Competition Reverse Pwn
Internal downstream skill for ctf-sandbox-orchestrator.
Install
npx skills add zhaoxuya520/reverse-skill --skill competition-reverse-pwn -g -a claude-code -y- Repository
- zhaoxuya520/reverse-skill43.9k
- Category
- Testing
- Updated
- 1mo ago
- License
- MIT
- Context cost
- Lightabout 837 tokens
- Runs scripts
- No, instructions only
What it does
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Competition Reverse Pwn
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill for binary-heavy challenges where the decisive path runs through artifacts, decoded layers, process behavior, crash state, or exploit primitives.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Preserve the original artifact before unpacking, patching, or instrumenting.
- Start with passive triage: type, headers, sections, imports, strings, entropy, resources.
- Decide whether the path is reverse-first, DFIR-first, or exploit-first.
- Tie every claim to an observable boundary: decode edge, persistence edge, crash edge, or leak edge.
- Reproduce the artifact or primitive from a clean baseline.
Workflow
1. Reverse Or Forensic Triage
- Separate loader, payload, config, and post-decode behavior.
- Correlate files, memory, logs, registry, services, tasks, IPC, and PCAPs as one graph.
- Keep decoded or dumped artifacts separate from the pristine sample.
2. Native And Exploit Path
- Map mitigations, loader behavior, libc or runtime, syscall and IPC surfaces, and protocol framing.
- Record the primitive, controllable bytes, leak source, target object, and final artifact separately.
- Compare host, libc, loader, and framing differences before doubting the primitive.
