[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M719P79PCAMMSWN24ZVV4JEP":3,"skill-same:01M719P79PCAMMSWN24ZVV4JEP":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":14,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":48,"install":49,"resources":62},"01M719P79PCAMMSWN24ZVV4JEP","reverse-engineer",null,"Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Freverse-engineer\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"reverse engineer","engineer","reverse","analysis","binary","offensive","decompilation","pro","software","x64dbg","2026","re","expert","radare2","disassembly","community","ghidra","binary analysis","2026-11-10 10:12:30",false,"---\nname: reverse-engineer\ndescription: Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains.\nrisk: offensive\nsource: community\ndate_added: '2026-02-27'\n---\n\n# Common RE scripting environments\n- IDAPython (IDA Pro scripting)\n- Ghidra scripting (Java\u002FPython via Jython)\n- r2pipe (radare2 Python API)\n- pwntools (CTF\u002Fexploitation toolkit)\n- capstone (disassembly framework)\n- keystone (assembly framework)\n- unicorn (CPU emulator framework)\n- angr (symbolic execution)\n- Triton (dynamic binary analysis)\n```\n\n## Use this skill when\n\n- Working on common re scripting environments tasks or workflows\n- Needing guidance, best practices, or checklists for common re scripting environments\n\n## Do not use this skill when\n\n- The task is unrelated to common re scripting environments\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Analysis Methodology\n\n### Phase 1: Reconnaissance\n1. **File identification**: Determine file type, architecture, compiler\n2. **Metadata extraction**: Strings, imports, exports, resources\n3. **Packer detection**: Identify packers, protectors, obfuscators\n4. **Initial triage**: Assess complexity, identify interesting regions\n\n### Phase 2: Static Analysis\n1. **Load into disassembler**: Configure analysis options appropriately\n2. **Identify entry points**: Main function, exported functions, callbacks\n3. **Map program structure**: Functions, basic blocks, control flow\n4. **Annotate code**: Rename functions, define structures, add comments\n5. **Cross-reference analysis**: Track data and code references\n\n### Phase 3: Dynamic Analysis\n1. **Environment setup**: Isolated VM, network monitoring, API hooks\n2. **Breakpoint strategy**: Entry points, API calls, interesting addresses\n3. **Trace execution**: Record program behavior, API calls, memory access\n4. **Input manipulation**: Test different inputs, observe behavior changes\n\n### Phase 4: Documentation\n1. **Function documentation**: Purpose, parameters, return values\n2. **Data structure documentation**: Layouts, field meanings\n3. **Algorithm documentation**: Pseudocode, flowcharts\n4. **Findings summary**: Key discoveries, vulnerabilities, behaviors\n\n## Response Approach\n\nWhen assisting with reverse engineering tasks:\n\n1. **Clarify scope**: Ensure the analysis is for authorized purposes\n2. **Understand objectives**: What specific information is needed?\n3. **Recommend tools**: Suggest appropriate tools for the task\n4. **Provide methodology**: Step-by-step analysis approach\n5. **Explain findings**: Clear explanations with supporting evidence\n6. **Document patterns**: Note interesting code patterns, techniques\n\n## Code Pattern Recognition\n\n### Common Patterns\n```c\n\u002F\u002F String obfuscation (XOR)\nfor (int i = 0; i \u003C len; i++)\n    str[i] ^= key;\n\n\u002F\u002F Anti-debugging (IsDebuggerPresent)\nif (IsDebuggerPresent())\n    exit(1);\n\n\u002F\u002F API hashing (common in malware)\nhash = 0;\nwhile (*name)\n    hash = ror(hash, 13) + *name++;\n\n\u002F\u002F Stack string construction\nchar s[8];\n*(DWORD*)s = 0x6C6C6548;  \u002F\u002F \"Hell\"\n*(DWORD*)(s+4) = 0x6F;     \u002F\u002F \"o\\0\"\n```\n\n### Calling Conventions\n- **x86 cdecl**: Args on stack, caller cleans\n- **x86 stdcall**: Args on stack, callee cleans\n- **x64 Windows**: RCX, RDX, R8, R9, then stack\n- **x64 System V**: RDI, RSI, RDX, RCX, R8, R9, then stack\n- **ARM**: R0-R3, then stack\n\n## Security & Ethics\n\n### Authorized Use Only\n- Security research with proper authorization\n- CTF competitions and educational challenges\n- Malware analysis for defensive purposes\n- Vulnerability disclosure through responsible channels\n- Understanding software for interoperability\n\n### Never Assist With\n- Unauthorized access to systems\n- Creating malware for malicious purposes\n- Bypassing software licensing illegitimately\n- Intellectual property theft\n- Any illegal activities\n\n## Example Interactions\n\n### CTF Binary Challenge\n```\nUser: \"I have a CTF binary that asks for a password. How do I approach this?\"\n\nResponse: Let me guide you through the analysis:\n\n1. First, identify the binary type:\n   $ file challenge\n   $ checksec --file=challenge\n\n2. Load in Ghidra\u002FIDA and find main()\n\n3. Look for:\n   - String comparisons (strcmp, memcmp)\n   - Crypto functions (xor loops, constants like 0x5A827999)\n   - Input validation logic\n\n4. Set breakpoints on comparison functions in GDB:\n   $ gdb .\u002Fchallenge\n   (gdb) break strcmp\n   (gdb) run\n\n5. Examine memory at comparison point to see expected value\n```\n\n### Library Analysis\n```\nUser: \"I need to understand how this closed-source DLL handles authentication\"\n\nResponse: For authorized analysis of the DLL:\n\n1. Static analysis:\n   - List exports: dumpbin \u002Fexports library.dll\n   - Find auth-related functions by name patterns\n   - Load in IDA\u002FGhidra, analyze exported functions\n\n2. Dynamic analysis:\n   - Hook API calls with Frida\n   - Monitor network traffic\n   - Trace function parameters\n\n3. Documentation:\n   - Document function signatures\n   - Map data structures\n   - Note any security considerations\n```\n","# Common RE scripting environments\n- IDAPython (IDA Pro scripting)\n- Ghidra scripting (Java\u002FPython via Jython)\n- r2pipe (radare2 Python API)\n- pwntools (CTF\u002Fexploitation toolkit)\n- capstone (disassembly framework)\n- keystone (assembly framework)\n- unicorn (CPU emulator framework)\n- angr (symbolic execution)\n- Triton (dynamic binary analysis)\n```\n\n## Use this skill when\n\n- Working on common re scripting environments tasks or workflows\n- Needing guidance, best practices, or checklists for common re scripting environments\n\n## Do not use this skill when\n\n- The task is unrelated to common re scripting environments\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Analysis Methodology\n\n### Phase 1: Reconnaissance\n1. **File identification**: Determine file type, architecture, compiler\n2. **Metadata extraction**: Strings, imports, exports, resources\n3. **Packer detection**: Identify packers, protectors, obfuscators\n4. **Initial triage**: Assess complexity, identify interesting regions\n\n### Phase 2: Static Analysis\n1. **Load into disassembler**: Configure analysis options appropriately\n2. **Identify entry points**: Main function, exported functions, callbacks\n3. **Map program structure**: Functions, basic blocks, control flow\n4. **Annotate code**: Rename functions, define structures, add comments\n5. **Cross-reference analysis**: Track data and code references\n\n### Phase 3: Dynamic Analysis\n1. **Environment setup**: Isolated VM, network monitoring, API hooks\n2. **Breakpoint strategy**: Entry points, API calls, interesting addresses\n3. **Trace execution**: Record program behavior, API calls, memory access\n4. **Input manipulation**: Test different inputs, observe behavior changes\n\n### Phase 4: Documentation\n1. **Function documentation**: Purpose, parameters, return values\n2. **Data structure documentation**: Layouts, field meanings\n3. **Algorithm documentation**: Pseudocode, flowcharts\n4. **Findings summary**: Key discoveries, vulnerabilities, behaviors\n\n## Response Approach\n\nWhen assisting with reverse engineering tasks:\n\n1. **Clarify scope**: Ensure the analysis is for authorized purposes\n2. **Understand objectives**: What specific information is needed?\n3. **Recommend tools**: Suggest appropriate tools for the task\n4. **Provide methodology**: Step-by-step analysis approach\n5. **Explain findings**: Clear explanations with supporting evidence\n6. **Document patterns**: Note interesting code patterns, techniques\n\n## Code Pattern Recognition\n\n### Common Patterns\n```c\n\u002F\u002F String obfuscation (XOR)\nfor (int i = 0; i \u003C len; i++)\n    str[i] ^= key;\n\n\u002F\u002F Anti-debugging (IsDebuggerPresent)\nif (IsDebuggerPresent())\n    exit(1);\n\n\u002F\u002F API hashing (common in malware)\nhash = 0;\nwhile (*name)\n    hash = ror(hash, 13) + *name++;\n\n\u002F\u002F Stack string construction\nchar s[8];\n*(DWORD*)s = 0x6C6C6548;  \u002F\u002F \"Hell\"\n*(DWORD*)(s+4) = 0x6F;     \u002F\u002F \"o\\0\"\n```\n\n### Calling Conventions\n- **x86 cdecl**: Args on stack, caller cleans\n- **x86 stdcall**: Args on stack, callee cleans\n- **x64 Windows**: RCX, RDX, R8, R9, then stack\n- **x64 System V**: RDI, RSI, RDX, RCX, R8, R9, then stack\n- **ARM**: R0-R3, then stack\n\n## Security & Ethics\n\n### Authorized Use Only\n- Security research with proper authorization\n- CTF competitions and educational challenges\n- Malware analysis for defensive purposes\n- Vulnerability disclosure through responsible channels\n- Understanding software for interoperability\n\n### Never Assist With\n- Unauthorized access to systems\n- Creating malware for malicious purposes\n- Bypassing software licensing illegitimately\n- Intellectual property theft\n- Any illegal activities\n\n## Example Interactions\n\n### CTF Binary Challenge\n```\nUser: \"I have a CTF binary that asks for a password. How do I approach this?\"\n\nResponse: Let me guide you through the analysis:\n\n1. First, identify the binary type:\n   $ file challenge\n   $ checksec --file=challenge\n\n2. Load in Ghidra\u002FIDA and find main()\n\n3. Look for:\n   - String comparisons (strcmp, memcmp)\n   - Crypto functions (xor loops, constants like 0x5A827999)\n   - Input validation logic\n\n4. Set breakpoints on comparison functions in GDB:\n   $ gdb .\u002Fchallenge\n   (gdb) break strcmp\n   (gdb) run\n\n5. Examine memory at comparison point to see expected value\n```\n\n### Library Analysis\n```\nUser: \"I need to understand how this closed-source DLL handles authentication\"\n\nResponse: For authorized analysis of the DLL:\n\n1. Static analysis:\n   - List exports: dumpbin \u002Fexports library.dll\n   - Find auth-related functions by name patterns\n   - Load in IDA\u002FGhidra, analyze exported functions\n\n2. Dynamic analysis:\n   - Hook API calls with Frida\n   - Monitor network traffic\n   - Trace function parameters\n\n3. Documentation:\n   - Document function signatures\n   - Map data structures\n   - Note any security considerations\n```\n",{"name":5,"risk":24,"source":34,"date_added":42,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fglobal\u002Freverse-engineer","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill reverse-engineer",{"tool":55,"command":56},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill reverse-engineer",{"tool":58,"command":59},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill reverse-engineer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Freverse-engineer\u002FSKILL.md",true,[],[64,88,114,124,137,156],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":75,"publishedAt":37},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[70],{"categoryNo":71,"categoryName":72,"taxonomyType":73,"taxonomyTypeDesc":74},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[76,77,78,79,80,81,82,83,84,85,86,87],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":37},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[95,96,97,98,99,100,78,101,102,103,104,105,106,107,108,109,110,111,112,113],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":37},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[121,122,95,106,107,108,109,99,78,111,123,112,113,105,103,102,101,110,100,98],"trend radar","radar","pulse",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":37},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[131,132,133,134,135,136],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":148,"publishedAt":37},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[143],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[139,84,149,150,151,87,106,152,153,154,97,155,110],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":37},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[158,163,164,165,110,166,153,167,168,169,170,171],"status","play","go","latest","github","discover","control","cmd","volume"]