[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DAWP364YPDKX1SF28SAVC7":3,"skill-same:01M7DAWP364YPDKX1SF28SAVC7":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":6,"ownerHtmlUrl":30,"ownerBlogUrl":6,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M7DAWP364YPDKX1SF28SAVC7","linker-fake-load-unwrapper",null,"Use when analyzing Android AArch64 ELF files protected by a special linker-style fake PT_LOAD wrapper, impossible high-address LOAD segments, entry-point translation such as e_entry minus fake p_vaddr, XOR runtime decryptors, embedded ELF carving, shell-looking ELF second stages, or when a user mentions linker 加固\u002F脱壳\u002F通杀. Provides static and dynamic workflows, tools, and principles for recovering the real runtime image.","alicewe1\u002Falice_skill","alicewe1","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F102134151?v=4","01M7D9STCM8HAESM958JP0989K","Alice_we","01M7D9STDR22MTD9FTTWPAZNV8",64,"GPL-3.0","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Flinker-fake-load-unwrapper\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: linker-fake-load-unwrapper\ndescription: Use when analyzing Android AArch64 ELF files protected by a special linker-style fake PT_LOAD wrapper, impossible high-address LOAD segments, entry-point translation such as e_entry minus fake p_vaddr, XOR runtime decryptors, embedded ELF carving, shell-looking ELF second stages, or when a user mentions linker 加固\u002F脱壳\u002F通杀. Provides static and dynamic workflows, tools, and principles for recovering the real runtime image.\nx-alice-class: assist\n---\n\n# Linker Fake-Load Unwrapper\n\n## Core idea\n\nThis protector abuses ELF program headers so the visible entry and memory layout look abnormal. Do not guess fixed offsets. Derive the real file entry from PHDR evidence, decode the entry stub, recover XOR ranges\u002Fkey, then reconstruct the runtime image.\n\n## Fast path\n\n```powershell\npython \u003Cskill-dir>\\scripts\\linker_static_unwrap.py \u003Ctarget> --out-dir \u003Cout>\n```\n\nExpected outputs:\n\n- `\u003Ctarget>.linker_xor_runtime.bin` — reconstructed runtime image.\n- `linker_static_unwrap_report.json` — PHDRs, fake LOAD, true entry offset, XOR ranges, carved embedded ELFs, interesting strings.\n- `embedded_elfs\u002F` — candidate inner ELF payloads\u002Finterpreters.\n\nThe script intentionally refuses to proceed if it cannot find the fake LOAD or recover XOR ranges; do not hardcode offsets unless you first write down why the PHDR-derived method fails.\n\n## Static analysis procedure\n\n1. Parse ELF64 little-endian AArch64 header and PHDRs.\n2. Find fake LOAD candidate:\n   - `p_type == PT_LOAD`\n   - `p_offset == 0`\n   - `p_filesz > file_size`\n   - high `p_vaddr` such as `0xffff0000` or huge `p_filesz`\n   - `e_entry` falls inside `p_vaddr .. p_vaddr + p_filesz`\n3. Translate true entry:\n   - `true_entry_file_offset = e_entry - fake.p_vaddr + fake.p_offset`\n4. Disassemble AArch64 stub at real file entry.\n5. Recover repeated decrypt calls:\n   - key usually arrives in `w3\u002Fx3` as an immediate byte.\n   - target pointer and size are often loaded through PC-relative `ldr` literals into `x2` and `x1`.\n   - each `bl` after those loads applies XOR to a runtime range.\n6. Map target VAs through normal LOADs, not the fake one, then XOR file bytes.\n7. Carve embedded `ELF` blobs and inspect sections\u002FPHDRs\u002FUPX markers.\n8. Validate runtime by string diff, embedded ELF parse, and dynamic dump comparison when possible.\n\n## Dynamic confirmation procedure\n\nUse dynamic dumping when:\n\n- Capstone cannot recover stub ranges.\n- The key\u002Franges are computed instead of literal-loaded.\n- The runtime later decrypts another stage.\n- Static runtime and device behavior disagree.\n\nOn Android:\n\n1. Run the target in a controlled directory.\n2. Monitor `\u002Fproc\u002F\u003Cpid>\u002Fmaps` for file-backed or anonymous executable mappings.\n3. Dump relevant mappings through `\u002Fproc\u002F\u003Cpid>\u002Fmem` as root.\n4. Prefer parent-child dumpers for short-lived children.\n5. Compare dump SHA256\u002Fstrings\u002FELF offsets with static runtime.\n\n## Validation gates\n\nA result is not “done” until these checks can fail and pass:\n\n- Original hash recorded.\n- Fake LOAD and true entry offset recorded.\n- XOR ranges\u002Fkey recorded or dynamic replacement evidence recorded.\n- Runtime image exists and has hash.\n- Embedded ELF offsets or absence thereof documented.\n- If business logic is expected, stack\u002Fheap\u002Fmemfd plaintext search performed.\n\n## Reference routing\n\nRead `references\u002Flinker-fake-load-principles.md` for the detailed protector model, failure modes, dynamic fallback, and reporting template.\n","# Linker Fake-Load Unwrapper\n\n## Core idea\n\nThis protector abuses ELF program headers so the visible entry and memory layout look abnormal. Do not guess fixed offsets. Derive the real file entry from PHDR evidence, decode the entry stub, recover XOR ranges\u002Fkey, then reconstruct the runtime image.\n\n## Fast path\n\n```powershell\npython \u003Cskill-dir>\\scripts\\linker_static_unwrap.py \u003Ctarget> --out-dir \u003Cout>\n```\n\nExpected outputs:\n\n- `\u003Ctarget>.linker_xor_runtime.bin` — reconstructed runtime image.\n- `linker_static_unwrap_report.json` — PHDRs, fake LOAD, true entry offset, XOR ranges, carved embedded ELFs, interesting strings.\n- `embedded_elfs\u002F` — candidate inner ELF payloads\u002Finterpreters.\n\nThe script intentionally refuses to proceed if it cannot find the fake LOAD or recover XOR ranges; do not hardcode offsets unless you first write down why the PHDR-derived method fails.\n\n## Static analysis procedure\n\n1. Parse ELF64 little-endian AArch64 header and PHDRs.\n2. Find fake LOAD candidate:\n   - `p_type == PT_LOAD`\n   - `p_offset == 0`\n   - `p_filesz > file_size`\n   - high `p_vaddr` such as `0xffff0000` or huge `p_filesz`\n   - `e_entry` falls inside `p_vaddr .. p_vaddr + p_filesz`\n3. Translate true entry:\n   - `true_entry_file_offset = e_entry - fake.p_vaddr + fake.p_offset`\n4. Disassemble AArch64 stub at real file entry.\n5. Recover repeated decrypt calls:\n   - key usually arrives in `w3\u002Fx3` as an immediate byte.\n   - target pointer and size are often loaded through PC-relative `ldr` literals into `x2` and `x1`.\n   - each `bl` after those loads applies XOR to a runtime range.\n6. Map target VAs through normal LOADs, not the fake one, then XOR file bytes.\n7. Carve embedded `ELF` blobs and inspect sections\u002FPHDRs\u002FUPX markers.\n8. Validate runtime by string diff, embedded ELF parse, and dynamic dump comparison when possible.\n\n## Dynamic confirmation procedure\n\nUse dynamic dumping when:\n\n- Capstone cannot recover stub ranges.\n- The key\u002Franges are computed instead of literal-loaded.\n- The runtime later decrypts another stage.\n- Static runtime and device behavior disagree.\n\nOn Android:\n\n1. Run the target in a controlled directory.\n2. Monitor `\u002Fproc\u002F\u003Cpid>\u002Fmaps` for file-backed or anonymous executable mappings.\n3. Dump relevant mappings through `\u002Fproc\u002F\u003Cpid>\u002Fmem` as root.\n4. Prefer parent-child dumpers for short-lived children.\n5. Compare dump SHA256\u002Fstrings\u002FELF offsets with static runtime.\n\n## Validation gates\n\nA result is not “done” until these checks can fail and pass:\n\n- Original hash recorded.\n- Fake LOAD and true entry offset recorded.\n- XOR ranges\u002Fkey recorded or dynamic replacement evidence recorded.\n- Runtime image exists and has hash.\n- Embedded ELF offsets or absence thereof documented.\n- If business logic is expected, stack\u002Fheap\u002Fmemfd plaintext search performed.\n\n## Reference routing\n\nRead `references\u002Flinker-fake-load-principles.md` for the detailed protector model, failure modes, dynamic fallback, and reporting template.\n",{"name":5,"description":7,"x-alice-class":24},"assist","main","19a54ac988e9929160334271f5c1924ddd9b227e","_modules\u002Flinker-fake-load-unwrapper",19,"https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill","https:\u002F\u002Fgithub.com\u002Falicewe1","写一些自己用得上的工具，能自动化就绝不手动 · 自动化 \u002F 工程效率 \u002F Agent 技能生态 · 保持好奇，持续构建","2026-09-30 00:41:20",{"source":8,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add alicewe1\u002Falice_skill --skill linker-fake-load-unwrapper",{"tool":39,"command":40},"bunx","bunx skills add alicewe1\u002Falice_skill --skill linker-fake-load-unwrapper",{"tool":42,"command":43},"pnpm","pnpm dlx skills add alicewe1\u002Falice_skill --skill linker-fake-load-unwrapper","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Flinker-fake-load-unwrapper\u002FSKILL.md",true,[47,53,57],{"path":48,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":51,"sourceHtmlUrl":52},"agents\u002Fopenai.yaml","REFERENCE","参考文档",244,"https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Flinker-fake-load-unwrapper\u002Fagents\u002Fopenai.yaml",{"path":54,"resourceType":49,"resourceTypeDesc":50,"sizeBytes":55,"sourceHtmlUrl":56},"references\u002Flinker-fake-load-principles.md",4043,"https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Flinker-fake-load-unwrapper\u002Freferences\u002Flinker-fake-load-principles.md",{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},"scripts\u002Flinker_static_unwrap.py","SCRIPT","脚本",11530,"https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Flinker-fake-load-unwrapper\u002Fscripts\u002Flinker_static_unwrap.py",[64,71,78,85,92,99],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7DBMD9P6R27SWQCW5HYVWG0","alice","Alice 六类技能总路由。用户输入 Alice 或要求查看 Alice 技能菜单时，严格输出固定菜单；输入攻\u002F防模式、六类入口或直接描述任务时，按类别→领域→模块渐进路由。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Faliceskill\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7DBM8X5M7YXPYBVFMWF8HRC","alice-reverse","逆向分析渐进路由（二进制 \u002F 移动端 \u002F 协议 \u002F 取证 \u002F 保护机制 \u002F 运行时观测）。触发词：二进制\u002F移动端\u002F反编译\u002FFrida\u002FIDA\u002FGhidra\u002FPE\u002FELF\u002FAPK\u002F协议\u002F取证；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-reverse\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7DBM630E2YKQP29194TT7HC","alice-pentest","web安全渐进路由（Web \u002F API \u002F 资产发现 \u002F 漏洞验证 \u002F 云与网络安全）。触发词：Web\u002FAPI\u002F资产发现\u002F端口\u002F漏洞验证\u002F云与网络安全；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-pentest\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7DBM20M2VDYV5D3MYDGBTQX","alice-game","游戏攻防渐进路由（游戏客户端 \u002F 内存 \u002F 图形 \u002F 反作弊 \u002F 安全研究）。触发词：游戏客户端\u002F内存\u002F图形\u002F偏移\u002F反作弊\u002F模拟器\u002F覆盖层；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-game\u002FSKILL.md",[],[],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":19},"01M7DBKXVEKB8931MZG23VACFN","alice-crack","卡密授权渐进路由（卡密 \u002F 激活 \u002F 授权验证 \u002F 许可证管理 \u002F 本地授权分析）。触发词：卡密\u002F激活\u002F授权验证\u002Flicense\u002F机器码\u002F试用状态；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-crack\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":19},"01M7DBKTMT90MGV2WP8K73TMQD","alice-assist","技能指令渐进路由（技能路由 \u002F 评分 \u002F 吸收 \u002F 迁移 \u002F 自动化 \u002F 文档与平台集成）。触发词：技能创建\u002F吸收\u002F评分\u002F迁移\u002F自动化\u002F文档\u002F平台指令；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-assist\u002FSKILL.md",[],[]]