eni-reverse-workflow
Deep, evidence-driven reverse engineering workflow for PE, ELF, Mach-O, firmware, drivers, bytecode, protocols, and local binaries.
- License 许可
- MIT
- 最近更新
- 2026-10-15
- Stars
- ★ 42
- Forks
- 24
01 前言 Front Matter
- name
- eni-reverse-workflow
- description
- Deep, evidence-driven reverse engineering workflow for PE, ELF, Mach-O, firmware, drivers, bytecode, protocols, and local binaries.
02 资源文件 21
- 参考文档.slo-install.json788 B
- 其他.slo-protected/assets/007b5a49aebfb98dd1c5a312c2709142.sloasset6.0 KB
- 其他.slo-protected/assets/423e6ed71787b50194082c7bc1eb4bf4.sloasset8.4 KB
- 其他.slo-protected/assets/488fec6561f2e36b8e56a672e4ae6400.sloasset14.8 KB
- 其他.slo-protected/assets/cb3d90a730e606650f586a8fd74d915b.sloasset9.9 KB
- 其他.slo-protected/engine/slo-engine.exe15.1 MB
- 参考文档.slo-protected/manifest.json2.6 KB
- 参考文档agents/openai.yaml218 B
- 参考文档README.md857 B
- 参考文档references/capabilities.md2.3 KB
- 参考文档references/evidence-reporting.md1.7 KB
- 参考文档references/prompting.md4.0 KB
- 参考文档references/reverse-techniques.md2.7 KB
- 参考文档references/tool-catalog.md4.2 KB
- 参考文档references/tooling-matrix.md1.7 KB
- 参考文档references/vulnerability-review.md2.3 KB
- 参考文档references/workflow.md2.3 KB
- 脚本scripts/create_case.py1.4 KB
- 脚本scripts/report_from_triage.py1.4 KB
- 脚本scripts/tool_audit.py1.4 KB
- 脚本scripts/triage_artifact.py1.4 KB
03 SKILL.md 正文
Reverse Workflow 2.1
Preserve the original and work from a hashed copy.
- Fingerprint format, architecture, entropy, imports, signatures, sections, and packer indicators.
- Run capa-style capability triage before deep reading.
- Use Ghidra-style headless analysis for functions, cross-references, call graphs, types, and decompilation.
- Form explicit hypotheses around data sources, transformations, checks, and sinks.
- Use Frida-style runtime observation only in a controlled local environment.
- Correlate static and dynamic evidence, reproduce behavior, and deliver scripts, offsets, symbols, copy patches, or a report.
Chain mobile, firmware, malware-ir, fuzzing, or crack when signals require them.
04 同仓库更多 Skills
competition-race-condition-state-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-queue-worker-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-prompt-injection
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-pcap-protocol
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-oauth-oidc-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-malware-config
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.