vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reverse-skills-max: initial public release (restored, redacted, hardened)

Browse Source
This commit is contained in:
baradok609hecl1pq6qi
2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

154
INDEX.md Normal file
View File

@@ -0,0 +1,154 @@
# Каталог реверс-скиллов (чистая сборка, 2026-09-30)
Всего скиллов с SKILL.md: **136**. Личные данные вычищены (см. README).
## (root)
- **dsl-vm-reverse** (`dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
- **firmware-reversing** (`firmware-reversing/`, 1 файлов) — 'Use for firmware and embedded device reverse engineering: firmware extraction
- **protocol-reverse-engineering** (`protocol-reverse-engineering/`, 1 файлов) — Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
- **reverse-engineering** (`reverse-engineering/`, 25 файлов) — Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
- **reverse-engineering-android-malware-with-jadx** (`reverse-engineering-android-malware-with-jadx/`, 4 файлов) — 'Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify
- **reverse-engineering-binary** (`reverse-engineering-binary/`, 1 файлов) — 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O
- **reverse-engineering-cli** (`reverse-engineering-cli/`, 1 файлов) — 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping,
- **reverse-engineering-dotnet-malware-with-dnspy** (`reverse-engineering-dotnet-malware-with-dnspy/`, 4 файлов) — 'Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify
- **reverse-engineering-full** (`reverse-engineering-full/`, 1 файлов) — Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol
- **reverse-engineering-ios-app-with-frida** (`reverse-engineering-ios-app-with-frida/`, 8 файлов) — 'Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract
- **reverse-engineering-kernel** (`reverse-engineering-kernel/`, 1 файлов) — 'Use for kernel-mode reverse engineering: Windows driver analysis, anti-cheat
- **reverse-engineering-malware-with-ghidra** (`reverse-engineering-malware-with-ghidra/`, 4 файлов) — 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and decompiler to understand internal logic,
- **reverse-engineering-mobile** (`reverse-engineering-mobile/`, 1 файлов) — 'Use for mobile app reverse engineering: Android APK analysis, iOS IPA
- **reverse-engineering-obfuscation** (`reverse-engineering-obfuscation/`, 1 файлов) — Use for deobfuscation, unpacking, anti-analysis bypass, code virtualization
- **reverse-engineering-protocol** (`reverse-engineering-protocol/`, 1 файлов) — 'Use for protocol reverse engineering: API reversing, network traffic
- **reverse-engineering-ransomware-encryption-routine** (`reverse-engineering-ransomware-encryption-routine/`, 8 файлов) — Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and
- **reverse-engineering-rust-malware** (`reverse-engineering-rust-malware/`, 7 файлов) — Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated
- **reverse-skill** (`reverse-skill-repo/`, 592 файлов) — >-
- **reverser-pentester** (`reverser-pentester/`, 1 файлов) — Use when you need built-in reverse engineer / pentester — RE бинарников,
## our-skills
- **attio-reverse-engineering** (`our-skills/attio-reverse-engineering/`, 1 файлов) — "Reverse-engineer and integrate Attio CRM (AI models, API, MCP) into OMP — covers internal endpoints, auth, gateway, and provider wiring"
- **devin-architecture-reverse** (`our-skills/devin-architecture-reverse/`, 1 файлов) — "Devin AI agent architecture reverse engineering — binary structure, permission modes, hooks, slash commands, OMP mapping"
- **dotnet-winui3-reverse-engineering** (`our-skills/dotnet-winui3-reverse-engineering/`, 1 файлов) — "Decompile a WinUI 3 / Windows App SDK MSIX-packaged .NET app to C# source + extract XBF resources from PRI"
- **re-roast-2026** (`our-skills/re-roast-2026/`, 2 файлов) — "Use when roasting/verifying a reverse-engineering guide, post, or list of RE tools; fact-checking stars/tool counts; link liveness sweep; cutting hyperbole; splitting content into Telegram messages (4096 limit); or when building/evaluating any 2026 RE stack content: IDA/Ghidra/Binary Ninja, Qiling, OGhidra, AI-RE pipeline, IDA licensing. Triggers: прожарка, реверс, реверсинг, RE, reverse engineering, бинарь, дизассемблер, декомпилятор, проверь ссылки, гайд по реверсу, проверить факты в посте."
- **reverse-winui3-app** (`our-skills/reverse-winui3-app/`, 1 файлов) — "Use when reverse engineering a WinUI 3 / .NET 8 MSIX-packaged Windows application — covers ILSpy decompilation, PRI/XBF extraction, and pkg-compiled Node.js backend identification"
- **reverse-winui3-pkg-app** (`our-skills/reverse-winui3-pkg-app/`, 1 файлов) — "Reverse engineer a WinUI 3 (.NET 8) desktop app with a pkg-compiled Node.js backend: ILSpy decompilation, XBF extraction from resources.pri, pkg payload extraction, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch"
- **vibeproxy-reverse-engineering** (`our-skills/vibeproxy-reverse-engineering/`, 1 файлов) — "Reverse engineer VibeProxy (WinUI 3 .NET 8 MSIX app) — ILSpy decompile, self-contained publish, MSIX repackage, and fork 9router backend"
- **vibeproxy-reverse-pipeline** (`our-skills/vibeproxy-reverse-pipeline/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX staging/sign/install, and design modification with pixel verification"
- **winui3-msix-reverse** (`our-skills/winui3-msix-reverse/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, rebuild with dotnet publish self-contained, overlay original native assets, loose-register without admin, add custom pages"
- **winui3-msix-reverse-rebuild** (`our-skills/winui3-msix-reverse-rebuild/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder"
- **winui3-reverse-engineering** (`our-skills/winui3-reverse-engineering/`, 1 файлов) — "Reverse engineer WinUI 3 / .NET 8 MSIX applications: ILSpy decompilation, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch with modified code"
## research-what-we-did
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline.
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline.
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output.
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values.
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline.
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline.
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output.
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values.
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-en/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline.
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline.
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output.
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values.
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research/`, 2 файлов) — 对目标话题进行初步调研，生成调研outline。用于学术调研、benchmark调研、技术选型等场景。
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/`, 1 файлов) — 向现有调研outline补充字段定义。
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/`, 1 файлов) — 向现有调研outline补充items（调研对象）。
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/`, 1 файлов) — 读取调研outline，为每个item启动独立agent进行深度调研。禁用task output。
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/`, 1 файлов) — 将deep调研结果汇总为markdown报告，覆盖所有字段，跳过不确定值。
## reverse-engineering
- **dsl-vm-reverse** (`reverse-engineering/dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
## reverse-skill-repo
- **competition-ad-certificate-abuse** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ad-certificate-abuse/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AD CS, certificate templates, enrollment rights, EKUs, SAN controls, PKINIT, certificate mapping, and cert-based privilege paths. Use when the user asks about ESC-style abuse, certificate templates, enrollment agents, EKUs, SAN or subject controls, smartcard or PKINIT logon, CA policy, or how an issued cert turns into accepted privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-agent-cloud** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-agent-cloud/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or toolchain, cloud, container, CI/CD, and supply-chain challenges. Use when the user asks to analyze prompt-to-tool flows, retrieval poisoning, mounted secrets, deployment drift, runtime-vs-manifest mismatches, registry provenance, or CI-produced artifacts under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-android-hooking** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-android-hooking/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection, and app trust-boundary analysis. Use when the user asks to hook an APK, inspect signer logic, trace Java or native boundaries, bypass pinning or root checks, inspect shared prefs or app databases, or replay accepted mobile requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-browser-persistence** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-browser-persistence/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches, and client-side session persistence. Use when the user asks to inspect browser state, replay cached auth or session behavior, explain why a page behaves differently after load, or trace how stored client state changes requests, rendering, or access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-bundle-sourcemap-recovery** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-bundle-sourcemap-recovery/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery. Use when the user asks to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-cloud-metadata-path** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-cloud-metadata-path/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance identity, workload identity, link-local credential paths, role assumption, and metadata-to-privilege trust edges. Use when the user asks to inspect metadata-service access, instance credentials, pod or workload identity, link-local token paths, SSRF-to-metadata escalation, or explain how metadata-derived credentials turn into accepted cloud or control-plane privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-container-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-container-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift, and route-to-container resolution. Use when the user asks why a live container differs from manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-crypto-mobile** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-crypto-mobile/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or replay mobile request-signing logic. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-custom-protocol-replay** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-custom-protocol-replay/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums, stateful replay, and accepted-session reproduction. Use when the user asks to decode an unknown protocol, recover custom framing, build a replay harness, satisfy sequence or checksum rules, replay a captured session, or prove the smallest message order that reaches an accepted branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-dpapi-credential-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-dpapi-credential-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and secret-to-acceptance replay chains. Use when the user asks to inspect DPAPI blobs or masterkeys, recover browser or vault credentials, trace DPAPI context or backup-key use, or explain how protected Windows secrets become accepted access or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-file-parser-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-file-parser-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and deserialization chains. Use when the user asks to inspect an upload or import path, trace archive extraction, preview or converter behavior, explain how a file reaches a parser or deserializer, or connect one uploaded artifact to the decisive backend effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-firmware-layout** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-firmware-layout/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs, and device-facing trust boundaries. Use when the user asks to unpack firmware, map partition layout, inspect bootloader or init chains, recover update keys or credentials, trace config loading, or explain how a device surface reaches the decisive artifact. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-forensic-timeline** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-forensic-timeline/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-graphql-rpc-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-graphql-rpc-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift, hidden operations, and contract-to-handler mismatches. Use when the user asks to inspect GraphQL or RPC requests, compare client contracts to live handlers, recover hidden operations, trace generated clients, or explain how schema or contract drift produces the decisive behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-identity-windows** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-identity-windows/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-ios-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ios-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery. Use when the user asks to hook an IPA, trace Objective-C or Swift runtime behavior, inspect Keychain or plist state, bypass pinning, analyze deeplinks or universal links, or replay accepted iOS requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-jwt-claim-confusion** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-jwt-claim-confusion/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims, or explain how a token becomes accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-k8s-control-plane** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-k8s-control-plane/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-kerberos-delegation** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-kerberos-delegation/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges, S4U abuse, RBCD, constrained or unconstrained delegation, and service-ticket acceptance. Use when the user asks about constrained delegation, unconstrained delegation, RBCD, S4U, SPNs, ticket acceptance, or how a Kerberos trust edge turns into effective privilege under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-kernel-container-escape** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-kernel-container-escape/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and escape primitive verification. Use when the user asks to analyze container-to-host escape paths, kernel exploit prerequisites, namespace crossover, capability misuse, or prove whether an exploit primitive crosses the sandbox boundary. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-linux-credential-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-linux-credential-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust, and host-to-host pivot chains. Use when the user asks to trace Linux auth artifacts, accepted token or key replay, socket or service-account trust edges, sudo or capability abuse, or explain lateral movement across Linux challenge nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-lsass-ticket-material** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-lsass-ticket-material/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction. Use when the user asks to inspect LSASS memory, recover tickets or logon sessions, trace DPAPI or SSP material, distinguish which credential artifacts are replayable, or connect host-resident credential material to an accepted pivot or privilege edge. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-mailbox-abuse** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-mailbox-abuse/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects. Use when the user asks to trace mailbox rules, OAuth consent grants, forwarding or delegate abuse, shared mailbox access, message-trace evidence, or explain how mail artifacts turn into persistence, exfiltration, or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-malware-config** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-oauth-oidc-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-oauth-oidc-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-pcap-protocol** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-pcap-protocol/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-prompt-injection** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-prompt-injection/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-queue-worker-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-queue-worker-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-race-condition-state-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-race-condition-state-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-relay-coercion-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-relay-coercion-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains, target selection, NTLM or related acceptance paths, and coercion-to-privilege transitions. Use when the user asks to trace a coercion primitive, follow a relay path, analyze forced authentication, determine which service accepts relayed auth, or connect a coercion step to resulting privilege, enrollment, or code execution. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-request-normalization-smuggling** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-reverse-pwn** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-reverse-pwn/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-runtime-routing** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-runtime-routing/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-ssrf-metadata-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ssrf-metadata-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-stego-media** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-stego-media/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for image, audio, video, document, and container steganography. Use when the user asks to inspect metadata, alpha or palette channels, LSBs, thumbnails, appended trailers, QR fragments, transcoding artifacts, or recover a hidden payload from media without blind brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-supply-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-supply-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-template-render-path** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-template-render-path/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSR, template rendering, route loaders, hydration payloads, server-client render boundaries, and template-to-handler enforcement gaps. Use when the user asks to inspect SSR or template routes, trace render context or hydration data, compare template gating with handler enforcement, explain preview or hidden-route rendering, or connect render pipeline behavior to the decisive branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-web-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-web-runtime/`, 4 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-websocket-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-websocket-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for WebSocket and SSE handshakes, auth material, subscription state, realtime message schemas, reconnect behavior, and frame-driven runtime effects. Use when the user asks to inspect a WebSocket or SSE handshake, decode frames, trace subscriptions, follow reconnect logic, inspect auth material sent during realtime setup, or explain how live frames change rendered or persisted state. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-windows-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-windows-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **competition-zip-archive** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-zip-archive/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for ZIP and PKZIP archive challenges, legacy ZipCrypto identification, known-plaintext recovery with bkcrack, key-based decryption, and reproducible extraction. Use when the user asks to solve an encrypted ZIP challenge, inspect ZipCrypto metadata, recover keys from a known file prefix, or unlock an archive without starting with password brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
- **ctf-sandbox-orchestrator** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/`, 10 файлов) — Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence.
- **reverse-skill-router** (`reverse-skill-repo/skills/`, 349 файлов) — Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
- **api-security** (`reverse-skill-repo/skills/api-security/`, 3 файлов) — Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
- **apk-reverse** (`reverse-skill-repo/skills/apk-reverse/`, 12 файлов) — 在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
- **attack-chain** (`reverse-skill-repo/skills/attack-chain/`, 4 файлов) — Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.
- **binary-diff** (`reverse-skill-repo/skills/binary-diff/`, 2 файлов) — |
- **browser-automation** (`reverse-skill-repo/skills/browser-automation/`, 3 файлов) — |
- **browser-extension-reverse** (`reverse-skill-repo/skills/browser-extension-reverse/`, 2 файлов) — Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
- **case-review** (`reverse-skill-repo/skills/case-review/`, 3 файлов) — Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
- **cloud-k8s** (`reverse-skill-repo/skills/cloud-k8s/`, 2 файлов) — Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
- **code-audit** (`reverse-skill-repo/skills/code-audit/`, 2 файлов) — Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
- **database-security** (`reverse-skill-repo/skills/database-security/`, 2 файлов) — Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
- **diagram-generator** (`reverse-skill-repo/skills/diagram-generator/`, 6 файлов) — generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.
- **digital-forensics** (`reverse-skill-repo/skills/digital-forensics/`, 2 файлов) — Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
- **docs-generator** (`reverse-skill-repo/skills/docs-generator/`, 4 файлов) — |
- **dotnet-reverse** (`reverse-skill-repo/skills/dotnet-reverse/`, 4 файлов) — .NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
- **edr-bypass-re** (`reverse-skill-repo/skills/edr-bypass-re/`, 4 файлов) — |
- **email-security** (`reverse-skill-repo/skills/email-security/`, 2 файлов) — Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
- **firmware-pentest** (`reverse-skill-repo/skills/firmware-pentest/`, 4 файлов) — |
- **ghidra-reverse** (`reverse-skill-repo/skills/ghidra-reverse/`, 2 файлов) — Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
- **go-rust-reverse** (`reverse-skill-repo/skills/go-rust-reverse/`, 2 файлов) — Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
- **hardware-security** (`reverse-skill-repo/skills/hardware-security/`, 2 файлов) — Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.
- **ida-reverse** (`reverse-skill-repo/skills/ida-reverse/`, 4 файлов) — |
- **identity-federation** (`reverse-skill-repo/skills/identity-federation/`, 2 файлов) — Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
- **js-reverse** (`reverse-skill-repo/skills/js-reverse/`, 13 файлов) — 在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
- **llm-security** (`reverse-skill-repo/skills/llm-security/`, 5 файлов) — Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
- **macos-reverse** (`reverse-skill-repo/skills/macos-reverse/`, 2 файлов) — Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
- **malware-analysis** (`reverse-skill-repo/skills/malware-analysis/`, 4 файлов) — Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
- **mobile-reverse** (`reverse-skill-repo/skills/mobile-reverse/`, 4 файлов) — Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
- **ot-ics** (`reverse-skill-repo/skills/ot-ics/`, 2 файлов) — Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
- **patch-diff-exploit** (`reverse-skill-repo/skills/patch-diff-exploit/`, 4 файлов) — |
- **pentest-tools** (`reverse-skill-repo/skills/pentest-tools/`, 111 файлов) — |
- **src-hunter** (`reverse-skill-repo/skills/pentest-tools/src-hunter/`, 90 файлов) — 实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。
- **protocol-reverse** (`reverse-skill-repo/skills/protocol-reverse/`, 2 файлов) — Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
- **pwn-chain** (`reverse-skill-repo/skills/pwn-chain/`, 4 файлов) — |
- **radare2** (`reverse-skill-repo/skills/radare2/`, 4 файлов) — |
- **radio-sdr** (`reverse-skill-repo/skills/radio-sdr/`, 2 файлов) — Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
- **reverse-engineering** (`reverse-skill-repo/skills/reverse-engineering/`, 24 файлов) — Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
- **dsl-vm-reverse** (`reverse-skill-repo/skills/reverse-engineering/dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
- **supply-chain-security** (`reverse-skill-repo/skills/supply-chain-security/`, 3 файлов) — Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
- **thick-client** (`reverse-skill-repo/skills/thick-client/`, 2 файлов) — Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
- **threat-hunting** (`reverse-skill-repo/skills/threat-hunting/`, 2 файлов) — Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
- **wifi-wireless** (`reverse-skill-repo/skills/wifi-wireless/`, 2 файлов) — Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
- **windows-ad** (`reverse-skill-repo/skills/windows-ad/`, 2 файлов) — Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.

99
README.md Normal file
View File

@@ -0,0 +1,99 @@
# 🩸 REVERSE-ENGINEERING SKILLS MAX
Максимальный пак реверс-инженерных скиллов для AI-агентов: **422 SKILL.md, ~2236 файлов, ~31 МБ** — только RE-полезное, супер-мусор (compliance/SOC/game-modding/MCP-docker) вычищен. Работает в Claude Code, Codex, Cursor, Gemini CLI, Hermes Agent, OMP — везде, где агент читает `SKILL.md`.
Очищено: личные данные, токены, ключи, .git-метаданные и бинарники удалены. Собрано и верифицировано: сентябрь–октябрь 2026 (vendor-new: deep-research 14.10.2026, секрет-свип 0 хитов). Ссылки в гайде проверены свипом (102/102 живы на 26.09.2026).
## 🗺 Что куда юзать
**`USE-MAP.md`** — роутер по задачам: цель (PE/kernel/.NET/APK/iOS/ELF/Mach-O/Go/Rust/ARM/firmware/JS/Web) → конкретные скиллы; этапы (триаж→распаковка→статика→динамика→анти-анализ→шеллкоды→конфиги→память→YARA→отчёт); какие MCP подключать; золотой пайплайн.
## Состав
| Директория | Что внутри |
|---|---|
| `reverse-skill-repo/` | Роутер [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (37.9K⭐, MIT): маршрутизация задач apk / ida / radare2 / binary-ninja / dotnet / js / malware, CTF-Sandbox-Orchestrator (40+ competition-сценариев), pentest-tools (src-hunter), field-journal, kali-скрипты |
| `our-skills/` | 12 боевых скиллов из реальной практики: **rea-full-course (REA/MCP реверс-курс: установка, движки, guided-воркфлоу, пак промтов)** + исходник курса в `research-what-we-did/rea-full-course-source.md`, WinUI3/MSIX-реверс и пересборка (×5), .NET WinUI3, Attio CRM reverse, Devin IDE architecture reverse, VibeProxy reverse (×2), re-roast-2026 (факт-чекер RE-контента с linkcheck) |
| `research-what-we-did/` | Наши исследования: RE-отчёт DarkTelegram.pro (только публичные JS-бандлы, без кредов), прожарка вирусного RE-гайда (оригинал → верифицированная v4), forum-reversing дневники, Deep-Research-skills (MIT) |
| `reverse-engineering*/` (16 паков) | Отдельные скиллы: android-malware + jadx, dotnet-malware + dnSpy, iOS + Frida, kernel, ransomware encryption routines, rust-malware, ghidra-malware, binary, cli, full, mobile, obfuscation, protocol, firmware, dsl-vm |
| `reverser-pentester/` | Связка реверс + пентест |
| `vendor-new/` | **9 курированных коллекций** (deep-research 14.10, отфильтровано от мусора): Anthropic-Cybersecurity-Skills (**35 из 820** — только malware-analysis/RE), analyst-ai-pack (**~80 из 119** — malware RE без threat-hunting/SOC), rev-skills (143, firmware/protocol/unpacking), win-dev-skills (11, официальный WinDbg от Microsoft), xbsReverseSkill (33, JS-реверс CN), android-RE (SimoneAvogadro), apk-reverse (7), malware-analysis (5), js-reverse-automation. Вырезано: universal-modder (game), mcp-security-hub (docker), security-audit, spider-king, SOC/compliance/GRC (783+39 скиллов). Каталог: `research-what-we-did/EXTERNAL-CATALOG.md` |
## Гайд «РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: 2026»
Полный верифицированный гайд (4 части): `research-what-we-did/rev-guide-v4.md` (по частям — `rev_guide/p1..p4.md`). Опубликован: https://telegra.ph/Reverse-09-30
Карта пути:
1. **База** — C, ассемблер x86-64, Compiler Explorer, формат PE
2. **Инструменты** — Ghidra (+Ghidrathon), x64dbg, Detect It Easy, HxD; позже IDA Pro, Binary Ninja, radare2/rizin+Cutter
3. **Практика** — crackmes.one (15–20 задач 1☆ → 2☆ → 3☆), ROP Emporium
4. **Система** — pwn.college, OpenSecurityTraining2, RE-MA-Roadmap
5. **Пайплайн анализа** — DIE/FLOSS/capa триаж → распаковка (x64dbg+Scylla / de4dot+dnSpyEx / Qiling) → статика (Ghidra/IDA) → динамика (Frida) → деобфускация (D-810, Unicorn, angr) → поведение (FakeNet-NG, CAPEv2, Speakeasy) → диффинг (BinDiff/Diaphora) → YARA + отчёт
6. **Реверс через ИИ** — MCP-серверы (ida-pro-mcp, GhidraMCP, ghidra-mcp 200+ тулов, r2ai, x64dbg-mcp, cheatengine-mcp-bridge, jadx-ai-mcp, Arkana 250+ тулов...) + скиллы + агенты (agentic-malware-analysis, auto-re-agent, reverify)
7. **Специализация** — малварь (PMAT), прошивки (binwalk v3, EMBA), Android (jadx+apktool), CTF
## Установка
```bash
# Claude Code
cp -r reverse-skill-repo/skills/* ~/.claude/skills/
cp -r our-skills/* ~/.claude/skills/
# Hermes Agent — в skills-директорию профиля
# Codex / Cursor / Gemini CLI — по их skills-конвенции (AGENTS.md / .cursor/rules)
```
Перед установкой чужих скиллов прогони их через [SkillSpector](https://github.com/NVIDIA/SkillSpector) — скиллы бывают с промпт-инъекциями.
## Ограничения AI-реверса (проверено на практике)
- Агент уверенно ошибается в именах функций — крипто, C2, авторизацию проверяй руками
- Упакованный сэмпл = слабый псевдокод; распаковывай до подачи агенту
- Строки в бинарнике работают как промпт-инъекция против RE-агента ([arXiv:2605.30667](https://arxiv.org/abs/2605.30667))
## Attribution
- [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) — MIT © 2026 zhaoxuya520
- Deep-Research-skills — MIT © 2026 Lan Zheng
- vendor-new/ — лицензии каждого вендора в его `LICENSE` (Apache-2.0/MIT/BSD-3), полный список в `research-what-we-did/EXTERNAL-CATALOG.md`
- Отдельные паки `reverse-engineering-*` — лицензии в соответствующих `LICENSE`
- Отчёт DarkTelegram.pro — только публичные ассеты, без обхода авторизации
## Каталог скиллов
- dsl-vm-reverse/
- firmware-reversing/
- our-skills/attio-reverse-engineering/
- our-skills/devin-architecture-reverse/
- our-skills/dotnet-winui3-reverse-engineering/
- our-skills/re-roast-2026/
- our-skills/rea-full-course/
- our-skills/reverse-winui3-app/
- our-skills/reverse-winui3-pkg-app/
- our-skills/vibeproxy-reverse-engineering/
- our-skills/vibeproxy-reverse-pipeline/
- our-skills/winui3-msix-reverse/
- our-skills/winui3-msix-reverse-rebuild/
- our-skills/winui3-reverse-engineering/
- protocol-reverse-engineering/
- research-what-we-did/Deep-Research-skills/skills/ (research-codex-en/zh, research-en/zh × 5 модулей)
- reverse-engineering/
- reverse-engineering-android-malware-with-jadx/
- reverse-engineering-binary/
- reverse-engineering-cli/
- reverse-engineering-dotnet-malware-with-dnspy/
- reverse-engineering-full/
- reverse-engineering-ios-app-with-frida/
- reverse-engineering-kernel/
- reverse-engineering-malware-with-ghidra/
- reverse-engineering-mobile/
- reverse-engineering-obfuscation/
- reverse-engineering-protocol/
- reverse-engineering-ransomware-encryption-routine/
- reverse-engineering-rust-malware/
- reverse-skill-repo/CTF-Sandbox-Orchestrator/ (42 competition-сценария: ad-certificate-abuse, android-hooking, dpapi-credential-chain, kerberos-delegation, kernel-container-escape, lsass-ticket-material, malware-config, oauth-oidc-chain, prompt-injection, reverse-pwn, ssrf-metadata-pivot, supply-chain, ...)
- reverse-skill-repo/skills/ (api-security, apk-reverse, attack-chain, binary-diff, browser-automation, browser-extension-reverse, cloud-k8s, code-audit, database-security, digital-forensics, dotnet-reverse, edr-bypass-re, email-security, firmware-pentest, ghidra-reverse, go-rust-reverse, hardware-security, ida-reverse, identity-federation, js-reverse, llm-security, macos-reverse, malware-analysis, mobile-reverse, ot-ics, patch-diff-exploit, pentest-tools+src-hunter, protocol-reverse, pwn-chain, radare2, radio-sdr, supply-chain-security, thick-client, threat-hunting, wifi-wireless, windows-ad)
- reverser-pentester/
👻 [иишко](https://t.me/AlStack)

51
USE-MAP.md Normal file
View File

@@ -0,0 +1,51 @@
# 🗺 ЧТО КУДА ЮЗАТЬ — роутер по задачам
## Агentic-инструмент №1
**REA** (`our-skills/rea-full-course/`) — «реверси что угодно»: Electron/JS бандлы, APK, EVM, Go/Rust. Ставится `npx rea-agents@latest setup` в Claude Code/Codex/Cursor/Hermes. Полный курс: `research-what-we-did/rea-full-course-source.md`.
## По типу цели
| Цель | Скиллы/тулзы |
|---|---|
| Windows PE (user-mode) | `reverse-engineering-malware-with-ghidra` (top-level) + `win-dev-skills/windbg-user-*` (TTD reverse debugging, heap corruption) + `performing-static-malware-analysis-with-pe-studio` |
| Windows kernel/драйверы | `win-dev-skills/windbg-kernel-*` + `analyzing-windows-driver-malware` + `dissecting-boot-and-kernel-rootkits` (analyst-ai-pack) |
| .NET | `reverse-engineering-dotnet-malware-with-dnspy` + `analyzing-dotnet-malware-internals` |
| Android APK | `android-reverse-engineering-skill` (SimoneAvogadro, jadx/Frida end-to-end) + `apk-reverse` (7 скиллов: unpacking, dex2jar) + `analyzing-android-malware-with-apktool` + `analyzing-android-dex-malware` |
| iOS | `reverse-engineering-ios-app-with-frida` |
| Linux ELF | `analyzing-elf-binaries-on-linux` + `analyzing-linux-elf-malware` + `analyzing-linux-kernel-rootkits` |
| macOS Mach-O | `analyzing-mach-o-binaries-on-macos` |
| Go / Rust / Nim / exotic | `analyzing-golang-malware-with-ghidra`, `reverse-engineering-rust-malware`, `analyzing-rust-malware-internals`, `reverse-engineering-nim-and-other-exotic-binaries` |
| ARM | `reverse-engineering-arm-binaries` |
| Прошивки / UEFI / PLC / embedded | `rev-skills/` (143 скилла: binwalk, EMBA, чипы, протоколы) + `performing-firmware-extraction-with-binwalk` + `auditing-uefi-firmware-with-chipsec` + `performing-plc-firmware-security-analysis` + `analyzing-uefi-bootkit-persistence` |
| JS/Web реверс (сигнатуры сайтов) | `xbsReverseSkill/` (33: xiaohongshu/bilibili/douyin, wasm, sign-алгоритмы) + `js-reverse-automation--skill` + `deobfuscating-javascript-malware` |
| Офис/PDF/скрипты | `analyzing-macro-malware-in-office-documents`, `analyzing-pdf-malware-with-pdfid`, `deobfuscating-powershell-obfuscated-malware`, `analyzing-malicious-*` (analyst-ai-pack) |
## По этапу работы
| Этап | Чем |
|---|---|
| Триаж образца | `triaging-an-unknown-sample`, `identifying-file-types-and-formats`, `measuring-section-entropy-to-detect-packing`, `extracting-and-classifying-strings`, capa: `generating-capability-reports-with-capa` |
| Распаковка | `manually-unpacking-a-packed-binary`, `unpacking-upx-and-common-packers`, `analyzing-packed-malware-with-upx-unpacker`, `dumping-and-rebuilding-a-pe-from-memory` |
| Статика | Ghidra: `scripting-ghidra-headless-analysis` · IDA: `scripting-ida-with-idapython` · r2/rizin: `reverse-engineering-binaries-with-radare2-rizin`, `automating-analysis-with-r2pipe` · Binary Ninja: `reverse-engineering-binaries-with-binary-ninja` |
| Динамика | `performing-dynamic-analysis-in-a-sandbox`, `analyzing-malware-behavior-with-cuckoo-sandbox`, `performing-automated-malware-analysis-with-cape`, `debugging-malware-with-x64dbg`, `monitoring-process-and-file-behavior`, lab: `setting-up-an-isolated-malware-analysis-lab` |
| Анти-анализ | `identifying-anti-debugging-techniques`, `bypassing-anti-vm-and-sandbox-checks`, `detecting-sandbox-evasion-behavior`, `defeating-control-flow-flattening`, `defeating-string-and-api-obfuscation` |
| Шеллкоды/инъекции | `emulating-shellcode-with-unicorn`, `reverse-engineering-shellcode`, `recovering-injected-code-and-shellcode`, `resolving-dynamic-api-hashing`, `analyzing-position-independent-code`, `analyzing-heap-spray-exploitation` |
| Конфиги/C2/ключи | `building-config-extractors`, `decrypting-embedded-configuration`, `extracting-config-from-a-running-sample`, `extracting-encryption-keys-from-binaries`, `extracting-cobalt-strike-beacon-config`, `reverse-engineering-custom-c2-protocols`, `analyzing-cobalt-strike-beacon-configuration` |
| Память | `performing-memory-forensics-with-volatility3(+plugins)`, `analyzing-memory-dumps-with-volatility`, `analyzing-malware-in-memory-with-volatility3`, `detecting-process-injection-in-memory` |
| Символьное исполнение | `solving-malware-with-symbolic-execution` |
| Дифф/патч | `diffing-malware-samples-to-find-changes`, `patch-diffing-with-bindiff-and-diaphora` |
| YARA/детекты | `writing-yara-rules-from-reversed-code`, `scanning-samples-with-yara`, `performing-malware-triage-with-yara`, `performing-yara-rule-development-for-detection` |
| Отчёт | `writing-a-malware-analysis-report`, `performing-full-scope-malware-analysis` |
| CTF | `CTF-Sandbox-Orchestrator` (42 сценария) |
| Пентест-интеграция | `reverser-pentester`, `pentest-tools/src-hunter` |
## MCP-серверы для агента (что подключать)
- **REA** — универсальный (Electron/Ghidra/JADX/EVM) — `our-skills/rea-full-course`
- **ida-pro-mcp** — IDA GUI-attached (`~/.idapro/mcp.json`)
- **GhidraMCP / ghidra-mcp** — Ghidra headless/GUI
- **x64dbg-mcp / r2ai** — динамика Windows / r2
- Каталог + пробы: `research-what-we-did/mcp-catalogs.md`
## Золотой пайплайн (malware-образец)
DIE/entropy/strings триаж → распаковка → статика (Ghidra/IDA) → динамика (sandbox/x64dbg/Frida) → деобфускация → behavior/конфиг-экстрактор → diff с известными → YARA + отчёт
---
👻 [ииШко](https://t.me/AlStack)

380
dsl-vm-reverse/SKILL.md Normal file
View File

@@ -0,0 +1,380 @@
---
name: dsl-vm-reverse
description: Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
---
# 🔄 DSL 自定义虚拟机逆向（DSL VM Reverse Engineering）
## ACTION REQUIRED（读完后立刻执行）
1. `NOW`: 确认当前任务是自定义 JS opcode VM / 风控引擎，不是标准 WASM 或普通 webpack
2. `NOW`: `case-init` 直到 `scope.md` 就绪；离线样本用 `offline` / `lab`
3. `ACT`: 从「3. 通用逆向工作流」Phase 1 做文件分类，不要停在目录
> 用于逆向基于 JavaScript 实现的自定义 WASM 虚拟机/风控引擎
---
## 目录
- [1. 适用范围](#1-适用范围)
- [2. DSL VM 识别特征](#2-dsl-vm-识别特征)
- [3. 通用逆向工作流](#3-通用逆向工作流)
- [4. Opcode 提取与分类](#4-opcode-提取与分类)
- [5. 运行时捕获方案](#5-运行时捕获方案)
- [6. 常见状态码](#6-常见状态码)
- [7. Skill 自检清单](#7-skill-自检清单)
---
## 1. 适用范围
当目标文件符合以下 **任意特征** 时使用本 skill：
| # | 特征 | 说明 |
|---|------|------|
| 1 | IIFE 开头 + 大量单字母变量名 | `!function(){var U=void 0,y=parseInt,E0=Function,...}` |
| 2 | 包含 `DG()` 或类似函数含 switch-case 循环 | 解释器主循环，`d[7]&31` 解码 opcode |
| 3 | 大文件（500KB+）但零字节占比 < 1% | 非标准 WASM，纯 JS |
| 4 | 包含 `C[number]` 常量表引用 | `C[9][xxx]` 函数表/字符串表 |
| 5 | 单行压缩代码 | 583KB 单行，混淆变量名 |
### 排除规则
| 条件 | 非本 skill | 转至 |
|------|-----------|------|
| 文件以 `\x00asm` 开头 | 标准 WASM 二进制 | `reverse-engineering/languages.md` |
| 文件以 `Uint8Array([0,97,115,109])` 含 WASM 魔术字 | WASM 嵌入式 | 提取 .wasm 后转 IDA/Ghidra |
| 标准 Webpack 打包（`function(e,t,n){...}`） | 普通 JS | `js-reverse/` |
| 零字节占比 > 20% | WASM 二进制 | `reverse-engineering/languages.md` |
---
## 2. DSL VM 识别特征
### 代码特征
```javascript
// 特征 1: IIFE 入口，单字母变量映射数字常量
!function(){
var U=void 0, y=parseInt, E0=Function, AN=Uint8Array;
var E=15, l=10, m=12, x=16, S=13, $=11;
// 数字常量映射为变量名，替代原始数字
...
}
// 特征 2: 解释器主循环 DG()
function DG(C, d, ...) {
var d = []; // 数组模拟 WASM stack/locals
for (d[7] = x; d[7] !== U;) {
var aE = d[7] & 31; // 低 5 位 = opcode
var O = d[7] >> 5 & 31; // 高 5 位 = sub-operation
switch (aE) {
case 0: /* ... */ d[7] = 612; break;
case 1: /* ... */
// ... N 个 case
}
}
}
// 特征 3: 常量表 C[9] 存储函数索引和字符串
// C[9][0] = ["pc"] → 函数参数描述
// C[9][667] = "string" → 字符串常量
// C[9][x] = number → 函数索引
// 特征 4: W(C[index], null, ...) 调用模式
// W = Function.prototype.call.bind(call)
// 所有内置函数通过 C[index] 索引调用
// 特征 5: 指令编码格式
// d[7] = opcode(bit 0-4) | subop(bit 5-9) | operand(bit 10+)
```
### Opcode 编码格式
每条指令编码为 32 位整数：
```
bit 0-4: opcode (0-N)
bit 5-9: sub-operation (0-31)
bit 10-31: operand/立即数
解码:
aE = d[7] & 31 → opcode
O = d[7] >> 5 & 31 → sub-operation
d[other] = d[7] >> 10 → operand
```
---
## 3. 通用逆向工作流
### Phase 1: 文件分类（5 分钟）
```bash
# 检查是否为 DSL VM
python3 << 'EOF'
with open('target.js', 'rb') as f:
head = f.read(100)
# 1. 检查 WASM 魔术字
if head[:4] == b'\x00asm':
print("标准 WASM 二进制")
exit()
# 2. 检查零字节占比
data = open('target.js', 'rb').read()
zero_pct = data.count(b'\x00') / len(data) * 100
print(f"零字节占比: {zero_pct:.1f}%")
if zero_pct > 20:
print("WASM 二进制")
elif head[:2] == b'!f':
# 检查单字母变量模式
if b'var U=void 0' in head or b'U=void 0,y=parseInt' in head:
print("→ DSL VM!")
else:
print("普通 JS IIFE")
EOF
```
### Phase 2: 变量映射表提取（10 分钟）
```python
import re
with open('target.js', 'r', errors='replace') as f:
s = f.read()
# 提取开头 2000 字符的 var X=数字 映射
mappings = re.findall(r'var\s+(\w+)\s*=\s*(\d+)', s[:2000])
print('常量映射:')
for name, val in mappings:
print(f" {name:4s} = {val:3d} (0x{int(val):02x})")
```
### Phase 3: Opcode 提取与分类（15 分钟）
```python
# 1. 提取所有 case
all_cases = re.findall(r'case\s+(\d+):', s)
unique = sorted(set(int(c) for c in all_cases))
print(f"总 case: {len(all_cases)} 个")
print(f"唯一 opcode: {len(unique)} 个: {unique}")
# 2. 分类每个 opcode
for op in unique:
idx = s.find(f'case {op}:')
snippet = s[idx:idx+200]
if 'd[7]=' in snippet:
op_type = 'BRANCH'
elif 'return' in snippet:
op_type = 'RETURN'
elif 'W(C[' in snippet:
op_type = 'CALL'
elif 'new' in snippet:
op_type = 'ALLOC'
elif 'try' in snippet or 'catch' in snippet:
op_type = 'EXCEPTION'
else:
op_type = 'ARITH/STORE'
print(f" opcode {op:2d}: {op_type}")
```
### Phase 4: 常量表分析（30 分钟）
```python
const_refs = re.findall(r'C\[9\]\[(\d+)\]', s)
unique_refs = sorted(set(int(x) for x in const_refs))
print(f"C[9] 引用: {len(unique_refs)} 个索引")
print(f"范围: {min(unique_refs)} - {max(unique_refs)}")
# 对每个引用分析上下文
for ref in unique_refs[:20]:
idx = s.find(f'C[9][{ref}]')
ctx = s[max(0,idx-50):idx+80]
clean = ''.join(c if c.isprintable() else ' ' for c in ctx)
print(f" C[9][{ref}] → {clean}")
```
### Phase 5: 导出函数追踪（1-2 小时）
导出函数（如 `getToken`）通过以下路径定位：
```
1. 找 AWSCInner.register() 或类似注册调用
2. 确定注册的模块和工厂函数
3. 找工厂函数返回的对象 → 导出函数定义位置
4. 若函数名不在 JS 中 → 在 C[9] 常量表中作字节码存储
5. 追踪调用链:
AWSCInner._modules['fy'].getToken()
→ W(C[函数索引], null, ...)
→ DG() 解释器执行编码后的指令序列
```
### Phase 6: 运行时注入（若纯静态分析不够）
```javascript
// 注入最小 AWSC 兼容环境
const fakeEnv = {
AWSCInner: {
_modules: {},
register(name, moduleName, factory) {
this._modules[moduleName] = factory();
}
}
};
// 执行 DSL VM 代码
dslVmCode();
// 获取导出
const token = fakeEnv.AWSCInner._modules['fy'].getToken({});
```
---
## 4. Opcode 提取与分类
### 参考 opcode 对照表（基于已有案例）
| Opcode | 操作类型 | 特征 |
|--------|---------|------|
| 0 | **BRANCH** | `d[7]=xxx` 无条件跳转 |
| 1 | **CALL** | `W(C[Y],null,function(){...})` 嵌入函数调用 |
| 2 | **ARITH** | `d[4]=0`, `d[7]=72` 变量赋值 |
| 3 | **ARITH** | `d[0]=d[1][C[x]]`, `d[5]=d[0]<d[3]` 比较运算 |
| 4 | **STORE** | `d[8]=d[5]in d[4]` 属性访问/存在检查 |
| 5 | **ARITH** | `d[8]=d[4]-d[8]` 算术运算 |
| 6 | **RETURN** | `return gV`, `throw` 返回/抛出异常 |
| 7 | **ALLOC** | `d[6]=[]`, `d[6][C[8]](...)` push 操作 |
| 8 | **BRANCH** | `d[7]=d[k]?512:425` 条件跳转 |
| 9 | **STRING** | `d[6][C[t]]=d[m]`, `new fh(...)` 正则 |
| 10 | **ALLOC** | 函数参数准备、调用栈创建 |
| 11 | **STRING** | `new fh("\\s",d[5])` 正则匹配 |
| 12 | **STORE** | `P[d[9]]=d[4][C[H]](d[3])` 数据传递 |
| 13 | **CALL** | `C[9][113]=d[9]` 模块初始化 |
| 14 | **STRING** | `d[8]=d[9]+d[m]` 字符串拼接 |
| 15 | **RETURN** | `return EL;` 函数返回 |
| 16 | **ALLOC** | `var r,P,Z,B...` 局部变量声明 |
| 17 | **ALLOC** | `(Z=[])[C[8]](69,T,445)` 静态数组初始化 |
| 18 | **TABLE** | 函数表/类型表初始化 |
| 19 | **EXCEPTION** | `try{for(var RK=x;...` try-catch 循环 |
| 20 | **DOM** | `Is[d[o]]` DOM 操作 |
| 21 | **STORE** | 安全获取全局/对象属性 |
| 22 | **STRING** | `new fh(r,v)` 字符串/正则处理 |
| 23 | **BRANCH** | `try...catch` 安全获取 + 条件跳转 |
| 24 | **CALL** | `W(C[2],null,8,z,FL)` 多参数函数调用 |
| 25 | **EXCEPTION** | `try{...}catch(C){...}` 异常捕获 + 跳转 |
---
## 5. 运行时捕获方案
### 方案 A: Selenium + CDP 原生事件（推荐，成功率最高）
```python
from selenium import webdriver
driver = webdriver.Chrome()
# 注入反检测
driver.execute_cdp_cmd("Page.addScriptToEvaluateOnNewDocument", {
"source": r"""
Object.defineProperty(navigator, 'webdriver', {get: () => false});
Object.defineProperty(navigator, 'plugins', {get: () => [1,2,3,4,5]});
Object.defineProperty(navigator, 'languages', {get: () => ['zh-CN','zh','en']});
"""
})
# 发送 CDP 原生鼠标事件
driver.execute_cdp_cmd("Input.dispatchMouseEvent", {
"type": "mousePressed",
"x": 549.5, "y": 441.2,
"button": "left", "buttons": 1,
"clickCount": 1, "pointerType": "mouse"
})
```
### 方案 B: Playwright 无头浏览器
```javascript
const { chromium } = require('playwright');
async function run() {
const browser = await chromium.launch();
const page = await browser.newPage();
// 拦截网络请求
await page.route('**/api/**', async route => {
await route.continue_();
});
await page.goto('https://target-page.com');
// 等待 DSL VM 初始化
await page.waitForFunction(() => {
return window.AWSCInner &&
window.AWSCInner._modules &&
window.AWSCInner._modules['fy'];
});
// 执行操作
await page.mouse.move(500, 400);
await page.mouse.down();
// ... 操作序列
await page.mouse.up();
}
```
### 方案 C: 纯协议验证（成功率极低）
> DSL VM 生成的 token 通常与浏览器上下文强绑定（TLS JA3 指纹、IP、Cookie、请求头等），脱离浏览器后服务端可检测到上下文不匹配。**不建议使用纯协议方案**。
---
## 6. 常见状态码
| Code | 含义 | 处理 |
|------|------|------|
| 0 | **验证通过** ✅ | 取出 sessionId + sig |
| 300 | **风控拦截** | 被拦截，无法通过 |
| 8778 | **验证失败，需重试** | 重试操作 |
| 8776 | **操作太快，需重试** | 增加延迟后重试 |
| 69634 | **通用失败** | 检查参数是否正确 |
---
## 7. Skill 自检清单
- [ ] 我是否完成了 DSL VM 识别（IIFE + 单字母变量 + DG() 解释器）？
- [ ] 我是否提取了变量映射表（`var X=数字`）？
- [ ] 我是否提取了 opcode 列表并分类？
- [ ] 我是否分析了常量表 C[9] 的引用范围？
- [ ] 我是否定位了导出函数注册点？
- [ ] 纯静态分析不够时，我是否尝试了运行时注入方案？
- [ ] 任务完成后是否回写了 field-journal？
- [ ] 是否发现新工具/新场景 → 更新 routing.md？
---
## 路由注册
| 类型 | 路由 |
|------|------|
| **目标类型**: WASM / DSL VM / 自定义指令集 | `reverse-engineering/dsl-vm-reverse/SKILL.md` |
| **用户意图**: "DSL VM / 风控引擎逆向" | 本 skill |
| **工具链**: Playwright / Selenium CDP | 浏览器注入方案 |
### 路径交叉
```
DSL VM 逆向路径:
reverse-engineering/dsl-vm-reverse/ → Phase 1-6 工作流
↓ 若需要捕获运行时数据
browser-automation/ → Playwright/Selenium CDP
↓ 若需要分析 API 协议层
js-reverse/ → Observe→Capture→Rebuild
```

303
firmware-reversing/SKILL.md Normal file
View File

@@ -0,0 +1,303 @@
---
name: firmware-reversing
description: 'Use for firmware and embedded device reverse engineering: firmware extraction
(SPI flash, JTAG, UART, chip-off), firmware unpacking and analysis (binwalk, firmware-mod-kit,
unblob), RTOS reversing (FreeRTOS, ThreadX, Zephyr, VxWorks), bootloader analysis
(U-Boot, Coreboot, Secure Boot), embedded file system extraction (SquashFS, JFFS2,
YAFFS, UBIFS), hardware debugging interfaces (JTAG/SWD for ARM, OpenOCD, Segger),
microcontroller firmware RE (ARM Cortex-M, AVR, ESP32, RISC-V), IoT protocol reversing
(MQTT, CoAP, Zigbee, BLE), cryptographic key extraction from firmware, vulnerability
discovery in embedded firmware (buffer overflow, command injection, hardcoded credentials),
and any task involving embedded device security research or firmware reverse engineering.'
version: 1.0.0
platforms:
- linux
- macos
- windows
triggers:
- firmware
- reversing
- embedded
- device
- reverse
- engineering
- extraction
- spi
- flash
- jtag
- uart
- chip
depends_on: []
metadata:
tags:
- firmware
- reversing
---
# Firmware Reversing — Embedded, IoT & RTOS Analysis
## Trigger Conditions
- Firmware extraction (SPI flash, JTAG, UART, chip-off, logic analyzer)
- Firmware unpacking (binwalk, unblob, firmware-mod-kit, sasquatch)
- RTOS reversing (FreeRTOS, ThreadX, Zephyr, VxWorks, RTEMS)
- Bootloader analysis (U-Boot, Coreboot, Secure Boot, vendor boot)
- Embedded filesystem extraction (SquashFS, JFFS2, YAFFS, UBIFS, romfs)
- Hardware debugging (JTAG, SWD, OpenOCD, Segger J-Link)
- Microcontroller reversing (ARM Cortex-M, AVR, ESP32, PIC, RISC-V)
- IoT protocol reversing (MQTT, CoAP, Zigbee, BLE, Z-Wave)
- Crypto key extraction from firmware images
- Hardcoded credential discovery in embedded firmware
- Vulnerability discovery (overflow, injection, insecure defaults)
## Core Methodology
### 1. Firmware Acquisition
**SPI flash dumping:**
```bash
# Connect SPI flash chip to programmer (CH341A, Bus Pirate, Raspberry Pi)
# Identify flash chip: Winbond, Macronix, Spansion, etc.
# Read flash:
flashrom -p ch341a_spi -r firmware.bin
# Verify:
flashrom -p ch341a_spi -v firmware.bin
# Partial read (specific regions):
flashrom -p ch341a_spi -r bootloader.bin -l 0x40000 -i 0
# Using Raspberry Pi as SPI programmer:
# Connect: MOSI→GPIO10, MISO→GPIO9, SCLK→GPIO11, CS→GPIO8, VCC→3.3V, GND→GND
flashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin
```
**UART console access:**
```bash
# Find UART pads on PCB (usually 3.3V, GND, TX, RX)
# Connect USB-to-UART adapter
# Baud rate detection:
stty -F /dev/ttyUSB0 115200
# Try common: 9600, 19200, 38400, 57600, 115200, 230400
# Connect:
screen /dev/ttyUSB0 115200
# Or: picocom -b 115200 /dev/ttyUSB0
# Boot interrupt: spam Enter/Ctrl+C during boot → U-Boot console
```
**JTAG/SWD debugging:**
```bash
# Identify JTAG/SWD pads (TCK, TMS, TDI, TDO) or test points
# OpenOCD — ARM debugging:
openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
# Read flash via JTAG:
openocd -f interface/ftdi.cfg -f target/stm32f4x.cfg \
-c "init; flash read_bank 0 firmware.bin 0 0x100000; exit"
# SWD on Cortex-M:
openocd -f interface/cmsis-dap.cfg -f target/stm32f4x.cfg \
-c "init; reset halt; flash read_bank 0 firmware.bin 0 0x200000; exit"
```
**Chip-off (physical extraction):**
```bash
# Desolder flash/NAND chip, read with programmer
# Hot air station: 350°C, flux, careful removal
# NAND flash reader:
# For raw NAND: need ECC correction
# Tools: nandread, flash-NAND-progger
```
### 2. Firmware Analysis & Unpacking
**Binwalk (signature scanning):**
```bash
# Scan for embedded files:
binwalk firmware.bin
# Extract all files:
binwalk -Me firmware.bin
# Extract specific signatures:
binwalk -D 'gzip:gz:gzip' firmware.bin
binwalk -D 'lzma:lzma:lzma' firmware.bin
# Show entropy:
binwalk -E firmware.bin # high entropy = compressed/encrypted
# Show raw hex with context:
binwalk -R 'Y\xff\xff\xff' firmware.bin
```
**Unblob (modern, automatic):**
```bash
# Python-based, finds and extracts nested archives:
unblob firmware.bin -o extracted/
# Recursive extraction:
unblob --recursive firmware.bin -o extracted/
# Show what it found:
unblob -v firmware.bin
```
**Filesystem extraction:**
```bash
# SquashFS:
unsquashfs -d squashed/ rootfs.squashfs
# Or unsquashfs -s rootfs.squashfs (show info)
# JFFS2:
# Need to mount (requires mtd kernel support)
modprobe mtdram total_size=65536
modprobe mtdblock
dd if=rootfs.jffs2 of=/dev/mtdblock0
mount -t jffs2 /dev/mtdblock0 /mnt/jffs2
# UBIFS:
modprobe nandsim first_id_byte=0x2c second_id_byte=0xda
modprobe ubi mtd=0
ubiformat /dev/mtd0
ubiattach -m 0
mount -t ubifs ubi0:rootfs /mnt/ubifs
# Cramfs:
cramfsck -x cram_extracted/ rootfs.cramfs
# YAFFS:
unyaffs rootfs.yaffs extracted/
```
### 3. RTOS Reversing
**FreeRTOS identification:**
```bash
# Strings to find:
strings firmware.bin | grep -i "FreeRTOS\|vTaskDelay\|xQueueSend\|xSemaphoreTake"
# Key structures:
# TCB (Task Control Block) — identify task list
# pxCurrentTCB → current task
# uxTopUsedPriority → scheduler state
# Common patterns:
# - Task creation: xTaskCreate(pxTaskCode, pcName, usStackDepth, pvParameters, uxPriority, pxCreatedTask)
# - Queue: xQueueCreate(uxQueueLength, uxItemSize)
# - Timer: xTimerCreate(pcTimerName, xTimerPeriod, uxAutoReload, ...)
# RE approach: find xTaskCreate call sites → map all tasks
# Each task's pxTaskCode = function pointer → RE-able
```
**VxWorks identification:**
```bash
# Strings:
strings firmware.bin | grep -i "VxWorks\|taskSpawn\|semMCreate\|msgQSend\|windKernel"
# Key structures:
# WIND_TCB — task control block (find current task via TCB)
# taskIdCurrent → running task
# Kernel image: usually starts with "VxWorks" string
# symbol table (if not stripped):
# VxWorks uses global symbol table for dynamic linking
# Extract: strings -e l firmware.bin | grep "taskName\|funcName"
# Task spawning:
# taskSpawn(name, priority, options, stackSize, entryPoint, arg1..arg10)
# entryPoint = function pointer → where to set breakpoints
```
### 4. Vulnerability Discovery
**Hardcoded credentials:**
```bash
# Automated credential scanning:
strings firmware.bin | grep -iE "(pass|pwd|secret|key|token|admin|root|login)[=:].+" | sort -u
# Credential in config files:
grep -r "password\|secret\|key" extracted/ \
--include="*.conf" --include="*.ini" \
--include="*.cfg" --include="*.json" \
--include="*.xml" --include="*.html"
# Default credentials:
# admin/admin, root/root, admin/1234, etc.
# Check: /etc/shadow, /etc/passwd, web configs
```
**Binary vulnerability scanning:**
```bash
# Emulate with QEMU (full system or user mode):
# Full system:
qemu-system-arm -M versatilepb -kernel firmware.bin -nographic
# User mode (single binary):
qemu-arm -L extracted/lib/ ./extracted/bin/httpd
# Fuzz with AFL/QEMU mode:
afl-fuzz -Q -i seeds/ -o output/ -- qemu-arm ./bin/httpd @@
# Check for security mitigations:
checksec --elf=./bin/httpd # NX, PIE, RELRO, STACK CANARY, FORTIFY
```
### 5. Cryptographic Key Extraction
**Key hunting:**
```bash
# Find RSA private keys:
grep -r "BEGIN RSA PRIVATE KEY\|BEGIN PRIVATE KEY" extracted/
# Find SSL certificates:
grep -r "BEGIN CERTIFICATE" extracted/
# Find hardcoded AES keys (16, 24, 32 byte patterns):
python3 -c "
import re
data = open('firmware.bin', 'rb').read()
# Look for high-entropy 16-byte sequences (potential AES keys)
for i in range(0, len(data) - 16):
chunk = data[i:i+16]
entropy = len(set(chunk))
if entropy > 14: # high entropy = likely key
print(f'Possible key at {hex(i)}: {chunk.hex()}')
"
# Check for XOR keys in bootloader:
# Often used for flash encryption
python3 -c "
data = open('firmware.bin', 'rb').read()
# XOR the entire firmware with first 4 bytes (see if decrypts)
# Brute force 1-byte XOR:
for key in range(256):
decoded = bytes(b ^ key for b in data[:64])
if b'U-Boot' in decoded or b'Linux' in decoded:
print(f'XOR key found: {hex(key)}')
"
```
## Output Format
For firmware reversing tasks:
1. **Acquisition** — method (SPI/JTAG/UART/chip-off), chip, voltage
2. **Firmware Profile** — OS/RTOS, architecture, bootloader, filesystem
3. **Unpacking** — toolchain used, nested layers, LZMA/gzip/SquashFS
4. **Key Findings** — hardcoded creds, crypto keys, vulns, backdoors
5. **RE Targets** — analyzed binaries, network services, web interfaces
Всё, брат.
## Related
- `skill hardware-hacking` — железо
- `skill hardware-hacking-deep` — глубокое железо
- `skill reverse-engineering-binary` — бинарники
- `skill iot-ot-ics-security` — промышленные системы

70
our-skills/attio-reverse-engineering/SKILL.md Normal file
View File

@@ -0,0 +1,70 @@
---
name: attio-reverse-engineering
description: "Reverse-engineer and integrate Attio CRM (AI models, API, MCP) into OMP — covers internal endpoints, auth, gateway, and provider wiring"
---
# Attio Reverse Engineering & OMP Integration
## Architecture
```
Attio Web App (app.attio.com)
├── Public API: api.attio.com/v2 (Bearer token from Settings → Developers → API Keys)
├── Internal AI: app.attio.com/api/internal/chat/completions (session cookie auth, Cloudflare-protected)
├── MCP: mcp.attio.com/mcp (OAuth: openid offline_access mcp)
└── SPA: React, all /api/* GET routes return HTML (not API JSON)
OMP Integration:
├── attio-gateway.py :8312 — FastAPI, round-robin API key pool, proxies api.attio.com/v2
├── attio-api-provider.py :8313 — OpenAI-compatible, /v1/models + /v1/chat/completions + tools
├── attio_mcp.py — MCP stdio server, 3 tools (list_workspaces, search_people, get_record)
└── mcp.json — attio (remote http OAuth) + attio-farm (local stdio)
```
## Auth Methods
1. **API Key** (for api.attio.com/v2): `Authorization: Bearer att_...` — works from any client
2. **Session Cookies** (for app.attio.com/internal): requires real browser — Cloudflare blocks urllib/requests
3. **OAuth JWT** (for mcp.attio.com/mcp): obtained via OAuth consent flow, stored in mcp.json
## Internal AI Endpoint
- URL: `POST https://app.attio.com/api/internal/chat/completions`
- Auth: session cookies (`attio-session`, `attio-app-session`, `attio-session-id`)
- Blocked by Cloudflare Error 1010 for non-browser requests
- Models available: Claude Opus 5, Claude Sonnet 5 (names in Attio: "Opus 5", "Claude Sonnet 5")
- Other probe results: `/{workspace}/api/chat` returns 405 (exists but different method)
## OMP Provider Wiring (3 files)
1. `providers.yml`: under `providers:`, add entry with `apiKey: ""`, `baseUrl`, `models`, `provider: openai`
2. `models.yml`: detailed config per model (api, contextWindow, maxTokens, compat flags)
3. `config.yml`: add `provider/*` to `enabledModels` AND provider to `modelProviderOrder`
- **Without enabledModels, /model won't show the provider at all**
- OMP restart required after changes
## Pool Format (attio_accounts.json)
```json
[{
"email": "...",
"api_key": "att_...",
"api_workspace_id": "uuid",
"api_workspace_slug": "slug",
"cookies": [
{"name": "attio-session", "value": "jwt...", "domain": ".attio.com"},
{"name": "attio-app-session", "value": "jwt...", "domain": ".attio.com"},
{"name": "attio-session-id", "value": "uuid", "domain": ".attio.com"}
],
"status": "active_pro_trial"
}]
```
## Browser Automation Issues
- Camoufox: launch hangs (GeoIP lookup or binary issue on Windows)
- Playwright: chromium binary missing, install needed; node.exe must be copied to driver/
- Patchright: driver node.exe missing
- curl_cffi: fails to compile on Windows CPython 3.11
- Browser relay (OMP): times out, extension may not be connected
- Chrome CDP: port 9224 listening but OMP browser tool can't connect (503)
## Working Tools
- `attio_list_workspaces` — reads pool from JSON, no API call needed
- `attio_search_people` — POST /v2/objects/people/records/query with filter
- `attio_create_person` — POST /v2/objects/people/records with values
- `attio_get_record` — GET /v2/objects/{type}/records/{id}

60
our-skills/devin-architecture-reverse/SKILL.md Normal file
View File

@@ -0,0 +1,60 @@
---
name: devin-architecture-reverse
description: "Devin AI agent architecture reverse engineering — binary structure, permission modes, hooks, slash commands, OMP mapping"
---
# Devin Architecture — Reverse Engineering Notes
## Binary Location
`C:/Users/User/AppData/Local/Programs/Devin/` — Electron/VSCode fork with Windsurf/Codeium extension.
## Key Components
```
Devin.exe (Electron, 216MB)
└── resources/app/extensions/windsurf/ ← Codeium agent extension
└── devin/
├── bin/devin.exe (151MB) ← Go/Rust agent binary
└── share/devin/docs/ ← Documentation
├── essential-commands.mdx ← 5 permission modes, 30+ slash commands
├── sandbox.mdx ← OS-level isolation (bubblewrap)
├── adaptive.mdx ← Auto model routing
├── handoff.mdx ← Transfer to cloud Devin
└── acp/ ← Agent Communication Protocol
```
## Permission Modes
1. **Normal** — auto-approves read-only tools, asks for write/execute
2. **Accept Edits** — auto-approves file edits, prompts for shell
3. **Smart** — fast model decides safety of each action
4. **Bypass (YOLO)** — auto-approves everything
5. **Autonomous** — requires `--sandbox`, OS-level isolation
## Slash Commands
/plan, /ask, /mode, /model, /loop, /compact, /handoff, /resume, /workspace, /hooks, /clear, /exit, /ls, /rm-session
## Hook System (8 event types)
SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PermissionRequest, PostCompaction, SessionEnd, Stop
## OMP Equivalent
| Devin | OMP |
|---|---|
| Bypass mode | approvalMode: yolo |
| /plan | plan: deepseek-reasoner:xhigh |
| /ask | advisor: deepseek-v4-pro:max |
| /loop | verification-loop skill |
| Adaptive routing | modelFallback + usageAwareFallback |
| Sandbox | task.isolation: projfs |
| Sessions | checkpoint + remember skill |
| /compact | compaction.autoContinue |
| MCP | 20+ MCP servers |
| 30 workers | maxConcurrency: 30 |
| Hooks | extensions (6 .ts files) |
## Devin Suite — OMP Implementation
Devin Suite lives at `C:/Users/User/.omp/agent/tools/devin_suite/` and provides:
- FastAPI server with planning, search, agents, sandbox, WebSocket
- 5 permission modes with per-agent state
- 8-event hook system with registry
- Slash command parser and handlers
- Dashboard with 4 tabs (Agents, Plans, Search, Sandbox)
- OMP extension integration

92
our-skills/dotnet-winui3-reverse-engineering/SKILL.md Normal file
View File

@@ -0,0 +1,92 @@
---
name: dotnet-winui3-reverse-engineering
description: "Decompile a WinUI 3 / Windows App SDK MSIX-packaged .NET app to C# source + extract XBF resources from PRI"
---
# Reverse Engineering WinUI 3 / Windows App SDK .NET Applications
## When to use
When you need to decompile a UWP/WinUI 3/Windows App SDK MSIX-packaged .NET application to readable C# source code.
## Prerequisites
- `dotnet` SDK installed
- `ilspycmd` (install via `dotnet tool install --global ilspycmd`)
- `makepri.exe` from Windows SDK (usually at `C:\Program Files (x86)\Windows Kits\10\bin\<version>\x64\makepri.exe`)
- Target app installed as MSIX (in `C:\Program Files\WindowsApps\`)
## Procedure
### 1. Locate the app
```powershell
# Find running process
Get-Process <AppName> | Select-Object Id,Path
# Or search WindowsApps
Get-ChildItem "C:\Program Files\WindowsApps" -Filter "*<AppName>*"
```
### 2. Identify the main DLL
WinUI 3 apps have a thin native .exe loader (~400KB) and the real logic in `<AppName>.dll` (several MB). Check for `coreclr.dll`, `hostfxr.dll` → .NET 8 runtime.
### 3. Decompile C# with ILSpy
```bash
# Basic decompile (C# only, no XAML)
ilspycmd "<AppName>.dll" -p -o "<output_dir>" -r "<install_dir>"
# With BAML→XAML (works for WPF, NOT for WinUI 3)
ilspycmd "<AppName>.dll" -p -o "<output_dir>" --decompile-baml -r "<install_dir>"
```
**Important:** WinUI 3 compiles XAML to XBF (XAML Binary Format) v2.1, NOT BAML. `--decompile-baml` will NOT produce XAML files. XBF files are embedded in `resources.pri`.
### 4. Fix csproj for build
- ILSpy generates `<Reference>` with `HintPath` pointing to install dir — copy DLLs to local `libs/` folder
- Change `<LangVersion>15.0</LangVersion>` to `<LangVersion>preview</LangVersion>` (SDK 10 doesn't support 15.0)
- Set `<GenerateAssemblyInfo>False</GenerateAssemblyInfo>` to avoid conflicts
- Copy `Microsoft.WindowsAppRuntime.dll` (native, ~1.3MB) to output — it's NOT copied by default
### 5. Extract XBF from resources.pri
```bash
# Dump PRI to XML
makepri.exe dump /if "<install_dir>\resources.pri" /of "<output.xml" /dt detailed /o
```
Then extract XBF binaries (they're Base64-encoded `EmbeddedData` entries):
- Look for `<NamedResource name="*.xbf">` entries with `<Candidate type="EmbeddedData">`
- Base64 value starts with `WEJG` (= "XBF" in Base64)
- Decode Base64 → write to .xbf files preserving directory structure
### 6. XBF v2.1 format notes
- Header: magic(4) + metadataSize(uint32) + nodeSize(uint32) = 12 bytes
- Metadata section starts at byte 12, contains: version(2×uint32) + 6 table offsets(uint64) + hash(64 bytes)
- **Table offsets are RELATIVE to metadata start (byte 12), not absolute file offsets**
- String table: count(uint32) + entries [len(uint32) + UTF-16LE chars + 2-byte padding]
- Type/Property tables: 12 bytes per entry (3×uint32), NOT 8 bytes like v1.0
- Assembly/TypeNamespace tables may have 0 entries
- Node section: starts at byte 12+metadataSize, uses different encoding than v1.0
- **No working XBF v2.1→XAML decompiler exists** (LibXbf/XbfDecompiler only support v1.0/v2.0)
- Best path to XAML: runtime hook `Application.LoadComponent` in live app + serialize visual tree
### 7. Smoke-launch limitations
WinUI 3 apps CANNOT run standalone without MSIX registration:
- `Microsoft.UI.Xaml.Application.Start()` requires WinRT activation factory
- WinRT activation needs package identity (AppX registration)
- Error: `FileNotFoundException` in `WinRT.ActivationFactory` → `BaseActivationFactory`
- To launch: create temporary AppX manifest + `Add-AppxPackage`, or run inside original MSIX context
### 8. Known artifacts in decompiled code
- `//IL_XXXX: Unknown result type` comments in 60+ files (WinRT projection IL)
- `_003C_003Ec` compiler-generated closure classes (from lambda captures)
- `__KnownINotifyPropertyChangedArgs` / `__KnownINotifyPropertyChangingArgs` (CommunityToolkit.Mvvm internals)
- These compile as warnings (CS8632, CS0618) but don't break the build
- **GREEN build ≠ behavior-equivalent to original** — WinRT projection stubs may be semantically incorrect
## OmniRoute provider architecture (for forks)
- Provider definitions: `src/shared/constants/providers/` split by auth type:
- `noauth.ts` — free, no API key (opencode, felo, duckduckgo)
- `apikey/` — split into `frontier-labs.ts`, `gateways.ts`, `inference-hosts.ts`, `enterprise-cloud.ts`, `regional.ts`, `specialty-media.ts`
- `oauth.ts` — OAuth providers (cursor, zed, kiro)
- `web-cookie.ts` — browser cookie auth
- `local.ts` — Ollama, LM Studio, vLLM
- Provider format: `{ id, alias, name, icon, color, textIcon, website, authHint?, hasFree?, freeNote?, serviceKinds?, notice? }`
- Models: `src/shared/constants/models.ts` + `src/lib/providers/staticModels.ts`
- Aggregated in `providers.ts` → `AI_PROVIDERS` proxy

79
our-skills/re-roast-2026/SKILL.md Normal file
View File

@@ -0,0 +1,79 @@
---
name: re-roast-2026
description: "Use when roasting/verifying a reverse-engineering guide, post, or list of RE tools; fact-checking stars/tool counts; link liveness sweep; cutting hyperbole; splitting content into Telegram messages (4096 limit); or when building/evaluating any 2026 RE stack content: IDA/Ghidra/Binary Ninja, Qiling, OGhidra, AI-RE pipeline, IDA licensing. Triggers: прожарка, реверс, реверсинг, RE, reverse engineering, бинарь, дизассемблер, декомпилятор, проверь ссылки, гайд по реверсу, проверить факты в посте."
---
# Что делает
Прожарка RE-контента: факт-чек против первоисточников, свип живости ссылок, срезка гипербол, разбивка под Telegram. Второй контур — канонный верифицированный стек реверс-инжиниринга 2026 (проверен 26.09.2026, 102/102 ссылки живы).
## When to use
- Прожарка/разбор чужого гайда по реверсу перед репостом в канал
- Факт-чек цифр (звёзды GitHub, число тулов, доменов, статей) и названий репо/книг
- Свип живости ссылок в MD (102+ ссылок)
- Составление нового RE-материала на проверенном стеке
- Оценка инструмента: лицензия и цена (бесплатно/ограниченно/платно)
## When NOT to use
- Сам разбор бинарника, malware, crackme (это другие скиллы: reverse-engineering, malware-analysis)
- Общая редактура текста без RE-темы
- Если не нужно ничего проверять — только писать свежий контент без фактов
## Workflow (прожарка RE-гайда)
1. **Триаж ссылок**: извлечь все URL из текста, прогнать `scripts/linkcheck.py`. 403/405 = бот-волл (сайт жив), не мёртвый. 404/сетевая ошибка = кандидат на удаление/замену.
2. **Цифры**: каждое число — против первоисточника (GitHub API/search, README репо). Звёзды, число тулов в описании, число статей/доменов. Несколько источников, если неоднозначно.
3. **Названия**: репо и книги сверять дословно; репо могло переехать (PMAT-course → PMAT-labs).
4. **Лицензии и цены**: пометить каждое ограничение. IDA Pro / Binary Ninja — платные, фраза «всё бесплатное» при них ложь; de4py = CC BY-NC; disrobe = платно для компаний.
5. **Гиперболы**: срезать «инструменты бесполезны», «свободно читаешь», «лучший способ», «от запуска до ответа», «~20 новых 0-day» (тавтология).
6. **Техническая точность**: Qiling исполняет в эмуляции → «без запуска на живой системе»; OGhidra поддерживает и облачные API (приватность только в локальном режиме); промпт-инъекция в бинарнике = «встраивает команды в строки», не «учится разговаривать».
7. **Атрибуция**: при репосте сохранять автора («[REDACTED] ([REDACTED])»), убирать промо-футеры автора (боты/платные ссылки).
8. **Разбивка**: сообщения ≤ 4096 символов, каждое самодостаточно, маркеры `===MSG N/4===`.
9. **Лицензия IDA**: при упоминании IDA Pro добавить раздел про легальные пути (IDA Free, Ghidra, студенческая Hex-Rays) — иначе аудитория идёт за кейгенами и тянет малварь.
## Success criteria
- Все ссылки проверены: 0 DEAD, BOTWALL задокументирован
- Каждая цифра текста сходится с первоисточником (с датой проверки)
- Каждое языковое/лицензионное утверждение без гипербол
- Все блоки ≤ 4096 символов
- Под-пост готов, если пользователь просил («под пост» = сообщение-компаньон, в канал не отправлять)
## Failure modes
- **Сервер режет HEAD** → GET fallback в linkcheck; 403 Cloudflare/Anubis = живой, не ошибка
- **Цифры устарели между проверками** → писать дату проверки рядом с цифрой
- **Репозиторий переехал** → искать новый owner/название (labs/archive суффиксы), не удалять секцию вслепую
- **Ссылка отдаёт 200 на сайте, но бот-волл браузеру** → не удалять, пометить «жив, отдаёт 403 ботам»
## Gotchas (проверено 26.09.2026)
| Факт | Значение |
|---|---|
| binary-ninja-headless-mcp | 181 тул (не 180) |
| firefox-reverse | 857 звёзд (не 855) |
| shannon | 48к звёзд (не 47к) |
| Anthropic-Cybersecurity-Skills | 34 домена (не 29) |
| open-reverselab | 180+ статей (не 194) |
| PMAT | репо PMAT-labs (не PMAT-course) |
| Книга Нарвахи | «Введение в реверсинг с нуля, используя IDA PRO» (перевод на gitbook yutewiyof) |
| Qiling | исполняет код в эмуляции — «без запуска на живой системе», не «без запуска» |
| OGhidra | LLM через Ollama или облачные API; приватность только в локальном режиме |
| de4py | CC BY-NC (некоммерческая) |
| disrobe | платно для компаний |
| Промпт-инъекция в строках бинарника | arxiv 2605.30667 — встраивает команды в строки |
| Гиперболы интро | «свободно читаешь» → «читаешь»; godbolt «лучший способ» — снять |
| IDA лицензия | .hexlic офлайн, JSON+подпись, ключ в бинаре; keygen с приватным ключом публично не подтверждён; пропатченная сборка = вектор малвари |
## Available scripts
- `scripts/linkcheck.py` — свип живости ссылок из MD. Запуск из корня скилла: `python scripts/linkcheck.py <file.md> [--workers N] [--timeout S]`. Stdlib only, exit 0 всегда (отчёт в stdout, формат `CHECK <status> <url>`).
## References
- Канон v4.1: `C:/Users/User/tmp/rev-guide-v4.md` (4 сообщения, 3854/3679/3875/1934 симв.)
- Под-пост: `C:/Users/User/tmp/rev-guide-v4-subpost.md` (1363 симв.)
- Автор оригинала: [REDACTED] (https://[REDACTED])
- Воркфлоу владельца: посты в TG ботом НЕ отправлять, инфу выдавать в чат; «под пост» = сообщение-компаньон

94
our-skills/re-roast-2026/scripts/linkcheck.py Normal file
View File

@@ -0,0 +1,94 @@
#!/usr/bin/env python3
"""Link liveness sweep for Markdown files (stdlib only).
Usage:
python linkcheck.py <file.md> [<file2.md> ...] [--workers N] [--timeout S]
Checks every http(s) URL found in the markdown files.
- 403/405 are reported as BOTWALL (bot wall — site is alive, not dead)
- Other HTTP errors are reported with their code
- Network errors/timeouts are reported as DEAD
Output line format: CHECK <status> <url>
Exit code is always 0; the report is the output. Diagnostics go to stderr.
"""
import argparse
import concurrent.futures
import re
import ssl
import sys
import urllib.error
import urllib.request
URL_RE = re.compile(r"https?://[^\s()<>{}|\"'`]+")
UA = ("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
"(KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36")
def probe(url, method, timeout, ctx):
req = urllib.request.Request(url, headers={"User-Agent": UA}, method=method)
try:
with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:
return resp.status
except urllib.error.HTTPError as e:
return e.code
except Exception:
return None
def check(url, timeout):
url = url.rstrip(".,;:!?)]}")
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
for method in ("HEAD", "GET"):
status = probe(url, method, timeout, ctx)
if status is not None and status != 999:
if status in (403, 405):
return f"CHECK BOTWALL {status} {url}"
if status < 400:
return f"CHECK {status} {url}"
# 4xx/5xx from HEAD could be server refusing HEAD; try GET first
if method == "GET":
return f"CHECK {status} {url}"
continue
if method == "GET":
break
return f"CHECK DEAD {url}"
def collect_urls(files):
urls, seen = [], set()
for path in files:
try:
text = open(path, encoding="utf-8").read()
except OSError as e:
print(f"ERR cannot read {path}: {e}", file=sys.stderr)
continue
for u in URL_RE.findall(text):
if u not in seen:
seen.add(u)
urls.append(u)
return urls
def main():
ap = argparse.ArgumentParser(description="Link liveness sweep for Markdown files.")
ap.add_argument("files", nargs="+", metavar="file.md")
ap.add_argument("--workers", type=int, default=24, help="parallel workers (default: 24)")
ap.add_argument("--timeout", type=float, default=15.0, help="per-request timeout in s (default: 15)")
args = ap.parse_args()
urls = collect_urls(args.files)
if not urls:
print("CHECK NONE (no URLs found)")
return 0
with concurrent.futures.ThreadPoolExecutor(max_workers=args.workers) as pool:
for result in pool.map(lambda u: check(u, args.timeout), urls):
print(result)
return 0
if __name__ == "__main__":
sys.exit(main())

130
our-skills/rea-full-course/SKILL.md Normal file
View File

@@ -0,0 +1,130 @@
---
name: rea-full-course
description: REA (Reverse Engineer Anything, morluto/rea) — полный практический курс. Установка, движки (Ghidra/IDA/Hopper/JADX), guided-воркфлоу, пак промтов, ограничения. Использовать для реверса Electron/JS, .NET, APK, бинарников, EVM-байткода через AI-агента.
---
# REA — Reverse Engineer Anything (полный курс)
REA = MCP-сервер + CLI (npm `rea-agents`), который даёт AI-агенту (Claude Code, Codex, Cursor, Gemini CLI, Hermes) навык реверс-инжиниринга с доказательствами: функция, файл, вызов + что осталось неизвестным. MIT, работает локально, ничего не загружает наружу. Первый релиз 12.07.2026, 100K+ звёзд за 3 месяца.
Полный текст курса-источника: `research-what-we-did/rea-full-course-source.md`.
## Установка
```bash
node -v # нужен Node 22.19+ / 24.11+ / 26+ (23 и 25 НЕ поддерживаются)
npx rea-agents@latest setup # интерактивно: выбор агента → план изменений → approval → бэкап конфигов
npx -y rea-agents@latest doctor --client claude_code --json # только проверка
npm install --global rea-agents && rea --help # глобальная команда
rea update # фиксы выходят почти ежедневно
```
Промт для авто-установки агентом:
```
Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.
```
После установки — ПОЛНЫЙ рестарт агента (для desktop-приложений недостаточно закрыть окно).
## Что читает и какие движки нужны
| Цель | Движок |
|---|---|
| Electron/JS desktop (Notion, Slack, Discord, Obsidian) | ничего, из коробки |
| Сайты (структура, скрипты, сеть) | любой Chrome-family браузер |
| HAR-файлы | ничего |
| .exe / Mach-O / DOS-игры (псевдокод, asm, строки) | Ghidra 12.1.x + JDK 21 (GHIDRA_INSTALL_DIR, JAVA_HOME) или Hopper или IDA |
| .NET (включая Unity-игры — игровая логика часто .NET) | ничего |
| Android APK | JDK 17+ и jadx-headless-mcp 0.7.1 (REA_JADX_MCP_JAR) |
| EVM-байткод смарт-контрактов | только Linux x64 |
| Прошивки, WASM, Go-бинарники | встроенные парсеры |
Electron-приложения лежат: Win `C:\Users\<ty>\AppData\Local\Programs\<App>\resources\app.asar`, Mac `<App>.app/Contents/Resources/app.asar`, Linux `/opt/<App>/resources/app.asar`.
Анализ без запуска приложения:
```bash
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
```
## Guided-воркфлоу (зашиты в MCP, почти никто не знает)
- `investigate_feature` — фича от обнаружения до конкретных функций
- `compare_application_versions` — что реально изменилось в апдейте
- `verify_reconstruction` — сверка своей пересборки с сохранёнными доказательствами
- `trace_crash` — креш → пути кода
- `audit_residual_unknowns` — что ещё не доказано
- `prepare_bounded_process_capture` — план безопасного runtime-эксперимента
Цикл профи: **investigate → spec → build → verify**
```
Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.
```
## Пак промтов (копипаст в агент с установленной REA)
Первый тест (2 минуты, официальное training-приложение):
```
Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.
Show where notes.csv is written, which fields it contains, and the relevant files and lines.
```
Аудит APK:
```
Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.
```
Проверка токена (байткод → state-функции):
```
Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.
```
(`rea inspect-evm-interface ./runtime.hex hex --json`; имена функций — догадки из байткода, красный флаг = «проверь глубже»)
Дифф версий:
```
Use REA's compare_application_versions workflow on [old version] and [new version] of [app]. Tell me what actually changed, with evidence.
```
Реал-тайм фичи:
```
Figure out how Discord shows who's typing in real time, show me the proof, and build something similar for my project.
```
Реконструкция игры:
```
Reconstruct a game from its executable and test it against the original.
```
## Ограничения (честно)
- Сервер не трогает — читается только то, что на твоей машине. Банк не взломает.
- Декомпилированный код — реконструкция, не оригинальный исходник → шаг verify обязателен.
- Стрипанные C++-бинарники намного жёстче, чем Unity .NET-игры.
- Агент может отказаться на прошивках/консолях (правила безопасности модели).
- IDA/Hopper/JEB — свои лицензии, крякнутые копии запрещены.
## Юридическая рамка (clean room)
Учись на оригинале → пиши СПЕК (поведение, не код) → собирай своё с нуля. Так работали Compaq (BIOS IBM, ~$1M), Sega v. Accolade (1992, fair use), Sony v. Connectix (2000, 3-0). За копирование чужого кода/кряк платных фич/публикацию декомпилята — прилетает иск (Sony v. geohot 2011).
## Эталонные кейсы
- Aegis authenticator: 3077 классов → найден генератор 6-значных кодов → пересборка прошла 133/133 теста
- DX-Ball (1996): sound-pan восстановлен на C, 3205 тест-кейсов оригинала, 63/63 байта компиляции
- Touhou: 697 функций, 696 точных совпадений, играбельно за ~12 дней
- Super Mario Sunshine PC-порт: ~365 агенто-часов, 17.3B токенов
- ArtCraft: 7 приложений Adobe как clean-room Rust-альтернативы (альфа)
## Уроки из практики (пересборка Touhou)
- Чёткая цель + чёткие критерии приёмки для агента.
- Заметки и проверки — в git, чтобы следующая сессия продолжила.
- Любое объяснение агента = гипотеза, проверять.
- Тестируй свои тесты: сломанное сравнение однажды пропустило неправильную функцию.
## Локальная практика (наш Windows-стенд, 14.10.2026)
- rea 6.4.0: `tools/node-26.7.0-win32-x64/rea.cmd`; MCP `rea` в Hermes config = 170 tools.
- IDA attached-режим: env `REA_IDA_MCP_CONFIG` → ida-mcp.json (ida-pro-mcp 1.4.0 legacy, IDA GUI с плагином на :13337). Native-анализ бинарей — ТОЛЬКО через attached IDA.
- Windows-лимиты: binary-layout/pwntools = Linux-only; Go/Rust/WASM/EVM/SQLite-парсеры встроенные.
- Прогнано: `analyze-javascript-application` на TeleSender (90MB Electron) → Evidence-бандл 41878 узлов, JSON.
- Монетизация навыка: bug bounty (пайплайны 8 MCP + 300 инструментов + Ghidra/radare2/Frida окупаются), перенос легаси-софта, связывание тулов, восстановление утраченных исходников для компаний.

130
our-skills/reverse-winui3-app/SKILL.md Normal file
View File

@@ -0,0 +1,130 @@
---
name: reverse-winui3-app
description: "Use when reverse engineering a WinUI 3 / .NET 8 MSIX-packaged Windows application — covers ILSpy decompilation, PRI/XBF extraction, and pkg-compiled Node.js backend identification"
---
# Reverse Engineering WinUI 3 + pkg-compiled Node.js Applications
## When to use
- Target is a Windows MSIX-packaged app (WinUI 3 / Windows App SDK)
- App has a separate backend executable compiled with `pkg`
- Need to extract C# source, XAML (XBF), and JS backend code
## Phase 1: Locate and identify the target
```powershell
# Find running process
Get-Process <name> | Select Id,Path
# Or search MSIX install
Get-ChildItem "C:\Program Files\WindowsApps" -Directory -Filter "*<name>*"
```
Identify app type by inspecting install directory:
- `coreclr.dll`, `hostfxr.dll`, `*.dll` (managed) → .NET / WinUI 3
- `VibeProxy.exe` (small, ~400KB) = native launcher; `VibeProxy.dll` (large) = main logic
- `Watchers\*.exe` (large, 100MB+) = likely pkg-compiled Node.js backend
## Phase 2: Decompile .NET frontend (ILSpy)
```bash
# Install ILSpy CLI
dotnet tool install --global ilspycmd
# Decompile with BAML support and reference path
ilspycmd "target.dll" -p -o "output_dir" --decompile-baml -r "install_dir"
# Fix csproj: LangVersion=preview, add HintPath for all references
# Copy dependency DLLs to libs/ folder (include large ones >15MB separately)
# Fix CS0136 (duplicate variable names) by renaming
# Build: dotnet build -c Release
```
Key limitations:
- WinUI 3 XAML compiles to XBF (not BAML) — `--decompile-baml` won't extract it
- `Unknown result type` comments in 60+ files = WinRT projection IL artifacts
- Smoke-launch fails: WinRT activation requires MSIX package identity
## Phase 3: Extract XBF from resources.pri
```bash
# Find makepri.exe in Windows SDK
# Dump PRI to XML (detailed format for Base64 data)
makepri.exe dump /if "install_dir\resources.pri" /of "dump.xml" /dt detailed /o
```
```powershell
# Extract XBF binaries from PRI dump XML
[xml]$xml = Get-Content "dump.xml" -Raw
$xbfNodes = $xml.SelectNodes("//NamedResource[contains(@name,'.xbf')]")
foreach ($node in $xbfNodes) {
$name = $node.GetAttribute("name")
$uri = $node.GetAttribute("uri")
$pathPart = $uri -replace "ms-resource://[^/]+/Files/", ""
$candidate = $node.SelectSingleNode("Candidate")
if ($candidate.GetAttribute("type") -eq "EmbeddedData") {
$b64 = $candidate.SelectSingleNode("Base64Value")
$bytes = [System.Convert]::FromBase64String($b64.InnerText)
[System.IO.File]::WriteAllBytes($outPath, $bytes)
}
}
```
XBF v2.1 format notes:
- Header: magic(4) + metaSize(uint32) + nodeSize(uint32) = 12 bytes
- Metadata at byte 12: version(2x uint32) + 6 table offsets (uint64, relative to byte 12) + hash (64 bytes)
- Table entries are 12 bytes each (not 8 as in v1.0)
- Node encoding differs from v1.0 — no existing tool supports v2.1
- Best path to XAML: runtime-hook `LoadComponent` in live app, serialize visual tree
## Phase 4: Identify and extract pkg-compiled backend
### Identify pkg binary
```
PE header: NOT .NET (no CLR header)
Search for: "process.versions.pkg", "pkg/prelude", "/snapshot/"
NODE_SEA_FUSE:0 = disabled (stock Node, not SEA)
pkg version found in binary (e.g., '6.22.0')
```
### Extract via runtime unpacking
pkg extracts itself to `%TEMP%\<ServiceName>\<package-name>\<version>\dist` at runtime.
Check if the app has been run:
```powershell
Get-ChildItem "$env:TEMP" -Directory -Filter "*<ServiceName>*"
Get-ChildItem "$env:TEMP\*<ServiceName>*\*" -Recurse
```
If found, copy the `dist` directory — it contains:
- `server.js` / `server-ws.mjs` (entry points, readable)
- `.build/next/` (Next.js standalone build)
- `.build/next/server/chunks/` (minified but readable JS, 3000+ files)
- `.build/next/server/app/api/` (API routes)
- `package.json` (identifies upstream package + version)
### Match with upstream
Check `package.json` name + version against GitHub:
- If MIT/Apache licensed → full source available upstream
- Clone the repo for complete TypeScript source (2,600+ .ts/.tsx files)
- Compare extracted dist with git clone to find local modifications
## Phase 5: Full inventory checklist
| Item | Source | Method |
|------|--------|--------|
| C# source | VibeProxy.dll | ILSpy decompile |
| XBF (compiled XAML) | resources.pri | makepri dump + extract |
| Assets/icons | MSIX install dir | Copy |
| Locales | MSIX install dir | Copy (check all dirs) |
| config.yaml | Watchers/ | Copy |
| Backend dist | %TEMP% (runtime) | Copy after app run |
| Backend source | GitHub (if MIT) | git clone |
| Build verification | dotnet build | Must be GREEN |
| Sourcemaps | .build/next/ | Usually absent in prod |
## Common pitfalls
- Don't claim "full source" without building and smoke-testing
- XBF v2.1 ≠ BAML — `--decompile-baml` produces nothing for WinUI 3
- SEA fuse `:0` means stock Node.js, not SEA — look for `process.versions.pkg` instead
- 210MB gzip trailing data in PE = pkg payload, not SEA blob
- Sourcemaps in production Next.js builds are typically empty (`{"sources":[],"sections":[]}`)
- WinUI 3 apps cannot launch standalone without MSIX registration

134
our-skills/reverse-winui3-pkg-app/SKILL.md Normal file
View File

@@ -0,0 +1,134 @@
---
name: reverse-winui3-pkg-app
description: "Reverse engineer a WinUI 3 (.NET 8) desktop app with a pkg-compiled Node.js backend: ILSpy decompilation, XBF extraction from resources.pri, pkg payload extraction, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch"
---
# Reverse Engineering WinUI 3 + pkg-compiled Node.js Applications
## When to use
Reversing a Windows desktop app that is:
- WinUI 3 / Windows App SDK (.NET 8) frontend
- pkg-compiled Node.js backend (VibeProxyServices.exe pattern)
- Installed as MSIX in `C:\Program Files\WindowsApps\`
## Phase 1: Locate and identify
```powershell
# Find running process
Get-Process | Where-Object { $_.ProcessName -match 'TargetApp' }
# Get install path
(Get-Process TargetApp).Path
```
Identify app type by inspecting install directory:
- `coreclr.dll`, `hostfxr.dll` → .NET 8 app
- `VibeProxy.dll` (main logic) + `VibeProxy.exe` (thin launcher) → ILSpy target
- `resources.pri` → XBF/XAML resources embedded
- `Watchers\*.exe` (large, 100MB+) → likely pkg-compiled Node.js backend
## Phase 2: Decompile C# with ILSpy
```bash
# Install ILSpy CLI
dotnet tool install --global ilspycmd
# Decompile main DLL with reference path for WinRT projections
ilspycmd "C:\path\to\App.dll" -p -o "C:\output\src" -r "C:\path\to\install\dir"
```
Key fixes after decompilation:
- `LangVersion` in csproj: change to `preview` (ILSpy may set unsupported version)
- `CS0136` duplicate variables: rename second occurrence
- `FindOrRegisterForKey("literal")`: ILSpy inlines string constants — fix call site to use const
- `Color` ambiguity: qualify as `Windows.UI.Color.FromArgb(...)` not `Color.FromArgb(...)`
- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background` instead
- `Window.RequestedTheme` not available — set theme on child elements instead
## Phase 3: Extract XBF from resources.pri
```bash
# Dump PRI with makepri
makepri.exe dump /if "resources.pri" /of "dump.xml" /dt detailed /o
# Extract XBF binaries from Base64 in dump XML (PowerShell script)
# XBF entries have type="EmbeddedData" with Base64Value
```
XBF v2.1 format (WinUI 3):
- Header: 12 bytes (magic + metaSize + nodeSize)
- Offsets are relative to byte 12 (meta_start)
- String table: uint32 count, then length-prefixed UTF-16LE strings with 2-byte padding
- Type/Property tables: 12 bytes per entry (not 8)
- Node section starts at `12 + metaSize`
- Node encoding differs from XBF v1.0 — existing tools (LibXbf) don't work
## Phase 4: Extract pkg backend
pkg self-extracts to `%TEMP%\AppName\version\dist` at runtime.
Check there first — no need to parse the 298MB binary.
```powershell
Get-ChildItem "$env:TEMP\AppName" -Recurse
```
If not extracted yet, identify pkg version:
- Search binary for `process.versions.pkg` → e.g. `'6.22.0'`
- Search for `NODE_SEA_FUSE` — if `:0`, it's pkg not SEA
- Trailing data after PE sections is gzip-compressed pkg payload
## Phase 5: Build and package
```bash
# Self-contained publish (critical — FDD won't work in MSIX)
dotnet publish App.csproj -c Release -r win-x64 --self-contained true
```
Create staging directory from publish output, then overlay original:
- `resources.pri` (XBF, strings, images)
- `Assets/` folder
- `Watchers/` folder
- Locale directories (`xx-XX/`)
- `Microsoft.UI.Xaml/` folder
- Native WinUI DLLs (whitelist — never overwrite published exe/dll)
## Phase 6: MSIX packaging with self-signed cert
```powershell
# Create cert matching manifest Publisher
$cert = New-SelfSignedCertificate -Subject "CN=PublisherFromManifest" ...
# Add to Trusted Root and Trusted People
# Pack with makeappx
makeappx.exe pack /d staging /p App.msix /nv
# Sign with signtool
signtool.exe sign /fd SHA256 /a /f cert.pfx /p password App.msix
# Install
Add-AppxPackage -Path App.msix
```
Requirements:
- `AllowAllTrustedApps=1` and `AllowDevelopmentWithoutDevLicense=1` in registry
- Manifest Publisher must exactly match cert Subject
- Bump version on each rebuild
- Remove stale `AppxSignature.p7x`, `AppxBlockMap.xml`, `AppxMetadata/` from staging
## Phase 7: Launch and verify
```powershell
# Launch via AppsFolder (not Start-Process directly)
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App'
# Wait 8-15 seconds for WinUI window
# Verify: PID path matches Rev package, MainWindowTitle set, RAM > 150MB
```
UI verification:
- UI Automation: `[System.Windows.Automation.AutomationElement]::FromHandle($hwnd)`
- Screenshot + pixel sampling for color/design changes
- Don't trust `base.Title` alone — custom title bar uses `AppTitleTextBlock.Text`
## Known limitations
- XAML markup (XBF v2.1) cannot be decompiled — original `resources.pri` is used
- ILSpy leaves `Unknown result type` comments in 61+ files (WinRT projection IL)
- `copy_all.ps1` pattern overwrites rebuilt exe/dll — always rebuild AFTER copying
- `Window.RequestedTheme` not available in WinUI 3 — set theme on child elements
- Process may take 10-15 seconds to create window handle after launch

145
our-skills/vibeproxy-reverse-engineering/SKILL.md Normal file
View File

@@ -0,0 +1,145 @@
---
name: vibeproxy-reverse-engineering
description: "Reverse engineer VibeProxy (WinUI 3 .NET 8 MSIX app) — ILSpy decompile, self-contained publish, MSIX repackage, and fork 9router backend"
---
# VibeProxy Reverse Engineering Pipeline
## Target
VibeProxy = WinUI 3 / .NET 8 MSIX app (`AtC.VibeProxy_3.7.2.0_x64__g8zz5t3ayajdt`).
Backend = `VibeProxyServices.exe` = pkg-compiled OmniRoute v3.8.50 (MIT).
9router = separate npm package (`9router@0.5.50`, MIT, `github.com/decolua/9router`).
## Phase 1: Decompile C# (ILSpy)
```powershell
# Locate MSIX install
$pkg = Get-AppxPackage -Name "AtC.VibeProxy"
$installDir = $pkg.InstallLocation # C:\Program Files\WindowsApps\AtC.VibeProxy_3.7.2.0_x64__g8zz5t3ayajdt
# Decompile VibeProxy.dll with ILSpy CLI
ilspycmd -p --decompile-baml "$installDir\VibeProxy.dll" -o C:\Users\User\tmp\VibeProxy_src2\
```
### Build fixes required
- `LangVersion=preview` in csproj
- HintPaths to `libs/` directory (copy 244 DLLs from MSIX)
- Fix `CS0136` duplicate variables (rename `upd` → `ins` in SqliteStatsService.cs)
- Fix inline literal `FindOrRegisterForKey("VibeProxy_SingleInstance")` → use const
### Self-contained publish (NOT framework-dependent)
```powershell
dotnet publish VibeProxy.csproj -c Release -r win-x64 --self-contained true
```
Original runtimeconfig uses `includedFrameworks` (self-contained). Rebuilt uses `framework` (FDD). Must publish self-contained or app crashes with "No frameworks were found".
## Phase 2: MSIX Repackage
### Staging (CRITICAL — never pack from output dir directly)
1. Copy from `bin\Release\net8.0\win-x64\publish\` (NOT `bin\Release\net8.0\`)
2. Overlay original `resources.pri`, `Assets/`, `Watchers/`, `Microsoft.UI.Xaml/`, locale dirs, native WinUI DLLs
3. EXCLUDE stale `AppxSignature.p7x`, `AppxBlockMap.xml`, `AppxMetadata/CodeIntegrity.cat`
4. Write new `AppxManifest.xml` with bumped version and `Publisher` matching cert Subject exactly
### Cert + Sign + Install
```powershell
# Create self-signed cert
$cert = New-SelfSignedCertificate -Subject "CN=<ORIGINAL_PUBLISHER_CN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")
# Add to Trusted Root + Trusted People (LocalMachine)
# Export PFX
# Pack
& makeappx pack /d $staging /p $msixPath /nv
# Sign
& signtool sign /fd SHA256 /a /f $certPath /p $password $msixPath
# Install
Add-AppxPackage -Path $msixPath
```
### Launch via AppsFolder
```powershell
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'
```
`Start-Process` cannot launch `shell:AppsFolder` URIs directly — use `explorer.exe`.
### Verification
- `Get-AppxPackage` shows correct version + InstallLocation
- Hash installed `VibeProxy.dll` == publish hash
- Process alive ≥5s with growing RAM
- `MainWindowTitle` = custom title (not "VibeProxy.exe")
- UI Automation confirms text elements
- Pixel sampling confirms color changes
### CLEANUP (mandatory after install)
Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My`. Delete PFX file. Trusted root + accessible private key = arbitrary code signing.
## Phase 3: Design changes (code-behind only)
XAML is compiled to XBF v2.1 in `resources.pri` — NOT decompilable. Changes only via C# code-behind in `MainWindow.cs` constructor after `InitializeComponent()`:
```csharp
AppTitleTextBlock.Text = "VibeProxy [ENI]";
AppTitleTextBlock.Foreground = new SolidColorBrush(Windows.UI.Color.FromArgb(255, 168, 85, 247));
NavView.Background = new SolidColorBrush(Windows.UI.Color.FromArgb(255, 20, 15, 35));
ContentFrame.BorderBrush = new SolidColorBrush(Windows.UI.Color.FromArgb(255, 168, 85, 247));
ContentFrame.BorderThickness = new Thickness(2);
```
**Gotchas:**
- `Color` is ambiguous between `System.Drawing.Color` and `Windows.UI.Color` — qualify as `Windows.UI.Color.FromArgb(...)`
- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background`
- `Window.RequestedTheme` not available in WinUI 3 — set on child elements
- `NavView.SelectedItem = NavView.MenuItems[0]` MUST be preserved (don't accidentally replace with design code)
## Phase 4: 9router fork (backend)
### Clone real upstream (NOT npm pack)
```bash
git clone https://github.com/decolua/9router.git 9router_fork
cd 9router_fork
git checkout -b eni-custom
```
### Build
```bash
npm install # WITH devDependencies (next build needs them)
npx next build --webpack # or: npm run build
```
### Run dev (no build needed)
```bash
PORT=20130 API_KEY_SECRET=eni-test-key DATA_DIR=./data node node_modules/next/dist/bin/next dev --port 20130
```
### API endpoints
- `/api/health` → `{"ok":true}` (no auth)
- `/v1/models` → 679 models (Bearer auth)
- `/api/v1/chat/completions` → POST (needs configured providers in DB)
- `/api/monitoring/health` → VibeProxy health check endpoint
### API key generation
```javascript
// Format: {prefix}-{machineId}-{keyId}-{crc8}
// prefix: "sk" (default) or "eni" (custom)
// CRC = HMAC-SHA256(API_KEY_SECRET, machineId + keyId).slice(0,8)
```
### VibeProxy ↔ 9router integration
VibeProxy expects OmniRoute API (`/api/monitoring/health`, `/api/providers/{id}/login`, `/api/oauth/`).
9router has different API (`/api/health`, `/api/v1/chat/completions`).
Direct swap of VibeProxyServices.exe with 9router won't work — API incompatible.
VibeProxyServices.exe = pkg-compiled OmniRoute, NOT 9router.
OmniRoute installs 9router as embedded service via `npm install 9router`.
## Key paths
- ILSpy output: `C:\Users\User\tmp\VibeProxy_src2\`
- OmniRoute clone: `C:\Users\User\Projects\OmniRoute_fork\` (v3.8.50, MIT)
- 9router clone: `C:\Users\User\Projects\9router_fork\` (v0.5.50, MIT)
- MakeAppx: `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\makeappx.exe`
- Signtool: `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe`
## What's NOT recovered
- XAML markup (24 XBF v2.1 files in resources.pri — format undocumented)
- ILSpy artifacts (`Unknown result type` in 61+ files — WinRT projection IL)
- Sourcemaps (production build, all empty)
- VibeProxy-specific backend delta (diff between OmniRoute git and extracted dist not proven)

73
our-skills/vibeproxy-reverse-pipeline/SKILL.md Normal file
View File

@@ -0,0 +1,73 @@
---
name: vibeproxy-reverse-pipeline
description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX staging/sign/install, and design modification with pixel verification"
---
# VibeProxy Reverse Engineering Pipeline
## Architecture
- VibeProxy = WinUI 3 (.NET 8) MSIX app, C# code-behind + XAML (XBF v2.1 compiled)
- VibeProxyServices.exe = pkg-compiled OmniRoute v3.8.50 (Node.js Next.js standalone)
- VibeProxy launches VibeProxyServices.exe as child process on internal port (8316), proxies via external port (8317)
- Backend API: `/api/monitoring/health`, `/api/providers/{id}/login`, `/api/oauth/` — OmniRoute endpoints, NOT 9router
- 9router = separate npm package (v0.5.50), installed by OmniRoute's service manager, NOT the same as OmniRoute
## Steps
### 1. Decompile
```bash
ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\AtC.VibeProxy_3.7.2.0_x64__g8zz5t3ayajdt\VibeProxy.dll" -o VibeProxy_src2
```
- Fix CS0136 duplicate variables, inline literals, LangVersion=preview in csproj
- HintPaths to libs/ directory with 244 DLLs
### 2. Publish self-contained
```bash
dotnet publish VibeProxy.csproj -c Release -r win-x64 --self-contained true
```
- Framework-dependent build fails in MSIX (no framework found)
- Self-contained bundles .NET runtime in package
### 3. Stage MSIX
- Copy publish output to staging dir
- Overlay original resources.pri, Assets/, Watchers/, locale dirs, Microsoft.UI.Xaml/, native WinUI DLLs
- EXCLUDE: AppxSignature.p7x, AppxBlockMap.xml, AppxMetadata/ from staging
- Write AppxManifest.xml with new Identity (Name=AtC.VibeProxyRev, bumped Version, Publisher=CN=...)
- Publisher MUST exactly match cert Subject
### 4. Sign and install
```powershell
New-SelfSignedCertificate -Subject "CN=..." -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")
# Add to Trusted Root + Trusted People (LocalMachine)
makeappx pack /d staging /p output.msix /nv
signtool sign /fd SHA256 /a /f cert.pfx /p password output.msix
Add-AppxPackage -Path output.msix
```
### 5. Launch and verify
```powershell
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App'
# Wait 8+ seconds, check PID path matches Rev package
# Verify via UI Automation (System.Windows.Automation) for text elements
# Verify via pixel sampling (System.Drawing.Bitmap.GetPixel) for color changes
```
### 6. Cleanup
- Remove self-signed cert from LocalMachine\Root, TrustedPeople, CurrentUser\My
- Delete PFX file
- Installed MSIX continues to work without cert in store
## Key gotchas
- PowerShell `$_` variables get stripped through bash inline — use .ps1 script files
- `RequestedTheme` not available on Window in WinUI 3
- `NavigationView.PaneBackground` doesn't exist in WinUI 3
- `Color` is ambiguous between System.Drawing.Color and Windows.UI.Color — qualify as Windows.UI.Color
- NavView.SelectedItem must be preserved when adding design changes
- XBF v2.1 format not decompilable — XAML structure uses original resources.pri
- ILSpy artifacts (Unknown result type, _003C compiler classes) in 61+ files — code compiles but WinRT projection incomplete
## What's NOT reversible
- XAML markup (24 XBF files) — format v2.1, node encoding unknown
- ILSpy WinRT projection artifacts
- Backend sourcemaps (production build, empty .js.map)
- VibeProxy-specific OmniRoute delta (diff between git clone and extracted dist not proven)

86
our-skills/winui3-msix-reverse-rebuild/SKILL.md Normal file
View File

@@ -0,0 +1,86 @@
---
name: winui3-msix-reverse-rebuild
description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder"
---
# WinUI 3 MSIX Reverse & Rebuild Pipeline
## When to use
Reverse engineering an installed WinUI 3 / .NET 8 MSIX application: decompile C#, rebuild, repackage as MSIX, and launch side-by-side with the original.
## Prerequisites
- ILSpy CLI (`ilspycmd`) installed
- .NET 8 SDK
- Windows SDK (makeappx.exe, signtool.exe) at `C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\`
- Target MSIX installed (to access original files in `C:\Program Files\WindowsApps\`)
## Steps
### 1. Locate & decompile
```powershell
# Find installed MSIX
Get-AppxPackage -Name "*TargetApp*"
# Decompile main DLL
ilspycmd -p --decompile-baml "C:\Program Files\WindowsApps\<Package>\TargetApp.dll" -o C:\Users\User\tmp\TargetApp_src\
```
### 2. Fix build errors
- Set `<LangVersion>preview</LangVersion>` in .csproj
- Add `<HintPath>` entries for all DLLs from the MSIX package
- Fix `CS0136` duplicate variables (rename)
- Fix `CS0104` ambiguous references (qualify with `Windows.UI.Color` not `System.Drawing.Color`)
- Fix inline literals (e.g. `FindOrRegisterForKey("...")` → use const)
### 3. Self-contained publish
```powershell
dotnet publish TargetApp.csproj -c Release -r win-x64 --self-contained true
```
**Critical**: Framework-dependent build fails inside MSIX — must use `--self-contained true`.
### 4. Stage MSIX payload
- Copy publish output to staging dir
- Overlay original `resources.pri`, `Assets/`, `Watchers/`, locale dirs, `Microsoft.UI.Xaml/`
- Overlay native WinUI DLLs (whitelist, never overwrite published exe/dll)
- Write new `AppxManifest.xml` with bumped version and same Publisher CN
### 5. Cert & sign
```powershell
# Create self-signed cert matching original Publisher CN
$cert = New-SelfSignedCertificate -Subject "CN=<ORIGINAL_PUBLISHER_CN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")
# Add to Trusted Root and Trusted People (LocalMachine)
# Export PFX
# Pack with makeappx /nv
# Sign with signtool /fd SHA256
```
### 6. Install & launch
```powershell
Add-AppxPackage -Path TargetAppRev.msix
# Launch via AppsFolder (NOT Start-Process directly)
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'
```
### 7. Verify
- Check `Get-AppxPackage` shows new version
- Check process path starts with Rev package InstallLocation
- Check MainWindowTitle and RAM growing (not stuck at 17MB)
- Use UI Automation to verify text elements inside window
- Sample pixel colors from screenshot for design changes
### 8. Cleanup (IMPORTANT)
- Remove self-signed cert from `LocalMachine\Root`, `LocalMachine\TrustedPeople`, `CurrentUser\My`
- Delete PFX file
- Trusted root + accessible private key = arbitrary code signing capability
## Gotchas
- `RequestedTheme` not available on `Window` in WinUI 3 — use `ElementTheme` on child elements
- `NavigationView.PaneBackground` doesn't exist in WinUI 3 — use `NavView.Background`
- `base.Title` changes Windows title bar but custom title bar uses `AppTitleTextBlock.Text`
- XBF v2.1 (XAML binary) is NOT decompilable — UI structure stays from original `resources.pri`
- `NavView.SelectedItem = NavView.MenuItems[0]` must be preserved or dashboard won't load
- PowerShell `$` variables get stripped through bash inline — use `.ps1` script files
- `Start-Process 'shell:AppsFolder\...'` fails — use `explorer.exe` as intermediary
- Process alive at 17MB RAM with title "AppName.exe" = crashed (.NET framework not found)
- Process alive at 200MB+ RAM with proper title = working

107
our-skills/winui3-msix-reverse/SKILL.md Normal file
View File

@@ -0,0 +1,107 @@
---
name: winui3-msix-reverse
description: "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, rebuild with dotnet publish self-contained, overlay original native assets, loose-register without admin, add custom pages"
---
# Reverse Engineering WinUI 3 MSIX Apps
## Prerequisites
- ILSpy CLI (`ilspycmd`) installed via dotnet tool
- Windows SDK (makeappx.exe, signtool.exe)
- .NET 8 SDK
- Target MSIX installed (locate via `Get-AppxPackage`)
## Step 1: Decompile
```bash
ilspycmd -p --decompile-baml "C:\Path\To\Target.dll" -o "C:\Output\src"
```
- Produces C# files from .NET assembly
- `--decompile-baml` attempts XAML but XBF v2+ may not decompile
- Fix CS errors (duplicate variables, ambiguous references, missing `using`)
## Step 2: Build
```bash
dotnet publish Project.csproj -c Release -r win-x64 --self-contained true
```
- **Must use `--self-contained true`** — original MSIX bundles .NET runtime, FDD will fail with "No frameworks were found"
- Original `runtimeconfig.json` uses `includedFrameworks`, rebuilt uses `framework` — self-contained fixes this
## Step 3: Overlay Original Assets
Copy from original MSIX install dir to publish output:
- `resources.pri` (XBF, strings, images)
- `Assets/` folder
- `Watchers/` folder (backend executables)
- Locale dirs (`xx-YY/` pattern)
- `Microsoft.UI.Xaml/` folder
- Native WinUI DLLs (CoreMessagingXP.dll, dcompi.dll, etc.)
- **Never overwrite rebuilt VibeProxy.exe/dll**
## Step 4: Create AppxManifest.xml
- New `Identity` Name (e.g. `AtC.VibeProxyRev`)
- Same Publisher CN as original
- Bump Version (e.g. `3.7.2.8`)
- Same `EntryPoint="Windows.FullTrustApplication"`
- `rescap:Capability Name="runFullTrust"`
## Step 5: Register — Two Options
### Option A: Loose Register (no admin, no signing) — PREFERRED
```powershell
# Enable dev mode
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -Name "AllowDevelopmentWithoutDevLicense" -Value 1
# Register from staging dir
Add-AppxPackage -Register "C:\Staging\AppxManifest.xml"
```
- No cert needed, no admin for cert stores
- Package runs from staging dir, not WindowsApps
- Works when `AllowAllTrustedApps=1` + `AllowDevelopmentWithoutDevLicense=1`
### Option B: Signed MSIX (requires admin for cert stores)
```powershell
# Create self-signed cert
$cert = New-SelfSignedCertificate -Subject "CN=..." -CertStoreLocation "Cert:\CurrentUser\My" ...
# MUST add to LocalMachine\Root and LocalMachine\TrustedPeople (requires admin)
# CurrentUser\Root is NOT trusted for MSIX — returns 0x800B0109
# Pack
makeappx pack /d Staging /p Output.msix /nv
# Sign
signtool sign /fd SHA256 /a /f cert.pfx /p password Output.msix
# Install
Add-AppxPackage -Path Output.msix
# CLEANUP: Remove cert from all stores + delete PFX after install
```
## Step 6: Launch
```powershell
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\PackageFamilyName!App'
```
- Wait ≥8 seconds before checking process
- Verify: PID path starts with Rev package, not original
- Check `MainWindowTitle` is non-empty
- RAM > 150MB indicates UI rendered
## Step 7: Verify Changes
- UI Automation: `[System.Windows.Automation.AutomationElement]::FromHandle($proc.MainWindowHandle)`
- Find Text elements by name to confirm UI changes visible
- Screenshot + pixel sampling for visual proof
## Step 8: Add Custom Functions
- Create new `Page` subclass in `VibeProxy.Views/`
- Add routing in `NavigateToTag`: `"CustomPage" => typeof(CustomPage)`
- Add `NavigationViewItem` programmatically in constructor:
```csharp
var navItem = new NavigationViewItem { Content = "Custom", Tag = "CustomPage", Icon = new FontIcon { Glyph = "\uE9D9;" } };
NavView.MenuItems.Add(navItem);
```
- Verify via UI Automation: find ListItem with name matching Content
## Critical Lessons
- **PowerShell `$_` gets stripped through bash inline** — always use `.ps1` script files
- **`CurrentUser\Root` cert store is NOT trusted for MSIX** — must use `LocalMachine` (admin) or loose register
- **XBF v2.1 XAML not decompilable** — use original `resources.pri`, modify UI programmatically in C#
- **`NavView.PaneBackground` doesn't exist in WinUI 3** — use `NavView.Background` instead
- **`Window.RequestedTheme` not available** — set theme on child elements
- **`Color` is ambiguous** — qualify as `Windows.UI.Color.FromArgb(...)`
- **Self-contained publish is mandatory** — FDD fails in MSIX without framework discovery
- **`makeappx pack` on 1200+ files takes ~70 seconds** — use async/background
- **`Add-AppxPackage` on 300MB MSIX takes minutes** — use loose register instead

133
our-skills/winui3-reverse-engineering/SKILL.md Normal file
View File

@@ -0,0 +1,133 @@
---
name: winui3-reverse-engineering
description: "Reverse engineer WinUI 3 / .NET 8 MSIX applications: ILSpy decompilation, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch with modified code"
---
# WinUI 3 Reverse Engineering Pipeline
## When to use
Reverse engineering a WinUI 3 / Windows App SDK / .NET 8 MSIX-packaged desktop application. Produces editable C# source, rebuildable MSIX, and a running modified app side-by-side with the original.
## Prerequisites
- ILSpy CLI (`dotnet tool install --global ilspycmd`)
- .NET 8 SDK
- Windows SDK (makeappx.exe, signtool.exe, makepri.exe)
- PowerShell 5+
- Target app installed as MSIX (in `C:\Program Files\WindowsApps\`)
## Steps
### 1. Locate the app
```powershell
Get-Process <AppName> | Select-Object Id,Path
# Path will be like C:\Program Files\WindowsApps\<PackageFullName>\<App>.exe
```
### 2. Identify the stack
- `.dll` next to `.exe` = .NET app (check for `coreclr.dll`, `hostfxr.dll`)
- Main `.dll` (3+ MB) = application logic; `.exe` (small) = native loader
- `resources.pri` = XAML binary (XBF) + strings + images
- `Watchers\` or similar = backend services (may be pkg-compiled Node.js)
### 3. Decompile C#
```bash
ilspycmd "C:\path\to\App.dll" -p -o "C:\output\src" --decompile-baml -r "C:\path\to\install\dir"
```
- `--decompile-baml` may not work for WinUI 3 (XBF v2.1, not BAML)
- `-r` provides reference path for dependency resolution
### 4. Fix csproj
- ILSpy generates bare `<Reference>` without HintPath for WinRT projections
- Copy all DLLs from install dir to `libs/` folder
- Add `<HintPath>libs\*.dll</HintPath>` for each reference
- Set `<LangVersion>preview</LangVersion>` (ILSpy may emit unsupported version)
- Set `<GenerateAssemblyInfo>False</GenerateAssemblyInfo>`
### 5. Fix common compile errors
- **CS0136** (duplicate variable): rename one occurrence
- **CS0104** (ambiguous `Color`): qualify as `Windows.UI.Color.FromArgb(...)`
- **CS1061** (`PaneBackground` not on NavView): use `Background` instead
- **CS1061** (`RequestedTheme` not on Window): set on `Content` element instead
- ILSpy inlines `const` values — fix inline literals (e.g., `FindOrRegisterForKey("OriginalKey")` → `FindOrRegisterForKey(AppInstanceKey)`)
### 6. Publish self-contained
```bash
dotnet publish App.csproj -c Release -r win-x64 --self-contained true
```
- Framework-dependent publish fails in MSIX (no global .NET runtime visible)
- Self-contained bundles .NET runtime into the package
### 7. Overlay original assets
Copy from original MSIX to publish output (whitelist only, never overwrite published exe/dll):
- `resources.pri` (XBF, strings, images)
- `Assets/` folder
- `Watchers/` folder (backend)
- Locale directories (`xx-XX/`)
- `Microsoft.UI.Xaml/` folder
- Native WinUI DLLs (Microsoft.UI.Xaml.Controls.dll, CoreMessagingXP.dll, etc.)
- `Microsoft.WindowsAppRuntime.dll`, `.Bootstrap.dll`, `.Bootstrap.Net.dll`
### 8. Create AppxManifest with new identity
```xml
<Identity Name="<OriginalName>Rev" Publisher="<OriginalPublisher>" Version="3.7.2.7" ProcessorArchitecture="x64" />
```
- Use same Publisher CN as original (for cert matching)
- Bump version on each rebuild
- Keep `runFullTrust` capability
### 9. Self-signed cert + MSIX packaging
```powershell
# Create cert matching manifest Publisher
$cert = New-SelfSignedCertificate -Subject "CN=<PublisherCN>" -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3","2.5.29.19={text}")
# Add to Trusted Root and Trusted People
# Export PFX, sign MSIX with signtool
# Register with Add-AppxPackage
# CRITICAL: Remove cert from all stores and delete PFX after install
# See cleanup section below
```
### 10. Launch and verify
```powershell
Start-Process explorer.exe -ArgumentList 'shell:AppsFolder\<PackageFamilyName>!App'
Start-Sleep -Seconds 10 # WinUI 3 needs time to initialize
# Verify: PID, Path (must be Rev package), MainWindowTitle, RAM > 100MB
# UI Automation: [System.Windows.Automation.AutomationElement]::FromHandle()
# Screenshot: System.Drawing.Bitmap + CopyFromScreen + GetPixel for color verification
```
## Key gotchas
- WinUI 3 XAML is compiled to XBF v2.1 in `resources.pri`, NOT BAML — ILSpy `--decompile-baml` won't extract it
- `copy_all.ps1` that copies ALL MSIX files will overwrite rebuilt exe/dll with originals — always whitelist
- `NODE_SEA_FUSE:0` = disabled SEA; check for `pkg` markers (`PRELUDE_POSITION`, `process.versions.pkg`) instead
- pkg auto-extracts to `%TEMP%\<AppName>\<version>\dist` — check there before manual extraction
- Cert in LocalMachine\Root with accessible PFX = code signing security risk — always cleanup after
- `Start-Process` cannot launch `shell:AppsFolder` URIs directly — use `explorer.exe` as intermediary
- Process may show 0x0 window for 10+ seconds before UI initializes — wait before screenshot
## XBF extraction (if needed)
```powershell
# Dump PRI
makepri.exe dump /if "resources.pri" /of "dump.xml" /dt detailed /o
# Extract XBF from Base64 in XML
# XBF v2.1 offsets are relative to metadata start (byte 12), not absolute
# Table entries are 12 bytes each (not 8 as in v1.0)
# Node encoding differs from v1.0 — no working open-source parser exists
```
## pkg-compiled Node.js backend detection
- PE header: no CLR header (not .NET)
- Search for `NODE_SEA_FUSE`, `pkg/prelude`, `process.versions.pkg`
- `process.versions.pkg = '6.22.0'` confirms pkg version
- Trailing data after PE sections (gzip compressed) = pkg payload
- Auto-extraction: check `%TEMP%\<AppName>\` for already-extracted dist
## Security cleanup (MANDATORY after install)
```powershell
# Remove self-signed cert from all stores
$certSubject = "CN=<PublisherCN>"
# Remove from LocalMachine\Root, LocalMachine\TrustedPeople, CurrentUser\My
# Delete PFX file
# Verify: Get-ChildItem Cert:\... | Where-Object { $_.Subject -eq $certSubject } returns empty
```

520
protocol-reverse-engineering/SKILL.md Normal file
View File

@@ -0,0 +1,520 @@
---
name: protocol-reverse-engineering
description: Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
---
# Protocol Reverse Engineering
Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging.
## Traffic Capture
### Wireshark Capture
```bash
# Capture on specific interface
wireshark -i eth0 -k
# Capture with filter
wireshark -i eth0 -k -f "port 443"
# Capture to file
tshark -i eth0 -w capture.pcap
# Ring buffer capture (rotate files)
tshark -i eth0 -b filesize:100000 -b files:10 -w capture.pcap
```
### tcpdump Capture
```bash
# Basic capture
tcpdump -i eth0 -w capture.pcap
# With filter
tcpdump -i eth0 port 8080 -w capture.pcap
# Capture specific bytes
tcpdump -i eth0 -s 0 -w capture.pcap # Full packet
# Real-time display
tcpdump -i eth0 -X port 80
```
### Man-in-the-Middle Capture
```bash
# mitmproxy for HTTP/HTTPS
mitmproxy --mode transparent -p 8080
# SSL/TLS interception
mitmproxy --mode transparent --ssl-insecure
# Dump to file
mitmdump -w traffic.mitm
# Burp Suite
# Configure browser proxy to 127.0.0.1:8080
```
## Protocol Analysis
### Wireshark Analysis
```
# Display filters
tcp.port == 8080
http.request.method == "POST"
ip.addr == 192.168.1.1
tcp.flags.syn == 1 && tcp.flags.ack == 0
frame contains "password"
# Following streams
Right-click > Follow > TCP Stream
Right-click > Follow > HTTP Stream
# Export objects
File > Export Objects > HTTP
# Decryption
Edit > Preferences > Protocols > TLS
- (Pre)-Master-Secret log filename
- RSA keys list
```
### tshark Analysis
```bash
# Extract specific fields
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port
# Statistics
tshark -r capture.pcap -q -z conv,tcp
tshark -r capture.pcap -q -z endpoints,ip
# Filter and extract
tshark -r capture.pcap -Y "http" -T json > http_traffic.json
# Protocol hierarchy
tshark -r capture.pcap -q -z io,phs
```
### Scapy for Custom Analysis
```python
from scapy.all import *
# Read pcap
packets = rdpcap("capture.pcap")
# Analyze packets
for pkt in packets:
if pkt.haslayer(TCP):
print(f"Src: {pkt[IP].src}:{pkt[TCP].sport}")
print(f"Dst: {pkt[IP].dst}:{pkt[TCP].dport}")
if pkt.haslayer(Raw):
print(f"Data: {pkt[Raw].load[:50]}")
# Filter packets
http_packets = [p for p in packets if p.haslayer(TCP)
and (p[TCP].sport == 80 or p[TCP].dport == 80)]
# Create custom packets
pkt = IP(dst="target")/TCP(dport=80)/Raw(load="GET / HTTP/1.1\r\n")
send(pkt)
```
## Protocol Identification
### Common Protocol Signatures
```
HTTP - "HTTP/1." or "GET " or "POST " at start
TLS/SSL - 0x16 0x03 (record layer)
DNS - UDP port 53, specific header format
SMB - 0xFF 0x53 0x4D 0x42 ("SMB" signature)
SSH - "SSH-2.0" banner
FTP - "220 " response, "USER " command
SMTP - "220 " banner, "EHLO" command
MySQL - 0x00 length prefix, protocol version
PostgreSQL - 0x00 0x00 0x00 startup length
Redis - "*" RESP array prefix
MongoDB - BSON documents with specific header
```
### Protocol Header Patterns
```
+--------+--------+--------+--------+
| Magic number / Signature |
+--------+--------+--------+--------+
| Version | Flags |
+--------+--------+--------+--------+
| Length | Message Type |
+--------+--------+--------+--------+
| Sequence Number / Session ID |
+--------+--------+--------+--------+
| Payload... |
+--------+--------+--------+--------+
```
## Binary Protocol Analysis
### Structure Identification
```python
# Common patterns in binary protocols
# Length-prefixed message
struct Message {
uint32_t length; # Total message length
uint16_t msg_type; # Message type identifier
uint8_t flags; # Flags/options
uint8_t reserved; # Padding/alignment
uint8_t payload[]; # Variable-length payload
};
# Type-Length-Value (TLV)
struct TLV {
uint8_t type; # Field type
uint16_t length; # Field length
uint8_t value[]; # Field data
};
# Fixed header + variable payload
struct Packet {
uint8_t magic[4]; # "ABCD" signature
uint32_t version;
uint32_t payload_len;
uint32_t checksum; # CRC32 or similar
uint8_t payload[];
};
```
### Python Protocol Parser
```python
import struct
from dataclasses import dataclass
@dataclass
class MessageHeader:
magic: bytes
version: int
msg_type: int
length: int
@classmethod
def from_bytes(cls, data: bytes):
magic, version, msg_type, length = struct.unpack(
">4sHHI", data[:12]
)
return cls(magic, version, msg_type, length)
def parse_messages(data: bytes):
offset = 0
messages = []
while offset < len(data):
header = MessageHeader.from_bytes(data[offset:])
payload = data[offset+12:offset+12+header.length]
messages.append((header, payload))
offset += 12 + header.length
return messages
# Parse TLV structure
def parse_tlv(data: bytes):
fields = []
offset = 0
while offset < len(data):
field_type = data[offset]
length = struct.unpack(">H", data[offset+1:offset+3])[0]
value = data[offset+3:offset+3+length]
fields.append((field_type, value))
offset += 3 + length
return fields
```
### Hex Dump Analysis
```python
def hexdump(data: bytes, width: int = 16):
"""Format binary data as hex dump."""
lines = []
for i in range(0, len(data), width):
chunk = data[i:i+width]
hex_part = ' '.join(f'{b:02x}' for b in chunk)
ascii_part = ''.join(
chr(b) if 32 <= b < 127 else '.'
for b in chunk
)
lines.append(f'{i:08x} {hex_part:<{width*3}} {ascii_part}')
return '\n'.join(lines)
# Example output:
# 00000000 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d HTTP/1.1 200 OK.
# 00000010 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 .Content-Type: t
```
## Encryption Analysis
### Identifying Encryption
```python
# Entropy analysis - high entropy suggests encryption/compression
import math
from collections import Counter
def entropy(data: bytes) -> float:
if not data:
return 0.0
counter = Counter(data)
probs = [count / len(data) for count in counter.values()]
return -sum(p * math.log2(p) for p in probs)
# Entropy thresholds:
# < 6.0: Likely plaintext or structured data
# 6.0-7.5: Possibly compressed
# > 7.5: Likely encrypted or random
# Common encryption indicators
# - High, uniform entropy
# - No obvious structure or patterns
# - Length often multiple of block size (16 for AES)
# - Possible IV at start (16 bytes for AES-CBC)
```
### TLS Analysis
```bash
# Extract TLS metadata
tshark -r capture.pcap -Y "ssl.handshake" \
-T fields -e ip.src -e ssl.handshake.ciphersuite
# JA3 fingerprinting (client)
tshark -r capture.pcap -Y "ssl.handshake.type == 1" \
-T fields -e ssl.handshake.ja3
# JA3S fingerprinting (server)
tshark -r capture.pcap -Y "ssl.handshake.type == 2" \
-T fields -e ssl.handshake.ja3s
# Certificate extraction
tshark -r capture.pcap -Y "ssl.handshake.certificate" \
-T fields -e x509sat.printableString
```
### Decryption Approaches
```bash
# Pre-master secret log (browser)
export SSLKEYLOGFILE=/tmp/keys.log
# Configure Wireshark
# Edit > Preferences > Protocols > TLS
# (Pre)-Master-Secret log filename: /tmp/keys.log
# Decrypt with private key (if available)
# Only works for RSA key exchange
# Edit > Preferences > Protocols > TLS > RSA keys list
```
## Custom Protocol Documentation
### Protocol Specification Template
```markdown
# Protocol Name Specification
## Overview
Brief description of protocol purpose and design.
## Transport
- Layer: TCP/UDP
- Port: XXXX
- Encryption: TLS 1.2+
## Message Format
### Header (12 bytes)
| Offset | Size | Field | Description |
| ------ | ---- | ------- | ----------------------- |
| 0 | 4 | Magic | 0x50524F54 ("PROT") |
| 4 | 2 | Version | Protocol version (1) |
| 6 | 2 | Type | Message type identifier |
| 8 | 4 | Length | Payload length in bytes |
### Message Types
| Type | Name | Description |
| ---- | --------- | ---------------------- |
| 0x01 | HELLO | Connection initiation |
| 0x02 | HELLO_ACK | Connection accepted |
| 0x03 | DATA | Application data |
| 0x04 | CLOSE | Connection termination |
### Type 0x01: HELLO
| Offset | Size | Field | Description |
| ------ | ---- | ---------- | ------------------------ |
| 0 | 4 | ClientID | Unique client identifier |
| 4 | 2 | Flags | Connection flags |
| 6 | var | Extensions | TLV-encoded extensions |
## State Machine
```
[INIT] --HELLO--> [WAIT_ACK] --HELLO_ACK--> [CONNECTED]
|
DATA/DATA
|
[CLOSED] <--CLOSE--+
```
## Examples
### Connection Establishment
```
Client -> Server: HELLO (ClientID=0x12345678)
Server -> Client: HELLO_ACK (Status=OK)
Client -> Server: DATA (payload)
```
```
### Wireshark Dissector (Lua)
```lua
-- custom_protocol.lua
local proto = Proto("custom", "Custom Protocol")
-- Define fields
local f_magic = ProtoField.string("custom.magic", "Magic")
local f_version = ProtoField.uint16("custom.version", "Version")
local f_type = ProtoField.uint16("custom.type", "Type")
local f_length = ProtoField.uint32("custom.length", "Length")
local f_payload = ProtoField.bytes("custom.payload", "Payload")
proto.fields = { f_magic, f_version, f_type, f_length, f_payload }
-- Message type names
local msg_types = {
[0x01] = "HELLO",
[0x02] = "HELLO_ACK",
[0x03] = "DATA",
[0x04] = "CLOSE"
}
function proto.dissector(buffer, pinfo, tree)
pinfo.cols.protocol = "CUSTOM"
local subtree = tree:add(proto, buffer())
-- Parse header
subtree:add(f_magic, buffer(0, 4))
subtree:add(f_version, buffer(4, 2))
local msg_type = buffer(6, 2):uint()
subtree:add(f_type, buffer(6, 2)):append_text(
" (" .. (msg_types[msg_type] or "Unknown") .. ")"
)
local length = buffer(8, 4):uint()
subtree:add(f_length, buffer(8, 4))
if length > 0 then
subtree:add(f_payload, buffer(12, length))
end
end
-- Register for TCP port
local tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(8888, proto)
```
## Active Testing
### Fuzzing with Boofuzz
```python
from boofuzz import *
def main():
session = Session(
target=Target(
connection=TCPSocketConnection("target", 8888)
)
)
# Define protocol structure
s_initialize("HELLO")
s_static(b"\x50\x52\x4f\x54") # Magic
s_word(1, name="version") # Version
s_word(0x01, name="type") # Type (HELLO)
s_size("payload", length=4) # Length field
s_block_start("payload")
s_dword(0x12345678, name="client_id")
s_word(0, name="flags")
s_block_end()
session.connect(s_get("HELLO"))
session.fuzz()
if __name__ == "__main__":
main()
```
### Replay and Modification
```python
from scapy.all import *
# Replay captured traffic
packets = rdpcap("capture.pcap")
for pkt in packets:
if pkt.haslayer(TCP) and pkt[TCP].dport == 8888:
send(pkt)
# Modify and replay
for pkt in packets:
if pkt.haslayer(Raw):
# Modify payload
original = pkt[Raw].load
modified = original.replace(b"client", b"CLIENT")
pkt[Raw].load = modified
# Recalculate checksums
del pkt[IP].chksum
del pkt[TCP].chksum
send(pkt)
```
## Best Practices
### Analysis Workflow
1. **Capture traffic**: Multiple sessions, different scenarios
2. **Identify boundaries**: Message start/end markers
3. **Map structure**: Fixed header, variable payload
4. **Identify fields**: Compare multiple samples
5. **Document format**: Create specification
6. **Validate understanding**: Implement parser/generator
7. **Test edge cases**: Fuzzing, boundary conditions
### Common Patterns to Look For
- Magic numbers/signatures at message start
- Version fields for compatibility
- Length fields (often before variable data)
- Type/opcode fields for message identification
- Sequence numbers for ordering
- Checksums/CRCs for integrity
- Timestamps for timing
- Session/connection identifiers

96
research-what-we-did/00-source-iishko-original.md Normal file
View File

@@ -0,0 +1,96 @@
# ИСХОДНИК — пост [REDACTED] (26.09.2026 22:43–22:54) — то что мы прожарили
Сохранён для диффа с `rev-guide-v4.md`. Все ошибки (180 тулов, 855, 47к, 29 доменов, 194 статьи, PMAT-course, «всё бесплатное», Qiling «без запуска») — здесь в оригинале.
---
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026
Полный путь от нуля до самостоятельного анализа бинарников: база, инструменты, пайплайн, реверс через ИИ, материалы. Всё бесплатное или с free-версией.
ШАГ 1. БАЗА
Без этого инструменты бесполезны:
- C — указатели, память, структуры, строки
- Ассемблер x86-64 — регистры, стек, calling conventions, переходы
- Compiler Explorer (https://godbolt.org/) — пишешь функцию на C, видишь её ассемблер. Лучший способ понять, что делает компилятор
- Формат PE (https://learn.microsoft.com/windows/win32/debug/pe-format) — заголовки, секции, таблица импортов
Результат: свободно читаешь ассемблерный листинг простой функции.
ШАГ 2. ИНСТРУМЕНТЫ
- Ghidra (https://github.com/NationalSecurityAgency/ghidra) — дизассемблер + декомпилятор, бесплатный. Основной инструмент для обучения, скриптится на Python через Ghidrathon (https://github.com/mandiant/Ghidrathon)
- x64dbg (https://x64dbg.com/) — отладчик Windows
- Detect It Easy (https://github.com/horsicq/Detect-It-Easy) — определение компилятора, протектора, упаковщика
- HxD (https://mh-nexus.de/hxd/) — hex-редактор
Позже пригодятся: IDA Pro (https://hex-rays.com/) — эталонный декомпилятор Hex-Rays; Binary Ninja (https://binary.ninja/) — API для автоматизации; radare2 (https://github.com/radareorg/radare2) / rizin (https://github.com/rizinorg/rizin) + Cutter (https://github.com/rizinorg/cutter) — консольный стек.
ШАГ 3. ПРАКТИКА
- crackmes.one (https://crackmes.one/) — задачи по реверсу, сложность 1–6
- Порядок: 15–20 задач 1☆, затем 10–15 задач 2☆, затем 3☆
- Осваиваются: поиск точки входа, паттерн проверки пароля, простые анти-отладочные приёмы
- ROP Emporium (https://ropemporium.com/) — exploitation по шагам
Результат: самостоятельно разбираешь небольшой бинарь от запуска до ответа.
ШАГ 4. СИСТЕМА
- pwn.college (https://pwn.college/) — бесплатные модули от ASU: ассемблер, основы RE, автопроверка, 15–25 задач на модуль
- OpenSecurityTraining2 (https://p.ost2.fyi/) — реверс C++, символьное исполнение, отладчики, UEFI
- RE-MA-Roadmap (https://github.com/x86byte/RE-MA-Roadmap) — roadmap от нуля до malware-аналитика
ШАГ 5. ПАЙПЛАЙН АНАЛИЗА БИНАРЯ
Порядок, по которому разбирают реальные сэмплы. Перед запуском чего-либо живого: виртуалка + снапшот, без общих папок и реальной сети.
1. Триаж без запуска: DIE — упаковщик/компилятор; FLOSS (https://github.com/mandiant/flare-floss) — строки, включая обфусцированные; capa (https://github.com/mandiant/capa) — capabilities с маппингом на ATT&CK
2. Распаковка: натив — x64dbg до OEP, дамп, IAT чинит Scylla (https://github.com/NtQuery/Scylla); .NET — de4dot-форк (https://github.com/kant2002/de4dot), разбор в dnSpyEx (https://github.com/dnSpyEx/dnSpy); без запуска — Qiling (https://github.com/qilingframework/qiling)
3. Статика: Ghidra/IDA — декомпиляция, xrefs, переименование
4. Динамика: отладчик для проверки гипотез; Frida (https://frida.re/) — хуки на функции, снятие конфигов
5. Деобфускация: D-810 (https://gitlab.com/eshard/d810) — MBA и flattening в декомпиляторе IDA; эмуляция и трейсинг — Unicorn (https://github.com/unicorn-engine/unicorn), Qiling, angr (https://github.com/angr/angr)
6. Поведение: FakeNet-NG (https://github.com/mandiant/flare-fakenet-ng) — перехват трафика; CAPEv2 (https://github.com/kevoreilly/capev2) — сэндбокс; Speakeasy (https://github.com/mandiant/speakeasy) — эмуляция малвари и драйверов без VM
7. Диффинг версий: BinDiff (https://github.com/google/bindiff) / Diaphora (https://github.com/joxeankoret/diaphora) — что изменил вендор, где была дыра
8. Выход: YARA-правило (https://github.com/VirusTotal/yara), IOC, отчёт
Шаг 6 — реверс через ИИ — во 2-м и 3-м сообщениях.
---
(2/4) ШАГ 6. РЕВЕРС ЧЕРЕЗ ИИ: MCP-СЕРВЕРЫ
IDA Pro: ida-pro-mcp (12.3к, mrexodia) · ida-mcp (официальный Hex-Rays, MIT, IDA 9.4+) · IDA-NO-MCP (2к) · ida-multi-mcp · ida-mcp-rs (Rust headless)
Ghidra: GhidraMCP (10.2к, LaurieWired) · ghidra-mcp (bethington, 4к, «200+ тулов») · ReVa (840) · GhidrAssistMCP · GhidraGPT · PyGhidra-MCP · OGhidra (LLNL, «локальные LLM, сэмплы не уходят в облако»)
r2/Binja: radare2-mcp (официальный) · r2ai · binary_ninja_mcp · binary-ninja-headless-mcp («180 тулов») · Rikugan
Отладчики: x64dbg-mcp · cheatengine-mcp-bridge (1.5к) · windbg-mcp
Малварь/Android/.NET/Python: Qu1cksc0pe · Reversecore_MCP · Arkana · remnux-mcp-server · jadx-ai-mcp (2.8к) · apktool-mcp-server · de4py · disrobe · TriageMCP
---
(3/4) СКИЛЛЫ
reverse-skill (37.9к, роутер) · Anthropic-Cybersecurity-Skills (33.4к, «817 скиллов по 29 доменам») · ctf-skills (3.3к) · android-reverse-engineering-skill (7.9к) · Trail of Bits skills (7.2к) · Claude-Red (6.9к) · Claude-Code-CyberSecurity-Skill (22) · open-reverselab (1.2к, «база на 194 статьи») · REA
SkillSpector (NVIDIA, 18.4к) — сканер скиллов.
АГЕНТЫ: agentic-malware-analysis · auto-re-agent (2к) · reverify (1.2к) · firefox-reverse (855) · anything-analyzer (3.7к) · FIRERPA (8.4к) · shannon (47к)
ДАТАСЕТЫ: mcp-reversing-dataset · AgentRE-Bench · CrackMeBench (arXiv:2605.10597)
ОГРАНИЧЕНИЯ: агент уверенно ошибается в именах функций; упакованный сэмпл = слабый псевдод; строки как промпт-инъекция (arXiv:2605.30667) — «малварь учится разговаривать с твоим ассистентом»
Каталоги: awesome-ai-reverse · Awesome-RE-MCP · mcp-security-hub
---
(4/4) ШАГ 7. СПЕЦИАЛИЗАЦИЯ
Малварь: PMAT (https://github.com/HuskyHacks/PMAT-course) — 404, мёртв
Прошивки: binwalk v3 · EMBA
Android: jadx + apktool
CTF: ctftime.org, Flare-On
МАТЕРИАЛЫ: intro-rev-ida-pro («Реверсинг с IDA Pro от 0» Нарвахи) · книги: PMA, PRE, Ghidra Book, RE for Beginners · Awesome-Reversing · YouTube: OALabs, LiveOverflow, Gynvael Coldwind (без ссылок)
👻 [REDACTED] (https://[REDACTED]) · промо-футер «Бесплатное API (t.me/[REDACTED])» ×4 сообщения — убран при репосте

21
research-what-we-did/Deep-Research-skills/LICENSE Normal file
View File

@@ -0,0 +1,21 @@
MIT License
Copyright (c) 2026 Lan Zheng
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

170
research-what-we-did/Deep-Research-skills/README.md Normal file
View File

@@ -0,0 +1,170 @@
# Deep Research Skill for Claude Code / OpenCode / Codex
[English](README.md) | [中文](README.zh.md)
> If you find this project helpful, please give it a star! :star:
> Inspired by [RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context](https://arxiv.org/abs/2511.18743)
A structured research workflow skill for Claude Code, OpenCode, and Codex, supporting two-phase research: outline generation (extensible) and deep investigation. Human-in-the-loop design ensures precise control at every stage.
![Deep Research Skills Workflow](workflow.png)
## Use Cases
- **Academic Research**: Paper surveys, benchmark reviews, literature analysis
- **Technical Research**: Technology comparison, framework evaluation, tool selection
- **Market Research**: Competitor analysis, industry trends, product comparison
- **Due Diligence**: Company research, investment analysis, risk assessment
## Installation
```bash
git clone https://github.com/Weizhena/deep-research-skills.git
cd deep-research-skills
```
### Claude Code
```bash
# English version
cp -r skills/research-en/* ~/.claude/skills/
# Chinese version
cp -r skills/research-zh/* ~/.claude/skills/
# Required: Install agent and modules
cp agents/web-search-agent.md ~/.claude/agents/
cp -r agents/web-search-modules ~/.claude/agents/
# Required: Install Python dependency
pip install pyyaml
```
### OpenCode (default: gpt-5.4)
```bash
# Skills (same as Claude Code)
cp -r skills/research-en/* ~/.claude/skills/ # or research-zh for Chinese
# Required: Enable web search for current shell
export OPENCODE_ENABLE_EXA=1
# Optional: make it permanent
echo 'export OPENCODE_ENABLE_EXA=1' >> ~/.bashrc
source ~/.bashrc
# Required: Install agent and modules
cp agents/web-search-opencode.md ~/.config/opencode/agents/web-search.md
cp -r agents/web-search-modules ~/.config/opencode/agents/
# Required: Install Python dependency
pip install pyyaml
```
> **Important**: In OpenCode, ANY model's websearch requires `OPENCODE_ENABLE_EXA=1`. A plain `export` only affects the current shell; writing it to `~/.bashrc` makes it persistent. Without it, you only get `web fetch`, which is weaker for the deep research phase.
### Codex
```bash
# English version
mkdir -p ~/.codex/skills ~/.codex/agents
cp -r skills/research-codex-en/* ~/.codex/skills/
# Chinese version
mkdir -p ~/.codex/skills ~/.codex/agents
cp -r skills/research-codex-zh/* ~/.codex/skills/
# Required: Install web researcher agent and modules
cp agents-codex/web-researcher.toml ~/.codex/agents/
cp -r agents-codex/web-search-modules ~/.codex/agents/
# Required: Install Python dependency
pip install pyyaml
```
Add or update `~/.codex/config.toml` using either method below:
**Option A: Automatic script**
```bash
cd deep-research-skills
bash scripts/install-codex.sh
```
**Option B: Manual edit**
```toml
suppress_unstable_features_warning = true
[features]
multi_agent = true
default_mode_request_user_input = true
[agents.web_researcher]
description = "Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation, or compilation of findings from multiple sources."
config_file = "agents/web-researcher.toml"
```
## Commands
> **Claude Code 2.1.0+**: Direct `/skill-name` trigger is now supported!
>
> **Older versions**: Use `run /skill-name` format instead.
>
> **Codex**: You can trigger these skills from `/skills` -> `List Skills`, or ask naturally, for example `Use the research skill to build an outline for AI Agent Demo 2025`.
| Command (2.1.0+) | Description |
|------------------|-------------|
| `/research` | Generate research outline with items and fields |
| `/research-add-items` | Add more research items to existing outline |
| `/research-add-fields` | Add more field definitions to existing outline |
| `/research-deep` | Deep research each item with parallel agents |
| `/research-report` | Generate markdown report from JSON results |
## Workflow & Example
> **Example**: Researching "AI Agent Demo 2025"
### Phase 1: Generate Outline
```
/research AI Agent Demo 2025
```
💡 **What will happen**: Tell it your topic → It creates a research list for you
**You get**: A list of 17 AI Agents to research (ChatGPT Agent, Claude Computer Use, Cursor, etc.) + what info to collect for each
### (Optional) Not satisfied? Add more
```
/research-add-items
/research-add-fields
```
💡 **What will happen**: Add more research items or field definitions
### Phase 2: Deep Research
```
/research-deep
```
💡 **What will happen**: AI automatically searches the web for each item, one by one
**You get**: Detailed info for each Agent (company, release date, pricing, tech specs, reviews...)
### Phase 3: Generate Report
```
/research-report
```
💡 **What will happen**: All data → One organized report
**You get**: `report.md` - A complete markdown report with table of contents, ready to read or share
## Need Help?
If you have questions, ask Claude Code, OpenCode, or Codex to explain this project:
```
Help me understand this project: https://github.com/Weizhena/deep-research-skills
```
## References
- RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context
## License
MIT

175
research-what-we-did/Deep-Research-skills/README.zh.md Normal file
View File

@@ -0,0 +1,175 @@
# Deep Research Skill for Claude Code / OpenCode / Codex
[English](README.md) | [中文](README.zh.md)
> 如果喜欢就请 star 一下吧！:star:
> 灵感来源：[RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context](https://arxiv.org/abs/2511.18743)
适用于 Claude Code、OpenCode 和 Codex 的结构化调研工作流技能，支持两阶段调研：outline生成（可扩展）和深度调查。人在回路设计确保每个阶段的精确控制。
![Deep Research Skills 工作流](workflow.png)
## 使用场景
- **学术研究**：论文综述、benchmark评测、文献分析
- **技术研究**：技术对比、框架评估、工具选型
- **市场研究**：竞品分析、行业趋势、产品比较
- **尽职调查**：公司研究、投资分析、风险评估
## 安装
```bash
git clone https://github.com/Weizhena/deep-research-skills.git
cd deep-research-skills
```
### Claude Code
```bash
# 中文版
cp -r skills/research-zh/* ~/.claude/skills/
# 英文版
cp -r skills/research-en/* ~/.claude/skills/
# 必需：安装agent和模块
cp agents/web-search-agent.md ~/.claude/agents/
cp -r agents/web-search-modules ~/.claude/agents/
# 必需：安装Python依赖
pip install pyyaml
```
### OpenCode (默认: gpt-5.4)
```bash
# Skills (同 Claude Code)
cp -r skills/research-zh/* ~/.claude/skills/ # 或 research-en 英文版
# 必需：为当前 shell 启用 web search
export OPENCODE_ENABLE_EXA=1
# 可选：写入 ~/.bashrc，永久生效
echo 'export OPENCODE_ENABLE_EXA=1' >> ~/.bashrc
source ~/.bashrc
# 必需：安装agent和模块
cp agents/web-search-opencode.md ~/.config/opencode/agents/web-search.md
cp -r agents/web-search-modules ~/.config/opencode/agents/
# 必需：安装Python依赖
pip install pyyaml
```
> **重要**：在 OpenCode 中，任何模型要想使用 `websearch`，需要设置 `OPENCODE_ENABLE_EXA=1`。单纯 `export` 只对当前 shell 生效；写入 `~/.bashrc` 后才是永久生效。不设置时，只有 `web fetch`，对深度调研阶段会弱很多。
### Codex
```bash
# 英文版
mkdir -p ~/.codex/skills ~/.codex/agents
cp -r skills/research-codex-en/* ~/.codex/skills/
# 中文版
mkdir -p ~/.codex/skills ~/.codex/agents
cp -r skills/research-codex-zh/* ~/.codex/skills/
# 必需：安装 web researcher agent 和模块
cp agents-codex/web-researcher.toml ~/.codex/agents/
cp -r agents-codex/web-search-modules ~/.codex/agents/
# 必需：安装 Python 依赖
pip install pyyaml
```
使用以下两种方式之一更新 `~/.codex/config.toml`：
**方式 A：自动脚本**
```bash
cd deep-research-skills
bash scripts/install-codex.sh
```
**方式 B：手动编辑**
```toml
suppress_unstable_features_warning = true
[features]
multi_agent = true
default_mode_request_user_input = true
[agents.web_researcher]
description = "Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation, or compilation of findings from multiple sources."
config_file = "agents/web-researcher.toml"
```
## 命令
> **Claude Code 2.1.0+**：现已支持直接 `/skill-name` 触发！
>
> **旧版本**：请使用 `run /skill-name` 格式。
>
> **Codex**：可以通过 `/skills` -> `List Skills` 选择这些 skills，也可以用自然语言触发，例如 `Use the research skill to build an outline for AI Agent Demo 2025`。
| 命令 (2.1.0+) | 描述 |
|---------------|------|
| `/research` | 生成包含items和fields的调研outline |
| `/research-add-items` | 向现有outline添加更多调研对象 |
| `/research-add-fields` | 向现有outline添加更多字段定义 |
| `/research-deep` | 使用并行agents对每个item进行深度调研 |
| `/research-report` | 从JSON结果生成markdown报告 |
## 工作流 & 示例
> **示例**：调研 "AI Agent Demo 2025"
### 阶段1：生成Outline
```
/research AI Agent Demo 2025
```
💡 **会发生什么**：告诉它你要研究什么 → 它帮你列出调研清单
对于 Codex，可以这样说：
```
Use the research skill to build an outline for AI Agent Demo 2025
```
**你会得到**：17个待调研的AI Agent清单（ChatGPT Agent、Claude Computer Use、Cursor等）+ 每个要收集哪些信息
### （可选）不满意？继续添加
```
/research-add-items
/research-add-fields
```
💡 **会发生什么**：补充更多调研对象或字段定义
### 阶段2：深度调研
```
/research-deep
```
💡 **会发生什么**：AI自动上网搜索每个item的详细信息，逐个完成
**你会得到**：每个Agent的详细资料（公司、发布日期、定价、技术规格、用户评价...）
### 阶段3：生成报告
```
/research-report
```
💡 **会发生什么**：所有数据 → 一份整理好的报告
**你会得到**：`report.md` - 带目录的完整Markdown报告，可直接阅读或分享
## 遇到问题？
如果过程中有什么不懂的，可以让 Claude Code、OpenCode 或 Codex 帮你理解这个项目：
```
帮我理解这个项目: https://github.com/Weizhena/deep-research-skills
```
## 参考文献
- RhinoInsight: Improving Deep Research through Control Mechanisms for Model Behavior and Context
## 许可证
MIT

130
research-what-we-did/Deep-Research-skills/agents-codex/web-researcher.toml Normal file
View File

@@ -0,0 +1,130 @@
model = "gpt-5.4"
model_reasoning_effort = "high"
sandbox_mode = "read-only"
web_search = "live"
developer_instructions = """
DONT USE ANY SKILLS.
You are an elite internet researcher specializing in finding relevant information across diverse online sources. Your expertise lies in creative search strategies, thorough investigation, and comprehensive compilation of findings.
**Core Capabilities:**
- You excel at crafting multiple search query variations to uncover hidden gems of information
- You systematically explore GitHub Issues, Reddit, Stack Overflow, Stack Exchange, technical forums, official documentation, blog posts, Dev.to, Medium, Hacker News, Discord, X/Twitter, Google Scholar, arXiv, Hugging Face Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM Digital Library, IEEE Xplore, CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent Cloud and Alibaba Cloud developer communities
- You never settle for surface-level results - you dig deep to find the most relevant and helpful information
- You are particularly skilled at debugging assistance, finding others who've encountered similar issues
- You understand context and can identify patterns across disparate sources
**Research Methodology:**
0. **Get Current Date**: Run `date +%Y-%m-%d` to get today's date for time-sensitive searches.
1. **Query Generation Phase**: When given a topic or problem, you will:
- Generate 5-10 different search query variations to maximize coverage
- Include technical terms, error messages, library names, and common misspellings
- Think of how different people might describe the same issue (novice vs. expert terminology)
- Consider searching for both the problem AND potential solutions
- Use exact phrases in quotes for error messages
- Include version numbers and environment details when relevant
**Scenario-Specific Query Strategies (MANDATORY Module Loading)**:
Before using live web search, you MUST inspect the relevant strategy module file(s) under `~/.codex/agents/web-search-modules/`. Based on the research type, read the corresponding file(s):
- **Debugging/GitHub Issues** → Read `github-debug.md`
Sources: GitHub Issues (open/closed)
- **Best Practices/Comparative Research** → Read `general-web.md`
Sources: Reddit, Official Docs, Blogs, Hacker News, Dev.to, Medium, Discord, X/Twitter
- **Academic Paper Search** → Read `academic-papers.md`
Sources: Google Scholar, arXiv, HuggingFace Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM DL, IEEE Xplore
- **Chinese Tech Community** → Read `chinese-tech.md`
Sources: CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent/Alibaba Cloud
- **Technical Q&A** → Read `stackoverflow.md`
Sources: Stack Overflow, Stack Exchange, technical forums
DO NOT skip this step. Do not start web research before reading at least one relevant module.
**Module Routing**: Each search may be routed to one or multiple modules:
- **Single module**: When the task clearly belongs to one domain, load only that module
- e.g. "search vllm memory leak issue" → Read `github-debug` only
- **Multi-module**: When complex tasks require cross-domain coverage, load multiple modules
- e.g. "transformers OOM problem" → Read `github-debug` + `stackoverflow` + `chinese-tech`
- e.g. "attention mechanism papers and open-source implementations" → Read `academic-papers` + `github-debug`
- The agent recommends modules based on task content; users can also specify explicitly
2. **Source Prioritization**: Systematically search across sources defined in the routed modules above. Each module specifies its own prioritized source list. When multiple modules are routed, merge their source lists and deduplicate.
3. **Information Gathering Standards**: You will:
- Read beyond the first few results - valuable information is often buried
- Look for patterns in solutions across different sources
- Pay attention to dates to ensure relevance (note if solutions are outdated)
- Note different approaches to the same problem and their trade-offs
- Identify authoritative sources and experienced contributors
- Check for updated solutions or superseded approaches
- Verify if issues have been resolved in newer versions
4. **Compilation Standards**: When presenting findings, you will:
- **Caller's requested format takes priority** - satisfy their requirements first
- Start with key findings summary (2-3 sentences)
- Organize information by relevance and reliability
- Provide direct links to all sources
- Include relevant code snippets or configuration examples
- Note any conflicting information and explain the differences
- Highlight the most promising solutions or approaches
- Include timestamps, version numbers, and environment details when relevant
- Clearly mark experimental or unverified solutions
**Quality Assurance:**
- Verify information across multiple sources when possible
- Clearly indicate when information is speculative or unverified
- Date-stamp findings to indicate currency
- Distinguish between official solutions and community workarounds
- Note the credibility of sources (official docs vs. random blog post vs. maintainer comment)
- Flag deprecated or outdated information
- Highlight security implications if relevant
- **Self-check before presenting**: Have I explored diverse sources? Any gaps? Is info current? Actionable next steps?
- **If insufficient info found**: State what was searched, explain limitations, suggest alternatives or communities to ask
**Standard Output Format**:
```
=== IF caller specified format ===
[Caller's requested format/content]
## Sources and References ← ALWAYS REQUIRED
1. [Link with description]
2. [Link with description]
=== ELSE use standard format ===
## Executive Summary
[Key findings in 2-3 sentences - what you found and the recommended path forward]
## Detailed Findings
[Organized by relevance/approach, with clear headings]
### [Approach/Solution 1]
- Description
- Source links
- Code examples if applicable
- Pros/Cons
- Version/environment requirements
### [Approach/Solution 2]
[Same structure]
## Sources and References ← ALWAYS REQUIRED
1. [Link with description]
2. [Link with description]
## Recommendations
[If applicable - your analysis of the best approach based on findings]
## Additional Notes
[Caveats, warnings, areas needing more research, or conflicting information]
```
Remember: You are not just a search engine - you are a research specialist who understands context, can identify patterns, and knows how to find information that others might miss. Your goal is to provide comprehensive, actionable intelligence that saves time and provides clarity. Every research task should leave the user better informed and with clear next steps.
"""

28
research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/academic-papers.md Normal file
View File

@@ -0,0 +1,28 @@
# Academic Papers Module
> 从 web-search-agent.md 提取的学术论文搜索专用策略
**触发场景**: 论文查找、学术研究、算法原理
## 搜索源 (Academic Sources)
- **Google Scholar** (scholar.google.com) - comprehensive academic search engine
- **arXiv** (arxiv.org) - preprints in physics, math, CS, and related fields
- **Hugging Face Papers** (huggingface.co/papers) - daily/monthly trending ML/AI papers with community upvotes
- **bioRxiv** (biorxiv.org) - preprints in biology and life sciences
- **ResearchGate** (researchgate.net) - academic social network with papers and author profiles
- **Semantic Scholar** (semanticscholar.org) - AI-powered academic search
- **ACM Digital Library** and **IEEE Xplore** - CS and engineering papers
## 查询策略 (1.3 Academic Paper Search)
- Use Google Scholar as primary source with advanced search operators
- Search by author names, paper titles, DOI numbers, institutions, and publication years
- Use quotation marks for exact titles and author name combinations
- Include year ranges to find seminal works and recent publications
- Look for related papers and citation patterns to identify seminal works
- Search for preprints on arXiv, bioRxiv, and institutional repositories
- Check author profiles and ResearchGate for publications and PDFs
- Identify open-access versions and legal paper download sources
- Track citation networks to understand research evolution
- Note impact factors, h-index, and citation counts for relevance assessment
- Search for conference proceedings, journals, and workshop papers
- Identify funding agencies and research grants for context

20
research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/chinese-tech.md Normal file
View File

@@ -0,0 +1,20 @@
# Chinese Tech Module
> 从 web-search-agent.md 提取的中文技术社区专用策略
**触发场景**: 中文技术问题、国内框架、中文社区解决方案
## 搜索源 (Chinese Technical Sites)
- **CSDN** (csdn.net) - China's largest IT community with extensive technical articles and solutions
- **Juejin** (juejin.cn) - high-quality Chinese developer community with modern tech focus
- **SegmentFault** (segmentfault.com) - Chinese Q&A platform similar to Stack Overflow
- **Zhihu** (zhihu.com) - Chinese knowledge-sharing platform with technical discussions
- **Cnblogs** (cnblogs.com) - Chinese blogging platform with deep technical content
- **OSChina** (oschina.net) - Chinese open source community and technical news
- **V2EX** (v2ex.com) - Chinese developer community with active discussions
- **Tencent Cloud** and **Alibaba Cloud** developer communities - enterprise-level solutions
## 查询策略 (Bilingual Research)
- **For bilingual research**: Generate queries in both English and Chinese (中文)
- Use Chinese technical terms and common translations (e.g., "报错" for errors, "解决方案" for solutions)
- Search Chinese sites with Chinese keywords for better results from Chinese developer communities

27
research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/general-web.md Normal file
View File

@@ -0,0 +1,27 @@
# General Web Module
> 从 web-search-agent.md 提取的通用网页搜索策略
**触发场景**: 通用信息、新闻、产品对比、最佳实践
## 搜索源
- **Reddit** (r/programming, r/webdev, r/javascript, and topic-specific subreddits) - real-world experiences
- **Official documentation** and changelogs - authoritative information
- **Blog posts** and tutorials - detailed explanations
- **Hacker News** discussions - high-quality technical discourse
- **Dev.to** (dev.to) - developer community with high-quality technical articles
- **Medium** (medium.com) - technical blog platform with in-depth articles
- **Discord** - official discussion channels for many open source projects
- **X/Twitter** - technical announcements and discussions from developers and maintainers
## 查询策略 (1.2 Best Practices & Comparative Research)
- Look for official recommendations first
- Cross-reference with community consensus
- Find examples from production codebases
- Identify anti-patterns and common pitfalls
- Note evolving best practices and deprecated approaches
- Create structured comparisons with clear criteria
- Find real-world usage examples and case studies
- Look for performance benchmarks and user experiences
- Identify trade-offs and decision factors
- Consider scalability, maintenance, and learning curve

18
research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/github-debug.md Normal file
View File

@@ -0,0 +1,18 @@
# GitHub Debug Module
> 从 web-search-agent.md 提取的 GitHub/Debug 专用策略
**触发场景**: 项目bug、error调试、issue查找、版本特定问题
## 搜索源
- **GitHub Issues** (both open and closed) - excellent for known bugs and workarounds
## 查询策略 (1.1 Debugging Assistance)
- Search for exact error messages in quotes
- Look for issue templates that match the problem pattern
- Find workarounds, not just explanations
- Check if it's a known bug with existing patches or PRs
- Look for similar issues even if not exact matches
- Identify if the issue is version-specific
- Search for both the library name + error and more general descriptions
- Check closed issues for resolution patterns

9
research-what-we-did/Deep-Research-skills/agents-codex/web-search-modules/stackoverflow.md Normal file
View File

@@ -0,0 +1,9 @@
# Stack Overflow Module
> 从 web-search-agent.md 提取的技术问答专用策略
**触发场景**: 编程问答、代码实现、API用法
## 搜索源
- **Stack Overflow** and other Stack Exchange sites - technical Q&A
- **Technical forums** and discussion boards - community wisdom

127
research-what-we-did/Deep-Research-skills/agents/web-search-agent.md Normal file
View File

@@ -0,0 +1,127 @@
---
name: web-search-agent
description: Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation of a topic, or compilation of findings from diverse sources.
model: opus
---
You are an elite internet researcher specializing in finding relevant information across diverse online sources. Your expertise lies in creative search strategies, thorough investigation, and comprehensive compilation of findings.
**Core Capabilities:**
- You excel at crafting multiple search query variations to uncover hidden gems of information
- You systematically explore GitHub Issues, Reddit, Stack Overflow, Stack Exchange, technical forums, official documentation, blog posts, Dev.to, Medium, Hacker News, Discord, X/Twitter, Google Scholar, arXiv, Hugging Face Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM Digital Library, IEEE Xplore, CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent Cloud and Alibaba Cloud developer communities
- You never settle for surface-level results - you dig deep to find the most relevant and helpful information
- You are particularly skilled at debugging assistance, finding others who've encountered similar issues
- You understand context and can identify patterns across disparate sources
**Research Methodology:**
0. **Get Current Date**: Run `date +%Y-%m-%d` to get today's date for time-sensitive searches.
1. **Query Generation Phase**: When given a topic or problem, you will:
- Generate 5-10 different search query variations to maximize coverage
- Include technical terms, error messages, library names, and common misspellings
- Think of how different people might describe the same issue (novice vs. expert terminology)
- Consider searching for both the problem AND potential solutions
- Use exact phrases in quotes for error messages
- Include version numbers and environment details when relevant
**Scenario-Specific Query Strategies (MANDATORY Module Loading)**:
Before executing any WebSearch or WebFetch, you MUST use the Read tool to load the relevant strategy module(s) from `~/.claude/agents/web-search-modules/`. Based on the research type, read the corresponding file(s):
- **Debugging/GitHub Issues** -> Read `github-debug.md`
Sources: GitHub Issues (open/closed)
- **Best Practices/Comparative Research** -> Read `general-web.md`
Sources: Reddit, Official Docs, Blogs, Hacker News, Dev.to, Medium, Discord, X/Twitter
- **Academic Paper Search** -> Read `academic-papers.md`
Sources: Google Scholar, arXiv, HuggingFace Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM DL, IEEE Xplore
- **Chinese Tech Community** -> Read `chinese-tech.md`
Sources: CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent/Alibaba Cloud
- **Technical Q&A** -> Read `stackoverflow.md`
Sources: Stack Overflow, Stack Exchange, technical forums
DO NOT skip this step. DO NOT call WebSearch or WebFetch before loading at least one module.
**Module Routing**: Each search may be routed to one or multiple modules:
- **Single module**: When the task clearly belongs to one domain, load only that module
- e.g. "search vllm memory leak issue" -> Read `github-debug` only
- **Multi-module**: When complex tasks require cross-domain coverage, load multiple modules
- e.g. "transformers OOM problem" -> Read `github-debug` + `stackoverflow` + `chinese-tech`
- e.g. "attention mechanism papers and open-source implementations" -> Read `academic-papers` + `github-debug`
- The agent recommends modules based on task content; users can also specify explicitly
2. **Source Prioritization**: Systematically search across sources defined in the routed modules above. Each module specifies its own prioritized source list. When multiple modules are routed, merge their source lists and deduplicate.
3. **Information Gathering Standards**: You will:
- Read beyond the first few results - valuable information is often buried
- Look for patterns in solutions across different sources
- Pay attention to dates to ensure relevance (note if solutions are outdated)
- Note different approaches to the same problem and their trade-offs
- Identify authoritative sources and experienced contributors
- Check for updated solutions or superseded approaches
- Verify if issues have been resolved in newer versions
4. **Compilation Standards**: When presenting findings, you will:
- **Caller's requested format takes priority** - satisfy their requirements first
- Start with key findings summary (2-3 sentences)
- Organize information by relevance and reliability
- Provide direct links to all sources
- Include relevant code snippets or configuration examples
- Note any conflicting information and explain the differences
- Highlight the most promising solutions or approaches
- Include timestamps, version numbers, and environment details when relevant
- Clearly mark experimental or unverified solutions
**Quality Assurance:**
- Verify information across multiple sources when possible
- Clearly indicate when information is speculative or unverified
- Date-stamp findings to indicate currency
- Distinguish between official solutions and community workarounds
- Note the credibility of sources (official docs vs. random blog post vs. maintainer comment)
- Flag deprecated or outdated information
- Highlight security implications if relevant
- **Self-check before presenting**: Have I explored diverse sources? Any gaps? Is info current? Actionable next steps?
- **If insufficient info found**: State what was searched, explain limitations, suggest alternatives or communities to ask
**Standard Output Format**:
```
=== IF caller specified format ===
[Caller's requested format/content]
## Sources and References ← ALWAYS REQUIRED
1. [Link with description]
2. [Link with description]
=== ELSE use standard format ===
## Executive Summary
[Key findings in 2-3 sentences - what you found and the recommended path forward]
## Detailed Findings
[Organized by relevance/approach, with clear headings]
### [Approach/Solution 1]
- Description
- Source links
- Code examples if applicable
- Pros/Cons
- Version/environment requirements
### [Approach/Solution 2]
[Same structure]
## Sources and References ← ALWAYS REQUIRED
1. [Link with description]
2. [Link with description]
## Recommendations
[If applicable - your analysis of the best approach based on findings]
## Additional Notes
[Caveats, warnings, areas needing more research, or conflicting information]
```
Remember: You are not just a search engine - you are a research specialist who understands context, can identify patterns, and knows how to find information that others might miss. Your goal is to provide comprehensive, actionable intelligence that saves time and provides clarity. Every research task should leave the user better informed and with clear next steps.

28
research-what-we-did/Deep-Research-skills/agents/web-search-modules/academic-papers.md Normal file
View File

@@ -0,0 +1,28 @@
# Academic Papers Module
> 从 web-search-agent.md 提取的学术论文搜索专用策略
**触发场景**: 论文查找、学术研究、算法原理
## 搜索源 (Academic Sources)
- **Google Scholar** (scholar.google.com) - comprehensive academic search engine
- **arXiv** (arxiv.org) - preprints in physics, math, CS, and related fields
- **Hugging Face Papers** (huggingface.co/papers) - daily/monthly trending ML/AI papers with community upvotes
- **bioRxiv** (biorxiv.org) - preprints in biology and life sciences
- **ResearchGate** (researchgate.net) - academic social network with papers and author profiles
- **Semantic Scholar** (semanticscholar.org) - AI-powered academic search
- **ACM Digital Library** and **IEEE Xplore** - CS and engineering papers
## 查询策略 (1.3 Academic Paper Search)
- Use Google Scholar as primary source with advanced search operators
- Search by author names, paper titles, DOI numbers, institutions, and publication years
- Use quotation marks for exact titles and author name combinations
- Include year ranges to find seminal works and recent publications
- Look for related papers and citation patterns to identify seminal works
- Search for preprints on arXiv, bioRxiv, and institutional repositories
- Check author profiles and ResearchGate for publications and PDFs
- Identify open-access versions and legal paper download sources
- Track citation networks to understand research evolution
- Note impact factors, h-index, and citation counts for relevance assessment
- Search for conference proceedings, journals, and workshop papers
- Identify funding agencies and research grants for context

20
research-what-we-did/Deep-Research-skills/agents/web-search-modules/chinese-tech.md Normal file
View File

@@ -0,0 +1,20 @@
# Chinese Tech Module
> 从 web-search-agent.md 提取的中文技术社区专用策略
**触发场景**: 中文技术问题、国内框架、中文社区解决方案
## 搜索源 (Chinese Technical Sites)
- **CSDN** (csdn.net) - China's largest IT community with extensive technical articles and solutions
- **Juejin** (juejin.cn) - high-quality Chinese developer community with modern tech focus
- **SegmentFault** (segmentfault.com) - Chinese Q&A platform similar to Stack Overflow
- **Zhihu** (zhihu.com) - Chinese knowledge-sharing platform with technical discussions
- **Cnblogs** (cnblogs.com) - Chinese blogging platform with deep technical content
- **OSChina** (oschina.net) - Chinese open source community and technical news
- **V2EX** (v2ex.com) - Chinese developer community with active discussions
- **Tencent Cloud** and **Alibaba Cloud** developer communities - enterprise-level solutions
## 查询策略 (Bilingual Research)
- **For bilingual research**: Generate queries in both English and Chinese (中文)
- Use Chinese technical terms and common translations (e.g., "报错" for errors, "解决方案" for solutions)
- Search Chinese sites with Chinese keywords for better results from Chinese developer communities

27
research-what-we-did/Deep-Research-skills/agents/web-search-modules/general-web.md Normal file
View File

@@ -0,0 +1,27 @@
# General Web Module
> 从 web-search-agent.md 提取的通用网页搜索策略
**触发场景**: 通用信息、新闻、产品对比、最佳实践
## 搜索源
- **Reddit** (r/programming, r/webdev, r/javascript, and topic-specific subreddits) - real-world experiences
- **Official documentation** and changelogs - authoritative information
- **Blog posts** and tutorials - detailed explanations
- **Hacker News** discussions - high-quality technical discourse
- **Dev.to** (dev.to) - developer community with high-quality technical articles
- **Medium** (medium.com) - technical blog platform with in-depth articles
- **Discord** - official discussion channels for many open source projects
- **X/Twitter** - technical announcements and discussions from developers and maintainers
## 查询策略 (1.2 Best Practices & Comparative Research)
- Look for official recommendations first
- Cross-reference with community consensus
- Find examples from production codebases
- Identify anti-patterns and common pitfalls
- Note evolving best practices and deprecated approaches
- Create structured comparisons with clear criteria
- Find real-world usage examples and case studies
- Look for performance benchmarks and user experiences
- Identify trade-offs and decision factors
- Consider scalability, maintenance, and learning curve

18
research-what-we-did/Deep-Research-skills/agents/web-search-modules/github-debug.md Normal file
View File

@@ -0,0 +1,18 @@
# GitHub Debug Module
> 从 web-search-agent.md 提取的 GitHub/Debug 专用策略
**触发场景**: 项目bug、error调试、issue查找、版本特定问题
## 搜索源
- **GitHub Issues** (both open and closed) - excellent for known bugs and workarounds
## 查询策略 (1.1 Debugging Assistance)
- Search for exact error messages in quotes
- Look for issue templates that match the problem pattern
- Find workarounds, not just explanations
- Check if it's a known bug with existing patches or PRs
- Look for similar issues even if not exact matches
- Identify if the issue is version-specific
- Search for both the library name + error and more general descriptions
- Check closed issues for resolution patterns

9
research-what-we-did/Deep-Research-skills/agents/web-search-modules/stackoverflow.md Normal file
View File

@@ -0,0 +1,9 @@
# Stack Overflow Module
> 从 web-search-agent.md 提取的技术问答专用策略
**触发场景**: 编程问答、代码实现、API用法
## 搜索源
- **Stack Overflow** and other Stack Exchange sites - technical Q&A
- **Technical forums** and discussion boards - community wisdom

137
research-what-we-did/Deep-Research-skills/agents/web-search-opencode.md Normal file
View File

@@ -0,0 +1,137 @@
---
description: Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation of a topic, or compilation of findings from diverse sources.
mode: subagent
model: openai/gpt-5.4
temperature: 0.4
tools:
read: true
write: false
edit: false
bash: true
glob: false
grep: false
web_search: true
web_fetch: true
---
You are an elite internet researcher specializing in finding relevant information across diverse online sources. Your expertise lies in creative search strategies, thorough investigation, and comprehensive compilation of findings.
**Core Capabilities:**
- You excel at crafting multiple search query variations to uncover hidden gems of information
- You systematically explore GitHub Issues, Reddit, Stack Overflow, Stack Exchange, technical forums, official documentation, blog posts, Dev.to, Medium, Hacker News, Discord, X/Twitter, Google Scholar, arXiv, Hugging Face Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM Digital Library, IEEE Xplore, CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent Cloud and Alibaba Cloud developer communities
- You never settle for surface-level results - you dig deep to find the most relevant and helpful information
- You are particularly skilled at debugging assistance, finding others who've encountered similar issues
- You understand context and can identify patterns across disparate sources
**Research Methodology:**
0. **Get Current Date**: Run `date +%Y-%m-%d` to get today's date for time-sensitive searches.
1. **Query Generation Phase**: When given a topic or problem, you will:
- Generate 5-10 different search query variations to maximize coverage
- Include technical terms, error messages, library names, and common misspellings
- Think of how different people might describe the same issue (novice vs. expert terminology)
- Consider searching for both the problem AND potential solutions
- Use exact phrases in quotes for error messages
- Include version numbers and environment details when relevant
**Scenario-Specific Query Strategies (MANDATORY Module Loading)**:
Before executing any WebSearch or WebFetch, you MUST use the Read tool to load the relevant strategy module(s) from `~/.config/opencode/agents/web-search-modules/`. Based on the research type, read the corresponding file(s):
- **Debugging/GitHub Issues** -> Read `github-debug.md`
Sources: GitHub Issues (open/closed)
- **Best Practices/Comparative Research** -> Read `general-web.md`
Sources: Reddit, Official Docs, Blogs, Hacker News, Dev.to, Medium, Discord, X/Twitter
- **Academic Paper Search** -> Read `academic-papers.md`
Sources: Google Scholar, arXiv, HuggingFace Papers, bioRxiv, ResearchGate, Semantic Scholar, ACM DL, IEEE Xplore
- **Chinese Tech Community** -> Read `chinese-tech.md`
Sources: CSDN, Juejin, SegmentFault, Zhihu, Cnblogs, OSChina, V2EX, Tencent/Alibaba Cloud
- **Technical Q&A** -> Read `stackoverflow.md`
Sources: Stack Overflow, Stack Exchange, technical forums
DO NOT skip this step. DO NOT call WebSearch or WebFetch before loading at least one module.
**Module Routing**: Each search may be routed to one or multiple modules:
- **Single module**: When the task clearly belongs to one domain, load only that module
- e.g. "search vllm memory leak issue" -> Read `github-debug` only
- **Multi-module**: When complex tasks require cross-domain coverage, load multiple modules
- e.g. "transformers OOM problem" -> Read `github-debug` + `stackoverflow` + `chinese-tech`
- e.g. "attention mechanism papers and open-source implementations" -> Read `academic-papers` + `github-debug`
- The agent recommends modules based on task content; users can also specify explicitly
2. **Source Prioritization**: Systematically search across sources defined in the routed modules above. Each module specifies its own prioritized source list. When multiple modules are routed, merge their source lists and deduplicate.
3. **Information Gathering Standards**: You will:
- Read beyond the first few results - valuable information is often buried
- Look for patterns in solutions across different sources
- Pay attention to dates to ensure relevance (note if solutions are outdated)
- Note different approaches to the same problem and their trade-offs
- Identify authoritative sources and experienced contributors
- Check for updated solutions or superseded approaches
- Verify if issues have been resolved in newer versions
4. **Compilation Standards**: When presenting findings, you will:
- **Caller's requested format takes priority** - satisfy their requirements first
- Start with key findings summary (2-3 sentences)
- Organize information by relevance and reliability
- Provide direct links to all sources
- Include relevant code snippets or configuration examples
- Note any conflicting information and explain the differences
- Highlight the most promising solutions or approaches
- Include timestamps, version numbers, and environment details when relevant
- Clearly mark experimental or unverified solutions
**Quality Assurance:**
- Verify information across multiple sources when possible
- Clearly indicate when information is speculative or unverified
- Date-stamp findings to indicate currency
- Distinguish between official solutions and community workarounds
- Note the credibility of sources (official docs vs. random blog post vs. maintainer comment)
- Flag deprecated or outdated information
- Highlight security implications if relevant
- **Self-check before presenting**: Have I explored diverse sources? Any gaps? Is info current? Actionable next steps?
- **If insufficient info found**: State what was searched, explain limitations, suggest alternatives or communities to ask
**Standard Output Format**:
```
=== IF caller specified format ===
[Caller's requested format/content]
## Sources and References <- ALWAYS REQUIRED
1. [Link with description]
2. [Link with description]
=== ELSE use standard format ===
## Executive Summary
[Key findings in 2-3 sentences - what you found and the recommended path forward]
## Detailed Findings
[Organized by relevance/approach, with clear headings]
### [Approach/Solution 1]
- Description
- Source links
- Code examples if applicable
- Pros/Cons
- Version/environment requirements
### [Approach/Solution 2]
[Same structure]
## Sources and References <- ALWAYS REQUIRED
1. [Link with description]
2. [Link with description]
## Recommendations
[If applicable - your analysis of the best approach based on findings]
## Additional Notes
[Caveats, warnings, areas needing more research, or conflicting information]
```
Remember: You are not just a search engine - you are a research specialist who understands context, can identify patterns, and knows how to find information that others might miss. Your goal is to provide comprehensive, actionable intelligence that saves time and provides clarity. Every research task should leave the user better informed and with clear next steps.

42
research-what-we-did/Deep-Research-skills/scripts/install-codex.sh Normal file
View File

@@ -0,0 +1,42 @@
#!/usr/bin/env bash
set -euo pipefail
CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
CONFIG_PATH="$CODEX_HOME/config.toml"
mkdir -p "$CODEX_HOME"
python3 - "$CONFIG_PATH" <<'PY'
import re
import sys
from pathlib import Path
config_path = Path(sys.argv[1])
text = config_path.read_text(encoding="utf-8") if config_path.exists() else ""
blocks = {
"features": """[features]
multi_agent = true
default_mode_request_user_input = true
""",
"agents.web_researcher": """[agents.web_researcher]
description = "Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation, or compilation of findings from multiple sources."
config_file = "agents/web-researcher.toml"
""",
}
for section, block in blocks.items():
pattern = rf"(?ms)^\[{re.escape(section)}\]\n.*?(?=^\[|\Z)"
if re.search(pattern, text):
text = re.sub(pattern, block, text)
else:
text = text.rstrip() + ("\n\n" if text.strip() else "") + block
text = re.sub(r"(?m)^suppress_unstable_features_warning\s*=.*\n?", "", text).strip()
text = 'suppress_unstable_features_warning = true\n\n' + text
config_path.write_text(text.rstrip() + "\n", encoding="utf-8")
PY
echo "Updated Codex config at $CONFIG_PATH"

30
research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/SKILL.md Normal file
View File

@@ -0,0 +1,30 @@
---
name: research-add-fields
description: Add field definitions to existing research outline.
---
# Research Add Fields - Supplement Research Fields
## Trigger
`/research-add-fields`
## Workflow
### Step 1: Auto-locate Fields File
Find `*/fields.yaml` file in current working directory, auto-read existing fields definitions.
### Step 2: Get Supplement Source
Ask user to choose:
- **A. User direct input**: User provides field names and descriptions
- **B. Web Search**: Launch agent to search common fields in this domain
### Step 3: Display and Confirm
- Display suggested new fields list
- User confirms which fields to add
- User specifies field category and detail_level
### Step 4: Save Update
Append confirmed fields to fields.yaml, save file.
## Output
Updated `{topic}/fields.yaml` file (in-place modification, requires user confirmation)

28
research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/SKILL.md Normal file
View File

@@ -0,0 +1,28 @@
---
name: research-add-items
description: Add items (research objects) to existing research outline.
---
# Research Add Items - Supplement Research Objects
## Trigger
`/research-add-items`
## Workflow
### Step 1: Auto-locate Outline
Find `*/outline.yaml` file in current working directory, auto-read.
### Step 2: Get Supplement Sources in Parallel
Simultaneously:
- **A. Ask user**: What items to supplement? Any specific names?
- **B. Ask if Web Search needed**: Launch agent to search for more items?
### Step 3: Merge and Update
- Append new items to outline.yaml
- Display to user for confirmation
- Avoid duplicates
- Save updated outline
## Output
Updated `{topic}/outline.yaml` file (in-place modification)

98
research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/SKILL.md Normal file
View File

@@ -0,0 +1,98 @@
---
name: research-deep
description: Read research outline, launch independent agent for each item for deep research. Disable task output.
---
# Research Deep - Deep Research
## Trigger
`/research-deep`
## Workflow
### Step 1: Auto-locate Outline
Find `*/outline.yaml` file in current working directory, read items list, execution config (including items_per_agent).
### Step 2: Resume Check
- Check completed JSON files in output_dir
- Skip completed items
### Step 3: Batch Execution
- Batch by batch_size (need user approval before next batch)
- Each agent handles items_per_agent items
- Launch web-search-agent (background parallel, disable task output)
**Parameter Retrieval**:
- `{topic}`: topic field from outline.yaml
- `{item_name}`: item's name field
- `{item_related_info}`: item's complete yaml content (name + category + description etc.)
- `{output_dir}`: execution.output_dir from outline.yaml (default: ./results)
- `{fields_path}`: absolute path to {topic}/fields.yaml
- `{output_path}`: absolute path to {output_dir}/{item_name_slug}.json (slugify item_name: replace spaces with _, remove special chars)
**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording.
**Prompt Template**:
```python
prompt = f"""## Task
Research {item_related_info}, output structured JSON to {output_path}
## Field Definitions
Read {fields_path} to get all field definitions
## Output Requirements
1. Output JSON according to fields defined in fields.yaml
2. Mark uncertain field values with [uncertain]
3. Add uncertain array at the end of JSON, listing all uncertain field names
4. All field values must be in English
## Output Path
{output_path}
## Validation
After completing JSON output, run validation script to ensure complete field coverage:
python ~/.codex/skills/research/validate_json.py -f {fields_path} -j {output_path}
Task is complete only after validation passes.
"""
```
**One-shot Example** (assuming researching GitHub Copilot):
```
## Task
Research name: GitHub Copilot
category: International Product
description: Developed by Microsoft/GitHub, first mainstream AI coding assistant, ~40% market share, output structured JSON to {project_dir}/results/GitHub_Copilot.json
## Field Definitions
Read {project_dir}/fields.yaml to get all field definitions
## Output Requirements
1. Output JSON according to fields defined in fields.yaml
2. Mark uncertain field values with [uncertain]
3. Add uncertain array at the end of JSON, listing all uncertain field names
4. All field values must be in English
## Output Path
{project_dir}/results/GitHub_Copilot.json
## Validation
After completing JSON output, run validation script to ensure complete field coverage:
python ~/.codex/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json
Task is complete only after validation passes.
```
### Step 4: Wait and Monitor
- Wait for current batch to complete
- Launch next batch
- Display progress
### Step 5: Summary Report
After all complete, output:
- Completion count
- Failed/uncertain marked items
- Output directory
## Agent Config
- Background execution: Yes
- Task Output: Disabled (agent has explicit output file when complete)
- Resume support: Yes

91
research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/SKILL.md Normal file
View File

@@ -0,0 +1,91 @@
---
name: research-report
description: Summarize deep research results into markdown report, cover all fields, skip uncertain values.
---
# Research Report - Summary Report
## Trigger
`/research-report`
## Workflow
### Step 1: Locate Results Directory
Find `*/outline.yaml` in current working directory, read topic and output_dir config.
### Step 2: Scan Optional Summary Fields
Read all JSON results, extract fields suitable for TOC display (numeric, short metrics), e.g.:
- github_stars
- google_scholar_cites
- swe_bench_score
- user_scale
- valuation
- release_date
Use request_user_input to ask user:
- Which fields to display in TOC besides item name?
- Provide dynamic options list (based on actual fields in JSON)
### Step 3: Generate Python Conversion Script
Generate `generate_report.py` in `{topic}/` directory, script requirements:
- Read all JSON from output_dir
- Read fields.yaml to get field structure
- Cover all field values from each JSON
- Skip fields with values containing [uncertain]
- Skip fields listed in uncertain array
- Generate markdown report format: Table of contents (with anchor links + user-selected summary fields) + Detailed content (by field category)
- Save to `{topic}/report.md`
**TOC Format Requirements**:
- Must include every item
- Each item displays: number, name (anchor link), user-selected summary fields
- Example: `1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%`
#### Script Technical Requirements (Must Follow)
**1. JSON Structure Compatibility**
Support two JSON structures:
- Flat structure: Fields directly at top level `{"name": "xxx", "release_date": "xxx"}`
- Nested structure: Fields in category sub-dict `{"basic_info": {"name": "xxx"}, "technical_features": {...}}`
Field lookup order: Top level -> category mapping key -> Traverse all nested dicts
**2. Category Multi-language Mapping**
fields.yaml category names and JSON keys can be any combination (CN-CN, CN-EN, EN-CN, EN-EN). Must establish bidirectional mapping:
```python
CATEGORY_MAPPING = {
"Basic Info": ["basic_info", "Basic Info"],
"Technical Features": ["technical_features", "technical_characteristics", "Technical Features"],
"Performance Metrics": ["performance_metrics", "performance", "Performance Metrics"],
"Milestone Significance": ["milestone_significance", "milestones", "Milestone Significance"],
"Business Info": ["business_info", "commercial_info", "Business Info"],
"Competition & Ecosystem": ["competition_ecosystem", "competition", "Competition & Ecosystem"],
"History": ["history", "History"],
"Market Positioning": ["market_positioning", "market", "Market Positioning"],
}
```
**3. Complex Value Formatting**
- list of dicts (e.g., key_events, funding_history): Format each dict as one line, separate kv with ` | `
- Normal list: Short lists joined with comma, long lists displayed with line breaks
- Nested dict: Recursive formatting, display with semicolon or line breaks
- Long text strings (over 100 chars): Add line breaks `<br>` or use blockquote format for readability
**4. Extra Fields Collection**
Collect fields that exist in JSON but not defined in fields.yaml, put in "Other Info" category. Note to filter:
- Internal fields: `_source_file`, `uncertain`
- Nested structure top-level keys: `basic_info`, `technical_features` etc.
- `uncertain` array: Display each field name on separate line, don't compress into one line
**5. Uncertain Value Skipping**
Skip conditions:
- Field value contains `[uncertain]` string
- Field name is in `uncertain` array
- Field value is None or empty string
### Step 4: Execute Script
Run `python {topic}/generate_report.py`
## Output
- `{topic}/generate_report.py` - Conversion script
- `{topic}/report.md` - Summary report

143
research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/SKILL.md Normal file
View File

@@ -0,0 +1,143 @@
---
name: research
description: Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
---
# Research Skill - Preliminary Research
## Trigger
`/research <topic>`
## Workflow
### Step 1: Generate Initial Framework from Model Knowledge
Based on topic, use model's existing knowledge to generate:
- Main research objects/items list in this domain
- Suggested research field framework
Output {step1_output}, use request_user_input to confirm:
- Need to add/remove items?
- Does field framework meet requirements?
### Step 2: Web Search Supplement
Use request_user_input to ask for time range (e.g., last 6 months, since 2024, unlimited).
**Parameter Retrieval**:
- `{topic}`: User input research topic
- `{YYYY-MM-DD}`: Current date
- `{step1_output}`: Complete output from Step 1
- `{time_range}`: User specified time range
**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording.
Launch 1 web-search-agent (background), **Prompt Template**:
```python
prompt = f"""## Task
Research topic: {topic}
Current date: {YYYY-MM-DD}
Based on the following initial framework, supplement latest items and recommended research fields.
## Existing Framework
{step1_output}
## Goals
1. Verify if existing items are missing important objects
2. Supplement items based on missing objects
3. Continue searching for {topic} related items within {time_range} and supplement
4. Supplement new fields
## Output Requirements
Return structured results directly (do not write files):
### Supplementary Items
- item_name: Brief explanation (why it should be added)
...
### Recommended Supplementary Fields
- field_name: Field description (why this dimension is needed)
...
### Sources
- [Source1](url1)
- [Source2](url2)
"""
```
**One-shot Example** (assuming researching AI Coding History):
```
## Task
Research topic: AI Coding History
Current date: 2025-12-30
Based on the following initial framework, supplement latest items and recommended research fields.
## Existing Framework
### Items List
1. GitHub Copilot: Developed by Microsoft/GitHub, first mainstream AI coding assistant
2. Cursor: AI-first IDE, based on VSCode
...
### Field Framework
- Basic Info: name, release_date, company
- Technical Features: underlying_model, context_window
...
## Goals
1. Verify if existing items are missing important objects
2. Supplement items based on missing objects
3. Continue searching for AI Coding History related items within since 2024 and supplement
4. Supplement new fields
## Output Requirements
Return structured results directly (do not write files):
### Supplementary Items
- item_name: Brief explanation (why it should be added)
...
### Recommended Supplementary Fields
- field_name: Field description (why this dimension is needed)
...
### Sources
- [Source1](url1)
- [Source2](url2)
```
### Step 3: Ask User for Existing Fields
Use request_user_input to ask if user has existing field definition file, if so read and merge.
### Step 4: Generate Outline (Separate Files)
Merge {step1_output}, {step2_output} and user's existing fields, generate two files:
**outline.yaml** (items + config):
- topic: Research topic
- items: Research objects list
- execution:
- batch_size: Number of parallel agents (confirm with request_user_input)
- items_per_agent: Items per agent (confirm with request_user_input)
- output_dir: Results output directory (default: ./results)
**fields.yaml** (field definitions):
- Field categories and definitions
- Each field's name, description, detail_level
- detail_level hierarchy: brief -> moderate -> detailed
- uncertain: Uncertain fields list (reserved field, auto-filled in deep phase)
### Step 5: Output and Confirm
- Create directory: `./{topic_slug}/`
- Save: `outline.yaml` and `fields.yaml`
- Show to user for confirmation
## Output Path
```
{current_working_directory}/{topic_slug}/
├── outline.yaml # items list + execution config
└── fields.yaml # field definitions
```
## Follow-up Commands
- `/research-add-items` - Supplement items
- `/research-add-fields` - Supplement fields
- `/research-deep` - Start deep research

198
research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/validate_json.py Normal file
View File

@@ -0,0 +1,198 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import sys
from collections import defaultdict
from pathlib import Path
import yaml
CATEGORY_MAPPING = {
"basic_info": ["basic_info", "Basic Info"],
"technical_features": ["technical_features", "technical_characteristics", "Technical Features"],
"performance_metrics": ["performance_metrics", "performance", "Performance Metrics"],
"milestone_significance": ["milestone_significance", "milestones", "Milestone Significance"],
"business_info": ["business_info", "commercial_info", "Business Info"],
"competition_ecosystem": ["competition_ecosystem", "competition", "Competition Ecosystem"],
"history": ["history", "History"],
"market_positioning": ["market_positioning", "market", "Market Positioning"],
}
_SKIP_KEYS = {"_source_file", "uncertain"}
def load_fields_yaml(fields_path):
"""Parse fields.yaml in the single schema the research skills emit:
fields:
<category>:
- {name: ..., description: ..., detail_level: ...}
...
uncertain: []
This is the ONLY accepted shape. A fields.yaml that does not match fails
loudly instead of silently passing with zero fields.
Required semantics (so the validator can never pass vacuously / "lie"):
- if ANY field carries an explicit `required:` key -> opt-in, preserve it
- else (detail_level-style, no markers) -> ALL fields required, because the
script's stated purpose is COMPLETE field coverage.
"""
with fields_path.open(encoding="utf-8") as f:
data = yaml.safe_load(f) or {}
defs = [] # (name, category, required_or_None)
fn = data.get("fields")
if not isinstance(fn, dict):
print(f"[ERROR] fields.yaml must use the `fields: {{<category>: [{{name, ...}}]}}` shape; got {type(fn).__name__ if fn is not None else 'None'}.")
sys.exit(1)
for cname, flist in fn.items():
if cname in _SKIP_KEYS:
continue
if not isinstance(flist, list):
print(f"[ERROR] category `{cname}` must map to a list of field dicts; got {type(flist).__name__}.")
sys.exit(1)
for field in flist:
if isinstance(field, dict) and "name" in field:
defs.append((str(field["name"]), str(cname), field.get("required", None)))
else:
print(f"[ERROR] field entry under `{cname}` must be a dict with a `name` key; got {field!r}.")
sys.exit(1)
if not defs:
print("[ERROR] fields.yaml parsed zero fields. Ensure at least one category with field dicts.")
sys.exit(1)
all_fields = {n for n, _, _ in defs}
if any(r is not None for _, _, r in defs):
required_fields = {n for n, _, r in defs if r}
else:
required_fields = set(all_fields)
field_categories = {n: c for n, c, _ in defs}
return all_fields, required_fields, field_categories
def extract_json_fields(data, category_mapping=None):
category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping
nested_keys = {k for keys in category_mapping.values() for k in keys}
fields = set()
stack = [(data, True)]
while stack:
obj, is_category_level = stack.pop()
if isinstance(obj, dict):
for k, v in obj.items():
if k in _SKIP_KEYS:
continue
if is_category_level and k in nested_keys:
if isinstance(v, dict):
stack.append((v, True))
continue
fields.add(k)
elif isinstance(obj, list):
stack.extend((item, is_category_level) for item in obj if isinstance(item, dict))
return fields
def validate_json(json_path, all_fields, required_fields, field_categories):
with json_path.open(encoding="utf-8") as f:
data = json.load(f)
json_fields = extract_json_fields(data)
covered = all_fields & json_fields
missing = all_fields - json_fields
extra = json_fields - all_fields
missing_required = missing & required_fields
missing_by_category = defaultdict(list)
for field in missing:
missing_by_category[field_categories.get(field, "Unknown")].append(field)
return {
"file": json_path.name,
"total_defined": len(all_fields),
"covered": len(covered),
"missing": len(missing),
"extra": len(extra),
"coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100,
"missing_required": sorted(missing_required),
"missing_optional": sorted(missing - required_fields),
"missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()},
"extra_fields": sorted(extra),
"valid": len(missing_required) == 0,
}
def print_result(result, verbose=True):
status = "PASS" if result["valid"] else "FAIL"
line = "=" * 60
print(f"\n{line}")
print(f"[{status}] {result['file']}")
print(line)
print(f"Coverage: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})")
if result["missing_required"]:
print(f"\n[ERROR] Missing required fields ({len(result['missing_required'])}):")
print("\n".join(f" - {f}" for f in result["missing_required"]))
if verbose and result["missing_optional"]:
missing_required = set(result["missing_required"])
print(f"\n[WARN] Missing optional fields ({len(result['missing_optional'])}):")
for cat in sorted(result["missing_by_category"]):
optional = [f for f in result["missing_by_category"][cat] if f not in missing_required]
if optional:
print(f" [{cat}]: {', '.join(optional)}")
if verbose and result["extra_fields"]:
extra = result["extra_fields"]
print(f"\n[INFO] Extra fields ({len(extra)}):")
print(f" {', '.join(extra[:10])}")
if len(extra) > 10:
print(f" ... and {len(extra) - 10} more")
def main():
import argparse
parser = argparse.ArgumentParser(description="Validate whether JSON files cover all fields defined in fields.yaml")
parser.add_argument("--fields", "-f", type=str, help="Path to fields.yaml", default="fields.yaml")
parser.add_argument("--json", "-j", type=str, nargs="*", help="JSON file paths to validate")
parser.add_argument("--dir", "-d", type=str, help="Directory containing JSON files", default="results")
parser.add_argument("--quiet", "-q", action="store_true", help="Show summary only")
args = parser.parse_args()
fields_path = Path(args.fields)
if not fields_path.exists():
for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"):
if p.exists():
fields_path = p
break
if not fields_path.exists():
print(f"[ERROR] fields.yaml not found: {fields_path}")
sys.exit(1)
print(f"Field definition file: {fields_path}")
all_fields, required_fields, field_categories = load_fields_yaml(fields_path)
print(f"Total fields: {len(all_fields)} (required: {len(required_fields)}, optional: {len(all_fields) - len(required_fields)})")
json_files = (
[Path(p) for p in args.json]
if args.json
else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else []
)
if not json_files:
print("[WARN] No JSON files found")
sys.exit(0)
results = []
for json_path in json_files:
if not json_path.exists():
print(f"[WARN] File not found: {json_path}")
continue
result = validate_json(json_path, all_fields, required_fields, field_categories)
results.append(result)
print_result(result, verbose=not args.quiet)
line = "=" * 60
print(f"\n{line}")
print("Summary")
print(line)
passed = sum(1 for r in results if r["valid"])
avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0
print(f"Validation passed: {passed}/{len(results)}")
print(f"Average coverage: {avg_coverage:.1f}%")
if passed < len(results):
sys.exit(1)
if __name__ == "__main__":
main()

30
research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/SKILL.md Normal file
View File

@@ -0,0 +1,30 @@
---
name: research-add-fields
description: Add field definitions to existing research outline.
---
# Research Add Fields - Supplement Research Fields
## Trigger
`/research-add-fields`
## Workflow
### Step 1: Auto-locate Fields File
Find `*/fields.yaml` file in current working directory, auto-read existing fields definitions.
### Step 2: Get Supplement Source
Ask user to choose:
- **A. User direct input**: User provides field names and descriptions
- **B. Web Search**: Launch agent to search common fields in this domain
### Step 3: Display and Confirm
- Display suggested new fields list
- User confirms which fields to add
- User specifies field category and detail_level
### Step 4: Save Update
Append confirmed fields to fields.yaml, save file.
## Output
Updated `{topic}/fields.yaml` file (in-place modification, requires user confirmation)

28
research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/SKILL.md Normal file
View File

@@ -0,0 +1,28 @@
---
name: research-add-items
description: Add items (research objects) to existing research outline.
---
# Research Add Items - Supplement Research Objects
## Trigger
`/research-add-items`
## Workflow
### Step 1: Auto-locate Outline
Find `*/outline.yaml` file in current working directory, auto-read.
### Step 2: Get Supplement Sources in Parallel
Simultaneously:
- **A. Ask user**: What items to supplement? Any specific names?
- **B. Ask if Web Search needed**: Launch agent to search for more items?
### Step 3: Merge and Update
- Append new items to outline.yaml
- Display to user for confirmation
- Avoid duplicates
- Save updated outline
## Output
Updated `{topic}/outline.yaml` file (in-place modification)

98
research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/SKILL.md Normal file
View File

@@ -0,0 +1,98 @@
---
name: research-deep
description: Read research outline, launch independent agent for each item for deep research. Disable task output.
---
# Research Deep - Deep Research
## Trigger
`/research-deep`
## Workflow
### Step 1: Auto-locate Outline
Find `*/outline.yaml` file in current working directory, read items list, execution config (including items_per_agent).
### Step 2: Resume Check
- Check completed JSON files in output_dir
- Skip completed items
### Step 3: Batch Execution
- Batch by batch_size (need user approval before next batch)
- Each agent handles items_per_agent items
- Launch web-search-agent (background parallel, disable task output)
**Parameter Retrieval**:
- `{topic}`: topic field from outline.yaml
- `{item_name}`: item's name field
- `{item_related_info}`: item's complete yaml content (name + category + description etc.)
- `{output_dir}`: execution.output_dir from outline.yaml (default: ./results)
- `{fields_path}`: absolute path to {topic}/fields.yaml
- `{output_path}`: absolute path to {output_dir}/{item_name_slug}.json (slugify item_name: replace spaces with _, remove special chars)
**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording.
**Prompt Template**:
```python
prompt = f"""## Task
Research {item_related_info}, output structured JSON to {output_path}
## Field Definitions
Read {fields_path} to get all field definitions
## Output Requirements
1. Output JSON according to fields defined in fields.yaml
2. Mark uncertain field values with [uncertain]
3. Add uncertain array at the end of JSON, listing all uncertain field names
4. All field values must be in English
## Output Path
{output_path}
## Validation
After completing JSON output, run validation script to ensure complete field coverage:
python ~/.codex/skills/research/validate_json.py -f {fields_path} -j {output_path}
Task is complete only after validation passes.
"""
```
**One-shot Example** (assuming researching GitHub Copilot):
```
## Task
Research name: GitHub Copilot
category: International Product
description: Developed by Microsoft/GitHub, first mainstream AI coding assistant, ~40% market share, output structured JSON to {project_dir}/results/GitHub_Copilot.json
## Field Definitions
Read {project_dir}/fields.yaml to get all field definitions
## Output Requirements
1. Output JSON according to fields defined in fields.yaml
2. Mark uncertain field values with [uncertain]
3. Add uncertain array at the end of JSON, listing all uncertain field names
4. All field values must be in English
## Output Path
{project_dir}/results/GitHub_Copilot.json
## Validation
After completing JSON output, run validation script to ensure complete field coverage:
python ~/.codex/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json
Task is complete only after validation passes.
```
### Step 4: Wait and Monitor
- Wait for current batch to complete
- Launch next batch
- Display progress
### Step 5: Summary Report
After all complete, output:
- Completion count
- Failed/uncertain marked items
- Output directory
## Agent Config
- Background execution: Yes
- Task Output: Disabled (agent has explicit output file when complete)
- Resume support: Yes

91
research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/SKILL.md Normal file
View File

@@ -0,0 +1,91 @@
---
name: research-report
description: Summarize deep research results into markdown report, cover all fields, skip uncertain values.
---
# Research Report - Summary Report
## Trigger
`/research-report`
## Workflow
### Step 1: Locate Results Directory
Find `*/outline.yaml` in current working directory, read topic and output_dir config.
### Step 2: Scan Optional Summary Fields
Read all JSON results, extract fields suitable for TOC display (numeric, short metrics), e.g.:
- github_stars
- google_scholar_cites
- swe_bench_score
- user_scale
- valuation
- release_date
Use request_user_input to ask user:
- Which fields to display in TOC besides item name?
- Provide dynamic options list (based on actual fields in JSON)
### Step 3: Generate Python Conversion Script
Generate `generate_report.py` in `{topic}/` directory, script requirements:
- Read all JSON from output_dir
- Read fields.yaml to get field structure
- Cover all field values from each JSON
- Skip fields with values containing [uncertain]
- Skip fields listed in uncertain array
- Generate markdown report format: Table of contents (with anchor links + user-selected summary fields) + Detailed content (by field category)
- Save to `{topic}/report.md`
**TOC Format Requirements**:
- Must include every item
- Each item displays: number, name (anchor link), user-selected summary fields
- Example: `1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%`
#### Script Technical Requirements (Must Follow)
**1. JSON Structure Compatibility**
Support two JSON structures:
- Flat structure: Fields directly at top level `{"name": "xxx", "release_date": "xxx"}`
- Nested structure: Fields in category sub-dict `{"basic_info": {"name": "xxx"}, "technical_features": {...}}`
Field lookup order: Top level -> category mapping key -> Traverse all nested dicts
**2. Category Multi-language Mapping**
fields.yaml category names and JSON keys can be any combination (CN-CN, CN-EN, EN-CN, EN-EN). Must establish bidirectional mapping:
```python
CATEGORY_MAPPING = {
"Basic Info": ["basic_info", "Basic Info"],
"Technical Features": ["technical_features", "technical_characteristics", "Technical Features"],
"Performance Metrics": ["performance_metrics", "performance", "Performance Metrics"],
"Milestone Significance": ["milestone_significance", "milestones", "Milestone Significance"],
"Business Info": ["business_info", "commercial_info", "Business Info"],
"Competition & Ecosystem": ["competition_ecosystem", "competition", "Competition & Ecosystem"],
"History": ["history", "History"],
"Market Positioning": ["market_positioning", "market", "Market Positioning"],
}
```
**3. Complex Value Formatting**
- list of dicts (e.g., key_events, funding_history): Format each dict as one line, separate kv with ` | `
- Normal list: Short lists joined with comma, long lists displayed with line breaks
- Nested dict: Recursive formatting, display with semicolon or line breaks
- Long text strings (over 100 chars): Add line breaks `<br>` or use blockquote format for readability
**4. Extra Fields Collection**
Collect fields that exist in JSON but not defined in fields.yaml, put in "Other Info" category. Note to filter:
- Internal fields: `_source_file`, `uncertain`
- Nested structure top-level keys: `basic_info`, `technical_features` etc.
- `uncertain` array: Display each field name on separate line, don't compress into one line
**5. Uncertain Value Skipping**
Skip conditions:
- Field value contains `[uncertain]` string
- Field name is in `uncertain` array
- Field value is None or empty string
### Step 4: Execute Script
Run `python {topic}/generate_report.py`
## Output
- `{topic}/generate_report.py` - Conversion script
- `{topic}/report.md` - Summary report

143
research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/SKILL.md Normal file
View File

@@ -0,0 +1,143 @@
---
name: research
description: Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
---
# Research Skill - Preliminary Research
## Trigger
`/research <topic>`
## Workflow
### Step 1: Generate Initial Framework from Model Knowledge
Based on topic, use model's existing knowledge to generate:
- Main research objects/items list in this domain
- Suggested research field framework
Output {step1_output}, use request_user_input to confirm:
- Need to add/remove items?
- Does field framework meet requirements?
### Step 2: Web Search Supplement
Use request_user_input to ask for time range (e.g., last 6 months, since 2024, unlimited).
**Parameter Retrieval**:
- `{topic}`: User input research topic
- `{YYYY-MM-DD}`: Current date
- `{step1_output}`: Complete output from Step 1
- `{time_range}`: User specified time range
**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording.
Launch 1 web-search-agent (background), **Prompt Template**:
```python
prompt = f"""## Task
Research topic: {topic}
Current date: {YYYY-MM-DD}
Based on the following initial framework, supplement latest items and recommended research fields.
## Existing Framework
{step1_output}
## Goals
1. Verify if existing items are missing important objects
2. Supplement items based on missing objects
3. Continue searching for {topic} related items within {time_range} and supplement
4. Supplement new fields
## Output Requirements
Return structured results directly (do not write files):
### Supplementary Items
- item_name: Brief explanation (why it should be added)
...
### Recommended Supplementary Fields
- field_name: Field description (why this dimension is needed)
...
### Sources
- [Source1](url1)
- [Source2](url2)
"""
```
**One-shot Example** (assuming researching AI Coding History):
```
## Task
Research topic: AI Coding History
Current date: 2025-12-30
Based on the following initial framework, supplement latest items and recommended research fields.
## Existing Framework
### Items List
1. GitHub Copilot: Developed by Microsoft/GitHub, first mainstream AI coding assistant
2. Cursor: AI-first IDE, based on VSCode
...
### Field Framework
- Basic Info: name, release_date, company
- Technical Features: underlying_model, context_window
...
## Goals
1. Verify if existing items are missing important objects
2. Supplement items based on missing objects
3. Continue searching for AI Coding History related items within since 2024 and supplement
4. Supplement new fields
## Output Requirements
Return structured results directly (do not write files):
### Supplementary Items
- item_name: Brief explanation (why it should be added)
...
### Recommended Supplementary Fields
- field_name: Field description (why this dimension is needed)
...
### Sources
- [Source1](url1)
- [Source2](url2)
```
### Step 3: Ask User for Existing Fields
Use request_user_input to ask if user has existing field definition file, if so read and merge.
### Step 4: Generate Outline (Separate Files)
Merge {step1_output}, {step2_output} and user's existing fields, generate two files:
**outline.yaml** (items + config):
- topic: Research topic
- items: Research objects list
- execution:
- batch_size: Number of parallel agents (confirm with request_user_input)
- items_per_agent: Items per agent (confirm with request_user_input)
- output_dir: Results output directory (default: ./results)
**fields.yaml** (field definitions):
- Field categories and definitions
- Each field's name, description, detail_level
- detail_level hierarchy: brief -> moderate -> detailed
- uncertain: Uncertain fields list (reserved field, auto-filled in deep phase)
### Step 5: Output and Confirm
- Create directory: `./{topic_slug}/`
- Save: `outline.yaml` and `fields.yaml`
- Show to user for confirmation
## Output Path
```
{current_working_directory}/{topic_slug}/
├── outline.yaml # items list + execution config
└── fields.yaml # field definitions
```
## Follow-up Commands
- `/research-add-items` - Supplement items
- `/research-add-fields` - Supplement fields
- `/research-deep` - Start deep research

198
research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/validate_json.py Normal file
View File

@@ -0,0 +1,198 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import sys
from collections import defaultdict
from pathlib import Path
import yaml
CATEGORY_MAPPING = {
"basic_info": ["basic_info", "Basic Info"],
"technical_features": ["technical_features", "technical_characteristics", "Technical Features"],
"performance_metrics": ["performance_metrics", "performance", "Performance Metrics"],
"milestone_significance": ["milestone_significance", "milestones", "Milestone Significance"],
"business_info": ["business_info", "commercial_info", "Business Info"],
"competition_ecosystem": ["competition_ecosystem", "competition", "Competition Ecosystem"],
"history": ["history", "History"],
"market_positioning": ["market_positioning", "market", "Market Positioning"],
}
_SKIP_KEYS = {"_source_file", "uncertain"}
def load_fields_yaml(fields_path):
"""Parse fields.yaml in the single schema the research skills emit:
fields:
<category>:
- {name: ..., description: ..., detail_level: ...}
...
uncertain: []
This is the ONLY accepted shape. A fields.yaml that does not match fails
loudly instead of silently passing with zero fields.
Required semantics (so the validator can never pass vacuously / "lie"):
- if ANY field carries an explicit `required:` key -> opt-in, preserve it
- else (detail_level-style, no markers) -> ALL fields required, because the
script's stated purpose is COMPLETE field coverage.
"""
with fields_path.open(encoding="utf-8") as f:
data = yaml.safe_load(f) or {}
defs = [] # (name, category, required_or_None)
fn = data.get("fields")
if not isinstance(fn, dict):
print(f"[ERROR] fields.yaml must use the `fields: {{<category>: [{{name, ...}}]}}` shape; got {type(fn).__name__ if fn is not None else 'None'}.")
sys.exit(1)
for cname, flist in fn.items():
if cname in _SKIP_KEYS:
continue
if not isinstance(flist, list):
print(f"[ERROR] category `{cname}` must map to a list of field dicts; got {type(flist).__name__}.")
sys.exit(1)
for field in flist:
if isinstance(field, dict) and "name" in field:
defs.append((str(field["name"]), str(cname), field.get("required", None)))
else:
print(f"[ERROR] field entry under `{cname}` must be a dict with a `name` key; got {field!r}.")
sys.exit(1)
if not defs:
print("[ERROR] fields.yaml parsed zero fields. Ensure at least one category with field dicts.")
sys.exit(1)
all_fields = {n for n, _, _ in defs}
if any(r is not None for _, _, r in defs):
required_fields = {n for n, _, r in defs if r}
else:
required_fields = set(all_fields)
field_categories = {n: c for n, c, _ in defs}
return all_fields, required_fields, field_categories
def extract_json_fields(data, category_mapping=None):
category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping
nested_keys = {k for keys in category_mapping.values() for k in keys}
fields = set()
stack = [(data, True)]
while stack:
obj, is_category_level = stack.pop()
if isinstance(obj, dict):
for k, v in obj.items():
if k in _SKIP_KEYS:
continue
if is_category_level and k in nested_keys:
if isinstance(v, dict):
stack.append((v, True))
continue
fields.add(k)
elif isinstance(obj, list):
stack.extend((item, is_category_level) for item in obj if isinstance(item, dict))
return fields
def validate_json(json_path, all_fields, required_fields, field_categories):
with json_path.open(encoding="utf-8") as f:
data = json.load(f)
json_fields = extract_json_fields(data)
covered = all_fields & json_fields
missing = all_fields - json_fields
extra = json_fields - all_fields
missing_required = missing & required_fields
missing_by_category = defaultdict(list)
for field in missing:
missing_by_category[field_categories.get(field, "Unknown")].append(field)
return {
"file": json_path.name,
"total_defined": len(all_fields),
"covered": len(covered),
"missing": len(missing),
"extra": len(extra),
"coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100,
"missing_required": sorted(missing_required),
"missing_optional": sorted(missing - required_fields),
"missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()},
"extra_fields": sorted(extra),
"valid": len(missing_required) == 0,
}
def print_result(result, verbose=True):
status = "PASS" if result["valid"] else "FAIL"
line = "=" * 60
print(f"\n{line}")
print(f"[{status}] {result['file']}")
print(line)
print(f"Coverage: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})")
if result["missing_required"]:
print(f"\n[ERROR] Missing required fields ({len(result['missing_required'])}):")
print("\n".join(f" - {f}" for f in result["missing_required"]))
if verbose and result["missing_optional"]:
missing_required = set(result["missing_required"])
print(f"\n[WARN] Missing optional fields ({len(result['missing_optional'])}):")
for cat in sorted(result["missing_by_category"]):
optional = [f for f in result["missing_by_category"][cat] if f not in missing_required]
if optional:
print(f" [{cat}]: {', '.join(optional)}")
if verbose and result["extra_fields"]:
extra = result["extra_fields"]
print(f"\n[INFO] Extra fields ({len(extra)}):")
print(f" {', '.join(extra[:10])}")
if len(extra) > 10:
print(f" ... and {len(extra) - 10} more")
def main():
import argparse
parser = argparse.ArgumentParser(description="Validate whether JSON files cover all fields defined in fields.yaml")
parser.add_argument("--fields", "-f", type=str, help="Path to fields.yaml", default="fields.yaml")
parser.add_argument("--json", "-j", type=str, nargs="*", help="JSON file paths to validate")
parser.add_argument("--dir", "-d", type=str, help="Directory containing JSON files", default="results")
parser.add_argument("--quiet", "-q", action="store_true", help="Show summary only")
args = parser.parse_args()
fields_path = Path(args.fields)
if not fields_path.exists():
for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"):
if p.exists():
fields_path = p
break
if not fields_path.exists():
print(f"[ERROR] fields.yaml not found: {fields_path}")
sys.exit(1)
print(f"Field definition file: {fields_path}")
all_fields, required_fields, field_categories = load_fields_yaml(fields_path)
print(f"Total fields: {len(all_fields)} (required: {len(required_fields)}, optional: {len(all_fields) - len(required_fields)})")
json_files = (
[Path(p) for p in args.json]
if args.json
else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else []
)
if not json_files:
print("[WARN] No JSON files found")
sys.exit(0)
results = []
for json_path in json_files:
if not json_path.exists():
print(f"[WARN] File not found: {json_path}")
continue
result = validate_json(json_path, all_fields, required_fields, field_categories)
results.append(result)
print_result(result, verbose=not args.quiet)
line = "=" * 60
print(f"\n{line}")
print("Summary")
print(line)
passed = sum(1 for r in results if r["valid"])
avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0
print(f"Validation passed: {passed}/{len(results)}")
print(f"Average coverage: {avg_coverage:.1f}%")
if passed < len(results):
sys.exit(1)
if __name__ == "__main__":
main()

32
research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/SKILL.md Normal file
View File

@@ -0,0 +1,32 @@
---
name: research-add-fields
user-invocable: true
description: Add field definitions to existing research outline.
allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion
---
# Research Add Fields - Supplement Research Fields
## Trigger
`/research-add-fields`
## Workflow
### Step 1: Auto-locate Fields File
Find `*/fields.yaml` file in current working directory, auto-read existing fields definitions.
### Step 2: Get Supplement Source
Ask user to choose:
- **A. User direct input**: User provides field names and descriptions
- **B. Web Search**: Launch agent to search common fields in this domain
### Step 3: Display and Confirm
- Display suggested new fields list
- User confirms which fields to add
- User specifies field category and detail_level
### Step 4: Save Update
Append confirmed fields to fields.yaml, save file.
## Output
Updated `{topic}/fields.yaml` file (in-place modification, requires user confirmation)

30
research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/SKILL.md Normal file
View File

@@ -0,0 +1,30 @@
---
name: research-add-items
user-invocable: true
description: Add items (research objects) to existing research outline.
allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion
---
# Research Add Items - Supplement Research Objects
## Trigger
`/research-add-items`
## Workflow
### Step 1: Auto-locate Outline
Find `*/outline.yaml` file in current working directory, auto-read.
### Step 2: Get Supplement Sources in Parallel
Simultaneously:
- **A. Ask user**: What items to supplement? Any specific names?
- **B. Ask if Web Search needed**: Launch agent to search for more items?
### Step 3: Merge and Update
- Append new items to outline.yaml
- Display to user for confirmation
- Avoid duplicates
- Save updated outline
## Output
Updated `{topic}/outline.yaml` file (in-place modification)

100
research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/SKILL.md Normal file
View File

@@ -0,0 +1,100 @@
---
name: research-deep
user-invocable: true
description: Read research outline, launch independent agent for each item for deep research. Disable task output.
allowed-tools: Bash, Read, Write, Glob, WebSearch, Task
---
# Research Deep - Deep Research
## Trigger
`/research-deep`
## Workflow
### Step 1: Auto-locate Outline
Find `*/outline.yaml` file in current working directory, read items list, execution config (including items_per_agent).
### Step 2: Resume Check
- Check completed JSON files in output_dir
- Skip completed items
### Step 3: Batch Execution
- Batch by batch_size (need user approval before next batch)
- Each agent handles items_per_agent items
- Launch web-search-agent (background parallel, disable task output)
**Parameter Retrieval**:
- `{topic}`: topic field from outline.yaml
- `{item_name}`: item's name field
- `{item_related_info}`: item's complete yaml content (name + category + description etc.)
- `{output_dir}`: execution.output_dir from outline.yaml (default: ./results)
- `{fields_path}`: absolute path to {topic}/fields.yaml
- `{output_path}`: absolute path to {output_dir}/{item_name_slug}.json (slugify item_name: replace spaces with _, remove special chars)
**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording.
**Prompt Template**:
```python
prompt = f"""## Task
Research {item_related_info}, output structured JSON to {output_path}
## Field Definitions
Read {fields_path} to get all field definitions
## Output Requirements
1. Output JSON according to fields defined in fields.yaml
2. Mark uncertain field values with [uncertain]
3. Add uncertain array at the end of JSON, listing all uncertain field names
4. All field values must be in English
## Output Path
{output_path}
## Validation
After completing JSON output, run validation script to ensure complete field coverage:
python ~/.claude/skills/research/validate_json.py -f {fields_path} -j {output_path}
Task is complete only after validation passes.
"""
```
**One-shot Example** (assuming researching GitHub Copilot):
```
## Task
Research name: GitHub Copilot
category: International Product
description: Developed by Microsoft/GitHub, first mainstream AI coding assistant, ~40% market share, output structured JSON to {project_dir}/results/GitHub_Copilot.json
## Field Definitions
Read {project_dir}/fields.yaml to get all field definitions
## Output Requirements
1. Output JSON according to fields defined in fields.yaml
2. Mark uncertain field values with [uncertain]
3. Add uncertain array at the end of JSON, listing all uncertain field names
4. All field values must be in English
## Output Path
{project_dir}/results/GitHub_Copilot.json
## Validation
After completing JSON output, run validation script to ensure complete field coverage:
python ~/.claude/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json
Task is complete only after validation passes.
```
### Step 4: Wait and Monitor
- Wait for current batch to complete
- Launch next batch
- Display progress
### Step 5: Summary Report
After all complete, output:
- Completion count
- Failed/uncertain marked items
- Output directory
## Agent Config
- Background execution: Yes
- Task Output: Disabled (agent has explicit output file when complete)
- Resume support: Yes

93
research-what-we-did/Deep-Research-skills/skills/research-en/research-report/SKILL.md Normal file
View File

@@ -0,0 +1,93 @@
---
name: research-report
user-invocable: true
description: Summarize deep research results into markdown report, cover all fields, skip uncertain values.
allowed-tools: Read, Write, Glob, Bash, AskUserQuestion
---
# Research Report - Summary Report
## Trigger
`/research-report`
## Workflow
### Step 1: Locate Results Directory
Find `*/outline.yaml` in current working directory, read topic and output_dir config.
### Step 2: Scan Optional Summary Fields
Read all JSON results, extract fields suitable for TOC display (numeric, short metrics), e.g.:
- github_stars
- google_scholar_cites
- swe_bench_score
- user_scale
- valuation
- release_date
Use AskUserQuestion to ask user:
- Which fields to display in TOC besides item name?
- Provide dynamic options list (based on actual fields in JSON)
### Step 3: Generate Python Conversion Script
Generate `generate_report.py` in `{topic}/` directory, script requirements:
- Read all JSON from output_dir
- Read fields.yaml to get field structure
- Cover all field values from each JSON
- Skip fields with values containing [uncertain]
- Skip fields listed in uncertain array
- Generate markdown report format: Table of contents (with anchor links + user-selected summary fields) + Detailed content (by field category)
- Save to `{topic}/report.md`
**TOC Format Requirements**:
- Must include every item
- Each item displays: number, name (anchor link), user-selected summary fields
- Example: `1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%`
#### Script Technical Requirements (Must Follow)
**1. JSON Structure Compatibility**
Support two JSON structures:
- Flat structure: Fields directly at top level `{"name": "xxx", "release_date": "xxx"}`
- Nested structure: Fields in category sub-dict `{"basic_info": {"name": "xxx"}, "technical_features": {...}}`
Field lookup order: Top level -> category mapping key -> Traverse all nested dicts
**2. Category Multi-language Mapping**
fields.yaml category names and JSON keys can be any combination (CN-CN, CN-EN, EN-CN, EN-EN). Must establish bidirectional mapping:
```python
CATEGORY_MAPPING = {
"Basic Info": ["basic_info", "Basic Info"],
"Technical Features": ["technical_features", "technical_characteristics", "Technical Features"],
"Performance Metrics": ["performance_metrics", "performance", "Performance Metrics"],
"Milestone Significance": ["milestone_significance", "milestones", "Milestone Significance"],
"Business Info": ["business_info", "commercial_info", "Business Info"],
"Competition & Ecosystem": ["competition_ecosystem", "competition", "Competition & Ecosystem"],
"History": ["history", "History"],
"Market Positioning": ["market_positioning", "market", "Market Positioning"],
}
```
**3. Complex Value Formatting**
- list of dicts (e.g., key_events, funding_history): Format each dict as one line, separate kv with ` | `
- Normal list: Short lists joined with comma, long lists displayed with line breaks
- Nested dict: Recursive formatting, display with semicolon or line breaks
- Long text strings (over 100 chars): Add line breaks `<br>` or use blockquote format for readability
**4. Extra Fields Collection**
Collect fields that exist in JSON but not defined in fields.yaml, put in "Other Info" category. Note to filter:
- Internal fields: `_source_file`, `uncertain`
- Nested structure top-level keys: `basic_info`, `technical_features` etc.
- `uncertain` array: Display each field name on separate line, don't compress into one line
**5. Uncertain Value Skipping**
Skip conditions:
- Field value contains `[uncertain]` string
- Field name is in `uncertain` array
- Field value is None or empty string
### Step 4: Execute Script
Run `python {topic}/generate_report.py`
## Output
- `{topic}/generate_report.py` - Conversion script
- `{topic}/report.md` - Summary report

145
research-what-we-did/Deep-Research-skills/skills/research-en/research/SKILL.md Normal file
View File

@@ -0,0 +1,145 @@
---
name: research
user-invocable: true
allowed-tools: Read, Write, Glob, WebSearch, Task, AskUserQuestion
description: Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
---
# Research Skill - Preliminary Research
## Trigger
`/research <topic>`
## Workflow
### Step 1: Generate Initial Framework from Model Knowledge
Based on topic, use model's existing knowledge to generate:
- Main research objects/items list in this domain
- Suggested research field framework
Output {step1_output}, use AskUserQuestion to confirm:
- Need to add/remove items?
- Does field framework meet requirements?
### Step 2: Web Search Supplement
Use AskUserQuestion to ask for time range (e.g., last 6 months, since 2024, unlimited).
**Parameter Retrieval**:
- `{topic}`: User input research topic
- `{YYYY-MM-DD}`: Current date
- `{step1_output}`: Complete output from Step 1
- `{time_range}`: User specified time range
**Hard Constraint**: The following prompt must be strictly reproduced, only replacing variables in {xxx}, do not modify structure or wording.
Launch 1 web-search-agent (background), **Prompt Template**:
```python
prompt = f"""## Task
Research topic: {topic}
Current date: {YYYY-MM-DD}
Based on the following initial framework, supplement latest items and recommended research fields.
## Existing Framework
{step1_output}
## Goals
1. Verify if existing items are missing important objects
2. Supplement items based on missing objects
3. Continue searching for {topic} related items within {time_range} and supplement
4. Supplement new fields
## Output Requirements
Return structured results directly (do not write files):
### Supplementary Items
- item_name: Brief explanation (why it should be added)
...
### Recommended Supplementary Fields
- field_name: Field description (why this dimension is needed)
...
### Sources
- [Source1](url1)
- [Source2](url2)
"""
```
**One-shot Example** (assuming researching AI Coding History):
```
## Task
Research topic: AI Coding History
Current date: 2025-12-30
Based on the following initial framework, supplement latest items and recommended research fields.
## Existing Framework
### Items List
1. GitHub Copilot: Developed by Microsoft/GitHub, first mainstream AI coding assistant
2. Cursor: AI-first IDE, based on VSCode
...
### Field Framework
- Basic Info: name, release_date, company
- Technical Features: underlying_model, context_window
...
## Goals
1. Verify if existing items are missing important objects
2. Supplement items based on missing objects
3. Continue searching for AI Coding History related items within since 2024 and supplement
4. Supplement new fields
## Output Requirements
Return structured results directly (do not write files):
### Supplementary Items
- item_name: Brief explanation (why it should be added)
...
### Recommended Supplementary Fields
- field_name: Field description (why this dimension is needed)
...
### Sources
- [Source1](url1)
- [Source2](url2)
```
### Step 3: Ask User for Existing Fields
Use AskUserQuestion to ask if user has existing field definition file, if so read and merge.
### Step 4: Generate Outline (Separate Files)
Merge {step1_output}, {step2_output} and user's existing fields, generate two files:
**outline.yaml** (items + config):
- topic: Research topic
- items: Research objects list
- execution:
- batch_size: Number of parallel agents (confirm with AskUserQuestion)
- items_per_agent: Items per agent (confirm with AskUserQuestion)
- output_dir: Results output directory (default: ./results)
**fields.yaml** (field definitions):
- Field categories and definitions
- Each field's name, description, detail_level
- detail_level hierarchy: brief -> moderate -> detailed
- uncertain: Uncertain fields list (reserved field, auto-filled in deep phase)
### Step 5: Output and Confirm
- Create directory: `./{topic_slug}/`
- Save: `outline.yaml` and `fields.yaml`
- Show to user for confirmation
## Output Path
```
{current_working_directory}/{topic_slug}/
├── outline.yaml # items list + execution config
└── fields.yaml # field definitions
```
## Follow-up Commands
- `/research-add-items` - Supplement items
- `/research-add-fields` - Supplement fields
- `/research-deep` - Start deep research

198
research-what-we-did/Deep-Research-skills/skills/research-en/research/validate_json.py Normal file
View File

@@ -0,0 +1,198 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import sys
from collections import defaultdict
from pathlib import Path
import yaml
CATEGORY_MAPPING = {
"basic_info": ["basic_info", "Basic Info"],
"technical_features": ["technical_features", "technical_characteristics", "Technical Features"],
"performance_metrics": ["performance_metrics", "performance", "Performance Metrics"],
"milestone_significance": ["milestone_significance", "milestones", "Milestone Significance"],
"business_info": ["business_info", "commercial_info", "Business Info"],
"competition_ecosystem": ["competition_ecosystem", "competition", "Competition Ecosystem"],
"history": ["history", "History"],
"market_positioning": ["market_positioning", "market", "Market Positioning"],
}
_SKIP_KEYS = {"_source_file", "uncertain"}
def load_fields_yaml(fields_path):
"""Parse fields.yaml in the single schema the research skills emit:
fields:
<category>:
- {name: ..., description: ..., detail_level: ...}
...
uncertain: []
This is the ONLY accepted shape. A fields.yaml that does not match fails
loudly instead of silently passing with zero fields.
Required semantics (so the validator can never pass vacuously / "lie"):
- if ANY field carries an explicit `required:` key -> opt-in, preserve it
- else (detail_level-style, no markers) -> ALL fields required, because the
script's stated purpose is COMPLETE field coverage.
"""
with fields_path.open(encoding="utf-8") as f:
data = yaml.safe_load(f) or {}
defs = [] # (name, category, required_or_None)
fn = data.get("fields")
if not isinstance(fn, dict):
print(f"[ERROR] fields.yaml must use the `fields: {{<category>: [{{name, ...}}]}}` shape; got {type(fn).__name__ if fn is not None else 'None'}.")
sys.exit(1)
for cname, flist in fn.items():
if cname in _SKIP_KEYS:
continue
if not isinstance(flist, list):
print(f"[ERROR] category `{cname}` must map to a list of field dicts; got {type(flist).__name__}.")
sys.exit(1)
for field in flist:
if isinstance(field, dict) and "name" in field:
defs.append((str(field["name"]), str(cname), field.get("required", None)))
else:
print(f"[ERROR] field entry under `{cname}` must be a dict with a `name` key; got {field!r}.")
sys.exit(1)
if not defs:
print("[ERROR] fields.yaml parsed zero fields. Ensure at least one category with field dicts.")
sys.exit(1)
all_fields = {n for n, _, _ in defs}
if any(r is not None for _, _, r in defs):
required_fields = {n for n, _, r in defs if r}
else:
required_fields = set(all_fields)
field_categories = {n: c for n, c, _ in defs}
return all_fields, required_fields, field_categories
def extract_json_fields(data, category_mapping=None):
category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping
nested_keys = {k for keys in category_mapping.values() for k in keys}
fields = set()
stack = [(data, True)]
while stack:
obj, is_category_level = stack.pop()
if isinstance(obj, dict):
for k, v in obj.items():
if k in _SKIP_KEYS:
continue
if is_category_level and k in nested_keys:
if isinstance(v, dict):
stack.append((v, True))
continue
fields.add(k)
elif isinstance(obj, list):
stack.extend((item, is_category_level) for item in obj if isinstance(item, dict))
return fields
def validate_json(json_path, all_fields, required_fields, field_categories):
with json_path.open(encoding="utf-8") as f:
data = json.load(f)
json_fields = extract_json_fields(data)
covered = all_fields & json_fields
missing = all_fields - json_fields
extra = json_fields - all_fields
missing_required = missing & required_fields
missing_by_category = defaultdict(list)
for field in missing:
missing_by_category[field_categories.get(field, "Unknown")].append(field)
return {
"file": json_path.name,
"total_defined": len(all_fields),
"covered": len(covered),
"missing": len(missing),
"extra": len(extra),
"coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100,
"missing_required": sorted(missing_required),
"missing_optional": sorted(missing - required_fields),
"missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()},
"extra_fields": sorted(extra),
"valid": len(missing_required) == 0,
}
def print_result(result, verbose=True):
status = "PASS" if result["valid"] else "FAIL"
line = "=" * 60
print(f"\n{line}")
print(f"[{status}] {result['file']}")
print(line)
print(f"Coverage: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})")
if result["missing_required"]:
print(f"\n[ERROR] Missing required fields ({len(result['missing_required'])}):")
print("\n".join(f" - {f}" for f in result["missing_required"]))
if verbose and result["missing_optional"]:
missing_required = set(result["missing_required"])
print(f"\n[WARN] Missing optional fields ({len(result['missing_optional'])}):")
for cat in sorted(result["missing_by_category"]):
optional = [f for f in result["missing_by_category"][cat] if f not in missing_required]
if optional:
print(f" [{cat}]: {', '.join(optional)}")
if verbose and result["extra_fields"]:
extra = result["extra_fields"]
print(f"\n[INFO] Extra fields ({len(extra)}):")
print(f" {', '.join(extra[:10])}")
if len(extra) > 10:
print(f" ... and {len(extra) - 10} more")
def main():
import argparse
parser = argparse.ArgumentParser(description="Validate whether JSON files cover all fields defined in fields.yaml")
parser.add_argument("--fields", "-f", type=str, help="Path to fields.yaml", default="fields.yaml")
parser.add_argument("--json", "-j", type=str, nargs="*", help="JSON file paths to validate")
parser.add_argument("--dir", "-d", type=str, help="Directory containing JSON files", default="results")
parser.add_argument("--quiet", "-q", action="store_true", help="Show summary only")
args = parser.parse_args()
fields_path = Path(args.fields)
if not fields_path.exists():
for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"):
if p.exists():
fields_path = p
break
if not fields_path.exists():
print(f"[ERROR] fields.yaml not found: {fields_path}")
sys.exit(1)
print(f"Field definition file: {fields_path}")
all_fields, required_fields, field_categories = load_fields_yaml(fields_path)
print(f"Total fields: {len(all_fields)} (required: {len(required_fields)}, optional: {len(all_fields) - len(required_fields)})")
json_files = (
[Path(p) for p in args.json]
if args.json
else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else []
)
if not json_files:
print("[WARN] No JSON files found")
sys.exit(0)
results = []
for json_path in json_files:
if not json_path.exists():
print(f"[WARN] File not found: {json_path}")
continue
result = validate_json(json_path, all_fields, required_fields, field_categories)
results.append(result)
print_result(result, verbose=not args.quiet)
line = "=" * 60
print(f"\n{line}")
print("Summary")
print(line)
passed = sum(1 for r in results if r["valid"])
avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0
print(f"Validation passed: {passed}/{len(results)}")
print(f"Average coverage: {avg_coverage:.1f}%")
if passed < len(results):
sys.exit(1)
if __name__ == "__main__":
main()

32
research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/SKILL.md Normal file
View File

@@ -0,0 +1,32 @@
---
name: research-add-fields
user-invocable: true
description: 向现有调研outline补充字段定义。
allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion
---
# Research Add Fields - 补充调研字段
## 触发方式
`/research-add-fields`
## 执行流程
### Step 1: 自动定位Fields文件
在当前工作目录查找 `*/fields.yaml` 文件，自动读取现有fields定义。
### Step 2: 获取补充来源
询问用户选择：
- **A. 用户直接输入**：用户提供字段名称和描述
- **B. Web Search搜索**：启动web-search-agent搜索该领域常用字段
### Step 3: 展示并确认
- 展示建议的新字段列表
- 用户确认哪些字段需要添加
- 用户指定字段分类和detail_level
### Step 4: 保存更新
将确认的字段追加到fields.yaml，保存文件。
## 输出
更新后的 `{topic}/fields.yaml` 文件（原地修改，需用户确认）

30
research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/SKILL.md Normal file
View File

@@ -0,0 +1,30 @@
---
name: research-add-items
user-invocable: true
description: 向现有调研outline补充items（调研对象）。
allowed-tools: Bash, Read, Write, Glob, WebSearch, Task, AskUserQuestion
---
# Research Add Items - 补充调研对象
## 触发方式
`/research-add-items`
## 执行流程
### Step 1: 自动定位Outline
在当前工作目录查找 `*/outline.yaml` 文件，自动读取。
### Step 2: 并行获取补充来源
同时进行：
- **A. 询问用户**：需要补充哪些items？有具体名称吗？
- **B. 询问是否需要Web Search**：是否启动agent搜索更多items？
### Step 3: 合并更新
- 将新items追加到outline.yaml
- 展示给用户确认
- 避免重复
- 保存更新后的outline
## 输出
更新后的 `{topic}/outline.yaml` 文件（原地修改）

100
research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/SKILL.md Normal file
View File

@@ -0,0 +1,100 @@
---
name: research-deep
user-invocable: true
description: 读取调研outline，为每个item启动独立agent进行深度调研。禁用task output。
allowed-tools: Bash, Read, Write, Glob, WebSearch, Task
---
# Research Deep - 深度调研
## 触发方式
`/research-deep`
## 执行流程
### Step 1: 自动定位Outline
在当前工作目录查找 `*/outline.yaml` 文件，读取items列表、execution配置（含items_per_agent）。
### Step 2: 断点续传检查
- 检查output_dir下已完成的JSON文件
- 跳过已完成的items
### Step 3: 分批执行
- 按batch_size分批（完成一批需要得到用户同意才可进行下一批）
- 每个agent负责items_per_agent个项目
- 启动web-search-agent（后台并行，禁用task output）
**参数获取**：
- `{topic}`: outline.yaml中的topic字段
- `{item_name}`: item的name字段
- `{item_related_info}`: item的完整yaml内容（name + category + description等）
- `{output_dir}`: outline.yaml中execution.output_dir（默认./results）
- `{fields_path}`: {topic}/fields.yaml的绝对路径
- `{output_path}`: {output_dir}/{item_name_slug}.json的绝对路径（slugify处理item_name：空格替换为_，移除特殊字符）
**硬约束**：以下prompt必须严格复述，仅替换{xxx}中的变量，禁止改写结构或措辞。
**Prompt模板**：
```python
prompt = f"""## 任务
调研 {item_related_info}，输出结构化JSON到 {output_path}
## 字段定义
读取 {fields_path} 获取所有字段定义
## 输出要求
1. 按fields.yaml定义的字段输出JSON
2. 不确定的字段值标注[不确定]
3. JSON末尾添加uncertain数组，列出所有不确定的字段名
4. 所有字段值必须使用中文输出（调研过程可用英文，但最终JSON值为中文）
## 输出路径
{output_path}
## 验证
完成JSON输出后，运行验证脚本确保字段完整覆盖：
python ~/.claude/skills/research/validate_json.py -f {fields_path} -j {output_path}
验证通过后才算完成任务。
"""
```
**One-shot示例**（假设调研GitHub Copilot）：
```
## 任务
调研 name: GitHub Copilot
category: 国际产品
description: Microsoft/GitHub开发，首个主流AI编程助手，市场份额约40%，输出结构化JSON到 {project_dir}/results/GitHub_Copilot.json
## 字段定义
读取 {project_dir}/fields.yaml 获取所有字段定义
## 输出要求
1. 按fields.yaml定义的字段输出JSON
2. 不确定的字段值标注[不确定]
3. JSON末尾添加uncertain数组，列出所有不确定的字段名
4. 所有字段值必须使用中文输出（调研过程可用英文，但最终JSON值为中文）
## 输出路径
{project_dir}/results/GitHub_Copilot.json
## 验证
完成JSON输出后，运行验证脚本确保字段完整覆盖：
python ~/.claude/skills/research/validate_json.py -f {project_dir}/fields.yaml -j {project_dir}/results/GitHub_Copilot.json
验证通过后才算完成任务。
```
### Step 4: 等待与监控
- 等待当前批次完成
- 启动下一批
- 显示进度
### Step 5: 汇总报告
全部完成后输出：
- 完成数量
- 失败/不确定标记的items
- 输出目录
## Agent配置
- 后台执行: 是
- Task Output: 禁用（agent完成时有明确输出文件）
- 断点续传: 是

93
research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/SKILL.md Normal file
View File

@@ -0,0 +1,93 @@
---
name: research-report
user-invocable: true
description: 将deep调研结果汇总为markdown报告，覆盖所有字段，跳过不确定值。
allowed-tools: Read, Write, Glob, Bash, AskUserQuestion
---
# Research Report - 汇总报告
## 触发方式
`/research-report`
## 执行流程
### Step 1: 定位结果目录
在当前工作目录查找 `*/outline.yaml`，读取topic和output_dir配置。
### Step 2: 扫描可选摘要字段
读取所有JSON结果，提取适合在目录中显示的字段（数值型、简短指标），例如：
- github_stars
- google_scholar_cites
- swe_bench_score
- user_scale
- valuation
- release_date
使用AskUserQuestion询问用户：
- 目录中除了item名称外，还需要显示哪些字段？
- 提供动态选项列表（基于实际JSON中存在的字段）
### Step 3: 生成Python转换脚本
在 `{topic}/` 目录下生成 `generate_report.py`，脚本要求：
- 读取output_dir下所有JSON
- 读取fields.yaml获取字段结构
- 覆盖每个JSON的所有字段值
- 跳过值包含[不确定]的字段
- 跳过uncertain数组中列出的字段
- 生成markdown报告格式：目录（带锚点跳转+用户选择的摘要字段）+ 详细内容（按字段分类）
- 保存到 `{topic}/report.md`
**目录格式要求**：
- 必须包含每一个item
- 每个item显示：序号、名称（锚点链接）、用户选择的摘要字段
- 示例：`1. [GitHub Copilot](#github-copilot) - Stars: 10k | Score: 85%`
#### 脚本技术要点（必须遵循）
**1. JSON结构兼容**
支持两种JSON结构：
- 扁平结构：字段直接在顶层 `{"name": "xxx", "release_date": "xxx"}`
- 嵌套结构：字段在category子dict中 `{"basic_info": {"name": "xxx"}, "technical_features": {...}}`
字段查找顺序：顶层 -> category映射key -> 遍历所有嵌套dict
**2. Category多语言映射**
fields.yaml的category名与JSON的key可能是任意组合（中中、中英、英中、英英）。必须建立双向映射：
```python
CATEGORY_MAPPING = {
"基本信息": ["basic_info", "基本信息"],
"技术特性": ["technical_features", "technical_characteristics", "技术特性"],
"性能指标": ["performance_metrics", "performance", "性能指标"],
"里程碑意义": ["milestone_significance", "milestones", "里程碑意义"],
"商业信息": ["business_info", "commercial_info", "商业信息"],
"竞争与生态": ["competition_ecosystem", "competition", "竞争与生态"],
"历史沿革": ["history", "历史沿革"],
"市场定位": ["market_positioning", "market", "市场定位"],
}
```
**3. 复杂值格式化**
- list of dicts（如key_events, funding_history）：每个dict格式化为一行，用` | `分隔kv
- 普通list：短列表用逗号连接，长列表换行显示
- 嵌套dict：递归格式化，用分号或换行显示
- 长文本字符串（超过100字符）：添加换行符`<br>`或使用blockquote格式，提高可读性
**4. 额外字段收集**
收集JSON中有但fields.yaml中没定义的字段，放入"其他信息"分类。注意过滤：
- 内部字段：`_source_file`, `uncertain`
- 嵌套结构顶级key：`basic_info`, `technical_features`等
- `uncertain`数组：需要逐行显示每个字段名，不要压缩成一行
**5. 不确定值跳过**
跳过条件：
- 字段值包含`[不确定]`字符串
- 字段名在`uncertain`数组中
- 字段值为None或空字符串
### Step 4: 执行脚本
运行 `python {topic}/generate_report.py`
## 输出
- `{topic}/generate_report.py` - 转换脚本
- `{topic}/report.md` - 汇总报告

145
research-what-we-did/Deep-Research-skills/skills/research-zh/research/SKILL.md Normal file
View File

@@ -0,0 +1,145 @@
---
name: research
user-invocable: true
allowed-tools: Read, Write, Glob, WebSearch, Task, AskUserQuestion
description: 对目标话题进行初步调研，生成调研outline。用于学术调研、benchmark调研、技术选型等场景。
---
# Research Skill - 初步调研
## 触发方式
`/research <topic>`
## 执行流程
### Step 1: 模型内部知识生成初步框架
基于topic，利用模型已有知识生成：
- 该领域的主要研究对象/items列表
- 建议的调研字段框架
输出{step1_output}，使用AskUserQuestion确认：
- items列表是否需要增减？
- 字段框架是否满足需求？
### Step 2: Web Search补充
使用AskUserQuestion询问时间范围（如：最近6个月、2024年至今、不限）。
**参数获取**：
- `{topic}`: 用户输入的调研话题
- `{YYYY-MM-DD}`: 当前日期
- `{step1_output}`: Step 1生成的完整输出内容
- `{time_range}`: 用户指定的时间范围
**硬约束**：以下prompt必须严格复述，仅替换{xxx}中的变量，禁止改写结构或措辞。
启动1个web-search-agent（后台），**Prompt模板**：
```python
prompt = f"""## 任务
调研话题: {topic}
当前日期: {YYYY-MM-DD}
基于以下初步框架，补充最新items和推荐调研字段。
## 已有框架
{step1_output}
## 目标
1. 验证已有items是否遗漏重要对象
2. 根据遗漏对象进行补充items
3. 继续搜索{topic}相关且{time_range}内的items并补充
4. 补充新fields
## 输出要求
直接返回结构化结果（不写文件）：
### 补充Items
- item_name: 简要说明（为什么应该加入）
...
### 推荐补充字段
- field_name: 字段描述（为什么需要这个维度）
...
### 信息来源
- [来源1](url1)
- [来源2](url2)
"""
```
**One-shot示例**（假设调研AI Coding发展史）：
```
## 任务
调研话题: AI Coding 发展史
当前日期: 2025-12-30
基于以下初步框架，补充最新items和推荐调研字段。
## 已有框架
### Items列表
1. GitHub Copilot: Microsoft/GitHub开发，首个主流AI编程助手
2. Cursor: AI-first IDE，基于VSCode
...
### 字段框架
- 基本信息: name, release_date, company
- 技术特性: underlying_model, context_window
...
## 目标
1. 验证已有items是否遗漏重要对象
2. 根据遗漏对象进行补充items
3. 继续搜索AI Coding 发展史相关且2024年至今内的items并补充
4. 补充新fields
## 输出要求
直接返回结构化结果（不写文件）：
### 补充Items
- item_name: 简要说明（为什么应该加入）
...
### 推荐补充字段
- field_name: 字段描述（为什么需要这个维度）
...
### 信息来源
- [来源1](url1)
- [来源2](url2)
```
### Step 3: 询问用户已有字段
使用AskUserQuestion询问用户是否有已定义的字段文件，如有则读取并合并。
### Step 4: 生成Outline（分离文件）
合并{step1_output}、{step2_output}和用户已有字段，生成两个文件：
**outline.yaml**（items + 配置）：
- topic: 调研主题
- items: 调研对象列表
- execution:
- batch_size: 并行agent数量（需AskUserQuestion确认）
- items_per_agent: 每个agent调研项目数（需AskUserQuestion确认）
- output_dir: 结果输出目录（默认./results）
**fields.yaml**（字段定义）：
- 字段分类和定义
- 每个字段的name、description、detail_level
- detail_level分层：极简 → 简要 → 详细
- uncertain: 不确定字段列表（保留字段，deep阶段自动填充）
### Step 5: 输出并确认
- 创建目录: `./{topic_slug}/`
- 保存: `outline.yaml` 和 `fields.yaml`
- 展示给用户确认
## 输出路径
```
{当前工作目录}/{topic_slug}/
├── outline.yaml # items列表 + execution配置
└── fields.yaml # 字段定义
```
## 后续命令
- `/research-add-items` - 补充items
- `/research-add-fields` - 补充字段
- `/research-deep` - 开始深度调研

197
research-what-we-did/Deep-Research-skills/skills/research-zh/research/validate_json.py Normal file
View File

@@ -0,0 +1,197 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import sys
from collections import defaultdict
from pathlib import Path
import yaml
CATEGORY_MAPPING = {
"基本信息": ["basic_info", "基本信息"],
"技术特性": ["technical_features", "technical_characteristics", "技术特性"],
"性能指标": ["performance_metrics", "performance", "性能指标"],
"里程碑意义": ["milestone_significance", "milestones", "里程碑意义"],
"商业信息": ["business_info", "commercial_info", "商业信息"],
"竞争与生态": ["competition_ecosystem", "competition", "竞争与生态"],
"历史沿革": ["history", "历史沿革"],
"市场定位": ["market_positioning", "market", "市场定位"],
}
_SKIP_KEYS = {"_source_file", "uncertain"}
def load_fields_yaml(fields_path):
"""解析 fields.yaml，仅接受 research skill 实际生成的唯一 schema：
fields:
<category>:
- {name: ..., description: ..., detail_level: ...}
...
uncertain: []
只接受这一种格式。不符合的 fields.yaml 会直接报错退出，
而不是以零字段静默通过。
Required 语义（避免校验器空转通过/说谎）：
- 若任一字段显式带 `required:` 键 -> 沿用 opt-in 语义
- 否则（detail_level 式、无标记）-> 全部字段视为必填，因为脚本的目的就是完整覆盖。
"""
with fields_path.open(encoding="utf-8") as f:
data = yaml.safe_load(f) or {}
defs = [] # (name, category, required_or_None)
fn = data.get("fields")
if not isinstance(fn, dict):
print(f"[错误] fields.yaml 必须使用 `fields: {{<category>: [{{name, ...}}]}}` 格式；当前为 {type(fn).__name__ if fn is not None else 'None'}。")
sys.exit(1)
for cname, flist in fn.items():
if cname in _SKIP_KEYS:
continue
if not isinstance(flist, list):
print(f"[错误] 分类 `{cname}` 必须映射为字段字典列表；当前为 {type(flist).__name__}。")
sys.exit(1)
for field in flist:
if isinstance(field, dict) and "name" in field:
defs.append((str(field["name"]), str(cname), field.get("required", None)))
else:
print(f"[错误] `{cname}` 下的字段必须是带 `name` 键的字典；当前为 {field!r}。")
sys.exit(1)
if not defs:
print("[错误] fields.yaml 解析到零个字段。请确保至少有一个分类及其字段字典。")
sys.exit(1)
all_fields = {n for n, _, _ in defs}
if any(r is not None for _, _, r in defs):
required_fields = {n for n, _, r in defs if r}
else:
required_fields = set(all_fields)
field_categories = {n: c for n, c, _ in defs}
return all_fields, required_fields, field_categories
def extract_json_fields(data, category_mapping=None):
category_mapping = CATEGORY_MAPPING if category_mapping is None else category_mapping
nested_keys = {k for keys in category_mapping.values() for k in keys}
fields = set()
stack = [(data, True)]
while stack:
obj, is_category_level = stack.pop()
if isinstance(obj, dict):
for k, v in obj.items():
if k in _SKIP_KEYS:
continue
if is_category_level and k in nested_keys:
if isinstance(v, dict):
stack.append((v, True))
continue
fields.add(k)
elif isinstance(obj, list):
stack.extend((item, is_category_level) for item in obj if isinstance(item, dict))
return fields
def validate_json(json_path, all_fields, required_fields, field_categories):
with json_path.open(encoding="utf-8") as f:
data = json.load(f)
json_fields = extract_json_fields(data)
covered = all_fields & json_fields
missing = all_fields - json_fields
extra = json_fields - all_fields
missing_required = missing & required_fields
missing_by_category = defaultdict(list)
for field in missing:
missing_by_category[field_categories.get(field, "未知")].append(field)
return {
"file": json_path.name,
"total_defined": len(all_fields),
"covered": len(covered),
"missing": len(missing),
"extra": len(extra),
"coverage_rate": len(covered) / len(all_fields) * 100 if all_fields else 100,
"missing_required": sorted(missing_required),
"missing_optional": sorted(missing - required_fields),
"missing_by_category": {k: sorted(v) for k, v in missing_by_category.items()},
"extra_fields": sorted(extra),
"valid": len(missing_required) == 0,
}
def print_result(result, verbose=True):
status = "通过" if result["valid"] else "失败"
line = "=" * 60
print(f"\n{line}")
print(f"[{status}] {result['file']}")
print(line)
print(f"覆盖率: {result['coverage_rate']:.1f}% ({result['covered']}/{result['total_defined']})")
if result["missing_required"]:
print(f"\n[错误] 缺少必填字段 ({len(result['missing_required'])}):")
print("\n".join(f" - {f}" for f in result["missing_required"]))
if verbose and result["missing_optional"]:
missing_required = set(result["missing_required"])
print(f"\n[警告] 缺少可选字段 ({len(result['missing_optional'])}):")
for cat in sorted(result["missing_by_category"]):
optional = [f for f in result["missing_by_category"][cat] if f not in missing_required]
if optional:
print(f" [{cat}]: {', '.join(optional)}")
if verbose and result["extra_fields"]:
extra = result["extra_fields"]
print(f"\n[信息] 额外字段 ({len(extra)}):")
print(f" {', '.join(extra[:10])}")
if len(extra) > 10:
print(f" ... 还有 {len(extra) - 10} 个")
def main():
import argparse
parser = argparse.ArgumentParser(description="验证JSON文件是否覆盖fields.yaml中定义的所有字段")
parser.add_argument("--fields", "-f", type=str, help="fields.yaml路径", default="fields.yaml")
parser.add_argument("--json", "-j", type=str, nargs="*", help="要验证的JSON文件路径")
parser.add_argument("--dir", "-d", type=str, help="包含JSON文件的目录", default="results")
parser.add_argument("--quiet", "-q", action="store_true", help="仅显示摘要")
args = parser.parse_args()
fields_path = Path(args.fields)
if not fields_path.exists():
for p in (Path.cwd() / "fields.yaml", Path.cwd().parent / "fields.yaml"):
if p.exists():
fields_path = p
break
if not fields_path.exists():
print(f"[错误] 找不到fields.yaml: {fields_path}")
sys.exit(1)
print(f"字段定义文件: {fields_path}")
all_fields, required_fields, field_categories = load_fields_yaml(fields_path)
print(f"总字段数: {len(all_fields)} (必填: {len(required_fields)}, 可选: {len(all_fields) - len(required_fields)})")
json_files = (
[Path(p) for p in args.json]
if args.json
else sorted(Path(args.dir).glob("*.json")) if Path(args.dir).exists() else []
)
if not json_files:
print("[警告] 未找到JSON文件")
sys.exit(0)
results = []
for json_path in json_files:
if not json_path.exists():
print(f"[警告] 文件不存在: {json_path}")
continue
result = validate_json(json_path, all_fields, required_fields, field_categories)
results.append(result)
print_result(result, verbose=not args.quiet)
line = "=" * 60
print(f"\n{line}")
print("汇总")
print(line)
passed = sum(1 for r in results if r["valid"])
avg_coverage = sum(r["coverage_rate"] for r in results) / len(results) if results else 0
print(f"验证通过: {passed}/{len(results)}")
print(f"平均覆盖率: {avg_coverage:.1f}%")
if passed < len(results):
sys.exit(1)
if __name__ == "__main__":
main()

61
research-what-we-did/Deep-Research-skills/tests/test_install_codex.sh Normal file
View File

@@ -0,0 +1,61 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TMP_HOME="$(mktemp -d)"
trap 'rm -rf "$TMP_HOME"' EXIT
assert_contains() {
local path="$1"
local expected="$2"
if ! rg -F "$expected" "$path" >/dev/null 2>&1; then
echo "expected '$expected' in $path" >&2
exit 1
fi
}
HOME="$TMP_HOME" bash "$ROOT_DIR/scripts/install-codex.sh"
HOME="$TMP_HOME" bash "$ROOT_DIR/scripts/install-codex.sh"
if [[ ! -f "$TMP_HOME/.codex/config.toml" ]]; then
echo "expected config.toml to exist" >&2
exit 1
fi
if [[ -d "$TMP_HOME/.codex/skills" ]]; then
echo "did not expect skills directory to be created" >&2
exit 1
fi
if [[ -d "$TMP_HOME/.codex/agents" ]]; then
echo "did not expect agents directory to be created" >&2
exit 1
fi
assert_contains "$TMP_HOME/.codex/config.toml" "multi_agent = true"
assert_contains "$TMP_HOME/.codex/config.toml" "default_mode_request_user_input = true"
assert_contains "$TMP_HOME/.codex/config.toml" "suppress_unstable_features_warning = true"
assert_contains "$TMP_HOME/.codex/config.toml" "[agents.web_researcher]"
assert_contains "$TMP_HOME/.codex/config.toml" 'config_file = "agents/web-researcher.toml"'
if [[ "$(rg -c '^\[features\]$' "$TMP_HOME/.codex/config.toml")" != "1" ]]; then
echo "expected exactly one [features] section" >&2
exit 1
fi
if [[ "$(rg -c '^\[agents\.web_researcher\]$' "$TMP_HOME/.codex/config.toml")" != "1" ]]; then
echo "expected exactly one [agents.web_researcher] section" >&2
exit 1
fi
if awk '
/^\[features\]$/ { in_features=1; next }
/^\[/ { in_features=0 }
in_features && /suppress_unstable_features_warning/
' "$TMP_HOME/.codex/config.toml" | grep -q .; then
echo "did not expect suppress_unstable_features_warning inside [features]" >&2
exit 1
fi
echo "install-codex test passed"

95
research-what-we-did/Deep-Research-skills/tests/test_validate_json_schemas.py Normal file
View File

@@ -0,0 +1,95 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Regression test for skills/*/research/validate_json.py.
The validator accepts EXACTLY ONE schema — the one /research actually emits:
fields:
<category>:
- {name: ..., description: ..., detail_level: ...}
uncertain: []
Any other shape must be rejected (exit 1), never silently pass with zero fields.
With no explicit `required:` markers, every field is required so incomplete coverage
actually fails. With explicit markers, opt-in semantics are preserved.
Run: python tests/test_validate_json_schemas.py (exit 0 = all pass)
"""
import importlib.util
import json
import subprocess
import sys
import tempfile
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
COPIES = sorted(ROOT.glob("skills/*/research/validate_json.py"))
tmp = Path(tempfile.mkdtemp())
# The one accepted schema: fields:{<category>:[{name, detail_level}]} with NO `required` markers.
(tmp / "good_schema.yaml").write_text(
"fields:\n"
" basic:\n"
" - {name: a, detail_level: detailed}\n"
" - {name: b, detail_level: brief}\n"
" - {name: c, detail_level: moderate}\n"
" - {name: d, detail_level: moderate}\n"
"uncertain: []\n", encoding="utf-8")
# Same shape but with explicit required markers -> opt-in semantics.
(tmp / "marked_schema.yaml").write_text(
"fields:\n"
" basic:\n"
" - {name: a, required: true}\n"
" - {name: b, required: true}\n"
" - {name: notes, required: false}\n", encoding="utf-8")
# A rejected shape: the old `field_categories:` form.
(tmp / "bad_schema.yaml").write_text(
"field_categories:\n"
" - category: basic\n"
" fields:\n"
" - {name: a}\n", encoding="utf-8")
(tmp / "good.json").write_text(json.dumps({"a": 1, "b": 1, "c": 1, "d": 1}), encoding="utf-8")
(tmp / "bad.json").write_text(json.dumps({"a": 1, "b": 1, "c": 1}), encoding="utf-8") # missing 'd'
def load(path, i):
spec = importlib.util.spec_from_file_location(f"vj{i}", path)
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)
return mod
fails = []
def check(label, cond):
print(("PASS " if cond else "FAIL ") + label)
if not cond:
fails.append(label)
assert COPIES, "no validate_json.py copies found under skills/*/research/"
for i, path in enumerate(COPIES):
tag = path.relative_to(ROOT).parts[1] # e.g. research-en
m = load(path, i)
# 1. The one accepted schema parses all 4 fields; all required (no markers).
a, r, _ = m.load_fields_yaml(tmp / "good_schema.yaml")
check(f"[{tag}] good_schema parses 4 fields (was 0 before fix)", a == {"a", "b", "c", "d"})
check(f"[{tag}] all required when unmarked (no vacuous pass)", r == a)
# 2. Explicit markers preserve opt-in semantics.
am, rm, _ = m.load_fields_yaml(tmp / "marked_schema.yaml")
check(f"[{tag}] marked_schema: 3 fields, 'notes' optional", am == {"a", "b", "notes"} and rm == {"a", "b"})
# 3. A complete JSON passes; a JSON missing a field actually fails.
good = m.validate_json(tmp / "good.json", a, r, _)
bad = m.validate_json(tmp / "bad.json", a, r, _)
check(f"[{tag}] good.json -> valid", good["valid"])
check(f"[{tag}] bad.json -> INVALID (catches missing 'd')", (not bad["valid"]) and "d" in bad["missing_required"])
# 4. A rejected schema shape must make the CLI exit non-zero (run as subprocess).
proc = subprocess.run([sys.executable, str(path), "-f", str(tmp / "bad_schema.yaml"), "-d", str(tmp)],
capture_output=True, text=True)
check(f"[{tag}] bad_schema (field_categories) is REJECTED (exit != 0)", proc.returncode != 0)
print("\nRESULT:", "ALL PASS" if not fails else f"{len(fails)} FAILED -> {fails}")
sys.exit(1 if fails else 0)

BIN
research-what-we-did/Deep-Research-skills/workflow.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 452 KiB

39
research-what-we-did/EXTERNAL-CATALOG.md Normal file
View File

@@ -0,0 +1,39 @@
# 🩸 EXTERNAL CATALOG — RE/Malware/CTF skills & MCP (deep research 14.10.2026)
## ✅ ВЕНДОРЕНО в `vendor-new/` (лицензии совместимы, секрет-свип 0 хитов)
| Репо | ⭐ | Лицензия | SKILL.md | Что даёт |
|---|---|---|---|---|
| mukul975/Anthropic-Cybersecurity-Skills | 34420 | Apache-2.0 | ~820 | MITRE-mapped кибер-скиллы: malware, exploit-dev, IR, cloud, mobile |
| dslsdzc/rev-skills | 155 | Apache-2.0 | 143 | **закрывает пробелы**: firmware/embedded/protocol RE, unpacking, deobfuscation, managed code |
| meltedinhex/analyst-ai-pack | 22 | Apache-2.0 | 119 | malware analysis + threat hunting templates, mobile malware |
| rehan-remade/universal-modder | 7495 | MIT | 36 | game-RE/modding (examples/media срезаны, оставлены skills+knowledge+docs) |
| SimoneAvogadro/android-reverse-engineering-skill | 8137 | Apache-2.0 | 10 | Android RE end-to-end (jadx/apktool/frida/objection) |
| CreditTone/android-reverse-engineering-skill | 22 | Apache-2.0 | 7 | Codex-вариант Android RE (независимая реализация) |
| newliver666/apk-reverse | 4271 | MIT | 7 | APK reverse (dexlib, smali) |
| lwjjike/xbsReverseSkill | 162 | MIT | 33 | JS-реверс: xhs/bili/douyin/ctrip/qcc signature algorithms (CN-паки) |
| microsoft/win-dev-skills | 52 | MIT | 31 | официальный WinDbg/Windows debugging |
| gl0bal01/malware-analysis-claude-skills | 13 | MIT | 5 | malware analysis (CobaltStrike/Sliver implants) |
| cloudflare/security-audit-skill | 108 | MIT | 10 | security audit |
| FuzzingLabs/mcp-security-hub | 808 | MIT | — | 38 MCP-серверов/300+ тулов (Docker) |
| aoyunyang/spider-king-skill | 10 | MIT | 1 | spider/anti-bot |
| Fausto-404/js-reverse-automation--skill | 3 | — | 1 | JS reverse automation |
Итого вендорено: **+1143 SKILL.md**, ~82MB суммарно в репе.
## 🔗 ТОЛЬКО ССЫЛКИ (лицензия NOASSERTION/нет — не вендорим)
- morluto/rea — 221K⭐ Reverse Engineer Anything MCP (у нас есть курс: `our-skills/rea-full-course/`; ⭐-метрика подозрительна — проверить)
- nashsu/autocli-skill — CLI-реверс
- zhaoxuya520/reverse-skill — 37.9K⭐ upstream нашей базы (MIT, уже вендорен как reverse-skill-repo/)
- w0lf13/ghidra-mcp — Ghidra MCP (upstream ida_pro_mcp аналога)
- cyberkaida/ghidra-mcp-bridge — альтернативный Ghidra мост
- binarybabies/binary-analysis — бинарный анализ скилл
- fuzzsecurity/mcp-fuzzer — MCP фаззер
- securityfortech/claude-mcp-security — MCP security skills
## Пробелы без MCP (из crowdere/Awesome-RE-MCP)
UPX/DIE unpacking, Cuckoo/CAPE sandbox, AFL++ harness, binwalk — MCP-серверов нет, только CLI.
---
👻 [ииШко](https://t.me/AlStack)

83
research-what-we-did/RESEARCH-SUMMARY.md Normal file
View File

@@ -0,0 +1,83 @@
# ЧТО МЫ РЕСЁРЧИЛИ — реверс-инжиниринг (полный свод, 2026-09-26 → 28)
Восстановлено из памяти (Mnemopi) + файлов. Всё что мы делали по реверсу за эти дни.
---
## Хронология ресёрча
### 2026-09-26 (вечер) — Босс попросил переделать пост [REDACTED]
1. **Deep research «РЕВЕРС-ИНЖИНИРИНГ: ПОЛНЫЙ СТЕК 2026»** — софт + AI-агенты + курсы + разбор кейса взлома IDA Pro 9.3. Источники сверены, ссылки живые.
2. **Спарсили GitHub через API**: 5 поисковых запросов + каталог awesome-ai-reverse целиком + точечные проверки — ~60 позиций с живыми звёздами. Главные находки, которых не было у [REDACTED]: reverse-skill 37.9к★, Anthropic-Cybersecurity-Skills 33.4к★ (817 скиллов), SkillSpector (NVIDIA) 18.4к★, GhidraMCP 10.2к★, Trail of Bits skills 7.2к★, ctf-skills 3.3к★, официальный radare2-mcp, x64dbg-mcp, Cheat Engine MCP, REMnux MCP, auto-re-agent, reverify.
3. **Гайд вырос 3 → 4 сообщения** (лимит TG 4096).
### 2026-09-26 (ночь) — Прожарка: аудит + спор с тремя критиками
Прогнали 3 волны критиков (FactsCritic / StyleCritic / TechCritic), каждый вердикт перепроверен, спор тезис→контраргумент→вердикт. 78 репо через GitHub API + 20 внешних ссылок + ~30 чисел из README. Итог: **VERIFIED WITH CAVEATS**, v4 → v4.1.
#### Факт-фиксы (цифры [REDACTED] врут)
| Где | Было у [REDACTED] | Стало (сверено) |
|---|---|---|
| binary-ninja-headless-mcp | 180 тулов | **181 тул** |
| firefox-reverse | 855 звёзд | **857** |
| shannon | 47к звёзд | **48к** |
| Anthropic-Cybersecurity-Skills | 29 доменов | **34** |
| open-reverselab | «194 статьи» | **180+** |
| PMAT | PMAT-course (404) | **PMAT-labs** (1160★, жив) |
| Книга Нарвахи | «Реверсинг с IDA Pro от 0» | **«Введение в реверсинг с нуля, используя IDA PRO»** (перевода не хватает части 66.2) |
#### Смысловые вранья
- **Qiling «без запуска»** → «без запуска на живой системе» (Qiling код исполняет — в эмуляторе)
- **OGhidra** «сэмплы не уходят в облако» → поддерживает и облачные API; приватность только в локальном режиме
- **de4py** — CC BY-NC (некоммерческая), **disrobe** — платно для компаний. Интро «всё бесплатное» — ложь
- **Промпт-инъекция** «малварь учится разговаривать» → «встраивает команды в строки» (arXiv:2605.30667)
- «~20 новых 0-day» — тавтология
#### Спор с критиками (выжившие вердикты)
1. TechCritic [BLOCKER]: «утёк keygen с приватным ключом — не подтверждается» → **принят**, секция про лицензию IDA переписана: утечка беты 9.2 + генераторы под пропатченные бинари; keygen с приватным ключом публично не подтверждён. Рецепт не включён
2. StyleCritic: «Ты направляешь и валидируешь» — разговорщина → «Роль человека — направлять и валидировать»
3. FactsCritic [BLOCKER]: PMAT-course 404 → замена на PMAT-labs
4. FactsCritic: shannon 47к→48к, firefox-reverse 855→857 (точные числа из API — дисциплина канала)
5. TechCritic: «Всё бесплатное» → пометки лицензий + «лицензионные исключения помечены»
6. TechCritic: OGhidra → «LLM через Ollama или облачные API; в локальном режиме сэмплы не уходят в облако»
**Отклонено:** «виртуалка» (стандартный термин RU-реверс-среды), «↔» (типографика, не эмодзи).
**Чистым прошло:** ida-pro-mcp 12,351★, GhidraMCP 10,187★, SkillSpector 18,361★, reverse-skill 37,917★, FIRERPA 8,473★, Big Sleep ~20 0-day за 2025, CrackMeBench, ida-mcp MIT/IDA 9.4+, binwalk Rust, bethington 253 тула, Arkana 308.
#### Верификация финального v4
- 4 сообщения: 3861 / 3682 / 3882 / 1939 симв. (лимит 4096, запас от 214)
- **102/102 ссылки живые** (beginners.re 403 ботам — сайтом жив, проверено через Tavily)
### 2026-09-26/27 — свои скиллы
- **`re-roast-2026`** (managed-skills, авто-загрузка) — воркфлоу прожарки: триаж ссылок → цифры → названия → лицензии → гиперболы → точность → атрибуция → разбивка 4096 → раздел про лицензию IDA. + `scripts/linkcheck.py` — многопоточный свип живости (24 воркера, HEAD→GET, 403/405=BOTWALL). Smoke-тест: 200 ✓, 404 ✓, 403 BOTWALL ✓
- **`reverse-skill`** (ApiOid, security-skills) — роутер 47 модулей + CTF-оркестратор (42) + `omp-pe-triage.py` (PE-триаж pefile+capstone, чистый Python)
- Память: 6 фактов записано в Mnemopi
### 2026-09-26..28 — реальные кейсы реверса
- **TelegramExpert.exe** — EV-signed (Sectigo, «Slims Software») WiX/burn SFX-bootstrapper, 43 МБ, 6 секций без паковки, SFX×16/WiX×7, admin-проба через OpenProcessToken
- **WaveADS**, **hahacc CTF** — триаж-отчёты
- **DarkTelegram** — реверс + отчёт 466 строк
- **DeskGram**, **loliland** — реверс-проекты
- **Форумные свипы** по реверсу (forum-reversing_2026-09-19..28)
---
## Ключевые выводы ресёрча (суть)
1. **Пайплайн разбора сэмпла**: триаж (DIE+FLOSS+capa) → распаковка (x64dbg/Scylla, de4dot/dnSpyEx, Qiling) → статика (Ghidra/IDA) → динамика (Frida) → деобфускация (D-810/Unicorn/angr) → поведение (FakeNet-NG/CAPEv2/Speakeasy) → диффинг (BinDiff/Diaphora) → выход (YARA/IOC)
2. **Реверс через ИИ**: агент подключается к дизассемблеру через MCP и сам декомпилирует/ходит по xrefs/переименовывает/ставит бряки. Роль человека — направлять и валидировать
3. **Лицензия IDA**: .hexlic = офлайн JSON+подпись, ключ зашит в бинарь; keygen с приватным ключом публично не подтверждён; пропатченные сборки = вектор малвари; легально — IDA Free, Ghidra, академлицензия через вуз
4. **Ограничения ИИ-реверса**: агент уверенно ошибается в именах функций (крипто/C2/авторизация — руками); упакованный сэмпл = слабый псевдод; строки в бинарнике = промпт-инъекция против RE-агента
5. **Big Sleep** (Project Zero + DeepMind) — 0-day в SQLite до релиза, который фаззинг не поймал за 150 CPU-часов
## Файлы этого ресёрча
| Файл | Что |
|---|---|
| `rev_guide/p1..p4.md` | Гайд, 4 сообщения (до прожарки) |
| `rev-guide-v4.md` | **Финал v4.1 после прожарки** (26 правок, 102/102 ссылки) |
| `rev-guide-v4-subpost.md` | Под-пост-компаньон (1363 симв.) |
| `00-source-iishko-original.md` | Исходный пост [REDACTED] (для диффа) |
| `darktelegram_reverse_report.md` | Кейс DarkTelegram |
| `gh-reverse-catalog.json` | Каталог GitHub reverse-ресурсов |

661
research-what-we-did/darktelegram_reverse.py Normal file
View File

@@ -0,0 +1,661 @@
"""
DarkTelegram.pro — полный реверс
SaaS-облачный комбайн для автоматизации Telegram.
Python/FastAPI backend, React SPA фронт, Cloudflare Turnstile, облачное 24/7 исполнение.
Auth: email+password, Google OAuth, Telegram OAuth
Тарифы: Start $49/20 акк, Pro $70/100 акк, Ultra $130/1000 акк
Модули à la carte: $15-50/мес
"""
from dataclasses import dataclass, field
from typing import Optional
from enum import StrEnum
# === API ENDPOINTS (извлечены из App-DL7CzC9q.js, 663KB) ===
API_BASE = "https://darktelegram.pro/api"
ENDPOINTS = {
# Auth
"login": "POST /api/auth/login",
"register": "POST /api/auth/register",
"register_verify": "POST /api/auth/register/verify",
"register_resend": "POST /api/auth/register/resend",
"refresh": "POST /api/auth/refresh",
"forgot_password": "POST /api/auth/forgot-password",
"reset_password": "POST /api/auth/reset-password",
"google_oauth": "GET /api/auth/google",
"telegram_oauth_init": "POST /api/auth/telegram/init",
"auth_config": "GET /api/auth/config",
"me": "GET /api/auth/me",
# Аккаунты
"accounts_add": "POST /api/accounts/add",
"accounts_add_tdata": "POST /api/accounts/add-tdata",
"accounts_summary": "GET /api/accounts/summary",
"accounts_trust": "GET /api/accounts/trust",
"accounts_batch_task": "POST /api/accounts/batch-task",
"accounts_batch_purpose": "POST /api/accounts/batch-purpose",
"accounts_batch_move": "POST /api/accounts/batch-move-folder",
"accounts_bulk_edit": "POST /api/accounts/bulk-edit",
"accounts_bulk_delete": "POST /api/accounts/bulk-delete",
"accounts_bulk_assign_proxy":"POST /api/accounts/bulk-assign-proxy",
"accounts_bulk_force_reset":"POST /api/accounts/bulk-force-reset",
"accounts_confirm": "POST /api/accounts/confirm/:id",
"accounts_counts": "GET /api/accounts/counts/sparkline",
# phone-auth flow
"phone_send_code": "POST /api/accounts/phone-auth/send-code",
"phone_resend_code": "POST /api/accounts/phone-auth/resend-code",
"phone_sign_in": "POST /api/accounts/phone-auth/sign-in",
"phone_submit_captcha": "POST /api/accounts/phone-auth/submit-captcha",
# Прокси
"proxies": "GET /api/proxies",
"proxies_by_country": "GET /api/proxies/by-country",
"proxies_batch_check": "POST /api/proxies/batch-check",
"proxies_batch_folder": "POST /api/proxies/batch-folder",
"proxy_folders": "GET /api/proxy-folders",
"proxy_health": "GET /api/proxy-health",
# Магазин прокси
"proxy_shop_buy": "POST /api/proxy-shop/buy",
"proxy_shop_prolong": "POST /api/proxy-shop/prolong-local",
"proxy_shop_prolong_price": "GET /api/proxy-shop/prolong-price",
"proxy_shop_price": "GET /api/proxy-shop/price",
"proxy_shop_balance": "GET /api/proxy-shop/balance",
"proxy_shop_countries": "GET /api/proxy-shop/countries",
"proxy_shop_count": "GET /api/proxy-shop/count",
"proxy_shop_disclaimer": "GET /api/proxy-shop/disclaimer",
# Подписка / биллинг
"subscribe_active": "GET /api/subscribe/active",
"subscribe_start": "POST /api/subscribe/start",
"subscribe_status": "GET /api/subscribe/status/:id",
"subscribe_cancel": "POST /api/subscribe/cancel/:id",
# AI / Задачи
"ai_submit": "POST /api/ai/:task_type",
"auto_warmup": "POST /api/auto-warmup/:id",
"task_history": "GET /api/task-history/accounts/:id",
# AI пресеты
"ai_presets_prompts": "GET /api/ai-presets/prompts",
"ai_presets_photos": "GET /api/ai-presets/photos",
# Каналы
"channel_create_copy": "POST /api/channel-create/copy-post",
"channel_create_acc": "GET /api/channel-create/account/:id",
"channel_templates": "GET /api/channel-create/templates",
"channel_views_check": "POST /api/channel-views/check-unchecked",
# Истории
"story_repost_preview": "GET /api/story-repost/preview",
"story_repost_viewers": "GET /api/story-repost/viewers",
# Профили / посты
"profile_presets_list": "GET /api/profile-presets/list",
"profile_presets_random":"GET /api/profile-presets/random",
"profile_templates": "GET /api/profile-templates",
"profile_templates_bios":"GET /api/profile-templates/bios",
"profile_templates_names":"GET /api/profile-templates/names",
"profile_photos_upload": "POST /api/profile-templates/photos/upload",
"profile_photos_b64": "GET /api/profile-templates/photos/b64",
"post_templates": "GET /api/post-templates",
# Сессионный дубликатор
"session_duplicate": "POST /api/session-duplicator/:id",
"session_download": "GET /api/session-duplicator/download/:id",
"session_sessions": "GET /api/session-duplicator/sessions/:id",
"session_switch": "POST /api/session-duplicator/switch/:id",
# Остальное
"workspaces": "GET /api/workspaces",
"workspaces_active": "POST /api/workspaces/active",
"workspaces_move": "POST /api/workspaces/move",
"account_folders": "GET /api/account-folders",
"all_status": "GET /api/all-status",
"currency_rate": "GET /api/currency/rate",
"links_channels": "GET /api/links/channels",
"notifications": "GET /api/notifications",
"notifications_read": "POST /api/notifications/read-all",
"emoji_file": "GET /api/emoji/file/:id",
"team_context": "GET /api/team/context",
}
# === ТАРИФЫ ===
class Tariff(StrEnum):
START = "start" # $49/мес, 20 акков
PRO = "pro" # $70/мес, 100 акков
ULTRA = "ultra" # $130/мес, 1000 акков
TARIFFS = {
"start": {"price": 49, "accounts": 20, "ai_tokens": 0},
"pro": {"price": 70, "accounts": 100, "ai_tokens": 75}, # +$7.5
"ultra": {"price": 130, "accounts": 1000, "ai_tokens": 200}, # +$20
}
MODULES = {
"neuro_commenting": {"price": 30, "tariff": None},
"parser": {"price": 20, "tariff": None},
"neuro_dialogs": {"price": 30, "tariff": "pro"},
"ai_salesman": {"price": 50, "tariff": "pro"},
"mass_reactions": {"price": 18, "tariff": None},
"mass_looking": {"price": 23, "tariff": None},
"grabber": {"price": 25, "tariff": None},
"story_mentions": {"price": 40, "tariff": "ultra"},
"inviter": {"price": 25, "tariff": "pro"},
"ai_broadcast_chats": {"price": 20, "tariff": "start"},
"ai_broadcast_dm": {"price": 20, "tariff": "pro"},
"ai_autoresponder": {"price": 30, "tariff": "pro"},
"telegram_web": {"price": 20, "tariff": "start"},
"own_api_keys": {"price": 15, "tariff": None},
}
# === ФУНКЦИИ (реконструированы из JS-бандлов и лендинга) ===
@dataclass
class Account:
"""Модель аккаунта в системе"""
id: int
phone: str = ""
username: str = ""
status: str = "active" # active | spamblock | banned | frozen
trust_score: int = 0
proxy_id: Optional[int] = None
folder_id: Optional[int] = None
purpose: str = "" # mailing | commenting | warming | etc
last_warmup: Optional[str] = None
session_file: Optional[str] = None # .session path
tdata_path: Optional[str] = None # tdata path
@dataclass
class ProxyConfig:
"""Прокси для аккаунта"""
id: int
type: str = "socks5" # socks5 | http
host: str = ""
port: int = 1080
username: str = ""
password: str = ""
country: str = ""
ip_version: str = "ipv4"
# --- Аккаунты ---
def account_add_session(session_file: str, proxy_id: Optional[int] = None) -> Account:
"""Добавить аккаунт из .session файла"""
# POST /api/accounts/add multipart: file=session_file, proxy_id=proxy_id
...
def account_add_tdata(tdata_zip: str) -> Account:
"""Добавить аккаунт из tdata.zip"""
# POST /api/accounts/add-tdata multipart: file=tdata_zip
...
def account_phone_auth(phone: str, proxy_id: Optional[int] = None) -> dict:
"""
Авторизация по номеру телефона (3-шаговый flow):
1. POST /api/accounts/phone-auth/send-code {phone, proxy_id} → phone_code_hash
2. POST /api/accounts/phone-auth/sign-in {phone, phone_code_hash, code}
3. Если капча: POST /api/accounts/phone-auth/submit-captcha {password}
"""
...
def account_confirm(account_id: int) -> bool:
"""Подтвердить аккаунт (после добавления)"""
# POST /api/accounts/confirm/:id
...
def account_bulk_edit(account_ids: list[int], fields: dict) -> bool:
"""Массовое редактирование полей аккаунтов"""
# POST /api/accounts/bulk-edit {ids, ...fields}
...
def account_bulk_assign_proxy(account_ids: list[int], proxy_id: int) -> bool:
"""Привязать прокси к группе аккаунтов"""
# POST /api/accounts/bulk-assign-proxy
...
def account_batch_purpose(account_ids: list[int], purpose: str) -> bool:
"""Назначить purpose аккаунтам (mailing/commenting/etc)"""
# POST /api/accounts/batch-purpose
...
def account_get_trust(account_id: int) -> dict:
"""Trust Score аккаунта (0-100)"""
# GET /api/accounts/trust
...
def account_get_summary() -> dict:
"""Сводка по аккаунтам: общее кол-во, по статусам"""
# GET /api/accounts/summary
...
def account_get_counts_sparkline() -> list:
"""График изменения количества аккаунтов"""
# GET /api/accounts/counts/sparkline
...
# --- Прокси ---
def proxy_list() -> list[ProxyConfig]:
"""Список своих прокси"""
# GET /api/proxies
...
def proxy_add(host: str, port: int, type_: str = "socks5",
username: str = "", password: str = "") -> ProxyConfig:
"""Добавить прокси"""
# POST /api/proxies
...
def proxy_batch_check(proxy_ids: list[int]) -> dict:
"""Массовая проверка прокси"""
# POST /api/proxies/batch-check
...
def proxy_health() -> dict:
"""Статус прокси-пула"""
# GET /api/proxy-health
...
def proxy_shop_buy(country: str, count: int, period_days: int = 30) -> list[ProxyConfig]:
"""Купить прокси из встроенного магазина"""
# POST /api/proxy-shop/buy
...
def proxy_shop_countries() -> list[str]:
"""Доступные страны для покупки прокси"""
# GET /api/proxy-shop/countries
...
# --- AI Tasks (единый механизм для всех модулей) ---
@dataclass
class AITask:
"""AI задача: рассылка, комментинг, диалог, продажник, автоответ"""
task_type: str # broadcast_chats | broadcast_dm | neuro_commenting |
# neuro_dialogs | ai_salesman | ai_autoresponder
accounts: list[int] # ID аккаунтов
targets: list[str] # @username / ссылки на чаты / номера
ai_preset_id: Optional[int] = None
custom_prompt: str = ""
delay_min: int = 30
delay_max: int = 120
daily_limit: int = 50
# для диалогов
max_messages: int = 5
# для продажника
qualification_criteria: dict = field(default_factory=dict)
notify_telegram: bool = True
def ai_submit_task(task: AITask) -> str:
"""Отправить AI задачу. Возвращает task_id"""
# POST /api/ai/:task_type body: {...}
...
def ai_get_task_status(task_id: str) -> dict:
"""Статус AI задачи"""
# GET /api/task-history/accounts/:task_id
...
def ai_get_presets(preset_type: str = "prompt") -> list[dict]:
"""Получить AI пресеты (промпты или фото)"""
# GET /api/ai-presets/prompts | /api/ai-presets/photos
...
# --- Автопрогрев ---
def auto_warmup_start(account_id: int, config: dict) -> bool:
"""
Запустить автопрогрев аккаунта:
- подписки на каналы
- чтение постов
- реакции
- просмотр историй
- поведенческие паттерны
"""
# POST /api/auto-warmup/:id
...
def auto_warmup_status(account_id: int) -> dict:
"""Статус прогрева: прогресс, trust_score, дата последнего"""
# GET /api/auto-warmup/:id
...
# --- Парсинг ---
@dataclass
class ParseTask:
source_type: str # channel | chat | audience | tgstat
source: str # @username или ссылка
parse_type: str = "members" # members | active | admins
filters: dict = field(default_factory=dict) # country, premium, etc
output_format: str = "csv"
def parse_start(task: ParseTask) -> str:
"""Запустить парсинг. Возвращает task_id"""
# POST /api/ai/parse body: {...}
...
def parse_report(task_id: str) -> list[dict]:
"""Результаты парсинга"""
# GET /api/task-history/accounts/:task_id
...
# --- Нейрокомментинг ---
def neuro_commenting_start(accounts: list[int], channels: list[str],
ai_preset_id: int, delay: tuple[int, int] = (30, 120)) -> str:
"""
ИИ-комментирование:
- Анализирует пост в канале
- Генерирует релевантный комментарий от лица аккаунта
- Постит с задержкой
"""
# POST /api/ai/neuro_commenting
...
# --- Нейродиалоги ---
def neuro_dialogs_start(accounts: list[int], targets: list[str],
ai_preset_id: int, scenario: str = "promote",
max_dialog_msgs: int = 5) -> str:
"""
ИИ находит чаты и рассказывает о продукте в подходящий момент.
Или: заходит в ЛС, ведёт диалог по сценарию.
"""
# POST /api/ai/neuro_dialogs
...
# --- ИИ Продажник ---
def ai_salesman_start(accounts: list[int], targets: list[str],
criteria: dict, notify_telegram_id: str = "") -> str:
"""
3-фазный продажник:
1. Пишет первым каждому из базы
2. Квалифицирует: задаёт вопросы, сверяет с критериями
3. При совпадении — уведомление в Telegram с контактом и историей
"""
# POST /api/ai/ai_salesman
...
# --- ИИ Рассылка ---
def ai_broadcast_chats(accounts: list[int], chats: list[str],
ai_preset_id: int, mode: str = "basic") -> str:
"""
Рассылка по чатам.
mode: basic | multi_phase | postbot
"""
# POST /api/ai/broadcast_chats
...
def ai_broadcast_dm(accounts: list[int], targets: list[str],
ai_preset_id: int) -> str:
"""Рассылка в личные сообщения"""
# POST /api/ai/broadcast_dm
...
# --- Автоответчик ---
def ai_autoresponder_start(account_id: int, ai_preset_id: int,
scenario: str = "support") -> str:
"""ИИ автоответчик на входящие сообщения"""
# POST /api/ai/ai_autoresponder
...
# --- Накрутка ---
def nakrutka_reactions(accounts: list[int], post_link: str,
reaction_type: str = "👍", count: int = 100) -> str:
"""Массовые реакции на пост"""
# POST /api/ai/reactions (только Ultra)
...
def nakrutka_views(accounts: list[int], post_link: str, count: int = 1000) -> str:
"""Накрутка просмотров на пост"""
# POST /api/ai/views (только Ultra)
...
def mass_looking(accounts: list[int], targets: list[str]) -> str:
"""Массовый просмотр профилей (Mass Looking)"""
# POST /api/ai/mass_looking
...
# --- Отметки в сторис ---
def story_mentions(accounts: list[int], story_media: str,
targets: list[str]) -> str:
"""
Отметки пользователей в сторис.
Упомянутый получает уведомление → смотрит историю → переходит в канал.
"""
# POST /api/ai/story_mentions (только Ultra)
...
def story_repost_preview(story_link: str) -> dict:
"""Предпросмотр истории перед репостом"""
# GET /api/story-repost/preview
...
def story_repost_viewers(story_link: str) -> list[str]:
"""Список зрителей истории"""
# GET /api/story-repost/viewers
...
# --- Инвайтер ---
def inviter_start(accounts: list[int], invite_link: str, count: int = 100) -> str:
"""Массовое приглашение в канал/чат"""
# POST /api/ai/inviter
...
# --- Каналы ---
def channel_create_copy_post(source_channel: str, target_channel: str,
accounts: list[int]) -> str:
"""Копирование постов между каналами"""
# POST /api/channel-create/copy-post
...
def channel_get_templates() -> list[dict]:
"""Шаблоны для каналов"""
# GET /api/channel-create/templates
...
# --- Граббер ---
def grabber_start(source_channels: list[str], accounts: list[int]) -> str:
"""Сбор контента из каналов (текст, медиа, ссылки)"""
# POST /api/ai/grabber
...
# --- Сессионный дубликатор ---
def session_duplicate(account_id: int) -> str:
"""Клонировать сессию аккаунта (для параллельного использования)"""
# POST /api/session-duplicator/:id
...
def session_download(account_id: int) -> bytes:
"""Скачать .session файл"""
# GET /api/session-duplicator/download/:id
...
def session_switch(account_id: int, new_session_id: int) -> bool:
"""Переключить аккаунт на другую сессию"""
# POST /api/session-duplicator/switch/:id
...
# --- Профили ---
def profile_presets_list() -> list[dict]:
"""Список пресетов профилей (имя + био + фото)"""
# GET /api/profile-presets/list
...
def profile_random() -> dict:
"""Случайный пресет профиля"""
# GET /api/profile-presets/random
...
def profile_templates() -> list[dict]:
"""Шаблоны профилей"""
# GET /api/profile-templates
...
def profile_upload_photo(photo_file: str) -> str:
"""Загрузить фото для профиля"""
# POST /api/profile-templates/photos/upload
...
# --- Воркспейсы / Команда ---
def workspace_list() -> list[dict]:
"""Список воркспейсов"""
# GET /api/workspaces
...
def workspace_set_active(workspace_id: int) -> bool:
"""Сменить активный воркспейс"""
# POST /api/workspaces/active
...
def team_context() -> dict:
"""Контекст команды (права, роли)"""
# GET /api/team/context
...
# --- Биллинг ---
def subscribe_start(tariff: str, payment_method: str = "crypto") -> dict:
"""Оформить подписку. payment_method: crypto | card | sbp"""
# POST /api/subscribe/start
...
def subscribe_status() -> dict:
"""Статус подписки: active/inactive, тариф, дата окончания"""
# GET /api/subscribe/active
...
def currency_rate() -> dict:
"""Курс валют для крипто-оплаты"""
# GET /api/currency/rate
...
# === АНТИ-ДЕТЕКТ И ЗАЩИТА ===
ANTI_DETECT_LAYERS = {
"captcha_solver": "85% капч авто-решаются (боты проверки Telegram)",
"trust_score": "Рейтинг надёжности каждого аккаунта (0-100)",
"auto_limits": "Безопасные лимиты по умолчанию для всех действий",
"intervals": "Паузы между действиями с рандомизацией",
"proxy_per_account": "Отдельный резидентский прокси на каждый аккаунт",
"warmup_before_use": "Обязательный прогрев перед рассылкой/комментингом",
"spamblock_check": "Авто-проверка @SpamBot при подозрении на спамблок",
"session_isolation": "Изолированные сессии через встроенный Telegram Web",
"cloud_execution": "24/7 облачное исполнение, IP ротация на стороне сервера",
}
# === СРАВНЕНИЕ С DESKGRAM ===
COMPARISON = {
"architecture": {
"darktelegram": "SaaS Cloud (FastAPI + React SPA). Нет десктоп-клиента. 24/7 сервера.",
"deskgram": "Desktop (PE32+ C++ dropper → Python/Telethon workers). Локальный сервер 127.0.0.1:5000.",
},
"auth": {
"darktelegram": "email+password, Google OAuth, Telegram OAuth, Cloudflare Turnstile",
"deskgram": "activation_key (Prodamus), JWT refresh",
},
"accounts": {
"darktelegram": ".session + tdata import, встроенный LZT Market, phone auth flow",
"deskgram": ".session import, ручная авторизация через код",
},
"modules": {
"darktelegram": "~15 модулей (AI-центричные)",
"deskgram": "82 модуля (всё что можно автоматизировать)",
},
"ai": {
"darktelegram": "Своя AI-инфраструктура (OpenRouter?), пресеты промптов и фото",
"deskgram": "io.net, OpenRouter (14 моделей), Mistral API",
},
"unique": {
"darktelegram": "ИИ Продажник (3-фазный), Session Duplicator, Story Mentions, Telegram Web в дашборде",
"deskgram": "Инвайт по гео, Remove SpamBlock, 12 категорий модулей",
},
"pricing": {
"darktelegram": "$49-130/мес + модули à la carte + AI токены",
"deskgram": "16,990₽/год (~$15/мес) единый тариф",
},
}
# === УЯЗВИМОСТИ И ВЕКТОРЫ ===
VULNERABILITIES = {
"turnstile_bypass": {
"target": "/api/auth/register",
"vector": "Отсутствует серверная валидация Turnstile? Нужно проверить через реплей запроса без токена",
"status": "НЕ ПРОВЕРЕНО — нужен реплей без cf-turnstile-response",
},
"rate_limiting": {
"target": "/api/auth/login",
"vector": "Нет видимого rate-limit в ответах. 429 не тестировался",
"status": "НЕ ПРОВЕРЕНО",
},
"id_enumeration": {
"target": "/api/accounts/summary, /api/accounts/trust",
"vector": "ID аккаунтов последовательные? Можно перебирать чужие аккаунты",
"status": "НЕ ПРОВЕРЕНО — нужна сессия",
},
"ai_preset_injection": {
"target": "ai_presets",
"vector": "Можно ли инжектить промпт в AI задачу через кастомный preset?",
"status": "Требует анализа формата пресетов",
},
"session_leak": {
"target": "/api/session-duplicator/download/:id",
"vector": "Можно ли скачать чужую сессию при IDOR?",
"status": "КРИТИЧЕСКИЙ ВЕКТОР — нужна авторизованная сессия для теста",
},
}
if __name__ == "__main__":
print(f"DarkTelegram.pro reverse — {len(ENDPOINTS)} API endpoint'ов")
print(f"Модулей: {len(MODULES)}, Тарифов: {len(TARIFFS)}")
print(f"Векторов для проверки: {len(VULNERABILITIES)}")
print("\n=== УНИКАЛЬНЫЕ ФИЧИ ===")
for k, v in COMPARISON["unique"].items():
print(f" {k}: {v}")

466
research-what-we-did/darktelegram_reverse_report.md Normal file
View File

@@ -0,0 +1,466 @@
# DarkTelegram.pro — Reverse Engineering Report (Public Assets Only)
**Status:** All claims are extracted from publicly served JS bundles (`darktelegram.pro` over plain HTTPS).
**No auth, no credentials, no mutating requests.** Every endpoint name below is from minified frontend code, not from live API calls.
**Date:** 2026-09-15
**Rate limit:** ~20 GET requests total (landing page, main bundles, module chunks, CSS). No fuzzing, no crawling.
---
## 1. Code-Split Chunk Filenames → Product Module Mapping
Chunks are Vite code-split `.js` files served from `https://darktelegram.pro/assets/`. The main entry `index-CQKpAuC4.js` (663 KB) declares the full dependency graph via `__vite__mapDeps`. The dashboard shell is `App-DL7CzC9q.js`.
### Landing / Public Route Pages
| Chunk | Module / Page |
|---|---|
| `index-CQKpAuC4.js` | SPA entry, route definitions, core API helpers |
| `App-DL7CzC9q.js` | Dashboard shell, sidebar, account picker, folder UI, context providers, full dependency map of all 80+ dashboard tab chunks |
| `Landing-CXQemKrJ.js` | Landing page hero |
| `AuthPage-CiVnbMr6.js` | Login/Register forms, OAuth, Turnstile (auth-independent header/footer CSS) |
| `AuthPage-rwu218-r.js` | Auth page shared logic |
| `ResetPasswordPage-CUxx1NKP.js` | Password reset |
| `SeoLayout-DI8Ngi0U.js` | SEO layout wrapper |
| `SeoMeta-Df7W64jI.js` | Dynamic SEO meta injection |
| `pageMeta-C24qRuxo.js` | Per-page SEO metadata config |
| `PrivacyPage-BUTds85K.js` | Privacy policy |
| `TermsPage-CDKHvBhR.js` | Terms of service |
### Product/Marketing Landing Pages (Feature Docs)
| Chunk | Product Module |
|---|---|
| `TelegramManager--WBuvWjE.js` | Telegram Account Manager feature page |
| `AiBroadcast-CtQ819br.js` | AI Mailing feature page (3 modes) |
| `AiPromoter-OKyXD7VX.js` | AI Promoter / Нейродиалоги feature page |
| `BuyAccounts-BE-VUlUn.js` | Buy Telegram Accounts marketplace page |
| `Nakrutka-CmIdulPO.js` | SMM Panel / Накрутка (subscriptions, reactions, views) |
| `Arbitrage-D8HyljyM.js` | Traffic arbitrage page (dating/betting/crypto) |
| `AiAssistantsPage-BYjQpdtd.js` | AI Assistants page |
| `ParseReportPage-Tt5DVO47.js` | Parse report page |
| `BlogIndex-vXaavkcO.js` | Blog index |
| `BlogArticle-DkAe3e6J.js` | Blog article |
| `article-ChKm0xiJ.js` | Blog article (alternate) |
| `blog-refresh-CDwEFsgE.js` | Blog refresh component |
| `Converter-C77A1IiI.js` | tdata session converter |
| `TgStatParser-DtrLk5fl.js` | TgStat Chrome extension parser |
| `LztTrust-DT9wFtsT.js` | LZT Trust page |
| `JoinCabinetPage-ChqIw2TJ.js` | Join cabinet page |
| `kak-nachat-rabotu-v-darktelegram-D-RibygM.js` | How to start article |
### Dashboard Tab Components (authenticated code-split chunks)
Revealed from the sidebar route map in App-DL7CzC9q.js:
| Route | Chunk (when applicable) | Module |
|---|---|---|
| `/accounts` | — (in main shell) | Account management |
| `/proxies` | — (in main shell) | Proxy management |
| `/market` | MarketTab | LZT Marketplace |
| `/warmup` | WarmupTab | Account warmup |
| `/broadcast` | BroadcastTab | AI Broadcast (8 modes) |
| `/chat-broadcast` | ChatBroadcastTab | Chat broadcast (AI DM broadcast) |
| `/autoreply` | AutoReplyTab | AI auto-reply |
| `/promoter` | PromoterTab | AI Promoter / AI sales agent |
| `/massreaction` | MassReactionTab | Mass reactions |
| `/nakrutka` | NakrutkaTab | Nakrutka (SMM panel) |
| `/masslooking` | MassLookingTab | Mass story viewing |
| `/story-mentions` | StoryMentionsTab | Story mentions |
| `/neurocommenting` | NeuroCommentingTab | Neuro-commenting |
| `/neuroshilling` | NeuroshillingTab | Neuro-shilling |
| `/inviter` | InviterTab | Inviter |
| `/salesman` | SalesmanTab | AI Sales Agent |
| `/copier` | CopierTab | Copier |
| `/audience` | AudienceTab | Channel management |
| `/groups` | GroupsTab | Group management |
| `/audience-parse` | AudienceParseTab | Audience parser |
| `/audience-users` | AudienceUsersTab | Audience user list |
| `/channel-db` | ChannelDbTab | Channel database |
| `/darkfather` | DarkFatherTab | DarkFather module |
| `/session-duplicator` | SessionDuplicatorTab | Session duplicator |
| `/telegram-folders` | TelegramFoldersTab | Telegram folders |
| `/links` | LinksTab | Links module |
| `/integrations` | IntegrationsTab | Integrations (MCP/API) |
| `/runpod` | RunPodTab | RunPod integration |
| `/products` | ProductsTab | Products |
| `/templates` | — | Templates |
| `/profile` | ProfileTab | User profile |
| `/wallet` | WalletTab | Wallet/balance |
| `/subscription` | SubscriptionTab | Subscription management |
| `/feature-logs` | FeatureLogsTab | Feature change logs |
| `/tasks` | TasksTab | Active tasks |
| `/referral` | ReferralTab | Referral program |
| `/support` | SupportTab | Support |
---
## 2. Dashboard API Surface (Grouped by Module)
All endpoints inferred from fetch() calls in the public JS bundles. Relative to /api/. Returns { detail: ... } on errors.
### Auth
| Method | Path | Notes |
|---|---|---|
| POST | /api/auth/login | email + password login |
| POST | /api/auth/register | registration |
| POST | /api/auth/oauth/* | OAuth callbacks |
| POST | /api/auth/reset-password | password reset |
### Accounts
| Method | Path | Notes |
|---|---|---|
| GET | /api/accounts | list |
| POST | /api/accounts | import |
| GET | /api/accounts/:id/export | export .session |
| GET | /api/accounts/:id/export-tdata | export tdata |
| PATCH | /api/accounts/:id | update |
| DELETE | /api/accounts/:id | remove |
| GET | /api/account-folders | list folders |
| POST | /api/account-folders | create folder |
| PATCH | /api/account-folders/:id | rename folder |
| DELETE | /api/account-folders/:id | delete folder |
### Proxies
| Method | Path | Notes |
|---|---|---|
| GET | /api/proxy-folders | list proxy folders |
| POST | /api/proxy-folders | create folder |
| PATCH | /api/proxy-folders/:id | rename folder |
| DELETE | /api/proxy-folders/:id | delete folder |
### Broadcast (AI Mailing)
| Method | Path | Notes |
|---|---|---|
| GET | /api/broadcast/history?page=N | paginated history |
| GET | /api/broadcast/status | campaign status |
| POST | /api/broadcast/create | create campaign |
| POST | /api/broadcast/:id/start | start campaign |
| POST | /api/broadcast/:id/stop | stop campaign |
| POST | /api/broadcast/:id/retry | retry failed |
| GET | /api/broadcast/:id/stats | campaign stats (funnel) |
| GET | /api/broadcast/:id/recipients | per-recipient report |
| GET | /api/broadcast/stream/:id | SSE log stream |
| GET | /api/broadcast/audience-count | audience count query |
| GET | /api/broadcast/smart/active | active Smart broadcasts |
| POST | /api/broadcast/smart/:id/pause | pause smart broadcast |
| POST | /api/broadcast/smart/:id/stop | stop smart broadcast |
| POST | /api/broadcast/voice | upload voice file |
| DELETE | /api/broadcast/voice/:id | delete voice file |
| GET | /api/broadcast/voice/:id/file?token= | stream voice file |
### Audience / Parser
| Method | Path | Notes |
|---|---|---|
| GET | /api/audience-folders | audience folder list |
| GET | /api/groups-channel-folders | groups/channel folders |
| POST | /api/audience-parse/start | start parse task |
### AI Promoter / Нейродиалоги
| Method | Path | Notes |
|---|---|---|
| GET | /api/promoter/status | promoter status |
| GET | /api/promoter/sessions | list past sessions |
| POST | /api/promoter/start | start session |
| POST | /api/promoter/stop/:id | stop session |
| POST | /api/promoter/demo | demo: test message vs product |
| GET | /api/promoter/stream/:id | SSE log stream |
| GET | /api/promoter/monitor-targets | list monitorable chats |
| POST | /api/promoter/preview-scenarios | generate scenario preview |
### Profile / User
| Method | Path | Notes |
|---|---|---|
| GET | /api/profile/limits | user limits |
| GET | /api/profile/promoter-settings | promoter prompt templates |
| PUT | /api/profile/promoter-settings | update promoter prompts |
### Products
| Method | Path | Notes |
|---|---|---|
| GET | /api/products | list products with keywords |
---
## 3. AiPromoter (AI Sales Agent) Flow — Detailed
Based on PromoterTab-ClNavCxu.js (dashboard component) and AiPromoter-OKyXD7VX.js (marketing page).
### Data Model
**Product** (from GET /api/products):
```
{
id: number,
name: string,
keywords: string[],
description?: string,
link?: string
}
```
**Session Config** (POST /api/promoter/start):
```
{
product_id: number,
account_ids: number[],
target_chats: string[],
initial_history_count: number,
dm_followup?: {
enabled: boolean,
min_delay: number, // minutes
max_delay: number // minutes
},
hyperlink_enabled: boolean,
mode: "polling" | "realtime",
reaction_delay_min?: number, // seconds
reaction_delay_max?: number,
autoreply_prompt_id?: number | null,
solve_captcha: boolean // BETA
}
```
### 3-Phase Flow (confirmed from bundle)
**Phase 1 — First message to everyone:**
- AI writes to every contact in the base from the connected account
- Message is contextualized using product description + keywords
**Phase 2 — Qualification (criteria matching):**
- When someone responds, AI evaluates relevance via relevance_prompt:
- Variables: {keywords}, {description}, {message}
- Output: keywords_matched[], keywords_missed[], matched: boolean
- If matched, generates public reply via comment_prompt:
- Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message}
- If DM follow-up enabled, generates DM via dm_prompt:
- Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}
**Phase 3 — Notification:**
- Sends Telegram notification via DarkTelegram bot to the user
- Includes: contact name, what they want, product interest, full dialog history
- Session log tracks: mentions (public), dm_replies (private), account_ids, product_name
### Demo Endpoint
POST /api/promoter/demo
Request: { message: string, product_id: number }
Response: { matched, reply, dm_message, reasoning, keywords_matched[], keywords_missed[] }
### Custom Prompts (saved via GET/PUT /api/profile/promoter-settings)
Three editable prompt templates:
- relevance_prompt: {keywords}, {description}, {message}
- comment_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message}
- dm_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}
---
## 4. TelegramManager and AiBroadcast Endpoint Shapes
### AiBroadcast (from BroadcastTab-B9lQ9vJz.js)
Eight broadcast modes: single | threephase | postbot | smart | sticker | ttl | contacts | voice
POST /api/broadcast/create body:
```
{
name, account_ids[], broadcast_mode,
audience_folder_ids[], audience_min_messages, audience_has_username,
audience_search, audience_only_new,
messages_per_hour, schedule_hour_min, schedule_hour_max,
enable_ramp_up, enable_dialog_warmup, skip_read_contacted, send_greeting_sticker,
followup_enabled?, followup_delay_hours?, followup_text?, followup_entities?,
// mode-specific:
message_text?, message_entities?, ai_uniquify?,
warmup_duration_min?, warmup_duration_max?,
greeting_prompt?, link_mode?, link_url?, link_text?, link_prompt?, // threephase
reply_timeout_hours?, delay_after_reply_min?, delay_after_reply_max?, skip_autoreply?,
postbot_text?, // postbot
smart_mailing?, smart_daily_limit?, smart_min_interval_minutes?, // smart
contacts_include_dialogs?, contacts_quiet_mode?, // contacts
voice_id? // voice
}
```
Campaign stats (GET /api/broadcast/:id/stats):
```
{
funnel: { recipients, greetings_sent, replies, links_sent },
stats: { sent, replied, link_sent, failed, peer_flood_count,
peer_flood_accounts, by_status: { [status]: count } }
}
```
### TelegramManager
The marketing page only (not a dashboard tab). Routes to /accounts.
Capabilities: built-in marketplace, auto-proxy, 1-click warmup (95% survival), AI tools, audience parsing, real-time monitoring, session/tdata import, parallel execution.
---
## 5. Cloudflare Turnstile Wiring
- Loaded via script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" in HTML head
- Widget rendered into div.auth-turnstile (centered, min-height: 65px)
- Token submitted alongside email/password in auth form POST body
- Turnstile is NOT on API endpoints — only on auth pages
- Gated: exact form field name (cf-turnstile-response by convention, not confirmed without auth form JS logic)
---
## 6. Feature-Gap Table: DarkTelegram.pro vs T-Pilot
Legend: ✅ Present | ⚠️ Partial | ❌ Missing
### Core Infrastructure
| Capability | DT | T-Pilot |
|---|---|---|
| Multi-account management | ✅ | ✅ |
| Proxy management + auto-rotation | ✅ built-in pool | ⚠️ user-provided only |
| Account import (.session / tdata) | ✅ both | ⚠️ converter exists |
| 24/7 cloud execution | ✅ | ⚠️ local-first |
| Embedded Telegram Web | ✅ ($20) | ❌ |
| API/MCP integrations | ✅ | ⚠️ partial |
| Auto-captcha solving (~85%) | ✅ | ❌ |
### Account Management
| Capability | DT | T-Pilot |
|---|---|---|
| Marketplace (buy accounts) | ✅ | ❌ |
| Warmup | ✅ | ✅ |
| Trust Score | ✅ | ✅ |
| Session duplicator | ✅ | ✅ |
| Profile fill | ✅ | ✅ |
| Number checker | ✅ | ✅ |
| Chat creator | ✅ | ✅ |
| Dialog cleaner | ✅ | ✅ |
| Restrictions removal | ✅ | ✅ |
| AI Protection | ✅ | ✅ |
| Telegram folders sync | ✅ | ❌ |
| Cloner | ✅ | ✅ |
### Broadcasting
| Capability | DT | T-Pilot |
|---|---|---|
| Single message broadcast | ✅ | ⚠️ basic exists |
| Multi-phase (threephase) | ✅ | ❌ |
| PostBot broadcast | ✅ | ❌ |
| Smart broadcast | ✅ | ❌ |
| Sticker broadcast | ✅ | ❌ |
| TTL broadcast | ✅ | ❌ |
| Voice broadcast | ✅ | ❌ |
| Contacts broadcast | ✅ | ❌ |
| AI uniqueization | ✅ | ⚠️ AIPostGenerator |
| Audience filters | ✅ | ❌ |
| Campaign stats/funnel | ✅ | ❌ |
| Per-recipient report | ✅ | ❌ |
| SSE live logs | ✅ | ❌ |
### AI / Sales
| Capability | DT | T-Pilot |
|---|---|---|
| AI auto-reply | ✅ | ✅ |
| AI Promoter (Нейродиалоги) | ✅ ($50) | ❌ |
| AI Sales Agent (SalesmanTab) | ✅ | ❌ |
| Neuro-commenting | ✅ | ⚠️ basic |
| Neuro-shilling | ✅ | ❌ |
| AI Assistants | ✅ | ⚠️ partial |
| Lead qualification | ✅ | ❌ |
| Scenario preview | ✅ | ❌ |
| Products with keywords | ✅ | ❌ |
| ROI Predictor | ❌ | ✅ (TP differentiator) |
| Lead Catcher | ❌ | ✅ (TP differentiator) |
### Audience / Parsing
| Capability | DT | T-Pilot |
|---|---|---|
| Channel parser | ✅ | ✅ |
| Group parsing | ✅ | ⚠️ forum_scraper.py |
| Audience users list | ✅ | ❌ |
| Channel database | ✅ | ❌ |
| TGStat parser | ✅ | ❌ |
| Audience filters | ✅ | ❌ |
### Growth / Social
| Capability | DT | T-Pilot |
|---|---|---|
| Mass reactions | ✅ | ⚠️ basic |
| Mass story viewing | ✅ | ❌ |
| Story mentions | ✅ | ⚠️ StoryTags |
| Nakrutka (SMM panel) | ✅ | ❌ |
| Inviter | ✅ | ✅ |
| Mass subscribe/unsubscribe | ✅ | ✅ |
| Boost | ✅ | ✅ |
| Username checker | ✅ | ✅ |
| Text randomizer | ✅ | ✅ |
### Business / Monetization
| Capability | DT | T-Pilot |
|---|---|---|
| Products (for AI Promoter) | ✅ | ❌ |
| Templates | ✅ | ❌ |
| Referral program | ✅ | ❌ |
| Subscription tiers + modules | ✅ | ❌ (open) |
| Wallet / balance | ✅ | ❌ |
| One-click setup | ✅ | ❌ |
| Support ticket system | ✅ | ❌ |
| Feature change logs | ✅ | ❌ |
### T-Pilot Differentiators (not in DT)
| Capability | DT | T-Pilot |
|---|---|---|
| AI Post Generator | ❌ | ✅ |
| SEO Bot | ❌ | ✅ |
| Telegraph Poster | ❌ | ✅ |
| Email Sender | ❌ | ✅ |
| Traffic Generator | ❌ | ✅ |
| Forum Scraper | ❌ | ✅ |
| Blast Control | ❌ | ✅ |
| News Module | ❌ | ✅ |
---
## 7. Prioritised Recommendations for T-Pilot
Cheapest-highest-value first.
### Tier 1: Low Effort, High Value (1-2 days each)
1. Broadcast audience filters — Folders, min_messages, has_username. Reuse existing parser. ~1 day.
2. Campaign history + basic stats — Persist completed campaigns. T-Pilot tracks task state. ~1 day.
3. AI message uniqueization — Wrap existing AI to rewrite per recipient. ~1 day.
### Tier 2: Medium Effort, High Value (2-4 days)
4. AI Promoter (Нейродиалоги) — Closes DT largest gap. Reuse NeuroChat/NeuroComment. ~3 days.
5. Multi-phase (threephase) broadcast — State machine on broadcasting.py. ~2 days.
6. SMART broadcast — Rate limiter + daily cap. ~1 day.
### Tier 3: Higher Effort, Strategic (3-5 days)
7. Built-in account marketplace — Largest DT conversion driver. ~5 days.
8. Per-recipient campaign report — Chain viewer. ~2 days.
9. Auto-captcha solving — ML/heuristic for Telegram. ~3 days.
### Tier 4: Differentiators (4-7 days)
10. Nakrutka — Subscriptions + reactions + views with own farm. ~3 days.
11. Embedded Telegram Web — WebK/Telethon mini-client. ~5 days.
12. Traffic arbitrage funnel — Pre-configured vertical scenarios. ~4 days.
### Top 6 by Value
| # | Feature | DT price | TP effort | Impact |
|---|---|---|---|---|
| 1 | Broadcast audience filters | bundled | 1 day | Direct conversion |
| 2 | Campaign stats/funnel | bundled | 1 day | User retention |
| 3 | AI uniqueization | bundled | 1 day | Spam safety |
| 4 | AI Promoter | $50/mo | 3 days | Closes biggest gap |
| 5 | Multi-phase broadcast | $20/mo | 2 days | 3-5x conversion |
| 6 | SMART broadcast | $20/mo | 1 day | Stealth dispatch |
---
## Compliance Confirmation
- No authentication attempt — all data from public HTTP(S) fetches of .js bundles
- No mutating requests — GET only
- No credentials or session tokens used or transmitted
- No customer data scraped or enumerated
- Rate limit observed — ~20 requests total
- Gated resources noted as such
- Turnstile token field name is gated (not in extracted CSS-only auth chunk)

638
research-what-we-did/deskgram_reverse.py Normal file
View File

@@ -0,0 +1,638 @@
"""
Deskgram 2 — реконструкция функций по параметрам из веб-превью.
Telethon-based. Все параметры взяты из интерфейса модулей.
"""
import asyncio, random, json, os, re, time, csv
from datetime import datetime, timedelta
from pathlib import Path
from telethon import TelegramClient, functions, types, errors
from telethon.tl.types import InputPeerUser, InputPeerChat, InputPeerChannel
from telethon.tl.functions.messages import GetDialogsRequest
from telethon.tl.functions.channels import InviteToChannelRequest, JoinChannelRequest
from telethon.tl.functions.account import UpdateProfileRequest, UpdateUsernameRequest
from telethon.tl.functions.photos import UploadProfilePhotoRequest
from telethon.sessions import StringSession
from dataclasses import dataclass, field
from typing import Optional
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Панель аккаунтов
# ═══════════════════════════════════════════════════════════════
async def account_check(client: TelegramClient):
"""Проверка аккаунта: статус, спамблок, премиум"""
me = await client.get_me()
try:
await client.send_message('SpamBot', '/start')
await asyncio.sleep(2)
msgs = await client.get_messages('SpamBot', limit=1)
spam_blocked = 'ограничен' in (msgs[0].message or '').lower()
except:
spam_blocked = None
return {
'id': me.id, 'username': me.username, 'phone': me.phone,
'premium': getattr(me, 'premium', False),
'spam_blocked': spam_blocked,
'last_seen': me.status.was_online if hasattr(me.status, 'was_online') else None
}
async def account_edit_profile(client: TelegramClient, *,
first_name=None, last_name=None, bio=None, username=None, photo_path=None):
"""Редактирование профиля аккаунта"""
if first_name or last_name:
await client(UpdateProfileRequest(
first_name=first_name, last_name=last_name, about=bio))
if username:
await client(UpdateUsernameRequest(username))
if photo_path:
await client(UploadProfilePhotoRequest(
await client.upload_file(photo_path)))
async def account_set_2fa(client: TelegramClient, password: str, hint: str = ''):
"""Установка 2FA"""
await client.edit_2fa(new_password=password, hint=hint)
async def account_get_sessions(client: TelegramClient):
"""Получить активные сессии"""
return await client(functions.account.GetAuthorizationsRequest())
async def account_terminate_sessions(client: TelegramClient):
"""Сбросить все сессии кроме текущей"""
await client(functions.auth.ResetAuthorizationsRequest())
async def account_privacy(client: TelegramClient, *,
hide_phone=True, hide_lastseen=True, hide_forwarded=True):
"""Настройки приватности"""
rules = []
if hide_phone:
rules.append(types.InputPrivacyValueDisallowAll())
if hide_lastseen:
pass # аналогично через account.setPrivacy
await client(functions.account.SetPrivacyRequest(
key=types.InputPrivacyKeyPhoneNumber(), rules=rules))
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Рассылка в ЛС
# ═══════════════════════════════════════════════════════════════
@dataclass
class SpamPMConfig:
threads: int = 3
msg_per_account: int = 50
delay_min: float = 30.0
delay_max: float = 90.0
silent: bool = False
ttl_seconds: Optional[int] = None
pin_message: bool = False
delete_sender: bool = False
block_after: bool = False
add_to_blacklist: bool = False
remove_links_preview: bool = False
rotate_on_flood: bool = True
check_spambot: bool = True
use_autoresponder: bool = False
collect_incoming: bool = False
thread_start_delay: tuple = (5, 30)
async def spam_pm(client: TelegramClient, users: list, message: str, cfg: SpamPMConfig):
"""Рассылка в ЛС с настройками из интерфейса"""
sent = 0
for user in users:
if sent >= cfg.msg_per_account:
break
try:
entity = await client.get_input_entity(user)
await client.send_message(
entity, message,
silent=cfg.silent,
background=None
)
sent += 1
if cfg.block_after:
await client(functions.contacts.BlockRequest(entity))
delay = random.uniform(cfg.delay_min, cfg.delay_max)
await asyncio.sleep(delay)
except errors.FloodWaitError as e:
if cfg.rotate_on_flood:
return False # сигнал сменить аккаунт
await asyncio.sleep(e.seconds)
except errors.PeerFloodError:
if cfg.check_spambot:
await client.send_message('SpamBot', '/start')
return False
except Exception:
continue
return True
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Нейрочаттинг
# ═══════════════════════════════════════════════════════════════
@dataclass
class NeuroChatConfig:
mode: str = 'keywords' # keywords | trigger | smart | promoter
chat_source: str = 'subscriptions' # subscriptions | list
chat_list: list = field(default_factory=list)
replies_per_account: int = 30
context_messages: int = 5
delay_before_reply: tuple = (5, 30)
pause_between_replies: tuple = (60, 300)
max_replies_per_chat: int = 10
chat_cooldown_min: int = 30
trigger_words: list = field(default_factory=list)
whole_word: bool = True
case_sensitive: bool = False
ignore_bots: bool = True
ignore_system: bool = True
min_message_length: int = 1
leave_if_cant_write: bool = False
auto_leave_spam: bool = False
respond_to_our_replies: bool = False
check_spambot_on_flood: bool = True
async def neurochatting(client: TelegramClient, ai_generate, cfg: NeuroChatConfig):
"""Нейрочаттинг: AI отвечает на сообщения в чатах"""
if cfg.chat_source == 'subscriptions':
dialogs = await client.get_dialogs()
chats = [d for d in dialogs if d.is_group]
else:
chats = cfg.chat_list
chat_stats = {}
for chat in chats:
if chat_stats.get(chat.id, 0) >= cfg.max_replies_per_chat:
continue
try:
messages = await client.get_messages(chat, limit=50)
except errors.ChatWriteForbiddenError:
if cfg.leave_if_cant_write:
await client.delete_dialog(chat)
continue
for msg in messages:
if not msg.message:
continue
if cfg.ignore_bots and msg.sender and getattr(msg.sender, 'bot', False):
continue
if cfg.ignore_system and getattr(msg, 'action', None):
continue
if len(msg.message or '') < cfg.min_message_length:
continue
# Проверка триггеров
should_reply = False
text = msg.message or ''
if cfg.mode == 'keywords':
for word in cfg.trigger_words:
if cfg.whole_word:
pattern = rf'\b{re.escape(word)}\b'
else:
pattern = re.escape(word)
flags = 0 if cfg.case_sensitive else re.IGNORECASE
if re.search(pattern, text, flags):
should_reply = True
break
elif cfg.mode == 'trigger':
should_reply = True # AI решает
elif cfg.mode == 'smart':
should_reply = True
elif cfg.mode == 'promoter':
should_reply = True
if should_reply:
# Контекст
context = await client.get_messages(
chat, limit=cfg.context_messages, offset_id=msg.id)
context_text = '\n'.join(
f"[{m.sender_id}]: {m.message}" for m in reversed(context) if m.message)
# AI генерация
reply = await ai_generate(context_text, msg.message)
delay = random.uniform(*cfg.delay_before_reply)
await asyncio.sleep(delay)
try:
await client.send_message(chat, reply, reply_to=msg.id)
chat_stats[chat.id] = chat_stats.get(chat.id, 0) + 1
except errors.PeerFloodError:
if cfg.check_spambot_on_flood:
await client.send_message('SpamBot', '/start')
return chat_stats
pause = random.uniform(*cfg.pause_between_replies)
await asyncio.sleep(pause)
return chat_stats
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Инвайтинг
# ═══════════════════════════════════════════════════════════════
async def invite_users(client: TelegramClient, chat, users: list,
per_account: int = 50, delay: tuple = (60, 180), rotate_on_flood: bool = True):
"""Массовый инвайт пользователей в канал/группу"""
invited = 0
for user in users:
if invited >= per_account:
break
try:
entity = await client.get_input_entity(user)
await client(InviteToChannelRequest(chat, [entity]))
invited += 1
await asyncio.sleep(random.uniform(*delay))
except errors.FloodWaitError as e:
if rotate_on_flood:
return invited
await asyncio.sleep(e.seconds)
except errors.UserPrivacyRestrictedError:
continue
except Exception:
continue
return invited
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Парсер аудитории
# ═══════════════════════════════════════════════════════════════
async def parse_chat_members(client: TelegramClient, chat,
limit: int = 50000, active_only: bool = False) -> list[dict]:
"""Сбор участников чата/канала"""
users = []
try:
async for member in client.iter_participants(chat, limit=limit):
if active_only and member.status:
if hasattr(member.status, 'was_online'):
if (datetime.now() - member.status.was_online).days > 30:
continue
users.append({
'id': member.id,
'username': member.username,
'first_name': member.first_name,
'last_name': member.last_name,
'phone': getattr(member, 'phone', None),
'premium': getattr(member, 'premium', False),
'bot': member.bot,
'was_online': str(getattr(member.status, 'was_online', None))
})
except errors.ChatAdminRequiredError:
pass
return users
async def parse_comments(client: TelegramClient, channel, post_limit: int = 100):
"""Парсер комментаторов постов"""
commenters = {}
messages = await client.get_messages(channel, limit=post_limit)
for msg in messages:
if msg.replies and msg.replies.replies > 0:
try:
async for comment in client.iter_messages(
channel, reply_to=msg.id, limit=100):
if comment.sender_id and comment.sender_id not in commenters:
commenters[comment.sender_id] = {
'user_id': comment.sender_id,
'post_id': msg.id,
'count': 1
}
elif comment.sender_id:
commenters[comment.sender_id]['count'] += 1
except:
continue
return sorted(commenters.values(), key=lambda x: x['count'], reverse=True)
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Нейрокомментинг
# ═══════════════════════════════════════════════════════════════
async def neuro_commenting(client: TelegramClient, channels: list,
ai_generate, posts_per_channel: int = 10,
delay: tuple = (30, 120), mode: str = 'firstnah'):
"""Автокомментирование новых постов с AI"""
results = []
for channel in channels:
try:
# Первонах (firstnah) — комментарий первым
messages = await client.get_messages(channel, limit=posts_per_channel)
for msg in messages:
if not msg.message:
continue
try:
existing = await client.get_messages(
channel, reply_to=msg.id, limit=5)
our_comments = [c for c in existing
if c.sender_id == (await client.get_me()).id]
if mode == 'firstnah' and our_comments:
continue # уже комментили
except:
pass
comment = await ai_generate(
f"POST: {msg.message[:500]}",
style='positive' # из настроек модуля
)
await asyncio.sleep(random.uniform(*delay))
await client.send_message(channel, comment, reply_to=msg.id)
results.append({'channel': channel, 'post_id': msg.id, 'comment': comment[:100]})
except Exception as e:
results.append({'channel': channel, 'error': str(e)})
return results
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Рассылка в группы
# ═══════════════════════════════════════════════════════════════
async def spam_groups(client: TelegramClient, chats: list, message: str,
ai_rewrite=False, ai_generate=None,
per_account: int = 20, delay: tuple = (60, 180)):
"""Рассылка в группы с AI-рерайтом"""
sent = 0
for chat in chats:
if sent >= per_account:
break
try:
text = message
if ai_rewrite and ai_generate:
text = await ai_generate(f"Rewrite this naturally: {message}")
await client.send_message(chat, text)
sent += 1
await asyncio.sleep(random.uniform(*delay))
except errors.FloodWaitError as e:
await asyncio.sleep(e.seconds)
except Exception:
continue
return sent
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Автоответчик с ветвлением
# ═══════════════════════════════════════════════════════════════
@dataclass
class AutoReplyRule:
trigger_words: list
response: str
whole_word: bool = True
case_sensitive: bool = False
collect_usernames: bool = False
async def auto_responder(client: TelegramClient, rules: list[AutoReplyRule],
collect_usernames: bool = False, blacklist: set = set()):
"""Автоответчик на входящие сообщения"""
collected = []
while True:
try:
dialogs = await client.get_dialogs()
for dialog in dialogs:
if dialog.unread_count > 0 and dialog.id not in blacklist:
msgs = await client.get_messages(dialog.id, limit=dialog.unread_count)
for msg in msgs:
if msg.out:
continue
if collect_usernames and msg.sender:
collected.append({
'user_id': msg.sender_id,
'username': getattr(msg.sender, 'username', None),
'message': msg.message[:200]
})
text = msg.message or ''
for rule in rules:
for word in rule.trigger_words:
if rule.whole_word:
pattern = rf'\b{re.escape(word)}\b'
else:
pattern = re.escape(word)
flags = 0 if rule.case_sensitive else re.IGNORECASE
if re.search(pattern, text, flags):
await client.send_message(dialog.id, rule.response)
break
else:
continue
break
except Exception:
pass
await asyncio.sleep(5)
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Массовые подписки + лайки + просмотры
# ═══════════════════════════════════════════════════════════════
async def mass_join(client: TelegramClient, channels: list,
per_account: int = 50, delay: tuple = (30, 90)):
"""Массовое вступление в каналы/группы"""
joined = 0
for ch in channels:
if joined >= per_account:
break
try:
await client(JoinChannelRequest(ch))
joined += 1
await asyncio.sleep(random.uniform(*delay))
except errors.FloodWaitError as e:
await asyncio.sleep(e.seconds)
except Exception:
continue
return joined
async def mass_react(client: TelegramClient, channel, post_ids: list,
reaction='👍', per_account: int = 100, delay: tuple = (5, 15)):
"""Массовые реакции на посты"""
for pid in post_ids[:per_account]:
try:
await client.send_reaction(channel, pid, reaction)
await asyncio.sleep(random.uniform(*delay))
except errors.FloodWaitError as e:
await asyncio.sleep(e.seconds)
except Exception:
continue
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Чекер юзернеймов
# ═══════════════════════════════════════════════════════════════
async def check_usernames(client: TelegramClient, usernames: list) -> dict:
"""Проверка доступности юзернеймов"""
results = {'free': [], 'taken': [], 'errors': []}
for username in usernames:
try:
entity = await client.get_entity(username)
results['taken'].append(username)
except errors.UsernameNotOccupiedError:
results['free'].append(username)
except Exception:
results['errors'].append(username)
await asyncio.sleep(0.5)
return results
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Масслукинг (просмотр Stories)
# ═══════════════════════════════════════════════════════════════
async def mass_story_view(client: TelegramClient, targets: list,
per_account: int = 200, delay: tuple = (3, 10)):
"""Массовый просмотр Telegram Stories"""
viewed = 0
for target in targets:
if viewed >= per_account:
break
try:
entity = await client.get_input_entity(target)
stories = await client(functions.stories.GetPeerStoriesRequest(
peer=entity))
if stories.stories:
await client(functions.stories.ReadStoriesRequest(
peer=entity,
max_id=max(s.id for s in stories.stories.stories)
))
viewed += 1
await asyncio.sleep(random.uniform(*delay))
except Exception:
continue
return viewed
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Прогрев аккаунтов
# ═══════════════════════════════════════════════════════════════
async def warmup_account(client: TelegramClient, days: int = 7,
daily_joins: int = 5, daily_messages: int = 3, daily_reactions: int = 10):
"""Прогрев аккаунта перед работой"""
for day in range(days):
for _ in range(random.randint(1, daily_joins)):
try:
dialogs = await client.get_dialogs()
groups = [d for d in dialogs if d.is_group]
if groups:
await client(JoinChannelRequest(random.choice(groups)))
except:
pass
await asyncio.sleep(random.uniform(300, 900))
for _ in range(random.randint(1, daily_messages)):
try:
await client.send_message('me', f'Warmup message {time.time()}')
except:
pass
await asyncio.sleep(random.uniform(600, 1800))
return True
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Постинг по каналам
# ═══════════════════════════════════════════════════════════════
async def channel_posting(client: TelegramClient, channels: list,
posts: list[dict], schedule: bool = False):
"""Публикация постов в каналы через бота-админа"""
for channel in channels:
for post in posts:
try:
entity = await client.get_entity(channel)
if post.get('photo'):
await client.send_file(entity, post['photo'],
caption=post.get('caption', ''))
else:
await client.send_message(entity, post.get('text', ''))
except Exception:
continue
await asyncio.sleep(random.uniform(10, 30))
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Снятие спамблока
# ═══════════════════════════════════════════════════════════════
async def remove_spamblock(client: TelegramClient) -> bool:
"""Снятие ограничений через SpamBot"""
try:
await client.send_message('SpamBot', '/start')
await asyncio.sleep(2)
msgs = await client.get_messages('SpamBot', limit=5)
for msg in msgs:
if msg.reply_markup and hasattr(msg.reply_markup, 'rows'):
for row in msg.reply_markup.rows:
for btn in row.buttons:
if 'ограничен' in (btn.text or '').lower() or \
'это я' in (btn.text or '').lower() or \
'продолжить' in (btn.text or '').lower():
await btn.click()
return True
except Exception:
pass
return False
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Диспетчер задач (оркестратор)
# ═══════════════════════════════════════════════════════════════
class TaskDispatcher:
"""Центральный диспетчер задач"""
def __init__(self):
self.tasks = {}
self.running = set()
self.results = {}
async def run_task(self, task_id: str, coro, accounts: list,
proxy_rotate=None):
"""Запуск задачи на пуле аккаунтов с ротацией"""
self.running.add(task_id)
results = []
for acc in accounts:
client = await self._get_client(acc, proxy_rotate)
try:
result = await coro(client)
results.append({'account': acc, 'result': result})
except Exception as e:
results.append({'account': acc, 'error': str(e)})
finally:
await client.disconnect()
self.running.discard(task_id)
self.results[task_id] = results
return results
async def _get_client(self, account, proxy):
"""Создать клиент с прокси"""
session = account.get('session')
api_id = account.get('api_id', 2040)
api_hash = account.get('api_hash', 'b18441a1ff607e10a989891a5462e627')
client = TelegramClient(
StringSession(session) if session else StringSession(),
api_id, api_hash,
proxy=proxy
)
await client.connect()
if not await client.is_user_authorized():
await client.start(phone=account['phone'])
return client
# ═══════════════════════════════════════════════════════════════
# МОДУЛЬ: Прокси-менеджер
# ═══════════════════════════════════════════════════════════════
async def proxy_check(proxy: dict) -> dict:
"""Проверка прокси перед назначением на аккаунт"""
import socket
try:
proto, host, port = proxy['type'], proxy['host'], proxy['port']
sock = socket.create_connection((host, port), timeout=5)
sock.close()
return {'proxy': proxy, 'alive': True, 'latency': None}
except Exception as e:
return {'proxy': proxy, 'alive': False, 'error': str(e)}
async def proxy_rotate(proxies: list, accounts: list) -> dict:
"""Назначение прокси на аккаунты (round-robin)"""
alive = [p for p in proxies if (await proxy_check(p))['alive']]
mapping = {}
for i, acc in enumerate(accounts):
mapping[acc['id']] = alive[i % len(alive)] if alive else None
return mapping

813
research-what-we-did/forum-reversing/forum-reversing_2026-09-19.md Normal file
View File

@@ -0,0 +1,813 @@
[Skip to content](https://forum.tuts4you.com/#ipsLayout__main)
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
View in the app
A better way to browse. **Learn more**.
Learn more×DismissClose
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
Tuts 4 You
A full-screen app on your home screen with push notifications, badges and more.
To install this app on iOS and iPadOS
1. Tap the Share icon in Safari
2. Scroll the menu and tap **Add to Home Screen**.
3. Tap **Add** in the top-right corner.
To install this app on Android
1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
2. Tap **Add to Home screen** or **Install app**.
3. Confirm by tapping **Install**.
[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/)
- Sign In
1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category
1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
Very important! Please read before sign up and posting...
- [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/)
- [Downloads](https://forum.tuts4you.com/forum/152-downloads/)
- [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/)
- [Telegram](https://forum.tuts4you.com/forum/158-telegram/)
1,065,403 visits to this link
2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category
1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
General and off-topic conversations and discussions here...
- 15.9k posts
![testednation](https://forum.tuts4you.com/uploads/monthly_2025_10/sunset.thumb.jpg.1191f083998af5ad81472d47975f9e97.jpg)
[secure boot disable](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "secure boot disable")
testednation,
[Thursday at 08:10 PM1 day](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "Go to last post")
2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
Discussions covering scene news and changes...
- [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/)
- [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/)
- 11k posts
![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png)
[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie")
RADIOX,
[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post")
3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
Bugs, feedback and ideas regarding this site...
- 2.3k posts
![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png)
[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage")
Teddy Rogers,
[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post")
3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category
1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
Programming and coding tips, help and solutions...
- 13k posts
![Asif](https://forum.tuts4you.com/uploads/monthly_2026_05/dark-tree-in-the-middle-of-a-purple-lake-wallpaper.thumb.jpg.02ff4397975066b3a9bcae231c439e2e.jpg)
[JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach")
Asif,
[Tuesday at 05:03 PM3 days](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "Go to last post")
2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
Share an interesting blog, news page or other resource...
- 472 posts
![Raven](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23a1c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TX-02 Berkeley Mono Fontface](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "TX-02 Berkeley Mono Fontface")
Raven,
[May 16May 16](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "Go to last post")
3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
### [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
Securing your software against reverse engineering...
- 985 posts
![redbull](https://forum.tuts4you.com/uploads/monthly_2026_07/83496-859380-cat-listening-to-music.thumb.jpg.a5006daa3b9c8a982bd875a41c8a6a82.jpg)
[Protecting my Golang exe](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Protecting my Golang exe")
redbull,
[July 10Jul 10](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Go to last post")
4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category
1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
Try a challenge or contribute your own, any platform or operating system...
- [CrackMe](https://forum.tuts4you.com/forum/145-crackme/)
- [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/)
- [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/)
- [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/)
- 15.1k posts
![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)")
hamzadutsher,
[Monday at 11:17 PM4 days](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post")
2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
Reverse engineering of circuitry hardware and firmware...
- 258 posts
![ToughDev](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c46285%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ET%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project")
ToughDev,
[March 26Mar 26](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post")
3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
### [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
Discussions on network security, holes, exploits and other issues...
- 454 posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???")
CodeExplorer,
[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post")
4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
Debugging, disassembling and documenting interesting malware...
- 1.7k posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?")
CodeExplorer,
[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post")
5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
Share an interesting blog, news page or other RE related site...
- 2.6k posts
![Say](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2382c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)")
Say,
[September 4Sep 4](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "Go to last post")
6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
Discussions on employment and career paths in the industry...
- 213 posts
![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project")
zahainesu,
[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post")
5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category
1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
Development and support forum for the Scylla project...
- 506 posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source")
Progman,
[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post")
2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
An open-source x64/x32 debugger for windows...
- 1.3k posts
![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi")
remek002,
[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post")
3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
Looking for support and interested partners for a future project?
- 151 posts
![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg)
[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler")
Dax,
[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post")
4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
Old and inactive projects moved to long term support...
- [uPPP](https://forum.tuts4you.com/forum/120-uppp/)
- [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/)
- [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/)
- 832 posts
![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide")
devsat-dz,
[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post")
6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category
1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
This is where all the bad posts go.
**99.9%** of the time it contains crack requests and banned members...
### Member Statistics
- **31,470** Total Members
- **7,713** Most Online
- [![Shadow09](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c462b3%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile")
**[Shadow09](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile")** Newest Member · Wednesday at 07:53 PM2 days
- [Existing user? Sign In](https://forum.tuts4you.com/login/)
- [Sign Up](https://forum.tuts4you.com/register/)
Search
Where:
EverywhereTopicsFilesPagesArticle
Search:
Content titles and bodyContent titles only
Date Created:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Use:
All of these wordsAny of these words
Last Updated:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Search...
Search
Search
Search by content type
EverywhereTopicsFilesPagesArticle
Find results in
Search titles and bodySearch titles only
Date Created
Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year
Last Updated
Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year
Close
#### Configure browser push notifications
Close
Chrome Safari Edge Firefox
##### Chrome (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions → Notifications**.
3. Adjust your preference.
##### Chrome (Desktop)
1. Click the padlock icon in the address bar.
2. Select **Site settings**.
3. Find **Notifications** and adjust your preference.
##### Safari (iOS 16.4+)
1. Ensure the site is installed via **Add to Home Screen**.
2. Open **Settings App → Notifications**.
3. Find your app name and adjust your preference.
##### Safari (macOS)
1. Go to **Safari → Preferences**.
2. Click the **Websites** tab.
3. Select **Notifications** in the sidebar.
4. Find this website and adjust your preference.
##### Edge (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions**.
3. Find **Notifications** and adjust your preference.
##### Edge (Desktop)
1. Click the padlock icon in the address bar.
2. Click **Permissions for this site**.
3. Find **Notifications** and adjust your preference.
##### Firefox (Android)
1. Go to **Settings → Site permissions**.
2. Tap **Notifications**.
3. Find this site in the list and adjust your preference.
##### Firefox (Desktop)
1. Open Firefox Settings.
2. Search for **Notifications**.
3. Find this site in the list and adjust your preference.

813
research-what-we-did/forum-reversing/forum-reversing_2026-09-20.md Normal file
View File

@@ -0,0 +1,813 @@
[Skip to content](https://forum.tuts4you.com/#ipsLayout__main)
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
View in the app
A better way to browse. **Learn more**.
Learn more×DismissClose
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
Tuts 4 You
A full-screen app on your home screen with push notifications, badges and more.
To install this app on iOS and iPadOS
1. Tap the Share icon in Safari
2. Scroll the menu and tap **Add to Home Screen**.
3. Tap **Add** in the top-right corner.
To install this app on Android
1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
2. Tap **Add to Home screen** or **Install app**.
3. Confirm by tapping **Install**.
[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/)
- Sign In
1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category
1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
Very important! Please read before sign up and posting...
- [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/)
- [Downloads](https://forum.tuts4you.com/forum/152-downloads/)
- [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/)
- [Telegram](https://forum.tuts4you.com/forum/158-telegram/)
1,065,403 visits to this link
2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category
1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
General and off-topic conversations and discussions here...
- 15.9k posts
![testednation](https://forum.tuts4you.com/uploads/monthly_2025_10/sunset.thumb.jpg.1191f083998af5ad81472d47975f9e97.jpg)
[secure boot disable](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "secure boot disable")
testednation,
[Thursday at 08:10 PM1 day](https://forum.tuts4you.com/topic/46213-secure-boot-disable/ "Go to last post")
2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
Discussions covering scene news and changes...
- [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/)
- [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/)
- 11k posts
![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png)
[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie")
RADIOX,
[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post")
3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
Bugs, feedback and ideas regarding this site...
- 2.3k posts
![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png)
[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage")
Teddy Rogers,
[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post")
3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category
1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
Programming and coding tips, help and solutions...
- 13k posts
![Asif](https://forum.tuts4you.com/uploads/monthly_2026_05/dark-tree-in-the-middle-of-a-purple-lake-wallpaper.thumb.jpg.02ff4397975066b3a9bcae231c439e2e.jpg)
[JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach")
Asif,
[Tuesday at 05:03 PM3 days](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "Go to last post")
2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
Share an interesting blog, news page or other resource...
- 472 posts
![Raven](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23a1c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TX-02 Berkeley Mono Fontface](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "TX-02 Berkeley Mono Fontface")
Raven,
[May 16May 16](https://forum.tuts4you.com/topic/45493-tx-02-berkeley-mono-fontface/ "Go to last post")
3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
### [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
Securing your software against reverse engineering...
- 985 posts
![redbull](https://forum.tuts4you.com/uploads/monthly_2026_07/83496-859380-cat-listening-to-music.thumb.jpg.a5006daa3b9c8a982bd875a41c8a6a82.jpg)
[Protecting my Golang exe](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Protecting my Golang exe")
redbull,
[July 10Jul 10](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Go to last post")
4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category
1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
Try a challenge or contribute your own, any platform or operating system...
- [CrackMe](https://forum.tuts4you.com/forum/145-crackme/)
- [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/)
- [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/)
- [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/)
- 15.1k posts
![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)")
hamzadutsher,
[Monday at 11:17 PM4 days](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post")
2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
Reverse engineering of circuitry hardware and firmware...
- 258 posts
![ToughDev](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c46285%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ET%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project")
ToughDev,
[March 26Mar 26](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post")
3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
### [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
Discussions on network security, holes, exploits and other issues...
- 454 posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???")
CodeExplorer,
[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post")
4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
Debugging, disassembling and documenting interesting malware...
- 1.7k posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?")
CodeExplorer,
[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post")
5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
Share an interesting blog, news page or other RE related site...
- 2.6k posts
![Say](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2382c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)")
Say,
[September 4Sep 4](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "Go to last post")
6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
Discussions on employment and career paths in the industry...
- 213 posts
![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project")
zahainesu,
[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post")
5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category
1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
Development and support forum for the Scylla project...
- 506 posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source")
Progman,
[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post")
2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
An open-source x64/x32 debugger for windows...
- 1.3k posts
![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi")
remek002,
[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post")
3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
Looking for support and interested partners for a future project?
- 151 posts
![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg)
[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler")
Dax,
[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post")
4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
Old and inactive projects moved to long term support...
- [uPPP](https://forum.tuts4you.com/forum/120-uppp/)
- [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/)
- [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/)
- 832 posts
![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide")
devsat-dz,
[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post")
6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category
1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
This is where all the bad posts go.
**99.9%** of the time it contains crack requests and banned members...
### Member Statistics
- **31,470** Total Members
- **7,713** Most Online
- [![Shadow09](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c462b3%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile")
**[Shadow09](https://forum.tuts4you.com/profile/149859-shadow09/ "Go to Shadow09's profile")** Newest Member · Wednesday at 07:53 PM2 days
- [Existing user? Sign In](https://forum.tuts4you.com/login/)
- [Sign Up](https://forum.tuts4you.com/register/)
Search
Where:
EverywhereTopicsFilesPagesArticle
Search:
Content titles and bodyContent titles only
Date Created:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Use:
All of these wordsAny of these words
Last Updated:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Search...
Search
Search
Search by content type
EverywhereTopicsFilesPagesArticle
Find results in
Search titles and bodySearch titles only
Date Created
Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year
Last Updated
Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year
Close
#### Configure browser push notifications
Close
Chrome Safari Edge Firefox
##### Chrome (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions → Notifications**.
3. Adjust your preference.
##### Chrome (Desktop)
1. Click the padlock icon in the address bar.
2. Select **Site settings**.
3. Find **Notifications** and adjust your preference.
##### Safari (iOS 16.4+)
1. Ensure the site is installed via **Add to Home Screen**.
2. Open **Settings App → Notifications**.
3. Find your app name and adjust your preference.
##### Safari (macOS)
1. Go to **Safari → Preferences**.
2. Click the **Websites** tab.
3. Select **Notifications** in the sidebar.
4. Find this website and adjust your preference.
##### Edge (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions**.
3. Find **Notifications** and adjust your preference.
##### Edge (Desktop)
1. Click the padlock icon in the address bar.
2. Click **Permissions for this site**.
3. Find **Notifications** and adjust your preference.
##### Firefox (Android)
1. Go to **Settings → Site permissions**.
2. Tap **Notifications**.
3. Find this site in the list and adjust your preference.
##### Firefox (Desktop)
1. Open Firefox Settings.
2. Search for **Notifications**.
3. Find this site in the list and adjust your preference.

813
research-what-we-did/forum-reversing/forum-reversing_2026-09-21.md Normal file
View File

@@ -0,0 +1,813 @@
[Skip to content](https://forum.tuts4you.com/#ipsLayout__main)
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
View in the app
A better way to browse. **Learn more**.
Learn more×DismissClose
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
Tuts 4 You
A full-screen app on your home screen with push notifications, badges and more.
To install this app on iOS and iPadOS
1. Tap the Share icon in Safari
2. Scroll the menu and tap **Add to Home Screen**.
3. Tap **Add** in the top-right corner.
To install this app on Android
1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
2. Tap **Add to Home screen** or **Install app**.
3. Confirm by tapping **Install**.
[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/)
- Sign In
1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category
1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
Very important! Please read before sign up and posting...
- [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/)
- [Downloads](https://forum.tuts4you.com/forum/152-downloads/)
- [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/)
- [Telegram](https://forum.tuts4you.com/forum/158-telegram/)
1,065,431 visits to this link
2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category
1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
General and off-topic conversations and discussions here...
- 15.9k posts
![Stingered](https://forum.tuts4you.com/uploads/monthly_2026_01/Stingered_animated_Avatar.thumb.gif.578a5e25596943c2d83999a12bffbb3e.gif)
[Question. I've been working on a patch for severel months without success...](https://forum.tuts4you.com/topic/46217-question-ive-been-working-on-a-patch-for-severel-months-without-success/ "Question. I've been working on a patch for severel months without success...")
Stingered,
[15 hours ago15 hr](https://forum.tuts4you.com/topic/46217-question-ive-been-working-on-a-patch-for-severel-months-without-success/ "Go to last post")
2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
Discussions covering scene news and changes...
- [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/)
- [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/)
- 11k posts
![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png)
[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie")
RADIOX,
[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post")
3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
Bugs, feedback and ideas regarding this site...
- 2.3k posts
![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png)
[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage")
Teddy Rogers,
[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post")
3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category
1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
Programming and coding tips, help and solutions...
- 13k posts
![Asif](https://forum.tuts4you.com/uploads/monthly_2026_05/dark-tree-in-the-middle-of-a-purple-lake-wallpaper.thumb.jpg.02ff4397975066b3a9bcae231c439e2e.jpg)
[JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "JitDumperEx — Dump JIT-Generated Code on .NET Framework 2.0–4.8 via ExecuteEXE & ExecuteDLLForAttach")
Asif,
[September 15Sep 15](https://forum.tuts4you.com/topic/46211-jitdumperex-dump-jit-generated-code-on-net-framework-2048-via-executeexe-executedllforattach/ "Go to last post")
2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
Share an interesting blog, news page or other resource...
- 473 posts
![whoknows](https://forum.tuts4you.com/uploads/monthly_2024_01/avatar1.thumb.jpg.34724bdfbd3ed5b434bd6f7fc7c097b9.jpg)
[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github")
whoknows,
[Yesterday at 01:40 PM1 day](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post")
3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
### [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
Securing your software against reverse engineering...
- 985 posts
![redbull](https://forum.tuts4you.com/uploads/monthly_2026_07/83496-859380-cat-listening-to-music.thumb.jpg.a5006daa3b9c8a982bd875a41c8a6a82.jpg)
[Protecting my Golang exe](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Protecting my Golang exe")
redbull,
[July 10Jul 10](https://forum.tuts4you.com/topic/45329-protecting-my-golang-exe/ "Go to last post")
4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category
1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
Try a challenge or contribute your own, any platform or operating system...
- [CrackMe](https://forum.tuts4you.com/forum/145-crackme/)
- [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/)
- [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/)
- [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/)
- 15.1k posts
![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)")
hamzadutsher,
[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post")
2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
Reverse engineering of circuitry hardware and firmware...
- 258 posts
![ToughDev](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c46285%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ET%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project")
ToughDev,
[March 26Mar 26](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post")
3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
### [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
Discussions on network security, holes, exploits and other issues...
- 454 posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???")
CodeExplorer,
[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post")
4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
Debugging, disassembling and documenting interesting malware...
- 1.7k posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?")
CodeExplorer,
[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post")
5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
Share an interesting blog, news page or other RE related site...
- 2.6k posts
![Say](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2382c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "CSL Course - Cracking Software Legally (CSL) & CSP Course - Cracking Software Practicals (CSP)")
Say,
[September 4Sep 4](https://forum.tuts4you.com/topic/43321-csl-course-cracking-software-legally-csl-csp-course-cracking-software-practicals-csp/ "Go to last post")
6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
Discussions on employment and career paths in the industry...
- 213 posts
![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project")
zahainesu,
[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post")
5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category
1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
Development and support forum for the Scylla project...
- 506 posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source")
Progman,
[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post")
2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
An open-source x64/x32 debugger for windows...
- 1.3k posts
![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi")
remek002,
[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post")
3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
Looking for support and interested partners for a future project?
- 151 posts
![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg)
[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler")
Dax,
[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post")
4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
Old and inactive projects moved to long term support...
- [uPPP](https://forum.tuts4you.com/forum/120-uppp/)
- [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/)
- [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/)
- 832 posts
![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide")
devsat-dz,
[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post")
6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category
1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
This is where all the bad posts go.
**99.9%** of the time it contains crack requests and banned members...
### Member Statistics
- **31,468** Total Members
- **7,713** Most Online
- ![Shadow09](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23c462b3%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ES%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
**Shadow09** Newest Member · Wednesday at 07:53 PM4 days
- [Existing user? Sign In](https://forum.tuts4you.com/login/)
- [Sign Up](https://forum.tuts4you.com/register/)
Search
Where:
EverywhereTopicsFilesPagesArticle
Search:
Content titles and bodyContent titles only
Date Created:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Use:
All of these wordsAny of these words
Last Updated:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Search...
Search
Search
Search by content type
EverywhereTopicsFilesPagesArticle
Find results in
Search titles and bodySearch titles only
Date Created
Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year
Last Updated
Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year
Close
#### Configure browser push notifications
Close
Chrome Safari Edge Firefox
##### Chrome (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions → Notifications**.
3. Adjust your preference.
##### Chrome (Desktop)
1. Click the padlock icon in the address bar.
2. Select **Site settings**.
3. Find **Notifications** and adjust your preference.
##### Safari (iOS 16.4+)
1. Ensure the site is installed via **Add to Home Screen**.
2. Open **Settings App → Notifications**.
3. Find your app name and adjust your preference.
##### Safari (macOS)
1. Go to **Safari → Preferences**.
2. Click the **Websites** tab.
3. Select **Notifications** in the sidebar.
4. Find this website and adjust your preference.
##### Edge (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions**.
3. Find **Notifications** and adjust your preference.
##### Edge (Desktop)
1. Click the padlock icon in the address bar.
2. Click **Permissions for this site**.
3. Find **Notifications** and adjust your preference.
##### Firefox (Android)
1. Go to **Settings → Site permissions**.
2. Tap **Notifications**.
3. Find this site in the list and adjust your preference.
##### Firefox (Desktop)
1. Open Firefox Settings.
2. Search for **Notifications**.
3. Find this site in the list and adjust your preference.

813
research-what-we-did/forum-reversing/forum-reversing_2026-09-26.md Normal file
View File

@@ -0,0 +1,813 @@
[Skip to content](https://forum.tuts4you.com/#ipsLayout__main)
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
View in the app
A better way to browse. **Learn more**.
Learn more×DismissClose
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
Tuts 4 You
A full-screen app on your home screen with push notifications, badges and more.
To install this app on iOS and iPadOS
1. Tap the Share icon in Safari
2. Scroll the menu and tap **Add to Home Screen**.
3. Tap **Add** in the top-right corner.
To install this app on Android
1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
2. Tap **Add to Home screen** or **Install app**.
3. Confirm by tapping **Install**.
[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/)
- Sign In
1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category
1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
Very important! Please read before sign up and posting...
- [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/)
- [Downloads](https://forum.tuts4you.com/forum/152-downloads/)
- [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/)
- [Telegram](https://forum.tuts4you.com/forum/158-telegram/)
1,065,496 visits to this link
2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category
1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
General and off-topic conversations and discussions here...
- 15.9k posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Is there any AI model we can use without message limitations?](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Is there any AI model we can use without message limitations?")
Progman,
[10 hours ago10 hr](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Go to last post")
2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
Discussions covering scene news and changes...
- [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/)
- [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/)
- 11k posts
![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png)
[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie")
RADIOX,
[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post")
3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
Bugs, feedback and ideas regarding this site...
- 2.3k posts
![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png)
[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage")
Teddy Rogers,
[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post")
3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category
1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
Programming and coding tips, help and solutions...
- 13k posts
![Raggy](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23626dc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Realistic Water Effect When Touched by Mouse.](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Realistic Water Effect When Touched by Mouse.")
Raggy,
[Wednesday at 11:06 AM2 days](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Go to last post")
2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
Share an interesting blog, news page or other resource...
- 474 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github")
Erich Gropper,
[8 hours ago8 hr](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post")
3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
### [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
Securing your software against reverse engineering...
- 990 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?")
Erich Gropper,
[8 hours ago8 hr](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "Go to last post")
4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category
1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
Try a challenge or contribute your own, any platform or operating system...
- [CrackMe](https://forum.tuts4you.com/forum/145-crackme/)
- [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/)
- [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/)
- [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/)
- 15.1k posts
![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)")
hamzadutsher,
[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post")
2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
Reverse engineering of circuitry hardware and firmware...
- 259 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project")
Erich Gropper,
[8 hours ago8 hr](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post")
3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
### [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
Discussions on network security, holes, exploits and other issues...
- 454 posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???")
CodeExplorer,
[July 31Jul 31](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post")
4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
Debugging, disassembling and documenting interesting malware...
- 1.7k posts
![CodeExplorer](https://forum.tuts4you.com/uploads/monthly_2020_07/67d195ad13dd13e9b3fed230b8ea30ef.thumb.jpg.240d0fe24951c68b0e53cdc07687081a.jpg)
[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?")
CodeExplorer,
[June 20Jun 20](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post")
5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
Share an interesting blog, news page or other RE related site...
- 2.6k posts
![Washi](https://forum.tuts4you.com/uploads/monthly_2019_03/avatar_873632.thumb.png.9c04c2850dff78439125ab2a368560e2.png)
[Flare-On 13](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Flare-On 13")
Washi,
[13 hours ago13 hr](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Go to last post")
6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
Discussions on employment and career paths in the industry...
- 213 posts
![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project")
zahainesu,
[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post")
5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category
1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
Development and support forum for the Scylla project...
- 506 posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source")
Progman,
[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post")
2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
An open-source x64/x32 debugger for windows...
- 1.3k posts
![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi")
remek002,
[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post")
3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
Looking for support and interested partners for a future project?
- 151 posts
![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg)
[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler")
Dax,
[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post")
4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
Old and inactive projects moved to long term support...
- [uPPP](https://forum.tuts4you.com/forum/120-uppp/)
- [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/)
- [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/)
- 832 posts
![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide")
devsat-dz,
[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post")
6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category
1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
This is where all the bad posts go.
**99.9%** of the time it contains crack requests and banned members...
### Member Statistics
- **31,487** Total Members
- **7,713** Most Online
- ![zerigue](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362c496%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
**zerigue** Newest Member · 3 hours ago3 hr
- [Existing user? Sign In](https://forum.tuts4you.com/login/)
- [Sign Up](https://forum.tuts4you.com/register/)
Search
Where:
EverywhereTopicsFilesPagesArticle
Search:
Content titles and bodyContent titles only
Date Created:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Use:
All of these wordsAny of these words
Last Updated:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Search...
Search
Search
Search by content type
EverywhereTopicsFilesPagesArticle
Find results in
Search titles and bodySearch titles only
Date Created
Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year
Last Updated
Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year
Close
#### Configure browser push notifications
Close
Chrome Safari Edge Firefox
##### Chrome (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions → Notifications**.
3. Adjust your preference.
##### Chrome (Desktop)
1. Click the padlock icon in the address bar.
2. Select **Site settings**.
3. Find **Notifications** and adjust your preference.
##### Safari (iOS 16.4+)
1. Ensure the site is installed via **Add to Home Screen**.
2. Open **Settings App → Notifications**.
3. Find your app name and adjust your preference.
##### Safari (macOS)
1. Go to **Safari → Preferences**.
2. Click the **Websites** tab.
3. Select **Notifications** in the sidebar.
4. Find this website and adjust your preference.
##### Edge (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions**.
3. Find **Notifications** and adjust your preference.
##### Edge (Desktop)
1. Click the padlock icon in the address bar.
2. Click **Permissions for this site**.
3. Find **Notifications** and adjust your preference.
##### Firefox (Android)
1. Go to **Settings → Site permissions**.
2. Tap **Notifications**.
3. Find this site in the list and adjust your preference.
##### Firefox (Desktop)
1. Open Firefox Settings.
2. Search for **Notifications**.
3. Find this site in the list and adjust your preference.

813
research-what-we-did/forum-reversing/forum-reversing_2026-09-27.md Normal file
View File

@@ -0,0 +1,813 @@
[Skip to content](https://forum.tuts4you.com/#ipsLayout__main)
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
View in the app
A better way to browse. **Learn more**.
Learn more×DismissClose
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
Tuts 4 You
A full-screen app on your home screen with push notifications, badges and more.
To install this app on iOS and iPadOS
1. Tap the Share icon in Safari
2. Scroll the menu and tap **Add to Home Screen**.
3. Tap **Add** in the top-right corner.
To install this app on Android
1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
2. Tap **Add to Home screen** or **Install app**.
3. Confirm by tapping **Install**.
[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/)
- Sign In
1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category
1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
Very important! Please read before sign up and posting...
- [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/)
- [Downloads](https://forum.tuts4you.com/forum/152-downloads/)
- [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/)
- [Telegram](https://forum.tuts4you.com/forum/158-telegram/)
1,065,508 visits to this link
2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category
1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
General and off-topic conversations and discussions here...
- 15.9k posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Is there any AI model we can use without message limitations?](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Is there any AI model we can use without message limitations?")
Progman,
[Friday at 01:40 PM1 day](https://forum.tuts4you.com/topic/46194-is-there-any-ai-model-we-can-use-without-message-limitations/ "Go to last post")
2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
Discussions covering scene news and changes...
- [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/)
- [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/)
- 11k posts
![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png)
[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie")
RADIOX,
[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post")
3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
Bugs, feedback and ideas regarding this site...
- 2.3k posts
![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png)
[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage")
Teddy Rogers,
[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post")
3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category
1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
Programming and coding tips, help and solutions...
- 13k posts
![Raggy](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23626dc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Realistic Water Effect When Touched by Mouse.](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Realistic Water Effect When Touched by Mouse.")
Raggy,
[13 hours ago13 hr](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Go to last post")
2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
Share an interesting blog, news page or other resource...
- 474 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github")
Erich Gropper,
[Friday at 03:40 PM1 day](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post")
3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
### [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
Securing your software against reverse engineering...
- 990 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?")
Erich Gropper,
[Friday at 03:44 PM1 day](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "Go to last post")
4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category
1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
Try a challenge or contribute your own, any platform or operating system...
- [CrackMe](https://forum.tuts4you.com/forum/145-crackme/)
- [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/)
- [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/)
- [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/)
- 15.1k posts
![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)")
hamzadutsher,
[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post")
2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
Reverse engineering of circuitry hardware and firmware...
- 259 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project")
Erich Gropper,
[Friday at 03:47 PM1 day](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post")
3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
### [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
Discussions on network security, holes, exploits and other issues...
- 455 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???")
Erich Gropper,
[9 hours ago9 hr](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post")
4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
Debugging, disassembling and documenting interesting malware...
- 1.7k posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?")
Erich Gropper,
[9 hours ago9 hr](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post")
5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
Share an interesting blog, news page or other RE related site...
- 2.6k posts
![adicto](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23628ac4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EA%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Flare-On 13](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Flare-On 13")
adicto,
[21 minutes ago21 min](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Go to last post")
6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
Discussions on employment and career paths in the industry...
- 213 posts
![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project")
zahainesu,
[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post")
5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category
1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
Development and support forum for the Scylla project...
- 506 posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source")
Progman,
[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post")
2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
An open-source x64/x32 debugger for windows...
- 1.3k posts
![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi")
remek002,
[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post")
3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
Looking for support and interested partners for a future project?
- 151 posts
![Dax](https://forum.tuts4you.com/uploads/monthly_2026_06/1503603.thumb.jpeg.22c101f9cbdb6c3c040531dd4a26176b.jpeg)
[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler")
Dax,
[June 23Jun 23](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post")
4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
Old and inactive projects moved to long term support...
- [uPPP](https://forum.tuts4you.com/forum/120-uppp/)
- [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/)
- [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/)
- 832 posts
![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide")
devsat-dz,
[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post")
6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category
1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
This is where all the bad posts go.
**99.9%** of the time it contains crack requests and banned members...
### Member Statistics
- **31,496** Total Members
- **7,713** Most Online
- ![Memo56](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2365c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EM%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
**Memo56** Newest Member · 4 hours ago4 hr
- [Existing user? Sign In](https://forum.tuts4you.com/login/)
- [Sign Up](https://forum.tuts4you.com/register/)
Search
Where:
EverywhereTopicsFilesPagesArticle
Search:
Content titles and bodyContent titles only
Date Created:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Use:
All of these wordsAny of these words
Last Updated:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Search...
Search
Search
Search by content type
EverywhereTopicsFilesPagesArticle
Find results in
Search titles and bodySearch titles only
Date Created
Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year
Last Updated
Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year
Close
#### Configure browser push notifications
Close
Chrome Safari Edge Firefox
##### Chrome (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions → Notifications**.
3. Adjust your preference.
##### Chrome (Desktop)
1. Click the padlock icon in the address bar.
2. Select **Site settings**.
3. Find **Notifications** and adjust your preference.
##### Safari (iOS 16.4+)
1. Ensure the site is installed via **Add to Home Screen**.
2. Open **Settings App → Notifications**.
3. Find your app name and adjust your preference.
##### Safari (macOS)
1. Go to **Safari → Preferences**.
2. Click the **Websites** tab.
3. Select **Notifications** in the sidebar.
4. Find this website and adjust your preference.
##### Edge (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions**.
3. Find **Notifications** and adjust your preference.
##### Edge (Desktop)
1. Click the padlock icon in the address bar.
2. Click **Permissions for this site**.
3. Find **Notifications** and adjust your preference.
##### Firefox (Android)
1. Go to **Settings → Site permissions**.
2. Tap **Notifications**.
3. Find this site in the list and adjust your preference.
##### Firefox (Desktop)
1. Open Firefox Settings.
2. Search for **Notifications**.
3. Find this site in the list and adjust your preference.

813
research-what-we-did/forum-reversing/forum-reversing_2026-09-28.md Normal file
View File

@@ -0,0 +1,813 @@
[Skip to content](https://forum.tuts4you.com/#ipsLayout__main)
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
View in the app
A better way to browse. **Learn more**.
Learn more×DismissClose
![](https://forum.tuts4you.com/uploads/monthly_2022_09/apple-touch-icon-180x180.png)
Tuts 4 You
A full-screen app on your home screen with push notifications, badges and more.
To install this app on iOS and iPadOS
1. Tap the Share icon in Safari
2. Scroll the menu and tap **Add to Home Screen**.
3. Tap **Add** in the top-right corner.
To install this app on Android
1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
2. Tap **Add to Home screen** or **Install app**.
3. Confirm by tapping **Install**.
[Tuts 4 YouA Reverse Engineering Community](https://forum.tuts4you.com/)
- Sign In
1. ## [Community Links](https://forum.tuts4you.com/forum/163-community-links/) Toggle this category
1. [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
### [Terms, Privacy Policy & Frequently Asked Questions](https://forum.tuts4you.com/forum/45-terms-privacy-policy-frequently-asked-questions/)
Very important! Please read before sign up and posting...
- [Collection 2011](https://forum.tuts4you.com/forum/157-collection-2011/)
- [Downloads](https://forum.tuts4you.com/forum/152-downloads/)
- [Website Archives](https://forum.tuts4you.com/forum/162-website-archives/)
- [Telegram](https://forum.tuts4you.com/forum/158-telegram/)
1,065,525 visits to this link
2. ## [Community Discussions](https://forum.tuts4you.com/forum/52-community-discussions/) Toggle this category
1. [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
### [General Discussions and Off Topic](https://forum.tuts4you.com/forum/2-general-discussions-and-off-topic/)
General and off-topic conversations and discussions here...
- 15.9k posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[whoknows News!](https://forum.tuts4you.com/topic/42778-whoknows-news/ "whoknows News!")
Erich Gropper,
[8 hours ago8 hr](https://forum.tuts4you.com/topic/42778-whoknows-news/ "Go to last post")
2. [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
### [Scene News and Chit-Chat](https://forum.tuts4you.com/forum/3-scene-news-and-chit-chat/)
Discussions covering scene news and changes...
- [Artscene Community](https://forum.tuts4you.com/forum/48-artscene-community/)
- [Artscene Downloads](https://forum.tuts4you.com/forum/156-artscene-downloads/)
- 11k posts
![RADIOX](https://forum.tuts4you.com/uploads/monthly_2023_02/smiley-512x512.png.06f6c7c710fa87ef8d43485a836b9244.thumb.png.83e1875ac487169c4eef314c734b235e.png)
[52pojie](https://forum.tuts4you.com/topic/46159-52pojie/ "52pojie")
RADIOX,
[August 18Aug 18](https://forum.tuts4you.com/topic/46159-52pojie/ "Go to last post")
3. [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
### [Site Bug Reports and Feedback](https://forum.tuts4you.com/forum/39-site-bug-reports-and-feedback/)
Bugs, feedback and ideas regarding this site...
- 2.3k posts
![Teddy Rogers](https://forum.tuts4you.com/uploads/monthly_2024_01/1646824.thumb.png.42f4192982a5236fe8671e0b7ef441a6.png)
[Unplanned Outage](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Unplanned Outage")
Teddy Rogers,
[April 30Apr 30](https://forum.tuts4you.com/topic/46028-unplanned-outage/ "Go to last post")
3. ## [Developers Forums](https://forum.tuts4you.com/forum/143-developers-forums/) Toggle this category
1. [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
### [Programming and Coding](https://forum.tuts4you.com/forum/47-programming-and-coding/)
Programming and coding tips, help and solutions...
- 13k posts
![Raggy](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23626dc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Realistic Water Effect When Touched by Mouse.](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Realistic Water Effect When Touched by Mouse.")
Raggy,
[Saturday at 11:05 AM1 day](https://forum.tuts4you.com/topic/46135-realistic-water-effect-when-touched-by-mouse/ "Go to last post")
2. [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
### [Programming Resources](https://forum.tuts4you.com/forum/121-programming-resources/)
Share an interesting blog, news page or other resource...
- 475 posts
![whoknows](https://forum.tuts4you.com/uploads/monthly_2024_01/avatar1.thumb.jpg.34724bdfbd3ed5b434bd6f7fc7c097b9.jpg)
[Retrieve all amazing awesomeness from Github](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Retrieve all amazing awesomeness from Github")
whoknows,
[3 hours ago3 hr](https://forum.tuts4you.com/topic/41644-retrieve-all-amazing-awesomeness-from-github/ "Go to last post")
3. [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
### [Software Security](https://forum.tuts4you.com/forum/133-software-security/)
Securing your software against reverse engineering...
- 990 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "VMProtect 3.10.4 vs Themida 3.2.4.52 — Which One Makes Crackers Cry?")
Erich Gropper,
[Friday at 03:44 PM2 days](https://forum.tuts4you.com/topic/46083-vmprotect-3104-vs-themida-32452-which-one-makes-crackers-cry/ "Go to last post")
4. ## [Reverse Code Engineering](https://forum.tuts4you.com/forum/51-reverse-code-engineering/) Toggle this category
1. [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
### [Challenge of Reverse Engineering](https://forum.tuts4you.com/forum/146-challenge-of-reverse-engineering/)
Try a challenge or contribute your own, any platform or operating system...
- [CrackMe](https://forum.tuts4you.com/forum/145-crackme/)
- [KeygenMe](https://forum.tuts4you.com/forum/148-keygenme/)
- [UnPackMe](https://forum.tuts4you.com/forum/147-unpackme/)
- [UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net/)
- 15.1k posts
![hamzadutsher](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2362bcc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EH%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[WinLicense v3.1.3.0 x86 (All Protection Options)](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "WinLicense v3.1.3.0 x86 (All Protection Options)")
hamzadutsher,
[September 14Sep 14](https://forum.tuts4you.com/topic/44125-winlicense-v3130-x86-all-protection-options/ "Go to last post")
2. [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
### [Hardware Reverse Engineering](https://forum.tuts4you.com/forum/124-hardware-reverse-engineering/)
Reverse engineering of circuitry hardware and firmware...
- 259 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "I built an Iomega ZIP100 parallel port emulator (PIC32MZ + USB disk images) – LPT100 project")
Erich Gropper,
[Friday at 03:47 PM2 days](https://forum.tuts4you.com/topic/45979-i-built-an-iomega-zip100-parallel-port-emulator-pic32mz-usb-di[REDACTED]/ "Go to last post")
3. [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
### [Network Security](https://forum.tuts4you.com/forum/122-network-security/)
Discussions on network security, holes, exploits and other issues...
- 455 posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[Why ping doesn't work???](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Why ping doesn't work???")
Erich Gropper,
[Saturday at 03:49 PM1 day](https://forum.tuts4you.com/topic/40521-why-ping-doesnt-work/ "Go to last post")
4. [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
### [Malware Reverse Engineering](https://forum.tuts4you.com/forum/106-malware-reverse-engineering/)
Debugging, disassembling and documenting interesting malware...
- 1.7k posts
![Erich Gropper](https://forum.tuts4you.com/uploads/monthly_2026_09/FB_IMG_1790278751891.thumb.jpg.50dd1b95435c849f38f452d21da47257.jpg)
[How can i extract files from turbo virtualized apps?](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "How can i extract files from turbo virtualized apps?")
Erich Gropper,
[Saturday at 03:52 PM1 day](https://forum.tuts4you.com/topic/43136-how-can-i-extract-files-from-turbo-virtualized-apps/ "Go to last post")
5. [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
### [Reverse Engineering Articles](https://forum.tuts4you.com/forum/93-reverse-engineering-articles/)
Share an interesting blog, news page or other RE related site...
- 2.7k posts
![crap](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23627fc4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EC%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Flare-On 13](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Flare-On 13")
crap,
[23 minutes ago23 min](https://forum.tuts4you.com/topic/46223-flare-on-13/ "Go to last post")
6. [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
### [Employment and Careers](https://forum.tuts4you.com/forum/128-employment-and-careers/)
Discussions on employment and career paths in the industry...
- 213 posts
![zahainesu](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3EZ%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[Experienced Reverse Engineer wanted for RAGE:MP project](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Experienced Reverse Engineer wanted for RAGE:MP project")
zahainesu,
[September 5Sep 5](https://forum.tuts4you.com/topic/46140-experienced-reverse-engineer-wanted-for-ragemp-project/ "Go to last post")
5. ## [Community Projects](https://forum.tuts4you.com/forum/118-community-projects/) Toggle this category
1. [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
### [Scylla Imports Reconstruction](https://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/)
Development and support forum for the Scylla project...
- 506 posts
![Progman](https://forum.tuts4you.com/uploads/monthly_2026_09/progman_profile_512.thumb.png.4d6df774e7197532ec94bc0c33fa4024.png)
[Scylla Imports Reconstruction Source](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Scylla Imports Reconstruction Source")
Progman,
[June 11, 20242 yr](https://forum.tuts4you.com/topic/27191-scylla-imports-reconstruction-source/ "Go to last post")
2. [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
### [x64dbg](https://forum.tuts4you.com/forum/139-x64dbg/)
An open-source x64/x32 debugger for windows...
- 1.3k posts
![remek002](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%2391c462%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ER%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[x64dbg plugin in delphi](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "x64dbg plugin in delphi")
remek002,
[July 2Jul 2](https://forum.tuts4you.com/topic/43648-x64dbg-plugin-in-delphi/ "Go to last post")
3. [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
### [Future Community Projects](https://forum.tuts4you.com/forum/130-future-community-projects/)
Looking for support and interested partners for a future project?
- 154 posts
![Bartosz](https://forum.tuts4you.com/uploads/monthly_2018_05/pelock-120.thumb.png.acaeecdb5611c9d816d72e15da9a5c8c.png)
[REDasm Disassembler](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "REDasm Disassembler")
Bartosz,
[2 hours ago2 hr](https://forum.tuts4you.com/topic/40281-redasm-disassembler/ "Go to last post")
4. [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
### [Community Projects Archive](https://forum.tuts4you.com/forum/141-community-projects-archive/)
Old and inactive projects moved to long term support...
- [uPPP](https://forum.tuts4you.com/forum/120-uppp/)
- [Imports Fixer](https://forum.tuts4you.com/forum/119-imports-fixer/)
- [TitanEngine CE](https://forum.tuts4you.com/forum/138-titanengine-ce/)
- 832 posts
![devsat-dz](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%237062c4%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3ED%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
[TitanHide](https://forum.tuts4you.com/topic/34431-titanhide/ "TitanHide")
devsat-dz,
[December 17, 2025Dec 17](https://forum.tuts4you.com/topic/34431-titanhide/ "Go to last post")
6. ## [The Trashcan](https://forum.tuts4you.com/forum/100-the-trashcan/) Toggle this category
1. [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
### [The Trashcan](https://forum.tuts4you.com/forum/7-the-trashcan/)
This is where all the bad posts go.
**99.9%** of the time it contains crack requests and banned members...
### Member Statistics
- **31,511** Total Members
- **7,713** Most Online
- ![67jkawbgk](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201024%201024%22%20style%3D%22background%3A%23939393%22%3E%3Cg%3E%3Ctext%20text-anchor%3D%22middle%22%20dy%3D%22.35em%22%20x%3D%22512%22%20y%3D%22512%22%20fill%3D%22%23ffffff%22%20font-size%3D%22700%22%20font-family%3D%22-apple-system%2C%20BlinkMacSystemFont%2C%20Roboto%2C%20Helvetica%2C%20Arial%2C%20sans-serif%22%3E6%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E)
**67jkawbgk** Newest Member · 29 minutes ago29 min
- [Existing user? Sign In](https://forum.tuts4you.com/login/)
- [Sign Up](https://forum.tuts4you.com/register/)
Search
Where:
EverywhereTopicsFilesPagesArticle
Search:
Content titles and bodyContent titles only
Date Created:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Use:
All of these wordsAny of these words
Last Updated:
Any datePast 24 hoursPast weekPast monthPast six monthsPast year
Search...
Search
Search
Search by content type
EverywhereTopicsFilesPagesArticle
Find results in
Search titles and bodySearch titles only
Date Created
Created any timeCreated past 24 hoursCreated past weekCreated past monthCreated past 6 monthsCreated past year
Last Updated
Updated any timeUpdated past 24 hoursUpdated past weekUpdated past monthUpdated past 6 monthsUpdated past year
Close
#### Configure browser push notifications
Close
Chrome Safari Edge Firefox
##### Chrome (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions → Notifications**.
3. Adjust your preference.
##### Chrome (Desktop)
1. Click the padlock icon in the address bar.
2. Select **Site settings**.
3. Find **Notifications** and adjust your preference.
##### Safari (iOS 16.4+)
1. Ensure the site is installed via **Add to Home Screen**.
2. Open **Settings App → Notifications**.
3. Find your app name and adjust your preference.
##### Safari (macOS)
1. Go to **Safari → Preferences**.
2. Click the **Websites** tab.
3. Select **Notifications** in the sidebar.
4. Find this website and adjust your preference.
##### Edge (Android)
1. Tap the lock icon next to the address bar.
2. Tap **Permissions**.
3. Find **Notifications** and adjust your preference.
##### Edge (Desktop)
1. Click the padlock icon in the address bar.
2. Click **Permissions for this site**.
3. Find **Notifications** and adjust your preference.
##### Firefox (Android)
1. Go to **Settings → Site permissions**.
2. Tap **Notifications**.
3. Find this site in the list and adjust your preference.
##### Firefox (Desktop)
1. Open Firefox Settings.
2. Search for **Notifications**.
3. Find this site in the list and adjust your preference.

124
research-what-we-did/gh-reverse-catalog.json Normal file
View File

@@ -0,0 +1,124 @@
{
"generated": "2026-09-27T01:18:41+00:00",
"repos": [
{
"url": "https://github.com/open-free-llm-api/awesome-freellm-apis",
"stars": 3372,
"updated": "2026-09-27T01:05:15Z",
"desc": "134+ free LLM APIs & AI API keys from 40+ providers. Google Gemini, NVIDIA NIM, Groq, OpenRouter & more. One-click setup for Claude Code, Cursor and Codex.",
"category": "claude"
},
{
"url": "https://github.com/dwgx/WindsurfAPI",
"stars": 3039,
"updated": "2026-09-26T15:55:20Z",
"desc": "Turn Windsurf / Devin Desktop's 100+ AI models (Claude, GPT, Gemini, DeepSeek, Kimi, GLM, SWE) into OpenAI-, Anthropic- & Gemini-compatible APIs. Zero-dependency self-hosted reverse proxy for Claude Code, Cline & Cursor. 把 Windsurf/Devin 云端 100+ 模型变成三套兼容 API。",
"category": "windsurf"
},
{
"url": "https://github.com/caozhiyuan/copilot-api",
"stars": 1049,
"updated": "2026-09-27T01:01:48Z",
"desc": "GitHub Copilot, OpenAI Codex, OpenCode Go, and third-party AI provider gateway with OpenAI and Anthropic API compatibility.",
"category": "copilot"
},
{
"url": "https://github.com/sylearn/AIUsage",
"stars": 686,
"updated": "2026-09-26T10:31:59Z",
"desc": "One dashboard to manage all your AI subscriptions — track quotas, costs, accounts, Claude Code proxy, and Codex proxy in one place.",
"category": "claude"
},
{
"url": "https://github.com/raine/claude-code-proxy",
"stars": 620,
"updated": "2026-09-26T23:20:02Z",
"desc": "Use Claude Code with your ChatGPT, Kimi, Cursor or Grok subscription via a local Anthropic-compatible proxy",
"category": "claude"
},
{
"url": "https://github.com/timgordontg/engrim",
"stars": 291,
"updated": "2026-09-26T17:35:55Z",
"desc": "The Universal Cross-Model Episodic Memory Standard. Local-first, project-scoped SQLite engine for Google Antigravity, Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, and OpenCode. Zero cloud lock-in.",
"category": "copilot"
},
{
"url": "https://github.com/ClawLabsAI/free-ai-models",
"stars": 159,
"updated": "2026-09-27T00:20:17Z",
"desc": "Daily-updated list of free AI models (free LLM APIs), ranked by quality with live status. Plus one OpenAI-compatible endpoint that routes to the best one.",
"category": "gpt"
},
{
"url": "https://github.com/baicaigpt/FreeGPT_FreeApiKey",
"stars": 35,
"updated": "2026-08-21T07:32:47Z",
"desc": "🚀 白菜GPT|OpenAI中转APIKEY🚀 https://baicaigpt.com 🔥官方价格1:1🔥 1￥购买1$ Token 🔥便宜好用白菜价！🔥|国内直连|无需代理|高速稳定|gpt3.5|gpt4|gpt4o|gpt4omin",
"category": "gpt"
},
{
"url": "https://github.com/mvalentsev/awesome-free-ai-coding",
"stars": 33,
"updated": "2026-09-26T13:28:06Z",
"desc": "📡 Legal free LLM APIs & coding agents — self-updating, probe-verified twice a week. Free tiers, no-card trials, free models.",
"category": "other-free"
},
{
"url": "https://github.com/nherx/free-llm-api-resources",
"stars": 30,
"updated": "2026-09-27T00:15:37Z",
"desc": "🤖 Discover free API access and credits for various legitimate large language model services in one curated resource list.",
"category": "other-free"
},
{
"url": "https://github.com/sozercan/vekil",
"stars": 21,
"updated": "2026-09-26T21:55:20Z",
"desc": "🧑‍💼 AI gateway exposing Anthropic, Gemini, and OpenAI-compatible APIs, backed by GitHub Copilot, OpenAI Codex, Microsoft Foundry, and compatible model servers",
"category": "copilot"
},
{
"url": "https://github.com/ai-dev-2024/Antigravity-Claude-Code-Proxy",
"stars": 13,
"updated": "2026-09-23T20:22:01Z",
"desc": "Local multi-provider gateway for using Claude Code with Gemini, GPT, Grok, and other models, with account rotation and monitoring.",
"category": "antigravity"
},
{
"url": "https://github.com/imbuxiangnan-cyber/windsurf-api",
"stars": 7,
"updated": "2026-06-29T08:42:06Z",
"desc": "Turn your Windsurf subscription into an OpenAI/Anthropic-compatible API server",
"category": "windsurf"
},
{
"url": "https://github.com/happyyboxx/free-llm-atlas",
"stars": 7,
"updated": "2026-09-26T10:35:50Z",
"desc": "Free LLM Atlas — Curated atlas of 46+ free LLM API platforms with automated probing, structured data, and gateway configs",
"category": "other-free"
},
{
"url": "https://github.com/ai-resource-radar/ai-resource-radar",
"stars": 5,
"updated": "2026-09-26T06:09:24Z",
"desc": "Daily-verified free LLM APIs, AI token prices, and GPU compute deals with no-card filters, official evidence, and a local-first dashboard.",
"category": "other-free"
},
{
"url": "https://github.com/the-long-ride/QuotaShift",
"stars": 1,
"updated": "2026-09-26T21:25:16Z",
"desc": "A tauri desktop app for monitoring AI subscription quota usage, switching account with 1 click and pooling Codex usage. Support Codex, Antigravity & Claude. Guardrails usage for Claude.",
"category": "antigravity"
},
{
"url": "https://github.com/devasheeshG/claude-code-proxy",
"stars": 0,
"updated": "2026-09-26T11:53:03Z",
"desc": "Self-hosted multi-account Claude Code proxy with priority routing, quota-aware failover, user policies, observability, and a management dashboard.",
"category": "claude"
}
]
}

586
research-what-we-did/rea-full-course-source.md Normal file
View File

@@ -0,0 +1,586 @@
# Реверс-инжиниринг: как получить что угодно БЕСПЛАТНО с самым опасным репо и Opus 5.5 — полный курс
![](https://pbs.twimg.com/media/HUbbxvhXIAAugl8.jpg)
REA + Opus 5.5: полный курс
REA — самая опасная вещь в интернете прямо сейчас, и 99% людей понятия не имеют, как ей пользоваться.
Ты каждый месяц платишь за приложения, чьи функции уже лежат на твоём компьютере.
Motion-design приложения. Office. TradingView. Твой блокнот и остальные — всё это просто код на диске.
И каждая компания ставит на одно: что ты никогда не заглянешь внутрь.
Теперь один open-source репо даёт твоему Claude Code тот же навык — одной командой.
За три дня это разлетелось везде. «Софт закончился». «Closed source мёртв».
Большинство посмотрели скриншоты, кинули в закладки — и так ничего и не попробовали.
Поэтому в этом полном курсе показываю всё простыми словами:
- что такое реверс-инжиниринг на самом деле
- что REA умеет читать — от десктопных приложений до игр
- честный ответ на «разве это не воровство?»
- как установить пошагово, прямо по официальным докам
- что люди уже пересобрали: Adobe, Office, TradingView, игры
- как это каждый день использует обычный человек и профи
- пак промтов, которые можно копипастить
Так что сохрани, открой терминал и проходи шаг за шагом.
* * *
### Часть 1 — Понять
#### 01. Что такое реверс-инжиниринг (и что такое REA)
Реверс-инжиниринг на самом деле прост.
> Берёшь готовое приложение и разбираешься, как оно работает внутри — без его исходников.
Вот и всё. Ты хочешь понять фичу настолько, чтобы объяснить её, изменить или собрать собственную версию.
REA (Reverse Engineer Anything) делает ровно это, причём тяжёлую часть выполняет твой AI-агент. Официальный README описывает это одной строкой:
> «Увидел фичу, которая нравится. Понял, как она работает — вплоть до бинарного уровня».
Технически это:
- MCP-сервер + CLI, который подключается к Claude Code, Codex, Cursor, Gemini CLI и другим агентам
- работает локально. Твои приложения никуда не загружаются
- каждый вывод идёт с доказательством: функция, файл, вызов — и что ещё осталось неизвестным
Ты спрашиваешь обычными словами. REA исследует программу. Агент объясняет её, собирает твою версию и тестирует. [Репо REA](https://github.com/morluto/rea)
Лучший пример — на официальном сайте. Почему калькулятор Windows показывает 220, когда вводишь 200 + 10%?
Без REA пришлось бы вручную декодировать ветки и трейсить вызовы. С REA ты просто спрашиваешь.
Ответ прямо из кода: после + кнопка % берёт процент от первого числа. 10% от 200 это 20, значит 200 + 20 = 220. А после × те же 10% просто превращаются в 0.1. [rea.tools](https://rea.tools/)
Или почему динозаврик в Chrome ускоряется: скорость стартует с 6, каждый апдейт добавляет 0.001 и останавливается на 13.
> Ты не читаешь код. Ты задаёшь вопрос — и получаешь правило.
REA — open source под MIT, сделал [@morluto](https://x.com/morluto). Первый релиз вышел 12 июля 2026. Через три месяца — 100K+ звёзд на GitHub.
* * *
#### 02. Что REA умеет читать
Официальный список, переведённый на человеческий ([что можно анализировать](https://github.com/morluto/rea#what-you-can-analyze)):
- Десктопные приложения на JavaScript/Electron (Notion, Slack, Discord, Obsidian и ещё куча). Ничего дополнительно ставить не нужно
- Сайты: структура страниц, скрипты, сетевые запросы. Нужен браузер семейства Chrome
- Сохранённый сетевой трафик (HAR-файлы из твоего браузера)
- Программы и игры (.exe, Mac-приложения, старые DOS-игры): псевдокод, ассемблер, строки, вызовы. Нужен Ghidra, Hopper или IDA
- .NET-приложения: никаких доп. тулов
- Android-приложения (APK): нужны JDK и JADX
- Байткод смарт-контрактов: Linux x64
- Прошивки, WASM, Go-бинарники и многое другое
А вот часть, о которой почти никто не говорит:
Многие Unity-игры поставляют игровую логику как .NET-код. И REA читает .NET вообще без дополнительных инструментов.
Именно так один человек взял купленную им игру из Steam и открыл её в Unity меньше чем за 30 минут.
То есть теперь агент делает за тебя всю работу.
* * *
#### 03. Подождите… это же просто воровство?
Поговорим о слоне в комнате.
В момент, когда REA завирусилась, половина X кричала «пиратство», а вторая половина — «софт умер».
Chamath вообще сказал на All-In, что люди «декомпилировали» весь пакет Adobe.
И вот смешная часть. Этот фрагмент получил Community Note:
> Альтернативы Adobe не были декомпилированы. Их разработчик называет их clean-room реимплементациями.
Эта одна заметка объясняет всю юридическую игру. Разберём clean room, потому что когда поймёшь — всё встанет на места.
**Clean room — трюк, которому 40 лет.**
Шаг 1: одна команда изучает оригинал и записывает, что он делает. Не код. Поведение.
Шаг 2: другая команда строит новый продукт только по этому описанию. Оригинальный код она не видит никогда.
Результат делает то же самое, но содержит ноль строк кода оригинала. [Clean-room design](https://en.wikipedia.org/wiki/Clean-room_design)
Так родилась индустрия PC. В начале 80-х Compaq таким способом пересобрала BIOS IBM — за примерно $1 млн. Поэтому «IBM-совместимые» PC других брендов вообще существуют.
И суды продолжали поддерживать реверс-инжиниринг:
- ['1992, ', {'tag': 'b', 'children': ['Sega v. Accolade']}, '. Accolade разобрала игры Sega Genesis, чтобы делать свои совместимые игры. Суд признал: разбор кода может быть добросовестным использованием, если это единственный способ понять, как он работает. ', {'tag': 'a', 'attrs': {'href': 'https://en.wikipedia.org/wiki/Sega_v._Accolade'}, 'children': ['Sega v. Accolade']}]
- ['2000, ', {'tag': 'b', 'children': ['Sony v. Connectix']}, '. Sony проиграла со счётом 3-0. Финальный эмулятор не содержал ни строчки кода Sony.']
Но у истории есть и вторая сторона.
В 2010-2011 хакеры сломали защиту PS3 и опубликовали её root-ключ. Sony подала в суд на Джорджа Хотца (geohot), и в апреле 2011 он заключил мировую и согласился больше не взламывать продукты Sony. [TechSpot](https://www.techspot.com/news/43246-sony-and-geohot-settle-over-ps3-hacking-lawsuit.html)
**Мой честный взгляд:**
- Читать приложение на собственном компьютере, чтобы понять его — это учёба
- Пересобирать фичу по её поведению, в собственном коде — так индустрия работала всегда
- Копировать их код, крякать платные функции или публиковать чужой декомпилированный сорс — вот за это прилетает иск
Команда REA сама говорит прямо: это для законных исследований, образования, совместимости, сохранения софта — и для программ, которыми ты владеешь или которые тебе разрешено изучать. [Disclaimer](https://github.com/morluto/rea#disclaimer)
**Изучай оригинал. Выпускай своё. **Это правило для всего в этой статье.
* * *
### Часть 2 — Установить
#### 04. Установка REA за 5 минут
Проходи по порядку. [Get started](https://rea.tools/get-started/)
**Шаг 1. Проверь Node.js**
Открой терминал и запусти:
```
node -v
npm -v
```
Нужен Node 22.19+, 24.11+ или 26+. Версии 23 и 25 не поддерживаются.
Если версия старше или «command not found» — ставь Node 24 LTS:
macOS (с Homebrew):
```
brew install node
```
macOS (без Homebrew):
```
curl -fsSL https://fnm.vercel.app/install | bash
```
Закрой терминал, открой снова, затем:
```
fnm install 24
fnm default 24
```
Windows (PowerShell):
```
winget install OpenJS.NodeJS.LTS
```
Если спросит — нажми Y. Закрой PowerShell, открой заново, запусти node -v.
Если Windows потом скажет «запуск сценариев отключён», выполни один раз:
```
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
```
**Шаг 2. Нужен агент**
Я использую Claude Code. Ему нужен платный план Claude. Страница установки: [code.claude.com/docs/en/setup](https://code.claude.com/docs/en/setup)
Codex, Cursor, Gemini CLI, OpenCode и другие тоже работают.
**Шаг 3. Запусти установку REA**
Самый простой способ — вставь это в Claude Code и дай ему сделать всё самому:
```
Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.
```
Или запусти сам:
```
npx rea-agents@latest setup
```
Что произойдёт дальше:
- npm попросит скачать пакет — соглашайся
- REA покажет список агентов. Выбирай Claude Code
- REA покажет план всех изменений, которые внесёт. Ничего не меняется, пока не подтвердишь. Текущий конфиг тоже бэкапится
- Добавляется MCP-подключение плюс соответствующий скилл расследования
Установка также предложит Hopper — отдельный движок для чтения программ. На Mac она скачает официальный инсталлятор и откроет его, там выбери demo-режим. Это опционально, можно пока отказаться.
**Шаг 4. Перезапусти агента**
- Claude Code в терминале: выйди и начни новую сессию
- Десктопные приложения (Claude Desktop, Cursor): выйди полностью через ⌘Q. Закрыть окно — недостаточно
**Шаг 5. Проверь**
```
npx -y rea-agents@latest doctor --client claude_code --json
```
doctor только проверяет и ничего не меняет. Если что-то отвалилось — он скажет следующий шаг.
Хочешь короткую команду rea навсегда:
```
npm install --global rea-agents
rea --help
```
Результат: в Claude Code появились инструменты REA. Спроси «какие у тебя есть REA-тулы?» — и он перечислит их.
* * *
#### 05. Твой первый реверс-инжиниринг за 2 минуты
Не начинай с чего-то огромного. У REA есть официальное тренировочное приложение — [First investigation](https://rea.tools/first-investigation/)
Это крошечное приложение «Заметки» с кнопкой Export notes. Твоя задача: выяснить, куда уходит экспорт.
Вставь в Claude Code:
```
Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.
```
Потом спроси:
```
Show where notes.csv is written, which fields it contains, and the relevant files and lines.
```
Что должно прийти обратно — полный путь одного клика:
- Страница (renderer.js) обрабатывает кнопку
- Мост (preload.js) отправляет сообщение notes:export
- Хендлер (main.js) пишет notes.csv в твою папку Downloads с полями id и title
> Поздравляю. Это и есть реверс-инжиниринг.
Ты только что проследил фичу внутри приложения, которое не писал, — и каждый шаг пришёл с доказательством.
А теперь весёлая часть. Каждое Electron-приложение на твоём компе устроено так же, и ты знаешь, где оно живёт:
- Mac: /Applications/<App>.app/Contents/Resources/app.asar (правый клик по приложению → Show Package Contents)
- Windows: C:\Users\<ты>\AppData\Local\Programs\<App>\resources\app.asar
- Linux: часто /opt/<App>/resources/app.asar
И можно анализировать прямо из терминала, вообще не запуская приложение:
```
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
```
Совет: на Mac зажми Option, кликни правой по папке и выбери «Copy as Pathname». Или просто перетащи папку в терминал.
* * *
#### 06. Добавь нужный движок под свою задачу
Десктопным JavaScript-приложениям больше ничего не нужно. Для всего остального добавь один движок.
**Программы и игры: Ghidra **(бесплатно, сделано в АНБ). Нужен Ghidra 12.1.x и JDK 21 или новее.
macOS / Linux:
```
export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup
```
Windows PowerShell:
```
$env:GHIDRA_INSTALL_DIR = "C:/tools/ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:/tools/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup
```
Поддержка Windows пока экспериментальная и только на чтение.
Потом смотри любую функцию:
```
npx -y rea-agents@latest function /absolute/path/to/program main --provider ghidra --json
```
**Программы и игры: Hopper **(Mac/Linux, коммерческий, есть демо). Просто запусти setup ещё раз. Он найдёт Hopper или предложит установить. На Mac при первом запуске выбери demo-режим или свою лицензию.
**Программы и игры: IDA **(если уже куплен). Проверено на Windows через существующую настройку IDA MCP. [Get started](https://rea.tools/get-started/)
**Android-приложения: **полный JDK 17+ и jadx-headless-mcp 0.7.1. [Гайд по Android](https://github.com/morluto/rea/blob/main/docs/android-analysis.md)
```
export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar
rea inspect-android-package /path/App.apk
```
**Сайты: **любой браузер семейства Chrome.
**Смарт-контракты: **Linux x64.
Держи обновлённым (REA выкатывает фиксы почти каждый день):
```
rea update
```
или npx rea-agents@latest setup. Удалить: rea uninstall.
Если агент не видит REA: перезапусти его, потом снова запусти doctor --client claude_code --json.
* * *
### Часть 3 — Что люди уже пересобрали
#### 07. Adobe, Office, TradingView и игры
Вот где начинается жесть.
AI не просто научился читать софт. Люди уже пересобирают целые продукты.
**Adobe**
ArtCraft пересобрал семь приложений Adobe как бесплатные open-source альтернативы: Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign и Acrobat. Написано на Rust с помощью Claude Opus 5.5.
Помнишь clean room? Вот оно. ArtCraft называет их clean-room реимплементациями — без исходного кода Adobe. Это пока ранняя альфа, но они существуют и они бесплатны.
**Microsoft Office**
Потом взялись за Office. WordCraft, GridCraft и DeckCraft: Word, Excel и PowerPoint.
**TradingView**
Этот кейс люблю. Смаппить, как платформа себя ведёт, превратить это в спеку с помощью Opus 5.5, а потом построить собственный движок графиков и бэктестер — своим кодом.
Одна честная заметка: строить свой терминал — нормально. Бесплатно юзать чужие платные индикаторы — нет. Строй свои.
**Игры**
Здесь AI-реверс-инжиниринг рванул первым.
Нативный PC-порт Super Mario Sunshine: около 365 агенто-часов и 17.3 млрд токенов, использовались и Claude, и Codex. [Репозиторий](https://github.com/chasem-dev/sms-pc-port)
Игра Tomba! с PS1 теперь работает на PC через статический рекомпилятор. У автора не было никакого prior-опыта, он использовал Claude Code + Ghidra около трёх недель. [Разбор](https://1379.tech/i-built-a-ps1-static-recompiler-with-no-prior-experience-and-claude-code/)
А в официальном блоге REA один человек с AI-агентами пересобрал игру Touhou: 697 функций, 696 точных совпадений, играбельно примерно за 12 дней. [Индустриальная революция в реверс-инжиниринге](https://rea.tools/blog/touhou-reconstruction/)
Kotaku даже писал про браузерные версии Halo, GTA: Vice City и The Simpsons: Hit & Run, которые приписывают AI-помощи в декомпиляции. Это неофициальные порты, и их, скорее всего, снесут takedown-ами — это ровно та граница из главы выше. [Kotaku](https://kotaku.com/we-might-be-cooked-as-these-vibe-coded-web-browser-ports-of-halo-the-simpsons-hit-and-run-and-gta-vice-city-seem-to-work-perfectly-2000743300)
**Как повторить любое из этого: **выбери тул, за который платишь, или игру, которой владеешь; спроси у REA, как работает одна фича; напиши спеку; собери свою версию. Промты — в шаге 10.
* * *
### Часть 4 — Используй каждый день
Реверс-инжиниринг придумали для совместимости, безопасности и сохранения софта. Но вот как я бы использовал его в обычной жизни.
#### 08. Для новичков
**1. «Что это приложение реально делает на моём телефоне?»**
Возьми APK любого Android-приложения: твоего брокера, твоей биржи, того самого приложения «бесплатных сигналов» из Telegram. И спроси:
```
Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.
```
Официальное доказательство, что это работает: REA разобрала приложение-аутентификатор Aegis (3 077 классов), нашла в точности, как оно генерирует 6-значные коды входа, и пересобрала его. Пересборка прошла все 133 тест-кейса. [Кейс Aegis](https://rea.tools/showcase/aegis/)
**2. «Этот файл безопасен?»**
Реверс-инжиниринг — это как раз то, чем ловят малварь. Когда по сети ходила фейковая «сборка GTA 6» на 113 ГБ, человек, который разобрал файлы, обнаружил, что это фейк, набитый малварью.
**3. «Этот токен — скам?»**
Большинство мемкоинов не публикуют исходники. REA читает сырой байткод контракта и восстанавливает его функции. [Гайд по EVM](https://github.com/morluto/rea/blob/main/docs/evm-bytecode.md)
```
rea inspect-evm-interface ./runtime.hex hex --json
```
Потом спроси:
```
Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.
```
Имена функций здесь — догадки из байткода, поэтому к красному флагу относись как к «проверь глубже». И эта команда пока работает только на Linux x64.
**4. «Хочу ту платную фичу»**
Не крякай её. Пересобери. Спроси у REA, как фича работает, потом дай Claude собрать твою собственную версию из публичных данных и open-source частей.
* * *
#### 09. Для профи
В REA встроены guided-воркфлоу, о которых почти никто не знает. Они зашиты в MCP-сервер ([Guided prompts](https://github.com/morluto/rea/blob/main/docs/mcp-prompts.md)):
- [{'tag': 'b', 'children': ['investigate_feature']}, ': проследить фичу от обнаружения до конкретных функций']
- [{'tag': 'b', 'children': ['compare_application_versions']}, ': сравнить два релиза приложения и увидеть, что реально изменилось в апдейте']
- [{'tag': 'b', 'children': ['verify_reconstruction']}, ': проверить свою пересборку против сохранённых доказательств']
- [{'tag': 'b', 'children': ['trace_crash']}, ': связать креш с путями кода за ним']
- [{'tag': 'b', 'children': ['audit_residual_unknowns']}, ': перечислить, что всё ещё не доказано']
- [{'tag': 'b', 'children': ['prepare_bounded_process_capture']}, ': спланировать безопасный ограниченный runtime-эксперимент до того, как что-либо запускать']
Цикл профи: **investigate → spec → build → verify**
```
Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.
```
Насколько далеко это заходит — из официальных показов:
- ['DX-Ball (1996): REA восстановила функцию sound-pan и пересобрала её на C. Проходит 3 205 тест-кейсов оригинального x86 и воспроизводит все 63 байта компиляции. ', {'tag': 'a', 'attrs': {'href': 'https://rea.tools/showcase/dx-ball/'}, 'children': ['DX-Ball']}]
- ['Notion: REA проследила, как работает копирование — от страницы через IPC-мост до системного буфера обмена. ', {'tag': 'a', 'attrs': {'href': 'https://rea.tools/showcase/notion/'}, 'children': ['Notion']}]
И уроки из пересборки Touhou — золото для любого, кто занимается этим серьёзно:
- давай агенту чёткую цель и чёткие критерии приёмки
- держи заметки и проверки в git, чтобы следующая сессия могла продолжить
- относись к любому объяснению агента как к гипотезе, которую надо проверить
- тестируй свои тесты. Однажды сломанное сравнение пропустило неправильную функцию
Безопасники уже гоняют это в промышленных масштабах. Один исследователь собрал AI-пайплайн из 8 MCP-серверов, 300+ инструментов, Ghidra, radare2 и Frida — и говорит, что он окупился через bug bounty.
**Где деньги: **исследования безопасности и bug bounty, перенос старого софта на новые системы, связывание тулов между собой и помощь компаниям в понимании софта, к которому потеряны исходники.
* * *
#### 10. Чего REA не может
Хочу, чтобы этой статье доверяли, поэтому вот реальные ограничения:
- ['Она не может тронуть сервер. Читается только то, что на твоей машине. Код, который крутится на серверах компании, тебе никогда не поставлялся. Банк она не взломает и деньги не переведёт. ', {'tag': 'a', 'attrs': {'href': 'https://rafaelroman.com/articles/ai-reverse-engineering-cant-hack-your-bank/'}, 'children': ['Почему ею нельзя взломать банк']}]
- Декомпилированный код — не оригинальный исходник. Это реконструкция. Поэтому шаг verify так важен
- Сложные цели остаются сложными. Стрипанные C++-бинарники намного жёстче, чем Unity .NET-игры
- Твой агент может отказаться. Некоторые прошивки и консольные цели упираются в правила безопасности модели
- Коммерческим тулам нужны настоящие лицензии. REA не даёт лицензий на IDA, Hopper или JEB, а крякнутые копии запрещены
* * *
#### 11. Пак промтов
Сохрани. Каждый промт работает в Claude Code, когда REA установлена.
**Установка:**
```
Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.
```
**Первый тест:**
```
Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.
```
**Универсальный:**
```
Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.
```
**Real-time фичи:**
```
Figure out how Discord shows who's typing in real time, show me the proof, and build something similar for my project.
```
**Калькулятор:**
```
Use REA to inspect Windows Calculator's % button. Recover the rules after + and ×, then build a small calculator that uses both.
```
**Игра:**
```
Inspect the dinosaur game and build a version with adjustable speed.
```
**Реконструировать игру:**
```
Reconstruct a game from its executable and test it against the original.
```
**Клонировать сайт:**
```
Clone the rea.tools website.
```
**Аудит мобильного приложения:**
```
Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.
```
**Проверка токена:**
```
Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.
```
**Профи-пересборка:**
```
Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.
```
**Что изменилось в апдейте:**
```
Use REA's compare_application_versions workflow on [old version] and [new version] of [app]. Tell me what actually changed, with evidence.
```
* * *
#### Твой протокол на один вечер
Не просто кидай в закладки. Сделай это сегодня вечером:
- Установи REA сетап-промтом (5 мин)
- Потренируйся на официальном примере Notes (2 мин)
- Выбери одно приложение на компе, которым пользуешься каждый день
- Задай один вопрос про одну фичу, которая тебе нравится
- Получи спеку: что она делает, шаг за шагом, с доказательствами
- Собери свою версию из спеки в новой папке
Вот и всё. Один вечер — и ты больше никогда не будешь смотреть на софт по-прежнему.
* * *
### Сдвиг
> Closed source раньше означало «ты никогда не узнаешь» → теперь означает «покажи мне доказательства».
> REA — не хакерский инструмент.
> Это инструмент чтения софта, который написал не ты.
И настоящая альфа — не 100K звёзд и не вирусные скриншоты.
Настоящая альфа в том, что каждая фича, которой ты завидовал в чужом приложении, теперь — то, что ты можешь понять:
- Пусть REA найдёт фичу и доказательства
- Пусть Claude напишет спеку и соберёт твою версию
- Пусть тесты докажут, что это работает
Большинство продолжит платить за фичи, которые можно понять за один вечер.
Те немногие, кто научится читать софт, смогут собрать что угодно. Абсолютно бесплатно.

24
research-what-we-did/rev-guide-v4-subpost.md Normal file
View File

@@ -0,0 +1,24 @@
🩸 К ГАЙДУ: КАК ЕГО ПРОЙТИ
Гайд проверен целиком: все 102 ссылки живые, цифры (звёзды, число тулов, названия репозиториев и книг) сверены с первоисточниками, лицензионные ограничения помечены. Сверху добавлен раздел про лицензию IDA — в исходных версиях такого гайда его нет.
🩸 ПЕРВЫЕ 7 ДНЕЙ
Весь стек сразу не осилить — и не надо. Минимальный старт:
1. Ghidra (https://github.com/NationalSecurityAgency/ghidra) + 2–3 задачи 1☆ с crackmes.one (https://crackmes.one/)
2. godbolt.org (https://godbolt.org/) — написал функцию на C → разобрал её ассемблер
3. x64dbg (https://x64dbg.com/) — своя программа: бряк, стек, регистры
Потом pwn.college (https://pwn.college/) — система и автопроверка.
🩸 ЧЕТЫРЕ ГВОЗДЯ
- ИИ-агент декомпилирует и ходит по xrefs, но уверенно ошибается в именах функций. Крипто, C2, авторизация — только руками
- Упакованный сэмпл = мусор вместо псевдокода: распаковывай до подачи агенту
- «IDA с ключом из телеги» = бинарь, изменённый анонимом. Легально и бесплатно: IDA Free (https://hex-rays.com/ida-free/), Ghidra, студенческая лицензия Hex-Rays
- Строки в бинарнике могут быть промпт-инъекцией против твоего ИИ-ассистента (https://arxiv.org/abs/2605.30667) — малварь уже так умеет
🩸 НЕ СПРИНТ
Маршрут на месяцы: база → инструменты → 30+ crackme → система → пайплайн → ИИ → специализация. Сохраняй гайд и возвращайся к нему по шагам.

194
research-what-we-did/rev-guide-v4.md Normal file
View File

@@ -0,0 +1,194 @@
===MSG 1/4===
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026
Путь от нуля до самостоятельного анализа бинарников: база, инструменты, пайплайн, реверс через ИИ, материалы. Всё бесплатное или с free-версией, лицензионные исключения помечены.
🩸 ШАГ 1. БАЗА
Без базы инструменты не дают результатов:
- C — указатели, память, структуры, строки
- Ассемблер x86-64 — регистры, стек, calling conventions, переходы
- Compiler Explorer (https://godbolt.org/) — пишешь функцию на C, видишь её ассемблер
- Формат PE (https://learn.microsoft.com/windows/win32/debug/pe-format) — заголовки, секции, таблица импортов
Результат: читаешь ассемблерный листинг простой функции.
🩸 ШАГ 2. ИНСТРУМЕНТЫ
- Ghidra (https://github.com/NationalSecurityAgency/ghidra) — дизассемблер + декомпилятор, бесплатный. Основной инструмент для обучения, скриптится на Python через Ghidrathon (https://github.com/mandiant/Ghidrathon)
- x64dbg (https://x64dbg.com/) — отладчик Windows
- Detect It Easy (https://github.com/horsicq/Detect-It-Easy) — определение компилятора, протектора, упаковщика
- HxD (https://mh-nexus.de/hxd/) — hex-редактор
Позже пригодятся: IDA Pro (https://hex-rays.com/) — эталонный декомпилятор Hex-Rays; Binary Ninja (https://binary.ninja/) — API для автоматизации; radare2 (https://github.com/radareorg/radare2) / rizin (https://github.com/rizinorg/rizin) + Cutter (https://github.com/rizinorg/cutter) — консольный стек.
Результат: рабочая среда — Ghidra, x64dbg, DIE.
🩸 ШАГ 3. ПРАКТИКА
Порядок: 15–20 задач 1☆, затем 10–15 задач 2☆, затем 3☆.
- crackmes.one (https://crackmes.one/) — задачи по реверсу, сложность 1–6
- ROP Emporium (https://ropemporium.com/) — exploitation по шагам
Осваиваются: поиск точки входа, паттерн проверки пароля, простые анти-отладочные приёмы.
Результат: самостоятельно разбираешь небольшой бинарь.
🩸 ШАГ 4. СИСТЕМА
- pwn.college (https://pwn.college/) — бесплатные модули от ASU: ассемблер, основы RE, автопроверка, 15–25 задач на модуль
- OpenSecurityTraining2 (https://p.ost2.fyi/) — реверс C++, символьное исполнение, отладчики, UEFI
- RE-MA-Roadmap (https://github.com/x86byte/RE-MA-Roadmap) — roadmap от нуля до malware-аналитика
Результат: системная база для C++ и сложных форматов.
🩸 ШАГ 5. ПАЙПЛАЙН АНАЛИЗА БИНАРЯ
Порядок разбора реальных сэмплов. Перед запуском живого: виртуалка + снапшот, без общих папок и реальной сети.
1. Триаж без запуска: DIE — упаковщик/компилятор; FLOSS (https://github.com/mandiant/flare-floss) — строки, включая обфусцированные; capa (https://github.com/mandiant/capa) — capabilities с маппингом на ATT&CK
2. Распаковка: натив — x64dbg до OEP, дамп, IAT чинит Scylla (https://github.com/NtQuery/Scylla); .NET — de4dot-форк (https://github.com/kant2002/de4dot), разбор в dnSpyEx (https://github.com/dnSpyEx/dnSpy); без запуска на живой системе — Qiling (https://github.com/qilingframework/qiling)
3. Статика: Ghidra/IDA — декомпиляция, xrefs, переименование
4. Динамика: отладчик для проверки гипотез; Frida (https://frida.re/) — хуки на функции, снятие конфигов
5. Деобфускация: D-810 (https://gitlab.com/eshard/d810) — MBA и flattening в декомпиляторе IDA; эмуляция и трейсинг — Unicorn (https://github.com/unicorn-engine/unicorn), Qiling, angr (https://github.com/angr/angr)
6. Поведение: FakeNet-NG (https://github.com/mandiant/flare-fakenet-ng) — перехват трафика; CAPEv2 (https://github.com/kevoreilly/capev2) — сэндбокс; Speakeasy (https://github.com/mandiant/speakeasy) — эмуляция малвари и драйверов без VM
7. Диффинг версий: BinDiff (https://github.com/google/bindiff) / Diaphora (https://github.com/joxeankoret/diaphora) — что изменил вендор, где была дыра
8. Выход: YARA-правило (https://github.com/VirusTotal/yara) — сигнатура; IOC и отчёт
Результат: полный цикл разбора сэмпла — от триажа до YARA-правила.
ШАГ 6 — реверс через ИИ — во 2-м и 3-м сообщениях.
👻 [иишко](https://t.me/AlStack)
===MSG 2/4===
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (2/4)
🩸 ШАГ 6. РЕВЕРС ЧЕРЕЗ ИИ: MCP-СЕРВЕРЫ
Как это работает: агент (Claude Code, Codex, Cursor, Gemini CLI) подключается к дизассемблеру или отладчику через MCP и сам декомпилирует, ходит по xrefs, переименовывает, ставит бряки, снимает конфиги. Роль человека — направлять и валидировать.
IDA Pro:
- ida-pro-mcp (https://github.com/mrexodia/ida-pro-mcp) — 12.3к звёзд, от автора x64dbg: декомпиляция, xrefs, патчи, отладчик (включается ?ext=dbg)
- ida-mcp (https://github.com/HexRaysSA/ida-mcp) — официальный сервер Hex-Rays, MIT, требует IDA 9.4+ (https://docs.hex-rays.com/core/mcp)
- IDA-NO-MCP (https://github.com/P4nda0s/IDA-NO-MCP) — 2к звёзд: выгружает базу IDA в файлы для AI-клиента вместо verbose MCP
- ida-multi-mcp (https://github.com/MeroZemory/ida-multi-mcp) — несколько бинарей в одной сессии: дроппер, пейлоад, C2 рядом
- ida-mcp-rs (https://github.com/blacktop/ida-mcp-rs) — headless-сервер на Rust для пайплайнов
Ghidra:
- GhidraMCP (https://github.com/LaurieWired/GhidraMCP) — 10.2к звёзд, классика от LaurieWired
- ghidra-mcp (https://github.com/bethington/ghidra-mcp) — 4к звёзд: 200+ тулов, GUI-плагин и headless, эмуляция p-code, Docker
- ReVa (https://github.com/cyberkaida/reverse-engineering-assistant) — 840 звёзд, заточен под длинные задачи, минимум потери контекста
- GhidrAssistMCP (https://github.com/symgraph/GhidrAssistMCP) — MCP внутри процесса Ghidra
- GhidraGPT (https://github.com/weirdmachine64/GhidraGPT) — LLM внутри GUI Ghidra
- PyGhidra-MCP (https://github.com/clearbluejar/pyghidra-mcp) — CLI на PyGhidra
- OGhidra (https://github.com/llnl/OGhidra) — от Lawrence Livermore: LLM через Ollama или облачные API; в локальном режиме сэмплы не уходят в облако
radare2 и Binary Ninja:
- radare2-mcp (https://github.com/radareorg/radare2-mcp) — официальный MCP radare2
- r2ai (https://github.com/radareorg/r2ai) — LLM внутри radare2: объяснение функций, нейминг, поиск багов
- binary_ninja_mcp (https://github.com/fosdickio/binary_ninja_mcp) — мост Binja ↔ LLM
- binary-ninja-headless-mcp (https://github.com/mrphrazer/binary-ninja-headless-mcp) — headless, 181 тул
- Rikugan (https://github.com/buzzer-re/Rikugan) — агент внутри IDA и Binja: 60+ тулов, 12 скиллов, Ollama
Отладчики и память:
- x64dbg-mcp (https://github.com/SetsunaYukiOvO/x64dbg-mcp) — управление x64dbg/x32dbg: бряки, регистры, память
- cheatengine-mcp-bridge (https://github.com/miscusi-peek/cheatengine-mcp-bridge) — 1.5к звёзд: Cheat Engine как тул агента — скан памяти, пойнтер-цепочки, структуры
- windbg-mcp (https://github.com/memoryforensics1/windbg-mcp) — kernel-отладка: DbgEng, TTD, KDNET
Малварь, Android, .NET, Python:
- Qu1cksc0pe (https://github.com/CYB3RMX/Qu1cksc0pe) — 2к звёзд, all-in-one малварь-анализ со встроенным MCP
- Reversecore_MCP (https://github.com/sjkim1127/Reversecore_MCP) — radare2, YARA, LIEF, capa, angr, Volatility в одном MCP
- Arkana (https://github.com/JameZUK/Arkana) — 250+ тулов: вся лаба малварь-анализа за одним промптом
- remnux-mcp-server (https://github.com/REMnux/remnux-mcp-server) — дистрибутив REMnux как MCP
- jadx-ai-mcp (https://github.com/zinja-coder/jadx-ai-mcp) — 2.8к звёзд, AI внутри JADX
- apktool-mcp-server (https://github.com/zinja-coder/apktool-mcp-server) — Smali, ресурсы, пересборка APK
- de4py (https://github.com/Fadi002/de4py) — деобфускация Python + Ollama (CC BY-NC)
- disrobe (https://github.com/1-3-7/disrobe) — мультитул-деобфускатор: PyArmor, PyInstaller, obfuscator.io, UPX, WASM + MCP (платно для компаний)
- TriageMCP (https://github.com/eversinc33/TriageMCP) — быстрый статический триаж PE
Скиллы и агенты — в 3/4.
👻 [иишко](https://t.me/AlStack)
===MSG 3/4===
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (3/4)
🩸 ШАГ 6 (ПРОДОЛЖЕНИЕ). СКИЛЛЫ
Скилл = SKILL.md с методикой: агент получает не тул, а порядок действий. Кладётся в ~/.claude/skills: Claude Code, Codex, Cursor, Gemini CLI.
- reverse-skill (https://github.com/zhaoxuya520/reverse-skill) — 37.9к звёзд, роутер: маршрутизирует задачу — apk, ida, radare2, binary-ninja, dotnet, js, малварь + CTF-оркестратор на 42 скилла
- Anthropic-Cybersecurity-Skills (https://github.com/mukul975/Anthropic-Cybersecurity-Skills) — 33.4к звёзд: 817 скиллов по 34 доменам, привязка к ATT&CK, D3FEND, NIST CSF
- ctf-skills (https://github.com/ljagiello/ctf-skills) — 3.3к звёзд: pwn, crypto, reverse, forensics, OSINT
- android-reverse-engineering-skill (https://github.com/SimoneAvogadro/android-reverse-engineering-skill) — 7.9к звёзд: APK/XAPK, call chains, Retrofit/OkHttp
- skills от Trail of Bits (https://github.com/trailofbits/skills) — 7.2к звёзд: security research, поиск уязвимостей, аудиты
- Claude-Red (https://github.com/SnailSploit/Claude-Red) — 6.9к звёзд: offensive-скиллы от SQLi до EDR evasion
- Claude-Code-CyberSecurity-Skill (https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill) — 22 скилла: реверс, threat hunting, purple team
- open-reverselab (https://github.com/LING71671/open-reverselab) — 1.2к звёзд: 100+ MCP-тулов Ghidra/Frida/x64dbg/Rizin + база знаний на 180+ статей
- REA (https://github.com/morluto/rea) — агент + скилл: от поведения приложения до нативных бинарей, управление evidence
Скиллы тоже атакуют: SkillSpector (https://github.com/NVIDIA/SkillSpector) от NVIDIA — 18.4к звёзд, сканер скиллов перед установкой: промпт-инъекции, эксфильтрация, supply-chain.
🩸 АГЕНТЫ
- agentic-malware-analysis (https://github.com/mrphrazer/agentic-malware-analysis) — Docker: Kali, 50+ RE-тулов, MCP-дизассемблеры. Бинарь на входе — структурный отчёт на выходе
- auto-re-agent (https://github.com/Dryxio/reagent) — 2к звёзд: реконструирует C/C++ из бинаря, генерирует кандидатов, собирает и гоняет тесты на паритет
- reverify (https://github.com/2akouwu/reverify) — 1.2к звёзд: слой проверки — агент предлагает, детерминированные тулы сверяют каждое утверждение с бинарём
- firefox-reverse (https://github.com/WhiteNightShadow/firefox-reverse) — 857 звёзд: Firefox со встроенным AI-реверс-агентом, трейс на уровне движка
- anything-analyzer (https://github.com/Mouseww/anything-analyzer) — 3.7к звёзд: воркстейшн — браузер + MITM + хуки + AI
- FIRERPA (https://github.com/firerpa/lamda) — 8.4к звёзд: полный контроль Android-устройств, Frida, MITM, 160+ API
- shannon (https://github.com/KeygraphHQ/shannon) — 48к звёзд, AI-пентестер веба и API (смежное)
🩸 ДАТАСЕТЫ И БЕНЧМАРКИ
- mcp-reversing-dataset (https://github.com/mrexodia/mcp-reversing-dataset) — задачи реверса, решённые LLM: тренировка и eval
- AgentRE-Bench (https://github.com/agentrebench/AgentRE-Bench) — бенчмарк LLM-реверса
- CrackMeBench (https://arxiv.org/abs/2605.10597) — бенчмарк агентов на crackme: выбор между Ghidra, angr, radare2
🩸 ЭТО УЖЕ РАБОТАЕТ
Big Sleep (https://projectzero.google/2024/10/from-naptime-to-big-sleep.html) — агент Project Zero и DeepMind нашёл 0-day в SQLite до релиза: stack buffer underflow, который не поймал фаззинг после 150 CPU-часов. За 2025 — ~20 0-day в open-source.
🩸 ОГРАНИЧЕНИЯ
- Агент уверенно ошибается в именах функций. Крипто, C2, авторизация — проверяй руками
- Упакованный сэмпл = слабый псевдокод = слабые выводы. Распаковывай до подачи
- Строки в бинарнике как промпт-инъекция против RE-агента (https://arxiv.org/abs/2605.30667): малварь встраивает команды для ассистента прямо в строки
Каталоги AI-реверса: awesome-ai-reverse (https://github.com/DiscoverBox/awesome-ai-reverse), Awesome-RE-MCP (https://github.com/crowdere/Awesome-RE-MCP), mcp-security-hub (https://github.com/FuzzingLabs/mcp-security-hub).
👻 [иишко](https://t.me/AlStack)
===MSG 4/4===
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (4/4)
🩸 ШАГ 7. СПЕЦИАЛИЗАЦИЯ
- Малварь: PMAT (https://github.com/HuskyHacks/PMAT-labs) — лабы к бесплатному курсу по триажу: сэмплы в VM, FakeNet-NG
- Прошивки: binwalk v3 (https://github.com/ReFirmLabs/binwalk) — распаковка, переписан на Rust; EMBA (https://github.com/e-m-b-a/emba) — полный анализ firmware: SBOM, уязвимости, эмуляция
- Android: jadx (https://github.com/skylot/jadx) + apktool (https://github.com/iBotPeaches/Apktool)
- CTF: ctftime.org (https://ctftime.org/), Flare-On от Mandiant — раз в год
🩸 МАТЕРИАЛЫ
- По-русски: intro-rev-ida-pro (https://yutewiyof.gitbook.io/intro-rev-ida-pro) — перевод Рикардо Нарвахи «Введение в реверсинг с нуля, используя IDA PRO»
- Книги: Practical Malware Analysis, Practical Reverse Engineering, The Ghidra Book; бесплатно — Reverse Engineering for Beginners (https://beginners.re/)
- Библиография: Awesome-Reversing (https://github.com/ReversingID/Awesome-Reversing)
- Ютуб: OALabs (https://www.youtube.com/@OALabs), LiveOverflow (https://www.youtube.com/@LiveOverflow), Gynvael Coldwind (https://www.youtube.com/@GynvaelColdwind)
🩸 ПРО ЛИЦЕНЗИЮ IDA
Лицензия IDA — офлайн: .hexlic, JSON с подписью, публичный ключ зашит в бинарь (схема официально не документируется, известна из разборов сообщества). В 2025 утекала бета 9.2, по форумам гуляли генераторы лицензий — под пропатченные бинарники; keygen с настоящим приватным ключом публично не подтверждён.
- Защитникам: офлайн-схема «ключ в бинаре + подпись» ломается патчем бинаря, а не только кражей ключа. Работают серверная валидация и ротация
- Реверсеру: точку проверки подписи ищут по xrefs на байты открытого ключа/модуля (RSA-модуль, 0x10001)
- Пропатченная сборка — бинарь, изменённый анонимом, регулярный вектор доставки малвари. Бесплатно и легально: IDA Free (https://hex-rays.com/ida-free/), Ghidra, академические лицензии Hex-Rays через вуз
👻 [иишко](https://t.me/AlStack)

55
research-what-we-did/rev_guide/p1.md Normal file
View File

@@ -0,0 +1,55 @@
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026
Полный путь от нуля до самостоятельного анализа бинарников: база, инструменты, пайплайн, реверс через ИИ, материалы. Всё бесплатное или с free-версией.
🩸 ШАГ 1. БАЗА
Без этого инструменты бесполезны:
- C — указатели, память, структуры, строки
- Ассемблер x86-64 — регистры, стек, calling conventions, переходы
- Compiler Explorer (https://godbolt.org/) — пишешь функцию на C, видишь её ассемблер. Лучший способ понять, что делает компилятор
- Формат PE (https://learn.microsoft.com/windows/win32/debug/pe-format) — заголовки, секции, таблица импортов
Результат: свободно читаешь ассемблерный листинг простой функции.
🩸 ШАГ 2. ИНСТРУМЕНТЫ
- Ghidra (https://github.com/NationalSecurityAgency/ghidra) — дизассемблер + декомпилятор, бесплатный. Основной инструмент для обучения, скриптится на Python через Ghidrathon (https://github.com/mandiant/Ghidrathon)
- x64dbg (https://x64dbg.com/) — отладчик Windows
- Detect It Easy (https://github.com/horsicq/Detect-It-Easy) — определение компилятора, протектора, упаковщика
- HxD (https://mh-nexus.de/hxd/) — hex-редактор
Позже пригодятся: IDA Pro (https://hex-rays.com/) — эталонный декомпилятор Hex-Rays; Binary Ninja (https://binary.ninja/) — API для автоматизации; radare2 (https://github.com/radareorg/radare2) / rizin (https://github.com/rizinorg/rizin) + Cutter (https://github.com/rizinorg/cutter) — консольный стек.
🩸 ШАГ 3. ПРАКТИКА
- crackmes.one (https://crackmes.one/) — задачи по реверсу, сложность 1–6
- Порядок: 15–20 задач 1☆, затем 10–15 задач 2☆, затем 3☆
- Осваиваются: поиск точки входа, паттерн проверки пароля, простые анти-отладочные приёмы
- ROP Emporium (https://ropemporium.com/) — exploitation по шагам
Результат: самостоятельно разбираешь небольшой бинарь от запуска до ответа.
🩸 ШАГ 4. СИСТЕМА
- pwn.college (https://pwn.college/) — бесплатные модули от ASU: ассемблер, основы RE, автопроверка, 15–25 задач на модуль
- OpenSecurityTraining2 (https://p.ost2.fyi/) — реверс C++, символьное исполнение, отладчики, UEFI
- RE-MA-Roadmap (https://github.com/x86byte/RE-MA-Roadmap) — roadmap от нуля до malware-аналитика
🩸 ШАГ 5. ПАЙПЛАЙН АНАЛИЗА БИНАРЯ
Порядок, по которому разбирают реальные сэмплы. Перед запуском чего-либо живого: виртуалка + снапшот, без общих папок и реальной сети.
1. Триаж без запуска: DIE — упаковщик/компилятор; FLOSS (https://github.com/mandiant/flare-floss) — строки, включая обфусцированные; capa (https://github.com/mandiant/capa) — capabilities с маппингом на ATT&CK
2. Распаковка: натив — x64dbg до OEP, дамп, IAT чинит Scylla (https://github.com/NtQuery/Scylla); .NET — de4dot-форк (https://github.com/kant2002/de4dot), разбор в dnSpyEx (https://github.com/dnSpyEx/dnSpy); без запуска — Qiling (https://github.com/qilingframework/qiling)
3. Статика: Ghidra/IDA — декомпиляция, xrefs, переименование
4. Динамика: отладчик для проверки гипотез; Frida (https://frida.re/) — хуки на функции, снятие конфигов
5. Деобфускация: D-810 (https://gitlab.com/eshard/d810) — MBA и flattening в декомпиляторе IDA; эмуляция и трейсинг — Unicorn (https://github.com/unicorn-engine/unicorn), Qiling, angr (https://github.com/angr/angr)
6. Поведение: FakeNet-NG (https://github.com/mandiant/flare-fakenet-ng) — перехват трафика; CAPEv2 (https://github.com/kevoreilly/capev2) — сэндбокс; Speakeasy (https://github.com/mandiant/speakeasy) — эмуляция малвари и драйверов без VM
7. Диффинг версий: BinDiff (https://github.com/google/bindiff) / Diaphora (https://github.com/joxeankoret/diaphora) — что изменил вендор, где была дыра
8. Выход: YARA-правило (https://github.com/VirusTotal/yara), IOC, отчёт
Шаг 6 — реверс через ИИ — во 2-м и 3-м сообщениях.
👻 [иишко](https://t.me/AlStack)

48
research-what-we-did/rev_guide/p2.md Normal file
View File

@@ -0,0 +1,48 @@
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (2/4)
🩸 ШАГ 6. РЕВЕРС ЧЕРЕЗ ИИ: MCP-СЕРВЕРЫ
Как это работает: агент (Claude Code, Codex, Cursor, Gemini CLI) подключается к дизассемблеру или отладчику через MCP и сам декомпилирует, ходит по xrefs, переименовывает, ставит бряки, снимает конфиги. Ты направляешь и валидируешь.
IDA Pro:
- ida-pro-mcp (https://github.com/mrexodia/ida-pro-mcp) — 12.3к звёзд, от автора x64dbg: декомпиляция, xrefs, патчи, отладчик
- ida-mcp (https://github.com/HexRaysSA/ida-mcp) — официальный сервер Hex-Rays, MIT, требует IDA 9.4+ (https://docs.hex-rays.com/core/mcp)
- IDA-NO-MCP (https://github.com/P4nda0s/IDA-NO-MCP) — 2к звёзд: выгружает базу IDA в файлы для AI-клиента вместо verbose MCP
- ida-multi-mcp (https://github.com/MeroZemory/ida-multi-mcp) — несколько бинарей в одной сессии: дроппер, пейлоад, C2 рядом
- ida-mcp-rs (https://github.com/blacktop/ida-mcp-rs) — headless-сервер на Rust для пайплайнов
Ghidra:
- GhidraMCP (https://github.com/LaurieWired/GhidraMCP) — 10.2к звёзд, классика от LaurieWired
- ghidra-mcp (https://github.com/bethington/ghidra-mcp) — 4к звёзд: 200+ тулов, GUI-плагин и headless, эмуляция p-code, Docker
- ReVa (https://github.com/cyberkaida/reverse-engineering-assistant) — 840 звёзд, заточен под длинные задачи, минимум потери контекста
- GhidrAssistMCP (https://github.com/symgraph/GhidrAssistMCP) — MCP внутри процесса Ghidra
- GhidraGPT (https://github.com/weirdmachine64/GhidraGPT) — LLM внутри GUI Ghidra
- PyGhidra-MCP (https://github.com/clearbluejar/pyghidra-mcp) — CLI на PyGhidra
- OGhidra (https://github.com/llnl/OGhidra) — от Lawrence Livermore: локальные LLM через Ollama, сэмплы не уходят в облако
radare2 и Binary Ninja:
- radare2-mcp (https://github.com/radareorg/radare2-mcp) — официальный MCP radare2
- r2ai (https://github.com/radareorg/r2ai) — LLM внутри radare2: объяснение функций, нейминг, поиск багов
- binary_ninja_mcp (https://github.com/fosdickio/binary_ninja_mcp) — мост Binja ↔ LLM
- binary-ninja-headless-mcp (https://github.com/mrphrazer/binary-ninja-headless-mcp) — headless, 180 тулов
- Rikugan (https://github.com/buzzer-re/Rikugan) — агент внутри IDA и Binja: 60+ тулов, 12 скиллов, Ollama
Отладчики и память:
- x64dbg-mcp (https://github.com/SetsunaYukiOvO/x64dbg-mcp) — управление x64dbg/x32dbg: бряки, регистры, память
- cheatengine-mcp-bridge (https://github.com/miscusi-peek/cheatengine-mcp-bridge) — 1.5к звёзд: Cheat Engine как тул агента — скан памяти, пойнтер-цепочки, структуры
- windbg-mcp (https://github.com/memoryforensics1/windbg-mcp) — kernel-отладка: DbgEng, TTD, KDNET
Малварь, Android, .NET, Python:
- Qu1cksc0pe (https://github.com/CYB3RMX/Qu1cksc0pe) — 2к звёзд, all-in-one малварь-анализ со встроенным MCP
- Reversecore_MCP (https://github.com/sjkim1127/Reversecore_MCP) — radare2, YARA, LIEF, capa, angr, Volatility в одном MCP
- Arkana (https://github.com/JameZUK/Arkana) — 250+ тулов: вся лаба малварь-анализа за одним промптом
- remnux-mcp-server (https://github.com/REMnux/remnux-mcp-server) — дистрибутив REMnux как MCP
- jadx-ai-mcp (https://github.com/zinja-coder/jadx-ai-mcp) — 2.8к звёзд, AI внутри JADX
- apktool-mcp-server (https://github.com/zinja-coder/apktool-mcp-server) — Smali, ресурсы, пересборка APK
- de4py (https://github.com/Fadi002/de4py) — деобфускация Python + Ollama
- disrobe (https://github.com/1-3-7/disrobe) — мультитул-деобфускатор: PyArmor, PyInstaller, obfuscator.io, UPX, WASM + MCP
- TriageMCP (https://github.com/eversinc33/TriageMCP) — быстрый статический триаж PE
Скиллы и агенты — в 3/4.
👻 [иишко](https://t.me/AlStack)

46
research-what-we-did/rev_guide/p3.md Normal file
View File

@@ -0,0 +1,46 @@
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (3/4)
🩸 ШАГ 6 (ПРОДОЛЖЕНИЕ). СКИЛЛЫ
Скилл = SKILL.md с методикой: агент получает не тул, а порядок действий. Кладётся в ~/.claude/skills, работает в Claude Code, Codex, Cursor, Gemini CLI.
- reverse-skill (https://github.com/zhaoxuya520/reverse-skill) — 37.9к звёзд, роутер: маршрутизирует задачу — apk, ida, radare2, binary-ninja, dotnet, js, малварь + CTF-оркестратор на 42 скилла
- Anthropic-Cybersecurity-Skills (https://github.com/mukul975/Anthropic-Cybersecurity-Skills) — 33.4к звёзд: 817 скиллов по 29 доменам, привязка к ATT&CK, D3FEND, NIST CSF
- ctf-skills (https://github.com/ljagiello/ctf-skills) — 3.3к звёзд: pwn, crypto, reverse, forensics, OSINT
- android-reverse-engineering-skill (https://github.com/SimoneAvogadro/android-reverse-engineering-skill) — 7.9к звёзд: APK/XAPK, call chains, Retrofit/OkHttp
- skills от Trail of Bits (https://github.com/trailofbits/skills) — 7.2к звёзд: security research, поиск уязвимостей, аудиты
- Claude-Red (https://github.com/SnailSploit/Claude-Red) — 6.9к звёзд: offensive-скиллы от SQLi до EDR evasion
- Claude-Code-CyberSecurity-Skill (https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill) — 22 скилла: реверс, threat hunting, purple team
- open-reverselab (https://github.com/LING71671/open-reverselab) — 1.2к звёзд: 100+ MCP-тулов Ghidra/Frida/x64dbg/Rizin + база знаний на 194 статьи
- REA (https://github.com/morluto/rea) — агент + скилл: от поведения приложения до нативных бинарей, с управлением evidence
Скиллы тоже атакуют: SkillSpector (https://github.com/NVIDIA/SkillSpector) от NVIDIA — 18.4к звёзд, сканер скиллов перед установкой: промпт-инъекции, эксфильтрация, supply-chain. Ставишь чужой скилл — проверяй.
🩸 АГЕНТЫ
- agentic-malware-analysis (https://github.com/mrphrazer/agentic-malware-analysis) — Docker: Kali, 50+ RE-тулов, MCP-дизассемблеры. Бинарь на входе — структурный отчёт на выходе
- auto-re-agent (https://github.com/Dryxio/reagent) — 2к звёзд: реконструирует C/C++ из бинаря, генерирует кандидатов, собирает и гоняет тесты на паритет
- reverify (https://github.com/2akouwu/reverify) — 1.2к звёзд: слой проверки — агент предлагает, детерминированные тулы сверяют каждое утверждение с бинарём
- firefox-reverse (https://github.com/WhiteNightShadow/firefox-reverse) — 855 звёзд: Firefox со встроенным AI-реверс-агентом, трейс на уровне движка
- anything-analyzer (https://github.com/Mouseww/anything-analyzer) — 3.7к звёзд: воркстейшн — браузер + MITM + хуки + AI
- FIRERPA (https://github.com/firerpa/lamda) — 8.4к звёзд: полный контроль Android-устройств, Frida, MITM, 160+ API
- shannon (https://github.com/KeygraphHQ/shannon) — 47к звёзд, AI-пентестер веба и API. Смежное с бинарным реверсом
🩸 ДАТАСЕТЫ И БЕНЧМАРКИ
- mcp-reversing-dataset (https://github.com/mrexodia/mcp-reversing-dataset) — задачи реверса, решённые LLM: тренировка и eval
- AgentRE-Bench (https://github.com/agentrebench/AgentRE-Bench) — бенчмарк LLM-реверса
- CrackMeBench (https://arxiv.org/abs/2605.10597) — бенчмарк агентов на crackme: выбор между Ghidra, angr, radare2
🩸 ЭТО УЖЕ РАБОТАЕТ
Big Sleep (https://projectzero.google/2024/10/from-naptime-to-big-sleep.html) — агент Project Zero и DeepMind нашёл 0-day в SQLite до релиза: stack buffer underflow, который не поймал фаззинг после 150 CPU-часов. За 2025 — ~20 новых 0-day в open-source.
🩸 ОГРАНИЧЕНИЯ
- Агент уверенно ошибается в именах функций. Крипто, C2, авторизация — проверяй руками
- Упакованный сэмпл = слабый псевдокод = слабые выводы. Распаковывай до подачи
- Строки в бинарнике как промпт-инъекция против RE-агента (https://arxiv.org/abs/2605.30667) — малварь учится «разговаривать» с твоим ассистентом
Каталоги всего AI-реверса: awesome-ai-reverse (https://github.com/DiscoverBox/awesome-ai-reverse), Awesome-RE-MCP (https://github.com/crowdere/Awesome-RE-MCP), mcp-security-hub (https://github.com/FuzzingLabs/mcp-security-hub).
👻 [иишко](https://t.me/AlStack)

25
research-what-we-did/rev_guide/p4.md Normal file
View File

@@ -0,0 +1,25 @@
🩸 РЕВЕРС-ИНЖИНИРИНГ С НУЛЯ: ГАЙД 2026 (4/4)
🩸 ШАГ 7. СПЕЦИАЛИЗАЦИЯ
- Малварь: PMAT (https://github.com/HuskyHacks/PMAT-course) — бесплатный курс по триажу. Лаба: VM + FakeNet-NG
- Прошивки: binwalk v3 (https://github.com/ReFirmLabs/binwalk) — распаковка, переписан на Rust; EMBA (https://github.com/e-m-b-a/emba) — полный анализ firmware: SBOM, уязвимости, эмуляция
- Android: jadx (https://github.com/skylot/jadx) + apktool (https://github.com/iBotPeaches/Apktool)
- CTF: ctftime.org (https://ctftime.org/), Flare-On от Mandiant — раз в год
🩸 МАТЕРИАЛЫ
- По-русски: intro-rev-ida-pro (https://yutewiyof.gitbook.io/intro-rev-ida-pro) — «Реверсинг с IDA Pro от 0» Рикардо Нарвахи, полный перевод
- Книги: Practical Malware Analysis, Practical Reverse Engineering, The Ghidra Book; Reverse Engineering for Beginners (https://beginners.re/) — бесплатно
- Библиография: Awesome-Reversing (https://github.com/ReversingID/Awesome-Reversing)
- Ютуб: OALabs, LiveOverflow, Gynvael Coldwind
🩸 ПРО ЛИЦЕНЗИЮ IDA
По публичным сообщениям 2025: лицензия IDA — офлайн-проверка, JSON с подписью, публичный ключ зашит в бинарь. Утёк keygen с приватным ключом, Hex-Rays в 9.1+ сменила схему подписи.
- Защитникам: офлайн-схема «ключ в бинаре + подпись» ломается подменой ключа. Работают серверная валидация и ротация
- Реверсеру: точка проверки подписи ищется через xrefs на крипто-константы
- Пропатченная сборка — бинарь, изменённый анонимом, регулярный вектор доставки малвари. Бесплатно и легально: IDA Free (https://hex-rays.com/ida-free/), Ghidra, академические лицензии Hex-Rays
👻 [иишко](https://t.me/AlStack)

12
research-what-we-did/reverse_keys.py Normal file
View File

@@ -0,0 +1,12 @@
import json, os
P = "C:/Users/User/tmp/octopusx_keys.json"
d = json.load(open(P, encoding="utf-8"))
keys = d["keys"]
print("before:", len(keys), "| first:", keys[0][:14], "| last:", keys[-1][:14])
d["keys"] = list(reversed(keys)) # newest first
d["current_index"] = 0
json.dump(d, open(P, "w", encoding="utf-8"), ensure_ascii=False, indent=1)
# bump mtime to force hot reload
os.utime(P)
print("reversed. now first:", d["keys"][0][:14], "| last:", d["keys"][-1][:14])

201
reverse-engineering-android-malware-with-jadx/LICENSE Normal file
View File

@@ -0,0 +1,201 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to the Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by the Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding any notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. Please do not remove or change
the license header comment from a contributed file except when
necessary.
Copyright 2026 mukul975
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

353
reverse-engineering-android-malware-with-jadx/SKILL.md Normal file
View File

@@ -0,0 +1,353 @@
---
name: reverse-engineering-android-malware-with-jadx
description: 'Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify
malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest
permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse
engineering, mobile malware investigation, or Android threat analysis.
'
domain: cybersecurity
subdomain: malware-analysis
tags:
- malware
- Android
- reverse-engineering
- JADX
- mobile-malware
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
---
# Reverse Engineering Android Malware with JADX
## When to Use
- A suspicious Android APK has been reported as malicious or flagged by mobile threat detection
- Analyzing Android banking trojans, spyware, SMS stealers, or adware samples
- Determining what data an app collects, where it sends it, and what permissions it abuses
- Extracting C2 server addresses, encryption keys, and configuration data from Android malware
- Understanding overlay attack mechanisms used by banking trojans
**Do not use** for analyzing obfuscated native (.so) libraries within APKs; use Ghidra or IDA for native ARM binary analysis.
## Prerequisites
- JADX 1.5+ installed (download from https://github.com/skylot/jadx/releases)
- Android SDK with `aapt2` and `adb` tools for APK inspection
- apktool for full APK disassembly including smali code and resources
- Python 3.8+ with `androguard` library for automated APK analysis
- Frida for dynamic instrumentation (optional, for runtime analysis)
- Isolated Android emulator (Genymotion or Android Studio AVD) without Google services
## Workflow
### Step 1: Extract APK Metadata and Permissions
Examine the APK structure and AndroidManifest.xml:
```bash
# Get APK basic info
aapt2 dump badging malware.apk
# Extract AndroidManifest.xml
apktool d malware.apk -o apk_extracted/ -f
# Analyze permissions with androguard
python3 << 'PYEOF'
from androguard.core.apk import APK
apk = APK("malware.apk")
print(f"Package: {apk.get_package()}")
print(f"App Name: {apk.get_app_name()}")
print(f"Version: {apk.get_androidversion_name()}")
print(f"Min SDK: {apk.get_min_sdk_version()}")
print(f"Target SDK: {apk.get_target_sdk_version()}")
# Dangerous permissions
dangerous_perms = {
"android.permission.READ_SMS": "SMS theft",
"android.permission.RECEIVE_SMS": "SMS interception",
"android.permission.SEND_SMS": "Premium SMS fraud",
"android.permission.READ_CONTACTS": "Contact harvesting",
"android.permission.READ_CALL_LOG": "Call log theft",
"android.permission.RECORD_AUDIO": "Audio surveillance",
"android.permission.CAMERA": "Camera surveillance",
"android.permission.ACCESS_FINE_LOCATION": "Location tracking",
"android.permission.READ_PHONE_STATE": "Device fingerprinting",
"android.permission.SYSTEM_ALERT_WINDOW": "Overlay attacks",
"android.permission.BIND_ACCESSIBILITY_SERVICE": "Full device control",
"android.permission.REQUEST_INSTALL_PACKAGES": "Sideloading apps",
"android.permission.BIND_DEVICE_ADMIN": "Device admin abuse",
}
print("\nDangerous Permissions:")
for perm in apk.get_permissions():
if perm in dangerous_perms:
print(f" [!] {perm}")
print(f" Risk: {dangerous_perms[perm]}")
elif "android.permission" in perm:
print(f" [*] {perm}")
# Components
print("\nActivities:")
for act in apk.get_activities():
print(f" {act}")
print("\nServices:")
for svc in apk.get_services():
print(f" {svc}")
print("\nReceivers:")
for rcv in apk.get_receivers():
print(f" {rcv}")
PYEOF
```
### Step 2: Decompile with JADX
Open the APK in JADX for Java/Kotlin source analysis:
```bash
# Open in JADX GUI
jadx-gui malware.apk
# Command-line decompilation for scripted analysis
jadx -d jadx_output/ malware.apk --show-bad-code
# Decompile with all options
jadx -d jadx_output/ malware.apk \
--deobf \
--deobf-min 3 \
--deobf-max 64 \
--show-bad-code \
--threads-count 4
# The output directory structure:
# jadx_output/
# sources/ <- Decompiled Java source code
# com/malware/app/
# MainActivity.java
# C2Service.java
# SMSReceiver.java
# resources/ <- Decoded resources (layouts, strings, assets)
# AndroidManifest.xml
# res/
# assets/
```
### Step 3: Identify Malicious Functionality
Search for suspicious code patterns in decompiled sources:
```bash
# Search for network communication
grep -rn "HttpURLConnection\|OkHttpClient\|Retrofit\|Volley\|URL(" jadx_output/sources/
# Search for SMS operations
grep -rn "SmsManager\|getDefault().sendTextMessage\|SMS_RECEIVED" jadx_output/sources/
# Search for overlay attack code
grep -rn "SYSTEM_ALERT_WINDOW\|TYPE_APPLICATION_OVERLAY\|WindowManager.LayoutParams" jadx_output/sources/
# Search for accessibility service abuse
grep -rn "AccessibilityService\|onAccessibilityEvent\|performAction" jadx_output/sources/
# Search for data exfiltration
grep -rn "getDeviceId\|getSubscriberId\|getSimSerialNumber\|getLine1Number" jadx_output/sources/
# Search for crypto operations (key storage, encryption)
grep -rn "SecretKeySpec\|Cipher.getInstance\|AES\|DES\|RSA" jadx_output/sources/
# Search for dynamic code loading
grep -rn "DexClassLoader\|PathClassLoader\|loadDex\|loadClass" jadx_output/sources/
# Search for obfuscated strings and decryption
grep -rn "Base64.decode\|decrypt\|decipher\|xor" jadx_output/sources/
```
### Step 4: Analyze C2 Communication
Trace the network communication logic:
```python
# Automated C2 extraction from decompiled code
import os
import re
jadx_dir = "jadx_output/sources"
# Patterns for C2 URLs and IPs
url_pattern = re.compile(r'https?://[^\s"\'<>]+')
ip_pattern = re.compile(r'"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"')
base64_pattern = re.compile(r'"([A-Za-z0-9+/]{20,}={0,2})"')
urls = set()
ips = set()
b64_strings = set()
for root, dirs, files in os.walk(jadx_dir):
for fname in files:
if fname.endswith('.java'):
filepath = os.path.join(root, fname)
with open(filepath, 'r', errors='ignore') as f:
content = f.read()
for match in url_pattern.finditer(content):
urls.add(match.group())
for match in ip_pattern.finditer(content):
ips.add(match.group(1))
for match in base64_pattern.finditer(content):
b64_strings.add(match.group(1))
print("URLs found:")
for u in urls:
print(f" {u}")
print("\nIP addresses:")
for ip in ips:
print(f" {ip}")
# Decode Base64 strings
import base64
print("\nDecoded Base64 strings:")
for b64 in b64_strings:
try:
decoded = base64.b64decode(b64).decode('utf-8', errors='ignore')
if any(c.isprintable() for c in decoded) and len(decoded) > 3:
print(f" {b64[:30]}... -> {decoded[:100]}")
except:
pass
```
### Step 5: Examine Native Libraries
Check for native code that may contain additional malicious logic:
```bash
# List native libraries in the APK
unzip -l malware.apk | grep "\.so$"
# Extract native libraries
unzip malware.apk "lib/*" -d apk_native/
# Check native library properties
file apk_native/lib/armeabi-v7a/*.so
readelf -d apk_native/lib/armeabi-v7a/*.so | grep NEEDED
# Strings from native libraries
strings apk_native/lib/armeabi-v7a/libpayload.so | grep -iE "(http|url|key|encrypt|password)"
# For deep native analysis, import into Ghidra:
# File -> Import -> Select .so file -> Select ARM architecture
```
### Step 6: Document Analysis and Extract IOCs
Compile a comprehensive Android malware analysis report:
```
Analysis documentation should include:
- APK metadata (package name, version, signing certificate)
- Permission analysis with risk assessment
- Component analysis (activities, services, receivers, providers)
- Decompiled code walkthrough of malicious functions
- C2 communication protocol and endpoints
- Data exfiltration methods and targeted data types
- Persistence mechanisms (device admin, accessibility service)
- Evasion techniques (emulator detection, root detection)
- Extracted IOCs (C2 URLs, domains, IPs, signing certificate hash)
```
## Key Concepts
| Term | Definition |
|------|------------|
| **APK (Android Package)** | Android application package format containing compiled DEX bytecode, resources, manifest, and native libraries |
| **DEX Bytecode** | Dalvik Executable format containing compiled Java/Kotlin code; JADX converts this back to readable Java source |
| **Overlay Attack** | Banking trojan technique displaying a fake UI layer over a legitimate banking app to steal credentials using SYSTEM_ALERT_WINDOW permission |
| **Accessibility Service Abuse** | Malware registering as an accessibility service to capture screen content, perform actions, and prevent uninstallation |
| **Smali** | Human-readable representation of DEX bytecode; intermediate representation between bytecode and Java used by apktool |
| **Dynamic Code Loading** | Loading additional DEX code at runtime using DexClassLoader to hide malicious functionality from static analysis |
| **Device Admin Abuse** | Malware requesting device administrator privileges to prevent uninstallation and perform device wipe threats |
## Tools & Systems
- **JADX**: Open-source DEX to Java decompiler providing GUI and CLI for Android APK analysis with deobfuscation support
- **apktool**: Tool for reverse engineering Android APK files to smali code and decoded resources
- **androguard**: Python framework for automated Android APK analysis including permission, component, and code analysis
- **Frida**: Dynamic instrumentation toolkit for hooking Java methods and native functions at runtime on Android
- **MobSF (Mobile Security Framework)**: Automated mobile application security testing framework for static and dynamic analysis
## Common Scenarios
### Scenario: Analyzing an Android Banking Trojan
**Context**: A banking trojan APK is distributed via SMS phishing targeting customers of a specific bank. The sample needs analysis to identify targeted banks, C2 infrastructure, and data theft mechanisms.
**Approach**:
1. Extract APK metadata and identify requested permissions (SMS, accessibility, overlay, device admin)
2. Decompile with JADX and search for overlay activity classes that mimic banking app UIs
3. Identify the list of targeted banking apps by searching for package name lists in the code
4. Trace the SMS interception receiver to understand how 2FA codes are stolen
5. Follow the C2 communication code to extract server URLs and command protocol
6. Check for web injection configuration files in assets/ directory
7. Extract all IOCs and document the complete attack chain
**Pitfalls**:
- Not deobfuscating class and method names before analysis (use JADX --deobf flag)
- Missing dynamically loaded DEX files downloaded after installation
- Ignoring native .so libraries that may contain the actual C2 logic or encryption routines
- Overlooking assets/ directory which may contain encrypted configuration or web injects
## Output Format
```
ANDROID MALWARE ANALYSIS REPORT
==================================
APK File: update_bank.apk
Package: com.android.systemupdate
SHA-256: e3b0c44298fc1c149afbf4c8996fb924...
Version: 1.2.3
Min SDK: 21 (Android 5.0)
Signing Cert: SHA-256: abc123... (self-signed)
CLASSIFICATION
Family: Anubis Banking Trojan
Type: Banking Trojan / SMS Stealer / Keylogger
DANGEROUS PERMISSIONS
[!] RECEIVE_SMS - Intercepts incoming SMS (2FA theft)
[!] READ_SMS - Reads SMS messages
[!] SEND_SMS - Sends premium SMS
[!] SYSTEM_ALERT_WINDOW - Overlay attacks on banking apps
[!] BIND_ACCESSIBILITY - Full device control
[!] BIND_DEVICE_ADMIN - Prevents uninstallation
MALICIOUS COMPONENTS
Service: com.android.systemupdate.C2Service (C2 communication)
Receiver: com.android.systemupdate.SmsReceiver (SMS interception)
Activity: com.android.systemupdate.OverlayActivity (credential overlay)
TARGETED APPS (23 banking apps)
com.bank.example1, com.bank.example2, ...
C2 INFRASTRUCTURE
Primary: hxxps://c2-server[.]com/api/bot
Fallback: hxxps://backup-c2[.]net/api/bot
Protocol: HTTPS POST with JSON body
Bot ID: MD5(IMEI + Build.SERIAL)
EXTRACTED IOCs
Domains: c2-server[.]com, backup-c2[.]net
IPs: 185.220.101[.]42
URLs: hxxps://c2-server[.]com/api/bot
hxxps://c2-server[.]com/api/injects
Cert Hash: abc123def456...
```

67
reverse-engineering-android-malware-with-jadx/references/api-reference.md Normal file
View File

@@ -0,0 +1,67 @@
# API Reference: Android Malware Reverse Engineering with JADX Agent
## Overview
Reverse engineers Android APKs using apktool for manifest extraction, JADX for Java decompilation, and regex-based source code analysis for malicious patterns (C2 URLs, SMS interception, overlay attacks).
## Dependencies
| Package | Version | Purpose |
|---------|---------|---------|
| hashlib | stdlib | APK hash computation |
| xml.etree | stdlib | AndroidManifest.xml parsing |
## External Tools Required
| Tool | Purpose |
|------|---------|
| apktool | APK disassembly and manifest extraction |
| jadx | DEX to Java decompilation with deobfuscation |
## Core Functions
### `compute_apk_hashes(apk_path)`
Generates MD5 and SHA-256 hashes for APK identification.
### `extract_manifest(apk_path, output_dir)`
Extracts AndroidManifest.xml and parses permissions, activities, services, receivers.
- **Returns**: `dict` with `package`, `permissions`, `activities`, `services`, `receivers`
### `analyze_permissions(permissions)`
Classifies permissions against a list of 16 dangerous Android permissions.
- **Risk**: CRITICAL if SMS/accessibility/device-admin, HIGH if >5 dangerous
- **Returns**: `dict` with categorized permission lists and risk level
### `decompile_with_jadx(apk_path, output_dir)`
Runs JADX with `--deobf` flag for deobfuscated Java source output.
- **Timeout**: 300 seconds
### `search_source_code(source_dir, patterns)`
Searches decompiled Java source for 10 malicious pattern categories.
- **Returns**: `dict[str, list[dict]]` - pattern name to file/match pairs
### `analyze_apk(apk_path, output_base)`
Full pipeline: hashes -> manifest -> permissions -> decompile -> code analysis.
## Malicious Code Patterns
| Pattern | Indicator |
|---------|-----------|
| urls | HTTP/HTTPS C2 server addresses |
| ips | Hardcoded IP addresses |
| exec_commands | Runtime.exec() shell command execution |
| reflection | Class.forName() dynamic class loading |
| dex_loading | DexClassLoader for loading additional code |
| overlay_attack | TYPE_APPLICATION_OVERLAY for phishing overlays |
| accessibility_abuse | AccessibilityService for keylogging/automation |
| sms_intercept | SMS_RECEIVED broadcast interception |
## Dangerous Permissions Checked
READ_SMS, SEND_SMS, RECEIVE_SMS, READ_CONTACTS, CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, READ_PHONE_STATE, BIND_ACCESSIBILITY_SERVICE, BIND_DEVICE_ADMIN, REQUEST_INSTALL_PACKAGES
## Usage
```bash
python agent.py malware.apk
```

196
reverse-engineering-android-malware-with-jadx/scripts/agent.py Normal file
View File

@@ -0,0 +1,196 @@
#!/usr/bin/env python3
"""Android malware reverse engineering agent using jadx and androguard subprocess wrappers."""
import subprocess
import os
import sys
import re
import hashlib
from xml.etree import ElementTree
def compute_apk_hashes(apk_path):
"""Compute hashes for APK identification."""
with open(apk_path, "rb") as f:
data = f.read()
return {
"md5": hashlib.md5(data).hexdigest(),
"sha256": hashlib.sha256(data).hexdigest(),
"size": len(data),
}
def extract_manifest(apk_path, output_dir):
"""Extract and parse AndroidManifest.xml using apktool."""
subprocess.run(
["apktool", "d", apk_path, "-o", output_dir, "-f"],
capture_output=True, text=True, timeout=120
)
manifest_path = os.path.join(output_dir, "AndroidManifest.xml")
if not os.path.exists(manifest_path):
return {"error": "Manifest extraction failed"}
tree = ElementTree.parse(manifest_path)
root = tree.getroot()
ns = {"android": "http://schemas.android.com/apk/res/android"}
permissions = []
for perm in root.findall(".//uses-permission"):
name = perm.get(f"{{{ns['android']}}}name", "")
permissions.append(name)
activities = []
for act in root.findall(".//activity"):
name = act.get(f"{{{ns['android']}}}name", "")
exported = act.get(f"{{{ns['android']}}}exported", "false")
activities.append({"name": name, "exported": exported})
services = []
for svc in root.findall(".//service"):
name = svc.get(f"{{{ns['android']}}}name", "")
services.append(name)
receivers = []
for rcv in root.findall(".//receiver"):
name = rcv.get(f"{{{ns['android']}}}name", "")
intents = []
for intent in rcv.findall(".//intent-filter/action"):
intents.append(intent.get(f"{{{ns['android']}}}name", ""))
receivers.append({"name": name, "intents": intents})
package = root.get("package", "")
return {
"package": package,
"permissions": permissions,
"activities": activities,
"services": services,
"receivers": receivers,
}
DANGEROUS_PERMISSIONS = [
"android.permission.READ_SMS", "android.permission.SEND_SMS",
"android.permission.RECEIVE_SMS", "android.permission.READ_CONTACTS",
"android.permission.CAMERA", "android.permission.RECORD_AUDIO",
"android.permission.ACCESS_FINE_LOCATION", "android.permission.READ_PHONE_STATE",
"android.permission.CALL_PHONE", "android.permission.READ_CALL_LOG",
"android.permission.WRITE_EXTERNAL_STORAGE", "android.permission.READ_EXTERNAL_STORAGE",
"android.permission.SYSTEM_ALERT_WINDOW", "android.permission.BIND_ACCESSIBILITY_SERVICE",
"android.permission.REQUEST_INSTALL_PACKAGES", "android.permission.BIND_DEVICE_ADMIN",
]
def analyze_permissions(permissions):
"""Classify permissions by risk level."""
dangerous = [p for p in permissions if p in DANGEROUS_PERMISSIONS]
sms_related = [p for p in permissions if "SMS" in p]
accessibility = [p for p in permissions if "ACCESSIBILITY" in p]
admin = [p for p in permissions if "DEVICE_ADMIN" in p or "BIND_ADMIN" in p]
risk = "LOW"
if len(dangerous) > 5:
risk = "HIGH"
if sms_related or accessibility or admin:
risk = "CRITICAL"
return {
"total": len(permissions),
"dangerous": dangerous,
"sms_related": sms_related,
"accessibility": accessibility,
"device_admin": admin,
"risk": risk,
}
def decompile_with_jadx(apk_path, output_dir):
"""Decompile APK to Java source using JADX."""
result = subprocess.run(
["jadx", "-d", output_dir, "--deobf", apk_path],
capture_output=True, text=True, timeout=300
)
return {
"output_dir": output_dir,
"returncode": result.returncode,
"stdout": result.stdout[-500:] if result.stdout else "",
}
def search_source_code(source_dir, patterns=None):
"""Search decompiled source for suspicious patterns."""
if patterns is None:
patterns = {
"urls": r'https?://[^\s"\'<>]+',
"ips": r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b',
"crypto_keys": r'(?:AES|DES|RSA|key|secret|encrypt).*?["\']([^"\']{8,})["\']',
"base64_strings": r'[A-Za-z0-9+/]{40,}={0,2}',
"exec_commands": r'Runtime\.getRuntime\(\)\.exec|ProcessBuilder',
"reflection": r'Class\.forName|getMethod|getDeclaredMethod',
"dex_loading": r'DexClassLoader|PathClassLoader|InMemoryDexClassLoader',
"overlay_attack": r'TYPE_APPLICATION_OVERLAY|SYSTEM_ALERT_WINDOW',
"accessibility_abuse": r'AccessibilityService|onAccessibilityEvent',
"sms_intercept": r'SmsReceiver|SMS_RECEIVED|sendTextMessage',
}
findings = {p: [] for p in patterns}
for root, dirs, files in os.walk(source_dir):
for filename in files:
if not filename.endswith(".java"):
continue
filepath = os.path.join(root, filename)
try:
with open(filepath, "r", errors="ignore") as f:
content = f.read()
for pattern_name, regex in patterns.items():
matches = re.findall(regex, content)
if matches:
findings[pattern_name].extend([
{"file": filepath, "match": m[:100]} for m in matches[:5]
])
except (OSError, UnicodeDecodeError):
pass
for key in findings:
findings[key] = findings[key][:20]
return findings
def analyze_apk(apk_path, output_base="/tmp/apk_analysis"):
"""Full APK analysis pipeline."""
os.makedirs(output_base, exist_ok=True)
report = {"apk": apk_path}
report["hashes"] = compute_apk_hashes(apk_path)
apktool_dir = os.path.join(output_base, "apktool")
report["manifest"] = extract_manifest(apk_path, apktool_dir)
if "permissions" in report["manifest"]:
report["permission_analysis"] = analyze_permissions(report["manifest"]["permissions"])
jadx_dir = os.path.join(output_base, "jadx_output")
report["decompilation"] = decompile_with_jadx(apk_path, jadx_dir)
if os.path.exists(jadx_dir):
source_dir = os.path.join(jadx_dir, "sources")
if os.path.exists(source_dir):
report["code_analysis"] = search_source_code(source_dir)
return report
def print_report(report):
print("Android Malware Analysis Report")
print("=" * 50)
print(f"APK: {report['apk']}")
print(f"SHA-256: {report['hashes']['sha256']}")
print(f"Size: {report['hashes']['size']} bytes")
manifest = report.get("manifest", {})
print(f"\nPackage: {manifest.get('package', 'N/A')}")
perm = report.get("permission_analysis", {})
print(f"Permissions: {perm.get('total', 0)} (Risk: {perm.get('risk', 'N/A')})")
if perm.get("dangerous"):
print(f" Dangerous: {', '.join(p.split('.')[-1] for p in perm['dangerous'][:8])}")
print(f"Activities: {len(manifest.get('activities', []))}")
print(f"Services: {len(manifest.get('services', []))}")
print(f"Receivers: {len(manifest.get('receivers', []))}")
code = report.get("code_analysis", {})
if code:
print("\nCode Analysis Findings:")
for pattern, matches in code.items():
if matches:
print(f" {pattern}: {len(matches)} match(es)")
for m in matches[:3]:
print(f" -> {m['match'][:80]}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python agent.py <apk_file>")
sys.exit(1)
result = analyze_apk(sys.argv[1])
print_report(result)

249
reverse-engineering-binary/SKILL.md Normal file
View File

@@ -0,0 +1,249 @@
---
name: reverse-engineering-binary
description: 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O
analysis, IDA Pro, Ghidra, radare2, binary patching, crackme solving, malware analysis,
unpacking, signature analysis, and any task involving compiled binary inspection
or modification.'
version: 1.0.0
platforms:
- linux
- macos
- windows
depends_on: []
metadata:
tags:
- reverse
- engineering
- binary
---
# Reverse Engineering — Binary Analysis
## Trigger Conditions
- Disassembling or decompiling binaries (PE, ELF, Mach-O)
- IDA Pro, Ghidra, radare2, Binary Ninja workflows
- Analyzing compiled code without source
- Binary patching, crackme/CTF challenges
- Malware reverse engineering, IOC extraction
- Function identification, control flow reconstruction
- String extraction, crypto constant identification
- Import/export table analysis, IAT reconstruction
- Binary instrumentation (Frida, DynamoRIO, Pin)
- Shellcode analysis, payload decoding
- Firmware extraction, embedded binary RE
- Comparing binary diffs, version analysis
- Writing loaders, unpackers, decoders
## Core Methodology
### 1. Static Analysis Pipeline
```
file identification → entropy analysis → string extraction →
import analysis → function identification → control flow graph →
data flow analysis → decompilation → manual verification
```
**File identification:**
- `file`, `binwalk`, `detect_it_easy` (DIE)
- PE: `pefile`, `peview`, `CFF Explorer`
- ELF: `readelf`, `objdump`, `elfutils`
- Mach-O: `otool`, `MachOView`
**Entropy analysis:**
- High entropy regions → packed/encrypted sections
- `binwalk -E`, `ent`, custom entropy scanner
- Section boundaries vs entropy spikes
**String extraction:**
- `strings -n 4`, `floss` (FireEye), `rabin2 -z`
- Unicode strings: `strings -e l`, `rabin2 -zz`
- Encrypted strings: constant analysis, decryption routine location
**Import analysis:**
- PE: IAT parsing, delayed imports, forwarders
- ELF: `.dynsym`, `.got.plt`, symbol versioning
- Hidden imports: API hashing, GetProcAddress/LoadLibrary chains
### 2. Dynamic Analysis Pipeline
```
sandbox execution → API monitoring → memory dumping →
network capture → behavior analysis → IOC extraction
```
**API monitoring:**
- Windows: API Monitor, ProcMon, ETW tracing
- Linux: `strace`, `ltrace`, `bpftrace`
- Cross-platform: Frida, DynamoRIO
**Memory analysis:**
- Process dumping: `Process Hacker`, `dumpcap`, custom dumpers
- Memory scanning: `Volatility`, `Rekall`, `LiME`
- String reconstruction from memory, decrypted payload extraction
### 3. Decompilation & Manual RE
**IDA Pro workflow:**
```
1. Load binary → auto-analysis → review entry points
2. Identify strings → cross-reference → locate key functions
3. Rename functions/variables based on behavior
4. Create structs for data structures
5. Apply FLIRT signatures for known libraries
6. Graph view for complex control flow
7. Pseudocode (F5) → manual correction
8. Write IDC/IDAPython scripts for automation
```
**Ghidra workflow:**
```
1. Import → auto-analyze (all analyzers)
2. Symbol tree → identify main/entry
3. Data type manager → create custom structs
4. Decompile → fix variable types
5. Script manager → Python/Java automation
6. Version tracking → binary diffing
7. Function graph → identify obfuscation patterns
```
**radare2 workflow:**
```
r2 binary
aaa # analyze all
afl # list functions
pdf @ main # print disassembly function
pdg @ main # decompile (if available)
izz # strings
ii # imports
is # symbols
axt @ <addr> # cross-references to
axf @ <addr> # cross-references from
```
### 4. Binary Patching
**Common patch targets:**
- License checks: `test eax, eax` → `xor eax, eax` (always true)
- Conditional jumps: `je` → `jmp` or `jne`
- Function skipping: `call func` → `nop` × 5
- Return value modification: `mov eax, 1` before `ret`
- Anti-debug bypass: `IsDebuggerPresent` → return 0
**PE patching:**
```python
import pefile
pe = pefile.PE("target.exe")
# Find target RVA
for section in pe.sections:
if section.Name.startswith(b'.text'):
text_rva = section.VirtualAddress
text_raw = section.PointerToRawData
# Convert RVA to file offset
def rva_to_offset(pe, rva):
for s in pe.sections:
if s.VirtualAddress <= rva < s.VirtualAddress + s.Misc_VirtualSize:
return rva - s.VirtualAddress + s.PointerToRawData
# Patch
offset = rva_to_offset(pe, target_rva)
pe.set_bytes_at_offset(offset, b'\x90' * 5) # NOP
pe.write("target_patched.exe")
```
### 5. Anti-Analysis Detection & Bypass
**Anti-debug techniques:**
- `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`
- `NtQueryInformationProcess(ProcessDebugPort)`
- `GetTickCount` timing checks
- `RDTSC` instruction timing
- SEH-based debugger detection
- Hardware breakpoint detection (`GetThreadContext`)
**Bypass methods:**
- Patch detection functions to return false
- Frida script to hook and override return values
- Hide debugger from process list
- Use kernel debugger (WinDbg) for kernel-mode targets
- Time manipulation for timing-based checks
**Anti-VM techniques:**
- MAC address checks (00:0C:29 = VMware)
- Registry keys (HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0)
- CPUID hypervisor bit
- DMI/SMBIOS strings
- Specific drivers (vmci, vmmouse, VBoxGuest)
### 6. Crypto Identification
**Constant-based identification:**
```
MD5: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476
SHA1: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
SHA256: 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, ...
AES: S-box lookup table (256 bytes starting 0x63, 0x7C, 0x77, ...)
RC4: Key-scheduling algorithm pattern
Base64: 64-char alphabet string
```
**Search patterns:**
- `rabin2 -x 67452301EFCDAB89` (SHA1 constants)
- IDA: Search → Immediate Value → hex constants
- YARA rules for crypto implementations
### 7. Automation Scripts
**IDAPython — find all API hash calls:**
```python
from idaapi import *
from idautils import *
def find_api_hash_calls(hash_value):
"""Find calls to API hash resolver with specific hash."""
results = []
for func_ea in Functions():
for block in FuncItems(func_ea):
for xref in XrefsTo(block, 0):
if get_operand_value(xref.frm, 0) == hash_value:
results.append(xref.frm)
return results
```
**Frida — trace all imports:**
```javascript
Interceptor.attach(Module.getExportByName(null, 'CreateFileW'), {
onEnter: function(args) {
console.log('CreateFileW(' + args[0].readUtf16String() + ')');
}
});
```
## Implementation Standards
- All RE artifacts are complete: full scripts, working patches, complete analysis
- Provide both static and dynamic analysis approaches
- Include automation scripts for repetitive tasks
- Document findings in structured format
- Cross-reference findings across multiple tools
- No partial analysis — complete or nothing
## Output Format
For binary RE tasks:
1. **Identification** — file type, architecture, compiler, packer
2. **Static Analysis** — strings, imports, key functions, control flow
3. **Dynamic Analysis** — behavior, API calls, network, file operations
4. **Key Findings** — algorithms, crypto, protocols, backdoors
5. **Artifacts** — patches, scripts, YARA rules, IOCs
Всё, брат.
## Related
- `skill reverse-engineering-full — полный RE`
- `skill reverse-engineering-obfuscation — деобфускация`
- `skill binary-exploitation — бинарные эксплойты`
- `skill fuzzing — фазинг`

113
reverse-engineering-cli/SKILL.md Normal file
View File

@@ -0,0 +1,113 @@
---
name: reverse-engineering-cli
description: 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping,
token extraction, API endpoint enumeration, state machine reconstruction, protocol
analysis, config file discovery, and bypass techniques for command-line applications.'
version: 1.0.0
platforms:
- linux
- macos
- windows
triggers:
- reverse
- engineering
- cli
- tool
- binary
- analysis
- auth
- flow
- mapping
- token
- extraction
- api
depends_on: []
metadata:
tags:
- reverse
- engineering
- cli
---
# Reverse Engineering — CLI Tools
## When to Use
- RE of any CLI binary/tool
- Auth flow analysis (login/logout/token refresh)
- Token storage discovery and extraction
- API endpoint enumeration from binaries
- State machine reconstruction
- Protocol reverse engineering
- Bypass of authentication or licensing in CLI tools
## Core Protocol
Load `../../meta-rules/meta-re/SKILL.md` for the full methodology.
## Quick Start
```bash
# 1. Identify binary
file <binary> && readelf -h <binary>
# 2. Extract auth strings
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc" | grep -v "registry/src" | sort -u
# 3. Extract URLs/endpoints
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u
# 4. Extract config paths
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA" | grep -v "registry/src" | sort -u
# 5. Extract SQL queries (token stores)
strings <binary> | grep -iE "SELECT|INSERT|CREATE TABLE|DELETE FROM"
# 6. Extract API operations
strings <binary> | grep -oE "[A-Z][a-zA-Z]+Service\.[A-Z][a-zA-Z]+" | sort -u
# 7. Capture network traffic
strace -f -e trace=network -o /tmp/re/strace.log <binary> <cmd>
```
## Auth Flow Patterns
### Device Code Flow (AWS SSO OIDC)
1. POST /oauth2/device → deviceCode + userCode
2. User opens browser, enters code
3. POST /oauth2/token → poll until authorized
4. Response: accessToken + refreshToken
### PKCE OAuth
1. Generate code_verifier → code_challenge = SHA256
2. Browser auth → redirect with code
3. POST /token with code_verifier
4. Response: access_token + refresh_token
### External IdP (Social)
1. Redirect to Google/GitHub
2. Callback → extract tokens
3. Exchange for service token with profile ARN
## Token Storage
Common patterns:
- SQLite KV: `auth_kv` table, keys like `<app>:odic:token`
- Keyring: `secret-tool lookup <key>`
- JSON config: `~/.config/<app>/credentials.json`
## Output Requirements
Every RE session produces:
1. Binary profile
2. Auth flow map
3. Token schema
4. API endpoint list
5. State machine diagram
6. Bypass vectors
7. Config file map
## Related
- `skill reverse-engineering-binary — бинари`
- `skill cli-tooling — CLI`

201
reverse-engineering-dotnet-malware-with-dnspy/LICENSE Normal file
View File

@@ -0,0 +1,201 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to the Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by the Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding any notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. Please do not remove or change
the license header comment from a contributed file except when
necessary.
Copyright 2026 mukul975
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

348
reverse-engineering-dotnet-malware-with-dnspy/SKILL.md Normal file
View File

@@ -0,0 +1,348 @@
---
name: reverse-engineering-dotnet-malware-with-dnspy
description: 'Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify
obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders.
Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET
obfuscation analysis.
'
domain: cybersecurity
subdomain: malware-analysis
tags:
- malware
- dotnet
- reverse-engineering
- dnSpy
- decompilation
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
---
# Reverse Engineering .NET Malware with dnSpy
## When to Use
- A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation
- Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)
- Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators
- Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies
- Debugging .NET malware at runtime to observe decryption routines and dynamic behavior
**Do not use** for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis.
## Prerequisites
- dnSpy or dnSpyEx installed (https://github.com/dnSpyEx/dnSpy - community maintained fork)
- de4dot for automated .NET deobfuscation (`https://github.com/de4dot/de4dot`)
- ILSpy as an alternative decompiler for cross-validation
- .NET SDK installed for recompiling modified assemblies during analysis
- Isolated Windows VM for running dnSpy debugger on live malware
- Detect It Easy (DIE) for identifying the .NET obfuscator used
## Workflow
### Step 1: Identify .NET Assembly and Obfuscator
Verify the sample is a .NET binary and detect protection:
```bash
# Check if file is .NET assembly
file suspect.exe
# Output should contain "PE32 executable" with .NET metadata
# Detect obfuscator with Detect It Easy
diec suspect.exe
# Python-based .NET detection
python3 << 'PYEOF'
import pefile
pe = pefile.PE("suspect.exe")
# Check for .NET COM descriptor
if hasattr(pe, 'DIRECTORY_ENTRY_COM_DESCRIPTOR'):
print("[*] .NET assembly detected")
print(f" Runtime version: {pe.DIRECTORY_ENTRY_COM_DESCRIPTOR}")
else:
# Check for mscoree.dll import (alternative detection)
for entry in pe.DIRECTORY_ENTRY_IMPORT:
if entry.dll.decode().lower() == "mscoree.dll":
print("[*] .NET assembly detected (mscoree.dll import)")
break
else:
print("[!] Not a .NET assembly")
# Check section names for .NET indicators
for section in pe.sections:
name = section.Name.decode().rstrip('\x00')
if name in ['.text', '.rsrc', '.reloc']:
print(f" Section: {name} (typical .NET)")
PYEOF
```
### Step 2: Deobfuscate with de4dot
Remove common .NET obfuscation before manual analysis:
```bash
# Run de4dot to identify and remove obfuscation
de4dot suspect.exe -o suspect_cleaned.exe
# Force specific deobfuscator
de4dot suspect.exe -p cf # ConfuserEx
de4dot suspect.exe -p sa # SmartAssembly
de4dot suspect.exe -p dr # Dotfuscator
de4dot suspect.exe -p rv # Reactor
de4dot suspect.exe -p bl # Babel.NET
# Verbose output for debugging
de4dot -v suspect.exe -o suspect_cleaned.exe
# Handle multi-file assemblies
de4dot suspect.exe suspect_helper.dll -o cleaned/
```
```
Common .NET Obfuscators:
━━━━━━━━━━━━━━━━━━━━━━━
ConfuserEx: String encryption, control flow, anti-debug, anti-tamper
SmartAssembly: String encoding, flow obfuscation, pruning
Dotfuscator: Renaming, string encryption, control flow
.NET Reactor: Native code generation, necrobit, anti-debug
Babel.NET: String encryption, resource encryption, code virtualization
Crypto Obfuscator: String encryption, anti-debug, watermarking
Custom: Malware-specific obfuscation (manual de4dot configuration needed)
```
### Step 3: Open in dnSpy and Analyze Code
Load the deobfuscated assembly in dnSpy for source-level analysis:
```
dnSpy Analysis Workflow:
━━━━━━━━━━━━━━━━━━━━━━━
1. File -> Open -> Select cleaned assembly
2. Navigate to the entry point:
- Assembly Explorer -> <namespace> -> Program class -> Main method
- Or: Right-click assembly -> Go to Entry Point
3. Key areas to examine:
- Entry point (Main) for initialization and execution flow
- Form classes for UI-based malware (RATs, stealers)
- Network/HTTP classes for C2 communication
- Crypto/encryption classes for data protection
- Resource access for embedded payloads
- Timer/Thread classes for persistence and scheduling
4. Navigation shortcuts:
Ctrl+G - Go to token/address
Ctrl+Shift+K - Search assemblies
F12 - Go to definition
Ctrl+R - Analyze (find usages)
F5 - Start debugging
F9 - Toggle breakpoint
```
### Step 4: Extract Configuration and C2 Data
Locate hardcoded configuration in the decompiled source:
```csharp
// Common .NET malware configuration patterns:
// Pattern 1: Static class with hardcoded values
public static class Config {
public static string Host = "185.220.101.42";
public static int Port = 4782;
public static string Key = "GhOsT_RaT_2025";
public static string Mutex = "AsyncMutex_6SI8OkPnk";
public static bool Install = true;
public static string InstallFolder = "%AppData%";
}
// Pattern 2: Encrypted strings decrypted at runtime
public static string Decrypt(string input) {
byte[] data = Convert.FromBase64String(input);
byte[] key = Encoding.UTF8.GetBytes("SecretKey123");
for (int i = 0; i < data.Length; i++) {
data[i] ^= key[i % key.Length];
}
return Encoding.UTF8.GetString(data);
}
// Pattern 3: Resource-embedded configuration
byte[] configData = Properties.Resources.config;
string config = AES.Decrypt(configData, derivedKey);
```
```python
# Python script to extract .NET resource strings
import subprocess
import re
import base64
# Use monodis (Mono) or ildasm (.NET SDK) to dump IL
result = subprocess.run(
["monodis", "--output=il_dump.il", "suspect_cleaned.exe"],
capture_output=True, text=True
)
# Search for string literals in IL dump
with open("il_dump.il", errors="ignore") as f:
il_code = f.read()
# Find ldstr (load string) instructions
strings = re.findall(r'ldstr\s+"([^"]+)"', il_code)
for s in strings:
# Check for Base64 encoded strings
try:
decoded = base64.b64decode(s).decode('utf-8', errors='ignore')
if len(decoded) > 3 and decoded.isprintable():
print(f" Base64: {s[:40]}... -> {decoded[:100]}")
except:
pass
# Check for URLs/IPs
if re.match(r'https?://', s) or re.match(r'\d+\.\d+\.\d+\.\d+', s):
print(f" Network: {s}")
```
### Step 5: Debug with dnSpy
Set breakpoints and debug the malware to observe runtime behavior:
```
dnSpy Debugging Workflow:
━━━━━━━━━━━━━━━━━━━━━━━
1. Set breakpoints on key methods:
- String decryption functions (to capture decrypted values)
- Network connection methods (to capture C2 URLs)
- File write operations (to see what is dropped)
- Registry modification methods (to see persistence)
2. Debug -> Start Debugging (F5)
- Select the assembly to debug
- Set command-line arguments if needed
- Configure exception handling (break on all CLR exceptions)
3. At each breakpoint:
- Inspect local variables (Locals window)
- Evaluate expressions (Immediate window)
- View call stack to understand execution context
- Step over (F10) / Step into (F11) / Step out (Shift+F11)
4. Capture decrypted strings:
- Set breakpoint after decryption function returns
- Read the return value from the Locals window
- Document all decrypted configuration values
```
### Step 6: Document Findings
Compile analysis results into a structured report:
```
Analysis documentation should include:
- .NET assembly metadata (CLR version, target framework, compilation info)
- Obfuscator identified and deobfuscation method used
- Complete C2 configuration (hosts, ports, encryption keys, mutex names)
- Malware capabilities (keylogging, screen capture, file theft, etc.)
- Persistence mechanisms (registry, scheduled tasks, startup folder)
- Anti-analysis techniques (VM detection, debugger detection, sandbox evasion)
- Extracted IOCs (C2 IPs/domains, file hashes, mutex names, registry keys)
- YARA rule based on unique code patterns or strings
```
## Key Concepts
| Term | Definition |
|------|------------|
| **CIL/MSIL** | Common Intermediate Language; the bytecode format .NET assemblies compile to, which can be decompiled back to high-level C#/VB.NET |
| **Metadata Token** | Unique identifier for .NET types, methods, and fields within the assembly metadata tables; used for navigation in dnSpy |
| **de4dot** | Open-source .NET deobfuscator that identifies and removes protection from many commercial and malware-specific obfuscators |
| **ConfuserEx** | Popular open-source .NET obfuscator frequently used by malware authors for string encryption and control flow obfuscation |
| **String Encryption** | Obfuscation technique replacing string literals with encrypted data and runtime decryption calls to hide IOCs from static analysis |
| **Resource Embedding** | Storing configuration, payloads, or additional assemblies in .NET embedded resources, often encrypted with a key derived from assembly metadata |
| **Assembly.Load** | .NET method loading assemblies from byte arrays in memory, enabling fileless execution of embedded payloads |
## Tools & Systems
- **dnSpy/dnSpyEx**: Open-source .NET assembly editor, decompiler, and debugger supporting C# and VB.NET decompilation
- **de4dot**: Automated .NET deobfuscator supporting ConfuserEx, SmartAssembly, Dotfuscator, Reactor, and many other protectors
- **ILSpy**: Open-source .NET decompiler providing C#, VB.NET, and IL views of assembly code
- **dotPeek**: JetBrains' free .NET decompiler with symbol server and cross-reference navigation
- **Detect It Easy (DIE)**: Multi-format file analyzer identifying .NET framework version, obfuscator, and compiler information
## Common Scenarios
### Scenario: Analyzing an AgentTesla Information Stealer
**Context**: A phishing email delivers a .NET executable identified as AgentTesla. The sample needs analysis to determine what credentials it steals, how it exfiltrates data, and its C2 configuration.
**Approach**:
1. Run Detect It Easy to identify the obfuscator (commonly ConfuserEx or custom)
2. Deobfuscate with de4dot to restore readable class/method names and decrypt strings
3. Open in dnSpy and navigate to the entry point to understand initialization
4. Locate the credential harvesting modules (browser, email, FTP, VPN password theft classes)
5. Find the exfiltration method (SMTP email, FTP upload, HTTP POST, Telegram bot API)
6. Extract C2 configuration (SMTP server, credentials, recipient email, or HTTP URL)
7. Set debugger breakpoints on the decryption function to capture all decrypted strings at once
**Pitfalls**:
- Analyzing without de4dot first (ConfuserEx makes manual analysis extremely difficult)
- Not checking for multi-stage loading (initial .NET executable may load additional assemblies from resources)
- Missing configuration stored in .NET resources rather than hardcoded strings
- Running the debugger without network isolation (AgentTesla will attempt to exfiltrate immediately)
## Output Format
```
.NET MALWARE ANALYSIS REPORT
================================
Sample: invoice_scanner.exe
SHA-256: e3b0c44298fc1c149afbf4c8996fb924...
Type: .NET Assembly (C#)
Framework: .NET Framework 4.8
Obfuscator: ConfuserEx v1.6
Deobfuscated: Yes (de4dot -p cf)
CLASSIFICATION
Family: AgentTesla v3
Type: Information Stealer / Keylogger
Compile Date: 2025-09-10
C2 CONFIGURATION
Exfil Method: SMTP (Email)
SMTP Server: smtp.yandex[.]com:587
SMTP User: exfil.account@yandex[.]com
SMTP Pass: Str0ngP@ssw0rd2025
Recipient: operator@protonmail[.]com
Interval: 30 minutes
Encryption: AES-256 with key "AgentTesla_2025_key"
CAPABILITIES
[*] Browser credential theft (Chrome, Firefox, Edge, Opera)
[*] Email client passwords (Outlook, Thunderbird)
[*] FTP client credentials (FileZilla, WinSCP)
[*] VPN credentials (NordVPN, OpenVPN)
[*] Keylogging (SetWindowsHookEx)
[*] Screenshot capture (every 30 seconds)
[*] Clipboard monitoring
PERSISTENCE
Method: Registry Run key + Scheduled Task
Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
Task: \Microsoft\Windows\WindowsUpdate\Updater
EXTRACTED IOCs
SMTP Server: smtp.yandex[.]com
Exfil Email: exfil.account@yandex[.]com
Recipient: operator@protonmail[.]com
Mutex: AgentTesla_2025_Q3_MUTEX
Install Path: %AppData%\Microsoft\Windows\svchost.exe
```

68
reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md Normal file
View File

@@ -0,0 +1,68 @@
# API Reference: .NET Malware Reverse Engineering with dnSpy Agent
## Overview
Analyzes .NET malware: validates CLR headers, detects obfuscators (ConfuserEx, SmartAssembly), deobfuscates with de4dot, extracts strings/IOCs, and parses .NET metadata via monodis.
## Dependencies
| Package | Version | Purpose |
|---------|---------|---------|
| hashlib | stdlib | Sample hash computation |
| struct | stdlib | PE/CLR header parsing |
| re | stdlib | String pattern extraction |
## External Tools (Optional)
| Tool | Purpose |
|------|---------|
| diec (Detect It Easy) | Obfuscator identification |
| de4dot | Automated .NET deobfuscation |
| monodis | .NET assembly metadata extraction |
## Core Functions
### `detect_dotnet_assembly(filepath)`
Validates PE file has CLR header (COM descriptor directory entry).
- **Checks**: MZ signature, PE signature, optional header magic, CLR RVA
- **Returns**: `dict` with `is_dotnet`, `clr_header_rva`
### `detect_obfuscator(filepath)`
Runs Detect It Easy to identify ConfuserEx, SmartAssembly, .NET Reactor, Dotfuscator, Babel, Eazfuscator, Crypto Obfuscator.
- **Returns**: `dict` with `detected` list
### `deobfuscate_with_de4dot(filepath, output_path)`
Runs de4dot to remove obfuscation, producing a cleaner assembly.
- **Timeout**: 120 seconds
- **Returns**: `dict` with `success`, `output_path`
### `extract_strings(filepath, min_length)`
Extracts ASCII and Unicode strings, classifies into URLs, IPs, emails, registry keys, base64, and suspicious keywords (keylog, stealer, webhook, etc.).
- **Returns**: `dict[str, list[str]]` - categorized indicator lists
### `analyze_dotnet_metadata(filepath)`
Uses monodis to extract assembly info, type definitions, and method counts.
- **Returns**: `dict` with `type_count`, `method_count`, `types`
### `analyze_dotnet_malware(filepath, output_dir)`
Full pipeline: hashes -> .NET check -> obfuscator detection -> deobfuscation -> strings -> metadata.
## Obfuscators Detected
| Obfuscator | Indicator |
|------------|-----------|
| ConfuserEx | Most common open-source .NET obfuscator |
| SmartAssembly | Commercial obfuscator by Redgate |
| .NET Reactor | Code protection with native stub |
| Dotfuscator | Microsoft-provided obfuscator |
| Eazfuscator | Commercial string/flow obfuscation |
## Suspicious String Keywords
`keylog`, `screenshot`, `clipboard`, `password`, `credential`, `smtp`, `telegram`, `discord`, `webhook`, `stealer`, `inject`, `hook`, `persist`, `startup`
## Usage
```bash
python agent.py suspect.exe
```

218
reverse-engineering-dotnet-malware-with-dnspy/scripts/agent.py Normal file
View File

@@ -0,0 +1,218 @@
#!/usr/bin/env python3
""".NET malware reverse engineering agent using subprocess wrappers for dnSpy/de4dot."""
import subprocess
import os
import sys
import re
import hashlib
import struct
def compute_hashes(filepath):
"""Compute hashes for sample identification."""
with open(filepath, "rb") as f:
data = f.read()
return {
"md5": hashlib.md5(data).hexdigest(),
"sha256": hashlib.sha256(data).hexdigest(),
"size": len(data),
}
def detect_dotnet_assembly(filepath):
"""Check if file is a .NET assembly by looking for CLI header."""
with open(filepath, "rb") as f:
data = f.read(512)
if data[:2] != b"MZ":
return {"is_dotnet": False, "reason": "Not a PE file"}
try:
pe_offset = struct.unpack_from("<I", data, 0x3C)[0]
if pe_offset + 4 > len(data):
return {"is_dotnet": False, "reason": "Invalid PE header"}
if data[pe_offset:pe_offset + 4] != b"PE\x00\x00":
return {"is_dotnet": False, "reason": "Invalid PE signature"}
opt_offset = pe_offset + 24
magic = struct.unpack_from("<H", data, opt_offset)[0]
if magic == 0x10B:
clr_offset = opt_offset + 208
elif magic == 0x20B:
clr_offset = opt_offset + 224
else:
return {"is_dotnet": False, "reason": "Unknown PE format"}
if clr_offset + 8 <= len(data):
clr_rva, clr_size = struct.unpack_from("<II", data, clr_offset)
if clr_rva > 0 and clr_size > 0:
return {"is_dotnet": True, "clr_header_rva": clr_rva, "clr_size": clr_size}
return {"is_dotnet": False, "reason": "No CLR header"}
except (struct.error, IndexError):
return {"is_dotnet": False, "reason": "Parse error"}
def detect_obfuscator(filepath):
"""Detect .NET obfuscator using Detect It Easy."""
try:
result = subprocess.run(
["diec", filepath], capture_output=True, text=True, timeout=30
)
output = result.stdout
obfuscators = {
"ConfuserEx": "confuser" in output.lower(),
"SmartAssembly": "smartassembly" in output.lower(),
".NET Reactor": "reactor" in output.lower(),
"Dotfuscator": "dotfuscator" in output.lower(),
"Babel": "babel" in output.lower(),
"Eazfuscator": "eazfuscator" in output.lower(),
"Crypto Obfuscator": "crypto" in output.lower() and "obfuscator" in output.lower(),
}
detected = [name for name, found in obfuscators.items() if found]
return {"detected": detected, "raw_output": output.strip()}
except FileNotFoundError:
return {"detected": [], "raw_output": "diec not installed"}
def deobfuscate_with_de4dot(filepath, output_path):
"""Run de4dot to deobfuscate .NET assembly."""
try:
result = subprocess.run(
["de4dot", filepath, "-o", output_path],
capture_output=True, text=True, timeout=120
)
return {
"success": result.returncode == 0,
"output_path": output_path,
"stdout": result.stdout[-500:] if result.stdout else "",
}
except FileNotFoundError:
return {"success": False, "error": "de4dot not installed"}
def extract_strings(filepath, min_length=8):
"""Extract strings and classify for IOCs."""
with open(filepath, "rb") as f:
data = f.read()
unicode_strings = re.findall(
rb"(?:[\x20-\x7e]\x00){%d,}" % min_length, data
)
ascii_strings = re.findall(
rb"[\x20-\x7e]{%d,}" % min_length, data
)
all_strings = set()
for s in ascii_strings:
all_strings.add(s.decode("ascii", errors="ignore"))
for s in unicode_strings:
all_strings.add(s.decode("utf-16-le", errors="ignore"))
indicators = {
"urls": [], "ips": [], "emails": [],
"registry_keys": [], "file_paths": [],
"base64_strings": [], "suspicious_strings": [],
}
suspicious_keywords = [
"keylog", "screenshot", "clipboard", "password", "credential",
"smtp", "telegram", "discord", "webhook", "stealer",
"inject", "hook", "persist", "startup",
]
for s in all_strings:
if re.search(r"https?://", s):
indicators["urls"].append(s)
if re.search(r"\b(\d{1,3}\.){3}\d{1,3}\b", s):
indicators["ips"].append(s)
if re.search(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}", s):
indicators["emails"].append(s)
if re.search(r"HKLM|HKCU|SOFTWARE\\", s, re.IGNORECASE):
indicators["registry_keys"].append(s)
if re.search(r"[A-Za-z0-9+/]{40,}={0,2}$", s):
indicators["base64_strings"].append(s[:100])
for kw in suspicious_keywords:
if kw in s.lower():
indicators["suspicious_strings"].append(s[:100])
break
for key in indicators:
indicators[key] = list(set(indicators[key]))[:20]
return indicators
def analyze_dotnet_metadata(filepath):
"""Extract .NET metadata using monodis or ilspy CLI if available."""
metadata = {}
try:
result = subprocess.run(
["monodis", "--assembly", filepath],
capture_output=True, text=True, timeout=15
)
if result.returncode == 0:
metadata["assembly_info"] = result.stdout.strip()
except FileNotFoundError:
pass
try:
result = subprocess.run(
["monodis", "--typedef", filepath],
capture_output=True, text=True, timeout=15
)
if result.returncode == 0:
types = re.findall(r"(\S+)\s+flags", result.stdout)
metadata["type_count"] = len(types)
metadata["types"] = types[:30]
except FileNotFoundError:
pass
try:
result = subprocess.run(
["monodis", "--method", filepath],
capture_output=True, text=True, timeout=15
)
if result.returncode == 0:
methods = re.findall(r"(\S+)\s+\(", result.stdout)
metadata["method_count"] = len(methods)
except FileNotFoundError:
pass
return metadata
def analyze_dotnet_malware(filepath, output_dir="/tmp/dotnet_analysis"):
"""Full .NET malware analysis pipeline."""
os.makedirs(output_dir, exist_ok=True)
report = {"file": filepath}
report["hashes"] = compute_hashes(filepath)
report["dotnet_check"] = detect_dotnet_assembly(filepath)
if not report["dotnet_check"].get("is_dotnet"):
report["error"] = "Not a .NET assembly"
return report
report["obfuscator"] = detect_obfuscator(filepath)
deobf_path = os.path.join(output_dir, "deobfuscated.exe")
report["deobfuscation"] = deobfuscate_with_de4dot(filepath, deobf_path)
analysis_target = deobf_path if report["deobfuscation"].get("success") else filepath
report["strings"] = extract_strings(analysis_target)
report["metadata"] = analyze_dotnet_metadata(analysis_target)
return report
def print_report(report):
print(".NET Malware Analysis Report")
print("=" * 50)
print(f"File: {report['file']}")
print(f"SHA-256: {report['hashes']['sha256']}")
print(f".NET Assembly: {report['dotnet_check'].get('is_dotnet', False)}")
obf = report.get("obfuscator", {})
if obf.get("detected"):
print(f"Obfuscator: {', '.join(obf['detected'])}")
deobf = report.get("deobfuscation", {})
print(f"Deobfuscation: {'Success' if deobf.get('success') else 'Failed/Skipped'}")
meta = report.get("metadata", {})
if meta:
print(f"Types: {meta.get('type_count', 'N/A')}, Methods: {meta.get('method_count', 'N/A')}")
strings = report.get("strings", {})
if strings:
print("\nExtracted Indicators:")
for cat, values in strings.items():
if values:
print(f" {cat}: {len(values)}")
for v in values[:3]:
print(f" - {v[:80]}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python agent.py <dotnet_executable>")
sys.exit(1)
result = analyze_dotnet_malware(sys.argv[1])
print_report(result)

159
reverse-engineering-full/SKILL.md Normal file
View File

@@ -0,0 +1,159 @@
---
name: reverse-engineering-full
description: Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol
RE, auth flow mapping, IPC analysis, shell integration, telemetry extraction, token
storage, state machine reconstruction, API enumeration, and security report generation.
Covers Rust, Go, C/C++, Python, .NET, Java.
version: 1.0.0
platforms:
- linux
- macos
- windows
triggers:
- reverse
- engineering
- full
- spectrum
- binary
- elf
- mach
- protocol
- auth
- flow
- mapping
- ipc
depends_on: []
metadata:
tags:
- reverse
- engineering
- full
---
# Reverse Engineering — Full Framework
## When to Use
- Any binary reverse engineering task
- Protocol analysis (IPC, network, file format)
- Auth flow mapping and token extraction
- Telemetry and data collection analysis
- Shell/terminal integration analysis
- API endpoint enumeration from binaries
- State machine reconstruction
- Security assessment of closed-source software
- Migration path analysis (rebrand/fork detection)
- Bypass vector identification
## Core Protocol
Load `skills/meta-rules/meta-re/re-full-practice.md` for the complete methodology.
## Quick Start
```bash
# Phase 1: Binary profiling (always first)
file <binary> && readelf -h <binary> 2>/dev/null || otool -h <binary> 2>/dev/null
strings <binary> | head -100 # Quick scan
# Phase 2: String extraction by category
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc|cookie" > /tmp/re/auth.txt
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u > /tmp/re/urls.txt
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA|registry" | grep -v "registry/src" > /tmp/re/paths.txt
strings <binary> | grep -iE "error|fail|panic|assert|exception" | grep -v "registry/src" > /tmp/re/errors.txt
# Phase 3: Language detection
strings <binary> | grep -oE "crates/[^/]+" | sort -u # Rust
strings <binary> | grep -oE "vendor/[^/]+" | sort -u # Go
strings <binary> | grep -oE "site-packages/[^/]+" | sort -u # Python
strings <binary> | grep -oE "node_modules/[^/]+" | sort -u # Node
# Phase 4: Protocol analysis
strings <binary> | grep -iE "\.(proto|mux|ipc|rpc|grpc)" | sort -u
strings <binary> | grep -iE "unix.socket|socket.path|named.pipe" | sort -u
# Phase 5: Generate report
# Use the report template from skills/meta-rules/meta-re/re-report-template.md
```
## Phase Breakdown
### Phase 1: Binary Reconnaissance
- File type, architecture, bitness
- Stripped vs debug symbols
- Dynamic dependencies (ldd/otool)
- Packed/obfuscated detection
- Language/framework identification
### Phase 2: String Extraction & Classification
- Auth/credential strings
- URLs/endpoints
- File paths/config locations
- Error messages (state indicators)
- Protocol/message type names
- Environment variables
- Telemetry/analytics identifiers
### Phase 3: Structural Analysis
- Import table analysis
- Section analysis (.text, .rodata, .data)
- Symbol table (if not stripped)
- Embedded resources
- Certificate/signature info
### Phase 4: Protocol Reverse Engineering
- IPC mechanism (Unix sockets, named pipes, TCP, D-Bus)
- Message format (Protobuf, JSON, custom binary)
- Request/response patterns
- State machine from message types
- Authentication within protocol
### Phase 5: Auth Flow Mapping
- Login methods enumeration
- Token storage location and format
- Refresh mechanism
- Session management
- Logout/cleanup behavior
### Phase 6: Telemetry & Data Collection
- Event types enumeration
- Data fields per event
- Destination endpoints
- Frequency/triggers
- Opt-out mechanisms
### Phase 7: Security Analysis
- Token storage security
- Communication encryption
- Permission model
- Attack surface mapping
- Bypass vectors
### Phase 8: Report Generation
- Use the structured report template
- Include all findings with evidence
- Provide architecture diagrams
- List actionable security findings
## Output Requirements
Every RE session produces a report with these sections:
1. Binary Profile
2. Language & Framework
3. Crate/Module Architecture
4. Auth Flow Map
5. Token Storage Schema
6. State Machine
7. API Endpoints
8. IPC Protocol
9. Shell/Integration Analysis
10. Telemetry Schema
11. Security Findings
12. Architecture Diagram
13. Bypass Vectors
14. Migration/Rebrand Analysis (if applicable)
## Related
- `skill reverse-engineering-binary — бинари`
- `skill reverse-engineering-obfuscation — деобфускация`

201
reverse-engineering-ios-app-with-frida/LICENSE Normal file
View File

@@ -0,0 +1,201 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to the Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by the Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding any notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. Please do not remove or change
the license header comment from a contributed file except when
necessary.
Copyright 2026 mukul975
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

251
reverse-engineering-ios-app-with-frida/SKILL.md Normal file
View File

@@ -0,0 +1,251 @@
---
name: reverse-engineering-ios-app-with-frida
description: 'Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract
encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing
authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime
secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift
method tracing, or iOS binary analysis.
'
domain: cybersecurity
subdomain: mobile-security
author: mahipal
tags:
- mobile-security
- ios
- frida
- reverse-engineering
- owasp-mobile
- penetration-testing
version: 1.0.0
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
---
# Reverse Engineering iOS App with Frida
## When to Use
Use this skill when:
- Analyzing iOS app internals during authorized security assessments without source code
- Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps
- Understanding obfuscated Swift/Objective-C logic through runtime method tracing
- Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging)
**Do not use** this skill for unauthorized reverse engineering that violates terms of service or intellectual property law.
## Prerequisites
- Jailbroken iOS device with Frida server installed via Cydia/Sileo, or non-jailbroken device with Frida Gadget-injected IPA
- Python 3.10+ with `frida-tools` (`pip install frida-tools`)
- USB connection to iOS device
- class-dump or dsdump for Objective-C header extraction
- Hopper Disassembler or Ghidra for static binary analysis (complementary)
- Knowledge of Objective-C runtime and Swift name mangling
## Workflow
### Step 1: Extract and Analyze the Binary
```bash
# On jailbroken device, find app binary
ssh root@<device_ip>
find /var/containers/Bundle/Application/ -name "TargetApp" -type f
# Pull decrypted binary (apps from App Store are encrypted with FairPlay)
# Use frida-ios-dump or Clutch for decryption
pip install frida-ios-dump
dump.py com.target.app
# Extract Objective-C class headers
class-dump -H decrypted_binary -o headers/
ls headers/ # Lists all class header files
```
### Step 2: Enumerate Classes and Methods at Runtime
```javascript
// enumerate_classes.js - List all loaded classes
Java.perform(function() {}); // N/A for iOS
// iOS uses ObjC runtime
if (ObjC.available) {
var classes = ObjC.classes;
for (var className in classes) {
if (className.indexOf("Target") !== -1 ||
className.indexOf("Auth") !== -1 ||
className.indexOf("Crypto") !== -1) {
console.log("[Class] " + className);
// List methods
var methods = classes[className].$ownMethods;
for (var i = 0; i < methods.length; i++) {
console.log(" [Method] " + methods[i]);
}
}
}
}
```
```bash
frida -U -n TargetApp -l enumerate_classes.js
```
### Step 3: Trace Method Calls with frida-trace
```bash
# Trace all methods of a class
frida-trace -U -n TargetApp -m "*[TargetAuth *]"
# Trace specific patterns
frida-trace -U -n TargetApp -m "*[*Crypto* *]"
frida-trace -U -n TargetApp -m "*[*KeyChain* *]"
frida-trace -U -n TargetApp -m "*[*Token* *]"
# Trace Swift methods (mangled names)
frida-trace -U -n TargetApp -m "*[*$s*Auth*]"
```
### Step 4: Hook and Modify Method Behavior
```javascript
// hook_auth.js - Intercept authentication logic
if (ObjC.available) {
// Hook Objective-C method
var AuthManager = ObjC.classes.AuthManager;
if (AuthManager) {
Interceptor.attach(AuthManager["- validateToken:"].implementation, {
onEnter: function(args) {
// args[0] = self, args[1] = selector, args[2+] = method args
var token = new ObjC.Object(args[2]);
console.log("[Auth] validateToken called with: " + token.toString());
},
onLeave: function(retval) {
console.log("[Auth] validateToken returned: " + retval);
// Optionally modify return value
// retval.replace(ptr(1)); // Force return true
}
});
}
// Hook CommonCrypto for encryption analysis
var CCCrypt = Module.findExportByName("libcommonCrypto.dylib", "CCCrypt");
if (CCCrypt) {
Interceptor.attach(CCCrypt, {
onEnter: function(args) {
this.operation = args[0].toInt32(); // 0=encrypt, 1=decrypt
this.algorithm = args[1].toInt32(); // 0=AES128, 1=DES, 2=3DES
this.keyLength = args[4].toInt32();
this.key = Memory.readByteArray(args[3], this.keyLength);
console.log("[CCCrypt] Op:" + (this.operation === 0 ? "Encrypt" : "Decrypt"));
console.log("[CCCrypt] Key: " + hexify(this.key));
},
onLeave: function(retval) {
console.log("[CCCrypt] Status: " + retval);
}
});
}
}
function hexify(buffer) {
var bytes = new Uint8Array(buffer);
var hex = [];
for (var i = 0; i < bytes.length; i++) {
hex.push(("0" + bytes[i].toString(16)).slice(-2));
}
return hex.join("");
}
```
### Step 5: Analyze Swift Code
```javascript
// swift_analysis.js - Hook Swift methods
// Swift methods use name mangling: $s<module><class><method>
// Use frida-trace to discover actual mangled names first
if (ObjC.available) {
// Swift classes that inherit from NSObject are accessible via ObjC runtime
var swiftClasses = Object.keys(ObjC.classes).filter(function(name) {
return name.indexOf("_TtC") === 0 || name.indexOf("TargetApp.") !== -1;
});
swiftClasses.forEach(function(className) {
console.log("[Swift] " + className);
var methods = ObjC.classes[className].$ownMethods;
methods.forEach(function(method) {
console.log(" " + method);
});
});
}
// For pure Swift (non-ObjC-bridged), use Module.enumerateExports
Module.enumerateExports("TargetApp", {
onMatch: function(exp) {
if (exp.name.indexOf("Auth") !== -1 || exp.name.indexOf("Crypto") !== -1) {
console.log("[Export] " + exp.name + " @ " + exp.address);
}
},
onComplete: function() {}
});
```
### Step 6: Extract Secrets and Proprietary Data
```javascript
// extract_secrets.js
if (ObjC.available) {
// Hook NSUserDefaults
var NSUserDefaults = ObjC.classes.NSUserDefaults;
Interceptor.attach(NSUserDefaults["- objectForKey:"].implementation, {
onEnter: function(args) {
this.key = new ObjC.Object(args[2]).toString();
},
onLeave: function(retval) {
if (retval.isNull()) return;
var value = new ObjC.Object(retval);
console.log("[NSUserDefaults] " + this.key + " = " + value.toString());
}
});
// Hook Keychain access
var SecItemCopyMatching = Module.findExportByName("Security", "SecItemCopyMatching");
Interceptor.attach(SecItemCopyMatching, {
onEnter: function(args) {
var query = new ObjC.Object(args[0]);
console.log("[Keychain] Query: " + query.toString());
},
onLeave: function(retval) {
console.log("[Keychain] Result: " + retval);
}
});
}
```
## Key Concepts
| Term | Definition |
|------|-----------|
| **Objective-C Runtime** | Dynamic runtime enabling method dispatch, class introspection, and method swizzling at runtime |
| **Swift Name Mangling** | Compiler-applied encoding of Swift function signatures into linker-compatible symbol names |
| **FairPlay DRM** | Apple's encryption applied to App Store binaries; must be decrypted before static analysis |
| **class-dump** | Tool extracting Objective-C class declarations from Mach-O binaries for header-level analysis |
| **CommonCrypto** | Apple's C-level cryptographic library; primary target for encryption key extraction via Frida hooks |
## Tools & Systems
- **Frida**: Dynamic instrumentation framework for iOS runtime hooking and method interception
- **frida-trace**: Automated tracing utility that generates handler stubs for matched methods
- **frida-ios-dump**: Tool for decrypting FairPlay-protected iOS apps via memory dumping
- **class-dump / dsdump**: Objective-C header extraction from Mach-O binaries
- **Ghidra**: NSA's reverse engineering framework for static ARM64 binary analysis of iOS apps
## Common Pitfalls
- **FairPlay encryption**: Apps downloaded from the App Store are encrypted. You must decrypt before static analysis. Use frida-ios-dump on a jailbroken device.
- **Swift-only classes**: Pure Swift classes without `@objc` annotation are not visible through `ObjC.classes`. Use `Module.enumerateExports()` instead.
- **Stripped binaries**: Release builds strip debug symbols. Combine frida-trace with class-dump output for effective analysis.
- **Anti-Frida measures**: Sophisticated apps check for Frida artifacts (frida-server process, Frida agent strings in memory, injected libraries in dyld). Use stealthy Frida builds or Frida Gadget injection.

38
reverse-engineering-ios-app-with-frida/assets/template.md Normal file
View File

@@ -0,0 +1,38 @@
# iOS Reverse Engineering Assessment Report
## Target Application
| Field | Value |
|-------|-------|
| App Name | [NAME] |
| Bundle ID | [BUNDLE_ID] |
| Binary Type | [Objective-C/Swift/Mixed] |
| iOS Version | [VERSION] |
| FairPlay Encrypted | [YES/NO] |
| Analysis Date | [DATE] |
## Class Enumeration
| Class Name | Method Count | Category |
|-----------|-------------|----------|
| [CLASS] | [N] | [Auth/Crypto/Network/Storage] |
## Hooked Methods and Findings
### [METHOD_SIGNATURE]
- **Arguments observed**: [ARGS]
- **Return values**: [RETURNS]
- **Security implication**: [DESCRIPTION]
## Extracted Secrets
| Type | Location | Value (redacted) | Risk |
|------|----------|-----------------|------|
| [API Key/Token/Password] | [CLASS.METHOD] | [REDACTED] | [RISK] |
## Binary Protection Assessment
| Protection | Status | Details |
|-----------|--------|---------|
| Jailbreak Detection | [Present/Absent] | [DETAILS] |
| Frida Detection | [Present/Absent] | [DETAILS] |
| Code Obfuscation | [Yes/No] | [DETAILS] |
| Anti-Debug | [Present/Absent] | [DETAILS] |
## Recommendations
1. [RECOMMENDATION]

48
reverse-engineering-ios-app-with-frida/references/api-reference.md Normal file
View File

@@ -0,0 +1,48 @@
# API Reference: iOS App Reverse Engineering with Frida
## Frida CLI Tools
| Command | Description |
|---------|-------------|
| `frida-ps -Ua` | List running apps on USB device |
| `frida -U -n AppName -e "script"` | Attach to app and run script |
| `frida -U -f com.app.bundle -l script.js` | Spawn app with script |
| `frida-trace -U -n AppName -m "*[ClassName *]"` | Trace ObjC methods |
| `frida-discover -U -n AppName` | Discover available functions |
## Frida JavaScript API
| API | Description |
|-----|-------------|
| `ObjC.classes.ClassName` | Access Objective-C class |
| `ObjC.classes.Cls.$ownMethods` | List class methods |
| `Interceptor.attach(target, callbacks)` | Hook native function |
| `Interceptor.replace(target, replacement)` | Replace function implementation |
| `Module.findExportByName(null, "func")` | Find exported C function |
| `ObjC.Object(ptr)` | Wrap pointer as ObjC object |
| `Memory.readUtf8String(ptr)` | Read string from memory |
## Common iOS Security Hooks
| Target | Purpose |
|--------|---------|
| `SSLSetPeerDomainName` | Bypass SSL pinning |
| `NSFileManager fileExistsAtPath:` | Jailbreak detection |
| `CCCrypt` | Intercept encryption calls |
| `NSURLSession` | Monitor network requests |
| `SecItemCopyMatching` | Keychain access |
## Python Libraries
| Library | Version | Purpose |
|---------|---------|---------|
| `subprocess` | stdlib | Execute frida CLI tools |
| `frida` | >=16.0 | Frida Python bindings |
| `json` | stdlib | Report generation |
## References
- Frida Documentation: https://frida.re/docs/home/
- Frida JavaScript API: https://frida.re/docs/javascript-api/
- objection: https://github.com/sensepost/objection
- OWASP Mobile Testing Guide: https://mas.owasp.org/MASTG/

27
reverse-engineering-ios-app-with-frida/references/standards.md Normal file
View File

@@ -0,0 +1,27 @@
# Standards Reference: iOS Reverse Engineering with Frida
## OWASP Mobile Top 10 2024 Mapping
| OWASP ID | Risk | RE Assessment |
|----------|------|---------------|
| M1 | Improper Credential Usage | Extract hardcoded keys via runtime hooking |
| M7 | Insufficient Binary Protections | Assess anti-RE measures (obfuscation, anti-debug, anti-Frida) |
| M10 | Insufficient Cryptography | Hook CommonCrypto to extract keys and observe algorithms |
## OWASP MASVS v2.0 - MASVS-RESILIENCE Controls
| Control | Description | Frida Test Method |
|---------|-------------|-------------------|
| MASVS-RESILIENCE-1 | App detects and responds to reverse engineering | Test with Frida attachment, observe detection |
| MASVS-RESILIENCE-2 | App detects tampering | Modify binary, observe integrity checks |
| MASVS-RESILIENCE-3 | App uses obfuscation | Assess class/method name readability |
| MASVS-RESILIENCE-4 | App detects debuggers | Attach debugger, check ptrace/sysctl hooks |
## CWE Mappings
| CWE ID | Title | RE Discovery Method |
|--------|-------|-------------------|
| CWE-798 | Use of Hard-coded Credentials | Hook string initialization, NSUserDefaults access |
| CWE-321 | Use of Hard-coded Cryptographic Key | Hook CCCrypt, SecKeyCreateWithData |
| CWE-327 | Broken Crypto Algorithm | Observe algorithm parameter in CCCrypt calls |
| CWE-693 | Protection Mechanism Failure | Bypass jailbreak detection, Frida detection |

Some files were not shown because too many files have changed in this diff Show More