# Competition Reverse Pwn

Internal downstream skill for ctf-sandbox-orchestrator.

- Repository: https://github.com/zhaoxuya520/reverse-skill (43923 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-09-22
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add zhaoxuya520/reverse-skill --skill competition-reverse-pwn -g -a claude-code -y`
Codex: `npx skills add zhaoxuya520/reverse-skill --skill competition-reverse-pwn -g -a codex -y`
Cursor: `npx skills add zhaoxuya520/reverse-skill --skill competition-reverse-pwn -g -a cursor -y`
Gemini CLI: `npx skills add zhaoxuya520/reverse-skill --skill competition-reverse-pwn -g -a gemini-cli -y`

## Description

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Competition Reverse Pwn

Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.

Use this skill for binary-heavy challenges where the decisive path runs through artifacts, decoded layers, process behavior, crash state, or exploit primitives.

Reply in Simplified Chinese unless the user explicitly requests English.

## Quick Start

1. Preserve the original artifact before unpacking, patching, or instrumenting.
2. Start with passive triage: type, headers, sections, imports, strings, entropy, resources.
3. Decide whether the path is reverse-first, DFIR-first, or exploit-first.
4. Tie every claim to an observable boundary: decode edge, persistence edge, crash edge, or leak edge.
5. Reproduce the artifact or primitive from a clean baseline.

## Workflow

### 1. Reverse Or Forensic Triage

- Separate loader, payload, config, and post-decode behavior.
- Correlate files, memory, logs, registry, services, tasks, IPC, and PCAPs as one graph.
- Keep decoded or dumped artifacts separate from the pristine sample.

### 2. Native And Exploit Path

- Map mitigations, loader behavior, libc or runtime, syscall and IPC surfaces, and protocol framing.
- Record the primitive, controllable bytes, leak source, target object, and final artifact separately.
- Compare host, libc, loader, and framing differences before doubting the primitive.

## Read This Reference

The rest: https://github.com/zhaoxuya520/reverse-skill/blob/HEAD/CTF-Sandbox-Orchestrator/competition-reverse-pwn/SKILL.md