reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
--- a/reverse-skill-repo/skills/radare2/scripts/recon.ps1
+++ b/reverse-skill-repo/skills/radare2/scripts/recon.ps1
@@ -0,0 +1,85 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$TargetPath,
+
+    [int]$StringsLimit = 40,
+
+    [int]$ImportsLimit = 80,
+
+    [switch]$RunAnalysis
+)
+
+# 强制当前脚本使用 UTF-8 输出，尽量减少中文标题乱码。
+[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+$OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+
+$ErrorActionPreference = 'Stop'
+
+. (Join-Path $PSScriptRoot '..\..\scripts\lib\ToolDiscovery.ps1')
+
+$bootstrapScript = Join-Path $PSScriptRoot '..\..\scripts\bootstrap-reverse.ps1'
+
+function Get-RequiredToolSpec {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Name
+    )
+
+    $spec = Resolve-ReverseToolSpec -Name $Name
+    if (-not $spec.Available) {
+        # Attempt auto-bootstrap
+        if (Test-Path -LiteralPath $bootstrapScript) {
+            Write-Output "INFO: $Name not found, attempting auto-bootstrap..."
+            & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $bootstrapScript -Capability @($Name) -SkipRefresh
+            $spec = Resolve-ReverseToolSpec -Name $Name
+        }
+        if (-not $spec.Available) {
+            throw "缺少命令：$Name — 自动安装失败，请手动安装。参考: https://github.com/radareorg/radare2"
+        }
+    }
+    return $spec
+}
+
+function Write-Section {
+    param(
+        [Parameter(Mandatory = $true)]
+    [string]$Title
+    )
+
+    # 用固定分段标题，方便人看，也方便后续 grep。
+    ""
+    "=== $Title ==="
+}
+
+$rabin2 = Get-RequiredToolSpec -Name 'rabin2'
+$r2 = $null
+if ($RunAnalysis) {
+    $r2 = Get-RequiredToolSpec -Name 'r2'
+}
+
+# 将输入路径规范化成绝对路径，避免 r2/rabin2 在相对路径下歧义解析。
+$resolvedPath = Resolve-Path -LiteralPath $TargetPath
+$target = $resolvedPath.Path
+
+"目标文件: $target"
+
+Write-Section -Title '基本信息'
+& $rabin2.Command @($rabin2.PrefixArgs + @('-I', '--', $target))
+
+Write-Section -Title '节区'
+& $rabin2.Command @($rabin2.PrefixArgs + @('-S', '--', $target))
+
+Write-Section -Title '导入'
+& $rabin2.Command @($rabin2.PrefixArgs + @('-i', '--', $target)) | Select-Object -First $ImportsLimit
+
+Write-Section -Title '导出'
+& $rabin2.Command @($rabin2.PrefixArgs + @('-E', '--', $target))
+
+Write-Section -Title '字符串'
+& $rabin2.Command @($rabin2.PrefixArgs + @('-zz', '--', $target)) | Select-Object -First $StringsLimit
+
+if ($RunAnalysis) {
+    Write-Section -Title '函数与入口分析'
+    & $r2.Command @($r2.PrefixArgs + @('-A', '-q', '-c', 's entry0;afl;iz;ii;q', '--', $target))
+}
--- a/reverse-skill-repo/skills/radare2/scripts/recon.sh
+++ b/reverse-skill-repo/skills/radare2/scripts/recon.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# recon.sh — radare2 快速侦察（二进制基本信息、节区、导入导出、字符串）
+# 等价于 Windows 版的 recon.ps1
+#
+# 用法:
+#   bash recon.sh <target_file> [--strings-limit 40] [--imports-limit 80] [--analyze]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KALI_BOOTSTRAP="$(cd "$SCRIPT_DIR/../../../kali/scripts" 2>/dev/null && pwd)/bootstrap-reverse.sh"
+
+# ─── 参数 ──────────────────────────────────────────────────────────────────────────
+
+TARGET=""
+STRINGS_LIMIT=40
+IMPORTS_LIMIT=80
+RUN_ANALYSIS=false
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --strings-limit) STRINGS_LIMIT="$2"; shift 2 ;;
+        --imports-limit) IMPORTS_LIMIT="$2"; shift 2 ;;
+        --analyze) RUN_ANALYSIS=true; shift ;;
+        -*) echo "未知选项: $1"; exit 1 ;;
+        *) TARGET="$1"; shift ;;
+    esac
+done
+
+if [[ -z "$TARGET" ]]; then
+    echo "用法: $0 <target_file> [--strings-limit N] [--imports-limit N] [--analyze]"
+    exit 1
+fi
+
+if [[ ! -f "$TARGET" ]]; then
+    echo "ERR: 文件不存在: $TARGET"
+    exit 1
+fi
+
+# ─── 工具检测 ──────────────────────────────────────────────────────────────────────
+
+ensure_tool() {
+    local name="$1"
+    if command -v "$name" &>/dev/null; then
+        return 0
+    fi
+    echo "INFO: $name 未找到，尝试安装..."
+    if [[ -x "$KALI_BOOTSTRAP" ]]; then
+        bash "$KALI_BOOTSTRAP" r2 --skip-refresh 2>/dev/null || true
+    fi
+    if ! command -v "$name" &>/dev/null; then
+        echo "ERR: $name 不可用。安装: apt install radare2"
+        exit 1
+    fi
+}
+
+ensure_tool "rabin2"
+[[ "$RUN_ANALYSIS" == "true" ]] && ensure_tool "r2"
+
+# ─── 绝对路径 ──────────────────────────────────────────────────────────────────────
+
+TARGET="$(realpath "$TARGET")"
+echo "目标文件: $TARGET"
+
+# ─── 侦察 ─────────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "=== 基本信息 ==="
+rabin2 -I -- "$TARGET"
+
+echo ""
+echo "=== 节区 ==="
+rabin2 -S -- "$TARGET"
+
+echo ""
+echo "=== 导入 ==="
+rabin2 -i -- "$TARGET" | head -n "$IMPORTS_LIMIT"
+
+echo ""
+echo "=== 导出 ==="
+rabin2 -E -- "$TARGET"
+
+echo ""
+echo "=== 字符串 ==="
+rabin2 -zz -- "$TARGET" | head -n "$STRINGS_LIMIT"
+
+if [[ "$RUN_ANALYSIS" == "true" ]]; then
+    echo ""
+    echo "=== 函数与入口分析 ==="
+    r2 -A -q -c 's entry0;afl;iz;ii;q' -- "$TARGET"
+fi