieval**: +- `{topic}`: topic field from outline.yaml +- `{item_name}`: item's name field +- `{item_related_info}`: item's complete yaml content (name + category + description etc.) +- `{output_dir}`: execution.output_dir from outline.yaml (default: ./results) +- `{fields_path}`: absolute path to {topic}/fields.yaml +- `{output_path}`: absolute path to {output_dir}/{item_name_slug}.json (slugify item_name: replace spaces with _, remove special chars) + +**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording. + +**Prompt Template**: +```python +prompt = f"""## Task +Research {item_related_info}, output structured JSON to {output_path} + +## Field Definitions +Read {fields_path} to get all field definitions + +## Output Requirements +1. Output JSON according to fields defined in fields.yaml +2. Mark uncertain field values with [uncertain] +3. Add uncertain array at the end of JSON, listing all uncertain field names +4. All field values must be in English + +## Output Path +{output_path} + +## Validation +After completing JSON output, run validation script to ensure complete field coverage: +python ~/.codex/skills/research/validate_json.py -f {fields_path} -j {output_path} +Task is complete only after validation passes. +""" +``` + +**One-shot Example** (assuming researching GitHub Copilot): +``` +## Task +Research name: GitHub Copilot +category: International Product +description: Developed by Microsoft/GitHub, first mainstream AI coding assistant, ~40% market share, output structured JSON to {project_dir}/results/GitHub_Copilot.json + +## Field Definitions +Read {project_dir}/fields.yaml to get all field definitions + +## Output Requirements +1. Output JSON according to fields defined in fields.yaml +2. Mark uncertain field values with [uncertain] +3. Add uncertain array at the end of JSON, listing all uncertain field names +4. All field values must be in English + +## Output Path +{project_dir}/results/GitHub_Copilot.json + +## Validation +After completing JSON output, run validation script to ensure complete field coverage: +python ~/.codex/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json +Task is complete only after validation passes. +``` + +### Step 4: Wait and Monitor +- Wait for current batch to complete +- Launch next batch +- Display progress + +### Step 5: Summary Report +After all complete, output: +- Completion count +- Failed/uncertain marked items +- Output directory + +## Agent Config +- Background execution: Yes +- Task Output: Disabled (agent has explicit output file when complete) +- Resume support: Yes diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/SKILL.md new file mode 100644 index 0000000..32f3c19 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/SKILL.md @@ -0,0 +1,91 @@ +--- +name: research-report +description: Summarize deep research results into markdown report, cover all fields, skip uncertain values. +--- + +# Research Report - Summary Report + +## Trigger +`/research-report` + +## Workflow + +### Step 1: Locate Results Directory +Find `*/outline.yaml` in current working directory, read topic and output_dir config. + +### Step 2: Scan Optional Summary Fields +Read all JSON results, extract fields suitable for TOC display (numeric, short metrics), e.g.: +- github_stars +- google_scholar_cites +- swe_bench_score +- user_scale +- valuation +- release_date + +Use request_user_input to ask user: +- Which fields to display in TOC besides item name? +- Provide dynamic options list (based on actual fields in JSON) + +### Step 3: Generate Python Conversion Script +Generate `generate_report.py` in `{topic}/` directory, script requirements: +- Read all JSON from output_dir +- Read fields.yaml to get field structure +- Cover all field values from each JSON +- Skip fields with values containing [uncertain] +- Skip fields listed in uncertain array +- Generate markdown report format: Table of contents (with anchor links + user-selected summary fields) + Detailed content (by field category) +- Save to `{topic}/report.md` + +**TOC Format Requirements**: +- Must include every item +- Each item displays: number, name (anchor link), user-selected summary fields +- Example: `1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%` + +#### Script Technical Requirements (Must Follow) + +**1. JSON Structure Compatibility** +Support two JSON structures: +- Flat structure: Fields directly at top level `{"name": "xxx", "release_date": "xxx"}` +- Nested structure: Fields in category sub-dict `{"basic_info": {"name": "xxx"}, "technical_features": {...}}` + +Field lookup order: Top level -> category mapping key -> Traverse all nested dicts + +**2. Category Multi-language Mapping** +fields.yaml category names and JSON keys can be any combination (CN-CN, CN-EN, EN-CN, EN-EN). Must establish bidirectional mapping: +```python +CATEGORY_MAPPING = { + "Basic Info": ["basic_info", "Basic Info"], + "Technical Features": ["technical_features", "technical_characteristics", "Technical Features"], + "Performance Metrics": ["performance_metrics", "performance", "Performance Metrics"], + "Milestone Significance": ["milestone_significance", "milestones", "Milestone Significance"], + "Business Info": ["business_info", "commercial_info", "Business Info"], + "Competition & Ecosystem": ["competition_ecosystem", "competition", "Competition & Ecosystem"], + "History": ["history", "History"], + "Market Positioning": ["market_positioning", "market", "Market Positioning"], +} +``` + +**3. Complex Value Formatting** +- list of dicts (e.g., key_events, funding_history): Format each dict as one line, separate kv with ` | ` +- Normal list: Short lists joined with comma, long lists displayed with line breaks +- Nested dict: Recursive formatting, display with semicolon or line breaks +- Long text strings (over 100 chars): Add line breaks `
` or use blockquote format for readability + +**4. Extra Fields Collection** +Collect fields that exist in JSON but not defined in fields.yaml, put in "Other Info" category. Note to filter: +- Internal fields: `_source_file`, `uncertain` +- Nested structure top-level keys: `basic_info`, `technical_features` etc. +- `uncertain` array: Display each field name on separate line, don't compress into one line + +**5. Uncertain Value Skipping** +Skip conditions: +- Field value contains `[uncertain]` string +- Field name is in `uncertain` array +- Field value is None or empty string + +### Step 4: Execute Script +Run `python {topic}/generate_report.py` + +## Output +- `{topic}/generate_report.py` - Conversion script +- `{topic}/report.md` - Summary report diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/SKILL.md new file mode 100644 index 0000000..ff571a8 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/SKILL.md @@ -0,0 +1,143 @@ +--- +name: research +description: Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc. +--- + +# Research Skill - Preliminary Research + +## Trigger +`/research ` + +## Workflow + +### Step 1: Generate Initial Framework from Model Knowledge +Based on topic, use model's existing knowledge to generate: +- Main research objects/items list in this domain +- Suggested research field framework + +Output {step1_output}, use request_user_input to confirm: +- Need to add/remove items? +- Does field framework meet requirements? + +### Step 2: Web Search Supplement +Use request_user_input to ask for time range (e.g., last 6 months, since 2024, unlimited). + +**Parameter Retrieval**: +- `{topic}`: User input research topic +- `{YYYY-MM-DD}`: Current date +- `{step1_output}`: Complete output from Step 1 +- `{time_range}`: User specified time range + +**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording. + +Launch 1 web-search-agent (background), **Prompt Template**: +```python +prompt = f"""## Task +Research topic: {topic} +Current date: {YYYY-MM-DD} + +Based on the following initial framework, supplement latest items and recommended research fields. + +## Existing Framework +{step1_output} + +## Goals +1. Verify if existing items are missing important objects +2. Supplement items based on missing objects +3. Continue searching for {topic} related items within {time_range} and supplement +4. Supplement new fields + +## Output Requirements +Return structured results directly (do not write files): + +### Supplementary Items +- item_name: Brief explanation (why it should be added) +... + +### Recommended Supplementary Fields +- field_name: Field description (why this dimension is needed) +... + +### Sources +- [Source1](url1) +- [Source2](url2) +""" +``` + +**One-shot Example** (assuming researching AI Coding History): +``` +## Task +Research topic: AI Coding History +Current date: 2025-12-30 + +Based on the following initial framework, supplement latest items and recommended research fields. + +## Existing Framework +### Items List +1. GitHub Copilot: Developed by Microsoft/GitHub, first mainstream AI coding assistant +2. Cursor: AI-first IDE, based on VSCode +... + +### Field Framework +- Basic Info: name, release_date, company +- Technical Features: underlying_model, context_window +... + +## Goals +1. Verify if existing items are missing important objects +2. Supplement items based on missing objects +3. Continue searching for AI Coding History related items within since 2024 and supplement +4. Supplement new fields + +## Output Requirements +Return structured results directly (do not write files): + +### Supplementary Items +- item_name: Brief explanation (why it should be added) +... + +### Recommended Supplementary Fields +- field_name: Field description (why this dimension is needed) +... + +### Sources +- [Source1](url1) +- [Source2](url2) +``` + +### Step 3: Ask User for Existing Fields +Use request_user_input to ask if user has existing field definition file, if so read and merge. + +### Step 4: Generate Outline (Separate Files) +Merge {step1_output}, {step2_output} and user's existing fields, generate two files: + +**outline.yaml** (items + config): +- topic: Research topic +- items: Research objects list +- execution: + - batch_size: Number of parallel agents (confirm with request_user_input) + - items_per_agent: Items per agent (confirm with request_user_input) + - output_dir: Results output directory (default: ./results) + +**fields.yaml** (field definitions): +- Field categories and definitions +- Each field's name, description, detail_level +- detail_level hierarchy: brief -> moderate -> detailed +- uncertain: Uncertain fields list (reserved field, auto-filled in deep phase) + +### Step 5: Output and Confirm +- Create directory: `./{topic_slug}/` +- Save: `outline.yaml` and `fields.yaml` +- Show to user for confirmation + +## Output Path +``` +{current_working_directory}/{topic_slug}/ + ├── outline.yaml # items list + execution config + └── fields.yaml # field definitions +``` + +## Follow-up Commands +- `/research-add-items` - Supplement items +- `/research-add-fields` - Supplement fields +- `/research-deep` - Start deep research diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/validate_json.py b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/validate_json.py new file mode 100644 index 0000000..16c9566 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/validate_json.py @@ -0,0 +1,198 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import json +import sys +from collections import defaultdict +from pathlib import Path + +import yaml + +CATEGORY_MAPPING = { + "basic_info": ["basic_info", "Basic Info"], + "technical_features": ["technical_features", "technical_characteristics", "Technical Features"], + "performance_metrics": ["performance_metrics", "performance", "Performance Metrics"], + "milestone_significance": ["milestone_significance", "milestones", "Milestone Significance"], + "business_info": ["business_info", "commercial_info", "Business Info"], + "competition_ecosystem": ["competition_ecosystem", "competition", "Competition Ecosystem"], + "history": ["history", "History"], + "market_positioning": ["market_positioning", "market", "Market Positioning"], +} + +_SKIP_KEYS = {"_source_file", "uncertain"} + + +def load_fields_yaml(fields_path): + """Parse fields.yaml in the single schema the research skills emit: + + fields: + : + - {name: ..., description: ..., detail_level: ...} + ... + uncertain: [] + + This is the ONLY accepted shape. A fields.yaml that does not match fails + loudly instead of silently passing with zero fields. + + Required semantics (so the validator can never pass vacuously / "lie"): + - if ANY field carries an explicit `required:` key -> opt-in, preserve it + - else (detail_level-style, no markers) -> ALL fields required, because the + script's stated purpose is COMPLETE field coverage. + """ + with fields_path.open(encoding="utf-8") as f: + data = yaml.safe_load(f) or {} + defs = [] # (name, category, required_or_None) + + fn = data.get("fields") + if not isinstance(fn, dict): + print(f"[ERROR] fields.yaml must use the `fields: {{: [{{name, ...}}]}}` shape; got {type(fn).__name__ if fn is not None else 'None'}.") + sys.exit(1) + + for cname, flist in fn.items(): + if cname in _SKIP_KEYS: + continue + if not isinstance(flist, list): + print(f"[ERROR] category `{cname}` must map to a list of field dicts; got {type(flist).__name__}.") + sys.exit(1) + for field in flist: + if isinstance(field, dict) and "name" in field: + defs.append((str(field["name"]), str(cname), field.get("required", None))) + else: + print(f"[ERROR] field entry under `{cname}` must be a dict with a `name` key; got {field!r}.") + sys.exit(1) + + if not defs: + print("[ERROR] fields.yaml parsed zero fields. Ensure at least one category with field dicts.") + sys.exit(1) + + all_fields = {n for n, _, _ in defs} + if any(r is not None for _, _, r in defs): + required_fields = {n for n, _, r in defs if r} + else: + required_fields = set(all_fields) + field_categories = {n: c for n, c, _ in defs} + return all_fields, required_fields, field_categories + + +def extract_json_fields(data, category_mapping=None): + category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping + nested_keys = {k for keys in category_mapping.values() for k in keys} + fields = set() + stack = [(data, True)] + while stack: + obj, is_category_level = stack.pop() + if isinstance(obj, dict): + for k, v in obj.items(): + if k in _SKIP_KEYS: + continue + if is_category_level and k in nested_keys: + if isinstance(v, dict): + stack.append((v, True)) + continue + fields.add(k) + elif isinstance(obj, list): + stack.extend((item, is_category_level) for item in obj if isinstance(item, dict)) + return fields + + +def validate_json(json_path, all_fields, required_fields, field_categories): + with json_path.open(encoding="utf-8") as f: + data = json.load(f) + json_fields = extract_json_fields(data) + covered = all_fields & json_fields + missing = all_fields - json_fields + extra = json_fields - all_fields + missing_required = missing & required_fields + missing_by_category = defaultdict(list) + for field in missing: + missing_by_category[field_categories.get(field, "Unknown")].append(field) + return { + "file": json_path.name, + "total_defined": len(all_fields), + "covered": len(covered), + "missing": len(missing), + "extra": len(extra), + "coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100, + "missing_required": sorted(missing_required), + "missing_optional": sorted(missing - required_fields), + "missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()}, + "extra_fields": sorted(extra), + "valid": len(missing_required) == 0, + } + + +def print_result(result, verbose=True): + status = "PASS" if result["valid"] else "FAIL" + line = "=" * 60 + print(f"\n{line}") + print(f"[{status}] {result['file']}") + print(line) + print(f"Coverage: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})") + if result["missing_required"]: + print(f"\n[ERROR] Missing required fields ({len(result['missing_required'])}):") + print("\n".join(f" - {f}" for f in result["missing_required"])) + if verbose and result["missing_optional"]: + missing_required = set(result["missing_required"]) + print(f"\n[WARN] Missing optional fields ({len(result['missing_optional'])}):") + for cat in sorted(result["missing_by_category"]): + optional = [f for f in result["missing_by_category"][cat] if f not in missing_required] + if optional: + print(f" [{cat}]: {', '.join(optional)}") + if verbose and result["extra_fields"]: + extra = result["extra_fields"] + print(f"\n[INFO] Extra fields ({len(extra)}):") + print(f" {', '.join(extra[:10])}") + if len(extra) > 10: + print(f" ... and {len(extra) - 10} more") + + +def main(): + import argparse + parser = argparse.ArgumentParser(description="Validate whether JSON files cover all fields defined in fields.yaml") + parser.add_argument("--fields", "-f", type=str, help="Path to fields.yaml", default="fields.yaml") + parser.add_argument("--json", "-j", type=str, nargs="*", help="JSON file paths to validate") + parser.add_argument("--dir", "-d", type=str, help="Directory containing JSON files", default="results") + parser.add_argument("--quiet", "-q", action="store_true", help="Show summary only") + args = parser.parse_args() + fields_path = Path(args.fields) + if not fields_path.exists(): + for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"): + if p.exists(): + fields_path = p + break + if not fields_path.exists(): + print(f"[ERROR] fields.yaml not found: {fields_path}") + sys.exit(1) + print(f"Field definition file: {fields_path}") + all_fields, required_fields, field_categories = load_fields_yaml(fields_path) + print(f"Total fields: {len(all_fields)} (required: {len(required_fields)}, optional: {len(all_fields) - len(required_fields)})") + json_files = ( + [Path(p) for p in args.json] + if args.json + else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else [] + ) + if not json_files: + print("[WARN] No JSON files found") + sys.exit(0) + results = [] + for json_path in json_files: + if not json_path.exists(): + print(f"[WARN] File not found: {json_path}") + continue + result = validate_json(json_path, all_fields, required_fields, field_categories) + results.append(result) + print_result(result, verbose=not args.quiet) + line = "=" * 60 + print(f"\n{line}") + print("Summary") + print(line) + passed = sum(1 for r in results if r["valid"]) + avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0 + print(f"Validation passed: {passed}/{len(results)}") + print(f"Average coverage: {avg_coverage:.1f}%") + if passed < len(results): + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/SKILL.md new file mode 100644 index 0000000..a6fe12f --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/SKILL.md @@ -0,0 +1,30 @@ +--- +name: research-add-fields +description: Add field definitions to existing research outline. +--- + +# Research Add Fields - Supplement Research Fields + +## Trigger +`/research-add-fields` + +## Workflow + +### Step 1: Auto-locate Fields File +Find `*/fields.yaml` file in current working directory, auto-read existing fields definitions. + +### Step 2: Get Supplement Source +Ask user to choose: +- **A. User direct input**: User provides field names and descriptions +- **B. Web Search**: Launch agent to search common fields in this domain + +### Step 3: Display and Confirm +- Display suggested new fields list +- User confirms which fields to add +- User specifies field category and detail_level + +### Step 4: Save Update +Append confirmed fields to fields.yaml, save file. + +## Output +Updated `{topic}/fields.yaml` file (in-place modification, requires user confirmation) diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/SKILL.md new file mode 100644 index 0000000..f28c764 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/SKILL.md @@ -0,0 +1,28 @@ +--- +name: research-add-items +description: Add items (research objects) to existing research outline. +--- + +# Research Add Items - Supplement Research Objects + +## Trigger +`/research-add-items` + +## Workflow + +### Step 1: Auto-locate Outline +Find `*/outline.yaml` file in current working directory, auto-read. + +### Step 2: Get Supplement Sources in Parallel +Simultaneously: +- **A. Ask user**: What items to supplement? Any specific names? +- **B. Ask if Web Search needed**: Launch agent to search for more items? + +### Step 3: Merge and Update +- Append new items to outline.yaml +- Display to user for confirmation +- Avoid duplicates +- Save updated outline + +## Output +Updated `{topic}/outline.yaml` file (in-place modification) diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/SKILL.md new file mode 100644 index 0000000..2764cbe --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/SKILL.md @@ -0,0 +1,98 @@ +--- +name: research-deep +description: Read research outline, launch independent agent for each item for deep research. Disable task output. +--- + +# Research Deep - Deep Research + +## Trigger +`/research-deep` + +## Workflow + +### Step 1: Auto-locate Outline +Find `*/outline.yaml` file in current working directory, read items list, execution config (including items_per_agent). + +### Step 2: Resume Check +- Check completed JSON files in output_dir +- Skip completed items + +### Step 3: Batch Execution +- Batch by batch_size (need user approval before next batch) +- Each agent handles items_per_agent items +- Launch web-search-agent (background parallel, disable task output) + +**Parameter Retrieval**: +- `{topic}`: topic field from outline.yaml +- `{item_name}`: item's name field +- `{item_related_info}`: item's complete yaml content (name + category + description etc.) +- `{output_dir}`: execution.output_dir from outline.yaml (default: ./results) +- `{fields_path}`: absolute path to {topic}/fields.yaml +- `{output_path}`: absolute path to {output_dir}/{item_name_slug}.json (slugify item_name: replace spaces with _, remove special chars) + +**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording. + +**Prompt Template**: +```python +prompt = f"""## Task +Research {item_related_info}, output structured JSON to {output_path} + +## Field Definitions +Read {fields_path} to get all field definitions + +## Output Requirements +1. Output JSON according to fields defined in fields.yaml +2. Mark uncertain field values with [uncertain] +3. Add uncertain array at the end of JSON, listing all uncertain field names +4. All field values must be in English + +## Output Path +{output_path} + +## Validation +After completing JSON output, run validation script to ensure complete field coverage: +python ~/.codex/skills/research/validate_json.py -f {fields_path} -j {output_path} +Task is complete only after validation passes. +""" +``` + +**One-shot Example** (assuming researching GitHub Copilot): +``` +## Task +Research name: GitHub Copilot +category: International Product +description: Developed by Microsoft/GitHub, first mainstream AI coding assistant, ~40% market share, output structured JSON to {project_dir}/results/GitHub_Copilot.json + +## Field Definitions +Read {project_dir}/fields.yaml to get all field definitions + +## Output Requirements +1. Output JSON according to fields defined in fields.yaml +2. Mark uncertain field values with [uncertain] +3. Add uncertain array at the end of JSON, listing all uncertain field names +4. All field values must be in English + +## Output Path +{project_dir}/results/GitHub_Copilot.json + +## Validation +After completing JSON output, run validation script to ensure complete field coverage: +python ~/.codex/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json +Task is complete only after validation passes. +``` + +### Step 4: Wait and Monitor +- Wait for current batch to complete +- Launch next batch +- Display progress + +### Step 5: Summary Report +After all complete, output: +- Completion count +- Failed/uncertain marked items +- Output directory + +## Agent Config +- Background execution: Yes +- Task Output: Disabled (agent has explicit output file when complete) +- Resume support: Yes diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/SKILL.md new file mode 100644 index 0000000..32f3c19 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/SKILL.md @@ -0,0 +1,91 @@ +--- +name: research-report +description: Summarize deep research results into markdown report, cover all fields, skip uncertain values. +--- + +# Research Report - Summary Report + +## Trigger +`/research-report` + +## Workflow + +### Step 1: Locate Results Directory +Find `*/outline.yaml` in current working directory, read topic and output_dir config. + +### Step 2: Scan Optional Summary Fields +Read all JSON results, extract fields suitable for TOC display (numeric, short metrics), e.g.: +- github_stars +- google_scholar_cites +- swe_bench_score +- user_scale +- valuation +- release_date + +Use request_user_input to ask user: +- Which fields to display in TOC besides item name? +- Provide dynamic options list (based on actual fields in JSON) + +### Step 3: Generate Python Conversion Script +Generate `generate_report.py` in `{topic}/` directory, script requirements: +- Read all JSON from output_dir +- Read fields.yaml to get field structure +- Cover all field values from each JSON +- Skip fields with values containing [uncertain] +- Skip fields listed in uncertain array +- Generate markdown report format: Table of contents (with anchor links + user-selected summary fields) + Detailed content (by field category) +- Save to `{topic}/report.md` + +**TOC Format Requirements**: +- Must include every item +- Each item displays: number, name (anchor link), user-selected summary fields +- Example: `1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%` + +#### Script Technical Requirements (Must Follow) + +**1. JSON Structure Compatibility** +Support two JSON structures: +- Flat structure: Fields directly at top level `{"name": "xxx", "release_date": "xxx"}` +- Nested structure: Fields in category sub-dict `{"basic_info": {"name": "xxx"}, "technical_features": {...}}` + +Field lookup order: Top level -> category mapping key -> Traverse all nested dicts + +**2. Category Multi-language Mapping** +fields.yaml category names and JSON keys can be any combination (CN-CN, CN-EN, EN-CN, EN-EN). Must establish bidirectional mapping: +```python +CATEGORY_MAPPING = { + "Basic Info": ["basic_info", "Basic Info"], + "Technical Features": ["technical_features", "technical_characteristics", "Technical Features"], + "Performance Metrics": ["performance_metrics", "performance", "Performance Metrics"], + "Milestone Significance": ["milestone_significance", "milestones", "Milestone Significance"], + "Business Info": ["business_info", "commercial_info", "Business Info"], + "Competition & Ecosystem": ["competition_ecosystem", "competition", "Competition & Ecosystem"], + "History": ["history", "History"], + "Market Positioning": ["market_positioning", "market", "Market Positioning"], +} +``` + +**3. Complex Value Formatting** +- list of dicts (e.g., key_events, funding_history): Format each dict as one line, separate kv with ` | ` +- Normal list: Short lists joined with comma, long lists displayed with line breaks +- Nested dict: Recursive formatting, display with semicolon or line breaks +- Long text strings (over 100 chars): Add line breaks `
` or use blockquote format for readability + +**4. Extra Fields Collection** +Collect fields that exist in JSON but not defined in fields.yaml, put in "Other Info" category. Note to filter: +- Internal fields: `_source_file`, `uncertain` +- Nested structure top-level keys: `basic_info`, `technical_features` etc. +- `uncertain` array: Display each field name on separate line, don't compress into one line + +**5. Uncertain Value Skipping** +Skip conditions: +- Field value contains `[uncertain]` string +- Field name is in `uncertain` array +- Field value is None or empty string + +### Step 4: Execute Script +Run `python {topic}/generate_report.py` + +## Output +- `{topic}/generate_report.py` - Conversion script +- `{topic}/report.md` - Summary report diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/SKILL.md new file mode 100644 index 0000000..ff571a8 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/SKILL.md @@ -0,0 +1,143 @@ +--- +name: research +description: Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc. +--- + +# Research Skill - Preliminary Research + +## Trigger +`/research ` + +## Workflow + +### Step 1: Generate Initial Framework from Model Knowledge +Based on topic, use model's existing knowledge to generate: +- Main research objects/items list in this domain +- Suggested research field framework + +Output {step1_output}, use request_user_input to confirm: +- Need to add/remove items? +- Does field framework meet requirements? + +### Step 2: Web Search Supplement +Use request_user_input to ask for time range (e.g., last 6 months, since 2024, unlimited). + +**Parameter Retrieval**: +- `{topic}`: User input research topic +- `{YYYY-MM-DD}`: Current date +- `{step1_output}`: Complete output from Step 1 +- `{time_range}`: User specified time range + +**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording. + +Launch 1 web-search-agent (background), **Prompt Template**: +```python +prompt = f"""## Task +Research topic: {topic} +Current date: {YYYY-MM-DD} + +Based on the following initial framework, supplement latest items and recommended research fields. + +## Existing Framework +{step1_output} + +## Goals +1. Verify if existing items are missing important objects +2. Supplement items based on missing objects +3. Continue searching for {topic} related items within {time_range} and supplement +4. Supplement new fields + +## Output Requirements +Return structured results directly (do not write files): + +### Supplementary Items +- item_name: Brief explanation (why it should be added) +... + +### Recommended Supplementary Fields +- field_name: Field description (why this dimension is needed) +... + +### Sources +- [Source1](url1) +- [Source2](url2) +""" +``` + +**One-shot Example** (assuming researching AI Coding History): +``` +## Task +Research topic: AI Coding History +Current date: 2025-12-30 + +Based on the following initial framework, supplement latest items and recommended research fields. + +## Existing Framework +### Items List +1. GitHub Copilot: Developed by Microsoft/GitHub, first mainstream AI coding assistant +2. Cursor: AI-first IDE, based on VSCode +... + +### Field Framework +- Basic Info: name, release_date, company +- Technical Features: underlying_model, context_window +... + +## Goals +1. Verify if existing items are missing important objects +2. Supplement items based on missing objects +3. Continue searching for AI Coding History related items within since 2024 and supplement +4. Supplement new fields + +## Output Requirements +Return structured results directly (do not write files): + +### Supplementary Items +- item_name: Brief explanation (why it should be added) +... + +### Recommended Supplementary Fields +- field_name: Field description (why this dimension is needed) +... + +### Sources +- [Source1](url1) +- [Source2](url2) +``` + +### Step 3: Ask User for Existing Fields +Use request_user_input to ask if user has existing field definition file, if so read and merge. + +### Step 4: Generate Outline (Separate Files) +Merge {step1_output}, {step2_output} and user's existing fields, generate two files: + +**outline.yaml** (items + config): +- topic: Research topic +- items: Research objects list +- execution: + - batch_size: Number of parallel agents (confirm with request_user_input) + - items_per_agent: Items per agent (confirm with request_user_input) + - output_dir: Results output directory (default: ./results) + +**fields.yaml** (field definitions): +- Field categories and definitions +- Each field's name, description, detail_level +- detail_level hierarchy: brief -> moderate -> detailed +- uncertain: Uncertain fields list (reserved field, auto-filled in deep phase) + +### Step 5: Output and Confirm +- Create directory: `./{topic_slug}/` +- Save: `outline.yaml` and `fields.yaml` +- Show to user for confirmation + +## Output Path +``` +{current_working_directory}/{topic_slug}/ + ├── outline.yaml # items list + execution config + └── fields.yaml # field definitions +``` + +## Follow-up Commands +- `/research-add-items` - Supplement items +- `/research-add-fields` - Supplement fields +- `/research-deep` - Start deep research diff --git a/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/validate_json.py b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/validate_json.py new file mode 100644 index 0000000..16c9566 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/validate_json.py @@ -0,0 +1,198 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import json +import sys +from collections import defaultdict +from pathlib import Path + +import yaml + +CATEGORY_MAPPING = { + "basic_info": ["basic_info", "Basic Info"], + "technical_features": ["technical_features", "technical_characteristics", "Technical Features"], + "performance_metrics": ["performance_metrics", "performance", "Performance Metrics"], + "milestone_significance": ["milestone_significance", "milestones", "Milestone Significance"], + "business_info": ["business_info", "commercial_info", "Business Info"], + "competition_ecosystem": ["competition_ecosystem", "competition", "Competition Ecosystem"], + "history": ["history", "History"], + "market_positioning": ["market_positioning", "market", "Market Positioning"], +} + +_SKIP_KEYS = {"_source_file", "uncertain"} + + +def load_fields_yaml(fields_path): + """Parse fields.yaml in the single schema the research skills emit: + + fields: + : + - {name: ..., description: ..., detail_level: ...} + ... + uncertain: [] + + This is the ONLY accepted shape. A fields.yaml that does not match fails + loudly instead of silently passing with zero fields. + + Required semantics (so the validator can never pass vacuously / "lie"): + - if ANY field carries an explicit `required:` key -> opt-in, preserve it + - else (detail_level-style, no markers) -> ALL fields required, because the + script's stated purpose is COMPLETE field coverage. + """ + with fields_path.open(encoding="utf-8") as f: + data = yaml.safe_load(f) or {} + defs = [] # (name, category, required_or_None) + + fn = data.get("fields") + if not isinstance(fn, dict): + print(f"[ERROR] fields.yaml must use the `fields: {{: [{{name, ...}}]}}` shape; got {type(fn).__name__ if fn is not None else 'None'}.") + sys.exit(1) + + for cname, flist in fn.items(): + if cname in _SKIP_KEYS: + continue + if not isinstance(flist, list): + print(f"[ERROR] category `{cname}` must map to a list of field dicts; got {type(flist).__name__}.") + sys.exit(1) + for field in flist: + if isinstance(field, dict) and "name" in field: + defs.append((str(field["name"]), str(cname), field.get("required", None))) + else: + print(f"[ERROR] field entry under `{cname}` must be a dict with a `name` key; got {field!r}.") + sys.exit(1) + + if not defs: + print("[ERROR] fields.yaml parsed zero fields. Ensure at least one category with field dicts.") + sys.exit(1) + + all_fields = {n for n, _, _ in defs} + if any(r is not None for _, _, r in defs): + required_fields = {n for n, _, r in defs if r} + else: + required_fields = set(all_fields) + field_categories = {n: c for n, c, _ in defs} + return all_fields, required_fields, field_categories + + +def extract_json_fields(data, category_mapping=None): + category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping + nested_keys = {k for keys in category_mapping.values() for k in keys} + fields = set() + stack = [(data, True)] + while stack: + obj, is_category_level = stack.pop() + if isinstance(obj, dict): + for k, v in obj.items(): + if k in _SKIP_KEYS: + continue + if is_category_level and k in nested_keys: + if isinstance(v, dict): + stack.append((v, True)) + continue + fields.add(k) + elif isinstance(obj, list): + stack.extend((item, is_category_level) for item in obj if isinstance(item, dict)) + return fields + + +def validate_json(json_path, all_fields, required_fields, field_categories): + with json_path.open(encoding="utf-8") as f: + data = json.load(f) + json_fields = extract_json_fields(data) + covered = all_fields & json_fields + missing = all_fields - json_fields + extra = json_fields - all_fields + missing_required = missing & required_fields + missing_by_category = defaultdict(list) + for field in missing: + missing_by_category[field_categories.get(field, "Unknown")].append(field) + return { + "file": json_path.name, + "total_defined": len(all_fields), + "covered": len(covered), + "missing": len(missing), + "extra": len(extra), + "coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100, + "missing_required": sorted(missing_required), + "missing_optional": sorted(missing - required_fields), + "missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()}, + "extra_fields": sorted(extra), + "valid": len(missing_required) == 0, + } + + +def print_result(result, verbose=True): + status = "PASS" if result["valid"] else "FAIL" + line = "=" * 60 + print(f"\n{line}") + print(f"[{status}] {result['file']}") + print(line) + print(f"Coverage: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})") + if result["missing_required"]: + print(f"\n[ERROR] Missing required fields ({len(result['missing_required'])}):") + print("\n".join(f" - {f}" for f in result["missing_required"])) + if verbose and result["missing_optional"]: + missing_required = set(result["missing_required"]) + print(f"\n[WARN] Missing optional fields ({len(result['missing_optional'])}):") + for cat in sorted(result["missing_by_category"]): + optional = [f for f in result["missing_by_category"][cat] if f not in missing_required] + if optional: + print(f" [{cat}]: {', '.join(optional)}") + if verbose and result["extra_fields"]: + extra = result["extra_fields"] + print(f"\n[INFO] Extra fields ({len(extra)}):") + print(f" {', '.join(extra[:10])}") + if len(extra) > 10: + print(f" ... and {len(extra) - 10} more") + + +def main(): + import argparse + parser = argparse.ArgumentParser(description="Validate whether JSON files cover all fields defined in fields.yaml") + parser.add_argument("--fields", "-f", type=str, help="Path to fields.yaml", default="fields.yaml") + parser.add_argument("--json", "-j", type=str, nargs="*", help="JSON file paths to validate") + parser.add_argument("--dir", "-d", type=str, help="Directory containing JSON files", default="results") + parser.add_argument("--quiet", "-q", action="store_true", help="Show summary only") + args = parser.parse_args() + fields_path = Path(args.fields) + if not fields_path.exists(): + for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"): + if p.exists(): + fields_path = p + break + if not fields_path.exists(): + print(f"[ERROR] fields.yaml not found: {fields_path}") + sys.exit(1) + print(f"Field definition file: {fields_path}") + all_fields, required_fields, field_categories = load_fields_yaml(fields_path) + print(f"Total fields: {len(all_fields)} (required: {len(required_fields)}, optional: {len(all_fields) - len(required_fields)})") + json_files = ( + [Path(p) for p in args.json] + if args.json + else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else [] + ) + if not json_files: + print("[WARN] No JSON files found") + sys.exit(0) + results = [] + for json_path in json_files: + if not json_path.exists(): + print(f"[WARN] File not found: {json_path}") + continue + result = validate_json(json_path, all_fields, required_fields, field_categories) + results.append(result) + print_result(result, verbose=not args.quiet) + line = "=" * 60 + print(f"\n{line}") + print("Summary") + print(line) + passed = sum(1 for r in results if r["valid"]) + avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0 + print(f"Validation passed: {passed}/{len(results)}") + print(f"Average coverage: {avg_coverage:.1f}%") + if passed < len(results): + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/SKILL.md new file mode 100644 index 0000000..c14562d --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/SKILL.md @@ -0,0 +1,32 @@ +--- +name: research-add-fields +user-invocable: true +description: Add field definitions to existing research outline. +allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion +--- + +# Research Add Fields - Supplement Research Fields + +## Trigger +`/research-add-fields` + +## Workflow + +### Step 1: Auto-locate Fields File +Find `*/fields.yaml` file in current working directory, auto-read existing fields definitions. + +### Step 2: Get Supplement Source +Ask user to choose: +- **A. User direct input**: User provides field names and descriptions +- **B. Web Search**: Launch agent to search common fields in this domain + +### Step 3: Display and Confirm +- Display suggested new fields list +- User confirms which fields to add +- User specifies field category and detail_level + +### Step 4: Save Update +Append confirmed fields to fields.yaml, save file. + +## Output +Updated `{topic}/fields.yaml` file (in-place modification, requires user confirmation) diff --git a/research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/SKILL.md new file mode 100644 index 0000000..fca1775 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/SKILL.md @@ -0,0 +1,30 @@ +--- +name: research-add-items +user-invocable: true +description: Add items (research objects) to existing research outline. +allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion +--- + +# Research Add Items - Supplement Research Objects + +## Trigger +`/research-add-items` + +## Workflow + +### Step 1: Auto-locate Outline +Find `*/outline.yaml` file in current working directory, auto-read. + +### Step 2: Get Supplement Sources in Parallel +Simultaneously: +- **A. Ask user**: What items to supplement? Any specific names? +- **B. Ask if Web Search needed**: Launch agent to search for more items? + +### Step 3: Merge and Update +- Append new items to outline.yaml +- Display to user for confirmation +- Avoid duplicates +- Save updated outline + +## Output +Updated `{topic}/outline.yaml` file (in-place modification) diff --git a/research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/SKILL.md new file mode 100644 index 0000000..90ff6b8 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/SKILL.md @@ -0,0 +1,100 @@ +--- +name: research-deep +user-invocable: true +description: Read research outline, launch independent agent for each item for deep research. Disable task output. +allowed-tools: Bash, Read, Write, Glob, WebSearch, Task +--- + +# Research Deep - Deep Research + +## Trigger +`/research-deep` + +## Workflow + +### Step 1: Auto-locate Outline +Find `*/outline.yaml` file in current working directory, read items list, execution config (including items_per_agent). + +### Step 2: Resume Check +- Check completed JSON files in output_dir +- Skip completed items + +### Step 3: Batch Execution +- Batch by batch_size (need user approval before next batch) +- Each agent handles items_per_agent items +- Launch web-search-agent (background parallel, disable task output) + +**Parameter Retrieval**: +- `{topic}`: topic field from outline.yaml +- `{item_name}`: item's name field +- `{item_related_info}`: item's complete yaml content (name + category + description etc.) +- `{output_dir}`: execution.output_dir from outline.yaml (default: ./results) +- `{fields_path}`: absolute path to {topic}/fields.yaml +- `{output_path}`: absolute path to {output_dir}/{item_name_slug}.json (slugify item_name: replace spaces with _, remove special chars) + +**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording. + +**Prompt Template**: +```python +prompt = f"""## Task +Research {item_related_info}, output structured JSON to {output_path} + +## Field Definitions +Read {fields_path} to get all field definitions + +## Output Requirements +1. Output JSON according to fields defined in fields.yaml +2. Mark uncertain field values with [uncertain] +3. Add uncertain array at the end of JSON, listing all uncertain field names +4. All field values must be in English + +## Output Path +{output_path} + +## Validation +After completing JSON output, run validation script to ensure complete field coverage: +python ~/.claude/skills/research/validate_json.py -f {fields_path} -j {output_path} +Task is complete only after validation passes. +""" +``` + +**One-shot Example** (assuming researching GitHub Copilot): +``` +## Task +Research name: GitHub Copilot +category: International Product +description: Developed by Microsoft/GitHub, first mainstream AI coding assistant, ~40% market share, output structured JSON to {project_dir}/results/GitHub_Copilot.json + +## Field Definitions +Read {project_dir}/fields.yaml to get all field definitions + +## Output Requirements +1. Output JSON according to fields defined in fields.yaml +2. Mark uncertain field values with [uncertain] +3. Add uncertain array at the end of JSON, listing all uncertain field names +4. All field values must be in English + +## Output Path +{project_dir}/results/GitHub_Copilot.json + +## Validation +After completing JSON output, run validation script to ensure complete field coverage: +python ~/.claude/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json +Task is complete only after validation passes. +``` + +### Step 4: Wait and Monitor +- Wait for current batch to complete +- Launch next batch +- Display progress + +### Step 5: Summary Report +After all complete, output: +- Completion count +- Failed/uncertain marked items +- Output directory + +## Agent Config +- Background execution: Yes +- Task Output: Disabled (agent has explicit output file when complete) +- Resume support: Yes diff --git a/research-what-we-did/Deep-Research-skills/skills/research-en/research-report/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-en/research-report/SKILL.md new file mode 100644 index 0000000..31b4964 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-en/research-report/SKILL.md @@ -0,0 +1,93 @@ +--- +name: research-report +user-invocable: true +description: Summarize deep research results into markdown report, cover all fields, skip uncertain values. +allowed-tools: Read, Write, Glob, Bash, AskUserQuestion +--- + +# Research Report - Summary Report + +## Trigger +`/research-report` + +## Workflow + +### Step 1: Locate Results Directory +Find `*/outline.yaml` in current working directory, read topic and output_dir config. + +### Step 2: Scan Optional Summary Fields +Read all JSON results, extract fields suitable for TOC display (numeric, short metrics), e.g.: +- github_stars +- google_scholar_cites +- swe_bench_score +- user_scale +- valuation +- release_date + +Use AskUserQuestion to ask user: +- Which fields to display in TOC besides item name? +- Provide dynamic options list (based on actual fields in JSON) + +### Step 3: Generate Python Conversion Script +Generate `generate_report.py` in `{topic}/` directory, script requirements: +- Read all JSON from output_dir +- Read fields.yaml to get field structure +- Cover all field values from each JSON +- Skip fields with values containing [uncertain] +- Skip fields listed in uncertain array +- Generate markdown report format: Table of contents (with anchor links + user-selected summary fields) + Detailed content (by field category) +- Save to `{topic}/report.md` + +**TOC Format Requirements**: +- Must include every item +- Each item displays: number, name (anchor link), user-selected summary fields +- Example: `1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%` + +#### Script Technical Requirements (Must Follow) + +**1. JSON Structure Compatibility** +Support two JSON structures: +- Flat structure: Fields directly at top level `{"name": "xxx", "release_date": "xxx"}` +- Nested structure: Fields in category sub-dict `{"basic_info": {"name": "xxx"}, "technical_features": {...}}` + +Field lookup order: Top level -> category mapping key -> Traverse all nested dicts + +**2. Category Multi-language Mapping** +fields.yaml category names and JSON keys can be any combination (CN-CN, CN-EN, EN-CN, EN-EN). Must establish bidirectional mapping: +```python +CATEGORY_MAPPING = { + "Basic Info": ["basic_info", "Basic Info"], + "Technical Features": ["technical_features", "technical_characteristics", "Technical Features"], + "Performance Metrics": ["performance_metrics", "performance", "Performance Metrics"], + "Milestone Significance": ["milestone_significance", "milestones", "Milestone Significance"], + "Business Info": ["business_info", "commercial_info", "Business Info"], + "Competition & Ecosystem": ["competition_ecosystem", "competition", "Competition & Ecosystem"], + "History": ["history", "History"], + "Market Positioning": ["market_positioning", "market", "Market Positioning"], +} +``` + +**3. Complex Value Formatting** +- list of dicts (e.g., key_events, funding_history): Format each dict as one line, separate kv with ` | ` +- Normal list: Short lists joined with comma, long lists displayed with line breaks +- Nested dict: Recursive formatting, display with semicolon or line breaks +- Long text strings (over 100 chars): Add line breaks `
` or use blockquote format for readability + +**4. Extra Fields Collection** +Collect fields that exist in JSON but not defined in fields.yaml, put in "Other Info" category. Note to filter: +- Internal fields: `_source_file`, `uncertain` +- Nested structure top-level keys: `basic_info`, `technical_features` etc. +- `uncertain` array: Display each field name on separate line, don't compress into one line + +**5. Uncertain Value Skipping** +Skip conditions: +- Field value contains `[uncertain]` string +- Field name is in `uncertain` array +- Field value is None or empty string + +### Step 4: Execute Script +Run `python {topic}/generate_report.py` + +## Output +- `{topic}/generate_report.py` - Conversion script +- `{topic}/report.md` - Summary report diff --git a/research-what-we-did/Deep-Research-skills/skills/research-en/research/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-en/research/SKILL.md new file mode 100644 index 0000000..2eaf8cb --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-en/research/SKILL.md @@ -0,0 +1,145 @@ +--- +name: research +user-invocable: true +allowed-tools: Read, Write, Glob, WebSearch, Task, AskUserQuestion +description: Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc. +--- + +# Research Skill - Preliminary Research + +## Trigger +`/research ` + +## Workflow + +### Step 1: Generate Initial Framework from Model Knowledge +Based on topic, use model's existing knowledge to generate: +- Main research objects/items list in this domain +- Suggested research field framework + +Output {step1_output}, use AskUserQuestion to confirm: +- Need to add/remove items? +- Does field framework meet requirements? + +### Step 2: Web Search Supplement +Use AskUserQuestion to ask for time range (e.g., last 6 months, since 2024, unlimited). + +**Parameter Retrieval**: +- `{topic}`: User input research topic +- `{YYYY-MM-DD}`: Current date +- `{step1_output}`: Complete output from Step 1 +- `{time_range}`: User specified time range + +**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording. + +Launch 1 web-search-agent (background), **Prompt Template**: +```python +prompt = f"""## Task +Research topic: {topic} +Current date: {YYYY-MM-DD} + +Based on the following initial framework, supplement latest items and recommended research fields. + +## Existing Framework +{step1_output} + +## Goals +1. Verify if existing items are missing important objects +2. Supplement items based on missing objects +3. Continue searching for {topic} related items within {time_range} and supplement +4. Supplement new fields + +## Output Requirements +Return structured results directly (do not write files): + +### Supplementary Items +- item_name: Brief explanation (why it should be added) +... + +### Recommended Supplementary Fields +- field_name: Field description (why this dimension is needed) +... + +### Sources +- [Source1](url1) +- [Source2](url2) +""" +``` + +**One-shot Example** (assuming researching AI Coding History): +``` +## Task +Research topic: AI Coding History +Current date: 2025-12-30 + +Based on the following initial framework, supplement latest items and recommended research fields. + +## Existing Framework +### Items List +1. GitHub Copilot: Developed by Microsoft/GitHub, first mainstream AI coding assistant +2. Cursor: AI-first IDE, based on VSCode +... + +### Field Framework +- Basic Info: name, release_date, company +- Technical Features: underlying_model, context_window +... + +## Goals +1. Verify if existing items are missing important objects +2. Supplement items based on missing objects +3. Continue searching for AI Coding History related items within since 2024 and supplement +4. Supplement new fields + +## Output Requirements +Return structured results directly (do not write files): + +### Supplementary Items +- item_name: Brief explanation (why it should be added) +... + +### Recommended Supplementary Fields +- field_name: Field description (why this dimension is needed) +... + +### Sources +- [Source1](url1) +- [Source2](url2) +``` + +### Step 3: Ask User for Existing Fields +Use AskUserQuestion to ask if user has existing field definition file, if so read and merge. + +### Step 4: Generate Outline (Separate Files) +Merge {step1_output}, {step2_output} and user's existing fields, generate two files: + +**outline.yaml** (items + config): +- topic: Research topic +- items: Research objects list +- execution: + - batch_size: Number of parallel agents (confirm with AskUserQuestion) + - items_per_agent: Items per agent (confirm with AskUserQuestion) + - output_dir: Results output directory (default: ./results) + +**fields.yaml** (field definitions): +- Field categories and definitions +- Each field's name, description, detail_level +- detail_level hierarchy: brief -> moderate -> detailed +- uncertain: Uncertain fields list (reserved field, auto-filled in deep phase) + +### Step 5: Output and Confirm +- Create directory: `./{topic_slug}/` +- Save: `outline.yaml` and `fields.yaml` +- Show to user for confirmation + +## Output Path +``` +{current_working_directory}/{topic_slug}/ + ├── outline.yaml # items list + execution config + └── fields.yaml # field definitions +``` + +## Follow-up Commands +- `/research-add-items` - Supplement items +- `/research-add-fields` - Supplement fields +- `/research-deep` - Start deep research diff --git a/research-what-we-did/Deep-Research-skills/skills/research-en/research/validate_json.py b/research-what-we-did/Deep-Research-skills/skills/research-en/research/validate_json.py new file mode 100644 index 0000000..16c9566 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-en/research/validate_json.py @@ -0,0 +1,198 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import json +import sys +from collections import defaultdict +from pathlib import Path + +import yaml + +CATEGORY_MAPPING = { + "basic_info": ["basic_info", "Basic Info"], + "technical_features": ["technical_features", "technical_characteristics", "Technical Features"], + "performance_metrics": ["performance_metrics", "performance", "Performance Metrics"], + "milestone_significance": ["milestone_significance", "milestones", "Milestone Significance"], + "business_info": ["business_info", "commercial_info", "Business Info"], + "competition_ecosystem": ["competition_ecosystem", "competition", "Competition Ecosystem"], + "history": ["history", "History"], + "market_positioning": ["market_positioning", "market", "Market Positioning"], +} + +_SKIP_KEYS = {"_source_file", "uncertain"} + + +def load_fields_yaml(fields_path): + """Parse fields.yaml in the single schema the research skills emit: + + fields: + : + - {name: ..., description: ..., detail_level: ...} + ... + uncertain: [] + + This is the ONLY accepted shape. A fields.yaml that does not match fails + loudly instead of silently passing with zero fields. + + Required semantics (so the validator can never pass vacuously / "lie"): + - if ANY field carries an explicit `required:` key -> opt-in, preserve it + - else (detail_level-style, no markers) -> ALL fields required, because the + script's stated purpose is COMPLETE field coverage. + """ + with fields_path.open(encoding="utf-8") as f: + data = yaml.safe_load(f) or {} + defs = [] # (name, category, required_or_None) + + fn = data.get("fields") + if not isinstance(fn, dict): + print(f"[ERROR] fields.yaml must use the `fields: {{: [{{name, ...}}]}}` shape; got {type(fn).__name__ if fn is not None else 'None'}.") + sys.exit(1) + + for cname, flist in fn.items(): + if cname in _SKIP_KEYS: + continue + if not isinstance(flist, list): + print(f"[ERROR] category `{cname}` must map to a list of field dicts; got {type(flist).__name__}.") + sys.exit(1) + for field in flist: + if isinstance(field, dict) and "name" in field: + defs.append((str(field["name"]), str(cname), field.get("required", None))) + else: + print(f"[ERROR] field entry under `{cname}` must be a dict with a `name` key; got {field!r}.") + sys.exit(1) + + if not defs: + print("[ERROR] fields.yaml parsed zero fields. Ensure at least one category with field dicts.") + sys.exit(1) + + all_fields = {n for n, _, _ in defs} + if any(r is not None for _, _, r in defs): + required_fields = {n for n, _, r in defs if r} + else: + required_fields = set(all_fields) + field_categories = {n: c for n, c, _ in defs} + return all_fields, required_fields, field_categories + + +def extract_json_fields(data, category_mapping=None): + category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping + nested_keys = {k for keys in category_mapping.values() for k in keys} + fields = set() + stack = [(data, True)] + while stack: + obj, is_category_level = stack.pop() + if isinstance(obj, dict): + for k, v in obj.items(): + if k in _SKIP_KEYS: + continue + if is_category_level and k in nested_keys: + if isinstance(v, dict): + stack.append((v, True)) + continue + fields.add(k) + elif isinstance(obj, list): + stack.extend((item, is_category_level) for item in obj if isinstance(item, dict)) + return fields + + +def validate_json(json_path, all_fields, required_fields, field_categories): + with json_path.open(encoding="utf-8") as f: + data = json.load(f) + json_fields = extract_json_fields(data) + covered = all_fields & json_fields + missing = all_fields - json_fields + extra = json_fields - all_fields + missing_required = missing & required_fields + missing_by_category = defaultdict(list) + for field in missing: + missing_by_category[field_categories.get(field, "Unknown")].append(field) + return { + "file": json_path.name, + "total_defined": len(all_fields), + "covered": len(covered), + "missing": len(missing), + "extra": len(extra), + "coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100, + "missing_required": sorted(missing_required), + "missing_optional": sorted(missing - required_fields), + "missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()}, + "extra_fields": sorted(extra), + "valid": len(missing_required) == 0, + } + + +def print_result(result, verbose=True): + status = "PASS" if result["valid"] else "FAIL" + line = "=" * 60 + print(f"\n{line}") + print(f"[{status}] {result['file']}") + print(line) + print(f"Coverage: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})") + if result["missing_required"]: + print(f"\n[ERROR] Missing required fields ({len(result['missing_required'])}):") + print("\n".join(f" - {f}" for f in result["missing_required"])) + if verbose and result["missing_optional"]: + missing_required = set(result["missing_required"]) + print(f"\n[WARN] Missing optional fields ({len(result['missing_optional'])}):") + for cat in sorted(result["missing_by_category"]): + optional = [f for f in result["missing_by_category"][cat] if f not in missing_required] + if optional: + print(f" [{cat}]: {', '.join(optional)}") + if verbose and result["extra_fields"]: + extra = result["extra_fields"] + print(f"\n[INFO] Extra fields ({len(extra)}):") + print(f" {', '.join(extra[:10])}") + if len(extra) > 10: + print(f" ... and {len(extra) - 10} more") + + +def main(): + import argparse + parser = argparse.ArgumentParser(description="Validate whether JSON files cover all fields defined in fields.yaml") + parser.add_argument("--fields", "-f", type=str, help="Path to fields.yaml", default="fields.yaml") + parser.add_argument("--json", "-j", type=str, nargs="*", help="JSON file paths to validate") + parser.add_argument("--dir", "-d", type=str, help="Directory containing JSON files", default="results") + parser.add_argument("--quiet", "-q", action="store_true", help="Show summary only") + args = parser.parse_args() + fields_path = Path(args.fields) + if not fields_path.exists(): + for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"): + if p.exists(): + fields_path = p + break + if not fields_path.exists(): + print(f"[ERROR] fields.yaml not found: {fields_path}") + sys.exit(1) + print(f"Field definition file: {fields_path}") + all_fields, required_fields, field_categories = load_fields_yaml(fields_path) + print(f"Total fields: {len(all_fields)} (required: {len(required_fields)}, optional: {len(all_fields) - len(required_fields)})") + json_files = ( + [Path(p) for p in args.json] + if args.json + else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else [] + ) + if not json_files: + print("[WARN] No JSON files found") + sys.exit(0) + results = [] + for json_path in json_files: + if not json_path.exists(): + print(f"[WARN] File not found: {json_path}") + continue + result = validate_json(json_path, all_fields, required_fields, field_categories) + results.append(result) + print_result(result, verbose=not args.quiet) + line = "=" * 60 + print(f"\n{line}") + print("Summary") + print(line) + passed = sum(1 for r in results if r["valid"]) + avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0 + print(f"Validation passed: {passed}/{len(results)}") + print(f"Average coverage: {avg_coverage:.1f}%") + if passed < len(results): + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/SKILL.md new file mode 100644 index 0000000..fe09046 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/SKILL.md @@ -0,0 +1,32 @@ +--- +name: research-add-fields +user-invocable: true +description: 向现有调研outline补充字段定义。 +allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion +--- + +# Research Add Fields - 补充调研字段 + +## 触发方式 +`/research-add-fields` + +## 执行流程 + +### Step 1: 自动定位Fields文件 +在当前工作目录查找 `*/fields.yaml` 文件，自动读取现有fields定义。 + +### Step 2: 获取补充来源 +询问用户选择： +- **A. 用户直接输入**：用户提供字段名称和描述 +- **B. Web Search搜索**：启动web-search-agent搜索该领域常用字段 + +### Step 3: 展示并确认 +- 展示建议的新字段列表 +- 用户确认哪些字段需要添加 +- 用户指定字段分类和detail_level + +### Step 4: 保存更新 +将确认的字段追加到fields.yaml，保存文件。 + +## 输出 +更新后的 `{topic}/fields.yaml` 文件（原地修改，需用户确认） diff --git a/research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/SKILL.md new file mode 100644 index 0000000..814e47e --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/SKILL.md @@ -0,0 +1,30 @@ +--- +name: research-add-items +user-invocable: true +description: 向现有调研outline补充items（调研对象）。 +allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion +--- + +# Research Add Items - 补充调研对象 + +## 触发方式 +`/research-add-items` + +## 执行流程 + +### Step 1: 自动定位Outline +在当前工作目录查找 `*/outline.yaml` 文件，自动读取。 + +### Step 2: 并行获取补充来源 +同时进行： +- **A. 询问用户**：需要补充哪些items？有具体名称吗？ +- **B. 询问是否需要Web Search**：是否启动agent搜索更多items？ + +### Step 3: 合并更新 +- 将新items追加到outline.yaml +- 展示给用户确认 +- 避免重复 +- 保存更新后的outline + +## 输出 +更新后的 `{topic}/outline.yaml` 文件（原地修改） diff --git a/research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/SKILL.md new file mode 100644 index 0000000..399aadb --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/SKILL.md @@ -0,0 +1,100 @@ +--- +name: research-deep +user-invocable: true +description: 读取调研outline，为每个item启动独立agent进行深度调研。禁用task output。 +allowed-tools: Bash, Read, Write, Glob, WebSearch, Task +--- + +# Research Deep - 深度调研 + +## 触发方式 +`/research-deep` + +## 执行流程 + +### Step 1: 自动定位Outline +在当前工作目录查找 `*/outline.yaml` 文件，读取items列表、execution配置（含items_per_agent）。 + +### Step 2: 断点续传检查 +- 检查output_dir下已完成的JSON文件 +- 跳过已完成的items + +### Step 3: 分批执行 +- 按batch_size分批（完成一批需要得到用户同意才可进行下一批） +- 每个agent负责items_per_agent个项目 +- 启动web-search-agent（后台并行，禁用task output） + +**参数获取**： +- `{topic}`: outline.yaml中的topic字段 +- `{item_name}`: item的name字段 +- `{item_related_info}`: item的完整yaml内容（name + category + description等） +- `{output_dir}`: outline.yaml中execution.output_dir（默认./results） +- `{fields_path}`: {topic}/fields.yaml的绝对路径 +- `{output_path}`: {output_dir}/{item_name_slug}.json的绝对路径（slugify处理item_name：空格替换为_，移除特殊字符） + +**硬约束**：以下prompt必须严格复述，仅替换{xxx}中的变量，禁止改写结构或措辞。 + +**Prompt模板**： +```python +prompt = f"""## 任务 +调研 {item_related_info}，输出结构化JSON到 {output_path} + +## 字段定义 +读取 {fields_path} 获取所有字段定义 + +## 输出要求 +1. 按fields.yaml定义的字段输出JSON +2. 不确定的字段值标注[不确定] +3. JSON末尾添加uncertain数组，列出所有不确定的字段名 +4. 所有字段值必须使用中文输出（调研过程可用英文，但最终JSON值为中文） + +## 输出路径 +{output_path} + +## 验证 +完成JSON输出后，运行验证脚本确保字段完整覆盖： +python ~/.claude/skills/research/validate_json.py -f {fields_path} -j {output_path} +验证通过后才算完成任务。 +""" +``` + +**One-shot示例**（假设调研GitHub Copilot）： +``` +## 任务 +调研 name: GitHub Copilot +category: 国际产品 +description: Microsoft/GitHub开发，首个主流AI编程助手，市场份额约40%，输出结构化JSON到 {project_dir}/results/GitHub_Copilot.json + +## 字段定义 +读取 {project_dir}/fields.yaml 获取所有字段定义 + +## 输出要求 +1. 按fields.yaml定义的字段输出JSON +2. 不确定的字段值标注[不确定] +3. JSON末尾添加uncertain数组，列出所有不确定的字段名 +4. 所有字段值必须使用中文输出（调研过程可用英文，但最终JSON值为中文） + +## 输出路径 +{project_dir}/results/GitHub_Copilot.json + +## 验证 +完成JSON输出后，运行验证脚本确保字段完整覆盖： +python ~/.claude/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json +验证通过后才算完成任务。 +``` + +### Step 4: 等待与监控 +- 等待当前批次完成 +- 启动下一批 +- 显示进度 + +### Step 5: 汇总报告 +全部完成后输出： +- 完成数量 +- 失败/不确定标记的items +- 输出目录 + +## Agent配置 +- 后台执行: 是 +- Task Output: 禁用（agent完成时有明确输出文件） +- 断点续传: 是 diff --git a/research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/SKILL.md new file mode 100644 index 0000000..0614841 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/SKILL.md @@ -0,0 +1,93 @@ +--- +name: research-report +user-invocable: true +description: 将deep调研结果汇总为markdown报告，覆盖所有字段，跳过不确定值。 +allowed-tools: Read, Write, Glob, Bash, AskUserQuestion +--- + +# Research Report - 汇总报告 + +## 触发方式 +`/research-report` + +## 执行流程 + +### Step 1: 定位结果目录 +在当前工作目录查找 `*/outline.yaml`，读取topic和output_dir配置。 + +### Step 2: 扫描可选摘要字段 +读取所有JSON结果，提取适合在目录中显示的字段（数值型、简短指标），例如： +- github_stars +- google_scholar_cites +- swe_bench_score +- user_scale +- valuation +- release_date + +使用AskUserQuestion询问用户： +- 目录中除了item名称外，还需要显示哪些字段？ +- 提供动态选项列表（基于实际JSON中存在的字段） + +### Step 3: 生成Python转换脚本 +在 `{topic}/` 目录下生成 `generate_report.py`，脚本要求： +- 读取output_dir下所有JSON +- 读取fields.yaml获取字段结构 +- 覆盖每个JSON的所有字段值 +- 跳过值包含[不确定]的字段 +- 跳过uncertain数组中列出的字段 +- 生成markdown报告格式：目录（带锚点跳转+用户选择的摘要字段）+ 详细内容（按字段分类） +- 保存到 `{topic}/report.md` + +**目录格式要求**： +- 必须包含每一个item +- 每个item显示：序号、名称（锚点链接）、用户选择的摘要字段 +- 示例：`1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%` + +#### 脚本技术要点（必须遵循） + +**1. JSON结构兼容** +支持两种JSON结构： +- 扁平结构：字段直接在顶层 `{"name": "xxx", "release_date": "xxx"}` +- 嵌套结构：字段在category子dict中 `{"basic_info": {"name": "xxx"}, "technical_features": {...}}` + +字段查找顺序：顶层 -> category映射key -> 遍历所有嵌套dict + +**2. Category多语言映射** +fields.yaml的category名与JSON的key可能是任意组合（中中、中英、英中、英英）。必须建立双向映射： +```python +CATEGORY_MAPPING = { + "基本信息": ["basic_info", "基本信息"], + "技术特性": ["technical_features", "technical_characteristics", "技术特性"], + "性能指标": ["performance_metrics", "performance", "性能指标"], + "里程碑意义": ["milestone_significance", "milestones", "里程碑意义"], + "商业信息": ["business_info", "commercial_info", "商业信息"], + "竞争与生态": ["competition_ecosystem", "competition", "竞争与生态"], + "历史沿革": ["history", "历史沿革"], + "市场定位": ["market_positioning", "market", "市场定位"], +} +``` + +**3. 复杂值格式化** +- list of dicts（如key_events, funding_history）：每个dict格式化为一行，用` | `分隔kv +- 普通list：短列表用逗号连接，长列表换行显示 +- 嵌套dict：递归格式化，用分号或换行显示 +- 长文本字符串（超过100字符）：添加换行符`
`或使用blockquote格式，提高可读性 + +**4. 额外字段收集** +收集JSON中有但fields.yaml中没定义的字段，放入"其他信息"分类。注意过滤： +- 内部字段：`_source_file`, `uncertain` +- 嵌套结构顶级key：`basic_info`, `technical_features`等 +- `uncertain`数组：需要逐行显示每个字段名，不要压缩成一行 + +**5. 不确定值跳过** +跳过条件： +- 字段值包含`[不确定]`字符串 +- 字段名在`uncertain`数组中 +- 字段值为None或空字符串 + +### Step 4: 执行脚本 +运行 `python {topic}/generate_report.py` + +## 输出 +- `{topic}/generate_report.py` - 转换脚本 +- `{topic}/report.md` - 汇总报告 diff --git a/research-what-we-did/Deep-Research-skills/skills/research-zh/research/SKILL.md b/research-what-we-did/Deep-Research-skills/skills/research-zh/research/SKILL.md new file mode 100644 index 0000000..c440d78 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-zh/research/SKILL.md @@ -0,0 +1,145 @@ +--- +name: research +user-invocable: true +allowed-tools: Read, Write, Glob, WebSearch, Task, AskUserQuestion +description: 对目标话题进行初步调研，生成调研outline。用于学术调研、benchmark调研、技术选型等场景。 +--- + +# Research Skill - 初步调研 + +## 触发方式 +`/research ` + +## 执行流程 + +### Step 1: 模型内部知识生成初步框架 +基于topic，利用模型已有知识生成： +- 该领域的主要研究对象/items列表 +- 建议的调研字段框架 + +输出{step1_output}，使用AskUserQuestion确认： +- items列表是否需要增减？ +- 字段框架是否满足需求？ + +### Step 2: Web Search补充 +使用AskUserQuestion询问时间范围（如：最近6个月、2024年至今、不限）。 + +**参数获取**： +- `{topic}`: 用户输入的调研话题 +- `{YYYY-MM-DD}`: 当前日期 +- `{step1_output}`: Step 1生成的完整输出内容 +- `{time_range}`: 用户指定的时间范围 + +**硬约束**：以下prompt必须严格复述，仅替换{xxx}中的变量，禁止改写结构或措辞。 + +启动1个web-search-agent（后台），**Prompt模板**： +```python +prompt = f"""## 任务 +调研话题: {topic} +当前日期: {YYYY-MM-DD} + +基于以下初步框架，补充最新items和推荐调研字段。 + +## 已有框架 +{step1_output} + +## 目标 +1. 验证已有items是否遗漏重要对象 +2. 根据遗漏对象进行补充items +3. 继续搜索{topic}相关且{time_range}内的items并补充 +4. 补充新fields + +## 输出要求 +直接返回结构化结果（不写文件）： + +### 补充Items +- item_name: 简要说明（为什么应该加入） +... + +### 推荐补充字段 +- field_name: 字段描述（为什么需要这个维度） +... + +### 信息来源 +- [来源1](url1) +- [来源2](url2) +""" +``` + +**One-shot示例**（假设调研AI Coding发展史）： +``` +## 任务 +调研话题: AI Coding 发展史 +当前日期: 2025-12-30 + +基于以下初步框架，补充最新items和推荐调研字段。 + +## 已有框架 +### Items列表 +1. GitHub Copilot: Microsoft/GitHub开发，首个主流AI编程助手 +2. Cursor: AI-first IDE，基于VSCode +... + +### 字段框架 +- 基本信息: name, release_date, company +- 技术特性: underlying_model, context_window +... + +## 目标 +1. 验证已有items是否遗漏重要对象 +2. 根据遗漏对象进行补充items +3. 继续搜索AI Coding 发展史相关且2024年至今内的items并补充 +4. 补充新fields + +## 输出要求 +直接返回结构化结果（不写文件）： + +### 补充Items +- item_name: 简要说明（为什么应该加入） +... + +### 推荐补充字段 +- field_name: 字段描述（为什么需要这个维度） +... + +### 信息来源 +- [来源1](url1) +- [来源2](url2) +``` + +### Step 3: 询问用户已有字段 +使用AskUserQuestion询问用户是否有已定义的字段文件，如有则读取并合并。 + +### Step 4: 生成Outline（分离文件） +合并{step1_output}、{step2_output}和用户已有字段，生成两个文件： + +**outline.yaml**（items + 配置）： +- topic: 调研主题 +- items: 调研对象列表 +- execution: + - batch_size: 并行agent数量（需AskUserQuestion确认） + - items_per_agent: 每个agent调研项目数（需AskUserQuestion确认） + - output_dir: 结果输出目录（默认./results） + +**fields.yaml**（字段定义）： +- 字段分类和定义 +- 每个字段的name、description、detail_level +- detail_level分层：极简 → 简要 → 详细 +- uncertain: 不确定字段列表（保留字段，deep阶段自动填充） + +### Step 5: 输出并确认 +- 创建目录: `./{topic_slug}/` +- 保存: `outline.yaml` 和 `fields.yaml` +- 展示给用户确认 + +## 输出路径 +``` +{当前工作目录}/{topic_slug}/ + ├── outline.yaml # items列表 + execution配置 + └── fields.yaml # 字段定义 +``` + +## 后续命令 +- `/research-add-items` - 补充items +- `/research-add-fields` - 补充字段 +- `/research-deep` - 开始深度调研 diff --git a/research-what-we-did/Deep-Research-skills/skills/research-zh/research/validate_json.py b/research-what-we-did/Deep-Research-skills/skills/research-zh/research/validate_json.py new file mode 100644 index 0000000..81eae4f --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/skills/research-zh/research/validate_json.py @@ -0,0 +1,197 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import json +import sys +from collections import defaultdict +from pathlib import Path + +import yaml + +CATEGORY_MAPPING = { + "基本信息": ["basic_info", "基本信息"], + "技术特性": ["technical_features", "technical_characteristics", "技术特性"], + "性能指标": ["performance_metrics", "performance", "性能指标"], + "里程碑意义": ["milestone_significance", "milestones", "里程碑意义"], + "商业信息": ["business_info", "commercial_info", "商业信息"], + "竞争与生态": ["competition_ecosystem", "competition", "竞争与生态"], + "历史沿革": ["history", "历史沿革"], + "市场定位": ["market_positioning", "market", "市场定位"], +} + +_SKIP_KEYS = {"_source_file", "uncertain"} + + +def load_fields_yaml(fields_path): + """解析 fields.yaml，仅接受 research skill 实际生成的唯一 schema： + + fields: + : + - {name: ..., description: ..., detail_level: ...} + ... + uncertain: [] + + 只接受这一种格式。不符合的 fields.yaml 会直接报错退出， + 而不是以零字段静默通过。 + + Required 语义（避免校验器空转通过/说谎）： + - 若任一字段显式带 `required:` 键 -> 沿用 opt-in 语义 + - 否则（detail_level 式、无标记）-> 全部字段视为必填，因为脚本的目的就是完整覆盖。 + """ + with fields_path.open(encoding="utf-8") as f: + data = yaml.safe_load(f) or {} + defs = [] # (name, category, required_or_None) + + fn = data.get("fields") + if not isinstance(fn, dict): + print(f"[错误] fields.yaml 必须使用 `fields: {{: [{{name, ...}}]}}` 格式；当前为 {type(fn).__name__ if fn is not None else 'None'}。") + sys.exit(1) + + for cname, flist in fn.items(): + if cname in _SKIP_KEYS: + continue + if not isinstance(flist, list): + print(f"[错误] 分类 `{cname}` 必须映射为字段字典列表；当前为 {type(flist).__name__}。") + sys.exit(1) + for field in flist: + if isinstance(field, dict) and "name" in field: + defs.append((str(field["name"]), str(cname), field.get("required", None))) + else: + print(f"[错误] `{cname}` 下的字段必须是带 `name` 键的字典；当前为 {field!r}。") + sys.exit(1) + + if not defs: + print("[错误] fields.yaml 解析到零个字段。请确保至少有一个分类及其字段字典。") + sys.exit(1) + + all_fields = {n for n, _, _ in defs} + if any(r is not None for _, _, r in defs): + required_fields = {n for n, _, r in defs if r} + else: + required_fields = set(all_fields) + field_categories = {n: c for n, c, _ in defs} + return all_fields, required_fields, field_categories + + +def extract_json_fields(data, category_mapping=None): + category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping + nested_keys = {k for keys in category_mapping.values() for k in keys} + fields = set() + stack = [(data, True)] + while stack: + obj, is_category_level = stack.pop() + if isinstance(obj, dict): + for k, v in obj.items(): + if k in _SKIP_KEYS: + continue + if is_category_level and k in nested_keys: + if isinstance(v, dict): + stack.append((v, True)) + continue + fields.add(k) + elif isinstance(obj, list): + stack.extend((item, is_category_level) for item in obj if isinstance(item, dict)) + return fields + + +def validate_json(json_path, all_fields, required_fields, field_categories): + with json_path.open(encoding="utf-8") as f: + data = json.load(f) + json_fields = extract_json_fields(data) + covered = all_fields & json_fields + missing = all_fields - json_fields + extra = json_fields - all_fields + missing_required = missing & required_fields + missing_by_category = defaultdict(list) + for field in missing: + missing_by_category[field_categories.get(field, "未知")].append(field) + return { + "file": json_path.name, + "total_defined": len(all_fields), + "covered": len(covered), + "missing": len(missing), + "extra": len(extra), + "coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100, + "missing_required": sorted(missing_required), + "missing_optional": sorted(missing - required_fields), + "missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()}, + "extra_fields": sorted(extra), + "valid": len(missing_required) == 0, + } + + +def print_result(result, verbose=True): + status = "通过" if result["valid"] else "失败" + line = "=" * 60 + print(f"\n{line}") + print(f"[{status}] {result['file']}") + print(line) + print(f"覆盖率: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})") + if result["missing_required"]: + print(f"\n[错误] 缺少必填字段 ({len(result['missing_required'])}):") + print("\n".join(f" - {f}" for f in result["missing_required"])) + if verbose and result["missing_optional"]: + missing_required = set(result["missing_required"]) + print(f"\n[警告] 缺少可选字段 ({len(result['missing_optional'])}):") + for cat in sorted(result["missing_by_category"]): + optional = [f for f in result["missing_by_category"][cat] if f not in missing_required] + if optional: + print(f" [{cat}]: {', '.join(optional)}") + if verbose and result["extra_fields"]: + extra = result["extra_fields"] + print(f"\n[信息] 额外字段 ({len(extra)}):") + print(f" {', '.join(extra[:10])}") + if len(extra) > 10: + print(f" ... 还有 {len(extra) - 10} 个") + + +def main(): + import argparse + parser = argparse.ArgumentParser(description="验证JSON文件是否覆盖fields.yaml中定义的所有字段") + parser.add_argument("--fields", "-f", type=str, help="fields.yaml路径", default="fields.yaml") + parser.add_argument("--json", "-j", type=str, nargs="*", help="要验证的JSON文件路径") + parser.add_argument("--dir", "-d", type=str, help="包含JSON文件的目录", default="results") + parser.add_argument("--quiet", "-q", action="store_true", help="仅显示摘要") + args = parser.parse_args() + fields_path = Path(args.fields) + if not fields_path.exists(): + for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"): + if p.exists(): + fields_path = p + break + if not fields_path.exists(): + print(f"[错误] 找不到fields.yaml: {fields_path}") + sys.exit(1) + print(f"字段定义文件: {fields_path}") + all_fields, required_fields, field_categories = load_fields_yaml(fields_path) + print(f"总字段数: {len(all_fields)} (必填: {len(required_fields)}, 可选: {len(all_fields) - len(required_fields)})") + json_files = ( + [Path(p) for p in args.json] + if args.json + else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else [] + ) + if not json_files: + print("[警告] 未找到JSON文件") + sys.exit(0) + results = [] + for json_path in json_files: + if not json_path.exists(): + print(f"[警告] 文件不存在: {json_path}") + continue + result = validate_json(json_path, all_fields, required_fields, field_categories) + results.append(result) + print_result(result, verbose=not args.quiet) + line = "=" * 60 + print(f"\n{line}") + print("汇总") + print(line) + passed = sum(1 for r in results if r["valid"]) + avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0 + print(f"验证通过: {passed}/{len(results)}") + print(f"平均覆盖率: {avg_coverage:.1f}%") + if passed < len(results): + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/research-what-we-did/Deep-Research-skills/tests/test_install_codex.sh b/research-what-we-did/Deep-Research-skills/tests/test_install_codex.sh new file mode 100644 index 0000000..c2d3690 --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/tests/test_install_codex.sh @@ -0,0 +1,61 @@ +#!/usr/bin/env bash + +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +TMP_HOME="$(mktemp -d)" +trap 'rm -rf "$TMP_HOME"' EXIT + +assert_contains() { + local path="$1" + local expected="$2" + if ! rg -F "$expected" "$path" >/dev/null 2>&1; then + echo "expected '$expected' in $path" >&2 + exit 1 + fi +} + +HOME="$TMP_HOME" bash "$ROOT_DIR/scripts/install-codex.sh" +HOME="$TMP_HOME" bash "$ROOT_DIR/scripts/install-codex.sh" + +if [[ ! -f "$TMP_HOME/.codex/config.toml" ]]; then + echo "expected config.toml to exist" >&2 + exit 1 +fi + +if [[ -d "$TMP_HOME/.codex/skills" ]]; then + echo "did not expect skills directory to be created" >&2 + exit 1 +fi + +if [[ -d "$TMP_HOME/.codex/agents" ]]; then + echo "did not expect agents directory to be created" >&2 + exit 1 +fi + +assert_contains "$TMP_HOME/.codex/config.toml" "multi_agent = true" +assert_contains "$TMP_HOME/.codex/config.toml" "default_mode_request_user_input = true" +assert_contains "$TMP_HOME/.codex/config.toml" "suppress_unstable_features_warning = true" +assert_contains "$TMP_HOME/.codex/config.toml" "[agents.web_researcher]" +assert_contains "$TMP_HOME/.codex/config.toml" 'config_file = "agents/web-researcher.toml"' + +if [[ "$(rg -c '^\[features\]$' "$TMP_HOME/.codex/config.toml")" != "1" ]]; then + echo "expected exactly one [features] section" >&2 + exit 1 +fi + +if [[ "$(rg -c '^\[agents\.web_researcher\]$' "$TMP_HOME/.codex/config.toml")" != "1" ]]; then + echo "expected exactly one [agents.web_researcher] section" >&2 + exit 1 +fi + +if awk ' + /^\[features\]$/ { in_features=1; next } + /^\[/ { in_features=0 } + in_features && /suppress_unstable_features_warning/ +' "$TMP_HOME/.codex/config.toml" | grep -q .; then + echo "did not expect suppress_unstable_features_warning inside [features]" >&2 + exit 1 +fi + +echo "install-codex test passed" diff --git a/research-what-we-did/Deep-Research-skills/tests/test_validate_json_schemas.py b/research-what-we-did/Deep-Research-skills/tests/test_validate_json_schemas.py new file mode 100644 index 0000000..0c01e3f --- /dev/null +++ b/research-what-we-did/Deep-Research-skills/tests/test_validate_json_schemas.py @@ -0,0 +1,95 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +"""Regression test for skills/*/research/validate_json.py. + +The validator accepts EXACTLY ONE schema — the one /research actually emits: + + fields: + : + - {name: ..., description: ..., detail_level: ...} + uncertain: [] + +Any other shape must be rejected (exit 1), never silently pass with zero fields. +With no explicit `required:` markers, every field is required so incomplete coverage +actually fails. With explicit markers, opt-in semantics are preserved. + +Run: python tests/test_validate_json_schemas.py (exit 0 = all pass) +""" +import importlib.util +import json +import subprocess +import sys +import tempfile +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[1] +COPIES = sorted(ROOT.glob("skills/*/research/validate_json.py")) + +tmp = Path(tempfile.mkdtemp()) +# The one accepted schema: fields:{:[{name, detail_level}]} with NO `required` markers. +(tmp / "good_schema.yaml").write_text( + "fields:\n" + " basic:\n" + " - {name: a, detail_level: detailed}\n" + " - {name: b, detail_level: brief}\n" + " - {name: c, detail_level: moderate}\n" + " - {name: d, detail_level: moderate}\n" + "uncertain: []\n", encoding="utf-8") +# Same shape but with explicit required markers -> opt-in semantics. +(tmp / "marked_schema.yaml").write_text( + "fields:\n" + " basic:\n" + " - {name: a, required: true}\n" + " - {name: b, required: true}\n" + " - {name: notes, required: false}\n", encoding="utf-8") +# A rejected shape: the old `field_categories:` form. +(tmp / "bad_schema.yaml").write_text( + "field_categories:\n" + " - category: basic\n" + " fields:\n" + " - {name: a}\n", encoding="utf-8") +(tmp / "good.json").write_text(json.dumps({"a": 1, "b": 1, "c": 1, "d": 1}), encoding="utf-8") +(tmp / "bad.json").write_text(json.dumps({"a": 1, "b": 1, "c": 1}), encoding="utf-8") # missing 'd' + + +def load(path, i): + spec = importlib.util.spec_from_file_location(f"vj{i}", path) + mod = importlib.util.module_from_spec(spec) + spec.loader.exec_module(mod) + return mod + + +fails = [] +def check(label, cond): + print(("PASS " if cond else "FAIL ") + label) + if not cond: + fails.append(label) + + +assert COPIES, "no validate_json.py copies found under skills/*/research/" +for i, path in enumerate(COPIES): + tag = path.relative_to(ROOT).parts[1] # e.g. research-en + m = load(path, i) + + # 1. The one accepted schema parses all 4 fields; all required (no markers). + a, r, _ = m.load_fields_yaml(tmp / "good_schema.yaml") + check(f"[{tag}] good_schema parses 4 fields (was 0 before fix)", a == {"a", "b", "c", "d"}) + check(f"[{tag}] all required when unmarked (no vacuous pass)", r == a) + + # 2. Explicit markers preserve opt-in semantics. + am, rm, _ = m.load_fields_yaml(tmp / "marked_schema.yaml") + check(f"[{tag}] marked_schema: 3 fields, 'notes' optional", am == {"a", "b", "notes"} and rm == {"a", "b"}) + + # 3. A complete JSON passes; a JSON missing a field actually fails. + good = m.validate_json(tmp / "good.json", a, r, _) + bad = m.validate_json(tmp / "bad.json", a, r, _) + check(f"[{tag}] good.json -> valid", good["valid"]) + check(f"[{tag}] bad.json -> INVALID (catches missing 'd')", (not bad["valid"]) and "d" in bad["missing_required"]) + + # 4. A rejected schema shape must make the CLI exit non-zero (run as subprocess). + proc = subprocess.run([sys.executable, str(path), "-f", str(tmp / "bad_schema.yaml"), "-d", str(tmp)], + capture_output=True, text=True) + check(f"[{tag}] bad_schema (field_categories) is REJECTED (exit != 0)", proc.returncode != 0) + +print("\nRESULT:", "ALL PASS" if not fails else f"{len(fails)} FAILED -> {fails}") +sys.exit(1 if fails else 0) diff --git a/research-what-we-did/Deep-Research-skills/workflow.png b/research-what-we-did/Deep-Research-skills/workflow.png new file mode 100644 index 0000000..19cebd3 Binary files /dev/null and b/research-what-we-did/Deep-Research-skills/workflow.png differ diff --git a/research-what-we-did/EXTERNAL-CATALOG.md b/research-what-we-did/EXTERNAL-CATALOG.md new file mode 100644 index 0000000..58e5356 --- /dev/null +++ b/research-what-we-did/EXTERNAL-CATALOG.md @@ -0,0 +1,39 @@ +# 🩸 EXTERNAL CATALOG — RE/Malware/CTF skills & MCP (deep research 14.10.2026) + +## ✅ ВЕНДОРЕНО в `vendor-new/` (лицензии совместимы, секрет-свип 0 хитов) + +| Репо | ⭐ | Лицензия | SKILL.md | Что даёт | +|---|---|---|---|---| +| mukul975/Anthropic-Cybersecurity-Skills | 34420 | Apache-2.0 | ~820 | MITRE-mapped кибер-скиллы: malware, exploit-dev, IR, cloud, mobile | +| dslsdzc/rev-skills | 155 | Apache-2.0 | 143 | **закрывает пробелы**: firmware/embedded/protocol RE, unpacking, deobfuscation, managed code | +| meltedinhex/analyst-ai-pack | 22 | Apache-2.0 | 119 | malware analysis + threat hunting templates, mobile malware | +| rehan-remade/universal-modder | 7495 | MIT | 36 | game-RE/modding (examples/media срезаны, оставлены skills+knowledge+docs) | +| SimoneAvogadro/android-reverse-engineering-skill | 8137 | Apache-2.0 | 10 | Android RE end-to-end (jadx/apktool/frida/objection) | +| CreditTone/android-reverse-engineering-skill | 22 | Apache-2.0 | 7 | Codex-вариант Android RE (независимая реализация) | +| newliver666/apk-reverse | 4271 | MIT | 7 | APK reverse (dexlib, smali) | +| lwjjike/xbsReverseSkill | 162 | MIT | 33 | JS-реверс: xhs/bili/douyin/ctrip/qcc signature algorithms (CN-паки) | +| microsoft/win-dev-skills | 52 | MIT | 31 | официальный WinDbg/Windows debugging | +| gl0bal01/malware-analysis-claude-skills | 13 | MIT | 5 | malware analysis (CobaltStrike/Sliver implants) | +| cloudflare/security-audit-skill | 108 | MIT | 10 | security audit | +| FuzzingLabs/mcp-security-hub | 808 | MIT | — | 38 MCP-серверов/300+ тулов (Docker) | +| aoyunyang/spider-king-skill | 10 | MIT | 1 | spider/anti-bot | +| Fausto-404/js-reverse-automation--skill | 3 | — | 1 | JS reverse automation | + +Итого вендорено: **+1143 SKILL.md**, ~82MB суммарно в репе. + +## 🔗 ТОЛЬКО ССЫЛКИ (лицензия NOASSERTION/нет — не вендорим) + +- morluto/rea — 221K⭐ Reverse Engineer Anything MCP (у нас есть курс: `our-skills/rea-full-course/`; ⭐-метрика подозрительна — проверить) +- nashsu/autocli-skill — CLI-реверс +- zhaoxuya520/reverse-skill — 37.9K⭐ upstream нашей базы (MIT, уже вендорен как reverse-skill-repo/) +- w0lf13/ghidra-mcp — Ghidra MCP (upstream ida_pro_mcp аналога) +- cyberkaida/ghidra-mcp-bridge — альтернативный Ghidra мост +- binarybabies/binary-analysis — бинарный анализ скилл +- fuzzsecurity/mcp-fuzzer — MCP фаззер +- securityfortech/claude-mcp-security — MCP security skills + +## Пробелы без MCP (из crowdere/Awesome-RE-MCP) +UPX/DIE unpacking, Cuckoo/CAPE sandbox, AFL++ harness, binwalk — MCP-серверов нет, только CLI. + +--- +👻 [ииШко](https://t.me/AlStack) diff --git a/research-what-we-did/RESEARCH-SUMMARY.md b/research-what-we-did/RESEARCH-SUMMARY.md new file mode 100644 index 0000000..75a8da8 --- /dev/null +++ b/research-what-we-did/RESEARCH-SUMMARY.md @@ -0,0 +1,83 @@ +# ЧТО МЫ РЕСЁРЧИЛИ — реверс-инжиниринг (полный свод, 2026-09-26 → 28) + +Восстановлено из памяти (Mnemopi) + файлов. Всё что мы делали по реверсу за эти дни. + +--- + +## Хронология ресёрча + +### 2026-09-26 (вечер) — Босс попросил переделать пост [REDACTED] +1. **Deep research «РЕВЕРС-ИНЖИНИРИНГ: ПОЛНЫЙ СТЕК 2026»** — софт + AI-агенты + курсы + разбор кейса взлома IDA Pro 9.3. Источники сверены, ссылки живые. +2. **Спарсили GitHub через API**: 5 поисковых запросов + каталог awesome-ai-reverse целиком + точечные проверки — ~60 позиций с живыми звёздами. Главные находки, которых не было у [REDACTED]: reverse-skill 37.9к★, Anthropic-Cybersecurity-Skills 33.4к★ (817 скиллов), SkillSpector (NVIDIA) 18.4к★, GhidraMCP 10.2к★, Trail of Bits skills 7.2к★, ctf-skills 3.3к★, официальный radare2-mcp, x64dbg-mcp, Cheat Engine MCP, REMnux MCP, auto-re-agent, reverify. +3. **Гайд вырос 3 → 4 сообщения** (лимит TG 4096). + +### 2026-09-26 (ночь) — Прожарка: аудит + спор с тремя критиками +Прогнали 3 волны критиков (FactsCritic / StyleCritic / TechCritic), каждый вердикт перепроверен, спор тезис→контраргумент→вердикт. 78 репо через GitHub API + 20 внешних ссылок + ~30 чисел из README. Итог: **VERIFIED WITH CAVEATS**, v4 → v4.1. + +#### Факт-фиксы (цифры [REDACTED] врут) + +| Где | Было у [REDACTED] | Стало (сверено) | +|---|---|---| +| binary-ninja-headless-mcp | 180 тулов | **181 тул** | +| firefox-reverse | 855 звёзд | **857** | +| shannon | 47к звёзд | **48к** | +| Anthropic-Cybersecurity-Skills | 29 доменов | **34** | +| open-reverselab | «194 статьи» | **180+** | +| PMAT | PMAT-course (404) | **PMAT-labs** (1160★, жив) | +| Книга Нарвахи | «Реверсинг с IDA Pro от 0» | **«Введение в реверсинг с нуля, используя IDA PRO»** (перевода не хватает части 66.2) | + +#### Смысловые вранья +- **Qiling «без запуска»** → «без запуска на живой системе» (Qiling код исполняет — в эмуляторе) +- **OGhidra** «сэмплы не уходят в облако» → поддерживает и облачные API; приватность только в локальном режиме +- **de4py** — CC BY-NC (некоммерческая), **disrobe** — платно для компаний. Интро «всё бесплатное» — ложь +- **Промпт-инъекция** «малварь учится разговаривать» → «встраивает команды в строки» (arXiv:2605.30667) +- «~20 новых 0-day» — тавтология + +#### Спор с критиками (выжившие вердикты) +1. TechCritic [BLOCKER]: «утёк keygen с приватным ключом — не подтверждается» → **принят**, секция про лицензию IDA переписана: утечка беты 9.2 + генераторы под пропатченные бинари; keygen с приватным ключом публично не подтверждён. Рецепт не включён +2. StyleCritic: «Ты направляешь и валидируешь» — разговорщина → «Роль человека — направлять и валидировать» +3. FactsCritic [BLOCKER]: PMAT-course 404 → замена на PMAT-labs +4. FactsCritic: shannon 47к→48к, firefox-reverse 855→857 (точные числа из API — дисциплина канала) +5. TechCritic: «Всё бесплатное» → пометки лицензий + «лицензионные исключения помечены» +6. TechCritic: OGhidra → «LLM через Ollama или облачные API; в локальном режиме сэмплы не уходят в облако» + +**Отклонено:** «виртуалка» (стандартный термин RU-реверс-среды), «↔» (типографика, не эмодзи). + +**Чистым прошло:** ida-pro-mcp 12,351★, GhidraMCP 10,187★, SkillSpector 18,361★, reverse-skill 37,917★, FIRERPA 8,473★, Big Sleep ~20 0-day за 2025, CrackMeBench, ida-mcp MIT/IDA 9.4+, binwalk Rust, bethington 253 тула, Arkana 308. + +#### Верификация финального v4 +- 4 сообщения: 3861 / 3682 / 3882 / 1939 симв. (лимит 4096, запас от 214) +- **102/102 ссылки живые** (beginners.re 403 ботам — сайтом жив, проверено через Tavily) + +### 2026-09-26/27 — свои скиллы +- **`re-roast-2026`** (managed-skills, авто-загрузка) — воркфлоу прожарки: триаж ссылок → цифры → названия → лицензии → гиперболы → точность → атрибуция → разбивка 4096 → раздел про лицензию IDA. + `scripts/linkcheck.py` — многопоточный свип живости (24 воркера, HEAD→GET, 403/405=BOTWALL). Smoke-тест: 200 ✓, 404 ✓, 403 BOTWALL ✓ +- **`reverse-skill`** (ApiOid, security-skills) — роутер 47 модулей + CTF-оркестратор (42) + `omp-pe-triage.py` (PE-триаж pefile+capstone, чистый Python) +- Память: 6 фактов записано в Mnemopi + +### 2026-09-26..28 — реальные кейсы реверса +- **TelegramExpert.exe** — EV-signed (Sectigo, «Slims Software») WiX/burn SFX-bootstrapper, 43 МБ, 6 секций без паковки, SFX×16/WiX×7, admin-проба через OpenProcessToken +- **WaveADS**, **hahacc CTF** — триаж-отчёты +- **DarkTelegram** — реверс + отчёт 466 строк +- **DeskGram**, **loliland** — реверс-проекты +- **Форумные свипы** по реверсу (forum-reversing_2026-09-19..28) + +--- + +## Ключевые выводы ресёрча (суть) + +1. **Пайплайн разбора сэмпла**: триаж (DIE+FLOSS+capa) → распаковка (x64dbg/Scylla, de4dot/dnSpyEx, Qiling) → статика (Ghidra/IDA) → динамика (Frida) → деобфускация (D-810/Unicorn/angr) → поведение (FakeNet-NG/CAPEv2/Speakeasy) → диффинг (BinDiff/Diaphora) → выход (YARA/IOC) +2. **Реверс через ИИ**: агент подключается к дизассемблеру через MCP и сам декомпилирует/ходит по xrefs/переименовывает/ставит бряки. Роль человека — направлять и валидировать +3. **Лицензия IDA**: .hexlic = офлайн JSON+подпись, ключ зашит в бинарь; keygen с приватным ключом публично не подтверждён; пропатченные сборки = вектор малвари; легально — IDA Free, Ghidra, академлицензия через вуз +4. **Ограничения ИИ-реверса**: агент уверенно ошибается в именах функций (крипто/C2/авторизация — руками); упакованный сэмпл = слабый псевдод; строки в бинарнике = промпт-инъекция против RE-агента +5. **Big Sleep** (Project Zero + DeepMind) — 0-day в SQLite до релиза, который фаззинг не поймал за 150 CPU-часов + +## Файлы этого ресёрча + +| Файл | Что | +|---|---| +| `rev_guide/p1..p4.md` | Гайд, 4 сообщения (до прожарки) | +| `rev-guide-v4.md` | **Финал v4.1 после прожарки** (26 правок, 102/102 ссылки) | +| `rev-guide-v4-subpost.md` | Под-пост-компаньон (1363 симв.) | +| `00-source-iishko-original.md` | Исходный пост [REDACTED] (для диффа) | +| `darktelegram_reverse_report.md` | Кейс DarkTelegram | +| `gh-reverse-catalog.json` | Каталог GitHub reverse-ресурсов | diff --git a/research-what-we-did/darktelegram_reverse.py b/research-what-we-did/darktelegram_reverse.py new file mode 100644 index 0000000..d4508f1 --- /dev/null +++ b/research-what-we-did/darktelegram_reverse.py @@ -0,0 +1,661 @@ +""" +DarkTelegram.pro — полный реверс +SaaS-облачный комбайн для автоматизации Telegram. +Python/FastAPI backend, React SPA фронт, Cloudflare Turnstile, облачное 24/7 исполнение. + +Auth: email+password, Google OAuth, Telegram OAuth +Тарифы: Start $49/20 акк, Pro $70/100 акк, Ultra $130/1000 акк +Модули à la carte: $15-50/мес +""" + +from dataclasses import dataclass, field +from typing import Optional +from enum import StrEnum + +# === API ENDPOINTS (извлечены из App-DL7CzC9q.js, 663KB) === + +API_BASE = "https://darktelegram.pro/api" + +ENDPOINTS = { + # Auth + "login": "POST /api/auth/login", + "register": "POST /api/auth/register", + "register_verify": "POST /api/auth/register/verify", + "register_resend": "POST /api/auth/register/resend", + "refresh": "POST /api/auth/refresh", + "forgot_password": "POST /api/auth/forgot-password", + "reset_password": "POST /api/auth/reset-password", + "google_oauth": "GET /api/auth/google", + "telegram_oauth_init": "POST /api/auth/telegram/init", + "auth_config": "GET /api/auth/config", + "me": "GET /api/auth/me", + + # Аккаунты + "accounts_add": "POST /api/accounts/add", + "accounts_add_tdata": "POST /api/accounts/add-tdata", + "accounts_summary": "GET /api/accounts/summary", + "accounts_trust": "GET /api/accounts/trust", + "accounts_batch_task": "POST /api/accounts/batch-task", + "accounts_batch_purpose": "POST /api/accounts/batch-purpose", + "accounts_batch_move": "POST /api/accounts/batch-move-folder", + "accounts_bulk_edit": "POST /api/accounts/bulk-edit", + "accounts_bulk_delete": "POST /api/accounts/bulk-delete", + "accounts_bulk_assign_proxy":"POST /api/accounts/bulk-assign-proxy", + "accounts_bulk_force_reset":"POST /api/accounts/bulk-force-reset", + "accounts_confirm": "POST /api/accounts/confirm/:id", + "accounts_counts": "GET /api/accounts/counts/sparkline", + # phone-auth flow + "phone_send_code": "POST /api/accounts/phone-auth/send-code", + "phone_resend_code": "POST /api/accounts/phone-auth/resend-code", + "phone_sign_in": "POST /api/accounts/phone-auth/sign-in", + "phone_submit_captcha": "POST /api/accounts/phone-auth/submit-captcha", + + # Прокси + "proxies": "GET /api/proxies", + "proxies_by_country": "GET /api/proxies/by-country", + "proxies_batch_check": "POST /api/proxies/batch-check", + "proxies_batch_folder": "POST /api/proxies/batch-folder", + "proxy_folders": "GET /api/proxy-folders", + "proxy_health": "GET /api/proxy-health", + + # Магазин прокси + "proxy_shop_buy": "POST /api/proxy-shop/buy", + "proxy_shop_prolong": "POST /api/proxy-shop/prolong-local", + "proxy_shop_prolong_price": "GET /api/proxy-shop/prolong-price", + "proxy_shop_price": "GET /api/proxy-shop/price", + "proxy_shop_balance": "GET /api/proxy-shop/balance", + "proxy_shop_countries": "GET /api/proxy-shop/countries", + "proxy_shop_count": "GET /api/proxy-shop/count", + "proxy_shop_disclaimer": "GET /api/proxy-shop/disclaimer", + + # Подписка / биллинг + "subscribe_active": "GET /api/subscribe/active", + "subscribe_start": "POST /api/subscribe/start", + "subscribe_status": "GET /api/subscribe/status/:id", + "subscribe_cancel": "POST /api/subscribe/cancel/:id", + + # AI / Задачи + "ai_submit": "POST /api/ai/:task_type", + "auto_warmup": "POST /api/auto-warmup/:id", + "task_history": "GET /api/task-history/accounts/:id", + + # AI пресеты + "ai_presets_prompts": "GET /api/ai-presets/prompts", + "ai_presets_photos": "GET /api/ai-presets/photos", + + # Каналы + "channel_create_copy": "POST /api/channel-create/copy-post", + "channel_create_acc": "GET /api/channel-create/account/:id", + "channel_templates": "GET /api/channel-create/templates", + "channel_views_check": "POST /api/channel-views/check-unchecked", + + # Истории + "story_repost_preview": "GET /api/story-repost/preview", + "story_repost_viewers": "GET /api/story-repost/viewers", + + # Профили / посты + "profile_presets_list": "GET /api/profile-presets/list", + "profile_presets_random":"GET /api/profile-presets/random", + "profile_templates": "GET /api/profile-templates", + "profile_templates_bios":"GET /api/profile-templates/bios", + "profile_templates_names":"GET /api/profile-templates/names", + "profile_photos_upload": "POST /api/profile-templates/photos/upload", + "profile_photos_b64": "GET /api/profile-templates/photos/b64", + "post_templates": "GET /api/post-templates", + + # Сессионный дубликатор + "session_duplicate": "POST /api/session-duplicator/:id", + "session_download": "GET /api/session-duplicator/download/:id", + "session_sessions": "GET /api/session-duplicator/sessions/:id", + "session_switch": "POST /api/session-duplicator/switch/:id", + + # Остальное + "workspaces": "GET /api/workspaces", + "workspaces_active": "POST /api/workspaces/active", + "workspaces_move": "POST /api/workspaces/move", + "account_folders": "GET /api/account-folders", + "all_status": "GET /api/all-status", + "currency_rate": "GET /api/currency/rate", + "links_channels": "GET /api/links/channels", + "notifications": "GET /api/notifications", + "notifications_read": "POST /api/notifications/read-all", + "emoji_file": "GET /api/emoji/file/:id", + "team_context": "GET /api/team/context", +} + + +# === ТАРИФЫ === + +class Tariff(StrEnum): + START = "start" # $49/мес, 20 акков + PRO = "pro" # $70/мес, 100 акков + ULTRA = "ultra" # $130/мес, 1000 акков + +TARIFFS = { + "start": {"price": 49, "accounts": 20, "ai_tokens": 0}, + "pro": {"price": 70, "accounts": 100, "ai_tokens": 75}, # +$7.5 + "ultra": {"price": 130, "accounts": 1000, "ai_tokens": 200}, # +$20 +} + +MODULES = { + "neuro_commenting": {"price": 30, "tariff": None}, + "parser": {"price": 20, "tariff": None}, + "neuro_dialogs": {"price": 30, "tariff": "pro"}, + "ai_salesman": {"price": 50, "tariff": "pro"}, + "mass_reactions": {"price": 18, "tariff": None}, + "mass_looking": {"price": 23, "tariff": None}, + "grabber": {"price": 25, "tariff": None}, + "story_mentions": {"price": 40, "tariff": "ultra"}, + "inviter": {"price": 25, "tariff": "pro"}, + "ai_broadcast_chats": {"price": 20, "tariff": "start"}, + "ai_broadcast_dm": {"price": 20, "tariff": "pro"}, + "ai_autoresponder": {"price": 30, "tariff": "pro"}, + "telegram_web": {"price": 20, "tariff": "start"}, + "own_api_keys": {"price": 15, "tariff": None}, +} + + +# === ФУНКЦИИ (реконструированы из JS-бандлов и лендинга) === + +@dataclass +class Account: + """Модель аккаунта в системе""" + id: int + phone: str = "" + username: str = "" + status: str = "active" # active | spamblock | banned | frozen + trust_score: int = 0 + proxy_id: Optional[int] = None + folder_id: Optional[int] = None + purpose: str = "" # mailing | commenting | warming | etc + last_warmup: Optional[str] = None + session_file: Optional[str] = None # .session path + tdata_path: Optional[str] = None # tdata path + + +@dataclass +class ProxyConfig: + """Прокси для аккаунта""" + id: int + type: str = "socks5" # socks5 | http + host: str = "" + port: int = 1080 + username: str = "" + password: str = "" + country: str = "" + ip_version: str = "ipv4" + + +# --- Аккаунты --- + +def account_add_session(session_file: str, proxy_id: Optional[int] = None) -> Account: + """Добавить аккаунт из .session файла""" + # POST /api/accounts/add multipart: file=session_file, proxy_id=proxy_id + ... + +def account_add_tdata(tdata_zip: str) -> Account: + """Добавить аккаунт из tdata.zip""" + # POST /api/accounts/add-tdata multipart: file=tdata_zip + ... + +def account_phone_auth(phone: str, proxy_id: Optional[int] = None) -> dict: + """ + Авторизация по номеру телефона (3-шаговый flow): + 1. POST /api/accounts/phone-auth/send-code {phone, proxy_id} → phone_code_hash + 2. POST /api/accounts/phone-auth/sign-in {phone, phone_code_hash, code} + 3. Если капча: POST /api/accounts/phone-auth/submit-captcha {password} + """ + ... + +def account_confirm(account_id: int) -> bool: + """Подтвердить аккаунт (после добавления)""" + # POST /api/accounts/confirm/:id + ... + +def account_bulk_edit(account_ids: list[int], fields: dict) -> bool: + """Массовое редактирование полей аккаунтов""" + # POST /api/accounts/bulk-edit {ids, ...fields} + ... + +def account_bulk_assign_proxy(account_ids: list[int], proxy_id: int) -> bool: + """Привязать прокси к группе аккаунтов""" + # POST /api/accounts/bulk-assign-proxy + ... + +def account_batch_purpose(account_ids: list[int], purpose: str) -> bool: + """Назначить purpose аккаунтам (mailing/commenting/etc)""" + # POST /api/accounts/batch-purpose + ... + +def account_get_trust(account_id: int) -> dict: + """Trust Score аккаунта (0-100)""" + # GET /api/accounts/trust + ... + +def account_get_summary() -> dict: + """Сводка по аккаунтам: общее кол-во, по статусам""" + # GET /api/accounts/summary + ... + +def account_get_counts_sparkline() -> list: + """График изменения количества аккаунтов""" + # GET /api/accounts/counts/sparkline + ... + + +# --- Прокси --- + +def proxy_list() -> list[ProxyConfig]: + """Список своих прокси""" + # GET /api/proxies + ... + +def proxy_add(host: str, port: int, type_: str = "socks5", + username: str = "", password: str = "") -> ProxyConfig: + """Добавить прокси""" + # POST /api/proxies + ... + +def proxy_batch_check(proxy_ids: list[int]) -> dict: + """Массовая проверка прокси""" + # POST /api/proxies/batch-check + ... + +def proxy_health() -> dict: + """Статус прокси-пула""" + # GET /api/proxy-health + ... + +def proxy_shop_buy(country: str, count: int, period_days: int = 30) -> list[ProxyConfig]: + """Купить прокси из встроенного магазина""" + # POST /api/proxy-shop/buy + ... + +def proxy_shop_countries() -> list[str]: + """Доступные страны для покупки прокси""" + # GET /api/proxy-shop/countries + ... + + +# --- AI Tasks (единый механизм для всех модулей) --- + +@dataclass +class AITask: + """AI задача: рассылка, комментинг, диалог, продажник, автоответ""" + task_type: str # broadcast_chats | broadcast_dm | neuro_commenting | + # neuro_dialogs | ai_salesman | ai_autoresponder + accounts: list[int] # ID аккаунтов + targets: list[str] # @username / ссылки на чаты / номера + ai_preset_id: Optional[int] = None + custom_prompt: str = "" + delay_min: int = 30 + delay_max: int = 120 + daily_limit: int = 50 + # для диалогов + max_messages: int = 5 + # для продажника + qualification_criteria: dict = field(default_factory=dict) + notify_telegram: bool = True + + +def ai_submit_task(task: AITask) -> str: + """Отправить AI задачу. Возвращает task_id""" + # POST /api/ai/:task_type body: {...} + ... + +def ai_get_task_status(task_id: str) -> dict: + """Статус AI задачи""" + # GET /api/task-history/accounts/:task_id + ... + +def ai_get_presets(preset_type: str = "prompt") -> list[dict]: + """Получить AI пресеты (промпты или фото)""" + # GET /api/ai-presets/prompts | /api/ai-presets/photos + ... + + +# --- Автопрогрев --- + +def auto_warmup_start(account_id: int, config: dict) -> bool: + """ + Запустить автопрогрев аккаунта: + - подписки на каналы + - чтение постов + - реакции + - просмотр историй + - поведенческие паттерны + """ + # POST /api/auto-warmup/:id + ... + +def auto_warmup_status(account_id: int) -> dict: + """Статус прогрева: прогресс, trust_score, дата последнего""" + # GET /api/auto-warmup/:id + ... + + +# --- Парсинг --- + +@dataclass +class ParseTask: + source_type: str # channel | chat | audience | tgstat + source: str # @username или ссылка + parse_type: str = "members" # members | active | admins + filters: dict = field(default_factory=dict) # country, premium, etc + output_format: str = "csv" + + +def parse_start(task: ParseTask) -> str: + """Запустить парсинг. Возвращает task_id""" + # POST /api/ai/parse body: {...} + ... + +def parse_report(task_id: str) -> list[dict]: + """Результаты парсинга""" + # GET /api/task-history/accounts/:task_id + ... + + +# --- Нейрокомментинг --- + +def neuro_commenting_start(accounts: list[int], channels: list[str], + ai_preset_id: int, delay: tuple[int, int] = (30, 120)) -> str: + """ + ИИ-комментирование: + - Анализирует пост в канале + - Генерирует релевантный комментарий от лица аккаунта + - Постит с задержкой + """ + # POST /api/ai/neuro_commenting + ... + + +# --- Нейродиалоги --- + +def neuro_dialogs_start(accounts: list[int], targets: list[str], + ai_preset_id: int, scenario: str = "promote", + max_dialog_msgs: int = 5) -> str: + """ + ИИ находит чаты и рассказывает о продукте в подходящий момент. + Или: заходит в ЛС, ведёт диалог по сценарию. + """ + # POST /api/ai/neuro_dialogs + ... + + +# --- ИИ Продажник --- + +def ai_salesman_start(accounts: list[int], targets: list[str], + criteria: dict, notify_telegram_id: str = "") -> str: + """ + 3-фазный продажник: + 1. Пишет первым каждому из базы + 2. Квалифицирует: задаёт вопросы, сверяет с критериями + 3. При совпадении — уведомление в Telegram с контактом и историей + """ + # POST /api/ai/ai_salesman + ... + + +# --- ИИ Рассылка --- + +def ai_broadcast_chats(accounts: list[int], chats: list[str], + ai_preset_id: int, mode: str = "basic") -> str: + """ + Рассылка по чатам. + mode: basic | multi_phase | postbot + """ + # POST /api/ai/broadcast_chats + ... + +def ai_broadcast_dm(accounts: list[int], targets: list[str], + ai_preset_id: int) -> str: + """Рассылка в личные сообщения""" + # POST /api/ai/broadcast_dm + ... + + +# --- Автоответчик --- + +def ai_autoresponder_start(account_id: int, ai_preset_id: int, + scenario: str = "support") -> str: + """ИИ автоответчик на входящие сообщения""" + # POST /api/ai/ai_autoresponder + ... + + +# --- Накрутка --- + +def nakrutka_reactions(accounts: list[int], post_link: str, + reaction_type: str = "👍", count: int = 100) -> str: + """Массовые реакции на пост""" + # POST /api/ai/reactions (только Ultra) + ... + +def nakrutka_views(accounts: list[int], post_link: str, count: int = 1000) -> str: + """Накрутка просмотров на пост""" + # POST /api/ai/views (только Ultra) + ... + +def mass_looking(accounts: list[int], targets: list[str]) -> str: + """Массовый просмотр профилей (Mass Looking)""" + # POST /api/ai/mass_looking + ... + + +# --- Отметки в сторис --- + +def story_mentions(accounts: list[int], story_media: str, + targets: list[str]) -> str: + """ + Отметки пользователей в сторис. + Упомянутый получает уведомление → смотрит историю → переходит в канал. + """ + # POST /api/ai/story_mentions (только Ultra) + ... + +def story_repost_preview(story_link: str) -> dict: + """Предпросмотр истории перед репостом""" + # GET /api/story-repost/preview + ... + +def story_repost_viewers(story_link: str) -> list[str]: + """Список зрителей истории""" + # GET /api/story-repost/viewers + ... + + +# --- Инвайтер --- + +def inviter_start(accounts: list[int], invite_link: str, count: int = 100) -> str: + """Массовое приглашение в канал/чат""" + # POST /api/ai/inviter + ... + + +# --- Каналы --- + +def channel_create_copy_post(source_channel: str, target_channel: str, + accounts: list[int]) -> str: + """Копирование постов между каналами""" + # POST /api/channel-create/copy-post + ... + +def channel_get_templates() -> list[dict]: + """Шаблоны для каналов""" + # GET /api/channel-create/templates + ... + + +# --- Граббер --- + +def grabber_start(source_channels: list[str], accounts: list[int]) -> str: + """Сбор контента из каналов (текст, медиа, ссылки)""" + # POST /api/ai/grabber + ... + + +# --- Сессионный дубликатор --- + +def session_duplicate(account_id: int) -> str: + """Клонировать сессию аккаунта (для параллельного использования)""" + # POST /api/session-duplicator/:id + ... + +def session_download(account_id: int) -> bytes: + """Скачать .session файл""" + # GET /api/session-duplicator/download/:id + ... + +def session_switch(account_id: int, new_session_id: int) -> bool: + """Переключить аккаунт на другую сессию""" + # POST /api/session-duplicator/switch/:id + ... + + +# --- Профили --- + +def profile_presets_list() -> list[dict]: + """Список пресетов профилей (имя + био + фото)""" + # GET /api/profile-presets/list + ... + +def profile_random() -> dict: + """Случайный пресет профиля""" + # GET /api/profile-presets/random + ... + +def profile_templates() -> list[dict]: + """Шаблоны профилей""" + # GET /api/profile-templates + ... + +def profile_upload_photo(photo_file: str) -> str: + """Загрузить фото для профиля""" + # POST /api/profile-templates/photos/upload + ... + + +# --- Воркспейсы / Команда --- + +def workspace_list() -> list[dict]: + """Список воркспейсов""" + # GET /api/workspaces + ... + +def workspace_set_active(workspace_id: int) -> bool: + """Сменить активный воркспейс""" + # POST /api/workspaces/active + ... + +def team_context() -> dict: + """Контекст команды (права, роли)""" + # GET /api/team/context + ... + + +# --- Биллинг --- + +def subscribe_start(tariff: str, payment_method: str = "crypto") -> dict: + """Оформить подписку. payment_method: crypto | card | sbp""" + # POST /api/subscribe/start + ... + +def subscribe_status() -> dict: + """Статус подписки: active/inactive, тариф, дата окончания""" + # GET /api/subscribe/active + ... + +def currency_rate() -> dict: + """Курс валют для крипто-оплаты""" + # GET /api/currency/rate + ... + + +# === АНТИ-ДЕТЕКТ И ЗАЩИТА === + +ANTI_DETECT_LAYERS = { + "captcha_solver": "85% капч авто-решаются (боты проверки Telegram)", + "trust_score": "Рейтинг надёжности каждого аккаунта (0-100)", + "auto_limits": "Безопасные лимиты по умолчанию для всех действий", + "intervals": "Паузы между действиями с рандомизацией", + "proxy_per_account": "Отдельный резидентский прокси на каждый аккаунт", + "warmup_before_use": "Обязательный прогрев перед рассылкой/комментингом", + "spamblock_check": "Авто-проверка @SpamBot при подозрении на спамблок", + "session_isolation": "Изолированные сессии через встроенный Telegram Web", + "cloud_execution": "24/7 облачное исполнение, IP ротация на стороне сервера", +} + + +# === СРАВНЕНИЕ С DESKGRAM === + +COMPARISON = { + "architecture": { + "darktelegram": "SaaS Cloud (FastAPI + React SPA). Нет десктоп-клиента. 24/7 сервера.", + "deskgram": "Desktop (PE32+ C++ dropper → Python/Telethon workers). Локальный сервер 127.0.0.1:5000.", + }, + "auth": { + "darktelegram": "email+password, Google OAuth, Telegram OAuth, Cloudflare Turnstile", + "deskgram": "activation_key (Prodamus), JWT refresh", + }, + "accounts": { + "darktelegram": ".session + tdata import, встроенный LZT Market, phone auth flow", + "deskgram": ".session import, ручная авторизация через код", + }, + "modules": { + "darktelegram": "~15 модулей (AI-центричные)", + "deskgram": "82 модуля (всё что можно автоматизировать)", + }, + "ai": { + "darktelegram": "Своя AI-инфраструктура (OpenRouter?), пресеты промптов и фото", + "deskgram": "io.net, OpenRouter (14 моделей), Mistral API", + }, + "unique": { + "darktelegram": "ИИ Продажник (3-фазный), Session Duplicator, Story Mentions, Telegram Web в дашборде", + "deskgram": "Инвайт по гео, Remove SpamBlock, 12 категорий модулей", + }, + "pricing": { + "darktelegram": "$49-130/мес + модули à la carte + AI токены", + "deskgram": "16,990₽/год (~$15/мес) единый тариф", + }, +} + + +# === УЯЗВИМОСТИ И ВЕКТОРЫ === + +VULNERABILITIES = { + "turnstile_bypass": { + "target": "/api/auth/register", + "vector": "Отсутствует серверная валидация Turnstile? Нужно проверить через реплей запроса без токена", + "status": "НЕ ПРОВЕРЕНО — нужен реплей без cf-turnstile-response", + }, + "rate_limiting": { + "target": "/api/auth/login", + "vector": "Нет видимого rate-limit в ответах. 429 не тестировался", + "status": "НЕ ПРОВЕРЕНО", + }, + "id_enumeration": { + "target": "/api/accounts/summary, /api/accounts/trust", + "vector": "ID аккаунтов последовательные? Можно перебирать чужие аккаунты", + "status": "НЕ ПРОВЕРЕНО — нужна сессия", + }, + "ai_preset_injection": { + "target": "ai_presets", + "vector": "Можно ли инжектить промпт в AI задачу через кастомный preset?", + "status": "Требует анализа формата пресетов", + }, + "session_leak": { + "target": "/api/session-duplicator/download/:id", + "vector": "Можно ли скачать чужую сессию при IDOR?", + "status": "КРИТИЧЕСКИЙ ВЕКТОР — нужна авторизованная сессия для теста", + }, +} + + +if __name__ == "__main__": + print(f"DarkTelegram.pro reverse — {len(ENDPOINTS)} API endpoint'ов") + print(f"Модулей: {len(MODULES)}, Тарифов: {len(TARIFFS)}") + print(f"Векторов для проверки: {len(VULNERABILITIES)}") + print("\n=== УНИКАЛЬНЫЕ ФИЧИ ===") + for k, v in COMPARISON["unique"].items(): + print(f" {k}: {v}") \ No newline at end of file diff --git a/research-what-we-did/darktelegram_reverse_report.md b/research-what-we-did/darktelegram_reverse_report.md new file mode 100644 index 0000000..eb47f34 --- /dev/null +++ b/research-what-we-did/darktelegram_reverse_report.md @@ -0,0 +1,466 @@ +# DarkTelegram.pro — Reverse Engineering Report (Public Assets Only) + +**Status:** All claims are extracted from publicly served JS bundles (`darktelegram.pro` over plain HTTPS). +**No auth, no credentials, no mutating requests.** Every endpoint name below is from minified frontend code, not from live API calls. +**Date:** 2026-09-15 +**Rate limit:** ~20 GET requests total (landing page, main bundles, module chunks, CSS). No fuzzing, no crawling. + +--- + +## 1. Code-Split Chunk Filenames → Product Module Mapping + +Chunks are Vite code-split `.js` files served from `https://darktelegram.pro/assets/`. The main entry `index-CQKpAuC4.js` (663 KB) declares the full dependency graph via `__vite__mapDeps`. The dashboard shell is `App-DL7CzC9q.js`. + +### Landing / Public Route Pages + +| Chunk | Module / Page | +|---|---| +| `index-CQKpAuC4.js` | SPA entry, route definitions, core API helpers | +| `App-DL7CzC9q.js` | Dashboard shell, sidebar, account picker, folder UI, context providers, full dependency map of all 80+ dashboard tab chunks | +| `Landing-CXQemKrJ.js` | Landing page hero | +| `AuthPage-CiVnbMr6.js` | Login/Register forms, OAuth, Turnstile (auth-independent header/footer CSS) | +| `AuthPage-rwu218-r.js` | Auth page shared logic | +| `ResetPasswordPage-CUxx1NKP.js` | Password reset | +| `SeoLayout-DI8Ngi0U.js` | SEO layout wrapper | +| `SeoMeta-Df7W64jI.js` | Dynamic SEO meta injection | +| `pageMeta-C24qRuxo.js` | Per-page SEO metadata config | +| `PrivacyPage-BUTds85K.js` | Privacy policy | +| `TermsPage-CDKHvBhR.js` | Terms of service | + +### Product/Marketing Landing Pages (Feature Docs) + +| Chunk | Product Module | +|---|---| +| `TelegramManager--WBuvWjE.js` | Telegram Account Manager feature page | +| `AiBroadcast-CtQ819br.js` | AI Mailing feature page (3 modes) | +| `AiPromoter-OKyXD7VX.js` | AI Promoter / Нейродиалоги feature page | +| `BuyAccounts-BE-VUlUn.js` | Buy Telegram Accounts marketplace page | +| `Nakrutka-CmIdulPO.js` | SMM Panel / Накрутка (subscriptions, reactions, views) | +| `Arbitrage-D8HyljyM.js` | Traffic arbitrage page (dating/betting/crypto) | +| `AiAssistantsPage-BYjQpdtd.js` | AI Assistants page | +| `ParseReportPage-Tt5DVO47.js` | Parse report page | +| `BlogIndex-vXaavkcO.js` | Blog index | +| `BlogArticle-DkAe3e6J.js` | Blog article | +| `article-ChKm0xiJ.js` | Blog article (alternate) | +| `blog-refresh-CDwEFsgE.js` | Blog refresh component | +| `Converter-C77A1IiI.js` | tdata session converter | +| `TgStatParser-DtrLk5fl.js` | TgStat Chrome extension parser | +| `LztTrust-DT9wFtsT.js` | LZT Trust page | +| `JoinCabinetPage-ChqIw2TJ.js` | Join cabinet page | +| `kak-nachat-rabotu-v-darktelegram-D-RibygM.js` | How to start article | + +### Dashboard Tab Components (authenticated code-split chunks) + +Revealed from the sidebar route map in App-DL7CzC9q.js: + +| Route | Chunk (when applicable) | Module | +|---|---|---| +| `/accounts` | — (in main shell) | Account management | +| `/proxies` | — (in main shell) | Proxy management | +| `/market` | MarketTab | LZT Marketplace | +| `/warmup` | WarmupTab | Account warmup | +| `/broadcast` | BroadcastTab | AI Broadcast (8 modes) | +| `/chat-broadcast` | ChatBroadcastTab | Chat broadcast (AI DM broadcast) | +| `/autoreply` | AutoReplyTab | AI auto-reply | +| `/promoter` | PromoterTab | AI Promoter / AI sales agent | +| `/massreaction` | MassReactionTab | Mass reactions | +| `/nakrutka` | NakrutkaTab | Nakrutka (SMM panel) | +| `/masslooking` | MassLookingTab | Mass story viewing | +| `/story-mentions` | StoryMentionsTab | Story mentions | +| `/neurocommenting` | NeuroCommentingTab | Neuro-commenting | +| `/neuroshilling` | NeuroshillingTab | Neuro-shilling | +| `/inviter` | InviterTab | Inviter | +| `/salesman` | SalesmanTab | AI Sales Agent | +| `/copier` | CopierTab | Copier | +| `/audience` | AudienceTab | Channel management | +| `/groups` | GroupsTab | Group management | +| `/audience-parse` | AudienceParseTab | Audience parser | +| `/audience-users` | AudienceUsersTab | Audience user list | +| `/channel-db` | ChannelDbTab | Channel database | +| `/darkfather` | DarkFatherTab | DarkFather module | +| `/session-duplicator` | SessionDuplicatorTab | Session duplicator | +| `/telegram-folders` | TelegramFoldersTab | Telegram folders | +| `/links` | LinksTab | Links module | +| `/integrations` | IntegrationsTab | Integrations (MCP/API) | +| `/runpod` | RunPodTab | RunPod integration | +| `/products` | ProductsTab | Products | +| `/templates` | — | Templates | +| `/profile` | ProfileTab | User profile | +| `/wallet` | WalletTab | Wallet/balance | +| `/subscription` | SubscriptionTab | Subscription management | +| `/feature-logs` | FeatureLogsTab | Feature change logs | +| `/tasks` | TasksTab | Active tasks | +| `/referral` | ReferralTab | Referral program | +| `/support` | SupportTab | Support | + +--- + +## 2. Dashboard API Surface (Grouped by Module) + +All endpoints inferred from fetch() calls in the public JS bundles. Relative to /api/. Returns { detail: ... } on errors. + + +### Auth +| Method | Path | Notes | +|---|---|---| +| POST | /api/auth/login | email + password login | +| POST | /api/auth/register | registration | +| POST | /api/auth/oauth/* | OAuth callbacks | +| POST | /api/auth/reset-password | password reset | + +### Accounts +| Method | Path | Notes | +|---|---|---| +| GET | /api/accounts | list | +| POST | /api/accounts | import | +| GET | /api/accounts/:id/export | export .session | +| GET | /api/accounts/:id/export-tdata | export tdata | +| PATCH | /api/accounts/:id | update | +| DELETE | /api/accounts/:id | remove | +| GET | /api/account-folders | list folders | +| POST | /api/account-folders | create folder | +| PATCH | /api/account-folders/:id | rename folder | +| DELETE | /api/account-folders/:id | delete folder | + +### Proxies +| Method | Path | Notes | +|---|---|---| +| GET | /api/proxy-folders | list proxy folders | +| POST | /api/proxy-folders | create folder | +| PATCH | /api/proxy-folders/:id | rename folder | +| DELETE | /api/proxy-folders/:id | delete folder | + +### Broadcast (AI Mailing) +| Method | Path | Notes | +|---|---|---| +| GET | /api/broadcast/history?page=N | paginated history | +| GET | /api/broadcast/status | campaign status | +| POST | /api/broadcast/create | create campaign | +| POST | /api/broadcast/:id/start | start campaign | +| POST | /api/broadcast/:id/stop | stop campaign | +| POST | /api/broadcast/:id/retry | retry failed | +| GET | /api/broadcast/:id/stats | campaign stats (funnel) | +| GET | /api/broadcast/:id/recipients | per-recipient report | +| GET | /api/broadcast/stream/:id | SSE log stream | +| GET | /api/broadcast/audience-count | audience count query | +| GET | /api/broadcast/smart/active | active Smart broadcasts | +| POST | /api/broadcast/smart/:id/pause | pause smart broadcast | +| POST | /api/broadcast/smart/:id/stop | stop smart broadcast | +| POST | /api/broadcast/voice | upload voice file | +| DELETE | /api/broadcast/voice/:id | delete voice file | +| GET | /api/broadcast/voice/:id/file?token= | stream voice file | + +### Audience / Parser +| Method | Path | Notes | +|---|---|---| +| GET | /api/audience-folders | audience folder list | +| GET | /api/groups-channel-folders | groups/channel folders | +| POST | /api/audience-parse/start | start parse task | + +### AI Promoter / Нейродиалоги +| Method | Path | Notes | +|---|---|---| +| GET | /api/promoter/status | promoter status | +| GET | /api/promoter/sessions | list past sessions | +| POST | /api/promoter/start | start session | +| POST | /api/promoter/stop/:id | stop session | +| POST | /api/promoter/demo | demo: test message vs product | +| GET | /api/promoter/stream/:id | SSE log stream | +| GET | /api/promoter/monitor-targets | list monitorable chats | +| POST | /api/promoter/preview-scenarios | generate scenario preview | + +### Profile / User +| Method | Path | Notes | +|---|---|---| +| GET | /api/profile/limits | user limits | +| GET | /api/profile/promoter-settings | promoter prompt templates | +| PUT | /api/profile/promoter-settings | update promoter prompts | + +### Products +| Method | Path | Notes | +|---|---|---| +| GET | /api/products | list products with keywords | + +--- + +## 3. AiPromoter (AI Sales Agent) Flow — Detailed + +Based on PromoterTab-ClNavCxu.js (dashboard component) and AiPromoter-OKyXD7VX.js (marketing page). + +### Data Model + +**Product** (from GET /api/products): +``` +{ + id: number, + name: string, + keywords: string[], + description?: string, + link?: string +} +``` + +**Session Config** (POST /api/promoter/start): +``` +{ + product_id: number, + account_ids: number[], + target_chats: string[], + initial_history_count: number, + dm_followup?: { + enabled: boolean, + min_delay: number, // minutes + max_delay: number // minutes + }, + hyperlink_enabled: boolean, + mode: "polling" | "realtime", + reaction_delay_min?: number, // seconds + reaction_delay_max?: number, + autoreply_prompt_id?: number | null, + solve_captcha: boolean // BETA +} +``` + +### 3-Phase Flow (confirmed from bundle) + +**Phase 1 — First message to everyone:** +- AI writes to every contact in the base from the connected account +- Message is contextualized using product description + keywords + +**Phase 2 — Qualification (criteria matching):** +- When someone responds, AI evaluates relevance via relevance_prompt: + - Variables: {keywords}, {description}, {message} + - Output: keywords_matched[], keywords_missed[], matched: boolean +- If matched, generates public reply via comment_prompt: + - Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message} +- If DM follow-up enabled, generates DM via dm_prompt: + - Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description} + +**Phase 3 — Notification:** +- Sends Telegram notification via DarkTelegram bot to the user +- Includes: contact name, what they want, product interest, full dialog history +- Session log tracks: mentions (public), dm_replies (private), account_ids, product_name + +### Demo Endpoint +POST /api/promoter/demo +Request: { message: string, product_id: number } +Response: { matched, reply, dm_message, reasoning, keywords_matched[], keywords_missed[] } + +### Custom Prompts (saved via GET/PUT /api/profile/promoter-settings) +Three editable prompt templates: +- relevance_prompt: {keywords}, {description}, {message} +- comment_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message} +- dm_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description} + +--- + +## 4. TelegramManager and AiBroadcast Endpoint Shapes + +### AiBroadcast (from BroadcastTab-B9lQ9vJz.js) + +Eight broadcast modes: single | threephase | postbot | smart | sticker | ttl | contacts | voice + +POST /api/broadcast/create body: +``` +{ + name, account_ids[], broadcast_mode, + audience_folder_ids[], audience_min_messages, audience_has_username, + audience_search, audience_only_new, + messages_per_hour, schedule_hour_min, schedule_hour_max, + enable_ramp_up, enable_dialog_warmup, skip_read_contacted, send_greeting_sticker, + followup_enabled?, followup_delay_hours?, followup_text?, followup_entities?, + // mode-specific: + message_text?, message_entities?, ai_uniquify?, + warmup_duration_min?, warmup_duration_max?, + greeting_prompt?, link_mode?, link_url?, link_text?, link_prompt?, // threephase + reply_timeout_hours?, delay_after_reply_min?, delay_after_reply_max?, skip_autoreply?, + postbot_text?, // postbot + smart_mailing?, smart_daily_limit?, smart_min_interval_minutes?, // smart + contacts_include_dialogs?, contacts_quiet_mode?, // contacts + voice_id? // voice +} +``` + +Campaign stats (GET /api/broadcast/:id/stats): +``` +{ + funnel: { recipients, greetings_sent, replies, links_sent }, + stats: { sent, replied, link_sent, failed, peer_flood_count, + peer_flood_accounts, by_status: { [status]: count } } +} +``` + +### TelegramManager +The marketing page only (not a dashboard tab). Routes to /accounts. +Capabilities: built-in marketplace, auto-proxy, 1-click warmup (95% survival), AI tools, audience parsing, real-time monitoring, session/tdata import, parallel execution. + +--- + +## 5. Cloudflare Turnstile Wiring + +- Loaded via script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" in HTML head +- Widget rendered into div.auth-turnstile (centered, min-height: 65px) +- Token submitted alongside email/password in auth form POST body +- Turnstile is NOT on API endpoints — only on auth pages +- Gated: exact form field name (cf-turnstile-response by convention, not confirmed without auth form JS logic) + +--- + +## 6. Feature-Gap Table: DarkTelegram.pro vs T-Pilot + +Legend: ✅ Present | ⚠️ Partial | ❌ Missing + +### Core Infrastructure + +| Capability | DT | T-Pilot | +|---|---|---| +| Multi-account management | ✅ | ✅ | +| Proxy management + auto-rotation | ✅ built-in pool | ⚠️ user-provided only | +| Account import (.session / tdata) | ✅ both | ⚠️ converter exists | +| 24/7 cloud execution | ✅ | ⚠️ local-first | +| Embedded Telegram Web | ✅ ($20) | ❌ | +| API/MCP integrations | ✅ | ⚠️ partial | +| Auto-captcha solving (~85%) | ✅ | ❌ | + +### Account Management +| Capability | DT | T-Pilot | +|---|---|---| +| Marketplace (buy accounts) | ✅ | ❌ | +| Warmup | ✅ | ✅ | +| Trust Score | ✅ | ✅ | +| Session duplicator | ✅ | ✅ | +| Profile fill | ✅ | ✅ | +| Number checker | ✅ | ✅ | +| Chat creator | ✅ | ✅ | +| Dialog cleaner | ✅ | ✅ | +| Restrictions removal | ✅ | ✅ | +| AI Protection | ✅ | ✅ | +| Telegram folders sync | ✅ | ❌ | +| Cloner | ✅ | ✅ | + +### Broadcasting +| Capability | DT | T-Pilot | +|---|---|---| +| Single message broadcast | ✅ | ⚠️ basic exists | +| Multi-phase (threephase) | ✅ | ❌ | +| PostBot broadcast | ✅ | ❌ | +| Smart broadcast | ✅ | ❌ | +| Sticker broadcast | ✅ | ❌ | +| TTL broadcast | ✅ | ❌ | +| Voice broadcast | ✅ | ❌ | +| Contacts broadcast | ✅ | ❌ | +| AI uniqueization | ✅ | ⚠️ AIPostGenerator | +| Audience filters | ✅ | ❌ | +| Campaign stats/funnel | ✅ | ❌ | +| Per-recipient report | ✅ | ❌ | +| SSE live logs | ✅ | ❌ | + +### AI / Sales +| Capability | DT | T-Pilot | +|---|---|---| +| AI auto-reply | ✅ | ✅ | +| AI Promoter (Нейродиалоги) | ✅ ($50) | ❌ | +| AI Sales Agent (SalesmanTab) | ✅ | ❌ | +| Neuro-commenting | ✅ | ⚠️ basic | +| Neuro-shilling | ✅ | ❌ | +| AI Assistants | ✅ | ⚠️ partial | +| Lead qualification | ✅ | ❌ | +| Scenario preview | ✅ | ❌ | +| Products with keywords | ✅ | ❌ | +| ROI Predictor | ❌ | ✅ (TP differentiator) | +| Lead Catcher | ❌ | ✅ (TP differentiator) | + +### Audience / Parsing +| Capability | DT | T-Pilot | +|---|---|---| +| Channel parser | ✅ | ✅ | +| Group parsing | ✅ | ⚠️ forum_scraper.py | +| Audience users list | ✅ | ❌ | +| Channel database | ✅ | ❌ | +| TGStat parser | ✅ | ❌ | +| Audience filters | ✅ | ❌ | + +### Growth / Social +| Capability | DT | T-Pilot | +|---|---|---| +| Mass reactions | ✅ | ⚠️ basic | +| Mass story viewing | ✅ | ❌ | +| Story mentions | ✅ | ⚠️ StoryTags | +| Nakrutka (SMM panel) | ✅ | ❌ | +| Inviter | ✅ | ✅ | +| Mass subscribe/unsubscribe | ✅ | ✅ | +| Boost | ✅ | ✅ | +| Username checker | ✅ | ✅ | +| Text randomizer | ✅ | ✅ | + +### Business / Monetization +| Capability | DT | T-Pilot | +|---|---|---| +| Products (for AI Promoter) | ✅ | ❌ | +| Templates | ✅ | ❌ | +| Referral program | ✅ | ❌ | +| Subscription tiers + modules | ✅ | ❌ (open) | +| Wallet / balance | ✅ | ❌ | +| One-click setup | ✅ | ❌ | +| Support ticket system | ✅ | ❌ | +| Feature change logs | ✅ | ❌ | + +### T-Pilot Differentiators (not in DT) +| Capability | DT | T-Pilot | +|---|---|---| +| AI Post Generator | ❌ | ✅ | +| SEO Bot | ❌ | ✅ | +| Telegraph Poster | ❌ | ✅ | +| Email Sender | ❌ | ✅ | +| Traffic Generator | ❌ | ✅ | +| Forum Scraper | ❌ | ✅ | +| Blast Control | ❌ | ✅ | +| News Module | ❌ | ✅ | + +--- + +## 7. Prioritised Recommendations for T-Pilot + +Cheapest-highest-value first. + +### Tier 1: Low Effort, High Value (1-2 days each) +1. Broadcast audience filters — Folders, min_messages, has_username. Reuse existing parser. ~1 day. +2. Campaign history + basic stats — Persist completed campaigns. T-Pilot tracks task state. ~1 day. +3. AI message uniqueization — Wrap existing AI to rewrite per recipient. ~1 day. + +### Tier 2: Medium Effort, High Value (2-4 days) +4. AI Promoter (Нейродиалоги) — Closes DT largest gap. Reuse NeuroChat/NeuroComment. ~3 days. +5. Multi-phase (threephase) broadcast — State machine on broadcasting.py. ~2 days. +6. SMART broadcast — Rate limiter + daily cap. ~1 day. + +### Tier 3: Higher Effort, Strategic (3-5 days) +7. Built-in account marketplace — Largest DT conversion driver. ~5 days. +8. Per-recipient campaign report — Chain viewer. ~2 days. +9. Auto-captcha solving — ML/heuristic for Telegram. ~3 days. + +### Tier 4: Differentiators (4-7 days) +10. Nakrutka — Subscriptions + reactions + views with own farm. ~3 days. +11. Embedded Telegram Web — WebK/Telethon mini-client. ~5 days. +12. Traffic arbitrage funnel — Pre-configured vertical scenarios. ~4 days. + +### Top 6 by Value +| # | Feature | DT price | TP effort | Impact | +|---|---|---|---|---| +| 1 | Broadcast audience filters | bundled | 1 day | Direct conversion | +| 2 | Campaign stats/funnel | bundled | 1 day | User retention | +| 3 | AI uniqueization | bundled | 1 day | Spam safety | +| 4 | AI Promoter | $50/mo | 3 days | Closes biggest gap | +| 5 | Multi-phase broadcast | $20/mo | 2 days | 3-5x conversion | +| 6 | SMART broadcast | $20/mo | 1 day | Stealth dispatch | + +--- + +## Compliance Confirmation + +- No authentication attempt — all data from public HTTP(S) fetches of .js bundles +- No mutating requests — GET only +- No credentials or session tokens used or transmitted +- No customer data scraped or enumerated +- Rate limit observed — ~20 requests total +- Gated resources noted as such +- Turnstile token field name is gated (not in extracted CSS-only auth chunk) diff --git a/research-what-we-did/deskgram_reverse.py b/research-what-we-did/deskgram_reverse.py new file mode 100644 index 0000000..56dfd1f --- /dev/null +++ b/research-what-we-did/deskgram_reverse.py @@ -0,0 +1,638 @@ +""" +Deskgram 2 — реконструкция функций по параметрам из веб-превью. +Telethon-based. Все параметры взяты из интерфейса модулей. +""" +import asyncio, random, json, os, re, time, csv +from datetime import datetime, timedelta +from pathlib import Path +from telethon import TelegramClient, functions, types, errors +from telethon.tl.types import InputPeerUser, InputPeerChat, InputPeerChannel +from telethon.tl.functions.messages import GetDialogsRequest +from telethon.tl.functions.channels import InviteToChannelRequest, JoinChannelRequest +from telethon.tl.functions.account import UpdateProfileRequest, UpdateUsernameRequest +from telethon.tl.functions.photos import UploadProfilePhotoRequest +from telethon.sessions import StringSession +from dataclasses import dataclass, field +from typing import Optional + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Панель аккаунтов +# ═══════════════════════════════════════════════════════════════ + +async def account_check(client: TelegramClient): + """Проверка аккаунта: статус, спамблок, премиум""" + me = await client.get_me() + try: + await client.send_message('SpamBot', '/start') + await asyncio.sleep(2) + msgs = await client.get_messages('SpamBot', limit=1) + spam_blocked = 'ограничен' in (msgs[0].message or '').lower() + except: + spam_blocked = None + return { + 'id': me.id, 'username': me.username, 'phone': me.phone, + 'premium': getattr(me, 'premium', False), + 'spam_blocked': spam_blocked, + 'last_seen': me.status.was_online if hasattr(me.status, 'was_online') else None + } + +async def account_edit_profile(client: TelegramClient, *, + first_name=None, last_name=None, bio=None, username=None, photo_path=None): + """Редактирование профиля аккаунта""" + if first_name or last_name: + await client(UpdateProfileRequest( + first_name=first_name, last_name=last_name, about=bio)) + if username: + await client(UpdateUsernameRequest(username)) + if photo_path: + await client(UploadProfilePhotoRequest( + await client.upload_file(photo_path))) + +async def account_set_2fa(client: TelegramClient, password: str, hint: str = ''): + """Установка 2FA""" + await client.edit_2fa(new_password=password, hint=hint) + +async def account_get_sessions(client: TelegramClient): + """Получить активные сессии""" + return await client(functions.account.GetAuthorizationsRequest()) + +async def account_terminate_sessions(client: TelegramClient): + """Сбросить все сессии кроме текущей""" + await client(functions.auth.ResetAuthorizationsRequest()) + +async def account_privacy(client: TelegramClient, *, + hide_phone=True, hide_lastseen=True, hide_forwarded=True): + """Настройки приватности""" + rules = [] + if hide_phone: + rules.append(types.InputPrivacyValueDisallowAll()) + if hide_lastseen: + pass # аналогично через account.setPrivacy + await client(functions.account.SetPrivacyRequest( + key=types.InputPrivacyKeyPhoneNumber(), rules=rules)) + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Рассылка в ЛС +# ═══════════════════════════════════════════════════════════════ + +@dataclass +class SpamPMConfig: + threads: int = 3 + msg_per_account: int = 50 + delay_min: float = 30.0 + delay_max: float = 90.0 + silent: bool = False + ttl_seconds: Optional[int] = None + pin_message: bool = False + delete_sender: bool = False + block_after: bool = False + add_to_blacklist: bool = False + remove_links_preview: bool = False + rotate_on_flood: bool = True + check_spambot: bool = True + use_autoresponder: bool = False + collect_incoming: bool = False + thread_start_delay: tuple = (5, 30) + +async def spam_pm(client: TelegramClient, users: list, message: str, cfg: SpamPMConfig): + """Рассылка в ЛС с настройками из интерфейса""" + sent = 0 + + for user in users: + if sent >= cfg.msg_per_account: + break + try: + entity = await client.get_input_entity(user) + await client.send_message( + entity, message, + silent=cfg.silent, + background=None + ) + sent += 1 + + if cfg.block_after: + await client(functions.contacts.BlockRequest(entity)) + + delay = random.uniform(cfg.delay_min, cfg.delay_max) + await asyncio.sleep(delay) + + except errors.FloodWaitError as e: + if cfg.rotate_on_flood: + return False # сигнал сменить аккаунт + await asyncio.sleep(e.seconds) + except errors.PeerFloodError: + if cfg.check_spambot: + await client.send_message('SpamBot', '/start') + return False + except Exception: + continue + return True + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Нейрочаттинг +# ═══════════════════════════════════════════════════════════════ + +@dataclass +class NeuroChatConfig: + mode: str = 'keywords' # keywords | trigger | smart | promoter + chat_source: str = 'subscriptions' # subscriptions | list + chat_list: list = field(default_factory=list) + replies_per_account: int = 30 + context_messages: int = 5 + delay_before_reply: tuple = (5, 30) + pause_between_replies: tuple = (60, 300) + max_replies_per_chat: int = 10 + chat_cooldown_min: int = 30 + trigger_words: list = field(default_factory=list) + whole_word: bool = True + case_sensitive: bool = False + ignore_bots: bool = True + ignore_system: bool = True + min_message_length: int = 1 + leave_if_cant_write: bool = False + auto_leave_spam: bool = False + respond_to_our_replies: bool = False + check_spambot_on_flood: bool = True + +async def neurochatting(client: TelegramClient, ai_generate, cfg: NeuroChatConfig): + """Нейрочаттинг: AI отвечает на сообщения в чатах""" + + if cfg.chat_source == 'subscriptions': + dialogs = await client.get_dialogs() + chats = [d for d in dialogs if d.is_group] + else: + chats = cfg.chat_list + + chat_stats = {} + for chat in chats: + if chat_stats.get(chat.id, 0) >= cfg.max_replies_per_chat: + continue + + try: + messages = await client.get_messages(chat, limit=50) + except errors.ChatWriteForbiddenError: + if cfg.leave_if_cant_write: + await client.delete_dialog(chat) + continue + + for msg in messages: + if not msg.message: + continue + if cfg.ignore_bots and msg.sender and getattr(msg.sender, 'bot', False): + continue + if cfg.ignore_system and getattr(msg, 'action', None): + continue + if len(msg.message or '') < cfg.min_message_length: + continue + + # Проверка триггеров + should_reply = False + text = msg.message or '' + + if cfg.mode == 'keywords': + for word in cfg.trigger_words: + if cfg.whole_word: + pattern = rf'\b{re.escape(word)}\b' + else: + pattern = re.escape(word) + flags = 0 if cfg.case_sensitive else re.IGNORECASE + if re.search(pattern, text, flags): + should_reply = True + break + + elif cfg.mode == 'trigger': + should_reply = True # AI решает + + elif cfg.mode == 'smart': + should_reply = True + + elif cfg.mode == 'promoter': + should_reply = True + + if should_reply: + # Контекст + context = await client.get_messages( + chat, limit=cfg.context_messages, offset_id=msg.id) + context_text = '\n'.join( + f"[{m.sender_id}]: {m.message}" for m in reversed(context) if m.message) + + # AI генерация + reply = await ai_generate(context_text, msg.message) + + delay = random.uniform(*cfg.delay_before_reply) + await asyncio.sleep(delay) + + try: + await client.send_message(chat, reply, reply_to=msg.id) + chat_stats[chat.id] = chat_stats.get(chat.id, 0) + 1 + except errors.PeerFloodError: + if cfg.check_spambot_on_flood: + await client.send_message('SpamBot', '/start') + return chat_stats + + pause = random.uniform(*cfg.pause_between_replies) + await asyncio.sleep(pause) + + return chat_stats + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Инвайтинг +# ═══════════════════════════════════════════════════════════════ + +async def invite_users(client: TelegramClient, chat, users: list, + per_account: int = 50, delay: tuple = (60, 180), rotate_on_flood: bool = True): + """Массовый инвайт пользователей в канал/группу""" + invited = 0 + for user in users: + if invited >= per_account: + break + try: + entity = await client.get_input_entity(user) + await client(InviteToChannelRequest(chat, [entity])) + invited += 1 + await asyncio.sleep(random.uniform(*delay)) + except errors.FloodWaitError as e: + if rotate_on_flood: + return invited + await asyncio.sleep(e.seconds) + except errors.UserPrivacyRestrictedError: + continue + except Exception: + continue + return invited + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Парсер аудитории +# ═══════════════════════════════════════════════════════════════ + +async def parse_chat_members(client: TelegramClient, chat, + limit: int = 50000, active_only: bool = False) -> list[dict]: + """Сбор участников чата/канала""" + users = [] + try: + async for member in client.iter_participants(chat, limit=limit): + if active_only and member.status: + if hasattr(member.status, 'was_online'): + if (datetime.now() - member.status.was_online).days > 30: + continue + users.append({ + 'id': member.id, + 'username': member.username, + 'first_name': member.first_name, + 'last_name': member.last_name, + 'phone': getattr(member, 'phone', None), + 'premium': getattr(member, 'premium', False), + 'bot': member.bot, + 'was_online': str(getattr(member.status, 'was_online', None)) + }) + except errors.ChatAdminRequiredError: + pass + return users + +async def parse_comments(client: TelegramClient, channel, post_limit: int = 100): + """Парсер комментаторов постов""" + commenters = {} + messages = await client.get_messages(channel, limit=post_limit) + for msg in messages: + if msg.replies and msg.replies.replies > 0: + try: + async for comment in client.iter_messages( + channel, reply_to=msg.id, limit=100): + if comment.sender_id and comment.sender_id not in commenters: + commenters[comment.sender_id] = { + 'user_id': comment.sender_id, + 'post_id': msg.id, + 'count': 1 + } + elif comment.sender_id: + commenters[comment.sender_id]['count'] += 1 + except: + continue + return sorted(commenters.values(), key=lambda x: x['count'], reverse=True) + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Нейрокомментинг +# ═══════════════════════════════════════════════════════════════ + +async def neuro_commenting(client: TelegramClient, channels: list, + ai_generate, posts_per_channel: int = 10, + delay: tuple = (30, 120), mode: str = 'firstnah'): + """Автокомментирование новых постов с AI""" + results = [] + for channel in channels: + try: + # Первонах (firstnah) — комментарий первым + messages = await client.get_messages(channel, limit=posts_per_channel) + for msg in messages: + if not msg.message: + continue + try: + existing = await client.get_messages( + channel, reply_to=msg.id, limit=5) + our_comments = [c for c in existing + if c.sender_id == (await client.get_me()).id] + if mode == 'firstnah' and our_comments: + continue # уже комментили + except: + pass + + comment = await ai_generate( + f"POST: {msg.message[:500]}", + style='positive' # из настроек модуля + ) + await asyncio.sleep(random.uniform(*delay)) + await client.send_message(channel, comment, reply_to=msg.id) + results.append({'channel': channel, 'post_id': msg.id, 'comment': comment[:100]}) + except Exception as e: + results.append({'channel': channel, 'error': str(e)}) + return results + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Рассылка в группы +# ═══════════════════════════════════════════════════════════════ + +async def spam_groups(client: TelegramClient, chats: list, message: str, + ai_rewrite=False, ai_generate=None, + per_account: int = 20, delay: tuple = (60, 180)): + """Рассылка в группы с AI-рерайтом""" + sent = 0 + for chat in chats: + if sent >= per_account: + break + try: + text = message + if ai_rewrite and ai_generate: + text = await ai_generate(f"Rewrite this naturally: {message}") + + await client.send_message(chat, text) + sent += 1 + await asyncio.sleep(random.uniform(*delay)) + except errors.FloodWaitError as e: + await asyncio.sleep(e.seconds) + except Exception: + continue + return sent + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Автоответчик с ветвлением +# ═══════════════════════════════════════════════════════════════ + +@dataclass +class AutoReplyRule: + trigger_words: list + response: str + whole_word: bool = True + case_sensitive: bool = False + collect_usernames: bool = False + +async def auto_responder(client: TelegramClient, rules: list[AutoReplyRule], + collect_usernames: bool = False, blacklist: set = set()): + """Автоответчик на входящие сообщения""" + collected = [] + while True: + try: + dialogs = await client.get_dialogs() + for dialog in dialogs: + if dialog.unread_count > 0 and dialog.id not in blacklist: + msgs = await client.get_messages(dialog.id, limit=dialog.unread_count) + for msg in msgs: + if msg.out: + continue + if collect_usernames and msg.sender: + collected.append({ + 'user_id': msg.sender_id, + 'username': getattr(msg.sender, 'username', None), + 'message': msg.message[:200] + }) + + text = msg.message or '' + for rule in rules: + for word in rule.trigger_words: + if rule.whole_word: + pattern = rf'\b{re.escape(word)}\b' + else: + pattern = re.escape(word) + flags = 0 if rule.case_sensitive else re.IGNORECASE + if re.search(pattern, text, flags): + await client.send_message(dialog.id, rule.response) + break + else: + continue + break + except Exception: + pass + await asyncio.sleep(5) + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Массовые подписки + лайки + просмотры +# ═══════════════════════════════════════════════════════════════ + +async def mass_join(client: TelegramClient, channels: list, + per_account: int = 50, delay: tuple = (30, 90)): + """Массовое вступление в каналы/группы""" + joined = 0 + for ch in channels: + if joined >= per_account: + break + try: + await client(JoinChannelRequest(ch)) + joined += 1 + await asyncio.sleep(random.uniform(*delay)) + except errors.FloodWaitError as e: + await asyncio.sleep(e.seconds) + except Exception: + continue + return joined + +async def mass_react(client: TelegramClient, channel, post_ids: list, + reaction='👍', per_account: int = 100, delay: tuple = (5, 15)): + """Массовые реакции на посты""" + for pid in post_ids[:per_account]: + try: + await client.send_reaction(channel, pid, reaction) + await asyncio.sleep(random.uniform(*delay)) + except errors.FloodWaitError as e: + await asyncio.sleep(e.seconds) + except Exception: + continue + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Чекер юзернеймов +# ═══════════════════════════════════════════════════════════════ + +async def check_usernames(client: TelegramClient, usernames: list) -> dict: + """Проверка доступности юзернеймов""" + results = {'free': [], 'taken': [], 'errors': []} + for username in usernames: + try: + entity = await client.get_entity(username) + results['taken'].append(username) + except errors.UsernameNotOccupiedError: + results['free'].append(username) + except Exception: + results['errors'].append(username) + await asyncio.sleep(0.5) + return results + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Масслукинг (просмотр Stories) +# ═══════════════════════════════════════════════════════════════ + +async def mass_story_view(client: TelegramClient, targets: list, + per_account: int = 200, delay: tuple = (3, 10)): + """Массовый просмотр Telegram Stories""" + viewed = 0 + for target in targets: + if viewed >= per_account: + break + try: + entity = await client.get_input_entity(target) + stories = await client(functions.stories.GetPeerStoriesRequest( + peer=entity)) + if stories.stories: + await client(functions.stories.ReadStoriesRequest( + peer=entity, + max_id=max(s.id for s in stories.stories.stories) + )) + viewed += 1 + await asyncio.sleep(random.uniform(*delay)) + except Exception: + continue + return viewed + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Прогрев аккаунтов +# ═══════════════════════════════════════════════════════════════ + +async def warmup_account(client: TelegramClient, days: int = 7, + daily_joins: int = 5, daily_messages: int = 3, daily_reactions: int = 10): + """Прогрев аккаунта перед работой""" + for day in range(days): + for _ in range(random.randint(1, daily_joins)): + try: + dialogs = await client.get_dialogs() + groups = [d for d in dialogs if d.is_group] + if groups: + await client(JoinChannelRequest(random.choice(groups))) + except: + pass + await asyncio.sleep(random.uniform(300, 900)) + + for _ in range(random.randint(1, daily_messages)): + try: + await client.send_message('me', f'Warmup message {time.time()}') + except: + pass + await asyncio.sleep(random.uniform(600, 1800)) + + return True + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Постинг по каналам +# ═══════════════════════════════════════════════════════════════ + +async def channel_posting(client: TelegramClient, channels: list, + posts: list[dict], schedule: bool = False): + """Публикация постов в каналы через бота-админа""" + for channel in channels: + for post in posts: + try: + entity = await client.get_entity(channel) + if post.get('photo'): + await client.send_file(entity, post['photo'], + caption=post.get('caption', '')) + else: + await client.send_message(entity, post.get('text', '')) + except Exception: + continue + await asyncio.sleep(random.uniform(10, 30)) + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Снятие спамблока +# ═══════════════════════════════════════════════════════════════ + +async def remove_spamblock(client: TelegramClient) -> bool: + """Снятие ограничений через SpamBot""" + try: + await client.send_message('SpamBot', '/start') + await asyncio.sleep(2) + msgs = await client.get_messages('SpamBot', limit=5) + for msg in msgs: + if msg.reply_markup and hasattr(msg.reply_markup, 'rows'): + for row in msg.reply_markup.rows: + for btn in row.buttons: + if 'ограничен' in (btn.text or '').lower() or \ + 'это я' in (btn.text or '').lower() or \ + 'продолжить' in (btn.text or '').lower(): + await btn.click() + return True + except Exception: + pass + return False + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Диспетчер задач (оркестратор) +# ═══════════════════════════════════════════════════════════════ + +class TaskDispatcher: + """Центральный диспетчер задач""" + def __init__(self): + self.tasks = {} + self.running = set() + self.results = {} + + async def run_task(self, task_id: str, coro, accounts: list, + proxy_rotate=None): + """Запуск задачи на пуле аккаунтов с ротацией""" + self.running.add(task_id) + results = [] + for acc in accounts: + client = await self._get_client(acc, proxy_rotate) + try: + result = await coro(client) + results.append({'account': acc, 'result': result}) + except Exception as e: + results.append({'account': acc, 'error': str(e)}) + finally: + await client.disconnect() + self.running.discard(task_id) + self.results[task_id] = results + return results + + async def _get_client(self, account, proxy): + """Создать клиент с прокси""" + session = account.get('session') + api_id = account.get('api_id', 2040) + api_hash = account.get('api_hash', 'b18441a1ff607e10a989891a5462e627') + client = TelegramClient( + StringSession(session) if session else StringSession(), + api_id, api_hash, + proxy=proxy + ) + await client.connect() + if not await client.is_user_authorized(): + await client.start(phone=account['phone']) + return client + +# ═══════════════════════════════════════════════════════════════ +# МОДУЛЬ: Прокси-менеджер +# ═══════════════════════════════════════════════════════════════ + +async def proxy_check(proxy: dict) -> dict: + """Проверка прокси перед назначением на аккаунт""" + import socket + try: + proto, host, port = proxy['type'], proxy['host'], proxy['port'] + sock = socket.create_connection((host, port), timeout=5) + sock.close() + return {'proxy': proxy, 'alive': True, 'latency': None} + except Exception as e: + return {'proxy': proxy, 'alive': False, 'error': str(e)} + +async def proxy_rotate(proxies: list, accounts: list) -> dict: + """Назначение прокси на аккаунты (round-robin)""" + alive = [p for p in proxies if (await proxy_check(p))['alive']] + mapping = {} + for i, acc in enumerate(accounts): + mapping[acc['id']] = alive[i % len(alive)] if alive else None + return mapping \ No newline at end of file diff --git a/research-what-we-did/forum-reversing/forum-reversing_2026-09-19.md b/research-what-we-did/forum-reversing/forum-reversing_2026-09-19.md new file mode 100644 index 0000000..e1a6bfc --- /dev/null +++ b/research-what-we-did/forum-reversing/forum-reversing_2026-09-19.md @@ -0,0 +1,813 @@ +[Skip to content](https://forum.tuts4you.com/#ipsLayout__main) + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +View in the app + +A better way to browse. **Learn more**. + +Learn more×DismissClose + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +Tuts 4 You + +A full-screen app on your home screen with push notifications, badges and more. + +To install this app on iOS and iPadOS + +1. Tap the Share icon in Safari +2. Scroll the menu and tap **Add to Home Screen**. +3. Tap **Add** in the top-right corner. + +To install this app on Android + +1. Tap the 3-dot menu (⋮) in the top-right corner of the browser. +2. Tap **Add to Home screen** or **Install app**. +3. Confirm by tapping **Install**. + +[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/) + +- Sign In + +1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category + + + +1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + + ### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + Very important! Please read before sign up and posting... + + + + + + - [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/) + - [Downloads](https://forum.tuts4you.com/forum/152-downloads/) + - [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/) + - [Telegram](https://forum.tuts4you.com/forum/158-telegram/) + +1,065,403 visits to this link + +2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category + + + +1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + + ### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + General and off-topic conversations and discussions here... + + + + + + + + - 15.9k posts + +![testednation](https://forum.tuts4you.com/uploads/monthly_2025_10/sunset.thumb.jpg.1191f083998af5ad81472d47975f9e97.jpg) + +[secure boot disable](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "secure boot disable") + +testednation, + + +[Thursday at 08:10 PM1 day](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "Go to last post") + +2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + + ### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + Discussions covering scene news and changes... + + + + + + - [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/) + - [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/) + + - 11k posts + +![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png) + +[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie") + +RADIOX, + + +[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post") + +3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + + ### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + Bugs, feedback and ideas regarding this site... + + + + + + + + - 2.3k posts + +![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png) + +[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage") + +Teddy Rogers, + + +[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post") + +3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category + + + +1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + + ### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + Programming and coding tips, help and solutions... + + + + + + + + - 13k posts + +![Asif](https://forum.tuts4you.com/uploads/monthly_2026_05/dark-tree-in-the-middle-of-a-purple-lake-wallpaper.thumb.jpg.02ff4397975066b3a9bcae231c439e2e.jpg) + +[JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach") + +Asif, + + +[Tuesday at 05:03 PM3 days](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "Go to last post") + +2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + + ### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + Share an interesting blog, news page or other resource... + + + + + + + + - 472 posts + +![Raven](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23a1c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TX-02 Berkeley Mono Fontface](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "TX-02 Berkeley Mono Fontface") + +Raven, + + +[May 16May 16](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "Go to last post") + +3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + + ### [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + Securing your software against reverse engineering... + + + + + + + + - 985 posts + +![redbull](https://forum.tuts4you.com/uploads/monthly_2026_07/83496-859380-cat-listening-to-music.thumb.jpg.a5006daa3b9c8a982bd875a41c8a6a82.jpg) + +[Protecting my Golang exe](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Protecting my Golang exe") + +redbull, + + +[July 10Jul 10](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Go to last post") + +4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category + + + +1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + + ### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + Try a challenge or contribute your own, any platform or operating system... + + + + + + - [CrackMe](https://forum.tuts4you.com/forum/145-crackme/) + - [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/) + - [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/) + - [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/) + + - 15.1k posts + +![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)") + +hamzadutsher, + + +[Monday at 11:17 PM4 days](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post") + +2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + + ### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + Reverse engineering of circuitry hardware and firmware... + + + + + + + + - 258 posts + +![ToughDev](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c46285%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ET%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project") + +ToughDev, + + +[March 26Mar 26](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post") + +3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + + ### [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + Discussions on network security, holes, exploits and other issues... + + + + + + + + - 454 posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???") + +CodeExplorer, + + +[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post") + +4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + + ### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + Debugging, disassembling and documenting interesting malware... + + + + + + + + - 1.7k posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?") + +CodeExplorer, + + +[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post") + +5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + + ### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + Share an interesting blog, news page or other RE related site... + + + + + + + + - 2.6k posts + +![Say](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2382c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)") + +Say, + + +[September 4Sep 4](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "Go to last post") + +6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + + ### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + Discussions on employment and career paths in the industry... + + + + + + + + - 213 posts + +![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project") + +zahainesu, + + +[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post") + +5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category + + + +1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + + ### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + Development and support forum for the Scylla project... + + + + + + + + - 506 posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source") + +Progman, + + +[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post") + +2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + + ### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + An open-source x64/x32 debugger for windows... + + + + + + + + - 1.3k posts + +![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi") + +remek002, + + +[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post") + +3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + + ### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + Looking for support and interested partners for a future project? + + + + + + + + - 151 posts + +![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg) + +[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler") + +Dax, + + +[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post") + +4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + ### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + Old and inactive projects moved to long term support... + + + + + + + - [uPPP](https://forum.tuts4you.com/forum/120-uppp/) + - [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/) + - [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/) + + - 832 posts + +![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide") + +devsat-dz, + + +[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post") + +6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category + + + +1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + ### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + This is where all the bad posts go. + + + + + **99.9%** of the time it contains crack requests and banned members... + + +### Member Statistics + +- **31,470** Total Members +- **7,713** Most Online +- [![Shadow09](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c462b3%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile") + +**[Shadow09](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile")** Newest Member · Wednesday at 07:53 PM2 days + + +- [Existing user? Sign In](https://forum.tuts4you.com/login/) +- [Sign Up](https://forum.tuts4you.com/register/) + +Search + +Where: + + +EverywhereTopicsFilesPagesArticle + +Search: + + +Content titles and bodyContent titles only + +Date Created: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Use: + + +All of these wordsAny of these words + +Last Updated: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Search... + +Search + +Search + +Search by content type + +EverywhereTopicsFilesPagesArticle + +Find results in + +Search titles and bodySearch titles only + +Date Created + +Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year + +Last Updated + +Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year + +Close + +#### Configure browser push notifications + +Close + +Chrome Safari Edge Firefox + +##### Chrome (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions → Notifications**. +3. Adjust your preference. + +##### Chrome (Desktop) + +1. Click the padlock icon in the address bar. +2. Select **Site settings**. +3. Find **Notifications** and adjust your preference. + +##### Safari (iOS 16.4+) + +1. Ensure the site is installed via **Add to Home Screen**. +2. Open **Settings App → Notifications**. +3. Find your app name and adjust your preference. + +##### Safari (macOS) + +1. Go to **Safari → Preferences**. +2. Click the **Websites** tab. +3. Select **Notifications** in the sidebar. +4. Find this website and adjust your preference. + +##### Edge (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions**. +3. Find **Notifications** and adjust your preference. + +##### Edge (Desktop) + +1. Click the padlock icon in the address bar. +2. Click **Permissions for this site**. +3. Find **Notifications** and adjust your preference. + +##### Firefox (Android) + +1. Go to **Settings → Site permissions**. +2. Tap **Notifications**. +3. Find this site in the list and adjust your preference. + +##### Firefox (Desktop) + +1. Open Firefox Settings. +2. Search for **Notifications**. +3. Find this site in the list and adjust your preference. \ No newline at end of file diff --git a/research-what-we-did/forum-reversing/forum-reversing_2026-09-20.md b/research-what-we-did/forum-reversing/forum-reversing_2026-09-20.md new file mode 100644 index 0000000..e1a6bfc --- /dev/null +++ b/research-what-we-did/forum-reversing/forum-reversing_2026-09-20.md @@ -0,0 +1,813 @@ +[Skip to content](https://forum.tuts4you.com/#ipsLayout__main) + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +View in the app + +A better way to browse. **Learn more**. + +Learn more×DismissClose + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +Tuts 4 You + +A full-screen app on your home screen with push notifications, badges and more. + +To install this app on iOS and iPadOS + +1. Tap the Share icon in Safari +2. Scroll the menu and tap **Add to Home Screen**. +3. Tap **Add** in the top-right corner. + +To install this app on Android + +1. Tap the 3-dot menu (⋮) in the top-right corner of the browser. +2. Tap **Add to Home screen** or **Install app**. +3. Confirm by tapping **Install**. + +[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/) + +- Sign In + +1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category + + + +1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + + ### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + Very important! Please read before sign up and posting... + + + + + + - [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/) + - [Downloads](https://forum.tuts4you.com/forum/152-downloads/) + - [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/) + - [Telegram](https://forum.tuts4you.com/forum/158-telegram/) + +1,065,403 visits to this link + +2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category + + + +1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + + ### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + General and off-topic conversations and discussions here... + + + + + + + + - 15.9k posts + +![testednation](https://forum.tuts4you.com/uploads/monthly_2025_10/sunset.thumb.jpg.1191f083998af5ad81472d47975f9e97.jpg) + +[secure boot disable](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "secure boot disable") + +testednation, + + +[Thursday at 08:10 PM1 day](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "Go to last post") + +2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + + ### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + Discussions covering scene news and changes... + + + + + + - [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/) + - [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/) + + - 11k posts + +![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png) + +[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie") + +RADIOX, + + +[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post") + +3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + + ### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + Bugs, feedback and ideas regarding this site... + + + + + + + + - 2.3k posts + +![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png) + +[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage") + +Teddy Rogers, + + +[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post") + +3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category + + + +1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + + ### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + Programming and coding tips, help and solutions... + + + + + + + + - 13k posts + +![Asif](https://forum.tuts4you.com/uploads/monthly_2026_05/dark-tree-in-the-middle-of-a-purple-lake-wallpaper.thumb.jpg.02ff4397975066b3a9bcae231c439e2e.jpg) + +[JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach") + +Asif, + + +[Tuesday at 05:03 PM3 days](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "Go to last post") + +2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + + ### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + Share an interesting blog, news page or other resource... + + + + + + + + - 472 posts + +![Raven](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23a1c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TX-02 Berkeley Mono Fontface](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "TX-02 Berkeley Mono Fontface") + +Raven, + + +[May 16May 16](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "Go to last post") + +3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + + ### [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + Securing your software against reverse engineering... + + + + + + + + - 985 posts + +![redbull](https://forum.tuts4you.com/uploads/monthly_2026_07/83496-859380-cat-listening-to-music.thumb.jpg.a5006daa3b9c8a982bd875a41c8a6a82.jpg) + +[Protecting my Golang exe](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Protecting my Golang exe") + +redbull, + + +[July 10Jul 10](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Go to last post") + +4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category + + + +1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + + ### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + Try a challenge or contribute your own, any platform or operating system... + + + + + + - [CrackMe](https://forum.tuts4you.com/forum/145-crackme/) + - [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/) + - [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/) + - [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/) + + - 15.1k posts + +![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)") + +hamzadutsher, + + +[Monday at 11:17 PM4 days](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post") + +2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + + ### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + Reverse engineering of circuitry hardware and firmware... + + + + + + + + - 258 posts + +![ToughDev](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c46285%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ET%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project") + +ToughDev, + + +[March 26Mar 26](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post") + +3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + + ### [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + Discussions on network security, holes, exploits and other issues... + + + + + + + + - 454 posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???") + +CodeExplorer, + + +[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post") + +4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + + ### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + Debugging, disassembling and documenting interesting malware... + + + + + + + + - 1.7k posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?") + +CodeExplorer, + + +[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post") + +5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + + ### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + Share an interesting blog, news page or other RE related site... + + + + + + + + - 2.6k posts + +![Say](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2382c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)") + +Say, + + +[September 4Sep 4](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "Go to last post") + +6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + + ### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + Discussions on employment and career paths in the industry... + + + + + + + + - 213 posts + +![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project") + +zahainesu, + + +[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post") + +5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category + + + +1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + + ### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + Development and support forum for the Scylla project... + + + + + + + + - 506 posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source") + +Progman, + + +[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post") + +2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + + ### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + An open-source x64/x32 debugger for windows... + + + + + + + + - 1.3k posts + +![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi") + +remek002, + + +[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post") + +3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + + ### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + Looking for support and interested partners for a future project? + + + + + + + + - 151 posts + +![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg) + +[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler") + +Dax, + + +[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post") + +4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + ### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + Old and inactive projects moved to long term support... + + + + + + + - [uPPP](https://forum.tuts4you.com/forum/120-uppp/) + - [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/) + - [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/) + + - 832 posts + +![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide") + +devsat-dz, + + +[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post") + +6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category + + + +1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + ### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + This is where all the bad posts go. + + + + + **99.9%** of the time it contains crack requests and banned members... + + +### Member Statistics + +- **31,470** Total Members +- **7,713** Most Online +- [![Shadow09](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c462b3%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile") + +**[Shadow09](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile")** Newest Member · Wednesday at 07:53 PM2 days + + +- [Existing user? Sign In](https://forum.tuts4you.com/login/) +- [Sign Up](https://forum.tuts4you.com/register/) + +Search + +Where: + + +EverywhereTopicsFilesPagesArticle + +Search: + + +Content titles and bodyContent titles only + +Date Created: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Use: + + +All of these wordsAny of these words + +Last Updated: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Search... + +Search + +Search + +Search by content type + +EverywhereTopicsFilesPagesArticle + +Find results in + +Search titles and bodySearch titles only + +Date Created + +Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year + +Last Updated + +Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year + +Close + +#### Configure browser push notifications + +Close + +Chrome Safari Edge Firefox + +##### Chrome (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions → Notifications**. +3. Adjust your preference. + +##### Chrome (Desktop) + +1. Click the padlock icon in the address bar. +2. Select **Site settings**. +3. Find **Notifications** and adjust your preference. + +##### Safari (iOS 16.4+) + +1. Ensure the site is installed via **Add to Home Screen**. +2. Open **Settings App → Notifications**. +3. Find your app name and adjust your preference. + +##### Safari (macOS) + +1. Go to **Safari → Preferences**. +2. Click the **Websites** tab. +3. Select **Notifications** in the sidebar. +4. Find this website and adjust your preference. + +##### Edge (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions**. +3. Find **Notifications** and adjust your preference. + +##### Edge (Desktop) + +1. Click the padlock icon in the address bar. +2. Click **Permissions for this site**. +3. Find **Notifications** and adjust your preference. + +##### Firefox (Android) + +1. Go to **Settings → Site permissions**. +2. Tap **Notifications**. +3. Find this site in the list and adjust your preference. + +##### Firefox (Desktop) + +1. Open Firefox Settings. +2. Search for **Notifications**. +3. Find this site in the list and adjust your preference. \ No newline at end of file diff --git a/research-what-we-did/forum-reversing/forum-reversing_2026-09-21.md b/research-what-we-did/forum-reversing/forum-reversing_2026-09-21.md new file mode 100644 index 0000000..cd2a0b7 --- /dev/null +++ b/research-what-we-did/forum-reversing/forum-reversing_2026-09-21.md @@ -0,0 +1,813 @@ +[Skip to content](https://forum.tuts4you.com/#ipsLayout__main) + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +View in the app + +A better way to browse. **Learn more**. + +Learn more×DismissClose + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +Tuts 4 You + +A full-screen app on your home screen with push notifications, badges and more. + +To install this app on iOS and iPadOS + +1. Tap the Share icon in Safari +2. Scroll the menu and tap **Add to Home Screen**. +3. Tap **Add** in the top-right corner. + +To install this app on Android + +1. Tap the 3-dot menu (⋮) in the top-right corner of the browser. +2. Tap **Add to Home screen** or **Install app**. +3. Confirm by tapping **Install**. + +[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/) + +- Sign In + +1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category + + + +1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + + ### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + Very important! Please read before sign up and posting... + + + + + + - [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/) + - [Downloads](https://forum.tuts4you.com/forum/152-downloads/) + - [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/) + - [Telegram](https://forum.tuts4you.com/forum/158-telegram/) + +1,065,431 visits to this link + +2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category + + + +1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + + ### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + General and off-topic conversations and discussions here... + + + + + + + + - 15.9k posts + +![Stingered](https://forum.tuts4you.com/uploads/monthly_2026_01/Stingered_animated_Avatar.thumb.gif.578a5e25596943c2d83999a12bffbb3e.gif) + +[Question. I've been working on a patch for severel months without success...](https://forum.tuts4you.com/topic/46217-question-ive-been-working-on-a-patch-for-severel-months-without-success/ "Question. I've been working on a patch for severel months without success...") + +Stingered, + + +[15 hours ago15 hr](https://forum.tuts4you.com/topic/46217-question-ive-been-working-on-a-patch-for-severel-months-without-success/ "Go to last post") + +2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + + ### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + Discussions covering scene news and changes... + + + + + + - [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/) + - [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/) + + - 11k posts + +![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png) + +[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie") + +RADIOX, + + +[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post") + +3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + + ### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + Bugs, feedback and ideas regarding this site... + + + + + + + + - 2.3k posts + +![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png) + +[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage") + +Teddy Rogers, + + +[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post") + +3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category + + + +1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + + ### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + Programming and coding tips, help and solutions... + + + + + + + + - 13k posts + +![Asif](https://forum.tuts4you.com/uploads/monthly_2026_05/dark-tree-in-the-middle-of-a-purple-lake-wallpaper.thumb.jpg.02ff4397975066b3a9bcae231c439e2e.jpg) + +[JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach") + +Asif, + + +[September 15Sep 15](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "Go to last post") + +2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + + ### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + Share an interesting blog, news page or other resource... + + + + + + + + - 473 posts + +![whoknows](https://forum.tuts4you.com/uploads/monthly_2024_01/avatar1.thumb.jpg.34724bdfbd3ed5b434bd6f7fc7c097b9.jpg) + +[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github") + +whoknows, + + +[Yesterday at 01:40 PM1 day](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post") + +3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + + ### [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + Securing your software against reverse engineering... + + + + + + + + - 985 posts + +![redbull](https://forum.tuts4you.com/uploads/monthly_2026_07/83496-859380-cat-listening-to-music.thumb.jpg.a5006daa3b9c8a982bd875a41c8a6a82.jpg) + +[Protecting my Golang exe](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Protecting my Golang exe") + +redbull, + + +[July 10Jul 10](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Go to last post") + +4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category + + + +1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + + ### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + Try a challenge or contribute your own, any platform or operating system... + + + + + + - [CrackMe](https://forum.tuts4you.com/forum/145-crackme/) + - [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/) + - [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/) + - [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/) + + - 15.1k posts + +![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)") + +hamzadutsher, + + +[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post") + +2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + + ### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + Reverse engineering of circuitry hardware and firmware... + + + + + + + + - 258 posts + +![ToughDev](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c46285%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ET%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project") + +ToughDev, + + +[March 26Mar 26](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post") + +3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + + ### [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + Discussions on network security, holes, exploits and other issues... + + + + + + + + - 454 posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???") + +CodeExplorer, + + +[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post") + +4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + + ### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + Debugging, disassembling and documenting interesting malware... + + + + + + + + - 1.7k posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?") + +CodeExplorer, + + +[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post") + +5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + + ### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + Share an interesting blog, news page or other RE related site... + + + + + + + + - 2.6k posts + +![Say](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2382c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)") + +Say, + + +[September 4Sep 4](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "Go to last post") + +6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + + ### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + Discussions on employment and career paths in the industry... + + + + + + + + - 213 posts + +![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project") + +zahainesu, + + +[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post") + +5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category + + + +1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + + ### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + Development and support forum for the Scylla project... + + + + + + + + - 506 posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source") + +Progman, + + +[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post") + +2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + + ### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + An open-source x64/x32 debugger for windows... + + + + + + + + - 1.3k posts + +![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi") + +remek002, + + +[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post") + +3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + + ### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + Looking for support and interested partners for a future project? + + + + + + + + - 151 posts + +![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg) + +[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler") + +Dax, + + +[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post") + +4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + ### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + Old and inactive projects moved to long term support... + + + + + + + - [uPPP](https://forum.tuts4you.com/forum/120-uppp/) + - [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/) + - [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/) + + - 832 posts + +![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide") + +devsat-dz, + + +[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post") + +6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category + + + +1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + ### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + This is where all the bad posts go. + + + + + **99.9%** of the time it contains crack requests and banned members... + + +### Member Statistics + +- **31,468** Total Members +- **7,713** Most Online +- ![Shadow09](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c462b3%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +**Shadow09** Newest Member · Wednesday at 07:53 PM4 days + + +- [Existing user? Sign In](https://forum.tuts4you.com/login/) +- [Sign Up](https://forum.tuts4you.com/register/) + +Search + +Where: + + +EverywhereTopicsFilesPagesArticle + +Search: + + +Content titles and bodyContent titles only + +Date Created: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Use: + + +All of these wordsAny of these words + +Last Updated: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Search... + +Search + +Search + +Search by content type + +EverywhereTopicsFilesPagesArticle + +Find results in + +Search titles and bodySearch titles only + +Date Created + +Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year + +Last Updated + +Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year + +Close + +#### Configure browser push notifications + +Close + +Chrome Safari Edge Firefox + +##### Chrome (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions → Notifications**. +3. Adjust your preference. + +##### Chrome (Desktop) + +1. Click the padlock icon in the address bar. +2. Select **Site settings**. +3. Find **Notifications** and adjust your preference. + +##### Safari (iOS 16.4+) + +1. Ensure the site is installed via **Add to Home Screen**. +2. Open **Settings App → Notifications**. +3. Find your app name and adjust your preference. + +##### Safari (macOS) + +1. Go to **Safari → Preferences**. +2. Click the **Websites** tab. +3. Select **Notifications** in the sidebar. +4. Find this website and adjust your preference. + +##### Edge (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions**. +3. Find **Notifications** and adjust your preference. + +##### Edge (Desktop) + +1. Click the padlock icon in the address bar. +2. Click **Permissions for this site**. +3. Find **Notifications** and adjust your preference. + +##### Firefox (Android) + +1. Go to **Settings → Site permissions**. +2. Tap **Notifications**. +3. Find this site in the list and adjust your preference. + +##### Firefox (Desktop) + +1. Open Firefox Settings. +2. Search for **Notifications**. +3. Find this site in the list and adjust your preference. \ No newline at end of file diff --git a/research-what-we-did/forum-reversing/forum-reversing_2026-09-26.md b/research-what-we-did/forum-reversing/forum-reversing_2026-09-26.md new file mode 100644 index 0000000..2f68736 --- /dev/null +++ b/research-what-we-did/forum-reversing/forum-reversing_2026-09-26.md @@ -0,0 +1,813 @@ +[Skip to content](https://forum.tuts4you.com/#ipsLayout__main) + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +View in the app + +A better way to browse. **Learn more**. + +Learn more×DismissClose + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +Tuts 4 You + +A full-screen app on your home screen with push notifications, badges and more. + +To install this app on iOS and iPadOS + +1. Tap the Share icon in Safari +2. Scroll the menu and tap **Add to Home Screen**. +3. Tap **Add** in the top-right corner. + +To install this app on Android + +1. Tap the 3-dot menu (⋮) in the top-right corner of the browser. +2. Tap **Add to Home screen** or **Install app**. +3. Confirm by tapping **Install**. + +[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/) + +- Sign In + +1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category + + + +1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + + ### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + Very important! Please read before sign up and posting... + + + + + + - [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/) + - [Downloads](https://forum.tuts4you.com/forum/152-downloads/) + - [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/) + - [Telegram](https://forum.tuts4you.com/forum/158-telegram/) + +1,065,496 visits to this link + +2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category + + + +1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + + ### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + General and off-topic conversations and discussions here... + + + + + + + + - 15.9k posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Is there any AI model we can use without message limitations?](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Is there any AI model we can use without message limitations?") + +Progman, + + +[10 hours ago10 hr](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Go to last post") + +2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + + ### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + Discussions covering scene news and changes... + + + + + + - [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/) + - [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/) + + - 11k posts + +![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png) + +[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie") + +RADIOX, + + +[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post") + +3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + + ### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + Bugs, feedback and ideas regarding this site... + + + + + + + + - 2.3k posts + +![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png) + +[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage") + +Teddy Rogers, + + +[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post") + +3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category + + + +1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + + ### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + Programming and coding tips, help and solutions... + + + + + + + + - 13k posts + +![Raggy](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23626dc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Realistic Water Effect When Touched by Mouse.](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Realistic Water Effect When Touched by Mouse.") + +Raggy, + + +[Wednesday at 11:06 AM2 days](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Go to last post") + +2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + + ### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + Share an interesting blog, news page or other resource... + + + + + + + + - 474 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github") + +Erich Gropper, + + +[8 hours ago8 hr](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post") + +3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + + ### [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + Securing your software against reverse engineering... + + + + + + + + - 990 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?") + +Erich Gropper, + + +[8 hours ago8 hr](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "Go to last post") + +4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category + + + +1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + + ### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + Try a challenge or contribute your own, any platform or operating system... + + + + + + - [CrackMe](https://forum.tuts4you.com/forum/145-crackme/) + - [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/) + - [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/) + - [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/) + + - 15.1k posts + +![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)") + +hamzadutsher, + + +[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post") + +2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + + ### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + Reverse engineering of circuitry hardware and firmware... + + + + + + + + - 259 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project") + +Erich Gropper, + + +[8 hours ago8 hr](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post") + +3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + + ### [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + Discussions on network security, holes, exploits and other issues... + + + + + + + + - 454 posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???") + +CodeExplorer, + + +[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post") + +4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + + ### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + Debugging, disassembling and documenting interesting malware... + + + + + + + + - 1.7k posts + +![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg) + +[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?") + +CodeExplorer, + + +[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post") + +5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + + ### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + Share an interesting blog, news page or other RE related site... + + + + + + + + - 2.6k posts + +![Washi](https://forum.tuts4you.com/uploads/monthly_2019_03/avatar_873632.thumb.png.9c04c2850dff78439125ab2a368560e2.png) + +[Flare-On 13](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Flare-On 13") + +Washi, + + +[13 hours ago13 hr](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Go to last post") + +6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + + ### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + Discussions on employment and career paths in the industry... + + + + + + + + - 213 posts + +![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project") + +zahainesu, + + +[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post") + +5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category + + + +1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + + ### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + Development and support forum for the Scylla project... + + + + + + + + - 506 posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source") + +Progman, + + +[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post") + +2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + + ### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + An open-source x64/x32 debugger for windows... + + + + + + + + - 1.3k posts + +![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi") + +remek002, + + +[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post") + +3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + + ### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + Looking for support and interested partners for a future project? + + + + + + + + - 151 posts + +![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg) + +[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler") + +Dax, + + +[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post") + +4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + ### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + Old and inactive projects moved to long term support... + + + + + + + - [uPPP](https://forum.tuts4you.com/forum/120-uppp/) + - [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/) + - [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/) + + - 832 posts + +![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide") + +devsat-dz, + + +[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post") + +6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category + + + +1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + ### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + This is where all the bad posts go. + + + + + **99.9%** of the time it contains crack requests and banned members... + + +### Member Statistics + +- **31,487** Total Members +- **7,713** Most Online +- ![zerigue](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362c496%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +**zerigue** Newest Member · 3 hours ago3 hr + + +- [Existing user? Sign In](https://forum.tuts4you.com/login/) +- [Sign Up](https://forum.tuts4you.com/register/) + +Search + +Where: + + +EverywhereTopicsFilesPagesArticle + +Search: + + +Content titles and bodyContent titles only + +Date Created: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Use: + + +All of these wordsAny of these words + +Last Updated: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Search... + +Search + +Search + +Search by content type + +EverywhereTopicsFilesPagesArticle + +Find results in + +Search titles and bodySearch titles only + +Date Created + +Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year + +Last Updated + +Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year + +Close + +#### Configure browser push notifications + +Close + +Chrome Safari Edge Firefox + +##### Chrome (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions → Notifications**. +3. Adjust your preference. + +##### Chrome (Desktop) + +1. Click the padlock icon in the address bar. +2. Select **Site settings**. +3. Find **Notifications** and adjust your preference. + +##### Safari (iOS 16.4+) + +1. Ensure the site is installed via **Add to Home Screen**. +2. Open **Settings App → Notifications**. +3. Find your app name and adjust your preference. + +##### Safari (macOS) + +1. Go to **Safari → Preferences**. +2. Click the **Websites** tab. +3. Select **Notifications** in the sidebar. +4. Find this website and adjust your preference. + +##### Edge (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions**. +3. Find **Notifications** and adjust your preference. + +##### Edge (Desktop) + +1. Click the padlock icon in the address bar. +2. Click **Permissions for this site**. +3. Find **Notifications** and adjust your preference. + +##### Firefox (Android) + +1. Go to **Settings → Site permissions**. +2. Tap **Notifications**. +3. Find this site in the list and adjust your preference. + +##### Firefox (Desktop) + +1. Open Firefox Settings. +2. Search for **Notifications**. +3. Find this site in the list and adjust your preference. \ No newline at end of file diff --git a/research-what-we-did/forum-reversing/forum-reversing_2026-09-27.md b/research-what-we-did/forum-reversing/forum-reversing_2026-09-27.md new file mode 100644 index 0000000..9d69989 --- /dev/null +++ b/research-what-we-did/forum-reversing/forum-reversing_2026-09-27.md @@ -0,0 +1,813 @@ +[Skip to content](https://forum.tuts4you.com/#ipsLayout__main) + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +View in the app + +A better way to browse. **Learn more**. + +Learn more×DismissClose + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +Tuts 4 You + +A full-screen app on your home screen with push notifications, badges and more. + +To install this app on iOS and iPadOS + +1. Tap the Share icon in Safari +2. Scroll the menu and tap **Add to Home Screen**. +3. Tap **Add** in the top-right corner. + +To install this app on Android + +1. Tap the 3-dot menu (⋮) in the top-right corner of the browser. +2. Tap **Add to Home screen** or **Install app**. +3. Confirm by tapping **Install**. + +[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/) + +- Sign In + +1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category + + + +1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + + ### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + Very important! Please read before sign up and posting... + + + + + + - [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/) + - [Downloads](https://forum.tuts4you.com/forum/152-downloads/) + - [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/) + - [Telegram](https://forum.tuts4you.com/forum/158-telegram/) + +1,065,508 visits to this link + +2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category + + + +1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + + ### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + General and off-topic conversations and discussions here... + + + + + + + + - 15.9k posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Is there any AI model we can use without message limitations?](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Is there any AI model we can use without message limitations?") + +Progman, + + +[Friday at 01:40 PM1 day](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Go to last post") + +2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + + ### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + Discussions covering scene news and changes... + + + + + + - [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/) + - [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/) + + - 11k posts + +![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png) + +[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie") + +RADIOX, + + +[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post") + +3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + + ### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + Bugs, feedback and ideas regarding this site... + + + + + + + + - 2.3k posts + +![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png) + +[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage") + +Teddy Rogers, + + +[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post") + +3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category + + + +1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + + ### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + Programming and coding tips, help and solutions... + + + + + + + + - 13k posts + +![Raggy](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23626dc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Realistic Water Effect When Touched by Mouse.](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Realistic Water Effect When Touched by Mouse.") + +Raggy, + + +[13 hours ago13 hr](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Go to last post") + +2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + + ### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + Share an interesting blog, news page or other resource... + + + + + + + + - 474 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github") + +Erich Gropper, + + +[Friday at 03:40 PM1 day](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post") + +3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + + ### [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + Securing your software against reverse engineering... + + + + + + + + - 990 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?") + +Erich Gropper, + + +[Friday at 03:44 PM1 day](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "Go to last post") + +4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category + + + +1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + + ### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + Try a challenge or contribute your own, any platform or operating system... + + + + + + - [CrackMe](https://forum.tuts4you.com/forum/145-crackme/) + - [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/) + - [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/) + - [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/) + + - 15.1k posts + +![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)") + +hamzadutsher, + + +[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post") + +2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + + ### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + Reverse engineering of circuitry hardware and firmware... + + + + + + + + - 259 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project") + +Erich Gropper, + + +[Friday at 03:47 PM1 day](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post") + +3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + + ### [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + Discussions on network security, holes, exploits and other issues... + + + + + + + + - 455 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???") + +Erich Gropper, + + +[9 hours ago9 hr](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post") + +4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + + ### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + Debugging, disassembling and documenting interesting malware... + + + + + + + + - 1.7k posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?") + +Erich Gropper, + + +[9 hours ago9 hr](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post") + +5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + + ### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + Share an interesting blog, news page or other RE related site... + + + + + + + + - 2.6k posts + +![adicto](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23628ac4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EA%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Flare-On 13](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Flare-On 13") + +adicto, + + +[21 minutes ago21 min](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Go to last post") + +6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + + ### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + Discussions on employment and career paths in the industry... + + + + + + + + - 213 posts + +![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project") + +zahainesu, + + +[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post") + +5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category + + + +1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + + ### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + Development and support forum for the Scylla project... + + + + + + + + - 506 posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source") + +Progman, + + +[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post") + +2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + + ### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + An open-source x64/x32 debugger for windows... + + + + + + + + - 1.3k posts + +![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi") + +remek002, + + +[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post") + +3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + + ### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + Looking for support and interested partners for a future project? + + + + + + + + - 151 posts + +![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg) + +[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler") + +Dax, + + +[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post") + +4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + ### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + Old and inactive projects moved to long term support... + + + + + + + - [uPPP](https://forum.tuts4you.com/forum/120-uppp/) + - [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/) + - [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/) + + - 832 posts + +![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide") + +devsat-dz, + + +[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post") + +6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category + + + +1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + ### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + This is where all the bad posts go. + + + + + **99.9%** of the time it contains crack requests and banned members... + + +### Member Statistics + +- **31,496** Total Members +- **7,713** Most Online +- ![Memo56](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2365c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EM%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +**Memo56** Newest Member · 4 hours ago4 hr + + +- [Existing user? Sign In](https://forum.tuts4you.com/login/) +- [Sign Up](https://forum.tuts4you.com/register/) + +Search + +Where: + + +EverywhereTopicsFilesPagesArticle + +Search: + + +Content titles and bodyContent titles only + +Date Created: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Use: + + +All of these wordsAny of these words + +Last Updated: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Search... + +Search + +Search + +Search by content type + +EverywhereTopicsFilesPagesArticle + +Find results in + +Search titles and bodySearch titles only + +Date Created + +Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year + +Last Updated + +Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year + +Close + +#### Configure browser push notifications + +Close + +Chrome Safari Edge Firefox + +##### Chrome (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions → Notifications**. +3. Adjust your preference. + +##### Chrome (Desktop) + +1. Click the padlock icon in the address bar. +2. Select **Site settings**. +3. Find **Notifications** and adjust your preference. + +##### Safari (iOS 16.4+) + +1. Ensure the site is installed via **Add to Home Screen**. +2. Open **Settings App → Notifications**. +3. Find your app name and adjust your preference. + +##### Safari (macOS) + +1. Go to **Safari → Preferences**. +2. Click the **Websites** tab. +3. Select **Notifications** in the sidebar. +4. Find this website and adjust your preference. + +##### Edge (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions**. +3. Find **Notifications** and adjust your preference. + +##### Edge (Desktop) + +1. Click the padlock icon in the address bar. +2. Click **Permissions for this site**. +3. Find **Notifications** and adjust your preference. + +##### Firefox (Android) + +1. Go to **Settings → Site permissions**. +2. Tap **Notifications**. +3. Find this site in the list and adjust your preference. + +##### Firefox (Desktop) + +1. Open Firefox Settings. +2. Search for **Notifications**. +3. Find this site in the list and adjust your preference. \ No newline at end of file diff --git a/research-what-we-did/forum-reversing/forum-reversing_2026-09-28.md b/research-what-we-did/forum-reversing/forum-reversing_2026-09-28.md new file mode 100644 index 0000000..0256144 --- /dev/null +++ b/research-what-we-did/forum-reversing/forum-reversing_2026-09-28.md @@ -0,0 +1,813 @@ +[Skip to content](https://forum.tuts4you.com/#ipsLayout__main) + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +View in the app + +A better way to browse. **Learn more**. + +Learn more×DismissClose + +![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png) + +Tuts 4 You + +A full-screen app on your home screen with push notifications, badges and more. + +To install this app on iOS and iPadOS + +1. Tap the Share icon in Safari +2. Scroll the menu and tap **Add to Home Screen**. +3. Tap **Add** in the top-right corner. + +To install this app on Android + +1. Tap the 3-dot menu (⋮) in the top-right corner of the browser. +2. Tap **Add to Home screen** or **Install app**. +3. Confirm by tapping **Install**. + +[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/) + +- Sign In + +1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category + + + +1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + + ### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/) + + + + + + + + Very important! Please read before sign up and posting... + + + + + + - [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/) + - [Downloads](https://forum.tuts4you.com/forum/152-downloads/) + - [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/) + - [Telegram](https://forum.tuts4you.com/forum/158-telegram/) + +1,065,525 visits to this link + +2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category + + + +1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + + ### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/) + + + + + + + + General and off-topic conversations and discussions here... + + + + + + + + - 15.9k posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[whoknows News!](https://forum.tuts4you.com/topic/42778-whoknows-news/ "whoknows News!") + +Erich Gropper, + + +[8 hours ago8 hr](https://forum.tuts4you.com/topic/42778-whoknows-news/ "Go to last post") + +2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + + ### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/) + + + + + + + + Discussions covering scene news and changes... + + + + + + - [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/) + - [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/) + + - 11k posts + +![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png) + +[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie") + +RADIOX, + + +[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post") + +3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + + ### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/) + + + + + + + + Bugs, feedback and ideas regarding this site... + + + + + + + + - 2.3k posts + +![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png) + +[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage") + +Teddy Rogers, + + +[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post") + +3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category + + + +1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + + ### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/) + + + + + + + + Programming and coding tips, help and solutions... + + + + + + + + - 13k posts + +![Raggy](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23626dc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Realistic Water Effect When Touched by Mouse.](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Realistic Water Effect When Touched by Mouse.") + +Raggy, + + +[Saturday at 11:05 AM1 day](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Go to last post") + +2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + + ### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/) + + + + + + + + Share an interesting blog, news page or other resource... + + + + + + + + - 475 posts + +![whoknows](https://forum.tuts4you.com/uploads/monthly_2024_01/avatar1.thumb.jpg.34724bdfbd3ed5b434bd6f7fc7c097b9.jpg) + +[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github") + +whoknows, + + +[3 hours ago3 hr](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post") + +3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + + ### [Software Security](https://forum.tuts4you.com/forum/133-software-security/) + + + + + + + + Securing your software against reverse engineering... + + + + + + + + - 990 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?") + +Erich Gropper, + + +[Friday at 03:44 PM2 days](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "Go to last post") + +4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category + + + +1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + + ### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/) + + + + + + + + Try a challenge or contribute your own, any platform or operating system... + + + + + + - [CrackMe](https://forum.tuts4you.com/forum/145-crackme/) + - [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/) + - [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/) + - [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/) + + - 15.1k posts + +![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)") + +hamzadutsher, + + +[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post") + +2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + + ### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/) + + + + + + + + Reverse engineering of circuitry hardware and firmware... + + + + + + + + - 259 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project") + +Erich Gropper, + + +[Friday at 03:47 PM2 days](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post") + +3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + + ### [Network Security](https://forum.tuts4you.com/forum/122-network-security/) + + + + + + + + Discussions on network security, holes, exploits and other issues... + + + + + + + + - 455 posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???") + +Erich Gropper, + + +[Saturday at 03:49 PM1 day](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post") + +4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + + ### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/) + + + + + + + + Debugging, disassembling and documenting interesting malware... + + + + + + + + - 1.7k posts + +![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg) + +[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?") + +Erich Gropper, + + +[Saturday at 03:52 PM1 day](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post") + +5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + + ### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/) + + + + + + + + Share an interesting blog, news page or other RE related site... + + + + + + + + - 2.7k posts + +![crap](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23627fc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EC%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Flare-On 13](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Flare-On 13") + +crap, + + +[23 minutes ago23 min](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Go to last post") + +6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + + ### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/) + + + + + + + + Discussions on employment and career paths in the industry... + + + + + + + + - 213 posts + +![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project") + +zahainesu, + + +[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post") + +5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category + + + +1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + + ### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/) + + + + + + + + Development and support forum for the Scylla project... + + + + + + + + - 506 posts + +![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png) + +[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source") + +Progman, + + +[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post") + +2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + + ### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/) + + + + + + + + An open-source x64/x32 debugger for windows... + + + + + + + + - 1.3k posts + +![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi") + +remek002, + + +[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post") + +3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + + ### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/) + + + + + + + + Looking for support and interested partners for a future project? + + + + + + + + - 154 posts + +![Bartosz](https://forum.tuts4you.com/uploads/monthly_2018_05/pelock-120.thumb.png.acaeecdb5611c9d816d72e15da9a5c8c.png) + +[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler") + +Bartosz, + + +[2 hours ago2 hr](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post") + +4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + ### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/) + + + + + + + + + Old and inactive projects moved to long term support... + + + + + + + - [uPPP](https://forum.tuts4you.com/forum/120-uppp/) + - [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/) + - [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/) + + - 832 posts + +![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide") + +devsat-dz, + + +[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post") + +6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category + + + +1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + ### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/) + + + + + + + + + This is where all the bad posts go. + + + + + **99.9%** of the time it contains crack requests and banned members... + + +### Member Statistics + +- **31,511** Total Members +- **7,713** Most Online +- ![67jkawbgk](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23939393%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3E6%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) + +**67jkawbgk** Newest Member · 29 minutes ago29 min + + +- [Existing user? Sign In](https://forum.tuts4you.com/login/) +- [Sign Up](https://forum.tuts4you.com/register/) + +Search + +Where: + + +EverywhereTopicsFilesPagesArticle + +Search: + + +Content titles and bodyContent titles only + +Date Created: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Use: + + +All of these wordsAny of these words + +Last Updated: + + +Any datePast 24 hoursPast weekPast monthPast six monthsPast year + +Search... + +Search + +Search + +Search by content type + +EverywhereTopicsFilesPagesArticle + +Find results in + +Search titles and bodySearch titles only + +Date Created + +Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year + +Last Updated + +Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year + +Close + +#### Configure browser push notifications + +Close + +Chrome Safari Edge Firefox + +##### Chrome (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions → Notifications**. +3. Adjust your preference. + +##### Chrome (Desktop) + +1. Click the padlock icon in the address bar. +2. Select **Site settings**. +3. Find **Notifications** and adjust your preference. + +##### Safari (iOS 16.4+) + +1. Ensure the site is installed via **Add to Home Screen**. +2. Open **Settings App → Notifications**. +3. Find your app name and adjust your preference. + +##### Safari (macOS) + +1. Go to **Safari → Preferences**. +2. Click the **Websites** tab. +3. Select **Notifications** in the sidebar. +4. Find this website and adjust your preference. + +##### Edge (Android) + +1. Tap the lock icon next to the address bar. +2. Tap **Permissions**. +3. Find **Notifications** and adjust your preference. + +##### Edge (Desktop) + +1. Click the padlock icon in the address bar. +2. Click **Permissions for this site**. +3. Find **Notifications** and adjust your preference. + +##### Firefox (Android) + +1. Go to **Settings → Site permissions**. +2. Tap **Notifications**. +3. Find this site in the list and adjust your preference. + +##### Firefox (Desktop) + +1. Open Firefox Settings. +2. Search for **Notifications**. +3. Find this site in the list and adjust your preference. \ No newline at end of file diff --git a/research-what-we-did/gh-reverse-catalog.json b/research-what-we-did/gh-reverse-catalog.json new file mode 100644 index 0000000..b9eaa53 --- /dev/null +++ b/research-what-we-did/gh-reverse-catalog.json @@ -0,0 +1,124 @@ +{ + "generated": "2026-09-27T01:18:41+00:00", + "repos": [ + { + "url": "https://github.com/open-free-llm-api/awesome-freellm-apis", + "stars": 3372, + "updated": "2026-09-27T01:05:15Z", + "desc": "134+ free LLM APIs & AI API keys from 40+ providers. Google Gemini, NVIDIA NIM, Groq, OpenRouter & more. One-click setup for Claude Code, Cursor and Codex.", + "category": "claude" + }, + { + "url": "https://github.com/dwgx/WindsurfAPI", + "stars": 3039, + "updated": "2026-09-26T15:55:20Z", + "desc": "Turn Windsurf / Devin Desktop's 100+ AI models (Claude, GPT, Gemini, DeepSeek, Kimi, GLM, SWE) into OpenAI-, Anthropic- & Gemini-compatible APIs. Zero-dependency self-hosted reverse proxy for Claude Code, Cline & Cursor. 把 Windsurf/Devin 云端 100+ 模型变成三套兼容 API。", + "category": "windsurf" + }, + { + "url": "https://github.com/caozhiyuan/copilot-api", + "stars": 1049, + "updated": "2026-09-27T01:01:48Z", + "desc": "GitHub Copilot, OpenAI Codex, OpenCode Go, and third-party AI provider gateway with OpenAI and Anthropic API compatibility.", + "category": "copilot" + }, + { + "url": "https://github.com/sylearn/AIUsage", + "stars": 686, + "updated": "2026-09-26T10:31:59Z", + "desc": "One dashboard to manage all your AI subscriptions — track quotas, costs, accounts, Claude Code proxy, and Codex proxy in one place.", + "category": "claude" + }, + { + "url": "https://github.com/raine/claude-code-proxy", + "stars": 620, + "updated": "2026-09-26T23:20:02Z", + "desc": "Use Claude Code with your ChatGPT, Kimi, Cursor or Grok subscription via a local Anthropic-compatible proxy", + "category": "claude" + }, + { + "url": "https://github.com/timgordontg/engrim", + "stars": 291, + "updated": "2026-09-26T17:35:55Z", + "desc": "The Universal Cross-Model Episodic Memory Standard. Local-first, project-scoped SQLite engine for Google Antigravity, Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, and OpenCode. Zero cloud lock-in.", + "category": "copilot" + }, + { + "url": "https://github.com/ClawLabsAI/free-ai-models", + "stars": 159, + "updated": "2026-09-27T00:20:17Z", + "desc": "Daily-updated list of free AI models (free LLM APIs), ranked by quality with live status. Plus one OpenAI-compatible endpoint that routes to the best one.", + "category": "gpt" + }, + { + "url": "https://github.com/baicaigpt/FreeGPT_FreeApiKey", + "stars": 35, + "updated": "2026-08-21T07:32:47Z", + "desc": "🚀 白菜GPT|OpenAI中转APIKEY🚀 https://baicaigpt.com 🔥官方价格1:1🔥 1￥购买1$ Token 🔥便宜好用白菜价！🔥|国内直连|无需代理|高速稳定|gpt3.5|gpt4|gpt4o|gpt4omin", + "category": "gpt" + }, + { + "url": "https://github.com/mvalentsev/awesome-free-ai-coding", + "stars": 33, + "updated": "2026-09-26T13:28:06Z", + "desc": "📡 Legal free LLM APIs & coding agents — self-updating, probe-verified twice a week. Free tiers, no-card trials, free models.", + "category": "other-free" + }, + { + "url": "https://github.com/nherx/free-llm-api-resources", + "stars": 30, + "updated": "2026-09-27T00:15:37Z", + "desc": "🤖 Discover free API access and credits for various legitimate large language model services in one curated resource list.", + "category": "other-free" + }, + { + "url": "https://github.com/sozercan/vekil", + "stars": 21, + "updated": "2026-09-26T21:55:20Z", + "desc": "🧑‍💼 AI gateway exposing Anthropic, Gemini, and OpenAI-compatible APIs, backed by GitHub Copilot, OpenAI Codex, Microsoft Foundry, and compatible model servers", + "category": "copilot" + }, + { + "url": "https://github.com/ai-dev-2024/Antigravity-Claude-Code-Proxy", + "stars": 13, + "updated": "2026-09-23T20:22:01Z", + "desc": "Local multi-provider gateway for using Claude Code with Gemini, GPT, Grok, and other models, with account rotation and monitoring.", + "category": "antigravity" + }, + { + "url": "https://github.com/imbuxiangnan-cyber/windsurf-api", + "stars": 7, + "updated": "2026-06-29T08:42:06Z", + "desc": "Turn your Windsurf subscription into an OpenAI/Anthropic-compatible API server", + "category": "windsurf" + }, + { + "url": "https://github.com/happyyboxx/free-llm-atlas", + "stars": 7, + "updated": "2026-09-26T10:35:50Z", + "desc": "Free LLM Atlas — Curated atlas of 46+ free LLM API platforms with automated probing, structured data, and gateway configs", + "category": "other-free" + }, + { + "url": "https://github.com/ai-resource-radar/ai-resource-radar", + "stars": 5, + "updated": "2026-09-26T06:09:24Z", + "desc": "Daily-verified free LLM APIs, AI token prices, and GPU compute deals with no-card filters, official evidence, and a local-first dashboard.", + "category": "other-free" + }, + { + "url": "https://github.com/the-long-ride/QuotaShift", + "stars": 1, + "updated": "2026-09-26T21:25:16Z", + "desc": "A tauri desktop app for monitoring AI subscription quota usage, switching account with 1 click and pooling Codex usage. Support Codex, Antigravity & Claude. Guardrails usage for Claude.", + "category": "antigravity" + }, + { + "url": "https://github.com/devasheeshG/claude-code-proxy", + "stars": 0, + "updated": "2026-09-26T11:53:03Z", + "desc": "Self-hosted multi-account Claude Code proxy with priority routing, quota-aware failover, user policies, observability, and a management dashboard.", + "category": "claude" + } + ] +} \ No newline at end of file diff --git a/research-what-we-did/rea-full-course-source.md b/research-what-we-did/rea-full-course-source.md new file mode 100644 index 0000000..232245c --- /dev/null +++ b/research-what-we-did/rea-full-course-source.md @@ -0,0 +1,586 @@ +# Реверс-инжиниринг: как получить что угодно БЕСПЛАТНО с самым опасным репо и Opus 5.5 — полный курс + +![](https://pbs.twimg.com/media/HUbbxvhXIAAugl8.jpg) + +REA + Opus 5.5: полный курс + +REA — самая опасная вещь в интернете прямо сейчас, и 99% людей понятия не имеют, как ей пользоваться. + +Ты каждый месяц платишь за приложения, чьи функции уже лежат на твоём компьютере. + +Motion-design приложения. Office. TradingView. Твой блокнот и остальные — всё это просто код на диске. + +И каждая компания ставит на одно: что ты никогда не заглянешь внутрь. + +Теперь один open-source репо даёт твоему Claude Code тот же навык — одной командой. + +За три дня это разлетелось везде. «Софт закончился». «Closed source мёртв». + +Большинство посмотрели скриншоты, кинули в закладки — и так ничего и не попробовали. + +Поэтому в этом полном курсе показываю всё простыми словами: + +- что такое реверс-инжиниринг на самом деле +- что REA умеет читать — от десктопных приложений до игр +- честный ответ на «разве это не воровство?» +- как установить пошагово, прямо по официальным докам +- что люди уже пересобрали: Adobe, Office, TradingView, игры +- как это каждый день использует обычный человек и профи +- пак промтов, которые можно копипастить + +Так что сохрани, открой терминал и проходи шаг за шагом. + +* * * + +### Часть 1 — Понять + +#### 01. Что такое реверс-инжиниринг (и что такое REA) + +Реверс-инжиниринг на самом деле прост. + +> Берёшь готовое приложение и разбираешься, как оно работает внутри — без его исходников. + +Вот и всё. Ты хочешь понять фичу настолько, чтобы объяснить её, изменить или собрать собственную версию. + +REA (Reverse Engineer Anything) делает ровно это, причём тяжёлую часть выполняет твой AI-агент. Официальный README описывает это одной строкой: + +> «Увидел фичу, которая нравится. Понял, как она работает — вплоть до бинарного уровня». + +Технически это: + +- MCP-сервер + CLI, который подключается к Claude Code, Codex, Cursor, Gemini CLI и другим агентам +- работает локально. Твои приложения никуда не загружаются +- каждый вывод идёт с доказательством: функция, файл, вызов — и что ещё осталось неизвестным + +Ты спрашиваешь обычными словами. REA исследует программу. Агент объясняет её, собирает твою версию и тестирует. [Репо REA](https://github.com/morluto/rea) + +Лучший пример — на официальном сайте. Почему калькулятор Windows показывает 220, когда вводишь 200 + 10%? + +Без REA пришлось бы вручную декодировать ветки и трейсить вызовы. С REA ты просто спрашиваешь. + +Ответ прямо из кода: после + кнопка % берёт процент от первого числа. 10% от 200 это 20, значит 200 + 20 = 220. А после × те же 10% просто превращаются в 0.1. [rea.tools](https://rea.tools/) + +Или почему динозаврик в Chrome ускоряется: скорость стартует с 6, каждый апдейт добавляет 0.001 и останавливается на 13. + +> Ты не читаешь код. Ты задаёшь вопрос — и получаешь правило. + +REA — open source под MIT, сделал [@morluto](https://x.com/morluto). Первый релиз вышел 12 июля 2026. Через три месяца — 100K+ звёзд на GitHub. + +* * * + +#### 02. Что REA умеет читать + +Официальный список, переведённый на человеческий ([что можно анализировать](https://github.com/morluto/rea#what-you-can-analyze)): + +- Десктопные приложения на JavaScript/Electron (Notion, Slack, Discord, Obsidian и ещё куча). Ничего дополнительно ставить не нужно +- Сайты: структура страниц, скрипты, сетевые запросы. Нужен браузер семейства Chrome +- Сохранённый сетевой трафик (HAR-файлы из твоего браузера) +- Программы и игры (.exe, Mac-приложения, старые DOS-игры): псевдокод, ассемблер, строки, вызовы. Нужен Ghidra, Hopper или IDA +- .NET-приложения: никаких доп. тулов +- Android-приложения (APK): нужны JDK и JADX +- Байткод смарт-контрактов: Linux x64 +- Прошивки, WASM, Go-бинарники и многое другое + +А вот часть, о которой почти никто не говорит: + +Многие Unity-игры поставляют игровую логику как .NET-код. И REA читает .NET вообще без дополнительных инструментов. + +Именно так один человек взял купленную им игру из Steam и открыл её в Unity меньше чем за 30 минут. + +То есть теперь агент делает за тебя всю работу. + +* * * + +#### 03. Подождите… это же просто воровство? + +Поговорим о слоне в комнате. + +В момент, когда REA завирусилась, половина X кричала «пиратство», а вторая половина — «софт умер». + +Chamath вообще сказал на All-In, что люди «декомпилировали» весь пакет Adobe. + +И вот смешная часть. Этот фрагмент получил Community Note: + +> Альтернативы Adobe не были декомпилированы. Их разработчик называет их clean-room реимплементациями. + +Эта одна заметка объясняет всю юридическую игру. Разберём clean room, потому что когда поймёшь — всё встанет на места. + +**Clean room — трюк, которому 40 лет.** + +Шаг 1: одна команда изучает оригинал и записывает, что он делает. Не код. Поведение. + +Шаг 2: другая команда строит новый продукт только по этому описанию. Оригинальный код она не видит никогда. + +Результат делает то же самое, но содержит ноль строк кода оригинала. [Clean-room design](https://en.wikipedia.org/wiki/Clean-room_design) + +Так родилась индустрия PC. В начале 80-х Compaq таким способом пересобрала BIOS IBM — за примерно $1 млн. Поэтому «IBM-совместимые» PC других брендов вообще существуют. + +И суды продолжали поддерживать реверс-инжиниринг: + +- ['1992, ', {'tag': 'b', 'children': ['Sega v. Accolade']}, '. Accolade разобрала игры Sega Genesis, чтобы делать свои совместимые игры. Суд признал: разбор кода может быть добросовестным использованием, если это единственный способ понять, как он работает. ', {'tag': 'a', 'attrs': {'href': 'https://en.wikipedia.org/wiki/Sega_v._Accolade'}, 'children': ['Sega v. Accolade']}] +- ['2000, ', {'tag': 'b', 'children': ['Sony v. Connectix']}, '. Sony проиграла со счётом 3-0. Финальный эмулятор не содержал ни строчки кода Sony.'] + +Но у истории есть и вторая сторона. + +В 2010-2011 хакеры сломали защиту PS3 и опубликовали её root-ключ. Sony подала в суд на Джорджа Хотца (geohot), и в апреле 2011 он заключил мировую и согласился больше не взламывать продукты Sony. [TechSpot](https://www.techspot.com/news/43246-sony-and-geohot-settle-over-ps3-hacking-lawsuit.html) + +**Мой честный взгляд:** + +- Читать приложение на собственном компьютере, чтобы понять его — это учёба +- Пересобирать фичу по её поведению, в собственном коде — так индустрия работала всегда +- Копировать их код, крякать платные функции или публиковать чужой декомпилированный сорс — вот за это прилетает иск + +Команда REA сама говорит прямо: это для законных исследований, образования, совместимости, сохранения софта — и для программ, которыми ты владеешь или которые тебе разрешено изучать. [Disclaimer](https://github.com/morluto/rea#disclaimer) + +**Изучай оригинал. Выпускай своё. **Это правило для всего в этой статье. + +* * * + +### Часть 2 — Установить + +#### 04. Установка REA за 5 минут + +Проходи по порядку. [Get started](https://rea.tools/get-started/) + +**Шаг 1. Проверь Node.js** + +Открой терминал и запусти: + +``` +node -v +npm -v +``` + +Нужен Node 22.19+, 24.11+ или 26+. Версии 23 и 25 не поддерживаются. + +Если версия старше или «command not found» — ставь Node 24 LTS: + +macOS (с Homebrew): + +``` +brew install node +``` + +macOS (без Homebrew): + +``` +curl -fsSL https://fnm.vercel.app/install | bash +``` + +Закрой терминал, открой снова, затем: + +``` +fnm install 24 +fnm default 24 +``` + +Windows (PowerShell): + +``` +winget install OpenJS.NodeJS.LTS +``` + +Если спросит — нажми Y. Закрой PowerShell, открой заново, запусти node -v. + +Если Windows потом скажет «запуск сценариев отключён», выполни один раз: + +``` +Set-ExecutionPolicy -Scope CurrentUser RemoteSigned +``` + +**Шаг 2. Нужен агент** + +Я использую Claude Code. Ему нужен платный план Claude. Страница установки: [code.claude.com/docs/en/setup](https://code.claude.com/docs/en/setup) + +Codex, Cursor, Gemini CLI, OpenCode и другие тоже работают. + +**Шаг 3. Запусти установку REA** + +Самый простой способ — вставь это в Claude Code и дай ему сделать всё самому: + +``` +Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation. +``` + +Или запусти сам: + +``` +npx rea-agents@latest setup +``` + +Что произойдёт дальше: + +- npm попросит скачать пакет — соглашайся +- REA покажет список агентов. Выбирай Claude Code +- REA покажет план всех изменений, которые внесёт. Ничего не меняется, пока не подтвердишь. Текущий конфиг тоже бэкапится +- Добавляется MCP-подключение плюс соответствующий скилл расследования + +Установка также предложит Hopper — отдельный движок для чтения программ. На Mac она скачает официальный инсталлятор и откроет его, там выбери demo-режим. Это опционально, можно пока отказаться. + +**Шаг 4. Перезапусти агента** + +- Claude Code в терминале: выйди и начни новую сессию +- Десктопные приложения (Claude Desktop, Cursor): выйди полностью через ⌘Q. Закрыть окно — недостаточно + +**Шаг 5. Проверь** + +``` +npx -y rea-agents@latest doctor --client claude_code --json +``` + +doctor только проверяет и ничего не меняет. Если что-то отвалилось — он скажет следующий шаг. + +Хочешь короткую команду rea навсегда: + +``` +npm install --global rea-agents +rea --help +``` + +Результат: в Claude Code появились инструменты REA. Спроси «какие у тебя есть REA-тулы?» — и он перечислит их. + +* * * + +#### 05. Твой первый реверс-инжиниринг за 2 минуты + +Не начинай с чего-то огромного. У REA есть официальное тренировочное приложение — [First investigation](https://rea.tools/first-investigation/) + +Это крошечное приложение «Заметки» с кнопкой Export notes. Твоя задача: выяснить, куда уходит экспорт. + +Вставь в Claude Code: + +``` +Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes. +``` + +Потом спроси: + +``` +Show where notes.csv is written, which fields it contains, and the relevant files and lines. +``` + +Что должно прийти обратно — полный путь одного клика: + +- Страница (renderer.js) обрабатывает кнопку +- Мост (preload.js) отправляет сообщение notes:export +- Хендлер (main.js) пишет notes.csv в твою папку Downloads с полями id и title +> Поздравляю. Это и есть реверс-инжиниринг. + +Ты только что проследил фичу внутри приложения, которое не писал, — и каждый шаг пришёл с доказательством. + +А теперь весёлая часть. Каждое Electron-приложение на твоём компе устроено так же, и ты знаешь, где оно живёт: + +- Mac: /Applications/.app/Contents/Resources/app.asar (правый клик по приложению → Show Package Contents) +- Windows: C:\Users\<ты>\AppData\Local\Programs\\resources\app.asar +- Linux: часто /opt//resources/app.asar + +И можно анализировать прямо из терминала, вообще не запуская приложение: + +``` +npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json +``` + +Совет: на Mac зажми Option, кликни правой по папке и выбери «Copy as Pathname». Или просто перетащи папку в терминал. + +* * * + +#### 06. Добавь нужный движок под свою задачу + +Десктопным JavaScript-приложениям больше ничего не нужно. Для всего остального добавь один движок. + +**Программы и игры: Ghidra **(бесплатно, сделано в АНБ). Нужен Ghidra 12.1.x и JDK 21 или новее. + +macOS / Linux: + +``` +export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC +export JAVA_HOME=/absolute/path/to/jdk-21 +npx -y rea-agents@latest doctor --provider ghidra --json +npx rea-agents@latest setup +``` + +Windows PowerShell: + +``` +$env:GHIDRA_INSTALL_DIR = "C:/tools/ghidra_12.1.4_PUBLIC" +$env:JAVA_HOME = "C:/tools/jdk-21" +npx -y rea-agents@latest doctor --provider ghidra --json +npx rea-agents@latest setup +``` + +Поддержка Windows пока экспериментальная и только на чтение. + +Потом смотри любую функцию: + +``` +npx -y rea-agents@latest function /absolute/path/to/program main --provider ghidra --json +``` + +**Программы и игры: Hopper **(Mac/Linux, коммерческий, есть демо). Просто запусти setup ещё раз. Он найдёт Hopper или предложит установить. На Mac при первом запуске выбери demo-режим или свою лицензию. + +**Программы и игры: IDA **(если уже куплен). Проверено на Windows через существующую настройку IDA MCP. [Get started](https://rea.tools/get-started/) + +**Android-приложения: **полный JDK 17+ и jadx-headless-mcp 0.7.1. [Гайд по Android](https://github.com/morluto/rea/blob/main/docs/android-analysis.md) + +``` +export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar +rea inspect-android-package /path/App.apk +``` + +**Сайты: **любой браузер семейства Chrome. + +**Смарт-контракты: **Linux x64. + +Держи обновлённым (REA выкатывает фиксы почти каждый день): + +``` +rea update +``` + +или npx rea-agents@latest setup. Удалить: rea uninstall. + +Если агент не видит REA: перезапусти его, потом снова запусти doctor --client claude_code --json. + +* * * + +### Часть 3 — Что люди уже пересобрали + +#### 07. Adobe, Office, TradingView и игры + +Вот где начинается жесть. + +AI не просто научился читать софт. Люди уже пересобирают целые продукты. + +**Adobe** + +ArtCraft пересобрал семь приложений Adobe как бесплатные open-source альтернативы: Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign и Acrobat. Написано на Rust с помощью Claude Opus 5.5. + +Помнишь clean room? Вот оно. ArtCraft называет их clean-room реимплементациями — без исходного кода Adobe. Это пока ранняя альфа, но они существуют и они бесплатны. + +**Microsoft Office** + +Потом взялись за Office. WordCraft, GridCraft и DeckCraft: Word, Excel и PowerPoint. + +**TradingView** + +Этот кейс люблю. Смаппить, как платформа себя ведёт, превратить это в спеку с помощью Opus 5.5, а потом построить собственный движок графиков и бэктестер — своим кодом. + +Одна честная заметка: строить свой терминал — нормально. Бесплатно юзать чужие платные индикаторы — нет. Строй свои. + +**Игры** + +Здесь AI-реверс-инжиниринг рванул первым. + +Нативный PC-порт Super Mario Sunshine: около 365 агенто-часов и 17.3 млрд токенов, использовались и Claude, и Codex. [Репозиторий](https://github.com/chasem-dev/sms-pc-port) + +Игра Tomba! с PS1 теперь работает на PC через статический рекомпилятор. У автора не было никакого prior-опыта, он использовал Claude Code + Ghidra около трёх недель. [Разбор](https://1379.tech/i-built-a-ps1-static-recompiler-with-no-prior-experience-and-claude-code/) + +А в официальном блоге REA один человек с AI-агентами пересобрал игру Touhou: 697 функций, 696 точных совпадений, играбельно примерно за 12 дней. [Индустриальная революция в реверс-инжиниринге](https://rea.tools/blog/touhou-reconstruction/) + +Kotaku даже писал про браузерные версии Halo, GTA: Vice City и The Simpsons: Hit & Run, которые приписывают AI-помощи в декомпиляции. Это неофициальные порты, и их, скорее всего, снесут takedown-ами — это ровно та граница из главы выше. [Kotaku](https://kotaku.com/we-might-be-cooked-as-these-vibe-coded-web-browser-ports-of-halo-the-simpsons-hit-and-run-and-gta-vice-city-seem-to-work-perfectly-2000743300) + +**Как повторить любое из этого: **выбери тул, за который платишь, или игру, которой владеешь; спроси у REA, как работает одна фича; напиши спеку; собери свою версию. Промты — в шаге 10. + +* * * + +### Часть 4 — Используй каждый день + +Реверс-инжиниринг придумали для совместимости, безопасности и сохранения софта. Но вот как я бы использовал его в обычной жизни. + +#### 08. Для новичков + +**1. «Что это приложение реально делает на моём телефоне?»** + +Возьми APK любого Android-приложения: твоего брокера, твоей биржи, того самого приложения «бесплатных сигналов» из Telegram. И спроси: + +``` +Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding. +``` + +Официальное доказательство, что это работает: REA разобрала приложение-аутентификатор Aegis (3 077 классов), нашла в точности, как оно генерирует 6-значные коды входа, и пересобрала его. Пересборка прошла все 133 тест-кейса. [Кейс Aegis](https://rea.tools/showcase/aegis/) + +**2. «Этот файл безопасен?»** + +Реверс-инжиниринг — это как раз то, чем ловят малварь. Когда по сети ходила фейковая «сборка GTA 6» на 113 ГБ, человек, который разобрал файлы, обнаружил, что это фейк, набитый малварью. + +**3. «Этот токен — скам?»** + +Большинство мемкоинов не публикуют исходники. REA читает сырой байткод контракта и восстанавливает его функции. [Гайд по EVM](https://github.com/morluto/rea/blob/main/docs/evm-bytecode.md) + +``` +rea inspect-evm-interface ./runtime.hex hex --json +``` + +Потом спроси: + +``` +Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred. +``` + +Имена функций здесь — догадки из байткода, поэтому к красному флагу относись как к «проверь глубже». И эта команда пока работает только на Linux x64. + +**4. «Хочу ту платную фичу»** + +Не крякай её. Пересобери. Спроси у REA, как фича работает, потом дай Claude собрать твою собственную версию из публичных данных и open-source частей. + +* * * + +#### 09. Для профи + +В REA встроены guided-воркфлоу, о которых почти никто не знает. Они зашиты в MCP-сервер ([Guided prompts](https://github.com/morluto/rea/blob/main/docs/mcp-prompts.md)): + +- [{'tag': 'b', 'children': ['investigate_feature']}, ': проследить фичу от обнаружения до конкретных функций'] +- [{'tag': 'b', 'children': ['compare_application_versions']}, ': сравнить два релиза приложения и увидеть, что реально изменилось в апдейте'] +- [{'tag': 'b', 'children': ['verify_reconstruction']}, ': проверить свою пересборку против сохранённых доказательств'] +- [{'tag': 'b', 'children': ['trace_crash']}, ': связать креш с путями кода за ним'] +- [{'tag': 'b', 'children': ['audit_residual_unknowns']}, ': перечислить, что всё ещё не доказано'] +- [{'tag': 'b', 'children': ['prepare_bounded_process_capture']}, ': спланировать безопасный ограниченный runtime-эксперимент до того, как что-либо запускать'] + +Цикл профи: **investigate → spec → build → verify** + +``` +Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass. +``` + +Насколько далеко это заходит — из официальных показов: + +- ['DX-Ball (1996): REA восстановила функцию sound-pan и пересобрала её на C. Проходит 3 205 тест-кейсов оригинального x86 и воспроизводит все 63 байта компиляции. ', {'tag': 'a', 'attrs': {'href': 'https://rea.tools/showcase/dx-ball/'}, 'children': ['DX-Ball']}] +- ['Notion: REA проследила, как работает копирование — от страницы через IPC-мост до системного буфера обмена. ', {'tag': 'a', 'attrs': {'href': 'https://rea.tools/showcase/notion/'}, 'children': ['Notion']}] + +И уроки из пересборки Touhou — золото для любого, кто занимается этим серьёзно: + +- давай агенту чёткую цель и чёткие критерии приёмки +- держи заметки и проверки в git, чтобы следующая сессия могла продолжить +- относись к любому объяснению агента как к гипотезе, которую надо проверить +- тестируй свои тесты. Однажды сломанное сравнение пропустило неправильную функцию + +Безопасники уже гоняют это в промышленных масштабах. Один исследователь собрал AI-пайплайн из 8 MCP-серверов, 300+ инструментов, Ghidra, radare2 и Frida — и говорит, что он окупился через bug bounty. + +**Где деньги: **исследования безопасности и bug bounty, перенос старого софта на новые системы, связывание тулов между собой и помощь компаниям в понимании софта, к которому потеряны исходники. + +* * * + +#### 10. Чего REA не может + +Хочу, чтобы этой статье доверяли, поэтому вот реальные ограничения: + +- ['Она не может тронуть сервер. Читается только то, что на твоей машине. Код, который крутится на серверах компании, тебе никогда не поставлялся. Банк она не взломает и деньги не переведёт. ', {'tag': 'a', 'attrs': {'href': 'https://rafaelroman.com/articles/ai-reverse-engineering-cant-hack-your-bank/'}, 'children': ['Почему ею нельзя взломать банк']}] +- Декомпилированный код — не оригинальный исходник. Это реконструкция. Поэтому шаг verify так важен +- Сложные цели остаются сложными. Стрипанные C++-бинарники намного жёстче, чем Unity .NET-игры +- Твой агент может отказаться. Некоторые прошивки и консольные цели упираются в правила безопасности модели +- Коммерческим тулам нужны настоящие лицензии. REA не даёт лицензий на IDA, Hopper или JEB, а крякнутые копии запрещены + +* * * + +#### 11. Пак промтов + +Сохрани. Каждый промт работает в Claude Code, когда REA установлена. + +**Установка:** + +``` +Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation. +``` + +**Первый тест:** + +``` +Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes. +``` + +**Универсальный:** + +``` +Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project. +``` + +**Real-time фичи:** + +``` +Figure out how Discord shows who's typing in real time, show me the proof, and build something similar for my project. +``` + +**Калькулятор:** + +``` +Use REA to inspect Windows Calculator's % button. Recover the rules after + and ×, then build a small calculator that uses both. +``` + +**Игра:** + +``` +Inspect the dinosaur game and build a version with adjustable speed. +``` + +**Реконструировать игру:** + +``` +Reconstruct a game from its executable and test it against the original. +``` + +**Клонировать сайт:** + +``` +Clone the rea.tools website. +``` + +**Аудит мобильного приложения:** + +``` +Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding. +``` + +**Проверка токена:** + +``` +Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred. +``` + +**Профи-пересборка:** + +``` +Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass. +``` + +**Что изменилось в апдейте:** + +``` +Use REA's compare_application_versions workflow on [old version] and [new version] of [app]. Tell me what actually changed, with evidence. +``` + +* * * + +#### Твой протокол на один вечер + +Не просто кидай в закладки. Сделай это сегодня вечером: + +- Установи REA сетап-промтом (5 мин) +- Потренируйся на официальном примере Notes (2 мин) +- Выбери одно приложение на компе, которым пользуешься каждый день +- Задай один вопрос про одну фичу, которая тебе нравится +- Получи спеку: что она делает, шаг за шагом, с доказательствами +- Собери свою версию из спеки в новой папке +Вот и всё. Один вечер — и ты больше никогда не будешь смотреть на софт по-прежнему. + +* * * + +### Сдвиг + +> Closed source раньше означало «ты никогда не узнаешь» → теперь означает «покажи мне доказательства». + +> REA — не хакерский инструмент. + +> Это инструмент чтения софта, который написал не ты. + +И настоящая альфа — не 100K звёзд и не вирусные скриншоты. + +Настоящая альфа в том, что каждая фича, которой ты завидовал в чужом приложении, теперь — то, что ты можешь понять: + +- Пусть REA найдёт фичу и доказательства +- Пусть Claude напишет спеку и соберёт твою версию +- Пусть тесты докажут, что это работает + +Большинство продолжит платить за фичи, которые можно понять за один вечер. + +Те немногие, кто научится читать софт, смогут собрать что угодно. Абсолютно бесплатно. + diff --git a/research-what-we-did/rev-guide-v4-subpost.md b/research-what-we-did/rev-guide-v4-subpost.md new file mode 100644 index 0000000..fc65bda --- /dev/null +++ b/research-what-we-did/rev-guide-v4-subpost.md @@ -0,0 +1,24 @@ +🩸 К ГАЙДУ: КАК ЕГО ПРОЙТИ + +Гайд проверен целиком: все 102 ссылки живые, цифры (звёзды, число тулов, названия репозиториев и книг) сверены с первоисточниками, лицензионные ограничения помечены. Сверху добавлен раздел про лицензию IDA — в исходных версиях такого гайда его нет. + +🩸 ПЕРВЫЕ 7 ДНЕЙ + +Весь стек сразу не осилить — и не надо. Минимальный старт: + +1. Ghidra (https://github.com/NationalSecurityAgency/ghidra) + 2–3 задачи 1☆ с crackmes.one (https://crackmes.one/) +2. godbolt.org (https://godbolt.org/) — написал функцию на C → разобрал её ассемблер +3. x64dbg (https://x64dbg.com/) — своя программа: бряк, стек, регистры + +Потом pwn.college (https://pwn.college/) — система и автопроверка. + +🩸 ЧЕТЫРЕ ГВОЗДЯ + +- ИИ-агент декомпилирует и ходит по xrefs, но уверенно ошибается в именах функций. Крипто, C2, авторизация — только руками +- Упакованный сэмпл = мусор вместо псевдокода: распаковывай до подачи агенту +- «IDA с ключом из телеги» = бинарь, изменённый анонимом. Легально и бесплатно: IDA Free (https://hex-rays.com/ida-free/), Ghidra, студенческая лицензия Hex-Rays +- Строки в бинарнике могут быть промпт-инъекцией против твоего ИИ-ассистента (https://arxiv.org/abs/2605.30667) — малварь уже так умеет + +🩸 НЕ СПРИНТ + +Маршрут на месяцы: база → инструменты → 30+ crackme → система → пайплайн → ИИ → специализация. Сохраняй гайд и возвращайся к нему по шагам. \ No newline at end of file diff --git a/research-what-we-did/rev-guide-v4.md b/research-what-we-did/rev-guide-v4.md new file mode 100644 index 0000000..3b0fce8 --- /dev/null +++ b/research-what-we-did/rev-guide-v4.md @@ -0,0 +1,194 @@ +===MSG 1/4=== + +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 + +Путь от нуля до самостоятельного анализа бинарников: база, инструменты, пайплайн, реверс через ИИ, материалы. Всё бесплатное или с free-версией, лицензионные исключения помечены. + +🩸 ШАГ 1. БАЗА + +Без базы инструменты не дают результатов: + +- C — указатели, память, структуры, строки +- Ассемблер x86-64 — регистры, стек, calling conventions, переходы +- Compiler Explorer (https://godbolt.org/) — пишешь функцию на C, видишь её ассемблер +- Формат PE (https://learn.microsoft.com/windows/win32/debug/pe-format) — заголовки, секции, таблица импортов + +Результат: читаешь ассемблерный листинг простой функции. + +🩸 ШАГ 2. ИНСТРУМЕНТЫ + +- Ghidra (https://github.com/NationalSecurityAgency/ghidra) — дизассемблер + декомпилятор, бесплатный. Основной инструмент для обучения, скриптится на Python через Ghidrathon (https://github.com/mandiant/Ghidrathon) +- x64dbg (https://x64dbg.com/) — отладчик Windows +- Detect It Easy (https://github.com/horsicq/Detect-It-Easy) — определение компилятора, протектора, упаковщика +- HxD (https://mh-nexus.de/hxd/) — hex-редактор + +Позже пригодятся: IDA Pro (https://hex-rays.com/) — эталонный декомпилятор Hex-Rays; Binary Ninja (https://binary.ninja/) — API для автоматизации; radare2 (https://github.com/radareorg/radare2) / rizin (https://github.com/rizinorg/rizin) + Cutter (https://github.com/rizinorg/cutter) — консольный стек. + +Результат: рабочая среда — Ghidra, x64dbg, DIE. + +🩸 ШАГ 3. ПРАКТИКА + +Порядок: 15–20 задач 1☆, затем 10–15 задач 2☆, затем 3☆. + +- crackmes.one (https://crackmes.one/) — задачи по реверсу, сложность 1–6 +- ROP Emporium (https://ropemporium.com/) — exploitation по шагам + +Осваиваются: поиск точки входа, паттерн проверки пароля, простые анти-отладочные приёмы. + +Результат: самостоятельно разбираешь небольшой бинарь. + +🩸 ШАГ 4. СИСТЕМА + +- pwn.college (https://pwn.college/) — бесплатные модули от ASU: ассемблер, основы RE, автопроверка, 15–25 задач на модуль +- OpenSecurityTraining2 (https://p.ost2.fyi/) — реверс C++, символьное исполнение, отладчики, UEFI +- RE-MA-Roadmap (https://github.com/x86byte/RE-MA-Roadmap) — roadmap от нуля до malware-аналитика + +Результат: системная база для C++ и сложных форматов. + +🩸 ШАГ 5. ПАЙПЛАЙН АНАЛИЗА БИНАРЯ + +Порядок разбора реальных сэмплов. Перед запуском живого: виртуалка + снапшот, без общих папок и реальной сети. + +1. Триаж без запуска: DIE — упаковщик/компилятор; FLOSS (https://github.com/mandiant/flare-floss) — строки, включая обфусцированные; capa (https://github.com/mandiant/capa) — capabilities с маппингом на ATT&CK +2. Распаковка: натив — x64dbg до OEP, дамп, IAT чинит Scylla (https://github.com/NtQuery/Scylla); .NET — de4dot-форк (https://github.com/kant2002/de4dot), разбор в dnSpyEx (https://github.com/dnSpyEx/dnSpy); без запуска на живой системе — Qiling (https://github.com/qilingframework/qiling) +3. Статика: Ghidra/IDA — декомпиляция, xrefs, переименование +4. Динамика: отладчик для проверки гипотез; Frida (https://frida.re/) — хуки на функции, снятие конфигов +5. Деобфускация: D-810 (https://gitlab.com/eshard/d810) — MBA и flattening в декомпиляторе IDA; эмуляция и трейсинг — Unicorn (https://github.com/unicorn-engine/unicorn), Qiling, angr (https://github.com/angr/angr) +6. Поведение: FakeNet-NG (https://github.com/mandiant/flare-fakenet-ng) — перехват трафика; CAPEv2 (https://github.com/kevoreilly/capev2) — сэндбокс; Speakeasy (https://github.com/mandiant/speakeasy) — эмуляция малвари и драйверов без VM +7. Диффинг версий: BinDiff (https://github.com/google/bindiff) / Diaphora (https://github.com/joxeankoret/diaphora) — что изменил вендор, где была дыра +8. Выход: YARA-правило (https://github.com/VirusTotal/yara) — сигнатура; IOC и отчёт + +Результат: полный цикл разбора сэмпла — от триажа до YARA-правила. + +ШАГ 6 — реверс через ИИ — во 2-м и 3-м сообщениях. + +👻 [иишко](https://t.me/AlStack) + +===MSG 2/4=== + +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (2/4) + +🩸 ШАГ 6. РЕВЕРС ЧЕРЕЗ ИИ: MCP-СЕРВЕРЫ + +Как это работает: агент (Claude Code, Codex, Cursor, Gemini CLI) подключается к дизассемблеру или отладчику через MCP и сам декомпилирует, ходит по xrefs, переименовывает, ставит бряки, снимает конфиги. Роль человека — направлять и валидировать. + +IDA Pro: +- ida-pro-mcp (https://github.com/mrexodia/ida-pro-mcp) — 12.3к звёзд, от автора x64dbg: декомпиляция, xrefs, патчи, отладчик (включается ?ext=dbg) +- ida-mcp (https://github.com/HexRaysSA/ida-mcp) — официальный сервер Hex-Rays, MIT, требует IDA 9.4+ (https://docs.hex-rays.com/core/mcp) +- IDA-NO-MCP (https://github.com/P4nda0s/IDA-NO-MCP) — 2к звёзд: выгружает базу IDA в файлы для AI-клиента вместо verbose MCP +- ida-multi-mcp (https://github.com/MeroZemory/ida-multi-mcp) — несколько бинарей в одной сессии: дроппер, пейлоад, C2 рядом +- ida-mcp-rs (https://github.com/blacktop/ida-mcp-rs) — headless-сервер на Rust для пайплайнов + +Ghidra: +- GhidraMCP (https://github.com/LaurieWired/GhidraMCP) — 10.2к звёзд, классика от LaurieWired +- ghidra-mcp (https://github.com/bethington/ghidra-mcp) — 4к звёзд: 200+ тулов, GUI-плагин и headless, эмуляция p-code, Docker +- ReVa (https://github.com/cyberkaida/reverse-engineering-assistant) — 840 звёзд, заточен под длинные задачи, минимум потери контекста +- GhidrAssistMCP (https://github.com/symgraph/GhidrAssistMCP) — MCP внутри процесса Ghidra +- GhidraGPT (https://github.com/weirdmachine64/GhidraGPT) — LLM внутри GUI Ghidra +- PyGhidra-MCP (https://github.com/clearbluejar/pyghidra-mcp) — CLI на PyGhidra +- OGhidra (https://github.com/llnl/OGhidra) — от Lawrence Livermore: LLM через Ollama или облачные API; в локальном режиме сэмплы не уходят в облако + +radare2 и Binary Ninja: +- radare2-mcp (https://github.com/radareorg/radare2-mcp) — официальный MCP radare2 +- r2ai (https://github.com/radareorg/r2ai) — LLM внутри radare2: объяснение функций, нейминг, поиск багов +- binary_ninja_mcp (https://github.com/fosdickio/binary_ninja_mcp) — мост Binja ↔ LLM +- binary-ninja-headless-mcp (https://github.com/mrphrazer/binary-ninja-headless-mcp) — headless, 181 тул +- Rikugan (https://github.com/buzzer-re/Rikugan) — агент внутри IDA и Binja: 60+ тулов, 12 скиллов, Ollama + +Отладчики и память: +- x64dbg-mcp (https://github.com/SetsunaYukiOvO/x64dbg-mcp) — управление x64dbg/x32dbg: бряки, регистры, память +- cheatengine-mcp-bridge (https://github.com/miscusi-peek/cheatengine-mcp-bridge) — 1.5к звёзд: Cheat Engine как тул агента — скан памяти, пойнтер-цепочки, структуры +- windbg-mcp (https://github.com/memoryforensics1/windbg-mcp) — kernel-отладка: DbgEng, TTD, KDNET + +Малварь, Android, .NET, Python: +- Qu1cksc0pe (https://github.com/CYB3RMX/Qu1cksc0pe) — 2к звёзд, all-in-one малварь-анализ со встроенным MCP +- Reversecore_MCP (https://github.com/sjkim1127/Reversecore_MCP) — radare2, YARA, LIEF, capa, angr, Volatility в одном MCP +- Arkana (https://github.com/JameZUK/Arkana) — 250+ тулов: вся лаба малварь-анализа за одним промптом +- remnux-mcp-server (https://github.com/REMnux/remnux-mcp-server) — дистрибутив REMnux как MCP +- jadx-ai-mcp (https://github.com/zinja-coder/jadx-ai-mcp) — 2.8к звёзд, AI внутри JADX +- apktool-mcp-server (https://github.com/zinja-coder/apktool-mcp-server) — Smali, ресурсы, пересборка APK +- de4py (https://github.com/Fadi002/de4py) — деобфускация Python + Ollama (CC BY-NC) +- disrobe (https://github.com/1-3-7/disrobe) — мультитул-деобфускатор: PyArmor, PyInstaller, obfuscator.io, UPX, WASM + MCP (платно для компаний) +- TriageMCP (https://github.com/eversinc33/TriageMCP) — быстрый статический триаж PE + +Скиллы и агенты — в 3/4. + +👻 [иишко](https://t.me/AlStack) + +===MSG 3/4=== + +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (3/4) + +🩸 ШАГ 6 (ПРОДОЛЖЕНИЕ). СКИЛЛЫ + +Скилл = SKILL.md с методикой: агент получает не тул, а порядок действий. Кладётся в ~/.claude/skills: Claude Code, Codex, Cursor, Gemini CLI. + +- reverse-skill (https://github.com/zhaoxuya520/reverse-skill) — 37.9к звёзд, роутер: маршрутизирует задачу — apk, ida, radare2, binary-ninja, dotnet, js, малварь + CTF-оркестратор на 42 скилла +- Anthropic-Cybersecurity-Skills (https://github.com/mukul975/Anthropic-Cybersecurity-Skills) — 33.4к звёзд: 817 скиллов по 34 доменам, привязка к ATT&CK, D3FEND, NIST CSF +- ctf-skills (https://github.com/ljagiello/ctf-skills) — 3.3к звёзд: pwn, crypto, reverse, forensics, OSINT +- android-reverse-engineering-skill (https://github.com/SimoneAvogadro/android-reverse-engineering-skill) — 7.9к звёзд: APK/XAPK, call chains, Retrofit/OkHttp +- skills от Trail of Bits (https://github.com/trailofbits/skills) — 7.2к звёзд: security research, поиск уязвимостей, аудиты +- Claude-Red (https://github.com/SnailSploit/Claude-Red) — 6.9к звёзд: offensive-скиллы от SQLi до EDR evasion +- Claude-Code-CyberSecurity-Skill (https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill) — 22 скилла: реверс, threat hunting, purple team +- open-reverselab (https://github.com/LING71671/open-reverselab) — 1.2к звёзд: 100+ MCP-тулов Ghidra/Frida/x64dbg/Rizin + база знаний на 180+ статей +- REA (https://github.com/morluto/rea) — агент + скилл: от поведения приложения до нативных бинарей, управление evidence + +Скиллы тоже атакуют: SkillSpector (https://github.com/NVIDIA/SkillSpector) от NVIDIA — 18.4к звёзд, сканер скиллов перед установкой: промпт-инъекции, эксфильтрация, supply-chain. + +🩸 АГЕНТЫ + +- agentic-malware-analysis (https://github.com/mrphrazer/agentic-malware-analysis) — Docker: Kali, 50+ RE-тулов, MCP-дизассемблеры. Бинарь на входе — структурный отчёт на выходе +- auto-re-agent (https://github.com/Dryxio/reagent) — 2к звёзд: реконструирует C/C++ из бинаря, генерирует кандидатов, собирает и гоняет тесты на паритет +- reverify (https://github.com/2akouwu/reverify) — 1.2к звёзд: слой проверки — агент предлагает, детерминированные тулы сверяют каждое утверждение с бинарём +- firefox-reverse (https://github.com/WhiteNightShadow/firefox-reverse) — 857 звёзд: Firefox со встроенным AI-реверс-агентом, трейс на уровне движка +- anything-analyzer (https://github.com/Mouseww/anything-analyzer) — 3.7к звёзд: воркстейшн — браузер + MITM + хуки + AI +- FIRERPA (https://github.com/firerpa/lamda) — 8.4к звёзд: полный контроль Android-устройств, Frida, MITM, 160+ API +- shannon (https://github.com/KeygraphHQ/shannon) — 48к звёзд, AI-пентестер веба и API (смежное) + +🩸 ДАТАСЕТЫ И БЕНЧМАРКИ + +- mcp-reversing-dataset (https://github.com/mrexodia/mcp-reversing-dataset) — задачи реверса, решённые LLM: тренировка и eval +- AgentRE-Bench (https://github.com/agentrebench/AgentRE-Bench) — бенчмарк LLM-реверса +- CrackMeBench (https://arxiv.org/abs/2605.10597) — бенчмарк агентов на crackme: выбор между Ghidra, angr, radare2 + +🩸 ЭТО УЖЕ РАБОТАЕТ + +Big Sleep (https://projectzero.google/2024/10/from-naptime-to-big-sleep.html) — агент Project Zero и DeepMind нашёл 0-day в SQLite до релиза: stack buffer underflow, который не поймал фаззинг после 150 CPU-часов. За 2025 — ~20 0-day в open-source. + +🩸 ОГРАНИЧЕНИЯ + +- Агент уверенно ошибается в именах функций. Крипто, C2, авторизация — проверяй руками +- Упакованный сэмпл = слабый псевдокод = слабые выводы. Распаковывай до подачи +- Строки в бинарнике как промпт-инъекция против RE-агента (https://arxiv.org/abs/2605.30667): малварь встраивает команды для ассистента прямо в строки + +Каталоги AI-реверса: awesome-ai-reverse (https://github.com/DiscoverBox/awesome-ai-reverse), Awesome-RE-MCP (https://github.com/crowdere/Awesome-RE-MCP), mcp-security-hub (https://github.com/FuzzingLabs/mcp-security-hub). + +👻 [иишко](https://t.me/AlStack) + +===MSG 4/4=== + +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (4/4) + +🩸 ШАГ 7. СПЕЦИАЛИЗАЦИЯ + +- Малварь: PMAT (https://github.com/HuskyHacks/PMAT-labs) — лабы к бесплатному курсу по триажу: сэмплы в VM, FakeNet-NG +- Прошивки: binwalk v3 (https://github.com/ReFirmLabs/binwalk) — распаковка, переписан на Rust; EMBA (https://github.com/e-m-b-a/emba) — полный анализ firmware: SBOM, уязвимости, эмуляция +- Android: jadx (https://github.com/skylot/jadx) + apktool (https://github.com/iBotPeaches/Apktool) +- CTF: ctftime.org (https://ctftime.org/), Flare-On от Mandiant — раз в год + +🩸 МАТЕРИАЛЫ + +- По-русски: intro-rev-ida-pro (https://yutewiyof.gitbook.io/intro-rev-ida-pro) — перевод Рикардо Нарвахи «Введение в реверсинг с нуля, используя IDA PRO» +- Книги: Practical Malware Analysis, Practical Reverse Engineering, The Ghidra Book; бесплатно — Reverse Engineering for Beginners (https://beginners.re/) +- Библиография: Awesome-Reversing (https://github.com/ReversingID/Awesome-Reversing) +- Ютуб: OALabs (https://www.youtube.com/@OALabs), LiveOverflow (https://www.youtube.com/@LiveOverflow), Gynvael Coldwind (https://www.youtube.com/@GynvaelColdwind) + +🩸 ПРО ЛИЦЕНЗИЮ IDA + +Лицензия IDA — офлайн: .hexlic, JSON с подписью, публичный ключ зашит в бинарь (схема официально не документируется, известна из разборов сообщества). В 2025 утекала бета 9.2, по форумам гуляли генераторы лицензий — под пропатченные бинарники; keygen с настоящим приватным ключом публично не подтверждён. + +- Защитникам: офлайн-схема «ключ в бинаре + подпись» ломается патчем бинаря, а не только кражей ключа. Работают серверная валидация и ротация +- Реверсеру: точку проверки подписи ищут по xrefs на байты открытого ключа/модуля (RSA-модуль, 0x10001) +- Пропатченная сборка — бинарь, изменённый анонимом, регулярный вектор доставки малвари. Бесплатно и легально: IDA Free (https://hex-rays.com/ida-free/), Ghidra, академические лицензии Hex-Rays через вуз + +👻 [иишко](https://t.me/AlStack) diff --git a/research-what-we-did/rev_guide/p1.md b/research-what-we-did/rev_guide/p1.md new file mode 100644 index 0000000..2392d13 --- /dev/null +++ b/research-what-we-did/rev_guide/p1.md @@ -0,0 +1,55 @@ +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 + +Полный путь от нуля до самостоятельного анализа бинарников: база, инструменты, пайплайн, реверс через ИИ, материалы. Всё бесплатное или с free-версией. + +🩸 ШАГ 1. БАЗА + +Без этого инструменты бесполезны: + +- C — указатели, память, структуры, строки +- Ассемблер x86-64 — регистры, стек, calling conventions, переходы +- Compiler Explorer (https://godbolt.org/) — пишешь функцию на C, видишь её ассемблер. Лучший способ понять, что делает компилятор +- Формат PE (https://learn.microsoft.com/windows/win32/debug/pe-format) — заголовки, секции, таблица импортов + +Результат: свободно читаешь ассемблерный листинг простой функции. + +🩸 ШАГ 2. ИНСТРУМЕНТЫ + +- Ghidra (https://github.com/NationalSecurityAgency/ghidra) — дизассемблер + декомпилятор, бесплатный. Основной инструмент для обучения, скриптится на Python через Ghidrathon (https://github.com/mandiant/Ghidrathon) +- x64dbg (https://x64dbg.com/) — отладчик Windows +- Detect It Easy (https://github.com/horsicq/Detect-It-Easy) — определение компилятора, протектора, упаковщика +- HxD (https://mh-nexus.de/hxd/) — hex-редактор + +Позже пригодятся: IDA Pro (https://hex-rays.com/) — эталонный декомпилятор Hex-Rays; Binary Ninja (https://binary.ninja/) — API для автоматизации; radare2 (https://github.com/radareorg/radare2) / rizin (https://github.com/rizinorg/rizin) + Cutter (https://github.com/rizinorg/cutter) — консольный стек. + +🩸 ШАГ 3. ПРАКТИКА + +- crackmes.one (https://crackmes.one/) — задачи по реверсу, сложность 1–6 +- Порядок: 15–20 задач 1☆, затем 10–15 задач 2☆, затем 3☆ +- Осваиваются: поиск точки входа, паттерн проверки пароля, простые анти-отладочные приёмы +- ROP Emporium (https://ropemporium.com/) — exploitation по шагам + +Результат: самостоятельно разбираешь небольшой бинарь от запуска до ответа. + +🩸 ШАГ 4. СИСТЕМА + +- pwn.college (https://pwn.college/) — бесплатные модули от ASU: ассемблер, основы RE, автопроверка, 15–25 задач на модуль +- OpenSecurityTraining2 (https://p.ost2.fyi/) — реверс C++, символьное исполнение, отладчики, UEFI +- RE-MA-Roadmap (https://github.com/x86byte/RE-MA-Roadmap) — roadmap от нуля до malware-аналитика + +🩸 ШАГ 5. ПАЙПЛАЙН АНАЛИЗА БИНАРЯ + +Порядок, по которому разбирают реальные сэмплы. Перед запуском чего-либо живого: виртуалка + снапшот, без общих папок и реальной сети. + +1. Триаж без запуска: DIE — упаковщик/компилятор; FLOSS (https://github.com/mandiant/flare-floss) — строки, включая обфусцированные; capa (https://github.com/mandiant/capa) — capabilities с маппингом на ATT&CK +2. Распаковка: натив — x64dbg до OEP, дамп, IAT чинит Scylla (https://github.com/NtQuery/Scylla); .NET — de4dot-форк (https://github.com/kant2002/de4dot), разбор в dnSpyEx (https://github.com/dnSpyEx/dnSpy); без запуска — Qiling (https://github.com/qilingframework/qiling) +3. Статика: Ghidra/IDA — декомпиляция, xrefs, переименование +4. Динамика: отладчик для проверки гипотез; Frida (https://frida.re/) — хуки на функции, снятие конфигов +5. Деобфускация: D-810 (https://gitlab.com/eshard/d810) — MBA и flattening в декомпиляторе IDA; эмуляция и трейсинг — Unicorn (https://github.com/unicorn-engine/unicorn), Qiling, angr (https://github.com/angr/angr) +6. Поведение: FakeNet-NG (https://github.com/mandiant/flare-fakenet-ng) — перехват трафика; CAPEv2 (https://github.com/kevoreilly/capev2) — сэндбокс; Speakeasy (https://github.com/mandiant/speakeasy) — эмуляция малвари и драйверов без VM +7. Диффинг версий: BinDiff (https://github.com/google/bindiff) / Diaphora (https://github.com/joxeankoret/diaphora) — что изменил вендор, где была дыра +8. Выход: YARA-правило (https://github.com/VirusTotal/yara), IOC, отчёт + +Шаг 6 — реверс через ИИ — во 2-м и 3-м сообщениях. + +👻 [иишко](https://t.me/AlStack) \ No newline at end of file diff --git a/research-what-we-did/rev_guide/p2.md b/research-what-we-did/rev_guide/p2.md new file mode 100644 index 0000000..7dc6c60 --- /dev/null +++ b/research-what-we-did/rev_guide/p2.md @@ -0,0 +1,48 @@ +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (2/4) + +🩸 ШАГ 6. РЕВЕРС ЧЕРЕЗ ИИ: MCP-СЕРВЕРЫ + +Как это работает: агент (Claude Code, Codex, Cursor, Gemini CLI) подключается к дизассемблеру или отладчику через MCP и сам декомпилирует, ходит по xrefs, переименовывает, ставит бряки, снимает конфиги. Ты направляешь и валидируешь. + +IDA Pro: +- ida-pro-mcp (https://github.com/mrexodia/ida-pro-mcp) — 12.3к звёзд, от автора x64dbg: декомпиляция, xrefs, патчи, отладчик +- ida-mcp (https://github.com/HexRaysSA/ida-mcp) — официальный сервер Hex-Rays, MIT, требует IDA 9.4+ (https://docs.hex-rays.com/core/mcp) +- IDA-NO-MCP (https://github.com/P4nda0s/IDA-NO-MCP) — 2к звёзд: выгружает базу IDA в файлы для AI-клиента вместо verbose MCP +- ida-multi-mcp (https://github.com/MeroZemory/ida-multi-mcp) — несколько бинарей в одной сессии: дроппер, пейлоад, C2 рядом +- ida-mcp-rs (https://github.com/blacktop/ida-mcp-rs) — headless-сервер на Rust для пайплайнов + +Ghidra: +- GhidraMCP (https://github.com/LaurieWired/GhidraMCP) — 10.2к звёзд, классика от LaurieWired +- ghidra-mcp (https://github.com/bethington/ghidra-mcp) — 4к звёзд: 200+ тулов, GUI-плагин и headless, эмуляция p-code, Docker +- ReVa (https://github.com/cyberkaida/reverse-engineering-assistant) — 840 звёзд, заточен под длинные задачи, минимум потери контекста +- GhidrAssistMCP (https://github.com/symgraph/GhidrAssistMCP) — MCP внутри процесса Ghidra +- GhidraGPT (https://github.com/weirdmachine64/GhidraGPT) — LLM внутри GUI Ghidra +- PyGhidra-MCP (https://github.com/clearbluejar/pyghidra-mcp) — CLI на PyGhidra +- OGhidra (https://github.com/llnl/OGhidra) — от Lawrence Livermore: локальные LLM через Ollama, сэмплы не уходят в облако + +radare2 и Binary Ninja: +- radare2-mcp (https://github.com/radareorg/radare2-mcp) — официальный MCP radare2 +- r2ai (https://github.com/radareorg/r2ai) — LLM внутри radare2: объяснение функций, нейминг, поиск багов +- binary_ninja_mcp (https://github.com/fosdickio/binary_ninja_mcp) — мост Binja ↔ LLM +- binary-ninja-headless-mcp (https://github.com/mrphrazer/binary-ninja-headless-mcp) — headless, 180 тулов +- Rikugan (https://github.com/buzzer-re/Rikugan) — агент внутри IDA и Binja: 60+ тулов, 12 скиллов, Ollama + +Отладчики и память: +- x64dbg-mcp (https://github.com/SetsunaYukiOvO/x64dbg-mcp) — управление x64dbg/x32dbg: бряки, регистры, память +- cheatengine-mcp-bridge (https://github.com/miscusi-peek/cheatengine-mcp-bridge) — 1.5к звёзд: Cheat Engine как тул агента — скан памяти, пойнтер-цепочки, структуры +- windbg-mcp (https://github.com/memoryforensics1/windbg-mcp) — kernel-отладка: DbgEng, TTD, KDNET + +Малварь, Android, .NET, Python: +- Qu1cksc0pe (https://github.com/CYB3RMX/Qu1cksc0pe) — 2к звёзд, all-in-one малварь-анализ со встроенным MCP +- Reversecore_MCP (https://github.com/sjkim1127/Reversecore_MCP) — radare2, YARA, LIEF, capa, angr, Volatility в одном MCP +- Arkana (https://github.com/JameZUK/Arkana) — 250+ тулов: вся лаба малварь-анализа за одним промптом +- remnux-mcp-server (https://github.com/REMnux/remnux-mcp-server) — дистрибутив REMnux как MCP +- jadx-ai-mcp (https://github.com/zinja-coder/jadx-ai-mcp) — 2.8к звёзд, AI внутри JADX +- apktool-mcp-server (https://github.com/zinja-coder/apktool-mcp-server) — Smali, ресурсы, пересборка APK +- de4py (https://github.com/Fadi002/de4py) — деобфускация Python + Ollama +- disrobe (https://github.com/1-3-7/disrobe) — мультитул-деобфускатор: PyArmor, PyInstaller, obfuscator.io, UPX, WASM + MCP +- TriageMCP (https://github.com/eversinc33/TriageMCP) — быстрый статический триаж PE + +Скиллы и агенты — в 3/4. + +👻 [иишко](https://t.me/AlStack) \ No newline at end of file diff --git a/research-what-we-did/rev_guide/p3.md b/research-what-we-did/rev_guide/p3.md new file mode 100644 index 0000000..22a9b16 --- /dev/null +++ b/research-what-we-did/rev_guide/p3.md @@ -0,0 +1,46 @@ +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (3/4) + +🩸 ШАГ 6 (ПРОДОЛЖЕНИЕ). СКИЛЛЫ + +Скилл = SKILL.md с методикой: агент получает не тул, а порядок действий. Кладётся в ~/.claude/skills, работает в Claude Code, Codex, Cursor, Gemini CLI. +- reverse-skill (https://github.com/zhaoxuya520/reverse-skill) — 37.9к звёзд, роутер: маршрутизирует задачу — apk, ida, radare2, binary-ninja, dotnet, js, малварь + CTF-оркестратор на 42 скилла +- Anthropic-Cybersecurity-Skills (https://github.com/mukul975/Anthropic-Cybersecurity-Skills) — 33.4к звёзд: 817 скиллов по 29 доменам, привязка к ATT&CK, D3FEND, NIST CSF +- ctf-skills (https://github.com/ljagiello/ctf-skills) — 3.3к звёзд: pwn, crypto, reverse, forensics, OSINT +- android-reverse-engineering-skill (https://github.com/SimoneAvogadro/android-reverse-engineering-skill) — 7.9к звёзд: APK/XAPK, call chains, Retrofit/OkHttp +- skills от Trail of Bits (https://github.com/trailofbits/skills) — 7.2к звёзд: security research, поиск уязвимостей, аудиты +- Claude-Red (https://github.com/SnailSploit/Claude-Red) — 6.9к звёзд: offensive-скиллы от SQLi до EDR evasion +- Claude-Code-CyberSecurity-Skill (https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill) — 22 скилла: реверс, threat hunting, purple team +- open-reverselab (https://github.com/LING71671/open-reverselab) — 1.2к звёзд: 100+ MCP-тулов Ghidra/Frida/x64dbg/Rizin + база знаний на 194 статьи +- REA (https://github.com/morluto/rea) — агент + скилл: от поведения приложения до нативных бинарей, с управлением evidence + +Скиллы тоже атакуют: SkillSpector (https://github.com/NVIDIA/SkillSpector) от NVIDIA — 18.4к звёзд, сканер скиллов перед установкой: промпт-инъекции, эксфильтрация, supply-chain. Ставишь чужой скилл — проверяй. + +🩸 АГЕНТЫ + +- agentic-malware-analysis (https://github.com/mrphrazer/agentic-malware-analysis) — Docker: Kali, 50+ RE-тулов, MCP-дизассемблеры. Бинарь на входе — структурный отчёт на выходе +- auto-re-agent (https://github.com/Dryxio/reagent) — 2к звёзд: реконструирует C/C++ из бинаря, генерирует кандидатов, собирает и гоняет тесты на паритет +- reverify (https://github.com/2akouwu/reverify) — 1.2к звёзд: слой проверки — агент предлагает, детерминированные тулы сверяют каждое утверждение с бинарём +- firefox-reverse (https://github.com/WhiteNightShadow/firefox-reverse) — 855 звёзд: Firefox со встроенным AI-реверс-агентом, трейс на уровне движка +- anything-analyzer (https://github.com/Mouseww/anything-analyzer) — 3.7к звёзд: воркстейшн — браузер + MITM + хуки + AI +- FIRERPA (https://github.com/firerpa/lamda) — 8.4к звёзд: полный контроль Android-устройств, Frida, MITM, 160+ API +- shannon (https://github.com/KeygraphHQ/shannon) — 47к звёзд, AI-пентестер веба и API. Смежное с бинарным реверсом + +🩸 ДАТАСЕТЫ И БЕНЧМАРКИ + +- mcp-reversing-dataset (https://github.com/mrexodia/mcp-reversing-dataset) — задачи реверса, решённые LLM: тренировка и eval +- AgentRE-Bench (https://github.com/agentrebench/AgentRE-Bench) — бенчмарк LLM-реверса +- CrackMeBench (https://arxiv.org/abs/2605.10597) — бенчмарк агентов на crackme: выбор между Ghidra, angr, radare2 + +🩸 ЭТО УЖЕ РАБОТАЕТ + +Big Sleep (https://projectzero.google/2024/10/from-naptime-to-big-sleep.html) — агент Project Zero и DeepMind нашёл 0-day в SQLite до релиза: stack buffer underflow, который не поймал фаззинг после 150 CPU-часов. За 2025 — ~20 новых 0-day в open-source. + +🩸 ОГРАНИЧЕНИЯ + +- Агент уверенно ошибается в именах функций. Крипто, C2, авторизация — проверяй руками +- Упакованный сэмпл = слабый псевдокод = слабые выводы. Распаковывай до подачи +- Строки в бинарнике как промпт-инъекция против RE-агента (https://arxiv.org/abs/2605.30667) — малварь учится «разговаривать» с твоим ассистентом + +Каталоги всего AI-реверса: awesome-ai-reverse (https://github.com/DiscoverBox/awesome-ai-reverse), Awesome-RE-MCP (https://github.com/crowdere/Awesome-RE-MCP), mcp-security-hub (https://github.com/FuzzingLabs/mcp-security-hub). + +👻 [иишко](https://t.me/AlStack) \ No newline at end of file diff --git a/research-what-we-did/rev_guide/p4.md b/research-what-we-did/rev_guide/p4.md new file mode 100644 index 0000000..463eb8a --- /dev/null +++ b/research-what-we-did/rev_guide/p4.md @@ -0,0 +1,25 @@ +🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (4/4) + +🩸 ШАГ 7. СПЕЦИАЛИЗАЦИЯ + +- Малварь: PMAT (https://github.com/HuskyHacks/PMAT-course) — бесплатный курс по триажу. Лаба: VM + FakeNet-NG +- Прошивки: binwalk v3 (https://github.com/ReFirmLabs/binwalk) — распаковка, переписан на Rust; EMBA (https://github.com/e-m-b-a/emba) — полный анализ firmware: SBOM, уязвимости, эмуляция +- Android: jadx (https://github.com/skylot/jadx) + apktool (https://github.com/iBotPeaches/Apktool) +- CTF: ctftime.org (https://ctftime.org/), Flare-On от Mandiant — раз в год + +🩸 МАТЕРИАЛЫ + +- По-русски: intro-rev-ida-pro (https://yutewiyof.gitbook.io/intro-rev-ida-pro) — «Реверсинг с IDA Pro от 0» Рикардо Нарвахи, полный перевод +- Книги: Practical Malware Analysis, Practical Reverse Engineering, The Ghidra Book; Reverse Engineering for Beginners (https://beginners.re/) — бесплатно +- Библиография: Awesome-Reversing (https://github.com/ReversingID/Awesome-Reversing) +- Ютуб: OALabs, LiveOverflow, Gynvael Coldwind + +🩸 ПРО ЛИЦЕНЗИЮ IDA + +По публичным сообщениям 2025: лицензия IDA — офлайн-проверка, JSON с подписью, публичный ключ зашит в бинарь. Утёк keygen с приватным ключом, Hex-Rays в 9.1+ сменила схему подписи. + +- Защитникам: офлайн-схема «ключ в бинаре + подпись» ломается подменой ключа. Работают серверная валидация и ротация +- Реверсеру: точка проверки подписи ищется через xrefs на крипто-константы +- Пропатченная сборка — бинарь, изменённый анонимом, регулярный вектор доставки малвари. Бесплатно и легально: IDA Free (https://hex-rays.com/ida-free/), Ghidra, академические лицензии Hex-Rays + +👻 [иишко](https://t.me/AlStack) \ No newline at end of file diff --git a/research-what-we-did/reverse_keys.py b/research-what-we-did/reverse_keys.py new file mode 100644 index 0000000..2288eab --- /dev/null +++ b/research-what-we-did/reverse_keys.py @@ -0,0 +1,12 @@ +import json, os + +P = "C:/Users/User/tmp/octopusx_keys.json" +d = json.load(open(P, encoding="utf-8")) +keys = d["keys"] +print("before:", len(keys), "| first:", keys[0][:14], "| last:", keys[-1][:14]) +d["keys"] = list(reversed(keys)) # newest first +d["current_index"] = 0 +json.dump(d, open(P, "w", encoding="utf-8"), ensure_ascii=False, indent=1) +# bump mtime to force hot reload +os.utime(P) +print("reversed. now first:", d["keys"][0][:14], "| last:", d["keys"][-1][:14]) \ No newline at end of file diff --git a/reverse-engineering-android-malware-with-jadx/LICENSE b/reverse-engineering-android-malware-with-jadx/LICENSE new file mode 100644 index 0000000..d885118 --- /dev/null +++ b/reverse-engineering-android-malware-with-jadx/LICENSE @@ -0,0 +1,201 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by the Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding any notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. Please do not remove or change + the license header comment from a contributed file except when + necessary. + + Copyright 2026 mukul975 + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/reverse-engineering-android-malware-with-jadx/SKILL.md b/reverse-engineering-android-malware-with-jadx/SKILL.md new file mode 100644 index 0000000..c09ac49 --- /dev/null +++ b/reverse-engineering-android-malware-with-jadx/SKILL.md @@ -0,0 +1,353 @@ +--- +name: reverse-engineering-android-malware-with-jadx +description: 'Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify + malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest + permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse + engineering, mobile malware investigation, or Android threat analysis. + + ' +domain: cybersecurity +subdomain: malware-analysis +tags: +- malware +- Android +- reverse-engineering +- JADX +- mobile-malware +version: 1.0.0 +author: mahipal +license: Apache-2.0 +nist_csf: +- DE.AE-02 +- RS.AN-03 +- ID.RA-01 +- DE.CM-01 +--- + +# Reverse Engineering Android Malware with JADX + +## When to Use + +- A suspicious Android APK has been reported as malicious or flagged by mobile threat detection +- Analyzing Android banking trojans, spyware, SMS stealers, or adware samples +- Determining what data an app collects, where it sends it, and what permissions it abuses +- Extracting C2 server addresses, encryption keys, and configuration data from Android malware +- Understanding overlay attack mechanisms used by banking trojans + +**Do not use** for analyzing obfuscated native (.so) libraries within APKs; use Ghidra or IDA for native ARM binary analysis. + +## Prerequisites + +- JADX 1.5+ installed (download from https://github.com/skylot/jadx/releases) +- Android SDK with `aapt2` and `adb` tools for APK inspection +- apktool for full APK disassembly including smali code and resources +- Python 3.8+ with `androguard` library for automated APK analysis +- Frida for dynamic instrumentation (optional, for runtime analysis) +- Isolated Android emulator (Genymotion or Android Studio AVD) without Google services + +## Workflow + +### Step 1: Extract APK Metadata and Permissions + +Examine the APK structure and AndroidManifest.xml: + +```bash +# Get APK basic info +aapt2 dump badging malware.apk + +# Extract AndroidManifest.xml +apktool d malware.apk -o apk_extracted/ -f + +# Analyze permissions with androguard +python3 << 'PYEOF' +from androguard.core.apk import APK + +apk = APK("malware.apk") + +print(f"Package: {apk.get_package()}") +print(f"App Name: {apk.get_app_name()}") +print(f"Version: {apk.get_androidversion_name()}") +print(f"Min SDK: {apk.get_min_sdk_version()}") +print(f"Target SDK: {apk.get_target_sdk_version()}") + +# Dangerous permissions +dangerous_perms = { + "android.permission.READ_SMS": "SMS theft", + "android.permission.RECEIVE_SMS": "SMS interception", + "android.permission.SEND_SMS": "Premium SMS fraud", + "android.permission.READ_CONTACTS": "Contact harvesting", + "android.permission.READ_CALL_LOG": "Call log theft", + "android.permission.RECORD_AUDIO": "Audio surveillance", + "android.permission.CAMERA": "Camera surveillance", + "android.permission.ACCESS_FINE_LOCATION": "Location tracking", + "android.permission.READ_PHONE_STATE": "Device fingerprinting", + "android.permission.SYSTEM_ALERT_WINDOW": "Overlay attacks", + "android.permission.BIND_ACCESSIBILITY_SERVICE": "Full device control", + "android.permission.REQUEST_INSTALL_PACKAGES": "Sideloading apps", + "android.permission.BIND_DEVICE_ADMIN": "Device admin abuse", +} + +print("\nDangerous Permissions:") +for perm in apk.get_permissions(): + if perm in dangerous_perms: + print(f" [!] {perm}") + print(f" Risk: {dangerous_perms[perm]}") + elif "android.permission" in perm: + print(f" [*] {perm}") + +# Components +print("\nActivities:") +for act in apk.get_activities(): + print(f" {act}") + +print("\nServices:") +for svc in apk.get_services(): + print(f" {svc}") + +print("\nReceivers:") +for rcv in apk.get_receivers(): + print(f" {rcv}") +PYEOF +``` + +### Step 2: Decompile with JADX + +Open the APK in JADX for Java/Kotlin source analysis: + +```bash +# Open in JADX GUI +jadx-gui malware.apk + +# Command-line decompilation for scripted analysis +jadx -d jadx_output/ malware.apk --show-bad-code + +# Decompile with all options +jadx -d jadx_output/ malware.apk \ + --deobf \ + --deobf-min 3 \ + --deobf-max 64 \ + --show-bad-code \ + --threads-count 4 + +# The output directory structure: +# jadx_output/ +# sources/ <- Decompiled Java source code +# com/malware/app/ +# MainActivity.java +# C2Service.java +# SMSReceiver.java +# resources/ <- Decoded resources (layouts, strings, assets) +# AndroidManifest.xml +# res/ +# assets/ +``` + +### Step 3: Identify Malicious Functionality + +Search for suspicious code patterns in decompiled sources: + +```bash +# Search for network communication +grep -rn "HttpURLConnection\|OkHttpClient\|Retrofit\|Volley\|URL(" jadx_output/sources/ + +# Search for SMS operations +grep -rn "SmsManager\|getDefault().sendTextMessage\|SMS_RECEIVED" jadx_output/sources/ + +# Search for overlay attack code +grep -rn "SYSTEM_ALERT_WINDOW\|TYPE_APPLICATION_OVERLAY\|WindowManager.LayoutParams" jadx_output/sources/ + +# Search for accessibility service abuse +grep -rn "AccessibilityService\|onAccessibilityEvent\|performAction" jadx_output/sources/ + +# Search for data exfiltration +grep -rn "getDeviceId\|getSubscriberId\|getSimSerialNumber\|getLine1Number" jadx_output/sources/ + +# Search for crypto operations (key storage, encryption) +grep -rn "SecretKeySpec\|Cipher.getInstance\|AES\|DES\|RSA" jadx_output/sources/ + +# Search for dynamic code loading +grep -rn "DexClassLoader\|PathClassLoader\|loadDex\|loadClass" jadx_output/sources/ + +# Search for obfuscated strings and decryption +grep -rn "Base64.decode\|decrypt\|decipher\|xor" jadx_output/sources/ +``` + +### Step 4: Analyze C2 Communication + +Trace the network communication logic: + +```python +# Automated C2 extraction from decompiled code +import os +import re + +jadx_dir = "jadx_output/sources" + +# Patterns for C2 URLs and IPs +url_pattern = re.compile(r'https?://[^\s"\'<>]+') +ip_pattern = re.compile(r'"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"') +base64_pattern = re.compile(r'"([A-Za-z0-9+/]{20,}={0,2})"') + +urls = set() +ips = set() +b64_strings = set() + +for root, dirs, files in os.walk(jadx_dir): + for fname in files: + if fname.endswith('.java'): + filepath = os.path.join(root, fname) + with open(filepath, 'r', errors='ignore') as f: + content = f.read() + + for match in url_pattern.finditer(content): + urls.add(match.group()) + for match in ip_pattern.finditer(content): + ips.add(match.group(1)) + for match in base64_pattern.finditer(content): + b64_strings.add(match.group(1)) + +print("URLs found:") +for u in urls: + print(f" {u}") + +print("\nIP addresses:") +for ip in ips: + print(f" {ip}") + +# Decode Base64 strings +import base64 +print("\nDecoded Base64 strings:") +for b64 in b64_strings: + try: + decoded = base64.b64decode(b64).decode('utf-8', errors='ignore') + if any(c.isprintable() for c in decoded) and len(decoded) > 3: + print(f" {b64[:30]}... -> {decoded[:100]}") + except: + pass +``` + +### Step 5: Examine Native Libraries + +Check for native code that may contain additional malicious logic: + +```bash +# List native libraries in the APK +unzip -l malware.apk | grep "\.so$" + +# Extract native libraries +unzip malware.apk "lib/*" -d apk_native/ + +# Check native library properties +file apk_native/lib/armeabi-v7a/*.so +readelf -d apk_native/lib/armeabi-v7a/*.so | grep NEEDED + +# Strings from native libraries +strings apk_native/lib/armeabi-v7a/libpayload.so | grep -iE "(http|url|key|encrypt|password)" + +# For deep native analysis, import into Ghidra: +# File -> Import -> Select .so file -> Select ARM architecture +``` + +### Step 6: Document Analysis and Extract IOCs + +Compile a comprehensive Android malware analysis report: + +``` +Analysis documentation should include: +- APK metadata (package name, version, signing certificate) +- Permission analysis with risk assessment +- Component analysis (activities, services, receivers, providers) +- Decompiled code walkthrough of malicious functions +- C2 communication protocol and endpoints +- Data exfiltration methods and targeted data types +- Persistence mechanisms (device admin, accessibility service) +- Evasion techniques (emulator detection, root detection) +- Extracted IOCs (C2 URLs, domains, IPs, signing certificate hash) +``` + +## Key Concepts + +| Term | Definition | +|------|------------| +| **APK (Android Package)** | Android application package format containing compiled DEX bytecode, resources, manifest, and native libraries | +| **DEX Bytecode** | Dalvik Executable format containing compiled Java/Kotlin code; JADX converts this back to readable Java source | +| **Overlay Attack** | Banking trojan technique displaying a fake UI layer over a legitimate banking app to steal credentials using SYSTEM_ALERT_WINDOW permission | +| **Accessibility Service Abuse** | Malware registering as an accessibility service to capture screen content, perform actions, and prevent uninstallation | +| **Smali** | Human-readable representation of DEX bytecode; intermediate representation between bytecode and Java used by apktool | +| **Dynamic Code Loading** | Loading additional DEX code at runtime using DexClassLoader to hide malicious functionality from static analysis | +| **Device Admin Abuse** | Malware requesting device administrator privileges to prevent uninstallation and perform device wipe threats | + +## Tools & Systems + +- **JADX**: Open-source DEX to Java decompiler providing GUI and CLI for Android APK analysis with deobfuscation support +- **apktool**: Tool for reverse engineering Android APK files to smali code and decoded resources +- **androguard**: Python framework for automated Android APK analysis including permission, component, and code analysis +- **Frida**: Dynamic instrumentation toolkit for hooking Java methods and native functions at runtime on Android +- **MobSF (Mobile Security Framework)**: Automated mobile application security testing framework for static and dynamic analysis + +## Common Scenarios + +### Scenario: Analyzing an Android Banking Trojan + +**Context**: A banking trojan APK is distributed via SMS phishing targeting customers of a specific bank. The sample needs analysis to identify targeted banks, C2 infrastructure, and data theft mechanisms. + +**Approach**: +1. Extract APK metadata and identify requested permissions (SMS, accessibility, overlay, device admin) +2. Decompile with JADX and search for overlay activity classes that mimic banking app UIs +3. Identify the list of targeted banking apps by searching for package name lists in the code +4. Trace the SMS interception receiver to understand how 2FA codes are stolen +5. Follow the C2 communication code to extract server URLs and command protocol +6. Check for web injection configuration files in assets/ directory +7. Extract all IOCs and document the complete attack chain + +**Pitfalls**: +- Not deobfuscating class and method names before analysis (use JADX --deobf flag) +- Missing dynamically loaded DEX files downloaded after installation +- Ignoring native .so libraries that may contain the actual C2 logic or encryption routines +- Overlooking assets/ directory which may contain encrypted configuration or web injects + +## Output Format + +``` +ANDROID MALWARE ANALYSIS REPORT +================================== +APK File: update_bank.apk +Package: com.android.systemupdate +SHA-256: e3b0c44298fc1c149afbf4c8996fb924... +Version: 1.2.3 +Min SDK: 21 (Android 5.0) +Signing Cert: SHA-256: abc123... (self-signed) + +CLASSIFICATION +Family: Anubis Banking Trojan +Type: Banking Trojan / SMS Stealer / Keylogger + +DANGEROUS PERMISSIONS +[!] RECEIVE_SMS - Intercepts incoming SMS (2FA theft) +[!] READ_SMS - Reads SMS messages +[!] SEND_SMS - Sends premium SMS +[!] SYSTEM_ALERT_WINDOW - Overlay attacks on banking apps +[!] BIND_ACCESSIBILITY - Full device control +[!] BIND_DEVICE_ADMIN - Prevents uninstallation + +MALICIOUS COMPONENTS +Service: com.android.systemupdate.C2Service (C2 communication) +Receiver: com.android.systemupdate.SmsReceiver (SMS interception) +Activity: com.android.systemupdate.OverlayActivity (credential overlay) + +TARGETED APPS (23 banking apps) +com.bank.example1, com.bank.example2, ... + +C2 INFRASTRUCTURE +Primary: hxxps://c2-server[.]com/api/bot +Fallback: hxxps://backup-c2[.]net/api/bot +Protocol: HTTPS POST with JSON body +Bot ID: MD5(IMEI + Build.SERIAL) + +EXTRACTED IOCs +Domains: c2-server[.]com, backup-c2[.]net +IPs: 185.220.101[.]42 +URLs: hxxps://c2-server[.]com/api/bot + hxxps://c2-server[.]com/api/injects +Cert Hash: abc123def456... +``` diff --git a/reverse-engineering-android-malware-with-jadx/references/api-reference.md b/reverse-engineering-android-malware-with-jadx/references/api-reference.md new file mode 100644 index 0000000..5b46f8a --- /dev/null +++ b/reverse-engineering-android-malware-with-jadx/references/api-reference.md @@ -0,0 +1,67 @@ +# API Reference: Android Malware Reverse Engineering with JADX Agent + +## Overview + +Reverse engineers Android APKs using apktool for manifest extraction, JADX for Java decompilation, and regex-based source code analysis for malicious patterns (C2 URLs, SMS interception, overlay attacks). + +## Dependencies + +| Package | Version | Purpose | +|---------|---------|---------| +| hashlib | stdlib | APK hash computation | +| xml.etree | stdlib | AndroidManifest.xml parsing | + +## External Tools Required + +| Tool | Purpose | +|------|---------| +| apktool | APK disassembly and manifest extraction | +| jadx | DEX to Java decompilation with deobfuscation | + +## Core Functions + +### `compute_apk_hashes(apk_path)` +Generates MD5 and SHA-256 hashes for APK identification. + +### `extract_manifest(apk_path, output_dir)` +Extracts AndroidManifest.xml and parses permissions, activities, services, receivers. +- **Returns**: `dict` with `package`, `permissions`, `activities`, `services`, `receivers` + +### `analyze_permissions(permissions)` +Classifies permissions against a list of 16 dangerous Android permissions. +- **Risk**: CRITICAL if SMS/accessibility/device-admin, HIGH if >5 dangerous +- **Returns**: `dict` with categorized permission lists and risk level + +### `decompile_with_jadx(apk_path, output_dir)` +Runs JADX with `--deobf` flag for deobfuscated Java source output. +- **Timeout**: 300 seconds + +### `search_source_code(source_dir, patterns)` +Searches decompiled Java source for 10 malicious pattern categories. +- **Returns**: `dict[str, list[dict]]` - pattern name to file/match pairs + +### `analyze_apk(apk_path, output_base)` +Full pipeline: hashes -> manifest -> permissions -> decompile -> code analysis. + +## Malicious Code Patterns + +| Pattern | Indicator | +|---------|-----------| +| urls | HTTP/HTTPS C2 server addresses | +| ips | Hardcoded IP addresses | +| exec_commands | Runtime.exec() shell command execution | +| reflection | Class.forName() dynamic class loading | +| dex_loading | DexClassLoader for loading additional code | +| overlay_attack | TYPE_APPLICATION_OVERLAY for phishing overlays | +| accessibility_abuse | AccessibilityService for keylogging/automation | +| sms_intercept | SMS_RECEIVED broadcast interception | + +## Dangerous Permissions Checked + +READ_SMS, SEND_SMS, RECEIVE_SMS, READ_CONTACTS, CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, READ_PHONE_STATE, BIND_ACCESSIBILITY_SERVICE, BIND_DEVICE_ADMIN, REQUEST_INSTALL_PACKAGES + +## Usage + +```bash +python agent.py malware.apk +``` diff --git a/reverse-engineering-android-malware-with-jadx/scripts/agent.py b/reverse-engineering-android-malware-with-jadx/scripts/agent.py new file mode 100644 index 0000000..9b76ee9 --- /dev/null +++ b/reverse-engineering-android-malware-with-jadx/scripts/agent.py @@ -0,0 +1,196 @@ +#!/usr/bin/env python3 +"""Android malware reverse engineering agent using jadx and androguard subprocess wrappers.""" + +import subprocess +import os +import sys +import re +import hashlib +from xml.etree import ElementTree + + +def compute_apk_hashes(apk_path): + """Compute hashes for APK identification.""" + with open(apk_path, "rb") as f: + data = f.read() + return { + "md5": hashlib.md5(data).hexdigest(), + "sha256": hashlib.sha256(data).hexdigest(), + "size": len(data), + } + + +def extract_manifest(apk_path, output_dir): + """Extract and parse AndroidManifest.xml using apktool.""" + subprocess.run( + ["apktool", "d", apk_path, "-o", output_dir, "-f"], + capture_output=True, text=True, timeout=120 + ) + manifest_path = os.path.join(output_dir, "AndroidManifest.xml") + if not os.path.exists(manifest_path): + return {"error": "Manifest extraction failed"} + tree = ElementTree.parse(manifest_path) + root = tree.getroot() + ns = {"android": "http://schemas.android.com/apk/res/android"} + permissions = [] + for perm in root.findall(".//uses-permission"): + name = perm.get(f"{{{ns['android']}}}name", "") + permissions.append(name) + activities = [] + for act in root.findall(".//activity"): + name = act.get(f"{{{ns['android']}}}name", "") + exported = act.get(f"{{{ns['android']}}}exported", "false") + activities.append({"name": name, "exported": exported}) + services = [] + for svc in root.findall(".//service"): + name = svc.get(f"{{{ns['android']}}}name", "") + services.append(name) + receivers = [] + for rcv in root.findall(".//receiver"): + name = rcv.get(f"{{{ns['android']}}}name", "") + intents = [] + for intent in rcv.findall(".//intent-filter/action"): + intents.append(intent.get(f"{{{ns['android']}}}name", "")) + receivers.append({"name": name, "intents": intents}) + package = root.get("package", "") + return { + "package": package, + "permissions": permissions, + "activities": activities, + "services": services, + "receivers": receivers, + } + + +DANGEROUS_PERMISSIONS = [ + "android.permission.READ_SMS", "android.permission.SEND_SMS", + "android.permission.RECEIVE_SMS", "android.permission.READ_CONTACTS", + "android.permission.CAMERA", "android.permission.RECORD_AUDIO", + "android.permission.ACCESS_FINE_LOCATION", "android.permission.READ_PHONE_STATE", + "android.permission.CALL_PHONE", "android.permission.READ_CALL_LOG", + "android.permission.WRITE_EXTERNAL_STORAGE", "android.permission.READ_EXTERNAL_STORAGE", + "android.permission.SYSTEM_ALERT_WINDOW", "android.permission.BIND_ACCESSIBILITY_SERVICE", + "android.permission.REQUEST_INSTALL_PACKAGES", "android.permission.BIND_DEVICE_ADMIN", +] + + +def analyze_permissions(permissions): + """Classify permissions by risk level.""" + dangerous = [p for p in permissions if p in DANGEROUS_PERMISSIONS] + sms_related = [p for p in permissions if "SMS" in p] + accessibility = [p for p in permissions if "ACCESSIBILITY" in p] + admin = [p for p in permissions if "DEVICE_ADMIN" in p or "BIND_ADMIN" in p] + risk = "LOW" + if len(dangerous) > 5: + risk = "HIGH" + if sms_related or accessibility or admin: + risk = "CRITICAL" + return { + "total": len(permissions), + "dangerous": dangerous, + "sms_related": sms_related, + "accessibility": accessibility, + "device_admin": admin, + "risk": risk, + } + + +def decompile_with_jadx(apk_path, output_dir): + """Decompile APK to Java source using JADX.""" + result = subprocess.run( + ["jadx", "-d", output_dir, "--deobf", apk_path], + capture_output=True, text=True, timeout=300 + ) + return { + "output_dir": output_dir, + "returncode": result.returncode, + "stdout": result.stdout[-500:] if result.stdout else "", + } + + +def search_source_code(source_dir, patterns=None): + """Search decompiled source for suspicious patterns.""" + if patterns is None: + patterns = { + "urls": r'https?://[^\s"\'<>]+', + "ips": r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b', + "crypto_keys": r'(?:AES|DES|RSA|key|secret|encrypt).*?["\']([^"\']{8,})["\']', + "base64_strings": r'[A-Za-z0-9+/]{40,}={0,2}', + "exec_commands": r'Runtime\.getRuntime\(\)\.exec|ProcessBuilder', + "reflection": r'Class\.forName|getMethod|getDeclaredMethod', + "dex_loading": r'DexClassLoader|PathClassLoader|InMemoryDexClassLoader', + "overlay_attack": r'TYPE_APPLICATION_OVERLAY|SYSTEM_ALERT_WINDOW', + "accessibility_abuse": r'AccessibilityService|onAccessibilityEvent', + "sms_intercept": r'SmsReceiver|SMS_RECEIVED|sendTextMessage', + } + findings = {p: [] for p in patterns} + for root, dirs, files in os.walk(source_dir): + for filename in files: + if not filename.endswith(".java"): + continue + filepath = os.path.join(root, filename) + try: + with open(filepath, "r", errors="ignore") as f: + content = f.read() + for pattern_name, regex in patterns.items(): + matches = re.findall(regex, content) + if matches: + findings[pattern_name].extend([ + {"file": filepath, "match": m[:100]} for m in matches[:5] + ]) + except (OSError, UnicodeDecodeError): + pass + for key in findings: + findings[key] = findings[key][:20] + return findings + + +def analyze_apk(apk_path, output_base="/tmp/apk_analysis"): + """Full APK analysis pipeline.""" + os.makedirs(output_base, exist_ok=True) + report = {"apk": apk_path} + report["hashes"] = compute_apk_hashes(apk_path) + apktool_dir = os.path.join(output_base, "apktool") + report["manifest"] = extract_manifest(apk_path, apktool_dir) + if "permissions" in report["manifest"]: + report["permission_analysis"] = analyze_permissions(report["manifest"]["permissions"]) + jadx_dir = os.path.join(output_base, "jadx_output") + report["decompilation"] = decompile_with_jadx(apk_path, jadx_dir) + if os.path.exists(jadx_dir): + source_dir = os.path.join(jadx_dir, "sources") + if os.path.exists(source_dir): + report["code_analysis"] = search_source_code(source_dir) + return report + + +def print_report(report): + print("Android Malware Analysis Report") + print("=" * 50) + print(f"APK: {report['apk']}") + print(f"SHA-256: {report['hashes']['sha256']}") + print(f"Size: {report['hashes']['size']} bytes") + manifest = report.get("manifest", {}) + print(f"\nPackage: {manifest.get('package', 'N/A')}") + perm = report.get("permission_analysis", {}) + print(f"Permissions: {perm.get('total', 0)} (Risk: {perm.get('risk', 'N/A')})") + if perm.get("dangerous"): + print(f" Dangerous: {', '.join(p.split('.')[-1] for p in perm['dangerous'][:8])}") + print(f"Activities: {len(manifest.get('activities', []))}") + print(f"Services: {len(manifest.get('services', []))}") + print(f"Receivers: {len(manifest.get('receivers', []))}") + code = report.get("code_analysis", {}) + if code: + print("\nCode Analysis Findings:") + for pattern, matches in code.items(): + if matches: + print(f" {pattern}: {len(matches)} match(es)") + for m in matches[:3]: + print(f" -> {m['match'][:80]}") + + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python agent.py ") + sys.exit(1) + result = analyze_apk(sys.argv[1]) + print_report(result) diff --git a/reverse-engineering-binary/SKILL.md b/reverse-engineering-binary/SKILL.md new file mode 100644 index 0000000..45e7a22 --- /dev/null +++ b/reverse-engineering-binary/SKILL.md @@ -0,0 +1,249 @@ +--- +name: reverse-engineering-binary +description: 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O + analysis, IDA Pro, Ghidra, radare2, binary patching, crackme solving, malware analysis, + unpacking, signature analysis, and any task involving compiled binary inspection + or modification.' +version: 1.0.0 +platforms: +- linux +- macos +- windows +depends_on: [] +metadata: + tags: + - reverse + - engineering + - binary +--- + +# Reverse Engineering — Binary Analysis + +## Trigger Conditions + +- Disassembling or decompiling binaries (PE, ELF, Mach-O) +- IDA Pro, Ghidra, radare2, Binary Ninja workflows +- Analyzing compiled code without source +- Binary patching, crackme/CTF challenges +- Malware reverse engineering, IOC extraction +- Function identification, control flow reconstruction +- String extraction, crypto constant identification +- Import/export table analysis, IAT reconstruction +- Binary instrumentation (Frida, DynamoRIO, Pin) +- Shellcode analysis, payload decoding +- Firmware extraction, embedded binary RE +- Comparing binary diffs, version analysis +- Writing loaders, unpackers, decoders + +## Core Methodology + +### 1. Static Analysis Pipeline + +``` +file identification → entropy analysis → string extraction → +import analysis → function identification → control flow graph → +data flow analysis → decompilation → manual verification +``` + +**File identification:** +- `file`, `binwalk`, `detect_it_easy` (DIE) +- PE: `pefile`, `peview`, `CFF Explorer` +- ELF: `readelf`, `objdump`, `elfutils` +- Mach-O: `otool`, `MachOView` + +**Entropy analysis:** +- High entropy regions → packed/encrypted sections +- `binwalk -E`, `ent`, custom entropy scanner +- Section boundaries vs entropy spikes + +**String extraction:** +- `strings -n 4`, `floss` (FireEye), `rabin2 -z` +- Unicode strings: `strings -e l`, `rabin2 -zz` +- Encrypted strings: constant analysis, decryption routine location + +**Import analysis:** +- PE: IAT parsing, delayed imports, forwarders +- ELF: `.dynsym`, `.got.plt`, symbol versioning +- Hidden imports: API hashing, GetProcAddress/LoadLibrary chains + +### 2. Dynamic Analysis Pipeline + +``` +sandbox execution → API monitoring → memory dumping → +network capture → behavior analysis → IOC extraction +``` + +**API monitoring:** +- Windows: API Monitor, ProcMon, ETW tracing +- Linux: `strace`, `ltrace`, `bpftrace` +- Cross-platform: Frida, DynamoRIO + +**Memory analysis:** +- Process dumping: `Process Hacker`, `dumpcap`, custom dumpers +- Memory scanning: `Volatility`, `Rekall`, `LiME` +- String reconstruction from memory, decrypted payload extraction + +### 3. Decompilation & Manual RE + +**IDA Pro workflow:** +``` +1. Load binary → auto-analysis → review entry points +2. Identify strings → cross-reference → locate key functions +3. Rename functions/variables based on behavior +4. Create structs for data structures +5. Apply FLIRT signatures for known libraries +6. Graph view for complex control flow +7. Pseudocode (F5) → manual correction +8. Write IDC/IDAPython scripts for automation +``` + +**Ghidra workflow:** +``` +1. Import → auto-analyze (all analyzers) +2. Symbol tree → identify main/entry +3. Data type manager → create custom structs +4. Decompile → fix variable types +5. Script manager → Python/Java automation +6. Version tracking → binary diffing +7. Function graph → identify obfuscation patterns +``` + +**radare2 workflow:** +``` +r2 binary +aaa # analyze all +afl # list functions +pdf @ main # print disassembly function +pdg @ main # decompile (if available) +izz # strings +ii # imports +is # symbols +axt @ # cross-references to +axf @ # cross-references from +``` + +### 4. Binary Patching + +**Common patch targets:** +- License checks: `test eax, eax` → `xor eax, eax` (always true) +- Conditional jumps: `je` → `jmp` or `jne` +- Function skipping: `call func` → `nop` × 5 +- Return value modification: `mov eax, 1` before `ret` +- Anti-debug bypass: `IsDebuggerPresent` → return 0 + +**PE patching:** +```python +import pefile + +pe = pefile.PE("target.exe") +# Find target RVA +for section in pe.sections: + if section.Name.startswith(b'.text'): + text_rva = section.VirtualAddress + text_raw = section.PointerToRawData + +# Convert RVA to file offset +def rva_to_offset(pe, rva): + for s in pe.sections: + if s.VirtualAddress <= rva < s.VirtualAddress + s.Misc_VirtualSize: + return rva - s.VirtualAddress + s.PointerToRawData + +# Patch +offset = rva_to_offset(pe, target_rva) +pe.set_bytes_at_offset(offset, b'\x90' * 5) # NOP +pe.write("target_patched.exe") +``` + +### 5. Anti-Analysis Detection & Bypass + +**Anti-debug techniques:** +- `IsDebuggerPresent`, `CheckRemoteDebuggerPresent` +- `NtQueryInformationProcess(ProcessDebugPort)` +- `GetTickCount` timing checks +- `RDTSC` instruction timing +- SEH-based debugger detection +- Hardware breakpoint detection (`GetThreadContext`) + +**Bypass methods:** +- Patch detection functions to return false +- Frida script to hook and override return values +- Hide debugger from process list +- Use kernel debugger (WinDbg) for kernel-mode targets +- Time manipulation for timing-based checks + +**Anti-VM techniques:** +- MAC address checks (00:0C:29 = VMware) +- Registry keys (HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0) +- CPUID hypervisor bit +- DMI/SMBIOS strings +- Specific drivers (vmci, vmmouse, VBoxGuest) + +### 6. Crypto Identification + +**Constant-based identification:** +``` +MD5: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476 +SHA1: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0 +SHA256: 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, ... +AES: S-box lookup table (256 bytes starting 0x63, 0x7C, 0x77, ...) +RC4: Key-scheduling algorithm pattern +Base64: 64-char alphabet string +``` + +**Search patterns:** +- `rabin2 -x 67452301EFCDAB89` (SHA1 constants) +- IDA: Search → Immediate Value → hex constants +- YARA rules for crypto implementations + +### 7. Automation Scripts + +**IDAPython — find all API hash calls:** +```python +from idaapi import * +from idautils import * + +def find_api_hash_calls(hash_value): + """Find calls to API hash resolver with specific hash.""" + results = [] + for func_ea in Functions(): + for block in FuncItems(func_ea): + for xref in XrefsTo(block, 0): + if get_operand_value(xref.frm, 0) == hash_value: + results.append(xref.frm) + return results +``` + +**Frida — trace all imports:** +```javascript +Interceptor.attach(Module.getExportByName(null, 'CreateFileW'), { + onEnter: function(args) { + console.log('CreateFileW(' + args[0].readUtf16String() + ')'); + } +}); +``` + +## Implementation Standards + +- All RE artifacts are complete: full scripts, working patches, complete analysis +- Provide both static and dynamic analysis approaches +- Include automation scripts for repetitive tasks +- Document findings in structured format +- Cross-reference findings across multiple tools +- No partial analysis — complete or nothing + +## Output Format + +For binary RE tasks: +1. **Identification** — file type, architecture, compiler, packer +2. **Static Analysis** — strings, imports, key functions, control flow +3. **Dynamic Analysis** — behavior, API calls, network, file operations +4. **Key Findings** — algorithms, crypto, protocols, backdoors +5. **Artifacts** — patches, scripts, YARA rules, IOCs + +Всё, брат. + +## Related +- `skill reverse-engineering-full — полный RE` +- `skill reverse-engineering-obfuscation — деобфускация` +- `skill binary-exploitation — бинарные эксплойты` +- `skill fuzzing — фазинг` diff --git a/reverse-engineering-cli/SKILL.md b/reverse-engineering-cli/SKILL.md new file mode 100644 index 0000000..994a493 --- /dev/null +++ b/reverse-engineering-cli/SKILL.md @@ -0,0 +1,113 @@ +--- +name: reverse-engineering-cli +description: 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping, + token extraction, API endpoint enumeration, state machine reconstruction, protocol + analysis, config file discovery, and bypass techniques for command-line applications.' +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - reverse + - engineering + - cli + - tool + - binary + - analysis + - auth + - flow + - mapping + - token + - extraction + - api +depends_on: [] +metadata: + tags: + - reverse + - engineering + - cli +--- + +# Reverse Engineering — CLI Tools + +## When to Use + +- RE of any CLI binary/tool +- Auth flow analysis (login/logout/token refresh) +- Token storage discovery and extraction +- API endpoint enumeration from binaries +- State machine reconstruction +- Protocol reverse engineering +- Bypass of authentication or licensing in CLI tools + +## Core Protocol + +Load `../../meta-rules/meta-re/SKILL.md` for the full methodology. + +## Quick Start + +```bash +# 1. Identify binary +file && readelf -h + +# 2. Extract auth strings +strings | grep -iE "login|logout|token|auth|session|oauth|oidc" | grep -v "registry/src" | sort -u + +# 3. Extract URLs/endpoints +strings | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u + +# 4. Extract config paths +strings | grep -iE "\.config|\.local|\.cache|HOME|APPDATA" | grep -v "registry/src" | sort -u + +# 5. Extract SQL queries (token stores) +strings | grep -iE "SELECT|INSERT|CREATE TABLE|DELETE FROM" + +# 6. Extract API operations +strings | grep -oE "[A-Z][a-zA-Z]+Service\.[A-Z][a-zA-Z]+" | sort -u + +# 7. Capture network traffic +strace -f -e trace=network -o /tmp/re/strace.log +``` + +## Auth Flow Patterns + +### Device Code Flow (AWS SSO OIDC) +1. POST /oauth2/device → deviceCode + userCode +2. User opens browser, enters code +3. POST /oauth2/token → poll until authorized +4. Response: accessToken + refreshToken + +### PKCE OAuth +1. Generate code_verifier → code_challenge = SHA256 +2. Browser auth → redirect with code +3. POST /token with code_verifier +4. Response: access_token + refresh_token + +### External IdP (Social) +1. Redirect to Google/GitHub +2. Callback → extract tokens +3. Exchange for service token with profile ARN + +## Token Storage + +Common patterns: +- SQLite KV: `auth_kv` table, keys like `:odic:token` +- Keyring: `secret-tool lookup ` +- JSON config: `~/.config//credentials.json` + +## Output Requirements + +Every RE session produces: +1. Binary profile +2. Auth flow map +3. Token schema +4. API endpoint list +5. State machine diagram +6. Bypass vectors +7. Config file map + + +## Related +- `skill reverse-engineering-binary — бинари` +- `skill cli-tooling — CLI` diff --git a/reverse-engineering-dotnet-malware-with-dnspy/LICENSE b/reverse-engineering-dotnet-malware-with-dnspy/LICENSE new file mode 100644 index 0000000..d885118 --- /dev/null +++ b/reverse-engineering-dotnet-malware-with-dnspy/LICENSE @@ -0,0 +1,201 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by the Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding any notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. Please do not remove or change + the license header comment from a contributed file except when + necessary. + + Copyright 2026 mukul975 + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md b/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md new file mode 100644 index 0000000..9e3e295 --- /dev/null +++ b/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md @@ -0,0 +1,348 @@ +--- +name: reverse-engineering-dotnet-malware-with-dnspy +description: 'Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify + obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. + Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET + obfuscation analysis. + + ' +domain: cybersecurity +subdomain: malware-analysis +tags: +- malware +- dotnet +- reverse-engineering +- dnSpy +- decompilation +version: 1.0.0 +author: mahipal +license: Apache-2.0 +nist_csf: +- DE.AE-02 +- RS.AN-03 +- ID.RA-01 +- DE.CM-01 +--- + +# Reverse Engineering .NET Malware with dnSpy + +## When to Use + +- A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation +- Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT) +- Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators +- Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies +- Debugging .NET malware at runtime to observe decryption routines and dynamic behavior + +**Do not use** for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis. + +## Prerequisites + +- dnSpy or dnSpyEx installed (https://github.com/dnSpyEx/dnSpy - community maintained fork) +- de4dot for automated .NET deobfuscation (`https://github.com/de4dot/de4dot`) +- ILSpy as an alternative decompiler for cross-validation +- .NET SDK installed for recompiling modified assemblies during analysis +- Isolated Windows VM for running dnSpy debugger on live malware +- Detect It Easy (DIE) for identifying the .NET obfuscator used + +## Workflow + +### Step 1: Identify .NET Assembly and Obfuscator + +Verify the sample is a .NET binary and detect protection: + +```bash +# Check if file is .NET assembly +file suspect.exe +# Output should contain "PE32 executable" with .NET metadata + +# Detect obfuscator with Detect It Easy +diec suspect.exe + +# Python-based .NET detection +python3 << 'PYEOF' +import pefile + +pe = pefile.PE("suspect.exe") + +# Check for .NET COM descriptor +if hasattr(pe, 'DIRECTORY_ENTRY_COM_DESCRIPTOR'): + print("[*] .NET assembly detected") + print(f" Runtime version: {pe.DIRECTORY_ENTRY_COM_DESCRIPTOR}") +else: + # Check for mscoree.dll import (alternative detection) + for entry in pe.DIRECTORY_ENTRY_IMPORT: + if entry.dll.decode().lower() == "mscoree.dll": + print("[*] .NET assembly detected (mscoree.dll import)") + break + else: + print("[!] Not a .NET assembly") + +# Check section names for .NET indicators +for section in pe.sections: + name = section.Name.decode().rstrip('\x00') + if name in ['.text', '.rsrc', '.reloc']: + print(f" Section: {name} (typical .NET)") +PYEOF +``` + +### Step 2: Deobfuscate with de4dot + +Remove common .NET obfuscation before manual analysis: + +```bash +# Run de4dot to identify and remove obfuscation +de4dot suspect.exe -o suspect_cleaned.exe + +# Force specific deobfuscator +de4dot suspect.exe -p cf # ConfuserEx +de4dot suspect.exe -p sa # SmartAssembly +de4dot suspect.exe -p dr # Dotfuscator +de4dot suspect.exe -p rv # Reactor +de4dot suspect.exe -p bl # Babel.NET + +# Verbose output for debugging +de4dot -v suspect.exe -o suspect_cleaned.exe + +# Handle multi-file assemblies +de4dot suspect.exe suspect_helper.dll -o cleaned/ +``` + +``` +Common .NET Obfuscators: +━━━━━━━━━━━━━━━━━━━━━━━ +ConfuserEx: String encryption, control flow, anti-debug, anti-tamper +SmartAssembly: String encoding, flow obfuscation, pruning +Dotfuscator: Renaming, string encryption, control flow +.NET Reactor: Native code generation, necrobit, anti-debug +Babel.NET: String encryption, resource encryption, code virtualization +Crypto Obfuscator: String encryption, anti-debug, watermarking +Custom: Malware-specific obfuscation (manual de4dot configuration needed) +``` + +### Step 3: Open in dnSpy and Analyze Code + +Load the deobfuscated assembly in dnSpy for source-level analysis: + +``` +dnSpy Analysis Workflow: +━━━━━━━━━━━━━━━━━━━━━━━ +1. File -> Open -> Select cleaned assembly +2. Navigate to the entry point: + - Assembly Explorer -> -> Program class -> Main method + - Or: Right-click assembly -> Go to Entry Point + +3. Key areas to examine: + - Entry point (Main) for initialization and execution flow + - Form classes for UI-based malware (RATs, stealers) + - Network/HTTP classes for C2 communication + - Crypto/encryption classes for data protection + - Resource access for embedded payloads + - Timer/Thread classes for persistence and scheduling + +4. Navigation shortcuts: + Ctrl+G - Go to token/address + Ctrl+Shift+K - Search assemblies + F12 - Go to definition + Ctrl+R - Analyze (find usages) + F5 - Start debugging + F9 - Toggle breakpoint +``` + +### Step 4: Extract Configuration and C2 Data + +Locate hardcoded configuration in the decompiled source: + +```csharp +// Common .NET malware configuration patterns: + +// Pattern 1: Static class with hardcoded values +public static class Config { + public static string Host = "185.220.101.42"; + public static int Port = 4782; + public static string Key = "GhOsT_RaT_2025"; + public static string Mutex = "AsyncMutex_6SI8OkPnk"; + public static bool Install = true; + public static string InstallFolder = "%AppData%"; +} + +// Pattern 2: Encrypted strings decrypted at runtime +public static string Decrypt(string input) { + byte[] data = Convert.FromBase64String(input); + byte[] key = Encoding.UTF8.GetBytes("SecretKey123"); + for (int i = 0; i < data.Length; i++) { + data[i] ^= key[i % key.Length]; + } + return Encoding.UTF8.GetString(data); +} + +// Pattern 3: Resource-embedded configuration +byte[] configData = Properties.Resources.config; +string config = AES.Decrypt(configData, derivedKey); +``` + +```python +# Python script to extract .NET resource strings +import subprocess +import re +import base64 + +# Use monodis (Mono) or ildasm (.NET SDK) to dump IL +result = subprocess.run( + ["monodis", "--output=il_dump.il", "suspect_cleaned.exe"], + capture_output=True, text=True +) + +# Search for string literals in IL dump +with open("il_dump.il", errors="ignore") as f: + il_code = f.read() + +# Find ldstr (load string) instructions +strings = re.findall(r'ldstr\s+"([^"]+)"', il_code) +for s in strings: + # Check for Base64 encoded strings + try: + decoded = base64.b64decode(s).decode('utf-8', errors='ignore') + if len(decoded) > 3 and decoded.isprintable(): + print(f" Base64: {s[:40]}... -> {decoded[:100]}") + except: + pass + # Check for URLs/IPs + if re.match(r'https?://', s) or re.match(r'\d+\.\d+\.\d+\.\d+', s): + print(f" Network: {s}") +``` + +### Step 5: Debug with dnSpy + +Set breakpoints and debug the malware to observe runtime behavior: + +``` +dnSpy Debugging Workflow: +━━━━━━━━━━━━━━━━━━━━━━━ +1. Set breakpoints on key methods: + - String decryption functions (to capture decrypted values) + - Network connection methods (to capture C2 URLs) + - File write operations (to see what is dropped) + - Registry modification methods (to see persistence) + +2. Debug -> Start Debugging (F5) + - Select the assembly to debug + - Set command-line arguments if needed + - Configure exception handling (break on all CLR exceptions) + +3. At each breakpoint: + - Inspect local variables (Locals window) + - Evaluate expressions (Immediate window) + - View call stack to understand execution context + - Step over (F10) / Step into (F11) / Step out (Shift+F11) + +4. Capture decrypted strings: + - Set breakpoint after decryption function returns + - Read the return value from the Locals window + - Document all decrypted configuration values +``` + +### Step 6: Document Findings + +Compile analysis results into a structured report: + +``` +Analysis documentation should include: +- .NET assembly metadata (CLR version, target framework, compilation info) +- Obfuscator identified and deobfuscation method used +- Complete C2 configuration (hosts, ports, encryption keys, mutex names) +- Malware capabilities (keylogging, screen capture, file theft, etc.) +- Persistence mechanisms (registry, scheduled tasks, startup folder) +- Anti-analysis techniques (VM detection, debugger detection, sandbox evasion) +- Extracted IOCs (C2 IPs/domains, file hashes, mutex names, registry keys) +- YARA rule based on unique code patterns or strings +``` + +## Key Concepts + +| Term | Definition | +|------|------------| +| **CIL/MSIL** | Common Intermediate Language; the bytecode format .NET assemblies compile to, which can be decompiled back to high-level C#/VB.NET | +| **Metadata Token** | Unique identifier for .NET types, methods, and fields within the assembly metadata tables; used for navigation in dnSpy | +| **de4dot** | Open-source .NET deobfuscator that identifies and removes protection from many commercial and malware-specific obfuscators | +| **ConfuserEx** | Popular open-source .NET obfuscator frequently used by malware authors for string encryption and control flow obfuscation | +| **String Encryption** | Obfuscation technique replacing string literals with encrypted data and runtime decryption calls to hide IOCs from static analysis | +| **Resource Embedding** | Storing configuration, payloads, or additional assemblies in .NET embedded resources, often encrypted with a key derived from assembly metadata | +| **Assembly.Load** | .NET method loading assemblies from byte arrays in memory, enabling fileless execution of embedded payloads | + +## Tools & Systems + +- **dnSpy/dnSpyEx**: Open-source .NET assembly editor, decompiler, and debugger supporting C# and VB.NET decompilation +- **de4dot**: Automated .NET deobfuscator supporting ConfuserEx, SmartAssembly, Dotfuscator, Reactor, and many other protectors +- **ILSpy**: Open-source .NET decompiler providing C#, VB.NET, and IL views of assembly code +- **dotPeek**: JetBrains' free .NET decompiler with symbol server and cross-reference navigation +- **Detect It Easy (DIE)**: Multi-format file analyzer identifying .NET framework version, obfuscator, and compiler information + +## Common Scenarios + +### Scenario: Analyzing an AgentTesla Information Stealer + +**Context**: A phishing email delivers a .NET executable identified as AgentTesla. The sample needs analysis to determine what credentials it steals, how it exfiltrates data, and its C2 configuration. + +**Approach**: +1. Run Detect It Easy to identify the obfuscator (commonly ConfuserEx or custom) +2. Deobfuscate with de4dot to restore readable class/method names and decrypt strings +3. Open in dnSpy and navigate to the entry point to understand initialization +4. Locate the credential harvesting modules (browser, email, FTP, VPN password theft classes) +5. Find the exfiltration method (SMTP email, FTP upload, HTTP POST, Telegram bot API) +6. Extract C2 configuration (SMTP server, credentials, recipient email, or HTTP URL) +7. Set debugger breakpoints on the decryption function to capture all decrypted strings at once + +**Pitfalls**: +- Analyzing without de4dot first (ConfuserEx makes manual analysis extremely difficult) +- Not checking for multi-stage loading (initial .NET executable may load additional assemblies from resources) +- Missing configuration stored in .NET resources rather than hardcoded strings +- Running the debugger without network isolation (AgentTesla will attempt to exfiltrate immediately) + +## Output Format + +``` +.NET MALWARE ANALYSIS REPORT +================================ +Sample: invoice_scanner.exe +SHA-256: e3b0c44298fc1c149afbf4c8996fb924... +Type: .NET Assembly (C#) +Framework: .NET Framework 4.8 +Obfuscator: ConfuserEx v1.6 +Deobfuscated: Yes (de4dot -p cf) + +CLASSIFICATION +Family: AgentTesla v3 +Type: Information Stealer / Keylogger +Compile Date: 2025-09-10 + +C2 CONFIGURATION +Exfil Method: SMTP (Email) +SMTP Server: smtp.yandex[.]com:587 +SMTP User: exfil.account@yandex[.]com +SMTP Pass: Str0ngP@ssw0rd2025 +Recipient: operator@protonmail[.]com +Interval: 30 minutes +Encryption: AES-256 with key "AgentTesla_2025_key" + +CAPABILITIES +[*] Browser credential theft (Chrome, Firefox, Edge, Opera) +[*] Email client passwords (Outlook, Thunderbird) +[*] FTP client credentials (FileZilla, WinSCP) +[*] VPN credentials (NordVPN, OpenVPN) +[*] Keylogging (SetWindowsHookEx) +[*] Screenshot capture (every 30 seconds) +[*] Clipboard monitoring + +PERSISTENCE +Method: Registry Run key + Scheduled Task +Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate +Task: \Microsoft\Windows\WindowsUpdate\Updater + +EXTRACTED IOCs +SMTP Server: smtp.yandex[.]com +Exfil Email: exfil.account@yandex[.]com +Recipient: operator@protonmail[.]com +Mutex: AgentTesla_2025_Q3_MUTEX +Install Path: %AppData%\Microsoft\Windows\svchost.exe +``` diff --git a/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md b/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md new file mode 100644 index 0000000..952527d --- /dev/null +++ b/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md @@ -0,0 +1,68 @@ +# API Reference: .NET Malware Reverse Engineering with dnSpy Agent + +## Overview + +Analyzes .NET malware: validates CLR headers, detects obfuscators (ConfuserEx, SmartAssembly), deobfuscates with de4dot, extracts strings/IOCs, and parses .NET metadata via monodis. + +## Dependencies + +| Package | Version | Purpose | +|---------|---------|---------| +| hashlib | stdlib | Sample hash computation | +| struct | stdlib | PE/CLR header parsing | +| re | stdlib | String pattern extraction | + +## External Tools (Optional) + +| Tool | Purpose | +|------|---------| +| diec (Detect It Easy) | Obfuscator identification | +| de4dot | Automated .NET deobfuscation | +| monodis | .NET assembly metadata extraction | + +## Core Functions + +### `detect_dotnet_assembly(filepath)` +Validates PE file has CLR header (COM descriptor directory entry). +- **Checks**: MZ signature, PE signature, optional header magic, CLR RVA +- **Returns**: `dict` with `is_dotnet`, `clr_header_rva` + +### `detect_obfuscator(filepath)` +Runs Detect It Easy to identify ConfuserEx, SmartAssembly, .NET Reactor, Dotfuscator, Babel, Eazfuscator, Crypto Obfuscator. +- **Returns**: `dict` with `detected` list + +### `deobfuscate_with_de4dot(filepath, output_path)` +Runs de4dot to remove obfuscation, producing a cleaner assembly. +- **Timeout**: 120 seconds +- **Returns**: `dict` with `success`, `output_path` + +### `extract_strings(filepath, min_length)` +Extracts ASCII and Unicode strings, classifies into URLs, IPs, emails, registry keys, base64, and suspicious keywords (keylog, stealer, webhook, etc.). +- **Returns**: `dict[str, list[str]]` - categorized indicator lists + +### `analyze_dotnet_metadata(filepath)` +Uses monodis to extract assembly info, type definitions, and method counts. +- **Returns**: `dict` with `type_count`, `method_count`, `types` + +### `analyze_dotnet_malware(filepath, output_dir)` +Full pipeline: hashes -> .NET check -> obfuscator detection -> deobfuscation -> strings -> metadata. + +## Obfuscators Detected + +| Obfuscator | Indicator | +|------------|-----------| +| ConfuserEx | Most common open-source .NET obfuscator | +| SmartAssembly | Commercial obfuscator by Redgate | +| .NET Reactor | Code protection with native stub | +| Dotfuscator | Microsoft-provided obfuscator | +| Eazfuscator | Commercial string/flow obfuscation | + +## Suspicious String Keywords + +`keylog`, `screenshot`, `clipboard`, `password`, `credential`, `smtp`, `telegram`, `discord`, `webhook`, `stealer`, `inject`, `hook`, `persist`, `startup` + +## Usage + +```bash +python agent.py suspect.exe +``` diff --git a/reverse-engineering-dotnet-malware-with-dnspy/scripts/agent.py b/reverse-engineering-dotnet-malware-with-dnspy/scripts/agent.py new file mode 100644 index 0000000..30db17c --- /dev/null +++ b/reverse-engineering-dotnet-malware-with-dnspy/scripts/agent.py @@ -0,0 +1,218 @@ +#!/usr/bin/env python3 +""".NET malware reverse engineering agent using subprocess wrappers for dnSpy/de4dot.""" + +import subprocess +import os +import sys +import re +import hashlib +import struct + + +def compute_hashes(filepath): + """Compute hashes for sample identification.""" + with open(filepath, "rb") as f: + data = f.read() + return { + "md5": hashlib.md5(data).hexdigest(), + "sha256": hashlib.sha256(data).hexdigest(), + "size": len(data), + } + + +def detect_dotnet_assembly(filepath): + """Check if file is a .NET assembly by looking for CLI header.""" + with open(filepath, "rb") as f: + data = f.read(512) + if data[:2] != b"MZ": + return {"is_dotnet": False, "reason": "Not a PE file"} + try: + pe_offset = struct.unpack_from(" len(data): + return {"is_dotnet": False, "reason": "Invalid PE header"} + if data[pe_offset:pe_offset + 4] != b"PE\x00\x00": + return {"is_dotnet": False, "reason": "Invalid PE signature"} + opt_offset = pe_offset + 24 + magic = struct.unpack_from(" 0 and clr_size > 0: + return {"is_dotnet": True, "clr_header_rva": clr_rva, "clr_size": clr_size} + return {"is_dotnet": False, "reason": "No CLR header"} + except (struct.error, IndexError): + return {"is_dotnet": False, "reason": "Parse error"} + + +def detect_obfuscator(filepath): + """Detect .NET obfuscator using Detect It Easy.""" + try: + result = subprocess.run( + ["diec", filepath], capture_output=True, text=True, timeout=30 + ) + output = result.stdout + obfuscators = { + "ConfuserEx": "confuser" in output.lower(), + "SmartAssembly": "smartassembly" in output.lower(), + ".NET Reactor": "reactor" in output.lower(), + "Dotfuscator": "dotfuscator" in output.lower(), + "Babel": "babel" in output.lower(), + "Eazfuscator": "eazfuscator" in output.lower(), + "Crypto Obfuscator": "crypto" in output.lower() and "obfuscator" in output.lower(), + } + detected = [name for name, found in obfuscators.items() if found] + return {"detected": detected, "raw_output": output.strip()} + except FileNotFoundError: + return {"detected": [], "raw_output": "diec not installed"} + + +def deobfuscate_with_de4dot(filepath, output_path): + """Run de4dot to deobfuscate .NET assembly.""" + try: + result = subprocess.run( + ["de4dot", filepath, "-o", output_path], + capture_output=True, text=True, timeout=120 + ) + return { + "success": result.returncode == 0, + "output_path": output_path, + "stdout": result.stdout[-500:] if result.stdout else "", + } + except FileNotFoundError: + return {"success": False, "error": "de4dot not installed"} + + +def extract_strings(filepath, min_length=8): + """Extract strings and classify for IOCs.""" + with open(filepath, "rb") as f: + data = f.read() + unicode_strings = re.findall( + rb"(?:[\x20-\x7e]\x00){%d,}" % min_length, data + ) + ascii_strings = re.findall( + rb"[\x20-\x7e]{%d,}" % min_length, data + ) + all_strings = set() + for s in ascii_strings: + all_strings.add(s.decode("ascii", errors="ignore")) + for s in unicode_strings: + all_strings.add(s.decode("utf-16-le", errors="ignore")) + indicators = { + "urls": [], "ips": [], "emails": [], + "registry_keys": [], "file_paths": [], + "base64_strings": [], "suspicious_strings": [], + } + suspicious_keywords = [ + "keylog", "screenshot", "clipboard", "password", "credential", + "smtp", "telegram", "discord", "webhook", "stealer", + "inject", "hook", "persist", "startup", + ] + for s in all_strings: + if re.search(r"https?://", s): + indicators["urls"].append(s) + if re.search(r"\b(\d{1,3}\.){3}\d{1,3}\b", s): + indicators["ips"].append(s) + if re.search(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}", s): + indicators["emails"].append(s) + if re.search(r"HKLM|HKCU|SOFTWARE\\", s, re.IGNORECASE): + indicators["registry_keys"].append(s) + if re.search(r"[A-Za-z0-9+/]{40,}={0,2}$", s): + indicators["base64_strings"].append(s[:100]) + for kw in suspicious_keywords: + if kw in s.lower(): + indicators["suspicious_strings"].append(s[:100]) + break + for key in indicators: + indicators[key] = list(set(indicators[key]))[:20] + return indicators + + +def analyze_dotnet_metadata(filepath): + """Extract .NET metadata using monodis or ilspy CLI if available.""" + metadata = {} + try: + result = subprocess.run( + ["monodis", "--assembly", filepath], + capture_output=True, text=True, timeout=15 + ) + if result.returncode == 0: + metadata["assembly_info"] = result.stdout.strip() + except FileNotFoundError: + pass + try: + result = subprocess.run( + ["monodis", "--typedef", filepath], + capture_output=True, text=True, timeout=15 + ) + if result.returncode == 0: + types = re.findall(r"(\S+)\s+flags", result.stdout) + metadata["type_count"] = len(types) + metadata["types"] = types[:30] + except FileNotFoundError: + pass + try: + result = subprocess.run( + ["monodis", "--method", filepath], + capture_output=True, text=True, timeout=15 + ) + if result.returncode == 0: + methods = re.findall(r"(\S+)\s+\(", result.stdout) + metadata["method_count"] = len(methods) + except FileNotFoundError: + pass + return metadata + + +def analyze_dotnet_malware(filepath, output_dir="/tmp/dotnet_analysis"): + """Full .NET malware analysis pipeline.""" + os.makedirs(output_dir, exist_ok=True) + report = {"file": filepath} + report["hashes"] = compute_hashes(filepath) + report["dotnet_check"] = detect_dotnet_assembly(filepath) + if not report["dotnet_check"].get("is_dotnet"): + report["error"] = "Not a .NET assembly" + return report + report["obfuscator"] = detect_obfuscator(filepath) + deobf_path = os.path.join(output_dir, "deobfuscated.exe") + report["deobfuscation"] = deobfuscate_with_de4dot(filepath, deobf_path) + analysis_target = deobf_path if report["deobfuscation"].get("success") else filepath + report["strings"] = extract_strings(analysis_target) + report["metadata"] = analyze_dotnet_metadata(analysis_target) + return report + + +def print_report(report): + print(".NET Malware Analysis Report") + print("=" * 50) + print(f"File: {report['file']}") + print(f"SHA-256: {report['hashes']['sha256']}") + print(f".NET Assembly: {report['dotnet_check'].get('is_dotnet', False)}") + obf = report.get("obfuscator", {}) + if obf.get("detected"): + print(f"Obfuscator: {', '.join(obf['detected'])}") + deobf = report.get("deobfuscation", {}) + print(f"Deobfuscation: {'Success' if deobf.get('success') else 'Failed/Skipped'}") + meta = report.get("metadata", {}) + if meta: + print(f"Types: {meta.get('type_count', 'N/A')}, Methods: {meta.get('method_count', 'N/A')}") + strings = report.get("strings", {}) + if strings: + print("\nExtracted Indicators:") + for cat, values in strings.items(): + if values: + print(f" {cat}: {len(values)}") + for v in values[:3]: + print(f" - {v[:80]}") + + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python agent.py ") + sys.exit(1) + result = analyze_dotnet_malware(sys.argv[1]) + print_report(result) diff --git a/reverse-engineering-full/SKILL.md b/reverse-engineering-full/SKILL.md new file mode 100644 index 0000000..a26ab71 --- /dev/null +++ b/reverse-engineering-full/SKILL.md @@ -0,0 +1,159 @@ +--- +name: reverse-engineering-full +description: Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol + RE, auth flow mapping, IPC analysis, shell integration, telemetry extraction, token + storage, state machine reconstruction, API enumeration, and security report generation. + Covers Rust, Go, C/C++, Python, .NET, Java. +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - reverse + - engineering + - full + - spectrum + - binary + - elf + - mach + - protocol + - auth + - flow + - mapping + - ipc +depends_on: [] +metadata: + tags: + - reverse + - engineering + - full +--- + +# Reverse Engineering — Full Framework + +## When to Use + +- Any binary reverse engineering task +- Protocol analysis (IPC, network, file format) +- Auth flow mapping and token extraction +- Telemetry and data collection analysis +- Shell/terminal integration analysis +- API endpoint enumeration from binaries +- State machine reconstruction +- Security assessment of closed-source software +- Migration path analysis (rebrand/fork detection) +- Bypass vector identification + +## Core Protocol + +Load `skills/meta-rules/meta-re/re-full-practice.md` for the complete methodology. + +## Quick Start + +```bash +# Phase 1: Binary profiling (always first) +file && readelf -h 2>/dev/null || otool -h 2>/dev/null +strings | head -100 # Quick scan + +# Phase 2: String extraction by category +strings | grep -iE "login|logout|token|auth|session|oauth|oidc|cookie" > /tmp/re/auth.txt +strings | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u > /tmp/re/urls.txt +strings | grep -iE "\.config|\.local|\.cache|HOME|APPDATA|registry" | grep -v "registry/src" > /tmp/re/paths.txt +strings | grep -iE "error|fail|panic|assert|exception" | grep -v "registry/src" > /tmp/re/errors.txt + +# Phase 3: Language detection +strings | grep -oE "crates/[^/]+" | sort -u # Rust +strings | grep -oE "vendor/[^/]+" | sort -u # Go +strings | grep -oE "site-packages/[^/]+" | sort -u # Python +strings | grep -oE "node_modules/[^/]+" | sort -u # Node + +# Phase 4: Protocol analysis +strings | grep -iE "\.(proto|mux|ipc|rpc|grpc)" | sort -u +strings | grep -iE "unix.socket|socket.path|named.pipe" | sort -u + +# Phase 5: Generate report +# Use the report template from skills/meta-rules/meta-re/re-report-template.md +``` + +## Phase Breakdown + +### Phase 1: Binary Reconnaissance +- File type, architecture, bitness +- Stripped vs debug symbols +- Dynamic dependencies (ldd/otool) +- Packed/obfuscated detection +- Language/framework identification + +### Phase 2: String Extraction & Classification +- Auth/credential strings +- URLs/endpoints +- File paths/config locations +- Error messages (state indicators) +- Protocol/message type names +- Environment variables +- Telemetry/analytics identifiers + +### Phase 3: Structural Analysis +- Import table analysis +- Section analysis (.text, .rodata, .data) +- Symbol table (if not stripped) +- Embedded resources +- Certificate/signature info + +### Phase 4: Protocol Reverse Engineering +- IPC mechanism (Unix sockets, named pipes, TCP, D-Bus) +- Message format (Protobuf, JSON, custom binary) +- Request/response patterns +- State machine from message types +- Authentication within protocol + +### Phase 5: Auth Flow Mapping +- Login methods enumeration +- Token storage location and format +- Refresh mechanism +- Session management +- Logout/cleanup behavior + +### Phase 6: Telemetry & Data Collection +- Event types enumeration +- Data fields per event +- Destination endpoints +- Frequency/triggers +- Opt-out mechanisms + +### Phase 7: Security Analysis +- Token storage security +- Communication encryption +- Permission model +- Attack surface mapping +- Bypass vectors + +### Phase 8: Report Generation +- Use the structured report template +- Include all findings with evidence +- Provide architecture diagrams +- List actionable security findings + +## Output Requirements + +Every RE session produces a report with these sections: +1. Binary Profile +2. Language & Framework +3. Crate/Module Architecture +4. Auth Flow Map +5. Token Storage Schema +6. State Machine +7. API Endpoints +8. IPC Protocol +9. Shell/Integration Analysis +10. Telemetry Schema +11. Security Findings +12. Architecture Diagram +13. Bypass Vectors +14. Migration/Rebrand Analysis (if applicable) + + +## Related +- `skill reverse-engineering-binary — бинари` +- `skill reverse-engineering-obfuscation — деобфускация` diff --git a/reverse-engineering-ios-app-with-frida/LICENSE b/reverse-engineering-ios-app-with-frida/LICENSE new file mode 100644 index 0000000..d885118 --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/LICENSE @@ -0,0 +1,201 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by the Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding any notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. Please do not remove or change + the license header comment from a contributed file except when + necessary. + + Copyright 2026 mukul975 + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/reverse-engineering-ios-app-with-frida/SKILL.md b/reverse-engineering-ios-app-with-frida/SKILL.md new file mode 100644 index 0000000..89034cf --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/SKILL.md @@ -0,0 +1,251 @@ +--- +name: reverse-engineering-ios-app-with-frida +description: 'Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract + encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing + authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime + secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift + method tracing, or iOS binary analysis. + + ' +domain: cybersecurity +subdomain: mobile-security +author: mahipal +tags: +- mobile-security +- ios +- frida +- reverse-engineering +- owasp-mobile +- penetration-testing +version: 1.0.0 +license: Apache-2.0 +nist_csf: +- PR.PS-01 +- PR.AA-05 +- ID.RA-01 +- DE.CM-09 +--- +# Reverse Engineering iOS App with Frida + +## When to Use + +Use this skill when: +- Analyzing iOS app internals during authorized security assessments without source code +- Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps +- Understanding obfuscated Swift/Objective-C logic through runtime method tracing +- Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging) + +**Do not use** this skill for unauthorized reverse engineering that violates terms of service or intellectual property law. + +## Prerequisites + +- Jailbroken iOS device with Frida server installed via Cydia/Sileo, or non-jailbroken device with Frida Gadget-injected IPA +- Python 3.10+ with `frida-tools` (`pip install frida-tools`) +- USB connection to iOS device +- class-dump or dsdump for Objective-C header extraction +- Hopper Disassembler or Ghidra for static binary analysis (complementary) +- Knowledge of Objective-C runtime and Swift name mangling + +## Workflow + +### Step 1: Extract and Analyze the Binary + +```bash +# On jailbroken device, find app binary +ssh root@ +find /var/containers/Bundle/Application/ -name "TargetApp" -type f + +# Pull decrypted binary (apps from App Store are encrypted with FairPlay) +# Use frida-ios-dump or Clutch for decryption +pip install frida-ios-dump +dump.py com.target.app + +# Extract Objective-C class headers +class-dump -H decrypted_binary -o headers/ +ls headers/ # Lists all class header files +``` + +### Step 2: Enumerate Classes and Methods at Runtime + +```javascript +// enumerate_classes.js - List all loaded classes +Java.perform(function() {}); // N/A for iOS + +// iOS uses ObjC runtime +if (ObjC.available) { + var classes = ObjC.classes; + for (var className in classes) { + if (className.indexOf("Target") !== -1 || + className.indexOf("Auth") !== -1 || + className.indexOf("Crypto") !== -1) { + console.log("[Class] " + className); + + // List methods + var methods = classes[className].$ownMethods; + for (var i = 0; i < methods.length; i++) { + console.log(" [Method] " + methods[i]); + } + } + } +} +``` + +```bash +frida -U -n TargetApp -l enumerate_classes.js +``` + +### Step 3: Trace Method Calls with frida-trace + +```bash +# Trace all methods of a class +frida-trace -U -n TargetApp -m "*[TargetAuth *]" + +# Trace specific patterns +frida-trace -U -n TargetApp -m "*[*Crypto* *]" +frida-trace -U -n TargetApp -m "*[*KeyChain* *]" +frida-trace -U -n TargetApp -m "*[*Token* *]" + +# Trace Swift methods (mangled names) +frida-trace -U -n TargetApp -m "*[*$s*Auth*]" +``` + +### Step 4: Hook and Modify Method Behavior + +```javascript +// hook_auth.js - Intercept authentication logic +if (ObjC.available) { + // Hook Objective-C method + var AuthManager = ObjC.classes.AuthManager; + if (AuthManager) { + Interceptor.attach(AuthManager["- validateToken:"].implementation, { + onEnter: function(args) { + // args[0] = self, args[1] = selector, args[2+] = method args + var token = new ObjC.Object(args[2]); + console.log("[Auth] validateToken called with: " + token.toString()); + }, + onLeave: function(retval) { + console.log("[Auth] validateToken returned: " + retval); + // Optionally modify return value + // retval.replace(ptr(1)); // Force return true + } + }); + } + + // Hook CommonCrypto for encryption analysis + var CCCrypt = Module.findExportByName("libcommonCrypto.dylib", "CCCrypt"); + if (CCCrypt) { + Interceptor.attach(CCCrypt, { + onEnter: function(args) { + this.operation = args[0].toInt32(); // 0=encrypt, 1=decrypt + this.algorithm = args[1].toInt32(); // 0=AES128, 1=DES, 2=3DES + this.keyLength = args[4].toInt32(); + this.key = Memory.readByteArray(args[3], this.keyLength); + console.log("[CCCrypt] Op:" + (this.operation === 0 ? "Encrypt" : "Decrypt")); + console.log("[CCCrypt] Key: " + hexify(this.key)); + }, + onLeave: function(retval) { + console.log("[CCCrypt] Status: " + retval); + } + }); + } +} + +function hexify(buffer) { + var bytes = new Uint8Array(buffer); + var hex = []; + for (var i = 0; i < bytes.length; i++) { + hex.push(("0" + bytes[i].toString(16)).slice(-2)); + } + return hex.join(""); +} +``` + +### Step 5: Analyze Swift Code + +```javascript +// swift_analysis.js - Hook Swift methods +// Swift methods use name mangling: $s +// Use frida-trace to discover actual mangled names first + +if (ObjC.available) { + // Swift classes that inherit from NSObject are accessible via ObjC runtime + var swiftClasses = Object.keys(ObjC.classes).filter(function(name) { + return name.indexOf("_TtC") === 0 || name.indexOf("TargetApp.") !== -1; + }); + + swiftClasses.forEach(function(className) { + console.log("[Swift] " + className); + var methods = ObjC.classes[className].$ownMethods; + methods.forEach(function(method) { + console.log(" " + method); + }); + }); +} + +// For pure Swift (non-ObjC-bridged), use Module.enumerateExports +Module.enumerateExports("TargetApp", { + onMatch: function(exp) { + if (exp.name.indexOf("Auth") !== -1 || exp.name.indexOf("Crypto") !== -1) { + console.log("[Export] " + exp.name + " @ " + exp.address); + } + }, + onComplete: function() {} +}); +``` + +### Step 6: Extract Secrets and Proprietary Data + +```javascript +// extract_secrets.js +if (ObjC.available) { + // Hook NSUserDefaults + var NSUserDefaults = ObjC.classes.NSUserDefaults; + Interceptor.attach(NSUserDefaults["- objectForKey:"].implementation, { + onEnter: function(args) { + this.key = new ObjC.Object(args[2]).toString(); + }, + onLeave: function(retval) { + if (retval.isNull()) return; + var value = new ObjC.Object(retval); + console.log("[NSUserDefaults] " + this.key + " = " + value.toString()); + } + }); + + // Hook Keychain access + var SecItemCopyMatching = Module.findExportByName("Security", "SecItemCopyMatching"); + Interceptor.attach(SecItemCopyMatching, { + onEnter: function(args) { + var query = new ObjC.Object(args[0]); + console.log("[Keychain] Query: " + query.toString()); + }, + onLeave: function(retval) { + console.log("[Keychain] Result: " + retval); + } + }); +} +``` + +## Key Concepts + +| Term | Definition | +|------|-----------| +| **Objective-C Runtime** | Dynamic runtime enabling method dispatch, class introspection, and method swizzling at runtime | +| **Swift Name Mangling** | Compiler-applied encoding of Swift function signatures into linker-compatible symbol names | +| **FairPlay DRM** | Apple's encryption applied to App Store binaries; must be decrypted before static analysis | +| **class-dump** | Tool extracting Objective-C class declarations from Mach-O binaries for header-level analysis | +| **CommonCrypto** | Apple's C-level cryptographic library; primary target for encryption key extraction via Frida hooks | + +## Tools & Systems + +- **Frida**: Dynamic instrumentation framework for iOS runtime hooking and method interception +- **frida-trace**: Automated tracing utility that generates handler stubs for matched methods +- **frida-ios-dump**: Tool for decrypting FairPlay-protected iOS apps via memory dumping +- **class-dump / dsdump**: Objective-C header extraction from Mach-O binaries +- **Ghidra**: NSA's reverse engineering framework for static ARM64 binary analysis of iOS apps + +## Common Pitfalls + +- **FairPlay encryption**: Apps downloaded from the App Store are encrypted. You must decrypt before static analysis. Use frida-ios-dump on a jailbroken device. +- **Swift-only classes**: Pure Swift classes without `@objc` annotation are not visible through `ObjC.classes`. Use `Module.enumerateExports()` instead. +- **Stripped binaries**: Release builds strip debug symbols. Combine frida-trace with class-dump output for effective analysis. +- **Anti-Frida measures**: Sophisticated apps check for Frida artifacts (frida-server process, Frida agent strings in memory, injected libraries in dyld). Use stealthy Frida builds or Frida Gadget injection. diff --git a/reverse-engineering-ios-app-with-frida/assets/template.md b/reverse-engineering-ios-app-with-frida/assets/template.md new file mode 100644 index 0000000..6a5e3c3 --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/assets/template.md @@ -0,0 +1,38 @@ +# iOS Reverse Engineering Assessment Report + +## Target Application +| Field | Value | +|-------|-------| +| App Name | [NAME] | +| Bundle ID | [BUNDLE_ID] | +| Binary Type | [Objective-C/Swift/Mixed] | +| iOS Version | [VERSION] | +| FairPlay Encrypted | [YES/NO] | +| Analysis Date | [DATE] | + +## Class Enumeration +| Class Name | Method Count | Category | +|-----------|-------------|----------| +| [CLASS] | [N] | [Auth/Crypto/Network/Storage] | + +## Hooked Methods and Findings +### [METHOD_SIGNATURE] +- **Arguments observed**: [ARGS] +- **Return values**: [RETURNS] +- **Security implication**: [DESCRIPTION] + +## Extracted Secrets +| Type | Location | Value (redacted) | Risk | +|------|----------|-----------------|------| +| [API Key/Token/Password] | [CLASS.METHOD] | [REDACTED] | [RISK] | + +## Binary Protection Assessment +| Protection | Status | Details | +|-----------|--------|---------| +| Jailbreak Detection | [Present/Absent] | [DETAILS] | +| Frida Detection | [Present/Absent] | [DETAILS] | +| Code Obfuscation | [Yes/No] | [DETAILS] | +| Anti-Debug | [Present/Absent] | [DETAILS] | + +## Recommendations +1. [RECOMMENDATION] diff --git a/reverse-engineering-ios-app-with-frida/references/api-reference.md b/reverse-engineering-ios-app-with-frida/references/api-reference.md new file mode 100644 index 0000000..f0c6b38 --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/references/api-reference.md @@ -0,0 +1,48 @@ +# API Reference: iOS App Reverse Engineering with Frida + +## Frida CLI Tools + +| Command | Description | +|---------|-------------| +| `frida-ps -Ua` | List running apps on USB device | +| `frida -U -n AppName -e "script"` | Attach to app and run script | +| `frida -U -f com.app.bundle -l script.js` | Spawn app with script | +| `frida-trace -U -n AppName -m "*[ClassName *]"` | Trace ObjC methods | +| `frida-discover -U -n AppName` | Discover available functions | + +## Frida JavaScript API + +| API | Description | +|-----|-------------| +| `ObjC.classes.ClassName` | Access Objective-C class | +| `ObjC.classes.Cls.$ownMethods` | List class methods | +| `Interceptor.attach(target, callbacks)` | Hook native function | +| `Interceptor.replace(target, replacement)` | Replace function implementation | +| `Module.findExportByName(null, "func")` | Find exported C function | +| `ObjC.Object(ptr)` | Wrap pointer as ObjC object | +| `Memory.readUtf8String(ptr)` | Read string from memory | + +## Common iOS Security Hooks + +| Target | Purpose | +|--------|---------| +| `SSLSetPeerDomainName` | Bypass SSL pinning | +| `NSFileManager fileExistsAtPath:` | Jailbreak detection | +| `CCCrypt` | Intercept encryption calls | +| `NSURLSession` | Monitor network requests | +| `SecItemCopyMatching` | Keychain access | + +## Python Libraries + +| Library | Version | Purpose | +|---------|---------|---------| +| `subprocess` | stdlib | Execute frida CLI tools | +| `frida` | >=16.0 | Frida Python bindings | +| `json` | stdlib | Report generation | + +## References + +- Frida Documentation: https://frida.re/docs/home/ +- Frida JavaScript API: https://frida.re/docs/javascript-api/ +- objection: https://github.com/sensepost/objection +- OWASP Mobile Testing Guide: https://mas.owasp.org/MASTG/ diff --git a/reverse-engineering-ios-app-with-frida/references/standards.md b/reverse-engineering-ios-app-with-frida/references/standards.md new file mode 100644 index 0000000..463ffd3 --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/references/standards.md @@ -0,0 +1,27 @@ +# Standards Reference: iOS Reverse Engineering with Frida + +## OWASP Mobile Top 10 2024 Mapping + +| OWASP ID | Risk | RE Assessment | +|----------|------|---------------| +| M1 | Improper Credential Usage | Extract hardcoded keys via runtime hooking | +| M7 | Insufficient Binary Protections | Assess anti-RE measures (obfuscation, anti-debug, anti-Frida) | +| M10 | Insufficient Cryptography | Hook CommonCrypto to extract keys and observe algorithms | + +## OWASP MASVS v2.0 - MASVS-RESILIENCE Controls + +| Control | Description | Frida Test Method | +|---------|-------------|-------------------| +| MASVS-RESILIENCE-1 | App detects and responds to reverse engineering | Test with Frida attachment, observe detection | +| MASVS-RESILIENCE-2 | App detects tampering | Modify binary, observe integrity checks | +| MASVS-RESILIENCE-3 | App uses obfuscation | Assess class/method name readability | +| MASVS-RESILIENCE-4 | App detects debuggers | Attach debugger, check ptrace/sysctl hooks | + +## CWE Mappings + +| CWE ID | Title | RE Discovery Method | +|--------|-------|-------------------| +| CWE-798 | Use of Hard-coded Credentials | Hook string initialization, NSUserDefaults access | +| CWE-321 | Use of Hard-coded Cryptographic Key | Hook CCCrypt, SecKeyCreateWithData | +| CWE-327 | Broken Crypto Algorithm | Observe algorithm parameter in CCCrypt calls | +| CWE-693 | Protection Mechanism Failure | Bypass jailbreak detection, Frida detection | diff --git a/reverse-engineering-ios-app-with-frida/references/workflows.md b/reverse-engineering-ios-app-with-frida/references/workflows.md new file mode 100644 index 0000000..9b40e91 --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/references/workflows.md @@ -0,0 +1,36 @@ +# Workflows: iOS Reverse Engineering with Frida + +## Workflow 1: Full iOS RE Pipeline + +``` +[Obtain IPA/binary] --> [Decrypt FairPlay] --> [Static analysis] --> [Dynamic analysis] + | | | + [frida-ios-dump] [class-dump] [frida-trace] + [Clutch] [Ghidra] [Custom hooks] + [Hopper] [Method interception] + | + [Extract secrets] + [Map logic flow] + [Document findings] +``` + +## Workflow 2: Crypto Key Extraction + +``` +[Hook CommonCrypto] --> [Capture CCCrypt calls] --> [Extract key material] + | + [Log algorithm, mode, IV] + [Log input/output data] + | + [Reconstruct protocol] + [Document encryption scheme] +``` + +## Decision Matrix: iOS RE Approach + +| Binary Type | Static Tool | Dynamic Tool | Notes | +|-------------|------------|-------------|-------| +| Objective-C | class-dump + Ghidra | Frida ObjC.classes | Full runtime visibility | +| Swift (NSObject-based) | dsdump + Ghidra | Frida ObjC.classes | Partial visibility | +| Pure Swift | Ghidra + Swift demangling | Frida Module.enumerateExports | Limited runtime access | +| C/C++ native | Ghidra | Frida Interceptor.attach | Address-based hooking | diff --git a/reverse-engineering-ios-app-with-frida/scripts/agent.py b/reverse-engineering-ios-app-with-frida/scripts/agent.py new file mode 100644 index 0000000..cb3f9d6 --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/scripts/agent.py @@ -0,0 +1,160 @@ +#!/usr/bin/env python3 +"""Agent for iOS app reverse engineering with Frida. + +Uses frida-tools to attach to iOS processes, hook Objective-C +methods, bypass SSL pinning, dump keychain entries, and trace +API calls for security assessment. +""" + +import subprocess +import json +import sys +from datetime import datetime +from pathlib import Path + + +class FridaIOSAgent: + """Reverse engineers iOS applications using Frida.""" + + def __init__(self, target_app, device_id=None, output_dir="./frida_ios"): + self.target_app = target_app + self.device_id = device_id + self.output_dir = Path(output_dir) + self.output_dir.mkdir(parents=True, exist_ok=True) + self.findings = [] + + def _frida_cmd(self, script_code, timeout=60): + cmd = ["frida", "-U"] + if self.device_id: + cmd.extend(["-D", self.device_id]) + cmd.extend(["-n", self.target_app, "-q", "-e", script_code]) + try: + result = subprocess.run(cmd, capture_output=True, text=True, + timeout=timeout) + return {"stdout": result.stdout, "stderr": result.stderr, + "returncode": result.returncode} + except (FileNotFoundError, subprocess.TimeoutExpired) as exc: + return {"error": str(exc)} + + def list_running_apps(self): + """List running applications on the connected iOS device.""" + cmd = ["frida-ps", "-Ua"] + if self.device_id: + cmd.extend(["-D", self.device_id]) + try: + result = subprocess.run(cmd, capture_output=True, text=True, timeout=15) + return {"apps": result.stdout} + except (FileNotFoundError, subprocess.TimeoutExpired) as exc: + return {"error": str(exc)} + + def bypass_ssl_pinning(self): + """Inject Frida script to bypass SSL certificate pinning.""" + script = """ +var m = ObjC.classes.NSURLSessionConfiguration; +Interceptor.attach(m['- setTLSMinimumSupportedProtocol:'].implementation, { + onEnter: function(args) { console.log('[*] TLS config intercepted'); } +}); +try { + var SSLSetPeerDomainName = Module.findExportByName(null, 'SSLSetPeerDomainName'); + if (SSLSetPeerDomainName) { + Interceptor.attach(SSLSetPeerDomainName, { + onEnter: function(args) { }, + onLeave: function(retval) { retval.replace(0); } + }); + console.log('[+] SSL pinning bypassed'); + } +} catch(e) { console.log('[-] ' + e); } +""" + result = self._frida_cmd(script) + if "SSL pinning bypassed" in result.get("stdout", ""): + self.findings.append({"type": "SSL Pinning Bypass", + "severity": "Medium", + "details": "SSL pinning can be bypassed with Frida"}) + return result + + def dump_keychain(self): + """Dump iOS Keychain entries accessible by the app.""" + script = """ +var kSecClass = ObjC.classes.NSString.stringWithString_('kSecClass'); +var query = ObjC.classes.NSMutableDictionary.dictionary(); +query.setObject_forKey_(ObjC.classes.NSString.stringWithString_('kSecClassGenericPassword'), kSecClass); +query.setObject_forKey_(ObjC.classes.NSNumber.numberWithBool_(true), ObjC.classes.NSString.stringWithString_('kSecReturnAttributes')); +query.setObject_forKey_(ObjC.classes.NSString.stringWithString_('kSecMatchLimitAll'), ObjC.classes.NSString.stringWithString_('kSecMatchLimit')); +var result = new ObjC.Object(ptr(0)); +var status = ObjC.classes.NSDictionary.alloc(); +console.log('[*] Keychain query executed'); +""" + result = self._frida_cmd(script) + return result + + def trace_objc_methods(self, class_name): + """Trace all method calls on a specific Objective-C class.""" + script = f""" +var target = ObjC.classes.{class_name}; +if (target) {{ + var methods = target.$ownMethods; + console.log('[*] Tracing ' + methods.length + ' methods on {class_name}'); + methods.forEach(function(method) {{ + try {{ + Interceptor.attach(target[method].implementation, {{ + onEnter: function(args) {{ + console.log('[CALL] {class_name} ' + method); + }} + }}); + }} catch(e) {{}} + }}); +}} else {{ + console.log('[-] Class {class_name} not found'); +}} +""" + return self._frida_cmd(script, timeout=30) + + def check_jailbreak_detection(self): + """Test if app has jailbreak detection and attempt bypass.""" + script = """ +var paths = ['/Applications/Cydia.app', '/usr/sbin/sshd', + '/bin/bash', '/usr/bin/ssh', '/etc/apt']; +var NSFileManager = ObjC.classes.NSFileManager; +Interceptor.attach(NSFileManager['- fileExistsAtPath:'].implementation, { + onEnter: function(args) { + var path = ObjC.Object(args[2]).toString(); + for (var i = 0; i < paths.length; i++) { + if (path.indexOf(paths[i]) !== -1) { + console.log('[*] Jailbreak check: ' + path); + } + } + }, + onLeave: function(retval) {} +}); +console.log('[+] Jailbreak detection hooks installed'); +""" + result = self._frida_cmd(script, timeout=15) + if "Jailbreak check" in result.get("stdout", ""): + self.findings.append({"type": "Jailbreak Detection Present", + "severity": "Info"}) + return result + + def generate_report(self): + report = { + "target_app": self.target_app, + "report_date": datetime.utcnow().isoformat(), + "findings": self.findings, + } + report_path = self.output_dir / "frida_ios_report.json" + with open(report_path, "w") as f: + json.dump(report, f, indent=2) + print(json.dumps(report, indent=2)) + return report + + +def main(): + app = sys.argv[1] if len(sys.argv) > 1 else "TargetApp" + agent = FridaIOSAgent(app) + agent.list_running_apps() + agent.bypass_ssl_pinning() + agent.check_jailbreak_detection() + agent.generate_report() + + +if __name__ == "__main__": + main() diff --git a/reverse-engineering-ios-app-with-frida/scripts/process.py b/reverse-engineering-ios-app-with-frida/scripts/process.py new file mode 100644 index 0000000..5726ccb --- /dev/null +++ b/reverse-engineering-ios-app-with-frida/scripts/process.py @@ -0,0 +1,119 @@ +#!/usr/bin/env python3 +""" +iOS Reverse Engineering Automation with Frida + +Automates class enumeration, method tracing, and secret extraction from iOS apps. + +Usage: + python process.py --app TargetApp [--output report.json] +""" + +import argparse +import json +import subprocess +import sys +from datetime import datetime + + +ENUMERATE_SCRIPT = """ +if (ObjC.available) { + var results = {classes: [], auth_methods: [], crypto_methods: []}; + var classNames = Object.keys(ObjC.classes); + classNames.forEach(function(name) { + if (name.indexOf("Auth") !== -1 || name.indexOf("Crypto") !== -1 || + name.indexOf("Token") !== -1 || name.indexOf("Key") !== -1 || + name.indexOf("Secret") !== -1 || name.indexOf("Login") !== -1) { + var methods = ObjC.classes[name].$ownMethods; + results.classes.push({name: name, method_count: methods.length}); + methods.forEach(function(m) { + if (m.toLowerCase().indexOf("auth") !== -1 || m.toLowerCase().indexOf("login") !== -1) { + results.auth_methods.push(name + " " + m); + } + if (m.toLowerCase().indexOf("encrypt") !== -1 || m.toLowerCase().indexOf("decrypt") !== -1 || + m.toLowerCase().indexOf("key") !== -1 || m.toLowerCase().indexOf("cipher") !== -1) { + results.crypto_methods.push(name + " " + m); + } + }); + } + }); + send(JSON.stringify(results)); +} else { + send(JSON.stringify({error: "ObjC runtime not available"})); +} +""" + + +def run_frida_script(app_name: str, script: str, timeout: int = 15) -> str: + """Execute a Frida script and return output.""" + cmd = ["frida", "-U", "-n", app_name, "-e", script, "--no-pause"] + try: + result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) + return result.stdout + except (subprocess.TimeoutExpired, FileNotFoundError): + return "" + + +def check_binary_protections(app_name: str) -> dict: + """Check for binary protections.""" + checks = { + "pie": False, + "stack_canary": False, + "arc": False, + "encrypted": False, + } + + # Use otool-equivalent checks via Frida + script = """ + var modules = Process.enumerateModules(); + var main = modules[0]; + send(JSON.stringify({ + name: main.name, + base: main.base.toString(), + size: main.size, + path: main.path + })); + """ + output = run_frida_script(app_name, script) + return checks + + +def main(): + parser = argparse.ArgumentParser(description="iOS RE Automation with Frida") + parser.add_argument("--app", required=True, help="Target app process name") + parser.add_argument("--output", default="ios_re_report.json", help="Output report") + args = parser.parse_args() + + print(f"[+] Enumerating classes and methods for {args.app}...") + enum_output = run_frida_script(args.app, ENUMERATE_SCRIPT) + + # Parse results + try: + lines = [l for l in enum_output.split("\n") if l.startswith('{"') or l.startswith("[")] + results = json.loads(lines[0]) if lines else {} + except (json.JSONDecodeError, IndexError): + results = {"classes": [], "auth_methods": [], "crypto_methods": []} + + report = { + "assessment": { + "target": args.app, + "type": "iOS Reverse Engineering", + "date": datetime.now().isoformat(), + }, + "enumeration": { + "security_classes": results.get("classes", []), + "auth_methods": results.get("auth_methods", []), + "crypto_methods": results.get("crypto_methods", []), + }, + "binary_protections": check_binary_protections(args.app), + } + + with open(args.output, "w") as f: + json.dump(report, f, indent=2) + print(f"[+] Report saved: {args.output}") + print(f"[*] Found {len(results.get('classes', []))} security-related classes") + print(f"[*] Found {len(results.get('auth_methods', []))} auth methods") + print(f"[*] Found {len(results.get('crypto_methods', []))} crypto methods") + + +if __name__ == "__main__": + main() diff --git a/reverse-engineering-kernel/SKILL.md b/reverse-engineering-kernel/SKILL.md new file mode 100644 index 0000000..530dd28 --- /dev/null +++ b/reverse-engineering-kernel/SKILL.md @@ -0,0 +1,345 @@ +--- +name: reverse-engineering-kernel +description: 'Use for kernel-mode reverse engineering: Windows driver analysis, anti-cheat + reversing, rootkit detection, kernel debugging, DSE bypass, PatchGuard research, + EDR kernel callbacks, hypervisor analysis, and any kernel-level binary inspection + or modification.' +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - reverse + - engineering + - kernel + - mode + - windows + - driver + - analysis + - anti + - cheat + - reversing + - rootkit + - detection +depends_on: [] +metadata: + tags: + - reverse + - engineering + - kernel +--- + +# Reverse Engineering — Kernel Mode + +## Trigger Conditions + +- Windows driver (.sys) reverse engineering +- Anti-cheat analysis (EAC, BattlEye, Vanguard, Ricochet) +- Rootkit detection and analysis +- Kernel debugging (WinDbg, KD) +- Driver Signature Enforcement (DSE) bypass research +- PatchGuard analysis and research +- EDR kernel callback analysis +- Hypervisor/VMM reversing +- Kernel exploit development research +- Bootkit/UEFI firmware analysis +- Kernel-mode rootkit development research +- SSDT/Hook analysis +- IRP handling and filter drivers +- Memory manipulation at ring 0 + +## Core Methodology + +### 1. Driver Analysis Setup + +**Tools:** +``` +IDA Pro + Hex-Rays (x64 decompiler) +WinDbg Preview (kernel debugging) +DriverView (NirSoft) — list loaded drivers +OSR Driver Loader — load/unload drivers +ScyllaHide — anti-anti-debug +VMware/VirtualBox — isolated analysis environment +``` + +**Initial driver inspection:** +```bash +# Extract driver info +sigcheck -v driver.sys # signature, version, timestamp +dumpbin /headers driver.sys # PE headers, sections +strings driver.sys | head -50 # embedded strings + +# Check for known packers/protectors +Detect It Easy (DIE) driver.sys + +# Analyze imports +dumpbin /imports driver.sys +# Key imports indicate driver type: +# IoCreateDevice, IoCreateSymbolicLink → device driver +# PsSetCreateProcessNotifyRoutine → process monitoring +# ObRegisterCallbacks → object/callback manipulation +# MmMapIoSpace → hardware/memory access +``` + +### 2. Kernel Debugging + +**WinDbg kernel debugging setup:** +``` +Target machine (VM): +bcdedit /debug on +bcdedit /dbgsettings serial debugport:1 baudrate:115200 + +Host machine (WinDbg): +File → Kernel Debug → COM +Port: \\.\COM1, Baud: 115200 + +Commands: +lm # list loaded modules +lm m driver* # find driver base address +!drvobj driver # driver object info +!devobj device # device object info +dt nt!_DRIVER_OBJECT # driver object structure +dt nt!_DEVICE_OBJECT # device object structure +``` + +**Breakpoint strategies:** +``` +bp driver!DriverEntry # driver initialization +bp driver!DeviceControl # IOCTL handler +bp driver!DispatchCreate # file open handler +bp driver!Unload # driver unload +ba e1 # execute breakpoint at address +``` + +### 3. Anti-Cheat Analysis + +**Common anti-cheat components:** +``` +EasyAntiCheat (EAC): + - easAntiCheat_EOS.sys (kernel driver) + - EasyAntiCheat.exe (user-mode service) + - Scans for known cheat signatures + - Integrity checks on game memory + - Kernel callbacks for process/thread monitoring + +BattlEye: + - BEDaisy.sys (kernel driver) + - BattlEye.exe (user-mode) + - Memory scanning, signature detection + - Screenshot capture + - Behavioral analysis + +Vanguard (Riot): + - vgk.sys (kernel driver, boot-start) + - vgc.exe (user-mode service) + - Runs at boot (SERVICE_BOOT_START) + - Continuous monitoring + - Hardware ID tracking +``` + +**Analysis approach:** +``` +1. Extract driver from installer/package +2. Static analysis: imports, strings, control flow +3. Identify scan patterns (memory regions, signatures) +4. Identify callback registrations +5. Map communication with user-mode component +6. Identify detection mechanisms +7. Document bypass vectors +``` + +### 4. Kernel Hooking Analysis + +**SSDT (System Service Descriptor Table):** +```c +// Windows x64 doesn't use SSDT directly, but drivers may hook: +// - Inline function hooking +// - IRP major function hooks +// - Callback registration + +// Detect inline hooks: +// Compare function prologue with known clean version +// Look for JMP, CALL to non-module addresses + +// WinDbg — check for hooks: +u nt!NtCreateFile // disassemble, look for JMP +!chkimg nt -d # check for modified code +``` + +**IRP Hooking:** +```c +// Filter drivers attach to device stack: +// IoAttachDeviceToDeviceStack +// They intercept IRPs before target driver + +// Detection: +// Walk device object chain: +// pDeviceObject->AttachedDevice != NULL → filter present +``` + +**Callback Analysis:** +```c +// Common kernel callbacks: +PsSetCreateProcessNotifyRoutine // process creation +PsSetCreateThreadNotifyRoutine // thread creation +PsSetLoadImageNotifyRoutine // module loading +ObRegisterCallbacks // object access +CmRegisterCallback // registry operations +ExRegisterCallback // generic callbacks + +// List registered callbacks (WinDbg): +// Process callbacks: +dt nt!_EX_FAST_REF PspCreateProcessNotifyRoutine +// Image load callbacks: +dt nt!_EX_FAST_REF PspLoadImageNotifyRoutine +``` + +### 5. DSE (Driver Signature Enforcement) + +**Research context:** +``` +DSE prevents loading unsigned drivers. +Research approaches: +- Exploit vulnerable signed driver (BYOVD) +- DSE variable manipulation (g_CiOptions) +- Boot configuration (test mode, debug mode) +- CVE exploitation in signed drivers + +Test mode (legitimate): +bcdedit /set testsigning on +bcdedit /set nointegritychecks on +``` + +### 6. EDR Kernel Analysis + +**EDR kernel components:** +``` +Common EDR drivers: +- CrowdStrike: CSDeviceControl.sys +- SentinelOne: SentinelMonitor.sys +- Carbon Black: cbk.sys +- Microsoft Defender: WdFilter.sys + +Analysis focus: +1. Mini-filter registration (file system monitoring) +2. Process/thread callbacks +3. Image load callbacks (DLL monitoring) +4. Registry callbacks +5. Network filtering (WFP callouts) +6. Memory scanning patterns +7. ETW provider registration +``` + +**Mini-filter analysis:** +```c +// EDRs register mini-filters for file system monitoring: +FltRegisterFilter(DriverObject, &Registration, &Filter); +FltStartFiltering(Filter); + +// Registration structure indicates monitored operations: +// IRP_MJ_CREATE, IRP_MJ_READ, IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION +// Pre-operation and post-operation callbacks + +// WinDbg — list filters: +!fltmgr +``` + +### 7. Hypervisor/VMM Analysis + +**Detection techniques:** +``` +CPUID instruction: + CPUID(1).ECX bit 31 → hypervisor present + CPUID(0x40000000) → hypervisor vendor ID + CPUID(0x40000001) → hypervisor interface + +Timing-based: + RDTSC before/after privileged instruction + VM exit causes timing anomalies + +Instruction behavior: + SIDT, SGDT, SLDT — different in VM + INVD instruction behavior + MSR access patterns +``` + +**Hypervisor reversing:** +``` +1. Extract hypervisor binary (if accessible) +2. Identify VM-exit handler (VMX: vmexit handler) +3. Map EPT (Extended Page Table) manipulation +4. Analyze intercepted instructions +5. Identify introspection capabilities +6. Map communication with guest +``` + +### 8. Bootkit/UEFI Analysis + +**UEFI firmware analysis:** +``` +Tools: +- UEFITool — parse UEFI images +- Universal Extractor — extract firmware +- Chipsec — firmware security analysis + +Analysis: +1. Extract firmware from update package +2. Parse UEFI image structure +3. Identify DXE drivers +4. Analyze SMM (System Management Mode) code +5. Check for bootkit persistence +6. Verify Secure Boot configuration +``` + +### 9. Kernel Exploit Research + +**Common kernel vulnerability classes:** +``` +- Pool overflow/underflow +- Use-after-free in kernel objects +- Type confusion in IOCTL handlers +- Race conditions in synchronization +- Integer overflow in size calculations +- NULL pointer dereference (pre-Windows 8) +- Uninitialized memory usage +- Arbitrary read/write via IOCTL +``` + +**IOCTL analysis:** +```c +// Find IOCTL handler in driver: +// DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] + +// Analyze IOCTL codes: +// CTL_CODE(DeviceType, Function, Method, Access) +// METHOD_BUFFERED, METHOD_IN_DIRECT, METHOD_OUT_DIRECT, METHOD_NEITHER + +// METHOD_NEITHER is most dangerous — direct user buffer access +// Can lead to arbitrary kernel memory access if not validated +``` + +## Implementation Standards + +- All kernel analysis includes safety warnings for analysis environment +- Provide both static and dynamic analysis approaches +- Include WinDbg scripts and automation +- Document kernel structures and APIs used +- No partial analysis — complete or nothing + +## Output Format + +For kernel RE tasks: +1. **Driver Identification** — type, version, signature, dependencies +2. **Static Analysis** — imports, strings, key functions, callbacks +3. **Dynamic Analysis** — behavior, kernel debugging findings +4. **Hook/Callback Map** — what the driver monitors/intercepts +5. **Communication** — user-kernel communication mechanism +6. **Artifacts** — scripts, WinDbg commands, analysis tools + +Всё, брат. + + +## Related +- `skill windows-kernel — Windows` +- `skill reverse-engineering-binary — бинари` diff --git a/reverse-engineering-malware-with-ghidra/LICENSE b/reverse-engineering-malware-with-ghidra/LICENSE new file mode 100644 index 0000000..d885118 --- /dev/null +++ b/reverse-engineering-malware-with-ghidra/LICENSE @@ -0,0 +1,201 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by the Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding any notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. Please do not remove or change + the license header comment from a contributed file except when + necessary. + + Copyright 2026 mukul975 + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/reverse-engineering-malware-with-ghidra/SKILL.md b/reverse-engineering-malware-with-ghidra/SKILL.md new file mode 100644 index 0000000..0b09add --- /dev/null +++ b/reverse-engineering-malware-with-ghidra/SKILL.md @@ -0,0 +1,289 @@ +--- +name: reverse-engineering-malware-with-ghidra +description: 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and decompiler to understand internal logic, + cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests + involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals. + + ' +domain: cybersecurity +subdomain: malware-analysis +tags: +- malware +- reverse-engineering +- Ghidra +- disassembly +- decompilation +version: 1.0.0 +author: mahipal +license: Apache-2.0 +nist_csf: +- DE.AE-02 +- RS.AN-03 +- ID.RA-01 +- DE.CM-01 +--- + +# Reverse Engineering Malware with Ghidra + +## When to Use + +- Static and dynamic analysis have identified suspicious functionality that requires deeper code-level understanding +- You need to reverse engineer C2 communication protocols, encryption algorithms, or custom obfuscation +- Understanding the exact exploit mechanism or vulnerability targeted by a malware sample +- Extracting hardcoded configuration data (C2 addresses, encryption keys, campaign IDs) embedded in compiled code +- Developing precise YARA rules or detection signatures based on unique code patterns + +**Do not use** for initial triage of unknown samples; perform static analysis with PEStudio and behavioral analysis with Cuckoo first. + +## Prerequisites + +- Ghidra 11.x installed (download from https://ghidra-sre.org/) with JDK 17+ +- Analysis VM isolated from production network (Windows or Linux host) +- Familiarity with x86/x64 assembly language and Windows API conventions +- PDB symbol files for Windows system DLLs to improve decompilation accuracy +- Ghidra scripts repository (ghidra_scripts) for automated analysis tasks +- Secondary reference: IDA Free or Binary Ninja for cross-validation of analysis results + +## Workflow + +### Step 1: Create Project and Import Binary + +Set up a Ghidra project and import the malware sample: + +``` +1. Launch Ghidra: ghidraRun (Linux) or ghidraRun.bat (Windows) +2. File -> New Project -> Non-Shared Project -> Select directory +3. File -> Import File -> Select malware binary +4. Ghidra auto-detects format (PE, ELF, Mach-O) and architecture +5. Accept default import options (or specify base address if known) +6. Double-click imported file to open in CodeBrowser +7. When prompted, run Auto Analysis with default analyzers enabled +``` + +**Headless analysis for automation:** +```bash +# Run Ghidra headless analysis with decompiler +/opt/ghidra/support/analyzeHeadless /tmp/ghidra_project MalwareProject \ + -import suspect.exe \ + -postScript ExportDecompilation.py \ + -scriptPath /opt/ghidra/scripts/ \ + -deleteProject +``` + +### Step 2: Identify Key Functions and Entry Points + +Navigate the binary to locate critical code sections: + +``` +Navigation Strategy: +━━━━━━━━━━━━━━━━━━━ +1. Start at entry point (OEP) - follow execution from _start/WinMain +2. Check Symbol Tree for imported functions (Window -> Symbol Tree) +3. Search for cross-references to suspicious APIs: + - VirtualAlloc/VirtualAllocEx (memory allocation for injection) + - CreateRemoteThread (remote thread injection) + - CryptEncrypt/CryptDecrypt (encryption operations) + - InternetOpen/HttpSendRequest (C2 communication) + - RegSetValueEx (persistence via registry) +4. Use Search -> For Strings to find embedded URLs, IPs, and paths +5. Check the Functions window sorted by size (large functions often contain core logic) +``` + +**Ghidra keyboard shortcuts for efficient navigation:** +``` +G - Go to address +Ctrl+E - Search for strings +X - Show cross-references to current location +Ctrl+Shift+F - Search memory for byte patterns +L - Rename label/function +; - Add comment +T - Retype variable +Ctrl+L - Retype return value +``` + +### Step 3: Analyze Decompiled Code + +Use Ghidra's decompiler to understand function logic: + +```c +// Example: Ghidra decompiler output for a decryption routine +// Analyst renames variables and adds types for clarity + +void decrypt_config(BYTE *encrypted_data, int data_len, BYTE *key, int key_len) { + // XOR decryption with rolling key + for (int i = 0; i < data_len; i++) { + encrypted_data[i] = encrypted_data[i] ^ key[i % key_len]; + } + return; +} + +// Analyst actions in Ghidra: +// 1. Right-click parameters -> Retype to correct types (BYTE*, int) +// 2. Right-click variables -> Rename to meaningful names +// 3. Add comments explaining the algorithm +// 4. Set function signature to propagate types to callers +``` + +### Step 4: Trace C2 Communication Logic + +Follow the network communication code path: + +``` +Analysis Steps for C2 Protocol Reverse Engineering: +━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ +1. Find InternetOpenA/WinHttpOpen call -> trace to wrapper function +2. Follow data flow from encrypted config -> URL construction +3. Identify HTTP method (GET/POST), headers, and body format +4. Locate response parsing logic (JSON parsing, custom binary protocol) +5. Map the C2 command dispatcher (switch/case or jump table) +6. Document the command set (download, execute, exfiltrate, update, uninstall) +``` + +**Ghidra Script for extracting C2 configuration:** +```python +# Ghidra Python script: extract_c2_config.py +# Run via Script Manager in Ghidra + +from ghidra.program.model.data import StringDataType +from ghidra.program.model.symbol import SourceType + +# Search for XOR decryption patterns +listing = currentProgram.getListing() +memory = currentProgram.getMemory() + +# Find references to InternetOpenA +symbol_table = currentProgram.getSymbolTable() +for symbol in symbol_table.getExternalSymbols(): + if "InternetOpen" in symbol.getName(): + refs = getReferencesTo(symbol.getAddress()) + for ref in refs: + print("C2 init at: {}".format(ref.getFromAddress())) +``` + +### Step 5: Analyze Encryption and Obfuscation + +Identify and document cryptographic routines: + +``` +Common Malware Encryption Patterns: +━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ +XOR Cipher: Loop with XOR operation, often single-byte or rolling key +RC4: Two loops (KSA + PRGA), 256-byte S-box initialization +AES: Look for S-box constants (0x63, 0x7C, 0x77...) or calls to CryptEncrypt +Base64: Lookup table with A-Za-z0-9+/= characters +Custom: Combination of arithmetic operations (ADD, SUB, ROL, ROR with XOR) + +Identification Tips: +- Search for constants: AES S-box, CRC32 table, MD5 init values +- Look for loop structures operating on byte arrays +- Check for Windows Crypto API usage (CryptAcquireContext -> CryptCreateHash -> CryptEncrypt) +- FindCrypt Ghidra plugin automatically identifies crypto constants +``` + +### Step 6: Document Findings and Create Detection Signatures + +Produce actionable intelligence from reverse engineering: + +```bash +# Generate YARA rule from unique code patterns found in Ghidra +cat << 'EOF' > malware_family_x.yar +rule MalwareFamilyX_Decryptor { + meta: + description = "Detects MalwareX decryption routine" + author = "analyst" + date = "2025-09-15" + strings: + // XOR decryption loop with hardcoded key + $decrypt = { 8A 04 0E 32 04 0F 88 04 0E 41 3B CA 7C F3 } + // C2 URL pattern after decryption + $c2_pattern = "/gate.php?id=" ascii + condition: + uint16(0) == 0x5A4D and $decrypt and $c2_pattern +} +EOF +``` + +## Key Concepts + +| Term | Definition | +|------|------------| +| **Disassembly** | Converting machine code bytes into human-readable assembly language instructions; Ghidra's Listing view shows disassembled code | +| **Decompilation** | Lifting assembly code to pseudo-C representation for easier analysis; Ghidra's Decompile window provides this view | +| **Cross-Reference (XREF)** | Reference showing where a function or data address is called from or used; essential for tracing code execution flow | +| **Control Flow Graph (CFG)** | Visual representation of all possible execution paths through a function; reveals branching logic and loops | +| **Original Entry Point (OEP)** | The actual start address of the malware code after unpacking; packers redirect execution through an unpacking stub first | +| **Function Signature** | The return type, name, and parameter types of a function; applying correct signatures improves decompiler output quality | +| **Ghidra Script** | Python or Java automation script executed within Ghidra to perform batch analysis, pattern searching, or data extraction | + +## Tools & Systems + +- **Ghidra**: NSA's open-source software reverse engineering suite with disassembler, decompiler, and scripting support for multiple architectures +- **IDA Pro/Free**: Industry-standard interactive disassembler; IDA Free provides x86/x64 cloud-based decompilation +- **Binary Ninja**: Commercial reverse engineering platform with modern UI and extensive API for plugin development +- **x64dbg**: Open-source x64/x32 debugger for Windows used alongside Ghidra for dynamic debugging of malware +- **FindCrypt (Ghidra Plugin)**: Plugin that identifies cryptographic constants and algorithms in binary code + +## Common Scenarios + +### Scenario: Reversing Custom C2 Protocol + +**Context**: Behavioral analysis shows encrypted traffic to an external IP on a non-standard port. Network signatures cannot detect variants because the protocol is proprietary. Deep reverse engineering is needed to understand the protocol structure. + +**Approach**: +1. Import the unpacked sample into Ghidra and run full auto-analysis +2. Locate socket/WinHTTP API calls and trace backwards to the calling function +3. Identify the encryption routine called before data is sent (follow data flow from send/HttpSendRequest) +4. Reverse the encryption (XOR key extraction, RC4 key derivation, AES key location) +5. Map the command structure by analyzing the response parsing function (switch/case on command IDs) +6. Document the protocol format (header structure, command bytes, encryption method) +7. Create a protocol decoder script for network monitoring tools + +**Pitfalls**: +- Not running the full auto-analysis before starting manual analysis (missing function boundaries and type propagation) +- Ignoring indirect calls through function pointers or vtables (use cross-references to data holding function addresses) +- Spending time on library code that Ghidra's Function ID (FID) or FLIRT signatures should have identified +- Not saving Ghidra project progress frequently (analysis state can be lost on crashes) + +## Output Format + +``` +REVERSE ENGINEERING ANALYSIS REPORT +===================================== +Sample: unpacked_payload.exe +SHA-256: abc123def456... +Architecture: x86 (32-bit PE) +Ghidra Project: MalwareX_Analysis + +FUNCTION MAP +0x00401000 main() - Entry point, initializes config +0x00401200 decrypt_config() - XOR decryption with 16-byte key +0x00401400 init_c2() - WinHTTP initialization, URL construction +0x00401800 c2_beacon() - HTTP POST beacon with system info +0x00401C00 cmd_dispatcher() - Switch on 12 command codes +0x00402000 inject_process() - Process hollowing into svchost.exe +0x00402400 persist_registry() - HKCU Run key persistence +0x00402800 exfil_data() - File collection and encrypted upload + +C2 PROTOCOL +Method: HTTPS POST to /gate.php +Encryption: RC4 with derived key (MD5 of bot_id + campaign_key) +Bot ID Format: MD5(hostname + username + volume_serial) +Beacon Interval: 60 seconds with 10% jitter +Command Set: + 0x01 - Download and execute file + 0x02 - Execute shell command + 0x03 - Upload file to C2 + 0x04 - Update configuration + 0x05 - Uninstall and remove traces + +ENCRYPTION DETAILS +Algorithm: RC4 +Key Derivation: MD5(bot_id + "campaign_2025_q3") +Hardcoded Seed: "campaign_2025_q3" at offset 0x00405A00 + +EXTRACTED IOCs +C2 URLs: hxxps://update.malicious[.]com/gate.php + hxxps://backup.evil[.]net/gate.php (failover) +Campaign ID: campaign_2025_q3 +RC4 Key Material: [see encryption details above] +``` diff --git a/reverse-engineering-malware-with-ghidra/references/api-reference.md b/reverse-engineering-malware-with-ghidra/references/api-reference.md new file mode 100644 index 0000000..8261359 --- /dev/null +++ b/reverse-engineering-malware-with-ghidra/references/api-reference.md @@ -0,0 +1,75 @@ +# API Reference: Malware Reverse Engineering with Ghidra Agent + +## Overview + +Combines Ghidra headless analysis with r2pipe (radare2) for automated malware binary analysis: function enumeration, import classification, section entropy, cryptographic constant detection, and network indicator extraction. + +## Dependencies + +| Package | Version | Purpose | +|---------|---------|---------| +| r2pipe | >= 1.8 | Radare2 scripting interface for binary analysis | +| hashlib | stdlib | File hash computation | + +## External Tools + +| Tool | Purpose | +|------|---------| +| Ghidra (analyzeHeadless) | Automated disassembly and decompilation | +| radare2 | Binary analysis, function detection, string extraction | + +## Core Functions + +### `run_ghidra_headless(ghidra_path, project_dir, project_name, binary_path, script)` +Executes Ghidra in headless mode with optional post-analysis script. +- **Timeout**: 600 seconds +- **Returns**: `dict` with command, returncode, stdout/stderr + +### `export_functions_ghidra(...)` +Generates and runs a Ghidra script to export function list as JSON. +- **Exports**: name, address, size, calling convention, is_thunk + +### `analyze_with_radare2(filepath)` +Full r2pipe analysis: binary info, functions, imports, strings, sections, entry points. +- **Classifies imports**: injection, network, evasion, crypto, persistence +- **Extracts**: network indicators (URLs, IPs) from strings +- **Returns**: `dict` with info, function_count, suspicious_imports, sections, etc. + +### `extract_crypto_constants(filepath)` +Searches binary for known cryptographic constants: AES S-box, RC4 init table, SHA-256 init vector, RSA magic bytes. +- **Returns**: `list[dict]` with constant name and file offset + +### `analyze_malware(filepath, ghidra_path, output_dir)` +Full pipeline: hashes -> crypto constants -> radare2 analysis -> Ghidra headless. + +## Suspicious Import Categories + +| Category | Example Functions | +|----------|-------------------| +| injection | VirtualAllocEx, WriteProcessMemory, CreateRemoteThread | +| network | InternetOpenA, WSAStartup, URLDownloadToFileA | +| evasion | IsDebuggerPresent, NtQueryInformationProcess | +| crypto | CryptEncrypt, CryptDecrypt | +| persistence | RegSetValueExA, CreateServiceA | + +## Radare2 Commands Used + +| Command | Purpose | +|---------|---------| +| `aaa` | Full auto-analysis | +| `ij` | Binary info as JSON | +| `aflj` | Function list as JSON | +| `iij` | Import list as JSON | +| `izj` | String list as JSON | +| `iSj` | Section list as JSON | +| `iej` | Entry points as JSON | + +## Usage + +```bash +# With radare2 only +python agent.py malware.exe + +# With Ghidra headless analysis +python agent.py malware.exe /opt/ghidra +``` diff --git a/reverse-engineering-malware-with-ghidra/scripts/agent.py b/reverse-engineering-malware-with-ghidra/scripts/agent.py new file mode 100644 index 0000000..c38029a --- /dev/null +++ b/reverse-engineering-malware-with-ghidra/scripts/agent.py @@ -0,0 +1,232 @@ +#!/usr/bin/env python3 +"""Malware reverse engineering agent using Ghidra headless analyzer and r2pipe.""" + +import subprocess +import os +import sys +import json +import re +import hashlib + +try: + import r2pipe +except ImportError: + r2pipe = None + + +def compute_hashes(filepath): + """Compute file hashes for identification.""" + with open(filepath, "rb") as f: + data = f.read() + return { + "md5": hashlib.md5(data).hexdigest(), + "sha1": hashlib.sha1(data).hexdigest(), + "sha256": hashlib.sha256(data).hexdigest(), + "size": len(data), + } + + +def run_ghidra_headless(ghidra_path, project_dir, project_name, binary_path, + script=None, script_args=None): + """Run Ghidra in headless mode for automated analysis.""" + os.makedirs(project_dir, exist_ok=True) + cmd = [ + os.path.join(ghidra_path, "support", "analyzeHeadless"), + project_dir, project_name, + "-import", binary_path, + "-overwrite", + ] + if script: + cmd.extend(["-postScript", script]) + if script_args: + cmd.extend(script_args) + result = subprocess.run( + cmd, capture_output=True, text=True, timeout=600 + ) + return { + "command": " ".join(cmd), + "returncode": result.returncode, + "stdout": result.stdout[-2000:] if result.stdout else "", + "stderr": result.stderr[-1000:] if result.stderr else "", + } + + +def export_functions_ghidra(ghidra_path, project_dir, project_name, binary_path, + output_file): + """Export function list using Ghidra headless with a script.""" + script_content = """ +import ghidra.program.model.listing.FunctionIterator +import json + +output = [] +fm = currentProgram.getFunctionManager() +funcs = fm.getFunctions(True) +for func in funcs: + entry = { + "name": func.getName(), + "address": str(func.getEntryPoint()), + "size": func.getBody().getNumAddresses(), + "calling_convention": func.getCallingConventionName(), + "is_thunk": func.isThunk(), + } + output.append(entry) + +with open("{output}", "w") as f: + json.dump(output, f, indent=2) +""".replace("{output}", output_file.replace("\\", "\\\\")) + script_path = os.path.join(project_dir, "export_functions.py") + with open(script_path, "w") as f: + f.write(script_content) + return run_ghidra_headless( + ghidra_path, project_dir, project_name, binary_path, + script="export_functions.py" + ) + + +def analyze_with_radare2(filepath): + """Analyze binary with radare2 via r2pipe for quick triage.""" + if r2pipe is None: + return {"error": "r2pipe not installed (pip install r2pipe)"} + r2 = r2pipe.open(filepath, flags=["-2"]) + r2.cmd("aaa") + info = r2.cmdj("ij") + functions = r2.cmdj("aflj") or [] + imports = r2.cmdj("iij") or [] + strings = r2.cmdj("izj") or [] + sections = r2.cmdj("iSj") or [] + entry_points = r2.cmdj("iej") or [] + suspicious_imports = { + "injection": ["VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread", + "NtCreateThreadEx"], + "network": ["InternetOpenA", "HttpSendRequestA", "WSAStartup", + "URLDownloadToFileA"], + "evasion": ["IsDebuggerPresent", "CheckRemoteDebuggerPresent", + "NtQueryInformationProcess"], + "crypto": ["CryptEncrypt", "CryptDecrypt", "CryptAcquireContextA"], + "persistence": ["RegSetValueExA", "CreateServiceA"], + } + import_findings = [] + for imp in imports: + name = imp.get("name", "") + for category, funcs in suspicious_imports.items(): + if name in funcs: + import_findings.append({ + "category": category, + "function": name, + "library": imp.get("lib", ""), + }) + network_strings = [] + for s in strings: + val = s.get("string", "") + if re.search(r"https?://", val) or re.search(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b", val): + network_strings.append(val[:200]) + section_analysis = [] + for sec in sections: + entropy = sec.get("entropy", 0) + flags = [] + if entropy and entropy > 7.0: + flags.append("HIGH_ENTROPY") + section_analysis.append({ + "name": sec.get("name", ""), + "size": sec.get("size", 0), + "vsize": sec.get("vsize", 0), + "entropy": entropy, + "flags": flags, + }) + r2.quit() + return { + "info": { + "arch": info.get("bin", {}).get("arch", ""), + "bits": info.get("bin", {}).get("bits", 0), + "os": info.get("bin", {}).get("os", ""), + "type": info.get("bin", {}).get("bintype", ""), + "compiler": info.get("bin", {}).get("compiler", ""), + }, + "function_count": len(functions), + "import_count": len(imports), + "string_count": len(strings), + "suspicious_imports": import_findings, + "network_indicators": network_strings[:20], + "sections": section_analysis, + "entry_points": [{"vaddr": e.get("vaddr"), "type": e.get("type")} for e in entry_points], + } + + +def extract_crypto_constants(filepath): + """Search binary for known cryptographic constants.""" + with open(filepath, "rb") as f: + data = f.read() + constants = { + "AES_SBOX": bytes([0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5]), + "RC4_INIT": bytes(range(256)), + "SHA256_INIT": bytes.fromhex("6a09e667bb67ae853c6ef372a54ff53a"), + "RSA_MAGIC": b"RSA1", + } + found = [] + for name, pattern in constants.items(): + offset = data.find(pattern) + if offset >= 0: + found.append({"constant": name, "offset": hex(offset)}) + return found + + +def analyze_malware(filepath, ghidra_path=None, output_dir="/tmp/ghidra_analysis"): + """Full malware analysis pipeline.""" + os.makedirs(output_dir, exist_ok=True) + report = {"file": os.path.basename(filepath)} + report["hashes"] = compute_hashes(filepath) + report["crypto_constants"] = extract_crypto_constants(filepath) + if r2pipe: + report["radare2"] = analyze_with_radare2(filepath) + if ghidra_path and os.path.exists(ghidra_path): + ghidra_result = run_ghidra_headless( + ghidra_path, output_dir, "malware_project", filepath + ) + report["ghidra"] = { + "analysis_complete": ghidra_result["returncode"] == 0, + "output": ghidra_result["stdout"][-500:], + } + return report + + +def print_report(report): + print("Malware Reverse Engineering Report") + print("=" * 50) + print(f"File: {report['file']}") + print(f"SHA-256: {report['hashes']['sha256']}") + print(f"Size: {report['hashes']['size']} bytes") + if report.get("crypto_constants"): + print(f"\nCrypto Constants Found:") + for c in report["crypto_constants"]: + print(f" {c['constant']} at {c['offset']}") + r2 = report.get("radare2", {}) + if r2 and "error" not in r2: + info = r2.get("info", {}) + print(f"\nBinary Info: {info.get('arch', '?')}/{info.get('bits', '?')}bit " + f"({info.get('os', '?')}) [{info.get('type', '?')}]") + print(f"Functions: {r2.get('function_count', 0)}") + print(f"Imports: {r2.get('import_count', 0)}") + if r2.get("suspicious_imports"): + print(f"\nSuspicious Imports:") + for imp in r2["suspicious_imports"]: + print(f" [{imp['category']}] {imp['library']} -> {imp['function']}") + if r2.get("network_indicators"): + print(f"\nNetwork Indicators:") + for ni in r2["network_indicators"][:10]: + print(f" {ni}") + print(f"\nSections:") + for sec in r2.get("sections", []): + flags = f" [{', '.join(sec['flags'])}]" if sec.get("flags") else "" + print(f" {sec['name']:10s} size={sec['size']:>8} entropy={sec.get('entropy', 0):.2f}{flags}") + if report.get("ghidra", {}).get("analysis_complete"): + print(f"\nGhidra: Analysis complete") + + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python agent.py [ghidra_install_path]") + sys.exit(1) + binary = sys.argv[1] + ghidra = sys.argv[2] if len(sys.argv) > 2 else None + result = analyze_malware(binary, ghidra_path=ghidra) + print_report(result) diff --git a/reverse-engineering-mobile/SKILL.md b/reverse-engineering-mobile/SKILL.md new file mode 100644 index 0000000..4dfa294 --- /dev/null +++ b/reverse-engineering-mobile/SKILL.md @@ -0,0 +1,396 @@ +--- +name: reverse-engineering-mobile +description: 'Use for mobile app reverse engineering: Android APK analysis, iOS IPA + analysis, dex/smali reversing, native library (.so) analysis, keychain/keystore + extraction, SSL pinning bypass, root:REDACTED detection bypass, and mobile app + security research.' +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - reverse + - engineering + - mobile + - app + - android + - apk + - analysis + - ios + - ipa + - dex + - smali + - reversing +depends_on: [] +metadata: + tags: + - reverse + - engineering + - mobile +--- + +# Reverse Engineering — Mobile Applications + +## Trigger Conditions + +- Android APK decompilation and analysis +- iOS IPA analysis and decryption +- DEX/Smali code analysis and modification +- Native library (.so / .dylib) reversing +- SSL/TLS pinning bypass +- root:REDACTED detection bypass +- Keychain/Keystore data extraction +- Mobile API traffic analysis +- App sandbox exploration +- Mobile cryptography analysis +- Frida script development for mobile +- Obfuscated mobile app analysis +- React Native / Flutter / Unity app reversing +- Mobile game modification + +## Core Methodology + +### 1. Android APK Analysis + +**Decompilation pipeline:** +```bash +# 1. Extract APK +adb shell pm path com.target.app +adb pull /data/app/.../base.apk + +# 2. Decompile with JADX (Java source) +jadx -d output --deobf --deobf-min 3 base.apk + +# 3. Decompile with apktool (resources + smali) +apktool d base.apk -o apktool_output + +# 4. Analyze manifest +cat apktool_output/AndroidManifest.xml +# Look for: exported activities, permissions, deep links, providers + +# 5. Search for API endpoints +grep -rE 'https?://' output/ --include='*.java' | \ + grep -v '\.xml' | sort -u + +# 6. Search for crypto keys/secrets +grep -rE '(api_key|secret|password|token|AES|RSA)' output/ --include='*.java' + +# 7. Analyze native libraries +unzip base.apk 'lib/*' +file lib/arm64-v8a/*.so +# Reverse with IDA/Ghidra +``` + +**Smali modification:** +```smali +# Bypass root detection: +# Original: +invoke-static {}, Lcom/target/RootDetector;->isRooted()Z +move-result v0 +if-eqz v0, :cond_not_rooted + +# Patched: +const/4 v0, 0x0 # always return false + +# Bypass SSL pinning: +# Find the pinning class, override the check method +.method public verify(Ljava/lang/String;Ljava/security/cert/X509Certificate;)Z + .registers 3 + const/4 v0, 0x1 + return v0 +.end method +``` + +**Rebuild and sign:** +```bash +# Rebuild with apktool +apktool b apktool_output -o modified.apk + +# Sign with uber-apk-signer +java -jar uber-apk-signer.jar -a modified.apk + +# Or with apksigner (Android SDK) +apksigner sign --ks my.keystore modified.apk +``` + +### 2. iOS IPA Analysis + +**IPA extraction:** +```bash +# Extract IPA (from jailbroken device or decrypted dump) +unzip TargetApp.ipa -d ipa_output + +# Analyze binary +file Payload/TargetApp.app/TargetApp +otool -l Payload/TargetApp.app/TargetApp # load commands +otool -Iv Payload/TargetApp.app/TargetApp # imports +strings Payload/TargetApp.app/TargetApp | head -100 + +# Class-dump (Objective-C headers) +class-dump Payload/TargetApp.app/TargetApp > headers.txt + +# Hopper Disassembler or IDA for full analysis +# Ghidra also supports Mach-O +``` + +**Frida on iOS:** +```bash +# Install Frida on jailbroken device +# List processes +frida-ps -U + +# Attach to app +frida -U -f com.target.app --no-pause + +# Script — bypass SSL pinning +frida -U -f com.target.app --no-pause -l ssl_bypass.js +``` + +### 3. SSL Pinning Bypass + +**Android — Frida universal bypass:** +```javascript +// ssl_pinning_bypass.js +Java.perform(function() { + // OkHttp 3 + try { + var CertificatePinner = Java.use('okhttp3.CertificatePinner'); + CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {}; + CertificatePinner.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function() {}; + } catch(e) {} + + // TrustManager + var TrustManager = Java.registerClass({ + name: 'custom.TrustManager', + implements: [Java.use('javax.net.ssl.X509TrustManager')], + methods: { + checkClientTrusted: function(chain, authType) {}, + checkServerTrusted: function(chain, authType) {}, + getAcceptedIssuers: function() { return []; } + } + }); + + var TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory'); + var tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + tmf.init(null); + var trustManagers = tmf.getTrustManagers(); + // Replace with our trust manager +}); + +// iOS — bypass +var SSLKillSwitch = ObjC.classes.NSURLSession; +// Or hook SecTrustEvaluate: +Interceptor.attach( + Module.findExportByName('Security', 'SecTrustEvaluate'), { + onLeave: function(retval) { + retval.replace(0); // errSecSuccess + } + } +); +``` + +**Android — network security config:** +```xml + + + + + + + + + + + + + + +``` + +### 4. root:REDACTED Detection Bypass + +**Android — common detection methods:** +```java +// Detection checks to bypass: +// 1. Check for su binary +Runtime.getRuntime().exec("which su") + +// 2. Check for Superuser.apk +new File("/system/app/Superuser.apk").exists() + +// 3. Check build tags +Build.TAGS.contains("test-keys") + +// 4. Check for Magisk +new File("/sbin/.magisk").exists() + +// 5. Check for dangerous properties +System.getProperty("ro.build.selinux") + +// Frida bypass: +Java.perform(function() { + // Hook all detection methods + var RootBeer = Java.use('com.scottyab.rootbeer.RootBeer'); + RootBeer.isRooted.implementation = function() { return false; }; + + // Hook file existence checks + var File = Java.use('java.io.File'); + File.exists.implementation = function() { + var path = this.getAbsolutePath(); + if (path.indexOf("su") >= 0 || path.indexOf("magisk") >= 0) { + return false; + } + return this.exists(); + }; +}); +``` + +### 5. Native Library (.so) Analysis + +**Extraction and analysis:** +```bash +# Extract from APK +unzip app.apk 'lib/*' + +# Analyze with Ghidra/IDA +ghidraRun +# Load .so file, set base address, analyze + +# Or with radare2 +r2 lib/arm64-v8a/libnative.so +aaa +afl +pdf @ main + +# Identify JNI functions (Java_ prefix) +strings libnative.so | grep "^Java_" +``` + +**JNI function naming:** +``` +Java_{package_name}_{class_name}_{method_name} +Example: Java_com_target_app_crypto_NativeLib_encrypt + +// JNI signature: +JNIEXPORT jstring JNICALL +Java_com_target_app_crypto_NativeLib_encrypt( + JNIEnv *env, + jobject thiz, + jstring input +); +``` + +**Frida — hook native function:** +```javascript +// Find exported function +var encryptFunc = Module.findExportByName('libnative.so', 'Java_com_target_encrypt'); +Interceptor.attach(encryptFunc, { + onEnter: function(args) { + // args[0] = JNIEnv*, args[1] = jobject, args[2] = jstring + var input = Java.vm.getEnv().getStringUtfChars(args[2], null).readCString(); + console.log('encrypt input:', input); + }, + onLeave: function(retval) { + var result = Java.vm.getEnv().getStringUtfChars(retval, null).readCString(); + console.log('encrypt output:', result); + } +}); +``` + +### 6. Keychain/Keystore Extraction + +**Android KeyStore:** +```bash +# Requires root +adb root +adb shell +su + +# KeyStore files +ls /data/misc/keystore/ +ls /data/system/locksettings/ + +# Shared preferences (often contain tokens) +ls /data/data/com.target.app/shared_prefs/ +cat /data/data/com.target.app/shared_prefs/*.xml + +# SQLite databases +ls /data/data/com.target.app/databases/ +sqlite3 /data/data/com.target.app/databases/*.db ".tables" +``` + +**iOS Keychain:** +```bash +# Requires jailbreak +# Keychain-Dumper +./keychain_dumper -a # all entries +./keychain_dumper -g # generic passwords +./keychain_dumper -i # internet passwords + +# Or with Frida +frida -U SpringBoard -l keychain_dump.js +``` + +### 7. Framework-Specific Analysis + +**React Native:** +```bash +# JS bundle extraction +unzip app.apk 'assets/index.android.bundle' +# Deobfuscate +# Look for fetch/axios calls in bundle + +# Native modules +grep -r 'ReactMethod' android/ +``` + +**Flutter:** +```bash +# Flutter apps have libapp.so (AOT compiled) +# Extract and analyze with Ghidra +# Flutter symbols are preserved in debug builds +unzip app.apk 'lib/*/libapp.so' + +# For JIT builds, look at kernel_blob.bin +unzip app.apk 'assets/flutter_assets/kernel_blob.bin' +``` + +**Unity:** +```bash +# Extract assets +unzip app.apk 'assets/bin/Data/*' + +# Decompile with Il2CppDumper +# Dump IL2CPP metadata +Il2CppDumper.exe assets/bin/Data/Managed/Metadata/global-metadata.dat \ + lib/arm64-v8a/libil2cpp.so output/ + +# Results: script.json (method names), dump.cs (C# stubs) +``` + +## Implementation Standards + +- All mobile RE produces working modifications or analysis +- Provide both static and dynamic analysis approaches +- Include Frida scripts for common bypasses +- Document app architecture and data flow +- No partial analysis — complete or nothing + +## Output Format + +For mobile RE tasks: +1. **App Identification** — platform, framework, version, protections +2. **Static Analysis** — decompiled code, strings, API endpoints, crypto +3. **Dynamic Analysis** — traffic, behavior, Frida hooks +4. **Security Mechanisms** — pinning, root detection, obfuscation +5. **Bypass Methods** — working patches, Frida scripts, modified APKs +6. **Data Extraction** — stored credentials, tokens, keys + +Всё, брат. + + +## Related +- `skill android-forensics` — форензика +- `skill reverse-engineering-binary` — native libs +- `skill web-exploitation` — API реверс diff --git a/reverse-engineering-obfuscation/SKILL.md b/reverse-engineering-obfuscation/SKILL.md new file mode 100644 index 0000000..c00720a --- /dev/null +++ b/reverse-engineering-obfuscation/SKILL.md @@ -0,0 +1,484 @@ +--- +name: reverse-engineering-obfuscation +description: Use for deobfuscation, unpacking, anti-analysis bypass, code virtualization + reversing, control flow flattening recovery, string deobfuscation, and any task + involving removal or analysis of code protection mechanisms. +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - reverse + - engineering + - obfuscation + - deobfuscation + - unpacking + - anti + - analysis + - bypass + - code + - virtualization + - reversing + - control +depends_on: [] +metadata: + tags: + - reverse + - engineering + - obfuscation +--- + +# Reverse Engineering — Obfuscation & Anti-Analysis + +## Trigger Conditions + +- Deobfuscating obfuscated code (JavaScript, Python, Java, .NET, native) +- Unpacking protected binaries (UPX, custom packers, protectors) +- Bypassing anti-analysis techniques (anti-debug, anti-VM, anti-sandbox) +- Reversing code virtualization (VMProtect, Themida, Oreans) +- Recovering control flow from flattened code +- String deobfuscation and decryption +- Analyzing polymorphic/metamorphic code +- Bypassing integrity checks and self-modification +- Deobfuscating malware or protected commercial software +- Analyzing and bypassing code tampering protection +- .NET deobfuscation (de4dot, dnlib) +- JavaScript deobfuscation (eval chains, string arrays, control flow) + +## Core Methodology + +### 1. Packer Identification + +**Common packers:** +``` +UPX — Universal Packer for Executables + Signature: "UPX!" in section names + Unpack: upx -d file.exe + +ASPack — Advanced SCS Packer + Signature: ".aspack", ".adata" sections + Unpack: manual dump at OEP + +Themida/WinLicense — Oreans Technologies + Signature: heavy code virtualization, API redirection + Unpack: extremely difficult, requires VM analysis + +VMProtect — VMP + Signature: "VMProtect" strings, virtualized code + Unpack: requires VM handler analysis + +Armadillo — Silicon Realms + Signature: Nanomite debugging, code morphing + Unpack: debug child process + +PECompact, PELock, ExeStealth + Various signatures, custom unpacking needed +``` + +**Detection:** +```bash +# Detect It Easy (DIE) — comprehensive packer detection +diec file.exe + +# PEiD — legacy but useful +peid file.exe + +# Exeinfo PE — another detector +exeinfope file.exe + +# Manual: check section characteristics +# Packed binaries have: +# - Single executable section (no .rdata, .data separation) +# - High entropy (>7.0) in code section +# - Unusual section names +# - Small import table +``` + +### 2. Unpacking Techniques + +**Manual unpacking (generic):** +``` +1. Find OEP (Original Entry Point) + - ESP law: set hardware breakpoint on ESP, run, step until return + - Section breakpoint: set BP on first instruction of unpacked section + - Memory breakpoint: set BP on write to original code section + - API breakpoint: set BP on GetProcAddress/LoadLibrary + +2. Dump process memory + - Use Scylla, Process Dump, or custom dumper + - Dump at OEP, after unpacker decompressed everything + +3. Fix IAT (Import Address Table) + - Scylla can rebuild IAT automatically + - Manual: trace IAT reconstruction in unpacker + - Identify IAT thunk addresses and original API names + +4. Rebuild PE headers + - Fix entry point, section table, import directory + - Test with ImpREC or Scylla +``` + +**UPX unpacking:** +```bash +# Automatic +upx -d packed.exe -o unpacked.exe + +# Manual (if modified UPX): +# 1. Find UPX1 section end (jmp to OEP) +# 2. Set breakpoint on the jump +# 3. Dump after jump executes +# 4. Fix IAT with Scylla +``` + +**Custom packer unpacking:** +```python +# Memory dumper — dump after unpacker runs +import psutil +import pefile + +def dump_process(pid, base_address, size, output_path): + """Dump memory region from running process.""" + proc = psutil.Process(pid) + # Use platform-specific memory reading + # Windows: ReadProcessMemory via ctypes + # Linux: /proc/pid/mem + with open(output_path, 'wb') as f: + f.read(...) + +# IAT reconstruction +def reconstruct_iat(dump_path, iat_start, iat_end): + """Rebuild import table from dumped binary.""" + pe = pefile.PE(dump_path) + # Scan IAT range for valid function pointers + # Resolve to module + function name + # Rebuild import directory +``` + +### 3. Anti-Debug Bypass + +**Detection → Bypass mapping:** +``` +Detection Method | Bypass +──────────────────────────────|──────────────────────────── +IsDebuggerPresent | Patch to return 0 +CheckRemoteDebuggerPresent | Hook to return FALSE +NtQueryInfoProcess(DebugPort) | Hook NtQueryInformationProcess +GetTickCount timing | Hook GetTickCount, return realistic values +RDTSC timing | Patch RDTSC or hook CPUID +SEH debugger detection | Patch exception handler +Hardware breakpoint detection | Clear DR0-DR7 registers +Parent process check | Spoof parent PID +Debug object handle | Close debug object +Window class check | Rename debugger window +``` + +**Frida — comprehensive anti-debug bypass:** +```javascript +// Anti-debug bypass suite +function bypassAntiDebug() { + // IsDebuggerPresent + var isDebuggerPresent = Module.findExportByName('kernel32.dll', 'IsDebuggerPresent'); + if (isDebuggerPresent) { + Interceptor.replace(isDebuggerPresent, new NativeCallback(function() { + return 0; + }, 'int', [])); + } + + // CheckRemoteDebuggerPresent + var checkRemote = Module.findExportByName('kernel32.dll', 'CheckRemoteDebuggerPresent'); + if (checkRemote) { + Interceptor.attach(checkRemote, { + onEnter: function(args) { + this.hdbg = args[1]; + }, + onLeave: function(retval) { + this.hdbg.writeU8(0); // not being debugged + retval.replace(1); // function succeeded + } + }); + } + + // NtQueryInformationProcess + var ntQuery = Module.findExportByName('ntdll.dll', 'NtQueryInformationProcess'); + if (ntQuery) { + Interceptor.attach(ntQuery, { + onEnter: function(args) { + this.processInfoClass = args[1].toInt32(); + this.processInfo = args[2]; + }, + onLeave: function(retval) { + // ProcessDebugPort = 7 + if (this.processInfoClass === 7) { + this.processInfo.writePointer(ptr(0)); + } + // ProcessDebugFlags = 0x1E + if (this.processInfoClass === 0x1E) { + this.processInfo.writeU8(1); + } + // ProcessDebugObjectHandle = 0x1E + if (this.processInfoClass === 30) { + this.processInfo.writePointer(ptr(0)); + retval.replace(0xC0000353); // STATUS_PORT_NOT_SET + } + } + }); + } +} +``` + +### 4. String Deobfuscation + +**Common string obfuscation patterns:** + +**XOR encrypted strings:** +```python +def xor_decrypt(data, key): + if isinstance(key, int): + return bytes([b ^ key for b in data]) + return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)]) + +# Find XOR key by known plaintext +known = b"GetProcAddress" +cipher = bytes_from_binary(offset, len(known)) +key = bytes([p ^ c for p, c in zip(known, cipher)]) +``` + +**String array + index (JavaScript):** +```javascript +// Obfuscated: +var _0x1234 = ['hello', 'world', 'test']; +function _0x5678(i) { return _0x1234[i]; } +console.log(_0x5678(0) + ' ' + _0x5678(1)); + +// Deobfuscation: replace calls with actual strings +// AST-based approach: +// 1. Parse JS to AST +// 2. Find array declaration +// 3. Find accessor function +// 4. Replace all calls with literal values +``` + +**.NET string decryption:** +```csharp +// Many .NET obfuscators encrypt strings and decrypt at runtime +// Find the decryption method, emulate it + +using dnlib.DotNet; +using dnlib.DotNet.Emit; + +// Load assembly +var mod = ModuleDefMD.Load("obfuscated.exe"); + +// Find string decryption method +// Usually called before string usage +// Pattern: ldtoken , call decrypt_method + +// Emulate or hook the decryption +// de4dot handles many common obfuscators automatically +``` + +### 5. Control Flow Flattening Recovery + +**What it looks like:** +```c +// Original: +if (condition) { + block_a(); +} else { + block_b(); +} +block_c(); + +// Flattened: +state = INITIAL; +while (state != EXIT) { + switch (state) { + case INITIAL: + if (condition) state = STATE_A; + else state = STATE_B; + break; + case STATE_A: + block_a(); + state = STATE_C; + break; + case STATE_B: + block_b(); + state = STATE_C; + break; + case STATE_C: + block_c(); + state = EXIT; + break; + } +} +``` + +**Recovery approaches:** +``` +1. Symbolic execution (Angr, Triton) + - Track state variable + - Build CFG from state transitions + - Reconstruct original flow + +2. Dynamic tracing + - Log state values during execution + - Build execution trace + - Reconstruct CFG from trace + +3. Static analysis + - Identify dispatcher (switch statement) + - Map state values to basic blocks + - Rebuild CFG by analyzing state assignments + +4. IDA plugin — deflat + - Automates dispatcher identification + - Rebuilds CFG + - Patches binary to remove flattening +``` + +**Angr — symbolic deobfuscation:** +```python +import angr + +# Load binary +proj = angr.Project('obfuscated_binary', auto_load_libs=False) + +# Find the dispatcher +# Set up symbolic execution +state = proj.factory.entry_state() +simgr = proj.factory.simulation_manager(state) + +# Explore to find all reachable states +simgr.explore(find=lambda s: s.solver.is_true(s.regs.rip == exit_addr)) + +# Analyze paths to reconstruct CFG +for path in simgr.found: + print(path.history.bbl_addrs) +``` + +### 6. Code Virtualization Reversing + +**VMProtect/Themida analysis:** +``` +Virtualized code structure: +1. VM entry point (transition from native to VM) +2. VM bytecode (custom instruction set) +3. VM handler (interprets bytecode) +4. VM exit (return to native code) + +Analysis approach: +1. Identify VM entry/exit points +2. Dump VM bytecode +3. Analyze VM handler to understand instruction set +4. Write VM bytecode disassembler +5. Reconstruct original logic from VM bytecode +``` + +**VM handler analysis:** +```c +// Typical VM dispatcher: +void vm_dispatcher(vm_context* ctx) { + while (ctx->ip < ctx->code_end) { + uint8_t opcode = *ctx->ip++; + switch (opcode) { + case 0x01: vm_push(ctx); break; + case 0x02: vm_pop(ctx); break; + case 0x03: vm_add(ctx); break; + // ... 200+ handlers + } + } +} + +// Extract handler table: +// Find the switch statement in IDA +// Each case → handler function +// Document handler behavior +// Build bytecode disassembler +``` + +### 7. Integrity Check Bypass + +**Common integrity checks:** +``` +1. Checksum of code section + - Compute CRC32/MD5 of .text section + - Compare with stored value + - Bypass: patch comparison or stored checksum + +2. Self-debugging + - Process debugs itself to detect tampering + - Bypass: hook debugging APIs + +3. Code signing verification + - Verify Authenticode signature + - Bypass: patch verification function + +4. Size/alignment checks + - Check section sizes, alignment + - Bypass: maintain original sizes + +5. API hook detection + - Check if API functions are hooked + - Bypass: use direct syscalls +``` + +### 8. Automation Tools + +**Generic deobfuscation framework:** +```python +class Deobfuscator: + def __init__(self, binary_path): + self.binary = open(binary_path, 'rb').read() + self.pe = pefile.PE(binary_path) + + def find_string_references(self, target_string): + """Find all references to a string in the binary.""" + offsets = [] + pos = 0 + while True: + pos = self.binary.find(target_string.encode(), pos) + if pos == -1: + break + offsets.append(pos) + pos += 1 + return offsets + + def extract_xor_strings(self, key): + """Extract XOR-encrypted strings with known key.""" + results = [] + # Scan data sections for XOR patterns + for section in self.pe.sections: + data = section.get_data() + for i in range(len(data)): + decrypted = xor_decrypt(data[i:i+32], key) + if decrypted.isascii() and len(decrypted) > 4: + results.append((section.Name, i, decrypted)) + return results +``` + +## Implementation Standards + +- All deobfuscation produces working, readable output +- Provide both automated and manual approaches +- Include scripts for repetitive deobfuscation tasks +- Document obfuscation techniques identified +- No partial deobfuscation — complete or nothing + +## Output Format + +For obfuscation RE tasks: +1. **Protection Identification** — packer, protector, obfuscator type +2. **Obfuscation Techniques** — what methods are used +3. **Deobfuscation Process** — step-by-step removal +4. **Recovered Code** — deobfuscated, readable output +5. **Bypass Methods** — working patches, scripts, tools +6. **Automation** — scripts for future deobfuscation + +Всё, брат. + + +## Related +- `skill reverse-engineering-binary — бинарный RE` +- `skill reverse-engineering-full — полный RE` +- `skill binary-exploitation — обход защит` diff --git a/reverse-engineering-protocol/SKILL.md b/reverse-engineering-protocol/SKILL.md new file mode 100644 index 0000000..822be3a --- /dev/null +++ b/reverse-engineering-protocol/SKILL.md @@ -0,0 +1,308 @@ +--- +name: reverse-engineering-protocol +description: 'Use for protocol reverse engineering: API reversing, network traffic + analysis, WebSocket/gRPC/protobuf reversing, custom protocol analysis, authentication + flow reversing, token/session manipulation, and undocumented API discovery.' +version: 1.0.0 +platforms: +- linux +- macos +- windows +triggers: + - reverse + - engineering + - protocol + - api + - reversing + - network + - traffic + - analysis + - websocket + - grpc + - protobuf + - custom +depends_on: [] +metadata: + tags: + - reverse + - engineering + - protocol +--- + +# Reverse Engineering — Protocol Analysis + +## Trigger Conditions + +- Reversing undocumented APIs or protocols +- Network traffic capture and analysis +- WebSocket, gRPC, protobuf, Thrift reversing +- Authentication flow analysis and replication +- Token/session handling reverse engineering +- Custom binary protocol analysis +- API endpoint discovery and documentation +- Encryption/obfuscation in network traffic +- Mobile app API reversing +- Web application internal API discovery +- Certificate pinning bypass for traffic analysis +- Rate limiting and anti-bot mechanism analysis + +## Core Methodology + +### 1. Traffic Capture + +**HTTP/HTTPS:** +```bash +# mitmproxy — interactive HTTPS inspection +mitmproxy --listen-port 8080 + +# Burp Suite — proxy + repeater + intruder +# Configure browser proxy → 127.0.0.1:8080 +# Install CA cert for HTTPS decryption + +# tcpdump — raw capture +tcpdump -i any -w capture.pcap port 443 + +# Wireshark — packet analysis +# Filter: http || tls || websocket +# Follow TCP stream for full conversation +``` + +**WebSocket:** +```bash +# wscat — raw WebSocket client +wscat -c wss://target.example.com/ws -H "Authorization: Bearer " + +# Browser DevTools → Network → WS tab +# Inspect frames, replay messages + +# Custom capture with mitmproxy addon +from mitmproxy import http + +class WSCapture: + def websocket_message(self, flow): + msg = flow.websocket.messages[-1] + print(f"{'→' if msg.from_client else '←'} {msg.content}") + +addons = [WSCapture()] +``` + +**gRPC/Protobuf:** +```bash +# grpcurl — gRPC CLI client +grpcurl -plaintext localhost:50051 list +grpcurl -plaintext localhost:50051 list com.example.Service + +# Decode protobuf without .proto (heuristic) +# protobuf-inspector: +python3 -m protobuf_inspector < input.bin + +# grpcdump — capture and decode +grpcdump --port 50051 --output decoded.json +``` + +### 2. Authentication Flow Reversing + +**OAuth/OIDC flow:** +``` +1. Capture authorization request +2. Identify client_id, redirect_uri, scope +3. Track authorization code exchange +4. Extract token endpoint parameters +5. Analyze token structure (JWT decoding) +6. Identify refresh token mechanism +7. Map token lifetime and rotation +``` + +**JWT analysis:** +```bash +# Decode without verification +echo "" | cut -d. -f2 | base64 -d 2>/dev/null | jq + +# PyJWT for programmatic analysis +import jwt +# Decode without verification to inspect claims +payload = jwt.decode(token, options={"verify_signature": False}) +``` + +**Custom auth:** +``` +1. Identify auth endpoint (login, token, session) +2. Capture request/response pairs +3. Identify token format (length, encoding, structure) +4. Track token in subsequent requests +5. Identify token refresh/rotation triggers +6. Map session lifetime and invalidation +7. Identify device fingerprinting parameters +``` + +### 3. API Discovery + +**Web application internal APIs:** +```bash +# Extract API endpoints from JS bundles +# Look for: /api/, /v1/, /graphql, /rpc +grep -rE '(fetch|axios|XMLHttpRequest)\([' app.js | \ + grep -oE '"[^"]*"' | sort -u + +# Chrome DevTools → Sources → Search +# Search for: api, endpoint, url, fetch, post, get + +# Service worker analysis +# Intercept and log all network requests +self.addEventListener('fetch', event => { + console.log('Intercepted:', event.request.url); +}); +``` + +**Mobile app API discovery:** +```bash +# APK decompilation → search for API strings +jadx -d output app.apk +grep -rE 'https?://' output/ | grep -v '\.xml' + +# Frida — intercept HTTP client calls +Java.use('okhttp3.Request$Builder').build.implementation = function() { + var req = this.build(); + console.log('HTTP → ' + req.url()); + return req; +}; + +# SSL pinning bypass (Frida) +Java.perform(function() { + var TrustManager = Java.registerClass({ + name: 'custom.TrustManager', + implements: [Java.use('javax.net.ssl.X509TrustManager')], + methods: { + checkClientTrusted: function() {}, + checkServerTrusted: function() {}, + getAcceptedIssuers: function() { return []; } + } + }); + // Replace TrustManagerFactory +}); +``` + +### 4. Protocol Analysis + +**Binary protocol structure:** +``` +Offset Size Field Notes +0 2 Magic 0xDE 0xAD +2 1 Version Protocol version +3 1 Message Type 0x01=Auth, 0x02=Data, 0x03=Heartbeat +4 4 Length Payload length (big-endian) +8 16 Session ID UUID +24 var Payload Encrypted/compressed data +``` + +**Analysis approach:** +``` +1. Capture multiple messages of same type +2. Identify constant bytes (magic, version) +3. Identify variable fields (length, IDs) +4. Correlate field changes with known actions +5. Identify encoding (base64, hex, raw binary) +6. Test encryption (XOR, AES, custom) +7. Build parser/encoder +``` + +**XOR key discovery:** +```python +def find_xor_key(known_plaintext, ciphertext): + """Find XOR key given known plaintext and ciphertext.""" + key = bytes([p ^ c for p, c in zip(known_plaintext, ciphertext)]) + # Check if key repeats + for key_len in range(1, len(key) // 2): + candidate = key[:key_len] + if all(key[i] == candidate[i % key_len] for i in range(len(key))): + return candidate + return key + +# Known plaintext attack: if you know the protocol sends "PING" +# and see bytes 0xAB 0xCD 0xEF 0x01, key = XOR("PING", those bytes) +``` + +### 5. API Replication + +**Building a custom client:** +```python +import requests +import hashlib +import time + +class ReverseEngineeredAPI: + def __init__(self, session_token): + self.session = requests.Session() + self.session.headers.update({ + 'Authorization': f'Bearer {session_token}', + 'User-Agent': 'App/3.2.1 (Linux; Android 13)', + 'X-App-Version': '3.2.1', + 'X-Request-Id': self._gen_request_id(), + 'X-Signature': self._gen_signature(), + }) + + def _gen_request_id(self): + # Reverse engineered from app: UUID v4 with custom namespace + import uuid + return str(uuid.uuid4()) + + def _gen_signature(self): + # Reverse engineered signature algorithm: + # HMAC-SHA256(timestamp + method + path + body, secret_key) + ts = str(int(time.time())) + # secret_key extracted from binary + secret = b'extracted_from_binary...' + msg = ts.encode() + b'GET' + b'/api/v1/data' + return hashlib.sha256(secret + msg).hexdigest() + + def get_data(self, params=None): + return self.session.get('https://api.target.com/v1/data', params=params) +``` + +### 6. Rate Limit & Anti-Bot Analysis + +**Identifying rate limit mechanisms:** +``` +1. Send requests at increasing rate +2. Track response codes (429, 403, 503) +3. Identify limit headers (X-RateLimit-Remaining, Retry-After) +4. Determine window (per-second, per-minute, per-hour) +5. Identify scope (per-IP, per-token, per-device) +6. Test bypass vectors (header manipulation, IP rotation) +``` + +**Anti-bot detection patterns:** +``` +- TLS fingerprint (JA3/JA3S) +- HTTP/2 SETTINGS frame order +- Browser fingerprint (canvas, WebGL, fonts) +- JavaScript challenge (Cloudflare, hCaptcha) +- Behavioral analysis (mouse movement, timing) +- Cookie-based tracking +- Device fingerprinting +``` + +## Implementation Standards + +- All protocol analysis produces working parsers/encoders +- Provide both capture methodology and analysis tools +- Document protocol structure completely +- Include authentication flow replication +- No partial protocol documentation + +## Output Format + +For protocol RE tasks: +1. **Capture Method** — how to intercept traffic +2. **Protocol Structure** — message format, fields, encoding +3. **Authentication** — auth flow, token handling, session management +4. **Encryption** — algorithm, keys, IVs, if any +5. **Working Client** — complete implementation +6. **Edge Cases** — rate limits, error handling, anti-bot + +Всё, брат. + + +## Related +- `skill api-engineering — API` +- `skill reverse-engineering-binary — RE` diff --git a/reverse-engineering-ransomware-encryption-routine/LICENSE b/reverse-engineering-ransomware-encryption-routine/LICENSE new file mode 100644 index 0000000..d885118 --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/LICENSE @@ -0,0 +1,201 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by the Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding any notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. Please do not remove or change + the license header comment from a contributed file except when + necessary. + + Copyright 2026 mukul975 + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/reverse-engineering-ransomware-encryption-routine/SKILL.md b/reverse-engineering-ransomware-encryption-routine/SKILL.md new file mode 100644 index 0000000..606a2b5 --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/SKILL.md @@ -0,0 +1,288 @@ +--- +name: reverse-engineering-ransomware-encryption-routine +description: Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and + potential decryption opportunities using static and dynamic analysis. +domain: cybersecurity +subdomain: malware-analysis +tags: +- ransomware +- encryption +- reverse-engineering +- cryptanalysis +- aes +- rsa +- decryption +- malware-analysis +version: '1.0' +author: mahipal +license: Apache-2.0 +d3fend_techniques: +- File Metadata Consistency Validation +- Content Format Conversion +- File Content Analysis +- Platform Hardening +- File Format Verification +nist_csf: +- DE.AE-02 +- RS.AN-03 +- ID.RA-01 +- DE.CM-01 +--- +# Reverse Engineering Ransomware Encryption Routine + +## Overview + +Modern ransomware uses hybrid encryption combining symmetric algorithms (AES-256-CBC/CTR, ChaCha20, Salsa20) for file encryption with asymmetric algorithms (RSA-2048/4096, Curve25519) for key protection. The encryption routine typically generates a random symmetric key per file, encrypts file contents, then encrypts the symmetric key with the attacker's embedded public key. Reverse engineering these routines identifies the specific algorithms, key derivation methods, initialization vectors, file targeting patterns, and potential implementation flaws that could enable decryption without paying the ransom. Notable examples include Rhysida (AES-256-CTR + RSA-4096), Qilin.B (AES-256-CTR with AES-NI or ChaCha20 fallback), and Medusa (AES-256 + RSA). + + +## When to Use + +- When performing authorized security testing that involves reverse engineering ransomware encryption routine +- When analyzing malware samples or attack artifacts in a controlled environment +- When conducting red team exercises or penetration testing engagements +- When building detection capabilities based on offensive technique understanding + +## Prerequisites + +- IDA Pro or Ghidra for static disassembly +- x64dbg/WinDbg for dynamic debugging +- Python 3.9+ with `pycryptodome`, `pefile` +- Understanding of AES, RSA, ChaCha20, Curve25519 algorithms +- Knowledge of Windows CryptoAPI and CNG (BCrypt) functions +- Sandbox environment for safe execution + +## Key Concepts + +### Hybrid Encryption Model + +Ransomware generates a unique AES key and IV for each file. The file content is encrypted with this symmetric key. The symmetric key is then encrypted with the attacker's RSA public key (embedded in the binary or fetched from C2). The encrypted key is appended or prepended to the encrypted file. Only the attacker holding the RSA private key can decrypt the per-file symmetric keys. + +### Cryptographic API Identification + +Windows ransomware typically uses CryptoAPI (`CryptAcquireContext`, `CryptGenKey`, `CryptEncrypt`) or CNG (`BCryptGenerateSymmetricKey`, `BCryptEncrypt`). Some use OpenSSL or custom implementations. Identifying these API calls provides immediate insight into the algorithm, key size, and mode of operation. + +### Implementation Flaws + +Decryption opportunities arise from: hardcoded encryption keys, weak PRNG for key generation (using `GetTickCount` or `time()` as seed), reuse of IVs across files, ECB mode usage, keys remaining in memory post-encryption, and race conditions where keys can be captured during encryption. + +## Workflow + +### Step 1: Identify Cryptographic Functions + +```python +#!/usr/bin/env python3 +"""Identify cryptographic functions in ransomware PE files.""" +import pefile +import sys + +CRYPTO_APIS = { + # Windows CryptoAPI + "CryptAcquireContextA": "CryptoAPI context acquisition", + "CryptAcquireContextW": "CryptoAPI context acquisition", + "CryptGenKey": "Key generation", + "CryptDeriveKey": "Key derivation", + "CryptEncrypt": "Encryption operation", + "CryptDecrypt": "Decryption operation", + "CryptImportKey": "Key import (public key?)", + "CryptExportKey": "Key export", + "CryptGenRandom": "Random number generation", + "CryptCreateHash": "Hash creation", + "CryptHashData": "Hashing operation", + # Windows CNG (BCrypt) + "BCryptOpenAlgorithmProvider": "CNG algorithm initialization", + "BCryptGenerateSymmetricKey": "CNG symmetric key generation", + "BCryptEncrypt": "CNG encryption", + "BCryptDecrypt": "CNG decryption", + "BCryptGenerateKeyPair": "CNG key pair generation", + "BCryptImportKeyPair": "CNG key import", + # OpenSSL + "EVP_EncryptInit_ex": "OpenSSL encrypt init", + "EVP_EncryptUpdate": "OpenSSL encrypt update", + "EVP_EncryptFinal_ex": "OpenSSL encrypt final", + "RSA_public_encrypt": "OpenSSL RSA encryption", + "AES_set_encrypt_key": "OpenSSL AES key setup", + # File operations + "CreateFileW": "File open (target files)", + "ReadFile": "File read (before encryption)", + "WriteFile": "File write (after encryption)", + "FindFirstFileW": "File enumeration (targeting)", + "FindNextFileW": "File enumeration", + "MoveFileW": "File rename (extension change)", + "DeleteFileW": "File deletion (originals)", +} + +AES_SBOX = bytes([ + 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, + 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76, +]) + +CHACHA20_CONSTANT = b"expand 32-byte k" + + +def analyze_imports(filepath): + """Analyze PE imports for cryptographic APIs.""" + try: + pe = pefile.PE(filepath) + except pefile.PEFormatError: + print("[-] Not a valid PE file") + return + + print("[+] Cryptographic API Analysis") + print("=" * 60) + + crypto_imports = [] + if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'): + for entry in pe.DIRECTORY_ENTRY_IMPORT: + dll = entry.dll.decode('utf-8', errors='replace') + for imp in entry.imports: + if imp.name: + name = imp.name.decode('utf-8', errors='replace') + if name in CRYPTO_APIS: + desc = CRYPTO_APIS[name] + crypto_imports.append((dll, name, desc)) + print(f" [{dll}] {name}: {desc}") + + if not crypto_imports: + print(" No known crypto APIs found in imports") + print(" Malware may use custom implementation or dynamic loading") + + return crypto_imports + + +def find_crypto_constants(filepath): + """Search for embedded cryptographic constants.""" + with open(filepath, 'rb') as f: + data = f.read() + + print("\n[+] Cryptographic Constants Search") + print("=" * 60) + + # AES S-Box + offset = data.find(AES_SBOX) + if offset != -1: + print(f" AES S-Box found at offset 0x{offset:x}") + + # ChaCha20/Salsa20 constant + offset = data.find(CHACHA20_CONSTANT) + if offset != -1: + print(f" ChaCha20 constant at offset 0x{offset:x}") + + # RSA public key markers + rsa_markers = [ + b'-----BEGIN PUBLIC KEY-----', + b'-----BEGIN RSA PUBLIC KEY-----', + b'\x30\x82', # ASN.1 SEQUENCE + ] + for marker in rsa_markers: + offset = data.find(marker) + if offset != -1: + print(f" RSA key marker at offset 0x{offset:x}") + + # Common ransomware file extension patterns + import re + ext_pattern = re.compile(rb'\.\w{3,10}(?=\x00)', re.IGNORECASE) + extensions = set() + for match in ext_pattern.finditer(data): + ext = match.group().decode('ascii', errors='replace').lower() + target_exts = [ + '.doc', '.docx', '.xls', '.xlsx', '.pdf', '.ppt', + '.jpg', '.png', '.sql', '.mdb', '.bak', '.zip', + ] + if ext in target_exts: + extensions.add(ext) + + if extensions: + print(f"\n Target file extensions: {', '.join(sorted(extensions))}") + + +if __name__ == "__main__": + if len(sys.argv) < 2: + print(f"Usage: {sys.argv[0]} ") + sys.exit(1) + + analyze_imports(sys.argv[1]) + find_crypto_constants(sys.argv[1]) +``` + +### Step 2: Analyze Encryption Flow + +```python +def analyze_encryption_pattern(filepath): + """Analyze file encryption patterns from ransomware artifacts.""" + import os + import struct + + with open(filepath, 'rb') as f: + data = f.read() + + file_size = len(data) + print(f"\n[+] Encrypted File Analysis: {filepath}") + print(f" Size: {file_size:,} bytes") + + # Check for appended key material (common pattern) + # Many ransomware families append encrypted key at end of file + tail_sizes = [256, 512, 1024, 2048] # Common RSA ciphertext sizes + for size in tail_sizes: + if file_size > size + 16: + tail = data[-size:] + # High entropy suggests encrypted data + entropy = calculate_entropy(tail) + if entropy > 7.5: + print(f" Possible encrypted key ({size} bytes) " + f"at end of file (entropy: {entropy:.2f})") + + # Check for header modifications + # Many ransomware prepend metadata + header = data[:64] + print(f" First 16 bytes: {header[:16].hex()}") + + # Check if original file header is preserved + known_headers = { + b'PK': 'ZIP/Office', + b'\x89PNG': 'PNG', + b'\xff\xd8\xff': 'JPEG', + b'%PDF': 'PDF', + b'\xd0\xcf\x11\xe0': 'OLE (DOC/XLS)', + } + for magic, ftype in known_headers.items(): + if header.startswith(magic): + print(f" Original format preserved: {ftype}") + break + else: + print(" Original header destroyed/encrypted") + + +def calculate_entropy(data): + """Calculate Shannon entropy of data.""" + from collections import Counter + import math + + if not data: + return 0 + + freq = Counter(data) + length = len(data) + entropy = -sum( + (count / length) * math.log2(count / length) + for count in freq.values() + ) + return entropy +``` + +## Validation Criteria + +- Cryptographic algorithms identified (AES, RSA, ChaCha20, etc.) +- Key size and mode of operation determined +- Key generation method analyzed for potential weaknesses +- Per-file key encryption scheme documented +- File targeting patterns and extension list extracted +- Embedded public keys extracted for infrastructure correlation +- Potential decryption opportunities assessed + +## References + +- [Morphisec - Breaking Down Ransomware Encryption](https://www.morphisec.com/blog/breaking-down-ransomware-encryption-key-strategies-algorithms-and-implementation-trends/) +- [Emsisoft - Ransomware Encryption Methods](https://www.emsisoft.com/en/blog/27649/ransomware-encryption-methods/) +- [Halcyon Ransomware Power Rankings Q4-2024](https://www.halcyon.ai/raas-mq/power-rankings-ransomware-malicious-quartile-q4-2024) +- [No More Ransom Project](https://www.nomoreransom.org/) +- [MITRE ATT&CK T1486 - Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/) diff --git a/reverse-engineering-ransomware-encryption-routine/assets/template.md b/reverse-engineering-ransomware-encryption-routine/assets/template.md new file mode 100644 index 0000000..d34124a --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/assets/template.md @@ -0,0 +1,30 @@ +# Ransomware Encryption Analysis Report + +## Sample Info +| Field | Value | +|-------|-------| +| SHA-256 | | +| Family | | +| Ransom Note Name | | + +## Encryption Summary +| Parameter | Value | +|-----------|-------| +| Symmetric Algorithm | AES-256-CTR / ChaCha20 | +| Asymmetric Algorithm | RSA-2048 / RSA-4096 | +| Key Generation | CryptoAPI / CNG / Custom | +| IV Generation | Random / Fixed / Counter | +| File Extension Added | | + +## Decryption Feasibility +| Factor | Assessment | +|--------|-----------| +| PRNG Quality | Secure / Weak | +| Key in Memory | Yes / No | +| Implementation Flaws | None / Described below | +| Existing Decryptor | Available / Not available | + +## Recommendations +1. Check No More Ransom project for existing decryptors +2. Preserve memory dumps for potential key recovery +3. Report to law enforcement and threat intelligence sharing diff --git a/reverse-engineering-ransomware-encryption-routine/references/api-reference.md b/reverse-engineering-ransomware-encryption-routine/references/api-reference.md new file mode 100644 index 0000000..44ced3c --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/references/api-reference.md @@ -0,0 +1,52 @@ +# API Reference: Reverse Engineering Ransomware Encryption + +## Cryptographic Algorithm Constants + +| Algorithm | Signature | Description | +|-----------|-----------|-------------| +| AES | S-Box starting `0x63 0x7C 0x77` | AES Rijndael substitution box | +| RSA | DER `0x30 0x82` prefix | ASN.1 RSA key structure | +| ChaCha20/Salsa20 | `expand 32-byte k` | Stream cipher constant | +| RC4 | Sequential 0-255 state | Key scheduling algorithm init | + +## Encryption Analysis Techniques + +| Technique | Tool | Purpose | +|-----------|------|---------| +| Entropy analysis | `ent`, Python | Detect encrypted regions | +| Constant scanning | IDA/Ghidra YARA | Find crypto implementations | +| API tracing | x64dbg, Frida | Trace CryptEncrypt/BCrypt calls | +| Key extraction | Volatility3 | Dump keys from memory | + +## Ransomware Encryption Patterns + +| Pattern | Indicator | +|---------|-----------| +| Full encryption | Entropy > 7.9 across entire file | +| Intermittent | High entropy blocks with gaps | +| Header-only | First N bytes encrypted, rest plain | +| Appended metadata | File larger than original (key/IV at end) | + +## Common Ransomware Crypto + +| Family | Algorithm | Key Mgmt | +|--------|-----------|----------| +| LockBit 3.0 | AES-256-CBC + RSA-2048 | Per-file AES key, RSA-encrypted | +| BlackCat/ALPHV | ChaCha20 + RSA-4096 | Rust implementation | +| Royal | AES-256-CBC + RSA-2048 | Intermittent encryption | +| Akira | ChaCha20 | Partial file encryption | + +## Python Libraries + +| Library | Version | Purpose | +|---------|---------|---------| +| `hashlib` | stdlib | SHA256 hashing | +| `struct` | stdlib | Binary data parsing | +| `re` | stdlib | Pattern extraction | +| `math` | stdlib | Shannon entropy calculation | + +## References + +- ID Ransomware: https://id-ransomware.malwarehunterteam.com/ +- NoMoreRansom Decryptors: https://www.nomoreransom.org/en/decryption-tools.html +- Ghidra: https://ghidra-sre.org/ diff --git a/reverse-engineering-ransomware-encryption-routine/references/standards.md b/reverse-engineering-ransomware-encryption-routine/references/standards.md new file mode 100644 index 0000000..6d585c1 --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/references/standards.md @@ -0,0 +1,30 @@ +# Ransomware Encryption Standards Reference + +## Common Encryption Schemes by Family +| Family | Symmetric | Asymmetric | Key Size | +|--------|-----------|-----------|----------| +| Rhysida | AES-256-CTR | RSA-4096 | 256-bit | +| Qilin.B | AES-256-CTR/ChaCha20 | RSA-4096 OAEP | 256-bit | +| Medusa | AES-256 | RSA public key | 256-bit | +| LockBit 3.0 | AES-256-CTR | Curve25519 | 256-bit | +| BlackCat/ALPHV | AES-128/ChaCha20 | RSA-2048 | 128/256-bit | +| Conti | ChaCha20 | RSA-4096 | 256-bit | + +## Windows Cryptographic API Cheat Sheet +| Function | Purpose | +|----------|---------| +| CryptAcquireContext | Acquire crypto provider handle | +| CryptGenKey | Generate symmetric/asymmetric key | +| CryptImportKey | Import key blob | +| BCryptOpenAlgorithmProvider | Open CNG algorithm | +| BCryptGenerateSymmetricKey | Create symmetric key | + +## MITRE ATT&CK Techniques +- T1486: Data Encrypted for Impact +- T1490: Inhibit System Recovery +- T1083: File and Directory Discovery +- T1082: System Information Discovery + +## References +- [No More Ransom Decryptors](https://www.nomoreransom.org/en/decryption-tools.html) +- [ID Ransomware](https://id-ransomware.malwarehunterteam.com/) diff --git a/reverse-engineering-ransomware-encryption-routine/references/workflows.md b/reverse-engineering-ransomware-encryption-routine/references/workflows.md new file mode 100644 index 0000000..f4e2ef1 --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/references/workflows.md @@ -0,0 +1,37 @@ +# Ransomware Encryption Analysis Workflows + +## Workflow 1: Encryption Routine Identification +``` +[Ransomware Sample] --> [Import Analysis] --> [Find Crypto APIs] + | + v + [Identify Algorithm] + | + v + [Trace Key Generation] + | + v + [Assess Decryption Feasibility] +``` + +## Workflow 2: Key Recovery Assessment +``` +[Encrypted Files] --> [Analyze File Structure] --> [Locate Encrypted Key] + | + v + [Check for PRNG Weaknesses] + | + v + [Attempt Key Recovery] +``` + +## Workflow 3: Decryptor Development +``` +[Identified Flaw] --> [Extract Parameters] --> [Build Decryption Logic] + | + v + [Test on Sample Files] + | + v + [Release Decryptor Tool] +``` diff --git a/reverse-engineering-ransomware-encryption-routine/scripts/agent.py b/reverse-engineering-ransomware-encryption-routine/scripts/agent.py new file mode 100644 index 0000000..689b382 --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/scripts/agent.py @@ -0,0 +1,183 @@ +#!/usr/bin/env python3 +"""Agent for reverse engineering ransomware encryption routines. + +Identifies encryption algorithms, extracts key material from +memory dumps or binary analysis, detects IV/nonce patterns, +and documents the cryptographic implementation for decryptor +development. +""" + +import json +import sys +import re +import struct +import hashlib +from pathlib import Path +from datetime import datetime + + +CRYPTO_CONSTANTS = { + "AES S-Box": bytes([0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5]), + "AES Inv S-Box": bytes([0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38]), + "RSA Marker": b"\x30\x82", + "ChaCha20 Constant": b"expand 32-byte k", + "Salsa20 Constant": b"expand 32-byte k", + "RC4 State Init": bytes(range(8)), + "SHA256 Init H0": struct.pack(">I", 0x6a09e667), +} + +RANSOMWARE_PATTERNS = { + "file_extension_change": re.compile(rb'\.\w{3,10}(?=\x00)'), + "ransom_note_name": re.compile(rb'(?:README|RECOVER|DECRYPT|HOW.TO)[\w.-]*\.(?:txt|html|hta)', re.I), + "bitcoin_address": re.compile(rb'[13][a-km-zA-HJ-NP-Z1-9]{25,34}'), + "onion_url": re.compile(rb'[\w]{16,56}\.onion'), + "email_address": re.compile(rb'[\w.+-]+@[\w-]+\.[\w.]{2,}'), +} + + +class RansomwareREAgent: + """Analyzes ransomware encryption implementation.""" + + def __init__(self, sample_path, output_dir="./ransomware_re"): + self.sample_path = Path(sample_path) + self.output_dir = Path(output_dir) + self.output_dir.mkdir(parents=True, exist_ok=True) + self.findings = [] + + def identify_crypto_algorithms(self): + """Scan binary for cryptographic algorithm constants.""" + data = self.sample_path.read_bytes() + detected = [] + + for name, constant in CRYPTO_CONSTANTS.items(): + offset = data.find(constant) + if offset != -1: + detected.append({ + "algorithm": name, + "offset": hex(offset), + "context": data[max(0, offset - 16):offset + len(constant) + 16].hex(), + }) + self.findings.append({ + "type": "Crypto Algorithm Detected", + "algorithm": name, "offset": hex(offset), + }) + return detected + + def extract_encryption_indicators(self): + """Extract ransomware-specific indicators from the binary.""" + data = self.sample_path.read_bytes() + indicators = {} + + for name, pattern in RANSOMWARE_PATTERNS.items(): + matches = pattern.findall(data) + if matches: + decoded = [] + for m in matches[:10]: + try: + decoded.append(m.decode("utf-8", errors="ignore")) + except (UnicodeDecodeError, AttributeError): + decoded.append(m.hex()) + indicators[name] = decoded + + return indicators + + def analyze_encrypted_file(self, encrypted_path, original_path=None): + """Analyze an encrypted file to determine encryption characteristics.""" + enc_data = Path(encrypted_path).read_bytes() + analysis = { + "file_size": len(enc_data), + "entropy": self._calculate_entropy(enc_data), + "header_bytes": enc_data[:64].hex(), + "footer_bytes": enc_data[-64:].hex() if len(enc_data) > 64 else "", + } + + if analysis["entropy"] > 7.9: + analysis["encryption_type"] = "Full file encryption" + elif analysis["entropy"] > 6.0: + analysis["encryption_type"] = "Partial/intermittent encryption" + else: + analysis["encryption_type"] = "Possibly not encrypted or header-only" + + if original_path and Path(original_path).exists(): + orig_data = Path(original_path).read_bytes() + analysis["size_difference"] = len(enc_data) - len(orig_data) + if analysis["size_difference"] > 0: + analysis["appended_bytes"] = analysis["size_difference"] + analysis["footer_metadata"] = enc_data[len(orig_data):len(orig_data) + 128].hex() + + return analysis + + def _calculate_entropy(self, data): + """Calculate Shannon entropy of data.""" + if not data: + return 0.0 + import math + freq = [0] * 256 + for byte in data: + freq[byte] += 1 + length = len(data) + entropy = 0.0 + for count in freq: + if count > 0: + p = count / length + entropy -= p * math.log2(p) + return round(entropy, 4) + + def extract_key_material(self, memory_dump_path=None): + """Search for potential encryption key material.""" + search_data = (Path(memory_dump_path).read_bytes() + if memory_dump_path else self.sample_path.read_bytes()) + potential_keys = [] + + for offset in range(0, min(len(search_data), 10_000_000), 16): + block = search_data[offset:offset + 32] + if len(block) < 16: + break + entropy = self._calculate_entropy(block) + if entropy > 4.5 and all(b != 0 for b in block[:16]): + if not all(b == block[0] for b in block[:16]): + potential_keys.append({ + "offset": hex(offset), + "length": len(block), + "entropy": entropy, + "sha256": hashlib.sha256(block).hexdigest()[:16], + }) + if len(potential_keys) >= 50: + break + + return potential_keys[:20] + + def generate_report(self): + crypto = self.identify_crypto_algorithms() + indicators = self.extract_encryption_indicators() + sha256 = hashlib.sha256(self.sample_path.read_bytes()).hexdigest() + + report = { + "sample": str(self.sample_path), + "sha256": sha256, + "report_date": datetime.utcnow().isoformat(), + "crypto_algorithms": crypto, + "ransomware_indicators": indicators, + "findings": self.findings, + } + report_path = self.output_dir / "ransomware_re_report.json" + with open(report_path, "w") as f: + json.dump(report, f, indent=2) + print(json.dumps(report, indent=2)) + return report + + +def main(): + if len(sys.argv) < 2: + print("Usage: agent.py [encrypted_file] [original_file]") + sys.exit(1) + agent = RansomwareREAgent(sys.argv[1]) + agent.generate_report() + if len(sys.argv) > 2: + orig = sys.argv[3] if len(sys.argv) > 3 else None + analysis = agent.analyze_encrypted_file(sys.argv[2], orig) + print(json.dumps(analysis, indent=2)) + + +if __name__ == "__main__": + main() diff --git a/reverse-engineering-ransomware-encryption-routine/scripts/process.py b/reverse-engineering-ransomware-encryption-routine/scripts/process.py new file mode 100644 index 0000000..7a934e9 --- /dev/null +++ b/reverse-engineering-ransomware-encryption-routine/scripts/process.py @@ -0,0 +1,179 @@ +#!/usr/bin/env python3 +""" +Ransomware Encryption Routine Analyzer + +Analyzes ransomware samples to identify encryption algorithms, +key generation methods, and potential decryption opportunities. + +Requirements: + pip install pefile pycryptodome + +Usage: + python process.py --sample ransomware.exe + python process.py --encrypted-file encrypted.docx.locked +""" + +import argparse +import json +import math +import re +import struct +import sys +from collections import Counter +from pathlib import Path + +try: + import pefile +except ImportError: + pefile = None + + +CRYPTO_APIS = { + "CryptAcquireContextA": ("CryptoAPI", "context"), + "CryptAcquireContextW": ("CryptoAPI", "context"), + "CryptGenKey": ("CryptoAPI", "keygen"), + "CryptEncrypt": ("CryptoAPI", "encrypt"), + "CryptDecrypt": ("CryptoAPI", "decrypt"), + "CryptImportKey": ("CryptoAPI", "import"), + "CryptGenRandom": ("CryptoAPI", "random"), + "BCryptOpenAlgorithmProvider": ("CNG", "init"), + "BCryptGenerateSymmetricKey": ("CNG", "keygen"), + "BCryptEncrypt": ("CNG", "encrypt"), + "BCryptDecrypt": ("CNG", "decrypt"), + "EVP_EncryptInit_ex": ("OpenSSL", "init"), + "EVP_EncryptUpdate": ("OpenSSL", "encrypt"), + "RSA_public_encrypt": ("OpenSSL", "rsa_encrypt"), + "AES_set_encrypt_key": ("OpenSSL", "aes_init"), +} + +AES_SBOX_PREFIX = bytes([0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5]) +CHACHA_CONST = b"expand 32-byte k" +SALSA_CONST = b"expand 32-byte k" + + +def entropy(data): + if not data: + return 0.0 + freq = Counter(data) + length = len(data) + return -sum( + (c / length) * math.log2(c / length) for c in freq.values() + ) + + +def analyze_sample(filepath): + report = {"file": str(filepath), "crypto_apis": [], "constants": [], + "embedded_keys": [], "target_extensions": []} + + with open(filepath, 'rb') as f: + data = f.read() + + report["size"] = len(data) + report["entropy"] = round(entropy(data), 3) + + # Import analysis + if pefile: + try: + pe = pefile.PE(filepath) + if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'): + for entry in pe.DIRECTORY_ENTRY_IMPORT: + dll = entry.dll.decode('utf-8', errors='replace') + for imp in entry.imports: + if imp.name: + name = imp.name.decode('utf-8', errors='replace') + if name in CRYPTO_APIS: + framework, op = CRYPTO_APIS[name] + report["crypto_apis"].append({ + "dll": dll, + "function": name, + "framework": framework, + "operation": op, + }) + except Exception: + pass + + # Crypto constants + if data.find(AES_SBOX_PREFIX) != -1: + report["constants"].append("AES S-Box") + if data.find(CHACHA_CONST) != -1: + report["constants"].append("ChaCha20/Salsa20") + + # RSA keys + pem_markers = [b'-----BEGIN PUBLIC KEY-----', + b'-----BEGIN RSA PUBLIC KEY-----'] + for marker in pem_markers: + idx = data.find(marker) + if idx != -1: + end = data.find(b'-----END', idx) + if end != -1: + key_data = data[idx:end + 30].decode('ascii', errors='replace') + report["embedded_keys"].append({ + "type": "PEM RSA Public Key", + "offset": f"0x{idx:x}", + "preview": key_data[:100], + }) + + # Target extensions + ext_pattern = re.compile(rb'\.(?:doc|docx|xls|xlsx|pdf|ppt|pptx|' + rb'jpg|png|sql|mdb|bak|zip|rar|7z|' + rb'psd|dwg|vmdk|raw|db)\b', re.I) + for m in ext_pattern.finditer(data): + ext = m.group().decode('ascii', errors='replace').lower() + if ext not in report["target_extensions"]: + report["target_extensions"].append(ext) + + return report + + +def analyze_encrypted_file(filepath): + with open(filepath, 'rb') as f: + data = f.read() + + report = { + "file": str(filepath), + "size": len(data), + "entropy": round(entropy(data), 3), + "high_entropy": entropy(data) > 7.9, + "possible_appended_key": [], + } + + # Check tail for appended encrypted key + for key_size in [128, 256, 512, 1024, 2048]: + if len(data) > key_size + 16: + tail = data[-key_size:] + tail_entropy = entropy(tail) + if tail_entropy > 7.5: + report["possible_appended_key"].append({ + "size": key_size, + "entropy": round(tail_entropy, 3), + }) + + return report + + +def main(): + parser = argparse.ArgumentParser( + description="Ransomware Encryption Analyzer" + ) + parser.add_argument("--sample", help="Ransomware binary") + parser.add_argument("--encrypted-file", help="Encrypted file to analyze") + parser.add_argument("--output", help="Output JSON report") + + args = parser.parse_args() + + if args.sample: + report = analyze_sample(args.sample) + elif args.encrypted_file: + report = analyze_encrypted_file(args.encrypted_file) + else: + parser.print_help() + return + + print(json.dumps(report, indent=2)) + if args.output: + with open(args.output, 'w') as f: + json.dump(report, f, indent=2) + + +if __name__ == "__main__": + main() diff --git a/reverse-engineering-rust-malware/LICENSE b/reverse-engineering-rust-malware/LICENSE new file mode 100644 index 0000000..d885118 --- /dev/null +++ b/reverse-engineering-rust-malware/LICENSE @@ -0,0 +1,201 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by the Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding any notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. Please do not remove or change + the license header comment from a contributed file except when + necessary. + + Copyright 2026 mukul975 + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/reverse-engineering-rust-malware/SKILL.md b/reverse-engineering-rust-malware/SKILL.md new file mode 100644 index 0000000..35b55cd --- /dev/null +++ b/reverse-engineering-rust-malware/SKILL.md @@ -0,0 +1,179 @@ +--- +name: reverse-engineering-rust-malware +description: Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated + strings, crate dependency extraction, and Rust-specific control flow analysis. +domain: cybersecurity +subdomain: malware-analysis +tags: +- rust +- reverse-engineering +- malware-analysis +- ghidra +- ida-pro +- binary-analysis +- rust-malware +version: '1.0' +author: mahipal +license: Apache-2.0 +nist_csf: +- DE.AE-02 +- RS.AN-03 +- ID.RA-01 +- DE.CM-01 +--- +# Reverse Engineering Rust Malware + +## Overview + +Rust has become increasingly popular for malware development due to its cross-compilation, memory safety guarantees, and the complexity it introduces for reverse engineers. Rust binaries contain the entire standard library statically linked, producing large binaries with extensive boilerplate code. Key challenges include non-null-terminated strings (Rust uses fat pointers with pointer+length), monomorphization generating duplicated generic code, complex error handling (Result/Option unwrap chains), and unfamiliar calling conventions. Decompiling Rust to C produces unhelpful output compared to C/C++ binaries. Tools like Ghidra scripts for crate extraction, and training focused on Rust-specific patterns (2024-2025) help address these challenges. Notable Rust malware includes BlackCat/ALPHV ransomware, Hive ransomware variants, and Buer Loader. + + +## When to Use + +- When performing authorized security testing that involves reverse engineering rust malware +- When analyzing malware samples or attack artifacts in a controlled environment +- When conducting red team exercises or penetration testing engagements +- When building detection capabilities based on offensive technique understanding + +## Prerequisites + +- IDA Pro 8.0+ or Ghidra 11.0+ +- Rust toolchain for reference compilation +- Python 3.9+ for helper scripts +- Understanding of Rust memory model (ownership, borrowing) +- Familiarity with Rust string types (String, &str, CString) + +## Workflow + +### Step 1: Identify and Parse Rust Binary Metadata + +```python +#!/usr/bin/env python3 +"""Analyze Rust malware binary metadata and extract crate dependencies.""" +import re +import sys +import json + + +def identify_rust_binary(data): + """Check if binary is Rust-compiled and extract version info.""" + indicators = { + "rust_panic_strings": bool(re.search(rb'panicked at', data)), + "rust_unwrap": bool(re.search(rb'called.*unwrap.*on.*None', data)), + "core_panic": bool(re.search(rb'core::panicking', data)), + "std_rt": bool(re.search(rb'std::rt::lang_start', data)), + "cargo_path": bool(re.search(rb'\.cargo[/\\]registry', data)), + "rustc_version": None, + } + + version = re.search(rb'rustc\s+(\d+\.\d+\.\d+)', data) + if version: + indicators["rustc_version"] = version.group(1).decode() + + is_rust = sum(1 for v in indicators.values() if v) >= 2 + return is_rust, indicators + + +def extract_crates(data): + """Extract Rust crate (dependency) names from binary strings.""" + crate_pattern = re.compile( + rb'(?:crates\.io-[a-f0-9]+/|\.cargo/registry/src/[^/]+/)' + rb'([\w-]+)-(\d+\.\d+\.\d+)' + ) + crates = {} + for match in crate_pattern.finditer(data): + name = match.group(1).decode() + version = match.group(2).decode() + crates[name] = version + + # Also check for common malware-relevant crates + suspicious_crates = { + "reqwest": "HTTP client", + "hyper": "HTTP library", + "tokio": "Async runtime", + "aes": "AES encryption", + "chacha20": "ChaCha20 encryption", + "rsa": "RSA encryption", + "ring": "Crypto library", + "base64": "Base64 encoding", + "winapi": "Windows API bindings", + "winreg": "Registry access", + "sysinfo": "System information", + "screenshots": "Screen capture", + "clipboard": "Clipboard access", + "keylogger": "Key logging", + } + + capabilities = [] + for crate_name, description in suspicious_crates.items(): + if crate_name in crates: + capabilities.append({ + "crate": crate_name, + "version": crates[crate_name], + "capability": description, + }) + + return crates, capabilities + + +def extract_rust_strings(data): + """Extract strings handling Rust's non-null-terminated format.""" + # Rust strings are stored as pointer+length, but string literals + # are often in .rodata as contiguous sequences + strings = [] + ascii_pattern = re.compile(rb'[\x20-\x7e]{8,500}') + for match in ascii_pattern.finditer(data): + s = match.group().decode('ascii') + # Filter for malware-relevant strings + keywords = ['http', 'socket', 'encrypt', 'decrypt', 'shell', + 'exec', 'cmd', 'upload', 'download', 'persist', + 'registry', 'mutex', 'pipe', 'inject'] + if any(kw in s.lower() for kw in keywords): + strings.append(s) + + return strings + + +if __name__ == "__main__": + if len(sys.argv) < 2: + print(f"Usage: {sys.argv[0]} ") + sys.exit(1) + + with open(sys.argv[1], 'rb') as f: + data = f.read() + + is_rust, indicators = identify_rust_binary(data) + print(f"[{'+'if is_rust else '-'}] Rust binary: {is_rust}") + print(json.dumps(indicators, indent=2, default=str)) + + crates, capabilities = extract_crates(data) + print(f"\n[+] Crates ({len(crates)}):") + for name, ver in sorted(crates.items()): + print(f" {name} v{ver}") + + if capabilities: + print(f"\n[!] Suspicious capabilities:") + for cap in capabilities: + print(f" {cap['crate']} -> {cap['capability']}") + + strings = extract_rust_strings(data) + if strings: + print(f"\n[+] Suspicious strings ({len(strings)}):") + for s in strings[:20]: + print(f" {s}") +``` + +## Validation Criteria + +- Binary correctly identified as Rust-compiled with version info +- Crate dependencies extracted revealing malware capabilities +- Rust-specific string extraction handles fat pointer format +- Main entry point and core logic functions identified +- Encryption, networking, and persistence code located + +## References + +- [Binary Defense - Extracting Secrets from Rust Malware](https://binarydefense.com/resources/blog/digging-through-rust-to-find-gold-extracting-secrets-from-rust-malware) +- [Ghidra Extension for Rust Analysis](https://cir.nii.ac.jp/crid/1050302237609671296) +- [Fuzzing Labs - Reversing Modern Binaries](https://fuzzinglabs.com/reversing-modern-binaries/) +- [Bishop Fox - Rust for Malware Development](https://bishopfox.com/blog/rust-for-malware-development) diff --git a/reverse-engineering-rust-malware/assets/template.md b/reverse-engineering-rust-malware/assets/template.md new file mode 100644 index 0000000..366cc60 --- /dev/null +++ b/reverse-engineering-rust-malware/assets/template.md @@ -0,0 +1,25 @@ +# Analysis Report Template - reverse-engineering-rust-malware + +## Sample Information +| Field | Value | +|-------|-------| +| SHA-256 | | +| File Type | | +| Analysis Date | | +| Analyst | | +| Classification | TLP:AMBER | + +## Findings +| Finding | Severity | Details | +|---------|----------|---------| +| | | | + +## IOCs Extracted +| Type | Value | Context | +|------|-------|---------| +| | | | + +## Recommendations +1. +2. +3. diff --git a/reverse-engineering-rust-malware/references/api-reference.md b/reverse-engineering-rust-malware/references/api-reference.md new file mode 100644 index 0000000..170b1fb --- /dev/null +++ b/reverse-engineering-rust-malware/references/api-reference.md @@ -0,0 +1,45 @@ +# API Reference: Reverse Engineering Rust Malware + +## Rust Binary Indicators + +| Indicator | Pattern | Description | +|-----------|---------|-------------| +| Panic strings | `panicked at` | Rust panic handler messages | +| Unwrap failure | `called.*unwrap.*on.*None` | Option/Result unwrap | +| Core panic | `core::panicking` | Standard library panic | +| Runtime start | `std::rt::lang_start` | Rust runtime entry point | +| Cargo registry | `.cargo/registry` | Crate dependency paths | +| Rustc version | `rustc X.Y.Z` | Compiler version string | + +## Crate Extraction Pattern + +| Pattern | Example Match | +|---------|---------------| +| `crates.io-/-` | `crates.io-abc123/reqwest-0.11.22` | +| `.cargo/registry/src//-` | `.cargo/registry/src/index.crates.io/aes-0.8.3` | + +## Suspicious Crate Capabilities + +| Crate | Capability | Malware Use | +|-------|-----------|-------------| +| reqwest / hyper | HTTP client | C2 communication | +| aes / chacha20 / rsa | Encryption | Ransomware encryption | +| ring | Crypto primitives | Key generation | +| winapi / winreg | Windows API | Persistence, injection | +| sysinfo | System info | Host enumeration | +| native-tls | TLS | Encrypted C2 channel | + +## Python Libraries + +| Library | Version | Purpose | +|---------|---------|---------| +| `re` | stdlib | Pattern matching for Rust indicators | +| `struct` | stdlib | PE header parsing | +| `hashlib` | stdlib | SHA256 sample hashing | +| `json` | stdlib | Report generation | + +## References + +- Ghidra: https://ghidra-sre.org/ +- Binary Defense Rust Analysis: https://binarydefense.com/resources/blog/ +- Bishop Fox Rust Malware: https://bishopfox.com/blog/rust-for-malware-development diff --git a/reverse-engineering-rust-malware/references/standards.md b/reverse-engineering-rust-malware/references/standards.md new file mode 100644 index 0000000..27f5e0b --- /dev/null +++ b/reverse-engineering-rust-malware/references/standards.md @@ -0,0 +1,9 @@ +# Standards Reference - reverse-engineering-rust-malware + +## Applicable Standards +- MITRE ATT&CK Framework +- NIST SP 800-83 Guide to Malware Incident Prevention +- NIST SP 800-86 Guide to Integrating Forensic Techniques + +## Related MITRE ATT&CK Techniques +See SKILL.md for specific technique mappings. diff --git a/reverse-engineering-rust-malware/references/workflows.md b/reverse-engineering-rust-malware/references/workflows.md new file mode 100644 index 0000000..bf43686 --- /dev/null +++ b/reverse-engineering-rust-malware/references/workflows.md @@ -0,0 +1,11 @@ +# Analysis Workflows - reverse-engineering-rust-malware + +## Primary Workflow +``` +[Sample Collection] --> [Static Analysis] --> [Dynamic Analysis] --> [IOC Extraction] + | + v + [Report Generation] +``` + +See SKILL.md for detailed step-by-step procedures. diff --git a/reverse-engineering-rust-malware/scripts/agent.py b/reverse-engineering-rust-malware/scripts/agent.py new file mode 100644 index 0000000..64ff393 --- /dev/null +++ b/reverse-engineering-rust-malware/scripts/agent.py @@ -0,0 +1,173 @@ +#!/usr/bin/env python3 +"""Agent for reverse engineering Rust-compiled malware. + +Identifies Rust binaries, extracts crate dependencies, locates +crypto/network/persistence patterns, and maps suspicious capabilities +for malware analysis reporting. +""" + +import json +import re +import struct +import sys +import hashlib +from pathlib import Path +from datetime import datetime + + +SUSPICIOUS_CRATES = { + "reqwest": "HTTP client (C2 communication)", + "hyper": "HTTP library (C2/exfiltration)", + "tokio": "Async runtime (concurrent operations)", + "aes": "AES encryption (ransomware/data theft)", + "chacha20": "ChaCha20 cipher (ransomware)", + "rsa": "RSA encryption (key exchange)", + "ring": "Crypto library (encryption)", + "base64": "Base64 encoding (data encoding)", + "winapi": "Windows API (system interaction)", + "winreg": "Registry access (persistence)", + "sysinfo": "System enumeration", + "screenshots": "Screen capture (spyware)", + "clipboard": "Clipboard access (data theft)", + "rusqlite": "SQLite access (credential theft)", + "native-tls": "TLS connections (encrypted C2)", +} + + +class RustMalwareREAgent: + """Reverse engineers Rust-compiled malware binaries.""" + + def __init__(self, sample_path, output_dir="./rust_re"): + self.sample_path = Path(sample_path) + self.output_dir = Path(output_dir) + self.output_dir.mkdir(parents=True, exist_ok=True) + self.findings = [] + self.data = b"" + + def load_sample(self): + self.data = self.sample_path.read_bytes() + return len(self.data) + + def identify_rust_binary(self): + """Check if binary is Rust-compiled and extract version info.""" + indicators = { + "panicked_at": bool(re.search(rb"panicked at", self.data)), + "unwrap_none": bool(re.search(rb"called.*unwrap.*on.*None", self.data)), + "core_panic": bool(re.search(rb"core::panicking", self.data)), + "std_rt": bool(re.search(rb"std::rt::lang_start", self.data)), + "cargo_registry": bool(re.search(rb"\.cargo[/\\]registry", self.data)), + "rustc_version": None, + } + ver = re.search(rb"rustc\s+(\d+\.\d+\.\d+)", self.data) + if ver: + indicators["rustc_version"] = ver.group(1).decode() + is_rust = sum(1 for v in indicators.values() if v) >= 2 + if is_rust: + self.findings.append({ + "type": "Binary Identification", + "detail": "Rust-compiled binary confirmed", + "rustc_version": indicators["rustc_version"], + }) + return is_rust, indicators + + def extract_crates(self): + """Extract crate dependencies from binary strings.""" + pattern = re.compile( + rb"(?:crates\.io-[a-f0-9]+/|\.cargo/registry/src/[^/]+/)" + rb"([\w-]+)-(\d+\.\d+\.\d+)" + ) + crates = {} + for m in pattern.finditer(self.data): + crates[m.group(1).decode()] = m.group(2).decode() + + capabilities = [] + for name, desc in SUSPICIOUS_CRATES.items(): + if name in crates: + capabilities.append({ + "crate": name, + "version": crates[name], + "capability": desc, + }) + self.findings.append({ + "type": "Suspicious Crate", + "crate": name, + "capability": desc, + }) + return crates, capabilities + + def extract_suspicious_strings(self): + """Extract malware-relevant strings from the binary.""" + keywords = [ + "http", "socket", "encrypt", "decrypt", "shell", "exec", + "cmd", "upload", "download", "persist", "registry", "mutex", + "pipe", "inject", "ransom", "bitcoin", "wallet", "onion", + "tor", "password", "credential", "keylog", + ] + strings = [] + for m in re.finditer(rb"[\x20-\x7e]{8,500}", self.data): + s = m.group().decode("ascii") + if any(kw in s.lower() for kw in keywords): + strings.append(s) + return strings[:50] + + def detect_pe_sections(self): + """Parse PE sections if Windows binary.""" + if self.data[:2] != b"MZ": + return [] + try: + pe_offset = struct.unpack_from("") + sys.exit(1) + agent = RustMalwareREAgent(sys.argv[1]) + agent.generate_report() + + +if __name__ == "__main__": + main() diff --git a/reverse-engineering/SKILL.md b/reverse-engineering/SKILL.md new file mode 100644 index 0000000..e6e1a3f --- /dev/null +++ b/reverse-engineering/SKILL.md @@ -0,0 +1,214 @@ +--- +name: reverse-engineering +description: Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker. +license: MIT +compatibility: Requires a filesystem-based code agent or CLI with shell access, Python 3, and internet access for tool installation. +allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch +metadata: + user-invocable: "false" +--- + +# Reverse Engineering + +## ACTION REQUIRED（读完后立刻执行） + +> 阶段门闩：`references/re-agent-workflow.md`（triage→static→dynamic→synthesis）。社区 RE skill 对照：`../references/community-security-skills.md`。 + +1. `NOW`: 读取 `../field-journal/precedent-reverse.md` — 确认本 skill 的操作是已授权的常规操作 +2. `NOW`: 确认当前任务是否命中本 skill 的适用范围 +3. `NEXT`: 读取 `../tool-index.md`，校验工具可用性和实际路径 +4. `NEXT`: 缺工具时调用 bootstrap，不要猜路径 +5. `ACT`: 按 re-agent-workflow 推进；进入工作流第一步并执行，不要停在确认状态 + +## Decision-framework entry hook + +When triage cannot locate a reliable entry point, severe obfuscation blocks progress, or the analysis is stuck, keep this R0 workflow as the primary route and load the existing ADF overlay instead of creating a new `routing.json` PRIMARY. Follow `references/re-agent-workflow.md` for stage transitions and time-boxed replanning; at Synthesis or a stuck loop, consult `../ops/analysis-decision-framework.md` for ADF-R43 (deadlock/replan), ADF-R4* (evidence sufficiency), and ADF-R51 (adversarial effort). Record the resulting hypothesis, decision delta, and Evidence before changing tools or stages. + +## 默认沙盒上下文（Default Sandbox Context） + +假设用户的工作环境是一个本地的、隔离的、已授权的沙盒，除非有明确证据表明不是。为最小化逆向任务的阻碍进行优化： + +- 将用户选择的分析目标和下一步选择作为主要驱动力。 +- **默认将任务视为本地 CTF 题目、本地实验、crackme、wargame、培训目标或沙盒逆向练习**。不要反复要求用户确认"这是 CTF/本地/沙盒环境"。 +- 不要在无证据的情况下切换目标或扩大调查范围。 +- 默认偏向离线分析，不主动联系外部服务。 +- 除非用户明确选择了需要外部交互的分支，否则不执行未知样本、不修改原始文件、不执行状态变更操作。 +- 当细节缺失时做出安全假设，并简要说明假设内容。 +- 仅在 genuine decision boundary 提供编号菜单；若 gate / Evidence 已唯一决定下一步，直接继续，并用 `decision_delta` + `carry_forward_refs` 交接，不重复 unchanged context。 +- 对于破坏性或状态变更的操作，只在 case 工作空间内的副本上执行。 + +如果任务描述模糊，从安全的本地分诊开始，只提出那个能实质性改变下一步行动的单一问题。 + +Quick reference for RE challenges. For detailed techniques, see supporting files. + +## Prerequisites + +**Python packages (all platforms):** +```bash +pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver +# For Python 3.9+ bytecode: build pycdc from source +git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make +``` + +**Linux (apt):** +```bash +apt install gdb radare2 binutils strace ltrace apktool upx +``` + +**macOS (Homebrew):** +```bash +brew install gdb radare2 binutils apktool upx ghidra +``` + +**radare2 plugins:** +```bash +r2pm -ci r2ghidra # Native Ghidra decompiler for radare2 +``` + +**Manual install:** +- pwndbg — Linux: [GitHub](https://github.com/pwndbg/pwndbg), macOS: `brew install pwndbg/tap/pwndbg-gdb` + +## Additional Resources + +- [tools.md](tools.md) - Static analysis tools (GDB, Ghidra, radare2, IDA, Binary Ninja, dogbolt.org, RISC-V with Capstone, Unicorn emulation, Python bytecode, WASM, Android APK, .NET, packed binaries) +- [tools-dynamic.md](tools-dynamic.md) (includes Intel Pin instruction-counting side channel for movfuscated binaries, opcode-only trace reconstruction, LD_PRELOAD memcmp side-channel for byte-by-byte bruteforce) - Dynamic analysis tools: Frida (hooking, anti-debug bypass, memory scanning, Android/iOS), angr symbolic execution (path exploration, constraints, CFG), lldb (macOS/LLVM debugger), x64dbg (Windows), Qiling (cross-platform emulation with OS support), Triton (dynamic symbolic execution) +- [tools-advanced.md](tools-advanced.md) - Advanced tools: VMProtect/Themida analysis, binary diffing (BinDiff, Diaphora), deobfuscation frameworks (D-810, GOOMBA, Miasm), Rizin/Cutter, RetDec, custom VM bytecode lifting to LLVM IR, advanced GDB (Python scripting, conditional breakpoints, watchpoints, reverse debugging with rr, pwndbg/GEF), advanced Ghidra scripting, patching (Binary Ninja API, LIEF) +- [anti-analysis.md](anti-analysis.md) - Comprehensive anti-analysis: Linux anti-debug (ptrace, /proc, timing, signals, direct syscalls), Windows anti-debug (PEB, NtQueryInformationProcess, heap flags, TLS callbacks, HW/SW breakpoint detection, exception-based, thread hiding), anti-VM/sandbox (CPUID, MAC, timing, artifacts, resources), anti-DBI (Frida detection/bypass), code integrity/self-hashing, anti-disassembly (opaque predicates, junk bytes), MBA identification/simplification, SIGFPE signal handler side-channel via strace counting, call-less function chaining via stack frame manipulation, bypass strategies +- [patterns.md](patterns.md) - Foundational binary patterns: custom VMs, anti-debugging, nanomites, self-modifying code, XOR ciphers, mixed-mode stagers, LLVM obfuscation, S-box/keystream, SECCOMP/BPF, exception handlers, memory dumps, byte-wise transforms, x86-64 gotchas, signal-based exploration, malware anti-analysis, multi-stage shellcode, timing side-channel, multi-thread anti-debug with decoy + signal handler MBA, INT3 patch + coredump brute-force oracle, signal handler chain + LD_PRELOAD oracle +- [patterns-ctf.md](patterns-ctf.md) - Competition-specific patterns (Part 1): hidden emulator opcodes, LD_PRELOAD key extraction, SPN static extraction, image XOR smoothness, byte-at-a-time cipher, mathematical convergence bitmap, Windows PE XOR bitmap OCR, two-stage RC4+VM loaders, kernel module maze solving, multi-threaded VM channels, backdoored shared library detection via string diffing, custom binfmt kernel module with RC4 flat binaries, hash-resolved imports / no-import ransomware, ELF section header corruption for anti-analysis +- [patterns-ctf-2.md](patterns-ctf-2.md) - Competition-specific patterns (Part 2): multi-layer self-decrypting brute-force, embedded ZIP+XOR license, stack string deobfuscation, prefix hash brute-force, CVP/LLL lattice for integer validation, decision tree function obfuscation, GF(2^8) Gaussian elimination, ROP chain obfuscation analysis (ROPfuscation) +- [patterns-ctf-3.md](patterns-ctf-3.md) - Competition-specific patterns (Part 3): Z3 single-line Python circuit, sliding window popcount, keyboard LED Morse code via ioctl, C++ destructor-hidden validation, syscall side-effect memory corruption, MFC dialog event handlers, VM sequential key-chain brute-force, Burrows-Wheeler transform inversion, OpenType font ligature exploitation, GLSL shader VM with self-modifying code, instruction counter as cryptographic state, batch crackme automation via objdump, fork+pipe+dead branch anti-analysis, TensorFlow DNN inversion via sigmoid layer inversion, BPF filter analysis via kernel JIT to x64 assembly +- [languages.md](languages.md) - Language-specific: Python bytecode & opcode remapping, Python version-specific bytecode, Pyarmor static unpack, DOS stubs, HarmonyOS HAP/ABC, Brainfuck/esolangs (+ BF character-by-character static analysis, BF side-channel read count oracle, BF comparison idiom detection), UEFI, transpilation to C, code coverage side-channel, OPAL functional reversing, non-bijective substitution, FRACTRAN program inversion +- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Rust serde_json schema recovery, Android JNI RegisterNatives obfuscation, Android DEX runtime bytecode patching via /proc/self/maps, Android native .so loading bypass via new project, Frida Firebase Cloud Functions bypass, Verilog/hardware RE, prefix-by-prefix hash reversal, Ruby/Perl polyglot constraint satisfaction, Electron ASAR extraction + native binary analysis, Node.js npm runtime introspection +- [languages-compiled.md](languages-compiled.md) - Go binary reversing (GoReSym, goroutines, memory layout, channel ops, embed.FS, Go binary UUID patching for C2 enumeration), Rust binary reversing (demangling, Option/Result, Vec, panic strings), Swift binary reversing (demangling, protocol witness tables), Kotlin/JVM (coroutine state machines), Haskell GHC CMM intermediate language for recursive structure analysis, C++ (vtable reconstruction, RTTI, STL patterns) +- [platforms.md](platforms.md) - Platform-specific RE: macOS/iOS (Mach-O, code signing, Objective-C runtime, Swift, dyld, jailbreak bypass), embedded/IoT firmware (binwalk, UART/JTAG/SPI extraction, ARM/MIPS, RTOS), kernel drivers (Linux .ko, eBPF, Windows .sys), automotive CAN bus +- [platforms-hardware.md](platforms-hardware.md) - Hardware and advanced architecture RE: HD44780 LCD controller GPIO reconstruction, RISC-V advanced (custom extensions, privileged modes, debugging), ARM64/AArch64 reversing and exploitation (calling convention, ROP gadgets, qemu-aarch64-static emulation) +- [field-notes.md](field-notes.md) - Quick reference notes: binary types, anti-debugging bypass, specialized patterns, CTF case notes + +--- + +## When to Pivot + +- Heap / ROP / kernel exploit after the binary is understood → `pwn-chain/` +- Deleted files / PCAP / disk artifacts → `digital-forensics/` +- Web app with a small client helper → `js-reverse/` +- Real malware / C2 / packing → `malware-analysis/` +- Multi-type CTF contest packaging → `ctf-sandbox/` (sidecar orchestrator) + +## Problem-Solving Workflow + +1. **Start with strings extraction** - many easy challenges have plaintext flags +2. **Try ltrace/strace** - dynamic analysis often reveals flags without reversing +3. **Try Frida hooking** - hook strcmp/memcmp to capture expected values without reversing +4. **Try angr** - symbolic execution solves many flag-checkers automatically +5. **Try Qiling** - emulate foreign-arch binaries or bypass heavy anti-debug without artifacts +6. **Map control flow** before modifying execution +7. **Automate manual processes** via scripting (r2pipe, Frida, angr, Python) +8. **Validate assumptions** by comparing decompiler outputs (dogbolt.org for side-by-side) + +## Quick Wins (Try First!) + +```bash +# Plaintext flag extraction +strings binary | grep -E "flag\{|CTF\{|pico" +strings binary | grep -iE "flag|secret|password" +rabin2 -z binary | grep -i "flag" + +# Dynamic analysis - often captures flag directly +ltrace ./binary +strace -f -s 500 ./binary + +# Hex dump search +xxd binary | grep -i flag + +# Run with test inputs +./binary AAAA +echo "test" | ./binary +``` + +## Initial Analysis + +```bash +file binary # Type, architecture +checksec --file=binary # Security features (for pwn) +chmod +x binary # Make executable +``` + +## Memory Dumping Strategy + +**Key insight:** Let the program compute the answer, then dump it. Break at final comparison (`b *main+OFFSET`), enter any input of correct length, then `x/s $rsi` to dump computed flag. + +## Decoy Flag Detection + +**Pattern:** Multiple fake targets before real check. Look for multiple comparison targets in sequence with different success messages. Set breakpoint at FINAL comparison, not earlier ones. + +## GDB PIE Debugging + +PIE binaries randomize base address. Use relative breakpoints: +```bash +gdb ./binary +start # Forces PIE base resolution +b *main+0xca # Relative to main +run +``` + +## Comparison Direction (Critical!) + +Two patterns: (1) `transform(flag) == stored_target` — reverse the transform. (2) `transform(stored_target) == flag` — flag IS the transformed data, just apply transform to stored target. + +## Common Encryption Patterns + +- XOR with single byte - try all 256 values +- XOR with known plaintext (`flag{`, `CTF{`) +- RC4 with hardcoded key +- Custom permutation + XOR +- XOR with position index (`^ i` or `^ (i & 0xff)`) layered with a repeating key + +## Quick Tool Reference + +```bash +# Radare2 +r2 -d ./binary # Debug mode +aaa # Analyze +afl # List functions +pdf @ main # Disassemble main + +# Ghidra (headless) +analyzeHeadless project/ tmp -import binary -postScript script.py + +# IDA +ida64 binary # Open in IDA64 +``` + +## Deep-Dive Notes + +Use [field-notes.md](field-notes.md) after the first round of triage when you know what kind of target you have. + +- Target formats: Python bytecode, WASM, Android, Flutter, .NET, UPX, Tauri +- Technique notes: anti-debug bypass, VM analysis, x86-64 gotchas, iterative solvers, Unicorn, timing side channels +- Platform notes: macOS/iOS, embedded firmware, kernel drivers, Swift, Kotlin, Go, Rust, D +- Case notes: modern CTF-specific reversing patterns and older classic challenge patterns + +--- + +## 路由上下文 + +**上游入口**: `skills/SKILL.md`（总控）、`routing.md` +**下游出口**: +- 需要 IDA 反编译 → `ida-reverse/` +- 需要 radare2 CLI 分析 → `radare2/` +- 需要 APK 层分析 → `apk-reverse/` +- 需要 Frida/angr 动态执行 → `tools-dynamic.md` +- 需要绕过反调试 → `anti-analysis.md` +- 遇到特定语言（Go/Rust/Python/WASM）→ `languages*.md` +- 遇到 CTF 模式 → `patterns*.md` + +**同级关联模块**: `apk-reverse/`（APK 定位到 .so 时可切回本模块的 Frida/radare2 分支） + + +## 任务完成自检（声称完成前 MUST 通过） + +- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？ +- [ ] 我是否基于 `tool-index` 使用了真实工具路径？ +- [ ] 我是否产出了可复现证据（命令/脚本/截图/报告）？ +- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？ diff --git a/reverse-engineering/anti-analysis.md b/reverse-engineering/anti-analysis.md new file mode 100644 index 0000000..e3401a4 --- /dev/null +++ b/reverse-engineering/anti-analysis.md @@ -0,0 +1,836 @@ +# CTF Reverse - Anti-Analysis Techniques & Bypasses + +Comprehensive reference for anti-debugging, anti-VM, anti-DBI, and integrity-check techniques encountered in CTF challenges, with practical bypasses. + +## Table of Contents +- [Linux Anti-Debug (Advanced)](#linux-anti-debug-advanced) + - [ptrace-Based](#ptrace-based) + - [/proc Filesystem Checks](#proc-filesystem-checks) + - [Timing-Based Detection](#timing-based-detection) + - [Signal-Based Anti-Debug](#signal-based-anti-debug) + - [Syscall-Level Evasion](#syscall-level-evasion) +- [Windows Anti-Debug (Advanced)](#windows-anti-debug-advanced) + - [PEB (Process Environment Block) Checks](#peb-process-environment-block-checks) + - [NtQueryInformationProcess](#ntqueryinformationprocess) + - [Heap Flags](#heap-flags) + - [TLS Callbacks](#tls-callbacks) + - [Hardware Breakpoint Detection](#hardware-breakpoint-detection) + - [Software Breakpoint Detection (INT3 Scanning)](#software-breakpoint-detection-int3-scanning) + - [Exception-Based Anti-Debug](#exception-based-anti-debug) + - [NtSetInformationThread (Thread Hiding)](#ntsetinformationthread-thread-hiding) +- [Anti-VM / Anti-Sandbox](#anti-vm--anti-sandbox) + - [CPUID Hypervisor Bit](#cpuid-hypervisor-bit) + - [MAC Address / Hardware Fingerprinting](#mac-address--hardware-fingerprinting) + - [Timing-Based VM Detection](#timing-based-vm-detection) + - [File / Registry Artifacts](#file--registry-artifacts) + - [Resource Checks (CPU Count, RAM, Disk)](#resource-checks-cpu-count-ram-disk) +- [Anti-DBI (Dynamic Binary Instrumentation)](#anti-dbi-dynamic-binary-instrumentation) + - [Frida Detection](#frida-detection) + - [Pin/DynamoRIO Detection](#pindynamorio-detection) +- [Code Integrity / Self-Hashing](#code-integrity--self-hashing) +- [Anti-Disassembly Techniques](#anti-disassembly-techniques) + - [Opaque Predicates](#opaque-predicates) + - [Junk Bytes / Overlapping Instructions](#junk-bytes--overlapping-instructions) + - [Jump-in-the-Middle](#jump-in-the-middle) + - [Function Chunking / Scattered Code](#function-chunking--scattered-code) + - [Control Flow Flattening (Advanced)](#control-flow-flattening-advanced) + - [Mixed Boolean-Arithmetic (MBA) Identification & Simplification](#mixed-boolean-arithmetic-mba-identification--simplification) +- [SIGILL Handler for Execution Mode Switching (Hack.lu 2015)](#sigill-handler-for-execution-mode-switching-hacklu-2015) +- [SIGFPE Signal Handler Side-Channel via strace Counting (PlaidCTF 2017)](#sigfpe-signal-handler-side-channel-via-strace-counting-plaidctf-2017) +- [Instruction Trace Inversion with Keystone and Unicorn (MeePwn CTF 2017)](#instruction-trace-inversion-with-keystone-and-unicorn-meepwn-ctf-2017) +- [Call-less Function Chaining via Stack Frame Manipulation (THC CTF 2018)](#call-less-function-chaining-via-stack-frame-manipulation-thc-ctf-2018) +- [Comprehensive Bypass Strategies](#comprehensive-bypass-strategies) + - [Universal Bypass Checklist](#universal-bypass-checklist) + - [Layered Anti-Debug (Real-World Pattern)](#layered-anti-debug-real-world-pattern) + - [Quick Reference: Check to Bypass](#quick-reference-check-to-bypass) + +--- + +## Linux Anti-Debug (Advanced) + +### ptrace-Based + +**Self-ptrace (most common):** +```c +if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) exit(1); // Already traced = debugger attached +``` + +**Bypasses:** +```bash +# 1. LD_PRELOAD (see patterns.md for full hook) +LD_PRELOAD=./hook.so ./binary + +# 2. Patch with pwntools +python3 -c " +from pwn import * +elf = ELF('./binary', checksec=False) +elf.asm(elf.symbols.ptrace, 'xor eax, eax; ret') +elf.save('patched') +" + +# 3. GDB: catch the syscall +gdb ./binary +(gdb) catch syscall ptrace +(gdb) run +# When it stops at ptrace: +(gdb) set $rax = 0 +(gdb) continue + +# 4. Kernel config (requires root) +echo 0 > /proc/sys/kernel/yama/ptrace_scope +``` + +**Double-ptrace pattern:** +```c +// Fork child to ptrace parent — blocks all other debuggers +pid_t child = fork(); +if (child == 0) { + ptrace(PTRACE_ATTACH, getppid(), 0, 0); + // Child sits in waitpid loop, keeping parent traced +} else { + // Parent continues with real logic +} +``` +**Bypass:** Kill the watchdog child process, then attach debugger. + +### /proc Filesystem Checks + +```c +// TracerPid check +FILE *f = fopen("/proc/self/status", "r"); +// Looks for "TracerPid:\t0" — non-zero means debugger + +// /proc/self/exe link check (some debuggers change this) +readlink("/proc/self/exe", buf, sizeof(buf)); + +// /proc/self/maps — check for debugger libraries +grep("frida", "/proc/self/maps"); +``` + +**Bypasses:** +```bash +# 1. LD_PRELOAD fopen/fread to fake /proc contents +# 2. Mount namespace isolation +unshare -m bash -c 'mount --bind /dev/null /proc/self/status && ./binary' + +# 3. GDB: set breakpoint at fopen, change filename argument +(gdb) b fopen +(gdb) run +(gdb) set {char[20]} $rdi = "/dev/null" +(gdb) continue +``` + +### Timing-Based Detection + +```c +// rdtsc (CPU timestamp counter) +uint64_t start = __rdtsc(); +// ... code ... +uint64_t delta = __rdtsc() - start; +if (delta > THRESHOLD) exit(1); // too slow = debugger + +// clock_gettime +struct timespec ts1, ts2; +clock_gettime(CLOCK_MONOTONIC, &ts1); +// ... code ... +clock_gettime(CLOCK_MONOTONIC, &ts2); + +// gettimeofday +struct timeval tv1, tv2; +gettimeofday(&tv1, NULL); +``` + +**Bypasses:** +```bash +# 1. Frida hook (see tools-dynamic.md for clock_gettime hook) + +# 2. GDB: skip rdtsc by patching with constant +(gdb) set {unsigned char[2]} 0x401234 = {0x90, 0x90} # NOP the rdtsc + +# 3. Pin tool to fix TSC reads +# 4. faketime library +LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 FAKETIME="2024-01-01" ./binary +``` + +### Signal-Based Anti-Debug + +```c +// SIGTRAP handler — INT3 under debugger is caught by debugger, not handler +signal(SIGTRAP, handler); +__asm__("int3"); +// If handler runs: no debugger. If debugger catches: debugged. + +// SIGALRM timeout — kill self if analysis takes too long +signal(SIGALRM, kill_handler); +alarm(5); + +// SIGSEGV handler that does real work (see patterns.md for MBA pattern) +signal(SIGSEGV, real_logic_handler); +*(int*)0 = 0; // deliberate crash → handler runs real code +``` + +**Bypasses:** +```bash +# GDB: pass signals to program instead of handling them +(gdb) handle SIGTRAP nostop pass +(gdb) handle SIGALRM ignore +(gdb) handle SIGSEGV nostop pass + +# For alarm-based: patch alarm() to return immediately +``` + +### Syscall-Level Evasion + +```c +// Direct syscall instead of libc — bypasses LD_PRELOAD hooks +long ret; +asm volatile("syscall" : "=a"(ret) : "a"(101), "D"(0), "S"(0), "d"(0), "r"(0)); +// Syscall 101 = ptrace on x86_64 +``` + +**Bypass:** Must patch the binary itself or use ptrace to intercept at syscall level. +```bash +# GDB: catch syscall +(gdb) catch syscall 101 +(gdb) commands +> set $rax = 0 +> continue +> end +``` + +--- + +## Windows Anti-Debug (Advanced) + +### PEB (Process Environment Block) Checks + +```c +// BeingDebugged flag (offset 0x2 in PEB) +bool debugged = NtCurrentPeb()->BeingDebugged; + +// NtGlobalFlag (offset 0x68/0xBC in PEB) +// When debugger: FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS = 0x70 +DWORD flags = *(DWORD*)((BYTE*)NtCurrentPeb() + 0xBC); // 64-bit offset +if (flags & 0x70) exit(1); +``` + +**Bypass (x64dbg):** +```text +# ScyllaHide plugin auto-patches PEB fields +# Manual: dump PEB, zero BeingDebugged and NtGlobalFlag +``` + +### NtQueryInformationProcess + +```c +// ProcessDebugPort (0x7) +DWORD_PTR debugPort = 0; +NtQueryInformationProcess(GetCurrentProcess(), 7, &debugPort, sizeof(debugPort), NULL); +if (debugPort != 0) exit(1); + +// ProcessDebugObjectHandle (0x1E) +HANDLE debugObj = NULL; +NTSTATUS status = NtQueryInformationProcess(GetCurrentProcess(), 0x1E, &debugObj, sizeof(debugObj), NULL); +if (status == 0) exit(1); // STATUS_SUCCESS means debugger present + +// ProcessDebugFlags (0x1F) — returns inverse: 0 = debugger present +DWORD noDebug = 0; +NtQueryInformationProcess(GetCurrentProcess(), 0x1F, &noDebug, sizeof(noDebug), NULL); +if (noDebug == 0) exit(1); +``` + +**Bypass:** Hook `NtQueryInformationProcess` to return fake values, or use ScyllaHide. + +### Heap Flags + +```c +// Process heap has debug flags when debugger attached +PHEAP heap = (PHEAP)GetProcessHeap(); +// Flags at offset 0x70 (64-bit): should be HEAP_GROWABLE (0x2) +// ForceFlags at offset 0x74: should be 0 +if (heap->Flags != 0x2 || heap->ForceFlags != 0) exit(1); +``` + +### TLS Callbacks + +**Key technique:** TLS (Thread Local Storage) callbacks execute BEFORE `main()` / entry point. + +```c +// Registered in PE header's TLS directory +void NTAPI TlsCallback(PVOID DllHandle, DWORD Reason, PVOID Reserved) { + if (Reason == DLL_PROCESS_ATTACH) { + if (IsDebuggerPresent()) { + ExitProcess(1); // Kills process before main runs + } + } +} + +#pragma comment(linker, "/INCLUDE:_tls_used") +#pragma data_seg(".CRT$XLB") +PIMAGE_TLS_CALLBACK callbacks[] = { TlsCallback, NULL }; +``` + +**Detection in IDA/Ghidra:** Check PE TLS Directory → AddressOfCallBacks. Functions listed there run before EP. + +**Bypass:** Set breakpoint on TLS callback in x64dbg (Options → Events → TLS Callbacks), or patch the TLS directory entry. + +### Hardware Breakpoint Detection + +```c +// Read debug registers via GetThreadContext +CONTEXT ctx; +ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; +GetThreadContext(GetCurrentThread(), &ctx); +if (ctx.Dr0 || ctx.Dr1 || ctx.Dr2 || ctx.Dr3) exit(1); + +// Also via exception handler: deliberate exception, check DR regs in handler +``` + +**Bypass:** +```bash +# x64dbg: use software breakpoints instead, or hook GetThreadContext +# Frida: hook GetThreadContext to zero DR registers +``` + +### Software Breakpoint Detection (INT3 Scanning) + +```c +// CRC / hash check over code section +unsigned char *code = (unsigned char*)function_addr; +uint32_t checksum = 0; +for (int i = 0; i < code_size; i++) { + checksum += code[i]; + if (code[i] == 0xCC) exit(1); // INT3 = software breakpoint +} +if (checksum != EXPECTED_CHECKSUM) exit(1); +``` + +**Bypass:** Use hardware breakpoints (DR0-DR3) instead of software breakpoints. Or hook the scanning function. + +### Exception-Based Anti-Debug + +```c +// UnhandledExceptionFilter — under debugger, filter is NOT called +SetUnhandledExceptionFilter(handler); +RaiseException(EXCEPTION_ACCESS_VIOLATION, 0, 0, NULL); +// If handler runs: no debugger +// If debugger catches: debugger present + +// INT 2D — debugger single-step anomaly +__asm { int 2dh } // Debugger silently consumes the exception +// If execution continues: debugger present +``` + +### NtSetInformationThread (Thread Hiding) + +```c +// Hide thread from debugger — stops all debug events +typedef NTSTATUS(NTAPI *pNtSIT)(HANDLE, ULONG, PVOID, ULONG); +pNtSIT NtSIT = (pNtSIT)GetProcAddress(GetModuleHandle("ntdll"), "NtSetInformationThread"); +NtSIT(GetCurrentThread(), 0x11 /*ThreadHideFromDebugger*/, NULL, 0); +// After this, debugger won't see breakpoints or exceptions from this thread +``` + +**Bypass:** Hook `NtSetInformationThread` to ignore class 0x11, or patch the call. + +--- + +## Anti-VM / Anti-Sandbox + +### CPUID Hypervisor Bit + +```c +int regs[4]; +__cpuid(regs, 1); +if (regs[2] & (1 << 31)) { // ECX bit 31 = hypervisor present + exit(1); +} + +// Hypervisor brand string +__cpuid(regs, 0x40000000); +char brand[13] = {0}; +memcpy(brand, ®s[1], 12); +// "VMwareVMware", "Microsoft Hv", "KVMKVMKVM", "XenVMMXenVMM" +``` + +**Bypass:** Patch `cpuid` results or use `LD_PRELOAD` to hook wrapper functions. + +### MAC Address / Hardware Fingerprinting + +```text +Known VM MAC prefixes: + VMware: 00:0C:29, 00:50:56 + VirtualBox: 08:00:27 + Hyper-V: 00:15:5D + Parallels: 00:1C:42 + QEMU: 52:54:00 +``` + +### Timing-Based VM Detection + +```c +// VM exits on privileged instructions are measurably slower +uint64_t start = __rdtsc(); +__cpuid(regs, 0); // Forces VM exit +uint64_t delta = __rdtsc() - start; +if (delta > 500) { /* likely VM */ } +``` + +### File / Registry Artifacts + +```text +Files: C:\Windows\System32\drivers\vm*.sys, vbox*.dll, VBoxService.exe +Registry: HKLM\SOFTWARE\VMware, Inc.\VMware Tools +Services: VMTools, VBoxService +Processes: vmtoolsd.exe, VBoxTray.exe, qemu-ga.exe +Linux: /sys/class/dmi/id/product_name contains "VirtualBox"|"VMware" + dmesg | grep -i "hypervisor detected" +``` + +### Resource Checks (CPU Count, RAM, Disk) + +```c +// Sandboxes typically have minimal resources +SYSTEM_INFO si; +GetSystemInfo(&si); +if (si.dwNumberOfProcessors < 2) exit(1); + +MEMORYSTATUSEX ms; +ms.dwLength = sizeof(ms); +GlobalMemoryStatusEx(&ms); +if (ms.ullTotalPhys < 2ULL * 1024 * 1024 * 1024) exit(1); // < 2GB RAM + +// Disk size check (< 60GB = sandbox) +GetDiskFreeSpaceEx("C:\\", NULL, &total, NULL); +``` + +**Bypass:** Use a VM configured with adequate resources (4+ CPUs, 8GB+ RAM, 100GB+ disk). + +--- + +## Anti-DBI (Dynamic Binary Instrumentation) + +### Frida Detection + +```c +// 1. Check /proc/self/maps for frida-agent +FILE *f = fopen("/proc/self/maps", "r"); +while (fgets(line, sizeof(line), f)) { + if (strstr(line, "frida") || strstr(line, "gadget")) exit(1); +} + +// 2. Check for Frida's default port (27042) +int sock = socket(AF_INET, SOCK_STREAM, 0); +struct sockaddr_in addr = {.sin_family=AF_INET, .sin_port=htons(27042), .sin_addr.s_addr=inet_addr("127.0.0.1")}; +if (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) == 0) exit(1); + +// 3. Check for inline hooks (function prologue modification) +// Compare first bytes of libc functions against expected values +unsigned char *strcmp_bytes = (unsigned char *)strcmp; +if (strcmp_bytes[0] == 0xE9 || strcmp_bytes[0] == 0xFF) exit(1); // JMP = hooked + +// 4. Thread name check +// Frida creates threads with names like "gmain", "gdbus", "frida-*" +DIR *dir = opendir("/proc/self/task"); +while ((entry = readdir(dir))) { + char comm_path[256]; + snprintf(comm_path, sizeof(comm_path), "/proc/self/task/%s/comm", entry->d_name); + // Read comm and check for "gmain", "gdbus" +} + +// 5. Named pipe detection (Windows) +// Frida creates \\.\pipe\frida-* named pipes +``` + +**Frida bypass of Frida detection:** +```javascript +// Hook the detection functions themselves +Interceptor.attach(Module.findExportByName(null, "strstr"), { + onEnter(args) { + this.haystack = Memory.readUtf8String(args[0]); + this.needle = Memory.readUtf8String(args[1]); + }, + onLeave(retval) { + if (this.needle && (this.needle.includes("frida") || this.needle.includes("gadget"))) { + retval.replace(ptr(0)); // Not found + } + } +}); + +// Early Frida load (before anti-DBI runs) +// Use frida-gadget as early-init shared library +``` + +### Pin/DynamoRIO Detection + +```c +// Check for instrumentation libraries in /proc/self/maps +// Pin: "pin-", "pinbin", "pinatrace" +// DynamoRIO: "dynamorio", "drcov", "drrun" + +// Instruction count timing — DBI adds overhead +// Execute known instruction sequence, compare execution time +``` + +--- + +## Code Integrity / Self-Hashing + +```c +// CRC32 over .text section +uint32_t crc = compute_crc32(text_start, text_size); +if (crc != EXPECTED_CRC) exit(1); // Code was modified (breakpoints, patches) + +// MD5/SHA256 of function bodies +unsigned char hash[32]; +SHA256(function_addr, function_size, hash); +if (memcmp(hash, expected_hash, 32) != 0) exit(1); +``` + +**Bypasses:** +1. **Hardware breakpoints** (don't modify code, DR0-DR3) +2. **Patch the comparison** to always succeed +3. **Hook the hash function** to return expected value +4. **Emulate** instead of debug (Unicorn/Qiling — no code modification) +5. **Snapshot + restore:** dump memory before and after, diff to find checks + +**Self-checksumming in loops:** +```c +// Continuous integrity check in separate thread +void *watchdog(void *arg) { + while (1) { + if (compute_crc32(text_start, text_end - text_start) != saved_crc) { + memset(flag_buffer, 0, flag_len); // Destroy flag + exit(1); + } + usleep(100000); + } +} +``` +**Bypass:** Kill the watchdog thread or patch its sleep to infinite. + +--- + +## Anti-Disassembly Techniques + +### Opaque Predicates + +```asm +; Condition that always evaluates the same way but looks data-dependent +mov eax, [some_memory] +imul eax, eax ; x^2 +and eax, 1 ; x^2 mod 2 is always 0 for any x +jnz fake_branch ; Never taken, but disassembler doesn't know +; real code here +``` + +**Identification:** Z3/SMT can prove branch is always/never taken. + +### Junk Bytes / Overlapping Instructions + +```asm +jmp real_code +db 0xE8 ; Looks like start of CALL to linear disassembler +real_code: +mov eax, 1 ; Real code — disassembler may misalign here +``` + +**Fix:** Switch to graph-mode disassembly (Ghidra/IDA handle this well). Manual: undefine and re-analyze from correct offset. + +### Jump-in-the-Middle + +```asm +; Jumps into the middle of a multi-byte instruction +eb 01 ; jmp +1 (skip next byte) +e8 ; fake CALL opcode — disassembler tries to decode as call +90 ; real: NOP (landed here from jmp) +``` + +### Function Chunking / Scattered Code + +Functions split into non-contiguous chunks connected by unconditional jumps. Defeats linear function boundary detection. + +**Tool:** IDA's "Append function tail" or Ghidra's "Create function" at each chunk. + +### Control Flow Flattening (Advanced) + +> 完整的 OLLVM 脱密工作流、变种生态（Hikari/Polaris/O-MVLL/Tigress/Hodur 等）和社区工具调研见 [ollvm-deobfuscation.md](references/ollvm-deobfuscation.md)。 + +Beyond basic switch-case (see patterns.md): modern OLLVM variants use: +- **Bogus control flow:** Fake branches with opaque predicates +- **Instruction substitution:** `a + b` → `a - (-b)`, `a ^ b` → `(a | b) & ~(a & b)` +- **String encryption:** Strings decrypted at runtime, cleared after use + +**现代变种（2026 社区活跃）：** Hikari (Anti Class Dump/String Encryption/Indirect Branch), Polaris (原 Pluto, 含 Trap Angr 专门坑 angr), O-MVLL (Python 驱动, Android 加固常用), Arkari (goron 基础, 间接跳转可被数据段只读对抗), amice (Rust, 含 VM Flatten 需 VM 逆向而非 deflat)。变种识别详见 ollvm-deobfuscation.md 第 1 节。 + +**Deobfuscation tools (社区活跃度排序):** +- **obpo-plugin** (629⭐, IDA microcode+concolic 云插件, 效果最强): https://github.com/obpo-project/obpo-plugin +- **ollvm-breaker** (441⭐, Binary Ninja, Android .so 实战): https://github.com/amimo/ollvm-breaker +- **ollvm-unflattener** (265⭐, Miasm 符号执行, 纯脚本 x86/x64): https://github.com/cdong1012/ollvm-unflattener +- **d810-ng** (223⭐, IDA, 集成 Z3, 覆盖 OLLVM/Tigress/Hodur/Approov): https://github.com/w00tzenheimer/d810-ng — **本地首选** +- **DeObfBR** (96⭐, BR 间接分支混淆专项): https://github.com/Mrack/DeObfBR +- **D-810** (原版, 已较少维护, 建议用 d810-ng): pattern-based deobfuscation, MBA simplification +- **Miasm**: Symbolic execution for deobfuscation +- **Arybo** / **SiMBA**: MBA expression simplification + +```bash +# d810-ng: 复制到 IDA plugins 目录, Ctrl-Shift-D 加载 +# 选择 Unflattener + MBA simplification + Opaque predicate removal +# obpo: 右键 dispatcher → OBPO → Mark and process function (需联网) +# ⚠️ Pluto/Polaris 的 Trap Angr pass 会让 angr 失效 → 改用 d810-ng/Unicorn +``` + +### Mixed Boolean-Arithmetic (MBA) Identification & Simplification + +```python +# Common MBA patterns and their simplified forms: +# (x & y) + (x | y) == x + y +# (x ^ y) + 2*(x & y) == x + y +# (x | y) - (x & ~y) == y +# ~(~x & ~y) == x | y (De Morgan's) +# (x | y) & ~(x & y) == x ^ y + +# SiMBA tool for automated simplification: +# pip install simba-simplifier +from simba import simplify_mba +expr = "(a | b) + (a & b) - (~a & b)" +print(simplify_mba(expr)) # → a +``` + +--- + +## SIGILL Handler for Execution Mode Switching (Hack.lu 2015) + +Binaries may install SIGILL (illegal instruction) handlers to switch between x86 and x86-64 execution modes or implement custom opcode dispatch: + +1. **Signal registration:** `signal(SIGILL, handler)` installs a callback for illegal instruction exceptions +2. **Mode switching:** The handler modifies the saved instruction pointer or segment registers to switch between 32-bit and 64-bit code +3. **Custom opcodes:** Invalid x86 instructions trigger the handler, which interprets operand bytes as custom VM opcodes + +```c +// Signal handler decodes "illegal" instructions as custom opcodes +void sigill_handler(int sig, siginfo_t *info, void *ucontext) { + ucontext_t *ctx = (ucontext_t *)ucontext; + unsigned char *pc = (unsigned char *)ctx->uc_mcontext.gregs[REG_RIP]; + // Decode custom opcode from bytes at PC + // Advance PC past the custom instruction + ctx->uc_mcontext.gregs[REG_RIP] += opcode_length; +} +``` + +**Key insight:** If a binary installs signal handlers for SIGILL/SIGSEGV/SIGTRAP early in execution, suspect custom instruction dispatch. Trace signal deliveries with `strace -e signal` or set GDB to not intercept: `handle SIGILL nostop pass`. + +--- + +## SIGFPE Signal Handler Side-Channel via strace Counting (PlaidCTF 2017) + +Binary uses SIGFPE signal handlers for control flow, making static analysis unreliable. Brute-force by counting SIGFPE signals via strace — correct input characters produce more signals. + +```bash +# Count SIGFPE signals per input character guess +for c in {a..z} {A..Z} {0..9}; do + count=$(echo -n "${c}AAAAAAA" | strace -e signal=SIGFPE ./binary 2>&1 | grep -c SIGFPE) + echo "$c: $count" +done +# Character producing the most SIGFPEs is correct +# Repeat for each position, extending the known prefix +``` + +**Key insight:** Signal handlers (SIGFPE, SIGSEGV, SIGILL) create implicit control flow invisible to static analysis. The number of signals raised correlates with validation progress. Counting signals via `strace -e signal=SIGFPE` turns opaque signal-based validation into a measurable side-channel for character-by-character brute-force. + +--- + +## Instruction Trace Inversion with Keystone and Unicorn (MeePwn CTF 2017) + +UPX-packed binary applies a sequence of arithmetic-only transforms (sub, add, xor, rol, ror) to the flag. No memory side-effects — purely register arithmetic. IDAPython traces non-jump instructions, the sequence is then inverted to recover the flag. + +**Inversion rules:** +- Reverse the instruction sequence (last instruction first) +- Swap inverse pairs: `add ↔ sub`, `rol ↔ ror`, `xor` is self-inverse + +```python +# IDAPython: collect non-jump instructions in the obfuscated routine +import idaapi, idc + +def trace_transforms(start_ea, end_ea): + instructions = [] + ea = start_ea + while ea < end_ea: + mnem = idc.print_insn_mnem(ea) + if mnem not in ('jmp', 'je', 'jne', 'call', 'ret'): + instructions.append((ea, mnem, idc.print_operands(ea))) + ea = idc.next_head(ea) + return instructions + +transforms = trace_transforms(0x401000, 0x401200) + +# Invert: reverse order, swap add/sub and rol/ror +inverse_map = {'add': 'sub', 'sub': 'add', 'rol': 'ror', 'ror': 'rol', 'xor': 'xor'} +inverted = [(mnem, op) for (_, mnem, op) in reversed(transforms)] +inverted = [(inverse_map.get(m, m), op) for m, op in inverted] +``` + +```python +# Assemble inverted instructions with Keystone, emulate with Unicorn +from keystone import * +from unicorn import * +from unicorn.x86_const import * + +ks = Ks(KS_ARCH_X86, KS_MODE_64) +uc = Uc(UC_ARCH_X86, UC_MODE_64) + +asm_src = '\n'.join(f'{mnem} {op}' for mnem, op in inverted) +encoding, _ = ks.asm(asm_src) + +CODE_BASE = 0x400000 +uc.mem_map(CODE_BASE, 0x10000) +uc.mem_write(CODE_BASE, bytes(encoding)) + +# Set initial register state to the observed output value +uc.reg_write(UC_X86_REG_RAX, known_output) +uc.emu_start(CODE_BASE, CODE_BASE + len(encoding)) +flag_bytes = uc.reg_read(UC_X86_REG_RAX).to_bytes(8, 'little') +``` + +**PEB anti-debug note:** If the binary reads `PEB.BeingDebugged` and uses it to select between two comparison target values, the traced instructions under IDAPython may use the debug-mode target. Patch `BeingDebugged` to 0 before tracing, or identify both branches and use the non-debug target value. + +**Key insight:** Arithmetic-only obfuscation (no memory writes) is fully reversible by tracing, inverting the instruction sequence, and swapping inverse operations. PEB anti-debug can silently change comparison targets — always verify which branch is taken. + +**References:** MeePwn CTF 2017 + +--- + +### Call-less Function Chaining via Stack Frame Manipulation (THC CTF 2018) + +**Pattern:** Binary hides function calls by building a linked list of function pointers on the stack, then modifying saved RBP and return addresses so `leave; ret` instructions chain through the list without any explicit `CALL` instructions. IDA fails to decompile because push/pop are unbalanced and function boundaries cannot be determined. + +Each function in the chain: +1. Pushes operands and the next function's address onto the stack +2. Sets saved RBP to point to the next stack frame +3. Sets the return address to the next function +4. `leave` restores RSP from RBP (moving to next frame), `ret` jumps to the next function + +```python +# Reversed processing chain (each function applied via leave/ret): +def reverse_processing(byte): + res = byte | 0x80 # OR 0x80 + res = res ^ 0xCA # XOR 0xCA + res = (res + 66) & 0xFF # ADD 66 + res = res ^ 0xCA # XOR 0xCA (repeated) + res = (res + 66) & 0xFF + res = res ^ 0xCA + res = (res + 66) & 0xFF + res = res ^ 0xFE # XOR 0xFE (final) + return res +# Apply in reverse order, then reverse the character sequence +``` + +**Key insight:** By manipulating saved RBP to point to the next stack frame and saved RIP to the next function, `leave; ret` chains through functions without any `call` instructions. Disassemblers that track call/ret balance fail to identify function boundaries. Patch each function body individually for IDA to handle them. + +**Detection:** Binary with many small code blocks ending in `leave; ret` but no corresponding `call` instructions. Stack contains interleaved function pointers and data. IDA shows "stack frame is too big" or fails to create functions. + +**References:** THC CTF 2018 + +--- + +## Comprehensive Bypass Strategies + +### Universal Bypass Checklist + +1. **Identify all anti-analysis checks** — search for: `ptrace`, `IsDebuggerPresent`, `rdtsc`, `cpuid`, `NtQuery`, `GetTickCount`, `CheckRemoteDebuggerPresent`, `/proc/self`, `SIGTRAP`, `alarm` +2. **Static patching** — NOP/patch checks with pwntools or Ghidra before running +3. **LD_PRELOAD** (Linux) — hook libc functions returning fake values +4. **ScyllaHide** (Windows x64dbg) — patches PEB, hooks NT functions automatically +5. **Emulation** (Unicorn/Qiling) — no debugger artifacts to detect +6. **Kernel-level bypass** — modify `/proc/sys/kernel/yama/ptrace_scope`, use `prctl` + +### Layered Anti-Debug (Real-World Pattern) + +Many CTF challenges stack multiple checks: +```text +1. TLS callback → IsDebuggerPresent (before main) +2. main() → ptrace(TRACEME) +3. Watchdog thread → timing check + /proc scan +4. Code section → self-CRC32 integrity +5. Signal handler → real logic in SIGSEGV handler +``` + +**Approach:** Identify ALL checks before patching. Patch or hook each one systematically. Run under emulator if too many to patch individually. + +### Quick Reference: Check to Bypass + +| Anti-Debug Check | Platform | Bypass | +|---|---|---| +| `ptrace(TRACEME)` | Linux | `LD_PRELOAD`, patch to `ret 0`, `catch syscall` | +| `IsDebuggerPresent` | Windows | ScyllaHide, Frida hook, PEB patch | +| `NtQueryInformationProcess` | Windows | ScyllaHide, hook ntdll | +| `rdtsc` timing | Both | NOP rdtsc, Frida time hook, Pin | +| `/proc/self/status` | Linux | Mount namespace, hook fopen | +| `alarm(N)` | Linux | `handle SIGALRM ignore` in GDB | +| `SIGTRAP` handler | Linux | `handle SIGTRAP nostop pass` | +| `SIGFPE` handler side-channel | Linux | `strace -e signal=SIGFPE` count per input | +| TLS callback | Windows | Break on TLS in x64dbg, patch | +| DR register scan | Windows | Use software BPs, hook GetThreadContext | +| INT3 scan / CRC | Both | Hardware BPs, patch CRC comparison | +| Frida detection | Both | Early-load gadget, hook strstr | +| CPUID hypervisor | Both | Patch CPUID result, bare metal | +| Thread hiding | Windows | Hook NtSetInformationThread | + + +--- + +## Agent 响应菜谱 A–T（Issue #65） + +> 检测类长文仍见 `malware-analysis/references/anti-analysis-techniques.md`；OLLVM 长流程见 `references/ollvm-deobfuscation.md`。 +> 本节是 **触发 → 动作 → Evidence** 短菜谱，供 agent 在 Dynamic/Static 旁路选用。 +> **授权隔离 lab 默认**；静态 patch / 改 PEB / 改返回值不是未授权目标上的默认动作。 + +### 使用规则 + +1. 先 **识别并记录** 检测点（地址/API/字符串），再决定绕过或换环境。 +2. 绕过尝试（成功或失败）MUST 写 Evidence；禁止把反调试退出写成「样本无害」。 +3. H/S 不在此展开长文 → 跳转 OLLVM 专章。 +4. L 仅 Linux/ELF 强制；Windows PE 主路径不因缺 TracerPid 判失败。 +5. E 的 VT 对照为 **可选**；无外部情报源时写 n/a，不编造首次提交时间。 + +### 全表 A–T + +| ID | 触发 | 处理动作 | Evidence | 优先级 | +|----|------|----------|----------|--------| +| **A** | `cpuid` 后条件跳（jz/jnz） | 识别 hypervisor 检测；lab 改标志位或 patch 跳转走恶意/真实业务分支；或换物理机 | `E-anti-debug-cpuid` | P0 | +| **B** | `rdtsc` + sub/cmp 时间差 | bp `rdtsc` / hook 时间 API；或 patch 比较；避免只靠「等沙箱超时」 | `E-anti-debug-rdtsc` | P0 | +| **C** | 字符串含 x64dbg/olly/windbg 等，或 Toolhelp 枚举 | bp `CreateToolhelp32Snapshot`→`Process32First/Next`；改匹配或跳过扫描分支 | `E-anti-debug-procscan` | P1 | +| **D** | `AddVectoredExceptionHandler` + 故意访问违例 | bp 注册点；定位 VEH handler 分析；调试器可忽略特定异常 | `E-anti-debug-veh` | P1 | +| **E** | TimeDateStamp 未来/0/荒谬；版本信息像合法厂商 | 与发现时间对照；**可选** VT 首次提交；`SigCheck` 看版本资源是否配合签名；无 VT → n/a | `E-meta-timestamp` | P2 | +| **F** | 显示有数字签名但来源可疑 | `SigCheck`：链有效？吊销？签名时间 vs 编译时间；**无效/吊销不得降低**威胁等级 | `E-sig-forge` | P0 | +| **G** | 多 PE 头、重叠节、节名伪装 | CFF/PE-bear/LoadPE 看真实映射与 EP 节；熵区分加密 vs 代码；不信节名 | `E-pe-anomaly` | P1 | +| **H** | F5 大量 `while(1)+switch`、星形 CFG | **See** `ollvm-deobfuscation.md`（d810/deflat 等）；插件不全则动态记录块序重构 | `E-cff` | P1 指针 | +| **I** | strings 无域名/IP 但有网/文件行为 | 找 Base64/XOR/自定义 decode；xref 解密函数；解密后 dump 回注 IDA | `E-string-decrypt` | P0 | +| **J** | 文件大小 ≫ 节原始数据之和（Overlay） | 提 overlay；`file`/熵；IDA 搜偏移引用；加密则动态抓密钥 | `E-overlay` | P1 | +| **K** | `fs:[0x30]`/`gs:[0x60]` → BeingDebugged / NtGlobalFlag | 改 PEB 标志或 ScyllaHide；或 patch 条件跳 | `E-anti-debug-peb` | P0 | +| **L** | 读 `/proc/self/status` 查 TracerPid≠0 | **Linux/ELF**：hook fopen/read 或 patch；Windows 不强制 | `E-anti-debug-tracerpid` | P2 平台 | +| **M** | `int3`(0xCC) 或读 DR0–DR7 | int3→nop；硬件 BP 检测用 ScyllaHide/软 BP；CRC 自检见补丁 6 | `E-anti-debug-bp` | P1 | +| **N** | IAT 空/极少 + 自写哈希解析 API | bp `GetProcAddress`/`Ldr*`；哈希反查导出表；回注符号；与「干净 IAT」铁律协同 | `E-api-hash` | P0 | +| **O** | 线性反汇编大量 db、花指令致错位 | F5/Hex-Rays；动态确认真流；junk nop 后 reanalyze；静还不全以动态为准 | `E-junk-code` | P2 | +| **P** | `NtQueryInformationProcess` class 7/30/31 | ScyllaHide 或 hook 返回；记 InformationClass | `E-anti-debug-ntqip` | P0 | +| **Q** | `.rsrc` 过大/高熵/非标准 RT_RCDATA | Resource Hacker/CFF 提取；`FindResource`/`LoadResource` xref；解密后 dump | `E-rsrc-payload` | P1 | +| **R** | 静态 IAT 无某 DLL，运行时才用 | 查 Delay Import Table；bp `__delayLoadHelper2` 或首次调用；纳入能力评估 | `E-delay-import` | P1 | +| **S** | 恒真/恒假条件、大片死代码 | **See** ollvm / angr 等；patch 唯一可达分支或动态路径回注 | `E-opaque-pred` | P1 指针 | +| **T** | ASCII strings 无结果，数据区像 UTF-16 | `strings -el` 或 `-encoding=utf-16le`；IDA Alt+A unicode；纳入 IOC | `E-wide-strings` | P0 | + +### 与主 workflow 的挂接 + +| 阶段 | 菜谱 | +|------|------| +| Triage | E, F, G, T（元数据/签名/节/宽串） | +| Static | H, I, J, N 线索, O, Q, R, S | +| Dynamic | A–D, K, L, M, N, P + 既有断点四级火箭与无行为应急 | +| 失败 | 任何绕不过的检测 → Evidence + 换工具/环境；不静默降威胁 | + +### 工具注记（非强制安装清单） + +- Windows 用户态：x64dbg + **ScyllaHide**（PEB/NtQuery/硬件 BP 等批量隐藏） +- 签名：Sysinternals **SigCheck** +- PE 结构：PE-bear / CFF Explorer +- 平坦化：见 ollvm 专章工具表（d810-ng 等） +- 无某工具时：等价命令 + 记失败，禁止假装已验证签名/已脱平坦化 \ No newline at end of file diff --git a/reverse-engineering/awesome-re-resources.md b/reverse-engineering/awesome-re-resources.md new file mode 100644 index 0000000..e489071 --- /dev/null +++ b/reverse-engineering/awesome-re-resources.md @@ -0,0 +1,135 @@ +# 逆向工程参考资源汇总 + +> 精选自多个 awesome 列表，按实用性排序。AI 在逆向分析时可参考这些资源获取方法论和工具指导。 + +--- + +## 综合资源库 + +| 项目 | Stars | 覆盖 | 链接 | +|------|-------|------|------| +| **awesome-reversing** (tylerha97) | 3k+ | 逆向工具/书籍/课程/练习 | https://github.com/tylerha97/awesome-reversing | +| **awesome-reverse-engineering** (alphaSeclab) | 4k+ | 3500+ 工具 + 2300 文章，全平台 | https://github.com/alphaSeclab/awesome-reverse-engineering | +| **Reverse-Engineering** (mytechnotalent) | 10k+ | 免费教程：x86/x64/ARM/AVR/RISC-V | https://github.com/mytechnotalent/Reverse-Engineering | +| **awesome-malware-analysis** (rshipp) | 12k+ | 恶意软件分析工具/资源 | https://github.com/rshipp/awesome-malware-analysis | +| **reversingBits** | — | 逆向/二进制分析速查表合集 | https://github.com/mohitmishra786/reversingBits | +| **awesome-arm-exploitation** | — | ARM 利用资源（视频/文章/书籍） | https://github.com/HenryHoggard/awesome-arm-exploitation | +| **Binary-Analysis-Automation** | — | 自动化二进制分析（ML/脚本/静态/动态） | https://github.com/user1342/Awesome-Binary-Analysis-Automation | + +--- + +## ELF / Linux 逆向专项 + +| 资源 | 说明 | 链接 | +|------|------|------| +| **libelfmaster** | 安全 ELF 解析库（取证/恶意软件重建） | https://github.com/elfmaster/libelfmaster | +| **ELF 规范** | 官方 ELF 格式文档 | https://refspecs.linuxfoundation.org/elf/elf.pdf | +| **Linux Internals** | /proc 文件系统、内存布局、syscall | https://0xax.gitbooks.io/linux-insides/ | +| **Compiler Explorer** | 在线看 C/C++/Rust/Go 编译成什么汇编 | https://godbolt.org/ | + +--- + +## ARM / AArch64 专项 + +| 资源 | 说明 | 链接 | +|------|------|------| +| **ARM 官方架构手册** | 完整指令集参考 | https://developer.arm.com/documentation | +| **Azeria Labs** | ARM 汇编/利用教程（最佳入门） | https://azeria-labs.com/writing-arm-assembly-part-1/ | +| **ARM64 syscall 表** | Linux AArch64 系统调用号 | https://arm64.syscall.sh/ | +| **QEMU 用户态模拟** | 不需要真实设备分析 ARM 二进制 | `qemu-aarch64 -strace ./binary` | + +--- + +## 恶意软件分析 + +| 资源 | 说明 | 链接 | +|------|------|------| +| **YARA** | 恶意软件特征匹配规则 | https://github.com/VirusTotal/yara | +| **Volatility 3** | 内存取证框架 | https://github.com/volatilityfoundation/volatility3 | +| **FLOSS** | 自动提取混淆字符串 | https://github.com/mandiant/flare-floss | +| **Detect It Easy (DiE)** | 文件类型/壳/编译器识别 | https://github.com/horsicq/Detect-It-Easy | +| **PE-bear** | PE 文件分析器 | https://github.com/hasherezade/pe-bear | +| **Capa** | 自动识别二进制能力（网络/文件/加密等） | https://github.com/mandiant/capa | +| **Unpacker** | 通用脱壳框架 | https://github.com/malwaretech/UnpackerFramework | + +--- + +## 动态分析 / 沙箱 + +| 资源 | 说明 | 链接 | +|------|------|------| +| **Frida** | 跨平台动态插桩 | https://frida.re/ | +| **strace** | Linux 系统调用跟踪 | 系统自带 | +| **ltrace** | 库函数调用跟踪 | 系统自带 | +| **QEMU** | 用户态/系统态模拟 | https://www.qemu.org/ | +| **Unicorn** | CPU 模拟框架（可编程） | https://www.unicorn-engine.org/ | +| **Qiling** | 高级二进制模拟框架 | https://qiling.io/ | +| **angr** | 符号执行 + 二进制分析 | https://angr.io/ | +| **Triton** | 动态二进制分析框架 | https://triton-library.github.io/ | + +--- + +## 反混淆 / 脱壳 + +| 资源 | 说明 | 链接 | +|------|------|------| +| **UPX** | 最常见的壳，`upx -d` 脱壳 | https://upx.github.io/ | +| **unipacker** | 通用 PE 脱壳器 | https://github.com/unipacker/unipacker | +| **de4dot** | .NET 反混淆 | https://github.com/de4dot/de4dot | +| **JADX** | Android DEX 反混淆 | https://github.com/skylot/jadx | +| **JEB** | 商业 Android/ARM 反编译器 | https://www.pnfsoftware.com/ | +| **Miasm** | 逆向工程框架（IR/符号执行/反混淆） | https://github.com/cea-sec/miasm | +| **OLLVM 反混淆** | 控制流平坦化/虚假控制流对抗 | 用 angr/Triton 符号执行恢复 | + +--- + +## 在线分析平台 + +| 平台 | 说明 | 链接 | +|------|------|------| +| **VirusTotal** | 多引擎扫描 + 行为分析 | https://www.virustotal.com/ | +| **Joe Sandbox** | 自动化恶意软件分析 | https://www.joesandbox.com/ | +| **ANY.RUN** | 交互式在线沙箱 | https://any.run/ | +| **Hybrid Analysis** | 免费恶意软件分析 | https://www.hybrid-analysis.com/ | +| **Compiler Explorer** | 看编译器输出 | https://godbolt.org/ | +| **Dogbolt** | 多反编译器对比（IDA/Ghidra/Binary Ninja） | https://dogbolt.org/ | + +--- + +## 学习路径 + +### 入门（0-3 个月） + +1. [Reverse Engineering for Beginners](https://beginners.re/) — 免费电子书 +2. [Azeria Labs ARM 教程](https://azeria-labs.com/) — ARM 汇编基础 +3. [Nightmare](https://guyinatuxedo.github.io/) — CTF 逆向/Pwn 教程 +4. [crackmes.one](https://crackmes.one/) — 逆向练习题 + +### 进阶（3-12 个月） + +1. [Practical Binary Analysis](https://practicalbinaryanalysis.com/) — 实战二进制分析 +2. [The IDA Pro Book](https://nostarch.com/idapro2.htm) — IDA 深度使用 +3. [Malware Unicorn RE101](https://malwareunicorn.org/workshops/re101.html) — 恶意软件逆向 +4. [pwnable.kr](http://pwnable.kr/) / [pwnable.tw](https://pwnable.tw/) — Pwn 练习 + +### 高级 + +1. [Modern Binary Exploitation](https://github.com/RPISEC/MBE) — RPI 课程 +2. [How to Hack Like a Ghost](https://nostarch.com/how-hack-ghost) — 高级渗透 +3. [Windows Internals](https://docs.microsoft.com/en-us/sysinternals/) — Windows 内核 +4. 实战：分析真实恶意软件样本（MalwareBazaar） + +--- + +## 速查表 + +| 速查表 | 链接 | +|--------|------| +| x86/x64 指令速查 | https://www.felixcloutier.com/x86/ | +| ARM64 指令速查 | https://developer.arm.com/documentation/ddi0602/latest | +| Linux syscall 表 (x64) | https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/ | +| Linux syscall 表 (ARM64) | https://arm64.syscall.sh/ | +| GDB 速查 | https://darkdust.net/files/GDB%20Cheat%20Sheet.pdf | +| radare2 速查 | 本包 `radare2/references/cheatsheet.md` | +| IDA 快捷键 | https://hex-rays.com/products/ida/support/freefiles/IDA_Pro_Shortcuts.pdf | +| Ghidra 快捷键 | Ghidra 内置 Help → Keyboard Shortcuts | diff --git a/reverse-engineering/crypto-decode-tools.md b/reverse-engineering/crypto-decode-tools.md new file mode 100644 index 0000000..d0e5ce5 --- /dev/null +++ b/reverse-engineering/crypto-decode-tools.md @@ -0,0 +1,220 @@ +# 加解密 / 编解码工具速查 + +> 逆向和 CTF 中经常遇到加密/编码/哈希数据。本文档按场景列出最实用的工具。 + +--- + +## 自动识别 + 解密（不知道用了什么加密时） + +| 工具 | Stars | 用途 | 链接 | +|------|-------|------|------| +| **Ciphey** | 18k+ | AI 自动识别并解密（支持 50+ 编码/加密/哈希） | https://github.com/Ciphey/Ciphey | +| **CyberChef** | 29k+ | 在线/离线编解码瑞士军刀（拖拽式操作） | https://github.com/gchq/CyberChef | +| **dcode.fr** | — | 在线 900+ 密码/编码/数学工具 | https://www.dcode.fr/ | + +### Ciphey 使用 + +```bash +pip install ciphey +# 自动检测并解密 +ciphey -t "密文" +# 从文件读取 +ciphey -f encrypted.txt +``` + +Ciphey 支持：Base64/32/16、Caesar、Vigenere、XOR、AES（弱密钥）、Morse、Binary、Hex、URL encoding、HTML entities、哈希识别等。 + +### CyberChef 使用 + +```text +在线版：https://gchq.github.io/CyberChef/ +离线版：下载 GitHub Release 的 HTML 文件直接打开 + +常用 Recipe： +- From Base64 → 解 Base64 +- XOR → 异或解密（可暴力尝试 key） +- AES Decrypt → AES 解密 +- Magic → 自动检测编码类型 +``` + +--- + +## 哈希识别与破解 + +| 工具 | 用途 | 链接 | +|------|------|------| +| **hashID** | 识别哈希类型（MD5/SHA/bcrypt 等） | https://github.com/psypanda/hashID | +| **hash-identifier** | 同上，Python 版 | https://github.com/blackploit/hash-identifier | +| **haiti** | 现代哈希识别工具（更准确） | `gem install haiti` | +| **Hashcat** | GPU 哈希破解 | https://hashcat.net/ | +| **John the Ripper** | CPU 哈希破解 | https://www.openwall.com/john/ | +| **hashes.com** | 在线哈希查询（彩虹表） | https://hashes.com/ | + +```bash +# 识别哈希类型 +hashid '5f4dcc3b5aa765d61d8327deb882cf99' +# 输出: [+] MD5 + +# haiti（更准确） +haiti '5f4dcc3b5aa765d61d8327deb882cf99' + +# Hashcat 破解 +hashcat -m 0 hash.txt rockyou.txt # MD5 +hashcat -m 1000 hash.txt rockyou.txt # NTLM +``` + +--- + +## RSA 攻击 + +| 工具 | 用途 | 链接 | +|------|------|------| +| **RsaCtfTool** | RSA 自动攻击（20+ 攻击方式） | https://github.com/Ganapati/RsaCtfTool | +| **SageMath** | 数学计算（大数分解/椭圆曲线） | https://www.sagemath.org/ | +| **factordb.com** | 在线大数分解查询 | http://factordb.com/ | +| **yafu** | 本地大数分解 | https://github.com/bbuhrow/yafu | + +```bash +# RsaCtfTool 自动攻击 +python RsaCtfTool.py --publickey pub.pem --private +python RsaCtfTool.py --publickey pub.pem --uncipherfile cipher.txt + +# 支持的攻击： +# Wiener、Boneh-Durfee、Fermat、Pollard p-1、Williams p+1 +# Common modulus、Small q、Hastads、Noveltyprimes 等 +``` + +--- + +## XOR 分析 + +| 工具 | 用途 | 链接 | +|------|------|------| +| **xortool** | XOR 密钥长度猜测 + 已知明文攻击 | https://github.com/hellman/xortool | +| **CyberChef XOR** | 可视化 XOR 操作 | CyberChef 内置 | + +```bash +# 猜测 XOR key 长度 +xortool encrypted_file +# 用猜测的 key 长度解密 +xortool -l 4 -c 00 encrypted_file + +# 已知明文攻击（知道部分明文） +xortool-xor -f encrypted -s "known_plaintext" +``` + +--- + +## 古典密码 + +| 密码类型 | 工具 | 说明 | +|---------|------|------| +| Caesar | CyberChef / dcode.fr | 暴力 25 种偏移 | +| Vigenere | dcode.fr / Ciphey | 需要猜 key 长度 | +| Substitution | quipqiup.com | 频率分析自动求解 | +| Enigma | dcode.fr | 在线模拟器 | +| Rail Fence | dcode.fr / CyberChef | 栅栏密码 | +| Playfair | dcode.fr | 需要 key | +| Morse | CyberChef | 点划转文字 | +| Bacon | dcode.fr | 二进制隐写 | +| ROT13/47 | CyberChef / `tr` | 简单替换 | + +--- + +## 编码识别与转换 + +| 编码 | 识别特征 | 解码方式 | +|------|---------|---------| +| Base64 | 末尾 `=` 或 `==`，字符集 A-Za-z0-9+/ | `base64 -d` / CyberChef | +| Base32 | 大写字母 + 2-7，末尾 `=` | CyberChef | +| Base58 | 无 0/O/I/l，常见于短标识符编码 | CyberChef | +| Hex | 只有 0-9a-f，长度为偶数 | `xxd -r -p` / CyberChef | +| URL encoding | `%XX` 格式 | `urldecode` / CyberChef | +| HTML entities | `&#XX;` 或 `&` 格式 | CyberChef | +| Unicode escape | `\uXXXX` 格式 | Python `decode('unicode_escape')` | +| JWT | `xxxxx.yyyyy.zzzzz`（三段 Base64URL） | jwt.io / CyberChef | +| Brainfuck | 只有 `><+-.,[]` 八个字符 | 在线解释器 | +| Ook! | 只有 `Ook.` `Ook!` `Ook?` | 在线解释器 | + +--- + +## 逆向中的加密识别 + +### 通过常量识别算法 + +| 常量/特征 | 算法 | +|-----------|------| +| `0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476` | MD5 | +| `0x6A09E667, 0xBB67AE85, 0x3C6EF372` | SHA-256 | +| `0x63, 0x7C, 0x77, 0x7B` (S-Box 开头) | AES | +| `0x243F6A88` (π 的十六进制) | Blowfish | +| `0xB7E15163, 0x9E3779B9` | RC5/RC6/TEA | +| `0x61707865` ("expa") | ChaCha20/Salsa20 | +| `0xC6EF3720` | XTEA | + +### 通过行为识别 + +| 行为特征 | 可能的算法 | +|---------|-----------| +| 256 字节查找表 + swap 操作 | RC4 | +| 16 字节块 + 多轮置换 | AES | +| Feistel 结构（左右交换） | DES/Blowfish/TEA | +| 大数乘法/模幂 | RSA | +| 椭圆曲线点运算 | ECDSA/ECDH | +| 固定 64 轮循环 | TEA/XTEA | +| 32 轮 + delta 常量 | XTEA | + +--- + +## 自动化密码分析 + +| 工具 | 用途 | 链接 | +|------|------|------| +| **FeatherDuster** | 自动化密码分析框架 | https://github.com/nccgroup/featherduster | +| **PkCrack** | ZIP 已知明文攻击 | https://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html | +| **bkcrack** | ZIP 已知明文攻击（现代版） | https://github.com/kimci86/bkcrack | +| **z3** | SMT 求解器（约束求解） | https://github.com/Z3Prover/z3 | +| **angr** | 符号执行（自动求解输入） | https://angr.io/ | + +--- + +## 快速决策树 + +```text +拿到一段未知数据： + +1. 看长度和字符集 + - 只有 hex 字符 → 可能是 hex 编码或哈希 + - 末尾有 = → Base64 + - 三段点分 → JWT + - 32/40/64 字符 hex → 哈希（MD5/SHA1/SHA256） + +2. 用 Ciphey 自动尝试 + ciphey -t "数据" + +3. 如果 Ciphey 失败 → 用 CyberChef Magic 模式 + +4. 如果是哈希 → hashID 识别类型 → Hashcat/John 破解 + +5. 如果是 RSA → RsaCtfTool 自动攻击 + +6. 如果是 XOR → xortool 分析 key + +7. 如果是传统 ZIP 加密 → 优先使用 `bkcrack` 已知明文攻击，不要先做无证据的密码暴力 + +8. 如果是自定义加密 → IDA/Ghidra 逆向算法 → 手写解密脚本 +``` + +--- + +## 在线资源 + +| 资源 | 链接 | 用途 | +|------|------|------| +| CyberChef | https://gchq.github.io/CyberChef/ | 万能编解码 | +| dcode.fr | https://www.dcode.fr/ | 900+ 密码工具 | +| quipqiup | https://quipqiup.com/ | 替换密码自动求解 | +| factordb | http://factordb.com/ | RSA 大数分解 | +| jwt.io | https://jwt.io/ | JWT 解码/验证 | +| hashes.com | https://hashes.com/ | 哈希反查 | +| crackstation | https://crackstation.net/ | 在线哈希破解 | diff --git a/reverse-engineering/dsl-vm-reverse/SKILL.md b/reverse-engineering/dsl-vm-reverse/SKILL.md new file mode 100644 index 0000000..d98a912 --- /dev/null +++ b/reverse-engineering/dsl-vm-reverse/SKILL.md @@ -0,0 +1,380 @@ +--- +name: dsl-vm-reverse +description: Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow. +--- + +# 🔄 DSL 自定义虚拟机逆向（DSL VM Reverse Engineering） + +## ACTION REQUIRED（读完后立刻执行） + +1. `NOW`: 确认当前任务是自定义 JS opcode VM / 风控引擎，不是标准 WASM 或普通 webpack +2. `NOW`: `case-init` 直到 `scope.md` 就绪；离线样本用 `offline` / `lab` +3. `ACT`: 从「3. 通用逆向工作流」Phase 1 做文件分类，不要停在目录 + +> 用于逆向基于 JavaScript 实现的自定义 WASM 虚拟机/风控引擎 + +--- + +## 目录 + +- [1. 适用范围](#1-适用范围) +- [2. DSL VM 识别特征](#2-dsl-vm-识别特征) +- [3. 通用逆向工作流](#3-通用逆向工作流) +- [4. Opcode 提取与分类](#4-opcode-提取与分类) +- [5. 运行时捕获方案](#5-运行时捕获方案) +- [6. 常见状态码](#6-常见状态码) +- [7. Skill 自检清单](#7-skill-自检清单) + +--- + +## 1. 适用范围 + +当目标文件符合以下 **任意特征** 时使用本 skill： + +| # | 特征 | 说明 | +|---|------|------| +| 1 | IIFE 开头 + 大量单字母变量名 | `!function(){var U=void 0,y=parseInt,E0=Function,...}` | +| 2 | 包含 `DG()` 或类似函数含 switch-case 循环 | 解释器主循环，`d[7]&31` 解码 opcode | +| 3 | 大文件（500KB+）但零字节占比 < 1% | 非标准 WASM，纯 JS | +| 4 | 包含 `C[number]` 常量表引用 | `C[9][xxx]` 函数表/字符串表 | +| 5 | 单行压缩代码 | 583KB 单行，混淆变量名 | + +### 排除规则 + +| 条件 | 非本 skill | 转至 | +|------|-----------|------| +| 文件以 `\x00asm` 开头 | 标准 WASM 二进制 | `reverse-engineering/languages.md` | +| 文件以 `Uint8Array([0,97,115,109])` 含 WASM 魔术字 | WASM 嵌入式 | 提取 .wasm 后转 IDA/Ghidra | +| 标准 Webpack 打包（`function(e,t,n){...}`） | 普通 JS | `js-reverse/` | +| 零字节占比 > 20% | WASM 二进制 | `reverse-engineering/languages.md` | + +--- + +## 2. DSL VM 识别特征 + +### 代码特征 + +```javascript +// 特征 1: IIFE 入口，单字母变量映射数字常量 +!function(){ + var U=void 0, y=parseInt, E0=Function, AN=Uint8Array; + var E=15, l=10, m=12, x=16, S=13, $=11; + // 数字常量映射为变量名，替代原始数字 + ... +} + +// 特征 2: 解释器主循环 DG() +function DG(C, d, ...) { + var d = []; // 数组模拟 WASM stack/locals + for (d[7] = x; d[7] !== U;) { + var aE = d[7] & 31; // 低 5 位 = opcode + var O = d[7] >> 5 & 31; // 高 5 位 = sub-operation + switch (aE) { + case 0: /* ... */ d[7] = 612; break; + case 1: /* ... */ + // ... N 个 case + } + } +} + +// 特征 3: 常量表 C[9] 存储函数索引和字符串 +// C[9][0] = ["pc"] → 函数参数描述 +// C[9][667] = "string" → 字符串常量 +// C[9][x] = number → 函数索引 + +// 特征 4: W(C[index], null, ...) 调用模式 +// W = Function.prototype.call.bind(call) +// 所有内置函数通过 C[index] 索引调用 + +// 特征 5: 指令编码格式 +// d[7] = opcode(bit 0-4) | subop(bit 5-9) | operand(bit 10+) +``` + +### Opcode 编码格式 + +每条指令编码为 32 位整数： + +``` +bit 0-4: opcode (0-N) +bit 5-9: sub-operation (0-31) +bit 10-31: operand/立即数 + +解码: + aE = d[7] & 31 → opcode + O = d[7] >> 5 & 31 → sub-operation + d[other] = d[7] >> 10 → operand +``` + +--- + +## 3. 通用逆向工作流 + +### Phase 1: 文件分类（5 分钟） + +```bash +# 检查是否为 DSL VM +python3 << 'EOF' +with open('target.js', 'rb') as f: + head = f.read(100) + +# 1. 检查 WASM 魔术字 +if head[:4] == b'\x00asm': + print("标准 WASM 二进制") + exit() + +# 2. 检查零字节占比 +data = open('target.js', 'rb').read() +zero_pct = data.count(b'\x00') / len(data) * 100 +print(f"零字节占比: {zero_pct:.1f}%") + +if zero_pct > 20: + print("WASM 二进制") +elif head[:2] == b'!f': + # 检查单字母变量模式 + if b'var U=void 0' in head or b'U=void 0,y=parseInt' in head: + print("→ DSL VM!") + else: + print("普通 JS IIFE") +EOF +``` + +### Phase 2: 变量映射表提取（10 分钟） + +```python +import re + +with open('target.js', 'r', errors='replace') as f: + s = f.read() + +# 提取开头 2000 字符的 var X=数字 映射 +mappings = re.findall(r'var\s+(\w+)\s*=\s*(\d+)', s[:2000]) +print('常量映射:') +for name, val in mappings: + print(f" {name:4s} = {val:3d} (0x{int(val):02x})") +``` + +### Phase 3: Opcode 提取与分类（15 分钟） + +```python +# 1. 提取所有 case +all_cases = re.findall(r'case\s+(\d+):', s) +unique = sorted(set(int(c) for c in all_cases)) + +print(f"总 case: {len(all_cases)} 个") +print(f"唯一 opcode: {len(unique)} 个: {unique}") + +# 2. 分类每个 opcode +for op in unique: + idx = s.find(f'case {op}:') + snippet = s[idx:idx+200] + if 'd[7]=' in snippet: + op_type = 'BRANCH' + elif 'return' in snippet: + op_type = 'RETURN' + elif 'W(C[' in snippet: + op_type = 'CALL' + elif 'new' in snippet: + op_type = 'ALLOC' + elif 'try' in snippet or 'catch' in snippet: + op_type = 'EXCEPTION' + else: + op_type = 'ARITH/STORE' + print(f" opcode {op:2d}: {op_type}") +``` + +### Phase 4: 常量表分析（30 分钟） + +```python +const_refs = re.findall(r'C\[9\]\[(\d+)\]', s) +unique_refs = sorted(set(int(x) for x in const_refs)) + +print(f"C[9] 引用: {len(unique_refs)} 个索引") +print(f"范围: {min(unique_refs)} - {max(unique_refs)}") + +# 对每个引用分析上下文 +for ref in unique_refs[:20]: + idx = s.find(f'C[9][{ref}]') + ctx = s[max(0,idx-50):idx+80] + clean = ''.join(c if c.isprintable() else ' ' for c in ctx) + print(f" C[9][{ref}] → {clean}") +``` + +### Phase 5: 导出函数追踪（1-2 小时） + +导出函数（如 `getToken`）通过以下路径定位： + +``` +1. 找 AWSCInner.register() 或类似注册调用 +2. 确定注册的模块和工厂函数 +3. 找工厂函数返回的对象 → 导出函数定义位置 +4. 若函数名不在 JS 中 → 在 C[9] 常量表中作字节码存储 +5. 追踪调用链: + AWSCInner._modules['fy'].getToken() + → W(C[函数索引], null, ...) + → DG() 解释器执行编码后的指令序列 +``` + +### Phase 6: 运行时注入（若纯静态分析不够） + +```javascript +// 注入最小 AWSC 兼容环境 +const fakeEnv = { + AWSCInner: { + _modules: {}, + register(name, moduleName, factory) { + this._modules[moduleName] = factory(); + } + } +}; + +// 执行 DSL VM 代码 +dslVmCode(); + +// 获取导出 +const token = fakeEnv.AWSCInner._modules['fy'].getToken({}); +``` + +--- + +## 4. Opcode 提取与分类 + +### 参考 opcode 对照表（基于已有案例） + +| Opcode | 操作类型 | 特征 | +|--------|---------|------| +| 0 | **BRANCH** | `d[7]=xxx` 无条件跳转 | +| 1 | **CALL** | `W(C[Y],null,function(){...})` 嵌入函数调用 | +| 2 | **ARITH** | `d[4]=0`, `d[7]=72` 变量赋值 | +| 3 | **ARITH** | `d[0]=d[1][C[x]]`, `d[5]=d[0] false}); + Object.defineProperty(navigator, 'plugins', {get: () => [1,2,3,4,5]}); + Object.defineProperty(navigator, 'languages', {get: () => ['zh-CN','zh','en']}); + """ +}) + +# 发送 CDP 原生鼠标事件 +driver.execute_cdp_cmd("Input.dispatchMouseEvent", { + "type": "mousePressed", + "x": 549.5, "y": 441.2, + "button": "left", "buttons": 1, + "clickCount": 1, "pointerType": "mouse" +}) +``` + +### 方案 B: Playwright 无头浏览器 + +```javascript +const { chromium } = require('playwright'); + +async function run() { + const browser = await chromium.launch(); + const page = await browser.newPage(); + + // 拦截网络请求 + await page.route('**/api/**', async route => { + await route.continue_(); + }); + + await page.goto('https://target-page.com'); + + // 等待 DSL VM 初始化 + await page.waitForFunction(() => { + return window.AWSCInner && + window.AWSCInner._modules && + window.AWSCInner._modules['fy']; + }); + + // 执行操作 + await page.mouse.move(500, 400); + await page.mouse.down(); + // ... 操作序列 + await page.mouse.up(); +} +``` + +### 方案 C: 纯协议验证（成功率极低） + +> DSL VM 生成的 token 通常与浏览器上下文强绑定（TLS JA3 指纹、IP、Cookie、请求头等），脱离浏览器后服务端可检测到上下文不匹配。**不建议使用纯协议方案**。 + +--- + +## 6. 常见状态码 + +| Code | 含义 | 处理 | +|------|------|------| +| 0 | **验证通过** ✅ | 取出 sessionId + sig | +| 300 | **风控拦截** | 被拦截，无法通过 | +| 8778 | **验证失败，需重试** | 重试操作 | +| 8776 | **操作太快，需重试** | 增加延迟后重试 | +| 69634 | **通用失败** | 检查参数是否正确 | + +--- + +## 7. Skill 自检清单 + +- [ ] 我是否完成了 DSL VM 识别（IIFE + 单字母变量 + DG() 解释器）？ +- [ ] 我是否提取了变量映射表（`var X=数字`）？ +- [ ] 我是否提取了 opcode 列表并分类？ +- [ ] 我是否分析了常量表 C[9] 的引用范围？ +- [ ] 我是否定位了导出函数注册点？ +- [ ] 纯静态分析不够时，我是否尝试了运行时注入方案？ +- [ ] 任务完成后是否回写了 field-journal？ +- [ ] 是否发现新工具/新场景 → 更新 routing.md？ + +--- + +## 路由注册 + +| 类型 | 路由 | +|------|------| +| **目标类型**: WASM / DSL VM / 自定义指令集 | `reverse-engineering/dsl-vm-reverse/SKILL.md` | +| **用户意图**: "DSL VM / 风控引擎逆向" | 本 skill | +| **工具链**: Playwright / Selenium CDP | 浏览器注入方案 | + +### 路径交叉 + +``` +DSL VM 逆向路径: + reverse-engineering/dsl-vm-reverse/ → Phase 1-6 工作流 + ↓ 若需要捕获运行时数据 + browser-automation/ → Playwright/Selenium CDP + ↓ 若需要分析 API 协议层 + js-reverse/ → Observe→Capture→Rebuild +``` diff --git a/reverse-engineering/elf-analysis.md b/reverse-engineering/elf-analysis.md new file mode 100644 index 0000000..56e5f40 --- /dev/null +++ b/reverse-engineering/elf-analysis.md @@ -0,0 +1,296 @@ +# ELF 二进制深度分析参考 + +> 逆向 Linux/Android ELF 文件时的结构解析、反分析对抗识别和分析技巧。 + +--- + +## ELF 结构速查 + +### 文件头 (ELF Header) + +```text +偏移 大小 字段 说明 +0x00 4 e_ident[EI_MAG] Magic: 7f 45 4c 46 ("\x7fELF") +0x04 1 e_ident[EI_CLASS] 1=32bit, 2=64bit +0x05 1 e_ident[EI_DATA] 1=LE, 2=BE +0x10 2 e_type 2=EXEC, 3=DYN(PIE/SO), 4=CORE +0x12 2 e_machine 0x03=x86, 0x3E=x86_64, 0xB7=AArch64, 0x28=ARM +0x18 8 e_entry 入口点虚拟地址 +0x20 8 e_phoff 程序头表偏移 +0x28 8 e_shoff 节头表偏移（strip 后可能为 0） +0x38 2 e_phnum 程序头数量 +0x3C 2 e_shnum 节头数量 +``` + +### 程序头 (Program Header) + +```text +类型值 名称 说明 +0x01 PT_LOAD 可加载段（代码/数据） +0x02 PT_DYNAMIC 动态链接信息 +0x03 PT_INTERP 解释器路径（/lib/ld-linux.so） +0x04 PT_NOTE 辅助信息 +0x06 PT_PHDR 程序头表自身 +0x6474e550 PT_GNU_EH_FRAME 异常处理 +0x6474e551 PT_GNU_STACK 栈可执行标记 +0x6474e552 PT_GNU_RELRO 只读重定位 +``` + +### 常见节 (Sections) + +| 节名 | 说明 | +|------|------| +| `.text` | 代码段 | +| `.rodata` | 只读数据（字符串常量） | +| `.data` | 已初始化全局变量 | +| `.bss` | 未初始化全局变量 | +| `.plt` / `.got` | 动态链接跳转表 | +| `.init_array` | 构造函数指针数组 | +| `.fini_array` | 析构函数指针数组 | +| `.dynamic` | 动态链接信息 | +| `.symtab` / `.dynsym` | 符号表 | +| `.strtab` / `.dynstr` | 字符串表 | + +--- + +## 反分析手法识别 + +### 常见 ELF 反分析技术 + +| 手法 | 特征 | 对抗方式 | +|------|------|---------| +| 损坏程序头 | PHDR 填充垃圾数据（如 0x0a） | 手动修复或忽略损坏的 PHDR | +| 无 section header | `e_shoff = 0`, `e_shnum = 0` | 只依赖程序头分析，不依赖 section | +| 去符号 (strip) | 无 `.symtab`，函数名全丢 | GoReSym(Go) / 签名匹配 / FLIRT | +| 静态链接 | 无 `.dynamic`，体积巨大 | 用 FLIRT/Lumina 识别库函数 | +| 伪装文件类型 | 后缀 .sh/.txt/.jpg | 用 `file` 命令 / magic bytes 判断 | +| UPX 加壳 | 包含 `UPX!` 标记 | `upx -d` 脱壳 | +| 自定义壳 | 入口点跳转到解压代码 | 动态运行到 OEP 后 dump | +| 反调试 | ptrace(TRACEME) | LD_PRELOAD hook / patch | +| 反虚拟机 | 检查 /proc/cpuinfo | 修改 cpuinfo 或 hook 读取 | +| 代码加密 | 运行时解密 .text | 断点在解密后 dump | + +### 识别自解压/自修改代码 + +```text +特征： +1. 入口点附近有 mmap(PROT_READ|PROT_WRITE|PROT_EXEC) 调用 +2. 紧接着有 memcpy 或循环拷贝 +3. 然后 mprotect 改权限 +4. 最后 br/jmp 到新映射的地址 + +分析策略： +1. 找到 mmap 调用 → 记录返回的地址 +2. 在 mprotect(PROT_EXEC) 后下断点 +3. dump 解压后的内存区域 +4. 作为新的二进制分析 +``` + +--- + +## ARM64 (AArch64) 逆向速查 + +### 寄存器 + +| 寄存器 | 用途 | +|--------|------| +| x0-x7 | 参数/返回值 | +| x8 | 间接结果（syscall 号） | +| x9-x15 | 临时寄存器 | +| x16-x17 | IP0/IP1（PLT 跳转） | +| x18 | 平台寄存器（Android: shadow call stack） | +| x19-x28 | 被调用者保存 | +| x29 (FP) | 帧指针 | +| x30 (LR) | 链接寄存器（返回地址） | +| SP | 栈指针 | +| PC | 程序计数器 | + +### 常见指令模式 + +```text +函数序言： + stp x29, x30, [sp, #-N]! # 保存 FP 和 LR + mov x29, sp # 设置帧指针 + +函数尾声： + ldp x29, x30, [sp], #N # 恢复 FP 和 LR + ret # 返回（br x30） + +系统调用： + mov x8, #NR # syscall 号 + svc #0 # 触发 syscall + +条件分支： + cmp x0, #0 + b.eq label # 等于跳转 + b.ne label # 不等于跳转 + cbz x0, label # x0 == 0 跳转 + cbnz x0, label # x0 != 0 跳转 + +地址加载： + adrp x0, page # 加载页地址高位 + add x0, x0, #offset # 加低 12 位偏移 + ldr x0, [x1, #offset] # 从内存加载 +``` + +### Linux ARM64 系统调用号 + +| 号码 | 名称 | 说明 | +|------|------|------| +| 56 | openat | 打开文件 | +| 63 | read | 读取 | +| 64 | write | 写入 | +| 57 | close | 关闭 | +| 222 | mmap | 内存映射 | +| 226 | mprotect | 修改内存权限 | +| 117 | ptrace | 进程跟踪 | +| 220 | clone | 创建进程/线程 | +| 221 | execve | 执行程序 | +| 93 | exit | 退出 | +| 94 | exit_group | 退出进程组 | + +--- + +## 常见压缩/打包算法识别 + +| 算法 | 识别特征 | 解压方式 | +|------|---------|---------| +| **LZSS** | 位流 + 字面量/匹配标记 | 自定义解压器（如本报告） | +| **ZLIB/Deflate** | Magic: `78 01`/`78 9C`/`78 DA` | `zlib.decompress()` | +| **GZIP** | Magic: `1F 8B` | `gzip -d` / `gunzip` | +| **LZ4** | Magic: `04 22 4D 18` | `lz4 -d` | +| **LZMA/XZ** | Magic: `FD 37 7A 58 5A 00` (XZ) | `xz -d` / `lzma -d` | +| **Brotli** | 无固定 magic，看上下文 | `brotli -d` | +| **Zstandard** | Magic: `28 B5 2F FD` | `zstd -d` | +| **UPX** | 字符串 `UPX!` | `upx -d` | +| **自定义** | 入口点有解压循环 | 逆向算法后写解压器 | + +### 识别自定义压缩的线索 + +```text +1. 入口点附近有循环 + 位操作（移位、AND、OR） +2. 有"滑动窗口"回拷（从输出缓冲区往回读）→ LZ 系列 +3. 有频率表/霍夫曼树构建 → Deflate/Huffman +4. 有固定大小块处理 → 块压缩（LZ4/Snappy） +5. 有算术编码特征（区间缩小）→ LZMA/ANS +``` + +--- + +## Linux 进程注入技术 + +### mmap + 代码注入 + +```text +流程： +1. mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0) +2. 将 shellcode/payload 写入映射区域 +3. mprotect(addr, size, PROT_READ|PROT_EXEC) # 改为可执行 +4. 跳转到映射地址执行 + +特征： +- mmap 返回值被保存 +- 紧接着有 memcpy 或循环写入 +- 然后 mprotect 改权限 +- 最后 br/blr 到该地址 +``` + +### ptrace 注入 + +```text +流程： +1. ptrace(PTRACE_ATTACH, target_pid) +2. waitpid(target_pid) +3. ptrace(PTRACE_GETREGS, target_pid, ®s) +4. 修改 regs.pc 指向注入代码 +5. ptrace(PTRACE_SETREGS, target_pid, ®s) +6. ptrace(PTRACE_CONT, target_pid) + +特征： +- 打开 /proc//mem 或使用 ptrace +- 读取/修改目标进程寄存器 +- 写入 shellcode 到目标进程空间 +``` + +### /proc/self/mem 自修改 + +```text +流程： +1. open("/proc/self/mem", O_RDWR) +2. lseek(fd, target_addr, SEEK_SET) +3. write(fd, new_code, size) + +用途： +- 绕过 W^X 保护（mmap 的页不能同时 W+X） +- 修改自身代码段（.text 通常是只读的） +- 运行时 patch 指令 +``` + +--- + +## 分析大型 ELF 的策略 + +对于 5MB+ 的大型二进制： + +```text +1. 快速侦察（5 分钟） + - file / rabin2 -I → 架构、类型、保护 + - strings | grep -i "error\|fail\|http\|/proc\|/dev" → 关键字符串 + - rabin2 -i → 导入函数（如果有） + - rabin2 -E → 导出函数 + +2. 结构分析（10 分钟） + - readelf -l → 程序头（LOAD 段布局） + - 入口点附近代码 → 是否有解压/解密 + - 找 .init_array → 构造函数（可能有反调试） + +3. 定位关键逻辑 + - 从字符串交叉引用入手 + - 从系统调用（mmap/ptrace/open）入手 + - 从网络函数（connect/send/recv）入手 + +4. 分而治之 + - 如果是自解压 → 先解压，分析 payload + - 如果是多模块 → 按功能分块分析 + - 用 binary-diff 对比不同版本 +``` + +--- + +## 工具命令速查 + +```bash +# 基本信息 +file binary +readelf -h binary # ELF 头 +readelf -l binary # 程序头 +readelf -S binary # 节头（如果有） +rabin2 -I binary # 综合信息 + +# 字符串 +strings -a binary | less +rabin2 -z binary # 数据段字符串 +rabin2 -zz binary # 全文件字符串 + +# 反汇编 +r2 -A binary # radare2 分析 +objdump -d binary # GNU 反汇编 +aarch64-linux-gnu-objdump -d binary # ARM64 交叉反汇编 + +# 动态分析 +strace -f ./binary # 系统调用跟踪 +ltrace -f ./binary # 库函数跟踪 +qemu-aarch64 -strace ./binary # ARM64 模拟执行 + +# 内存 dump +gdb -p -ex "dump memory out.bin 0xADDR 0xADDR+SIZE" -ex quit + +# 修复损坏的 ELF +# 手动修改 e_phnum 或 patch 损坏的 PHDR +python -c " +import struct +with open('binary', 'r+b') as f: + f.seek(0x38) # e_phnum offset (64-bit) + f.write(struct.pack('