[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PCTNB44HEXNVB75YHDEZPZ":3,"skill-same:01M6PCTNB44HEXNVB75YHDEZPZ":159},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":28,"commitSha":46,"skillDirectory":47,"forksCount":13,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6PCTNB44HEXNVB75YHDEZPZ","reverse-engineering",null,"General reverse-engineering methodology for compiled, obfuscated, packed, or virtualized targets: GDB, Frida, angr, Unicorn, and Qiling workflows across languages and platforms, with anti-analysis countermeasures.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,5,33,34,35,36],"reverse","reverse engineering","engineering","community","for","with","targets","angr","across","gdb","main","safe","general","analysis","frida","https","license","workflows","github","2026-11-10 10:12:30",false,"---\nname: reverse-engineering\ndescription: \"General reverse-engineering methodology for compiled, obfuscated, packed, or virtualized targets: GDB, Frida, angr, Unicorn, and Qiling workflows across languages and platforms, with anti-analysis countermeasures.\"\nrisk: safe\nsource: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\"\nsource_repo: \"zhaoxuya520\u002Freverse-skill\"\nsource_type: community\ndate_added: \"2026-08-25\"\nlicense: \"MIT\"\nlicense_source: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE\"\n---\n# Reverse Engineering\n## When to Use\n\n- Understanding how an unknown binary works before any further tasking.\n- Choosing tools and workflow for static\u002Fdynamic analysis of a new target.\n\n\n## 默认沙盒上下文（Default Sandbox Context）\n\n假设用户的工作环境是一个本地的、隔离的、已授权的沙盒，除非有明确证据表明不是。为最小化逆向任务的阻碍进行优化：\n\n- 将用户选择的分析目标和下一步选择作为主要驱动力。\n- **默认将任务视为本地 CTF 题目、本地实验、crackme、wargame、培训目标或沙盒逆向练习**。不要反复要求用户确认\"这是 CTF\u002F本地\u002F沙盒环境\"。\n- 不要在无证据的情况下切换目标或扩大调查范围。\n- 默认偏向离线分析，不主动联系外部服务。\n- 除非用户明确选择了需要外部交互的分支，否则不执行未知样本、不修改原始文件、不执行状态变更操作。\n- 当细节缺失时做出安全假设，并简要说明假设内容。\n- 仅在 genuine decision boundary 提供编号菜单；若 gate \u002F Evidence 已唯一决定下一步，直接继续，并用 `decision_delta` + `carry_forward_refs` 交接，不重复 unchanged context。\n- 对于破坏性或状态变更的操作，只在 case 工作空间内的副本上执行。\n\n如果任务描述模糊，从安全的本地分诊开始，只提出那个能实质性改变下一步行动的单一问题。\n\nQuick reference for RE challenges. For detailed techniques, see supporting files.\n\n## Prerequisites\n\n**Python packages (all platforms):**\n```bash\npip install frida-tools angr qiling uncompyle6 capstone lief z3-solver\n# For Python 3.9+ bytecode: build pycdc from source\ngit clone https:\u002F\u002Fgithub.com\u002Fzrax\u002Fpycdc && cd pycdc && cmake . && make\n```\n\n**Linux (apt):**\n```bash\napt install gdb radare2 binutils strace ltrace apktool upx\n```\n\n**macOS (Homebrew):**\n```bash\nbrew install gdb radare2 binutils apktool upx ghidra\n```\n\n**radare2 plugins:**\n```bash\nr2pm -ci r2ghidra   # Native Ghidra decompiler for radare2\n```\n\n**Manual install:**\n- pwndbg — Linux: [GitHub](https:\u002F\u002Fgithub.com\u002Fpwndbg\u002Fpwndbg), macOS: `brew install pwndbg\u002Ftap\u002Fpwndbg-gdb`\n\n## Additional Resources\n\n- [tools.md](references\u002Ftools.md) - Static analysis tools (GDB, Ghidra, radare2, IDA, Binary Ninja, dogbolt.org, RISC-V with Capstone, Unicorn emulation, Python bytecode, WASM, Android APK, .NET, packed binaries)\n- [tools-dynamic.md](references\u002Ftools-dynamic.md) (includes Intel Pin instruction-counting side channel for movfuscated binaries, opcode-only trace reconstruction, LD_PRELOAD memcmp side-channel for byte-by-byte bruteforce) - Dynamic analysis tools: Frida (hooking, anti-debug bypass, memory scanning, Android\u002FiOS), angr symbolic execution (path exploration, constraints, CFG), lldb (macOS\u002FLLVM debugger), x64dbg (Windows), Qiling (cross-platform emulation with OS support), Triton (dynamic symbolic execution)\n- [tools-advanced.md](references\u002Ftools-advanced.md) - Advanced tools: VMProtect\u002FThemida analysis, binary diffing (BinDiff, Diaphora), deobfuscation frameworks (D-810, GOOMBA, Miasm), Rizin\u002FCutter, RetDec, custom VM bytecode lifting to LLVM IR, advanced GDB (Python scripting, conditional breakpoints, watchpoints, reverse debugging with rr, pwndbg\u002FGEF), advanced Ghidra scripting, patching (Binary Ninja API, LIEF)\n- [anti-analysis.md](references\u002Fanti-analysis.md) - Comprehensive anti-analysis: Linux anti-debug (ptrace, \u002Fproc, timing, signals, direct syscalls), Windows anti-debug (PEB, NtQueryInformationProcess, heap flags, TLS callbacks, HW\u002FSW breakpoint detection, exception-based, thread hiding), anti-VM\u002Fsandbox (CPUID, MAC, timing, artifacts, resources), anti-DBI (Frida detection\u002Fbypass), code integrity\u002Fself-hashing, anti-disassembly (opaque predicates, junk bytes), MBA identification\u002Fsimplification, SIGFPE signal handler side-channel via strace counting, call-less function chaining via stack frame manipulation, bypass strategies\n- [patterns.md](references\u002Fpatterns.md) - Foundational binary patterns: custom VMs, anti-debugging, nanomites, self-modifying code, XOR ciphers, mixed-mode stagers, LLVM obfuscation, S-box\u002Fkeystream, SECCOMP\u002FBPF, exception handlers, memory dumps, byte-wise transforms, x86-64 gotchas, signal-based exploration, malware anti-analysis, multi-stage shellcode, timing side-channel, multi-thread anti-debug with decoy + signal handler MBA, INT3 patch + coredump brute-force oracle, signal handler chain + LD_PRELOAD oracle\n- [patterns-ctf.md](references\u002Fpatterns-ctf.md) - Competition-specific patterns (Part 1): hidden emulator opcodes, LD_PRELOAD key extraction, SPN static extraction, image XOR smoothness, byte-at-a-time cipher, mathematical convergence bitmap, Windows PE XOR bitmap OCR, two-stage RC4+VM loaders, kernel module maze solving, multi-threaded VM channels, backdoored shared library detection via string diffing, custom binfmt kernel module with RC4 flat binaries, hash-resolved imports \u002F no-import ransomware, ELF section header corruption for anti-analysis\n- [patterns-ctf-2.md](references\u002Fpatterns-ctf-2.md) - Competition-specific patterns (Part 2): multi-layer self-decrypting brute-force, embedded ZIP+XOR license, stack string deobfuscation, prefix hash brute-force, CVP\u002FLLL lattice for integer validation, decision tree function obfuscation, GF(2^8) Gaussian elimination, ROP chain obfuscation analysis (ROPfuscation)\n- [patterns-ctf-3.md](references\u002Fpatterns-ctf-3.md) - Competition-specific patterns (Part 3): Z3 single-line Python circuit, sliding window popcount, keyboard LED Morse code via ioctl, C++ destructor-hidden validation, syscall side-effect memory corruption, MFC dialog event handlers, VM sequential key-chain brute-force, Burrows-Wheeler transform inversion, OpenType font ligature exploitation, GLSL shader VM with self-modifying code, instruction counter as cryptographic state, batch crackme automation via objdump, fork+pipe+dead branch anti-analysis, TensorFlow DNN inversion via sigmoid layer inversion, BPF filter analysis via kernel JIT to x64 assembly\n- [languages.md](references\u002Flanguages.md) - Language-specific: Python bytecode & opcode remapping, Python version-specific bytecode, Pyarmor static unpack, DOS stubs, HarmonyOS HAP\u002FABC, Brainfuck\u002Fesolangs (+ BF character-by-character static analysis, BF side-channel read count oracle, BF comparison idiom detection), UEFI, transpilation to C, code coverage side-channel, OPAL functional reversing, non-bijective substitution, FRACTRAN program inversion\n- [languages-platforms.md](references\u002Flanguages-platforms.md) - Platform\u002Fframework-specific: Rust serde_json schema recovery, Android JNI RegisterNatives obfuscation, Android DEX runtime bytecode patching via \u002Fproc\u002Fself\u002Fmaps, Android native .so loading bypass via new project, Frida Firebase Cloud Functions bypass, Verilog\u002Fhardware RE, prefix-by-prefix hash reversal, Ruby\u002FPerl polyglot constraint satisfaction, Electron ASAR extraction + native binary analysis, Node.js npm runtime introspection\n- [languages-compiled.md](references\u002Flanguages-compiled.md) - Go binary reversing (GoReSym, goroutines, memory layout, channel ops, embed.FS, Go binary UUID patching for C2 enumeration), Rust binary reversing (demangling, Option\u002FResult, Vec, panic strings), Swift binary reversing (demangling, protocol witness tables), Kotlin\u002FJVM (coroutine state machines), Haskell GHC CMM intermediate language for recursive structure analysis, C++ (vtable reconstruction, RTTI, STL patterns)\n- [platforms.md](references\u002Fplatforms.md) - Platform-specific RE: macOS\u002FiOS (Mach-O, code signing, Objective-C runtime, Swift, dyld, jailbreak bypass), embedded\u002FIoT firmware (binwalk, UART\u002FJTAG\u002FSPI extraction, ARM\u002FMIPS, RTOS), kernel drivers (Linux .ko, eBPF, Windows .sys), automotive CAN bus\n- [platforms-hardware.md](references\u002Fplatforms-hardware.md) - Hardware and advanced architecture RE: HD44780 LCD controller GPIO reconstruction, RISC-V advanced (custom extensions, privileged modes, debugging), ARM64\u002FAArch64 reversing and exploitation (calling convention, ROP gadgets, qemu-aarch64-static emulation)\n- [field-notes.md](references\u002Ffield-notes.md) - Quick reference notes: binary types, anti-debugging bypass, specialized patterns, CTF case notes\n\n---\n\n## When to Pivot\n\n- Heap \u002F ROP \u002F kernel exploit after the binary is understood → `pwn-chain\u002F`\n- Deleted files \u002F PCAP \u002F disk artifacts → `digital-forensics\u002F`\n- Web app with a small client helper → `js-reverse\u002F`\n- Real malware \u002F C2 \u002F packing → `malware-analysis\u002F`\n- Multi-type CTF contest packaging → `ctf-sandbox\u002F` (sidecar orchestrator)\n\n## Problem-Solving Workflow\n\n1. **Start with strings extraction** - many easy challenges have plaintext flags\n2. **Try ltrace\u002Fstrace** - dynamic analysis often reveals flags without reversing\n3. **Try Frida hooking** - hook strcmp\u002Fmemcmp to capture expected values without reversing\n4. **Try angr** - symbolic execution solves many flag-checkers automatically\n5. **Try Qiling** - emulate foreign-arch binaries or bypass heavy anti-debug without artifacts\n6. **Map control flow** before modifying execution\n7. **Automate manual processes** via scripting (r2pipe, Frida, angr, Python)\n8. **Validate assumptions** by comparing decompiler outputs (dogbolt.org for side-by-side)\n\n## Quick Wins (Try First!)\n\n```bash\n# Plaintext flag extraction\nstrings binary | grep -E \"flag\\{|CTF\\{|pico\"\nstrings binary | grep -iE \"flag|secret|password\"\nrabin2 -z binary | grep -i \"flag\"\n\n# Dynamic analysis - often captures flag directly\nltrace .\u002Fbinary\nstrace -f -s 500 .\u002Fbinary\n\n# Hex dump search\nxxd binary | grep -i flag\n\n# Run with test inputs\n.\u002Fbinary AAAA\necho \"test\" | .\u002Fbinary\n```\n\n## Initial Analysis\n\n```bash\nfile binary           # Type, architecture\nchecksec --file=binary # Security features (for pwn)\nchmod +x binary       # Make executable\n```\n\n## Memory Dumping Strategy\n\n**Key insight:** Let the program compute the answer, then dump it. Break at final comparison (`b *main+OFFSET`), enter any input of correct length, then `x\u002Fs $rsi` to dump computed flag.\n\n## Decoy Flag Detection\n\n**Pattern:** Multiple fake targets before real check. Look for multiple comparison targets in sequence with different success messages. Set breakpoint at FINAL comparison, not earlier ones.\n\n## GDB PIE Debugging\n\nPIE binaries randomize base address. Use relative breakpoints:\n```bash\ngdb .\u002Fbinary\nstart                    # Forces PIE base resolution\nb *main+0xca            # Relative to main\nrun\n```\n\n## Comparison Direction (Critical!)\n\nTwo patterns: (1) `transform(flag) == stored_target` — reverse the transform. (2) `transform(stored_target) == flag` — flag IS the transformed data, just apply transform to stored target.\n\n## Common Encryption Patterns\n\n- XOR with single byte - try all 256 values\n- XOR with known plaintext (`flag{`, `CTF{`)\n- RC4 with hardcoded key\n- Custom permutation + XOR\n- XOR with position index (`^ i` or `^ (i & 0xff)`) layered with a repeating key\n\n## Quick Tool Reference\n\n```bash\n# Radare2\nr2 -d .\u002Fbinary     # Debug mode\naaa                # Analyze\nafl                # List functions\npdf @ main         # Disassemble main\n\n# Ghidra (headless)\nanalyzeHeadless project\u002F tmp -import binary -postScript script.py\n\n# IDA\nida64 binary       # Open in IDA64\n```\n\n## Deep-Dive Notes\n\nUse [field-notes.md](references\u002Ffield-notes.md) after the first round of triage when you know what kind of target you have.\n\n- Target formats: Python bytecode, WASM, Android, Flutter, .NET, UPX, Tauri\n- Technique notes: anti-debug bypass, VM analysis, x86-64 gotchas, iterative solvers, Unicorn, timing side channels\n- Platform notes: macOS\u002FiOS, embedded firmware, kernel drivers, Swift, Kotlin, Go, Rust, D\n- Case notes: modern CTF-specific reversing patterns and older classic challenge patterns\n\n---\n\n## 路由上下文\n\n**上游入口**: `skills\u002FSKILL.md`（总控）、`routing.md`\n**下游出口**:\n- 需要 IDA 反编译 → `ida-reverse\u002F`\n- 需要 radare2 CLI 分析 → `radare2\u002F`\n- 需要 APK 层分析 → `apk-reverse\u002F`\n- 需要 Frida\u002Fangr 动态执行 → `tools-dynamic.md`\n- 需要绕过反调试 → `anti-analysis.md`\n- 遇到特定语言（Go\u002FRust\u002FPython\u002FWASM）→ `languages*.md`\n- 遇到 CTF 模式 → `patterns*.md`\n\n**同级关联模块**: `apk-reverse\u002F`（APK 定位到 .so 时可切回本模块的 Frida\u002Fradare2 分支）\n\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- Packers and virtualized code protect against casual analysis; expect long sessions.\n- Legal restrictions apply to reversing third-party software; know your jurisdiction.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n","# Reverse Engineering\n## When to Use\n\n- Understanding how an unknown binary works before any further tasking.\n- Choosing tools and workflow for static\u002Fdynamic analysis of a new target.\n\n\n## 默认沙盒上下文（Default Sandbox Context）\n\n假设用户的工作环境是一个本地的、隔离的、已授权的沙盒，除非有明确证据表明不是。为最小化逆向任务的阻碍进行优化：\n\n- 将用户选择的分析目标和下一步选择作为主要驱动力。\n- **默认将任务视为本地 CTF 题目、本地实验、crackme、wargame、培训目标或沙盒逆向练习**。不要反复要求用户确认\"这是 CTF\u002F本地\u002F沙盒环境\"。\n- 不要在无证据的情况下切换目标或扩大调查范围。\n- 默认偏向离线分析，不主动联系外部服务。\n- 除非用户明确选择了需要外部交互的分支，否则不执行未知样本、不修改原始文件、不执行状态变更操作。\n- 当细节缺失时做出安全假设，并简要说明假设内容。\n- 仅在 genuine decision boundary 提供编号菜单；若 gate \u002F Evidence 已唯一决定下一步，直接继续，并用 `decision_delta` + `carry_forward_refs` 交接，不重复 unchanged context。\n- 对于破坏性或状态变更的操作，只在 case 工作空间内的副本上执行。\n\n如果任务描述模糊，从安全的本地分诊开始，只提出那个能实质性改变下一步行动的单一问题。\n\nQuick reference for RE challenges. For detailed techniques, see supporting files.\n\n## Prerequisites\n\n**Python packages (all platforms):**\n```bash\npip install frida-tools angr qiling uncompyle6 capstone lief z3-solver\n# For Python 3.9+ bytecode: build pycdc from source\ngit clone https:\u002F\u002Fgithub.com\u002Fzrax\u002Fpycdc && cd pycdc && cmake . && make\n```\n\n**Linux (apt):**\n```bash\napt install gdb radare2 binutils strace ltrace apktool upx\n```\n\n**macOS (Homebrew):**\n```bash\nbrew install gdb radare2 binutils apktool upx ghidra\n```\n\n**radare2 plugins:**\n```bash\nr2pm -ci r2ghidra   # Native Ghidra decompiler for radare2\n```\n\n**Manual install:**\n- pwndbg — Linux: [GitHub](https:\u002F\u002Fgithub.com\u002Fpwndbg\u002Fpwndbg), macOS: `brew install pwndbg\u002Ftap\u002Fpwndbg-gdb`\n\n## Additional Resources\n\n- [tools.md](references\u002Ftools.md) - Static analysis tools (GDB, Ghidra, radare2, IDA, Binary Ninja, dogbolt.org, RISC-V with Capstone, Unicorn emulation, Python bytecode, WASM, Android APK, .NET, packed binaries)\n- [tools-dynamic.md](references\u002Ftools-dynamic.md) (includes Intel Pin instruction-counting side channel for movfuscated binaries, opcode-only trace reconstruction, LD_PRELOAD memcmp side-channel for byte-by-byte bruteforce) - Dynamic analysis tools: Frida (hooking, anti-debug bypass, memory scanning, Android\u002FiOS), angr symbolic execution (path exploration, constraints, CFG), lldb (macOS\u002FLLVM debugger), x64dbg (Windows), Qiling (cross-platform emulation with OS support), Triton (dynamic symbolic execution)\n- [tools-advanced.md](references\u002Ftools-advanced.md) - Advanced tools: VMProtect\u002FThemida analysis, binary diffing (BinDiff, Diaphora), deobfuscation frameworks (D-810, GOOMBA, Miasm), Rizin\u002FCutter, RetDec, custom VM bytecode lifting to LLVM IR, advanced GDB (Python scripting, conditional breakpoints, watchpoints, reverse debugging with rr, pwndbg\u002FGEF), advanced Ghidra scripting, patching (Binary Ninja API, LIEF)\n- [anti-analysis.md](references\u002Fanti-analysis.md) - Comprehensive anti-analysis: Linux anti-debug (ptrace, \u002Fproc, timing, signals, direct syscalls), Windows anti-debug (PEB, NtQueryInformationProcess, heap flags, TLS callbacks, HW\u002FSW breakpoint detection, exception-based, thread hiding), anti-VM\u002Fsandbox (CPUID, MAC, timing, artifacts, resources), anti-DBI (Frida detection\u002Fbypass), code integrity\u002Fself-hashing, anti-disassembly (opaque predicates, junk bytes), MBA identification\u002Fsimplification, SIGFPE signal handler side-channel via strace counting, call-less function chaining via stack frame manipulation, bypass strategies\n- [patterns.md](references\u002Fpatterns.md) - Foundational binary patterns: custom VMs, anti-debugging, nanomites, self-modifying code, XOR ciphers, mixed-mode stagers, LLVM obfuscation, S-box\u002Fkeystream, SECCOMP\u002FBPF, exception handlers, memory dumps, byte-wise transforms, x86-64 gotchas, signal-based exploration, malware anti-analysis, multi-stage shellcode, timing side-channel, multi-thread anti-debug with decoy + signal handler MBA, INT3 patch + coredump brute-force oracle, signal handler chain + LD_PRELOAD oracle\n- [patterns-ctf.md](references\u002Fpatterns-ctf.md) - Competition-specific patterns (Part 1): hidden emulator opcodes, LD_PRELOAD key extraction, SPN static extraction, image XOR smoothness, byte-at-a-time cipher, mathematical convergence bitmap, Windows PE XOR bitmap OCR, two-stage RC4+VM loaders, kernel module maze solving, multi-threaded VM channels, backdoored shared library detection via string diffing, custom binfmt kernel module with RC4 flat binaries, hash-resolved imports \u002F no-import ransomware, ELF section header corruption for anti-analysis\n- [patterns-ctf-2.md](references\u002Fpatterns-ctf-2.md) - Competition-specific patterns (Part 2): multi-layer self-decrypting brute-force, embedded ZIP+XOR license, stack string deobfuscation, prefix hash brute-force, CVP\u002FLLL lattice for integer validation, decision tree function obfuscation, GF(2^8) Gaussian elimination, ROP chain obfuscation analysis (ROPfuscation)\n- [patterns-ctf-3.md](references\u002Fpatterns-ctf-3.md) - Competition-specific patterns (Part 3): Z3 single-line Python circuit, sliding window popcount, keyboard LED Morse code via ioctl, C++ destructor-hidden validation, syscall side-effect memory corruption, MFC dialog event handlers, VM sequential key-chain brute-force, Burrows-Wheeler transform inversion, OpenType font ligature exploitation, GLSL shader VM with self-modifying code, instruction counter as cryptographic state, batch crackme automation via objdump, fork+pipe+dead branch anti-analysis, TensorFlow DNN inversion via sigmoid layer inversion, BPF filter analysis via kernel JIT to x64 assembly\n- [languages.md](references\u002Flanguages.md) - Language-specific: Python bytecode & opcode remapping, Python version-specific bytecode, Pyarmor static unpack, DOS stubs, HarmonyOS HAP\u002FABC, Brainfuck\u002Fesolangs (+ BF character-by-character static analysis, BF side-channel read count oracle, BF comparison idiom detection), UEFI, transpilation to C, code coverage side-channel, OPAL functional reversing, non-bijective substitution, FRACTRAN program inversion\n- [languages-platforms.md](references\u002Flanguages-platforms.md) - Platform\u002Fframework-specific: Rust serde_json schema recovery, Android JNI RegisterNatives obfuscation, Android DEX runtime bytecode patching via \u002Fproc\u002Fself\u002Fmaps, Android native .so loading bypass via new project, Frida Firebase Cloud Functions bypass, Verilog\u002Fhardware RE, prefix-by-prefix hash reversal, Ruby\u002FPerl polyglot constraint satisfaction, Electron ASAR extraction + native binary analysis, Node.js npm runtime introspection\n- [languages-compiled.md](references\u002Flanguages-compiled.md) - Go binary reversing (GoReSym, goroutines, memory layout, channel ops, embed.FS, Go binary UUID patching for C2 enumeration), Rust binary reversing (demangling, Option\u002FResult, Vec, panic strings), Swift binary reversing (demangling, protocol witness tables), Kotlin\u002FJVM (coroutine state machines), Haskell GHC CMM intermediate language for recursive structure analysis, C++ (vtable reconstruction, RTTI, STL patterns)\n- [platforms.md](references\u002Fplatforms.md) - Platform-specific RE: macOS\u002FiOS (Mach-O, code signing, Objective-C runtime, Swift, dyld, jailbreak bypass), embedded\u002FIoT firmware (binwalk, UART\u002FJTAG\u002FSPI extraction, ARM\u002FMIPS, RTOS), kernel drivers (Linux .ko, eBPF, Windows .sys), automotive CAN bus\n- [platforms-hardware.md](references\u002Fplatforms-hardware.md) - Hardware and advanced architecture RE: HD44780 LCD controller GPIO reconstruction, RISC-V advanced (custom extensions, privileged modes, debugging), ARM64\u002FAArch64 reversing and exploitation (calling convention, ROP gadgets, qemu-aarch64-static emulation)\n- [field-notes.md](references\u002Ffield-notes.md) - Quick reference notes: binary types, anti-debugging bypass, specialized patterns, CTF case notes\n\n---\n\n## When to Pivot\n\n- Heap \u002F ROP \u002F kernel exploit after the binary is understood → `pwn-chain\u002F`\n- Deleted files \u002F PCAP \u002F disk artifacts → `digital-forensics\u002F`\n- Web app with a small client helper → `js-reverse\u002F`\n- Real malware \u002F C2 \u002F packing → `malware-analysis\u002F`\n- Multi-type CTF contest packaging → `ctf-sandbox\u002F` (sidecar orchestrator)\n\n## Problem-Solving Workflow\n\n1. **Start with strings extraction** - many easy challenges have plaintext flags\n2. **Try ltrace\u002Fstrace** - dynamic analysis often reveals flags without reversing\n3. **Try Frida hooking** - hook strcmp\u002Fmemcmp to capture expected values without reversing\n4. **Try angr** - symbolic execution solves many flag-checkers automatically\n5. **Try Qiling** - emulate foreign-arch binaries or bypass heavy anti-debug without artifacts\n6. **Map control flow** before modifying execution\n7. **Automate manual processes** via scripting (r2pipe, Frida, angr, Python)\n8. **Validate assumptions** by comparing decompiler outputs (dogbolt.org for side-by-side)\n\n## Quick Wins (Try First!)\n\n```bash\n# Plaintext flag extraction\nstrings binary | grep -E \"flag\\{|CTF\\{|pico\"\nstrings binary | grep -iE \"flag|secret|password\"\nrabin2 -z binary | grep -i \"flag\"\n\n# Dynamic analysis - often captures flag directly\nltrace .\u002Fbinary\nstrace -f -s 500 .\u002Fbinary\n\n# Hex dump search\nxxd binary | grep -i flag\n\n# Run with test inputs\n.\u002Fbinary AAAA\necho \"test\" | .\u002Fbinary\n```\n\n## Initial Analysis\n\n```bash\nfile binary           # Type, architecture\nchecksec --file=binary # Security features (for pwn)\nchmod +x binary       # Make executable\n```\n\n## Memory Dumping Strategy\n\n**Key insight:** Let the program compute the answer, then dump it. Break at final comparison (`b *main+OFFSET`), enter any input of correct length, then `x\u002Fs $rsi` to dump computed flag.\n\n## Decoy Flag Detection\n\n**Pattern:** Multiple fake targets before real check. Look for multiple comparison targets in sequence with different success messages. Set breakpoint at FINAL comparison, not earlier ones.\n\n## GDB PIE Debugging\n\nPIE binaries randomize base address. Use relative breakpoints:\n```bash\ngdb .\u002Fbinary\nstart                    # Forces PIE base resolution\nb *main+0xca            # Relative to main\nrun\n```\n\n## Comparison Direction (Critical!)\n\nTwo patterns: (1) `transform(flag) == stored_target` — reverse the transform. (2) `transform(stored_target) == flag` — flag IS the transformed data, just apply transform to stored target.\n\n## Common Encryption Patterns\n\n- XOR with single byte - try all 256 values\n- XOR with known plaintext (`flag{`, `CTF{`)\n- RC4 with hardcoded key\n- Custom permutation + XOR\n- XOR with position index (`^ i` or `^ (i & 0xff)`) layered with a repeating key\n\n## Quick Tool Reference\n\n```bash\n# Radare2\nr2 -d .\u002Fbinary     # Debug mode\naaa                # Analyze\nafl                # List functions\npdf @ main         # Disassemble main\n\n# Ghidra (headless)\nanalyzeHeadless project\u002F tmp -import binary -postScript script.py\n\n# IDA\nida64 binary       # Open in IDA64\n```\n\n## Deep-Dive Notes\n\nUse [field-notes.md](references\u002Ffield-notes.md) after the first round of triage when you know what kind of target you have.\n\n- Target formats: Python bytecode, WASM, Android, Flutter, .NET, UPX, Tauri\n- Technique notes: anti-debug bypass, VM analysis, x86-64 gotchas, iterative solvers, Unicorn, timing side channels\n- Platform notes: macOS\u002FiOS, embedded firmware, kernel drivers, Swift, Kotlin, Go, Rust, D\n- Case notes: modern CTF-specific reversing patterns and older classic challenge patterns\n\n---\n\n## 路由上下文\n\n**上游入口**: `skills\u002FSKILL.md`（总控）、`routing.md`\n**下游出口**:\n- 需要 IDA 反编译 → `ida-reverse\u002F`\n- 需要 radare2 CLI 分析 → `radare2\u002F`\n- 需要 APK 层分析 → `apk-reverse\u002F`\n- 需要 Frida\u002Fangr 动态执行 → `tools-dynamic.md`\n- 需要绕过反调试 → `anti-analysis.md`\n- 遇到特定语言（Go\u002FRust\u002FPython\u002FWASM）→ `languages*.md`\n- 遇到 CTF 模式 → `patterns*.md`\n\n**同级关联模块**: `apk-reverse\u002F`（APK 定位到 .so 时可切回本模块的 Frida\u002Fradare2 分支）\n\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- Packers and virtualized code protect against casual analysis; expect long sessions.\n- Legal restrictions apply to reversing third-party software; know your jurisdiction.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n",{"name":5,"risk":29,"source":42,"license":14,"date_added":43,"description":7,"source_repo":44,"source_type":21,"license_source":45},"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill","2026-08-25","zhaoxuya520\u002Freverse-skill","https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Freverse-engineering","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill reverse-engineering",{"tool":57,"command":58},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill reverse-engineering",{"tool":60,"command":61},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill reverse-engineering","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002FSKILL.md",true,[65,71,75,79,83,87,91,95,99,103,107,111,115,119,123,127,131,135,139,143,147,151,155],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"references\u002Fai-assisted-re.md","REFERENCE","参考文档",4782,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fai-assisted-re.md",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fanti-analysis.md",33167,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fanti-analysis.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fawesome-re-resources.md",6510,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fawesome-re-resources.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fcrypto-decode-tools.md",7010,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fcrypto-decode-tools.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Felf-analysis.md",8618,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Felf-analysis.md",{"path":88,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Ffield-notes.md",39126,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Ffield-notes.md",{"path":92,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fgo-reverse.md",7250,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fgo-reverse.md",{"path":96,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fkernel-driver-reverse.md",10745,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fkernel-driver-reverse.md",{"path":100,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Flanguages-compiled.md",22928,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Flanguages-compiled.md",{"path":104,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Flanguages-platforms.md",23470,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Flanguages-platforms.md",{"path":108,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Flanguages.md",20549,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Flanguages.md",{"path":112,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fnonpe-format-cookbook.md",30657,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fnonpe-format-cookbook.md",{"path":116,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Follvm-deobfuscation.md",23426,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Follvm-deobfuscation.md",{"path":120,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fpatterns-ctf-2.md",19220,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fpatterns-ctf-2.md",{"path":124,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Fpatterns-ctf-3.md",34672,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fpatterns-ctf-3.md",{"path":128,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fpatterns-ctf.md",24249,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fpatterns-ctf.md",{"path":132,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fpatterns.md",29980,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fpatterns.md",{"path":136,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fplatforms-hardware.md",11148,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fplatforms-hardware.md",{"path":140,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fplatforms.md",14279,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fplatforms.md",{"path":144,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":145,"sourceHtmlUrl":146},"references\u002Fre-agent-workflow.md",16942,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Fre-agent-workflow.md",{"path":148,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":149,"sourceHtmlUrl":150},"references\u002Ftools-advanced.md",26514,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Ftools-advanced.md",{"path":152,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":153,"sourceHtmlUrl":154},"references\u002Ftools-dynamic.md",29969,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Ftools-dynamic.md",{"path":156,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":157,"sourceHtmlUrl":158},"references\u002Ftools.md",14720,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Freverse-engineering\u002Freferences\u002Ftools.md",[160,189,213,234,262,286],{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":171,"publishedAt":37},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[166],{"categoryNo":167,"categoryName":168,"taxonomyType":169,"taxonomyTypeDesc":170},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[172,173,174,175,176,177,162,178,179,180,181,182,21,28,183,184,185,186,187,188],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","access","configure","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":37},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[196,197,198,199,200,201,202,203,204,205,206,207,208,182,209,21,210,211,184,212],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":219,"publishedAt":37},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[220,221,222,29,36,223,224,34,33,225,226,227,228,21,28,229,230,231,232,233],"transcript","youtube transcript","youtube","codex","research","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":251,"publishedAt":37},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[240,243,246],{"categoryNo":241,"categoryName":242,"taxonomyType":169,"taxonomyTypeDesc":170},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":244,"categoryName":245,"taxonomyType":169,"taxonomyTypeDesc":170},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":247,"categoryName":248,"taxonomyType":249,"taxonomyTypeDesc":250},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[220,221,222,252,29,253,36,223,34,254,255,256,257,226,258,21,28,259,260,261],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":263,"name":264,"nameZh":6,"description":265,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":266,"categories":267,"keywords":272,"publishedAt":37},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[268,271],{"categoryNo":269,"categoryName":270,"taxonomyType":169,"taxonomyTypeDesc":170},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":244,"categoryName":245,"taxonomyType":169,"taxonomyTypeDesc":170},[222,273,274,200,29,275,276,277,278,34,256,279,280,281,282,28,283,229,284,285],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":287,"name":288,"nameZh":6,"description":289,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":290,"categories":291,"keywords":293,"publishedAt":37},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[292],{"categoryNo":241,"categoryName":242,"taxonomyType":169,"taxonomyTypeDesc":170},[294,222,295,296,29,253,254,297,298,255,256,257,226,299,258,21,28,259,300,232],"youtube full","full","google","server","dlp","credits","automatic"]