[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DAFNET6NJ8K5VYKHYW0FWT":3,"skill-same:01M6DAFNET6NJ8K5VYKHYW0FWT":58},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":27,"linkOnly":28,"markdownContent":29,"markdownBody":30,"frontMatter":31,"refName":32,"commitSha":33,"skillDirectory":34,"forksCount":14,"repositoryHtmlUrl":35,"repositoryHomepageUrl":6,"ownerHtmlUrl":36,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":37,"install":38,"resources":51},"01M6DAFNET6NJ8K5VYKHYW0FWT","game-unpack-pe",null,"Use when asked to unpack, unprotect, or extract real code from a protected or obfuscated Windows executable. Applies when a binary shows a stub entry point, packed sections, few imports, or signs of VMProtect, Themida, UPX, or custom packers.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Flibrary\u002Fskills\u002Fgame-unpack-pe\u002FSKILL.md",[],[19,20,21,22,23,24,25,26],"game","game unpack pe","windows","code","UPX","extract","use","binary","2026-11-10 10:12:30",false,"---\nname: game-unpack-pe\ndescription: Use when asked to unpack, unprotect, or extract real code from a protected or obfuscated Windows executable. Applies when a binary shows a stub entry point, packed sections, few imports, or signs of VMProtect, Themida, UPX, or custom packers.\n---\n\n# PE Unpacking\n\n## Overview\nIdentify the packer → find the Original Entry Point (OEP) → dump at OEP → fix IAT.\nThe dump is worthless without a fixed IAT; the IAT is unfixable without the correct OEP.\n\n## Packer Detection\n\n### Static Signals (check first via Binary Ninja)\n```python\nlist_sections()     # .UPX0\u002F.UPX1 = UPX; .vmp0\u002F.vmp1 = VMProtect; .themida = Themida\nlist_imports()      # Only LoadLibrary + GetProcAddress = unpacking stub\nget_entry_points()  # Entry point outside .text section = packer stub\n```\n\n### Packer Identification Table\n\n| Packer | Static signature | Fast path |\n|---|---|---|\n| UPX | `.UPX0`, `.UPX1` sections | `upx -d target.exe` (CLI, done) |\n| MPRESS | `.MPRESS1` section | mpress unpacker tool |\n| VMProtect | `.vmp0`\u002F`.vmp1`, VM interpreter loop at EP | `C:\\GameSecTools\\Packing\\NoVmpy` or manual |\n| Themida | Complex EP + anti-debug at start | `C:\\GameSecTools\\Packing\\themida-unmutate` |\n| Custom | One giant section, no real imports | Dynamic dump approach below |\n\n## UPX (Trivial Case)\n```powershell\nupx -d target.exe   # produces unpacked target.exe immediately\n```\nVerify: `list_imports()` on result should show real API names.\n\n## Dynamic Unpacking (Universal Approach)\n\n### Step 1 — Find Where Unpacking Ends\n**Using Frida** (set breakpoint on memory-write to .text):\n```javascript\n\u002F\u002F Get .text section base + size from list_sections() output first\nconst textBase = ptr(\"0x401000\");   \u002F\u002F replace with actual .text base\nconst textSize = 0x50000;           \u002F\u002F replace with actual size\n\nMemoryAccessMonitor.enable({base: textBase, size: textSize}, {\n    onAccess(details) {\n        if (details.operation === 'write') {\n            console.log(\"[WRITE TO .TEXT]\", details.address, \"from\", details.from);\n            \u002F\u002F Single-step from here to find OEP\n        }\n    }\n});\n```\n\n**Using Cheat Engine MCP:**\n```python\n# Set hardware BP on the .text section start address\nset_data_breakpoint(address=0x401000, size=4, break_on=\"write\")\n# Run until BP fires (unpacker writing decompressed code)\n# Then step until you see `jmp \u003Coriginal_entry>`\n```\n\n### Step 2 — Dump at OEP\nOnce at OEP, use KsDumper:\n```\nC:\\GameSecTools\\Memory\\KsDumper\n→ select target process → dump → save\n```\nOr via Frida (raw memory dump):\n```javascript\nconst mod = Process.getModuleByName(\"target.exe\");\nconst dump = mod.base.readByteArray(mod.size);\n\u002F\u002F Save dump via File.writeAllBytes or send() to host\n```\n\n### Step 3 — Fix Import Table\nThe dumped binary has invalid IAT pointers. Fix with **Scylla** (x64dbg plugin) or manually:\n\n```javascript\n\u002F\u002F Frida: collect resolved API addresses during unpacking\n\u002F\u002F Hook GetProcAddress while unpacker resolves APIs\nconst gpa = Module.getExportByName(\"kernel32.dll\", \"GetProcAddress\");\nInterceptor.attach(gpa, {\n    onEnter(args) { this.name = args[1].readAnsiString(); },\n    onLeave(retval) {\n        console.log(\"[IAT]\", this.name, \"=\", retval);\n        \u002F\u002F Use this map to patch IAT in the dump\n    }\n});\n```\n\n### Step 4 — Verify Dump\n```python\nselect_binary(dumped_path)\nlist_imports()      # Should show real API names, not just LoadLibrary\nlist_functions()    # Should show many functions, not just packer stub\nget_entry_points()  # Should be inside .text section\n```\n\n## Common Mistakes\n\n| Mistake | Fix |\n|---|---|\n| Dumping before OEP reached | Code still compressed — BP hits too early |\n| Not fixing IAT | Dump crashes or shows no imports in Binary Ninja |\n| Wrong dump base\u002Fsize | Use `module.base` and exact `module.size` from Frida\u002FCheat Engine |\n| Missing PE overlay | Some packers store data after PE headers — append overlay |\n| VMProtect: treating as regular packer | VM bytecode needs devirtualization (NoVmpy\u002FTitan), not OEP dump |\n","# PE Unpacking\n\n## Overview\nIdentify the packer → find the Original Entry Point (OEP) → dump at OEP → fix IAT.\nThe dump is worthless without a fixed IAT; the IAT is unfixable without the correct OEP.\n\n## Packer Detection\n\n### Static Signals (check first via Binary Ninja)\n```python\nlist_sections()     # .UPX0\u002F.UPX1 = UPX; .vmp0\u002F.vmp1 = VMProtect; .themida = Themida\nlist_imports()      # Only LoadLibrary + GetProcAddress = unpacking stub\nget_entry_points()  # Entry point outside .text section = packer stub\n```\n\n### Packer Identification Table\n\n| Packer | Static signature | Fast path |\n|---|---|---|\n| UPX | `.UPX0`, `.UPX1` sections | `upx -d target.exe` (CLI, done) |\n| MPRESS | `.MPRESS1` section | mpress unpacker tool |\n| VMProtect | `.vmp0`\u002F`.vmp1`, VM interpreter loop at EP | `C:\\GameSecTools\\Packing\\NoVmpy` or manual |\n| Themida | Complex EP + anti-debug at start | `C:\\GameSecTools\\Packing\\themida-unmutate` |\n| Custom | One giant section, no real imports | Dynamic dump approach below |\n\n## UPX (Trivial Case)\n```powershell\nupx -d target.exe   # produces unpacked target.exe immediately\n```\nVerify: `list_imports()` on result should show real API names.\n\n## Dynamic Unpacking (Universal Approach)\n\n### Step 1 — Find Where Unpacking Ends\n**Using Frida** (set breakpoint on memory-write to .text):\n```javascript\n\u002F\u002F Get .text section base + size from list_sections() output first\nconst textBase = ptr(\"0x401000\");   \u002F\u002F replace with actual .text base\nconst textSize = 0x50000;           \u002F\u002F replace with actual size\n\nMemoryAccessMonitor.enable({base: textBase, size: textSize}, {\n    onAccess(details) {\n        if (details.operation === 'write') {\n            console.log(\"[WRITE TO .TEXT]\", details.address, \"from\", details.from);\n            \u002F\u002F Single-step from here to find OEP\n        }\n    }\n});\n```\n\n**Using Cheat Engine MCP:**\n```python\n# Set hardware BP on the .text section start address\nset_data_breakpoint(address=0x401000, size=4, break_on=\"write\")\n# Run until BP fires (unpacker writing decompressed code)\n# Then step until you see `jmp \u003Coriginal_entry>`\n```\n\n### Step 2 — Dump at OEP\nOnce at OEP, use KsDumper:\n```\nC:\\GameSecTools\\Memory\\KsDumper\n→ select target process → dump → save\n```\nOr via Frida (raw memory dump):\n```javascript\nconst mod = Process.getModuleByName(\"target.exe\");\nconst dump = mod.base.readByteArray(mod.size);\n\u002F\u002F Save dump via File.writeAllBytes or send() to host\n```\n\n### Step 3 — Fix Import Table\nThe dumped binary has invalid IAT pointers. Fix with **Scylla** (x64dbg plugin) or manually:\n\n```javascript\n\u002F\u002F Frida: collect resolved API addresses during unpacking\n\u002F\u002F Hook GetProcAddress while unpacker resolves APIs\nconst gpa = Module.getExportByName(\"kernel32.dll\", \"GetProcAddress\");\nInterceptor.attach(gpa, {\n    onEnter(args) { this.name = args[1].readAnsiString(); },\n    onLeave(retval) {\n        console.log(\"[IAT]\", this.name, \"=\", retval);\n        \u002F\u002F Use this map to patch IAT in the dump\n    }\n});\n```\n\n### Step 4 — Verify Dump\n```python\nselect_binary(dumped_path)\nlist_imports()      # Should show real API names, not just LoadLibrary\nlist_functions()    # Should show many functions, not just packer stub\nget_entry_points()  # Should be inside .text section\n```\n\n## Common Mistakes\n\n| Mistake | Fix |\n|---|---|\n| Dumping before OEP reached | Code still compressed — BP hits too early |\n| Not fixing IAT | Dump crashes or shows no imports in Binary Ninja |\n| Wrong dump base\u002Fsize | Use `module.base` and exact `module.size` from Frida\u002FCheat Engine |\n| Missing PE overlay | Some packers store data after PE headers — append overlay |\n| VMProtect: treating as regular packer | VM bytecode needs devirtualization (NoVmpy\u002FTitan), not OEP dump |\n",{"name":5,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Flibrary\u002Fskills\u002Fgame-unpack-pe","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":50},[40,43,46],{"tool":41,"command":42},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill game-unpack-pe",{"tool":44,"command":45},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill game-unpack-pe",{"tool":47,"command":48},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill game-unpack-pe","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Flibrary\u002Fskills\u002Fgame-unpack-pe\u002FSKILL.md",true,[52],{"path":53,"resourceType":54,"resourceTypeDesc":55,"sizeBytes":56,"sourceHtmlUrl":57},"agents\u002Fopenai.yaml","REFERENCE","参考文档",82,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgitnexus-pr-review\u002Fagents\u002Fopenai.yaml",[59,80,110,137,151,167],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":27},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[66,67,68,69,70,71,72,73,74,25,75,76,77,78,79],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","context","repo","injection","execution","file",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":91,"publishedAt":27},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[92,93,94,95,96,97,98,99,100,101,102,103,104,21,25,105,106,107,108,109],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","free","molecular dynamics","local","do","MCP",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":122,"publishedAt":27},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[116,119],{"categoryNo":117,"categoryName":118,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":120,"categoryName":121,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000008","测试与质量",[123,124,125,126,127,128,129,130,131,132,93,133,134,135,136],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":27},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[139,144,145,146,147,148,149,150],"setup","report","project","installation","project setup","issues","state",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":27},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[157],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},[153,159,71,160,161,162,25,163,164,165,166],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":168,"name":144,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":27},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[144,146,107,173,148,174],"files","interactive"]