[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KB49635AFFCJEGCCP8Q1N":3,"skill-same:01M71KB49635AFFCJEGCCP8Q1N":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":42,"repositoryHtmlUrl":43,"repositoryHomepageUrl":44,"ownerHtmlUrl":45,"ownerBlogUrl":46,"ownerDescription":47,"updatedAt":48,"install":49,"resources":61},"01M71KB49635AFFCJEGCCP8Q1N","binary-diff",null,"跨版本符号迁移与二进制差分。当你有旧版本的符号\u002F逆向结果，需要快速迁移到新版本时使用。\n适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。\n核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。\n触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。","coco-research\u002Fcoco","coco-research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F68911604?v=4","01M71JRE9C4NM4NSZM4JD0BJTB","Coco Research","01M71JREA0ZMR0PMH3CKA99SN1",630,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fbinary-diff\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31],"diff","binary","binary diff","关键词","migration","bindiff","pdb","true","2026-11-10 10:12:30",false,"---\nname: binary-diff\ndescription: |\n  跨版本符号迁移与二进制差分。当你有旧版本的符号\u002F逆向结果，需要快速迁移到新版本时使用。\n  适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。\n  核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。\n  触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。\nuser-invocable: true\n---\n\n# 跨版本符号迁移 (Binary Diff)\n\n## 适用范围\n\n当任务属于以下场景时使用本 skill：\n\n1. **内核\u002F驱动缺 PDB** — 有旧版 ntoskrnl.exe 的符号，新版 PDB 被微软下架，需要用旧版符号推导新版非导出函数地址\n2. **程序更新后符号迁移** — 曾经逆向过某个程序，程序更新了，不想重新逆一遍，用旧版结果批量迁移\n3. **保护机制更新** — 旧版有完整逆向结果，新版需要快速定位同一函数的新偏移\n4. **任何\"有旧版符号 + 新版无符号\"的二进制对比场景**\n\n### 与其他 skill 的分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 从零开始逆向一个二进制 | `ida-reverse\u002F` 或 `radare2\u002F` |\n| 有旧版结果，迁移到新版 | **本 skill** |\n| 两个完全不同的二进制对比 | BinDiff \u002F Diaphora（传统工具） |\n\n### 核心优势\n\n相比传统方案：\n\n| 方案 | 200 个函数成本 | 时间 | 准确率 |\n|------|--------------|------|--------|\n| 人工开两个 IDA 窗口对比 | 免费但耗命 | 数小时 | 高 |\n| BinDiff 自动匹配 | 免费 | 快 | 中（结构变化大时失效） |\n| 完全交给 Agent（CC\u002FCodex） | 50-100 元 | 慢 | 高 |\n| **本 skill（LLM 批量比对）** | **~1 元** | **~10 秒\u002F函数** | **高** |\n\n## 核心原理\n\n```text\n旧版函数（有符号）          新版同一函数（无符号）\n    ↓                              ↓\n导出反汇编 + 伪代码          导出反汇编 + 伪代码\n    ↓                              ↓\n    └──────── LLM 结构化比对 ────────┘\n                    ↓\n         输出 YAML（符号映射表）\n                    ↓\n         程序化解析 → 批量应用到新版 IDB\n```\n\n关键点：\n- prompt 是固定模板，程序化填充\n- 输入输出格式确定，程序化解析\n- LLM 只负责\"看两段代码，找出对应关系\"这一步\n- 时间成本和 token 成本极低\n\n## Prompt 模板\n\n### 标准比对 Prompt\n\n```text\nI have disassembly outputs and procedure code of the same function.\n\nThis is the function for reference:\n\n**Disassembly for Reference**\n```c\n{disasm_for_reference}\n```\n\n**Procedure code for Reference**\n```c\n{procedure_for_reference}\n```\n\nThis is the function you need to reverse-engineering:\n\n**Disassembly to reverse-engineering**\n```c\n{disasm_code}\n```\n\n**Procedure code to reverse-engineering**\n```c\n{procedure}\n```\n\nWhat you need to do is to collect all references to \"{symbol_name_list}\" in the function you need to reverse-engineering and output those references as YAML.\n\nExample:\n```yaml\nfound_vcall: # This is for indirect call to virtual function or virtual function pointer fetching.\n  - insn_va: '0x180777700' # Always be the instruction with displacement offset\n    insn_disasm: call [rax+68h] # Always be the instruction with displacement offset\n    vfunc_offset: '0x68'\n    func_name: ILoopMode_OnLoopActivate\n  - insn_va: '0x180777778' # Always be the instruction with displacement offset\n    insn_disasm: mov rax, [rax+80h] # Always be the instruction with displacement offset\n    vfunc_offset: '0x80'\n    func_name: INetworkMessages_GetNetworkGroupCount\n\nfound_call: # This is for direct call to non-virtual regular function.\n  - insn_va: '0x180888800'\n    insn_disasm: call sub_180999900\n    func_name: CLoopMode_RegisterEventMapInternal\n  - insn_va: '0x180888880'\n    insn_disasm: call sub_180555500\n    func_name: CLoopMode_SetSystemState\n\nfound_funcptr: # This is for non-virtual regular function pointer.\n  - insn_va: '0x180666600' # Must load\u002Freference the function pointer target address\n    insn_disasm: lea rdx, sub_15BC910 # Must load\u002Freference the function pointer target address\n    funcptr_name: CLoopMode_OnClientPollNetworking\n\nfound_gv: # This is for reference to global variable.\n  - insn_va: '0x180444400'\n    insn_disasm: mov rcx, cs:qword_180666600 # Must load\u002Freference the global variable\n    gv_name: g_pNetworkMessages\n  - insn_va: '0x180333300'\n    insn_disasm: lea rax, unk_180222200 # Must load\u002Freference the global variable\n    gv_name: s_EventManager\n\nfound_struct_offset: # This is for reference to struct offset. NOTE THAT virtual function pointer should not be here! virtual function pointer should ALWAYS be in found_vcall !\n  - insn_va: '0x1801BA12A' # Always be the instruction with displacement offset\n    insn_disasm: mov rcx, [r14+58h] # Always be the instruction with displacement offset\n    offset: '0x58'\n    size: 8\n    struct_name: CResourceService\n    member_name: m_pEntitySystem\n```\n\nIf nothing found, output an empty YAML. DO NOT output anything other than the desired YAML. DO NOT collect unrelated symbols.\n```\n\n### 变量说明\n\n| 变量 | 来源 | 说明 |\n|------|------|------|\n| `{disasm_for_reference}` | 旧版 IDA 导出 | 有符号的反汇编 |\n| `{procedure_for_reference}` | 旧版 IDA 导出 | 有符号的伪代码 |\n| `{disasm_code}` | 新版 IDA 导出 | 无符号的反汇编 |\n| `{procedure}` | 新版 IDA 导出 | 无符号的伪代码 |\n| `{symbol_name_list}` | 从旧版提取 | 需要在新版中定位的符号列表 |\n\n## 工作流\n\n### 完整流程\n\n```text\nStep 1: 准备数据\n  - 旧版二进制加载到 IDA（有 PDB\u002F符号）\n  - 新版二进制加载到 IDA（无符号）\n  - 找到两个版本中相同的锚点函数（导出函数、字符串引用等）\n\nStep 2: 批量导出\n  - 从旧版导出：锚点函数的反汇编 + 伪代码（含符号名）\n  - 从新版导出：同一锚点函数的反汇编 + 伪代码（无符号名）\n\nStep 3: LLM 比对\n  - 用 prompt 模板填充数据\n  - 调用 LLM API（推荐：deepseek 量大便宜，超大函数切 gpt）\n  - 解析返回的 YAML\n\nStep 4: 应用结果\n  - 将 YAML 中的符号映射批量应用到新版 IDB\n  - 用 idapro_rename 或 IDAPython 脚本批量重命名\n\nStep 5: 迭代\n  - 第一轮迁移的函数成为新的锚点\n  - 进入这些函数，继续对比内部调用\n  - 重复直到覆盖所有目标函数\n```\n\n### 锚点选择策略\n\n| 锚点类型 | 可靠性 | 说明 |\n|---------|--------|------|\n| 导出函数 | 最高 | 名字不变，地址可能变 |\n| 字符串引用 | 高 | 字符串内容不变，引用位置可能变 |\n| 常量\u002F魔数 | 中 | 特征值不变 |\n| 代码模式 | 中 | 函数结构相似但地址全变 |\n\n### 批量处理建议\n\n- 每次比对 1 个函数（避免 context 爆炸）\n- 中等函数（\u003C200 行）用 deepseek\n- 超大函数（>500 行）切 gpt-4o 或 claude\n- 并发调用提高速度（10-20 并发）\n- 结果缓存，避免重复调用\n\n## 输出格式\n\n### YAML 输出的 5 种符号类型\n\n| 类型 | 含义 | 关键字段 |\n|------|------|---------|\n| `found_vcall` | 虚函数调用（间接 call） | `vfunc_offset`, `func_name` |\n| `found_call` | 直接函数调用 | `insn_va`, `func_name` |\n| `found_funcptr` | 函数指针引用 | `insn_va`, `funcptr_name` |\n| `found_gv` | 全局变量引用 | `insn_va`, `gv_name` |\n| `found_struct_offset` | 结构体偏移引用 | `offset`, `struct_name`, `member_name` |\n\n### 解析后的应用动作\n\n```text\nfound_call → idapro_rename(addr=call_target, name=func_name)\nfound_vcall → idapro_set_comments(addr=insn_va, comment=\"vcall: {func_name} @ +{offset}\")\nfound_funcptr → idapro_rename(addr=funcptr_target, name=funcptr_name)\nfound_gv → idapro_rename(addr=gv_addr, name=gv_name)\nfound_struct_offset → idapro_set_comments(addr=insn_va, comment=\"{struct_name}.{member_name}\")\n```\n\n## 典型场景示例\n\n### 场景 1：ntoskrnl.exe 缺 PDB\n\n```text\n已有：ntoskrnl.exe 10.0.26100.2000 + 完整 PDB\n目标：ntoskrnl.exe 10.0.26100.2605（PDB 被下架）\n需求：定位 PspSetCreateProcessNotifyRoutine 的新地址\n\n步骤：\n1. 两个版本都加载到 IDA\n2. 找到导出函数 PsSetCreateProcessNotifyRoutine（两个版本都有）\n3. 旧版中它调用了 PspSetCreateProcessNotifyRoutine（有符号）\n4. 新版中它调用了 sub_140822108（无符号）\n5. LLM 一眼看出：sub_140822108 = PspSetCreateProcessNotifyRoutine\n6. 批量应用\n```\n\n### 场景 2：应用更新后迁移\n\n```text\n已有：target.exe v1.0 的完整逆向结果（200+ 函数已命名）\n目标：target.exe v1.1（所有符号丢失）\n需求：批量迁移 200 个函数名\n\n步骤：\n1. 从旧版导出所有已命名函数的反汇编+伪代码\n2. 在新版中通过导出函数\u002F字符串找到对应锚点\n3. 批量调用 LLM 比对\n4. 解析 YAML，批量 rename\n5. 迭代深入\n```\n\n## LLM 选择建议\n\n| 模型 | 适合场景 | 成本 | 速度 |\n|------|---------|------|------|\n| DeepSeek V3 | 中小函数（\u003C200 行），批量处理 | 极低 | 快 |\n| GPT-4o | 超大函数，复杂控制流 | 中 | 快 |\n| Claude Sonnet | 中大函数，需要推理 | 中 | 快 |\n| Claude Opus | 极复杂函数，需要深度理解 | 高 | 慢 |\n\n推荐策略：默认 DeepSeek，遇到 context 超限或结果不准时自动升级。\n\n## 注意事项\n\n- **不要把整个二进制丢给 LLM** — 一次只比对一个函数\n- **锚点必须可靠** — 如果锚点本身就对错了，后续全部白费\n- **结果需要人工抽检** — LLM 不是 100% 准确，关键符号要验证\n- **缓存中间结果** — 避免重复调用浪费 token\n- **注意 context 限制** — 超大函数（>1000 行反汇编）需要拆分或用大 context 模型\n\n---\n","# 跨版本符号迁移 (Binary Diff)\n\n## 适用范围\n\n当任务属于以下场景时使用本 skill：\n\n1. **内核\u002F驱动缺 PDB** — 有旧版 ntoskrnl.exe 的符号，新版 PDB 被微软下架，需要用旧版符号推导新版非导出函数地址\n2. **程序更新后符号迁移** — 曾经逆向过某个程序，程序更新了，不想重新逆一遍，用旧版结果批量迁移\n3. **保护机制更新** — 旧版有完整逆向结果，新版需要快速定位同一函数的新偏移\n4. **任何\"有旧版符号 + 新版无符号\"的二进制对比场景**\n\n### 与其他 skill 的分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 从零开始逆向一个二进制 | `ida-reverse\u002F` 或 `radare2\u002F` |\n| 有旧版结果，迁移到新版 | **本 skill** |\n| 两个完全不同的二进制对比 | BinDiff \u002F Diaphora（传统工具） |\n\n### 核心优势\n\n相比传统方案：\n\n| 方案 | 200 个函数成本 | 时间 | 准确率 |\n|------|--------------|------|--------|\n| 人工开两个 IDA 窗口对比 | 免费但耗命 | 数小时 | 高 |\n| BinDiff 自动匹配 | 免费 | 快 | 中（结构变化大时失效） |\n| 完全交给 Agent（CC\u002FCodex） | 50-100 元 | 慢 | 高 |\n| **本 skill（LLM 批量比对）** | **~1 元** | **~10 秒\u002F函数** | **高** |\n\n## 核心原理\n\n```text\n旧版函数（有符号）          新版同一函数（无符号）\n    ↓                              ↓\n导出反汇编 + 伪代码          导出反汇编 + 伪代码\n    ↓                              ↓\n    └──────── LLM 结构化比对 ────────┘\n                    ↓\n         输出 YAML（符号映射表）\n                    ↓\n         程序化解析 → 批量应用到新版 IDB\n```\n\n关键点：\n- prompt 是固定模板，程序化填充\n- 输入输出格式确定，程序化解析\n- LLM 只负责\"看两段代码，找出对应关系\"这一步\n- 时间成本和 token 成本极低\n\n## Prompt 模板\n\n### 标准比对 Prompt\n\n```text\nI have disassembly outputs and procedure code of the same function.\n\nThis is the function for reference:\n\n**Disassembly for Reference**\n```c\n{disasm_for_reference}\n```\n\n**Procedure code for Reference**\n```c\n{procedure_for_reference}\n```\n\nThis is the function you need to reverse-engineering:\n\n**Disassembly to reverse-engineering**\n```c\n{disasm_code}\n```\n\n**Procedure code to reverse-engineering**\n```c\n{procedure}\n```\n\nWhat you need to do is to collect all references to \"{symbol_name_list}\" in the function you need to reverse-engineering and output those references as YAML.\n\nExample:\n```yaml\nfound_vcall: # This is for indirect call to virtual function or virtual function pointer fetching.\n  - insn_va: '0x180777700' # Always be the instruction with displacement offset\n    insn_disasm: call [rax+68h] # Always be the instruction with displacement offset\n    vfunc_offset: '0x68'\n    func_name: ILoopMode_OnLoopActivate\n  - insn_va: '0x180777778' # Always be the instruction with displacement offset\n    insn_disasm: mov rax, [rax+80h] # Always be the instruction with displacement offset\n    vfunc_offset: '0x80'\n    func_name: INetworkMessages_GetNetworkGroupCount\n\nfound_call: # This is for direct call to non-virtual regular function.\n  - insn_va: '0x180888800'\n    insn_disasm: call sub_180999900\n    func_name: CLoopMode_RegisterEventMapInternal\n  - insn_va: '0x180888880'\n    insn_disasm: call sub_180555500\n    func_name: CLoopMode_SetSystemState\n\nfound_funcptr: # This is for non-virtual regular function pointer.\n  - insn_va: '0x180666600' # Must load\u002Freference the function pointer target address\n    insn_disasm: lea rdx, sub_15BC910 # Must load\u002Freference the function pointer target address\n    funcptr_name: CLoopMode_OnClientPollNetworking\n\nfound_gv: # This is for reference to global variable.\n  - insn_va: '0x180444400'\n    insn_disasm: mov rcx, cs:qword_180666600 # Must load\u002Freference the global variable\n    gv_name: g_pNetworkMessages\n  - insn_va: '0x180333300'\n    insn_disasm: lea rax, unk_180222200 # Must load\u002Freference the global variable\n    gv_name: s_EventManager\n\nfound_struct_offset: # This is for reference to struct offset. NOTE THAT virtual function pointer should not be here! virtual function pointer should ALWAYS be in found_vcall !\n  - insn_va: '0x1801BA12A' # Always be the instruction with displacement offset\n    insn_disasm: mov rcx, [r14+58h] # Always be the instruction with displacement offset\n    offset: '0x58'\n    size: 8\n    struct_name: CResourceService\n    member_name: m_pEntitySystem\n```\n\nIf nothing found, output an empty YAML. DO NOT output anything other than the desired YAML. DO NOT collect unrelated symbols.\n```\n\n### 变量说明\n\n| 变量 | 来源 | 说明 |\n|------|------|------|\n| `{disasm_for_reference}` | 旧版 IDA 导出 | 有符号的反汇编 |\n| `{procedure_for_reference}` | 旧版 IDA 导出 | 有符号的伪代码 |\n| `{disasm_code}` | 新版 IDA 导出 | 无符号的反汇编 |\n| `{procedure}` | 新版 IDA 导出 | 无符号的伪代码 |\n| `{symbol_name_list}` | 从旧版提取 | 需要在新版中定位的符号列表 |\n\n## 工作流\n\n### 完整流程\n\n```text\nStep 1: 准备数据\n  - 旧版二进制加载到 IDA（有 PDB\u002F符号）\n  - 新版二进制加载到 IDA（无符号）\n  - 找到两个版本中相同的锚点函数（导出函数、字符串引用等）\n\nStep 2: 批量导出\n  - 从旧版导出：锚点函数的反汇编 + 伪代码（含符号名）\n  - 从新版导出：同一锚点函数的反汇编 + 伪代码（无符号名）\n\nStep 3: LLM 比对\n  - 用 prompt 模板填充数据\n  - 调用 LLM API（推荐：deepseek 量大便宜，超大函数切 gpt）\n  - 解析返回的 YAML\n\nStep 4: 应用结果\n  - 将 YAML 中的符号映射批量应用到新版 IDB\n  - 用 idapro_rename 或 IDAPython 脚本批量重命名\n\nStep 5: 迭代\n  - 第一轮迁移的函数成为新的锚点\n  - 进入这些函数，继续对比内部调用\n  - 重复直到覆盖所有目标函数\n```\n\n### 锚点选择策略\n\n| 锚点类型 | 可靠性 | 说明 |\n|---------|--------|------|\n| 导出函数 | 最高 | 名字不变，地址可能变 |\n| 字符串引用 | 高 | 字符串内容不变，引用位置可能变 |\n| 常量\u002F魔数 | 中 | 特征值不变 |\n| 代码模式 | 中 | 函数结构相似但地址全变 |\n\n### 批量处理建议\n\n- 每次比对 1 个函数（避免 context 爆炸）\n- 中等函数（\u003C200 行）用 deepseek\n- 超大函数（>500 行）切 gpt-4o 或 claude\n- 并发调用提高速度（10-20 并发）\n- 结果缓存，避免重复调用\n\n## 输出格式\n\n### YAML 输出的 5 种符号类型\n\n| 类型 | 含义 | 关键字段 |\n|------|------|---------|\n| `found_vcall` | 虚函数调用（间接 call） | `vfunc_offset`, `func_name` |\n| `found_call` | 直接函数调用 | `insn_va`, `func_name` |\n| `found_funcptr` | 函数指针引用 | `insn_va`, `funcptr_name` |\n| `found_gv` | 全局变量引用 | `insn_va`, `gv_name` |\n| `found_struct_offset` | 结构体偏移引用 | `offset`, `struct_name`, `member_name` |\n\n### 解析后的应用动作\n\n```text\nfound_call → idapro_rename(addr=call_target, name=func_name)\nfound_vcall → idapro_set_comments(addr=insn_va, comment=\"vcall: {func_name} @ +{offset}\")\nfound_funcptr → idapro_rename(addr=funcptr_target, name=funcptr_name)\nfound_gv → idapro_rename(addr=gv_addr, name=gv_name)\nfound_struct_offset → idapro_set_comments(addr=insn_va, comment=\"{struct_name}.{member_name}\")\n```\n\n## 典型场景示例\n\n### 场景 1：ntoskrnl.exe 缺 PDB\n\n```text\n已有：ntoskrnl.exe 10.0.26100.2000 + 完整 PDB\n目标：ntoskrnl.exe 10.0.26100.2605（PDB 被下架）\n需求：定位 PspSetCreateProcessNotifyRoutine 的新地址\n\n步骤：\n1. 两个版本都加载到 IDA\n2. 找到导出函数 PsSetCreateProcessNotifyRoutine（两个版本都有）\n3. 旧版中它调用了 PspSetCreateProcessNotifyRoutine（有符号）\n4. 新版中它调用了 sub_140822108（无符号）\n5. LLM 一眼看出：sub_140822108 = PspSetCreateProcessNotifyRoutine\n6. 批量应用\n```\n\n### 场景 2：应用更新后迁移\n\n```text\n已有：target.exe v1.0 的完整逆向结果（200+ 函数已命名）\n目标：target.exe v1.1（所有符号丢失）\n需求：批量迁移 200 个函数名\n\n步骤：\n1. 从旧版导出所有已命名函数的反汇编+伪代码\n2. 在新版中通过导出函数\u002F字符串找到对应锚点\n3. 批量调用 LLM 比对\n4. 解析 YAML，批量 rename\n5. 迭代深入\n```\n\n## LLM 选择建议\n\n| 模型 | 适合场景 | 成本 | 速度 |\n|------|---------|------|------|\n| DeepSeek V3 | 中小函数（\u003C200 行），批量处理 | 极低 | 快 |\n| GPT-4o | 超大函数，复杂控制流 | 中 | 快 |\n| Claude Sonnet | 中大函数，需要推理 | 中 | 快 |\n| Claude Opus | 极复杂函数，需要深度理解 | 高 | 慢 |\n\n推荐策略：默认 DeepSeek，遇到 context 超限或结果不准时自动升级。\n\n## 注意事项\n\n- **不要把整个二进制丢给 LLM** — 一次只比对一个函数\n- **锚点必须可靠** — 如果锚点本身就对错了，后续全部白费\n- **结果需要人工抽检** — LLM 不是 100% 准确，关键符号要验证\n- **缓存中间结果** — 避免重复调用浪费 token\n- **注意 context 限制** — 超大函数（>1000 行反汇编）需要拆分或用大 context 模型\n\n---\n",{"name":5,"description":37,"user-invocable":38},"跨版本符号迁移与二进制差分。当你有旧版本的符号\u002F逆向结果，需要快速迁移到新版本时使用。\n适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。\n核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。\n触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。\n",true,"main","cd89f013b617f7eea982a9bbc60e992974fda2aa","systems\u002Freverse-skill\u002Fskills\u002Fbinary-diff",15,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco","https:\u002F\u002Fcocoresearch.org\u002Fcoco\u002F","https:\u002F\u002Fgithub.com\u002Fcoco-research","https:\u002F\u002Fcocoresearch.org","Local-first, open-source tools for people who work with AI agents: governed memory, agents that check their own work, and data that stays on your machine.","2026-11-11 12:18:13",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":38},[51,54,57],{"tool":52,"command":53},"npx","npx skills add coco-research\u002Fcoco --skill binary-diff",{"tool":55,"command":56},"bunx","bunx skills add coco-research\u002Fcoco --skill binary-diff",{"tool":58,"command":59},"pnpm","pnpm dlx skills add coco-research\u002Fcoco --skill binary-diff","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fbinary-diff\u002FSKILL.md",[62],{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"references\u002Fprompt-template.md","REFERENCE","参考文档",4947,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fbinary-diff\u002Freferences\u002Fprompt-template.md",[69,94,104,122,157,176],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":76,"publishedAt":32},"01M71KEJXF9KMT0BWCMRSRFA4M","trading-super-intelligence","Trading Super Intelligence Team. Named real-world personas across 8 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Ftrading\u002FSKILL.md",[75],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93],"super","trading super intelligence","intelligence","trading","validator","personas","local","composites","studio","team","across","world","first","gated","2026","lm studio","local-first",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":101,"publishedAt":32},"01M71KEFWS3CMAP7DF1P0FWTDE","strategy-super-intelligence","Strategy Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fstrategy\u002FSKILL.md",[100],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[102,77,103,79,81,82,83,84,85,86,87,88,89,90,91,92,93],"strategy","strategy super intelligence",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":116,"publishedAt":32},"01M71KED56ZEPK2QE84QSQPMT0","risk-compliance-super-intelligence","Risk & Compliance (GRC) Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Frisk-compliance\u002FSKILL.md",[110,111],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[117,77,118,119,120,79,81,82,83,84,121,85,86,87,88,89,90,91,92,93],"risk","risk compliance super intelligence","compliance","risk compliance","grc",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":141,"publishedAt":32},"01M71KE9A2FWSC74VA96W1EZSN","product-design-super-intelligence","Your product + design brain trust and decision partner. Named personas across 8 cells spanning product strategy, discovery\u002Fresearch, growth\u002Fmetrics, design foundations\u002Fusability, design leadership\u002Fcraft, UX\u002Fcontent, design systems, and a…","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fproduct-design\u002FSKILL.md",[128,131,134,135,138],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000031","产品经理",{"categoryNo":139,"categoryName":140,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000032","设计师",[142,143,79,144,77,145,146,147,148,149,150,86,87,151,152,91,153,154,155,156],"design","product","product design","product design super intelligence","foundations","product-design","decision","design systems","usability","leadership","ux","brain","craft","metrics","trust",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":165,"publishedAt":32},"01M71KE6H9FPSD9TECYFBPXZ8Y","legal-ip-super-intelligence","Your legal, IP, and regulatory brain trust. 31 named personas across 7 cells covering patent strategy, tech licensing, regulatory litigation, AI governance, open-source compliance, privacy law, and antitrust.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Flegal-ip\u002FSKILL.md",[163,164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},[166,77,167,79,168,169,156,170,82,171,172,173,102,86,87,174,119,175,91,153],"ip","legal ip super intelligence","legal","sep","tech","litigation","ai governance","open","open-source","governance",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":183,"publishedAt":32},"01M71KE36QRY610V6YVB9JWRND","healthcare-life-sciences-super-intelligence","Your healthcare and life sciences brain trust. 25 named personas across 7 cells covering drug discovery, medtech, biotech strategy, health policy, genomics, clinical trials, and healthcare economics.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fhealthcare-life-sciences\u002FSKILL.md",[182],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[184,77,185,186,79,169,156,187,188,82,189,190,102,86,87,191,192,193,194,91],"healthcare","healthcare life sciences super intelligence","life","economics","discovery","policy","clinical","clinical trials","health","trials","genomics"]