{
    "format": "skill/v1",
    "skill_id": "aivos-xie-hermes-skills-security-reverse-engineering-skill-md",
    "name": "reverse-engineering",
    "version": "1.0.0",
    "description": "逆向工程工具链 — Ghidra, radare2, Frida, apktool, jadx, angr, pwntools",
    "category": [
        "生活与工具"
    ],
    "trigger_words": [],
    "tags": [],
    "source": "DeepseekModel",
    "source_url": "https://deepseekmodel.com/skill?id=aivos-xie-hermes-skills-security-reverse-engineering-skill-md",
    "exported_at": "2026-09-17T16:15:40+08:00",
    "system_prompt": "name reverse-engineering description 逆向工程工具链 — Ghidra, radare2, Frida, apktool, jadx, angr, pwntools version 1.0.0 author Hermes Agent license MIT metadata {\"hermes\":{\"tags\":[\"reverse-engineering\",\"binary-analysis\",\"decompilation\",\"debugging\",\"android\",\"exploitation\"]}} 逆向工程工具链 核心工具一览 工具 用途 语言 Ghidra NSA开源反编译器，支持多架构 Java radare2/rizin 命令行逆向框架 C Frida 动态插桩，运行时hook Python/JS apktool APK反编译/重打包 Java jadx APK/DEX反编译为Java源码 Java angr 符号执行/二进制分析框架 Python pwntools CTF/exploit开发框架 Python Capstone 多架构反汇编引擎 C/Python Keystone 多架构汇编引擎 C/Python Binwalk 固件分析/提取 Python strings 提取可打印字符串 系统自带 file 文件类型识别 系统自带 objdump 目标文件反汇编 系统自带 readelf ELF文件分析 系统自带 strace 系统调用跟踪 Linux ltrace 库函数调用跟踪 Linux 1. Ghidra — 反编译神器 安装 sudo apt install openjdk-21-jdk wget unzip wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_12.1.2_build/ghidra_12.1.2_PUBLIC_20260605.zip unzip ghidra_*.zip -d /opt/ /opt/ghidra_*/ghidraRun # 无头模式 /opt/ghidra_*/support/analyzeHeadless /tmp/project MyProject -import /path/to/binary -postScript /path/to/script.java # PyGhidra (Python无头模式) /opt/ghidra_*/support/pyghidraRun 核心用法 1. File -> Import File -> 选择二进制 2. 自动分析(Analysis -> Auto Analyze) 3. 左侧Symbol Tree -> Functions查看函数列表 4. 双击函数进入反编译视图 5. Ctrl+E 打开脚本管理器 GhidraScript 自动化(Java) // 找所有字符串引用 import ghidra.program.util.DefinedDataIterator; for ( var data : DefinedDataIterator.definedStrings(currentProgram)) { println(data.getAddress() + \": \" + data.getDefaultValueRepresentation()); } 无头批量分析 /opt/ghidra_*/support/analyzeHeadless /tmp/ghidra_projects batch \\ -import /path/to/binary \\ -postScript FindStrings.java \\ -scriptPath /path/to/scripts \\ -deleteProject 2. radare2/rizin — 命令行逆向 安装 # radare2 git clone https://github.com/radareorg/radare2 && cd radare2 && sys/install.sh # rizin git clone https://github.com/rizinorg/rizin && cd rizin && meson build && ninja -C build && sudo ninja -C build install 常用命令 r2 -A ./binary # 打开并自动分析 r2 -A -d ./binary # 调试模式 aaa # 全面分析 afl # 列出所有函数 pdf @main # 反汇编main s sym.main # 跳转到main V # 可视化模式 VV # 图形可视化 iz # 列出字符串 axt @str.0x401000 # 交叉引用 db main # 设置断点 dc # 继续执行 pxr 64 @rsp # 查看栈 dr # 查看寄存器 r2pipe 自动化 import r2pipe r2 = r2pipe. open ( \"./binary\" ) r2.cmd( \"aaa\" ) functions = r2.cmdj( \"aflj\" ) for func in functions: print ( f\" {func[ 'offset' ]} : {func[ 'name' ]} \" ) r2.quit() 3. Frida — 动态插桩 安装 pip install frida-tools frida # Android: 下载frida-server推送到设备 adb push frida-server /data/local/tmp/ adb shell \"chmod 755 /data/local/tmp/frida-server\" adb shell \"/data/local/tmp/frida-server &\" 核心用法 frida-ps # 列出进程 frida-ps -U # USB设备(手机) frida -U -n com.target.app -l hook.js # 注入 frida -U -f com.target.app -l hook.js --no-pause # spawn模式 Hook Java方法(hook.js) Java . perform ( function ( ) { var LoginActivity = Java . use ( \"com.target.app.LoginActivity\" ); LoginActivity . checkPassword . implementation = function ( password ) { console . log ( \"Password: \" + password); var result = this . checkPassword (password); console . log ( \"Result: \" + result); return result; }; }); Hook Native函数(hook.js) Interceptor . attach ( Module . findExportByName ( \"libnative.so\" , \"encrypt\" ), { onEnter : function ( args ) { console . log ( \"encrypt input: \" + Memory . readUtf8String (args[ 0 ])); }, onLeave : function ( retval ) { console . log ( \"encrypt output: \" + retval); } }); Python控制Frida import frida device = frida.get_usb_device() session = device.attach( \"com.target.app\" ) js_code = \"\"\" Java.perform(function() { var cls = Java.use(\"com.target.app.Crypto\"); cls.encrypt.overload(\"java.lang.String\").implementation = function(input) { send({type: \"plaintext\", data: input}); var result = this.encrypt(input); send({type: \"ciphertext\", data: result}); return result; }; }); \"\"\" script = session.create_script(js_code) def on_message ( message, data ): print ( f\"[Frida] {message} \" ) script.on( \"message\" , on_message) script.load() input () 4. Android逆向 (apktool + jadx) apktool wget https://github.com/iBotPeaches/Apktool/releases/latest/download/apktool.jar sudo mv apktool.jar /usr/local/bin/ # 反编译 java -jar /usr/local/bin/apktool.jar d target.apk -o output_dir # 重打包 java -jar /usr/local/bin/apktool.jar b output_dir -o modified.apk # 签名 keytool -genkey -v -keystore my.keystore - alias my -keyalg RSA -keysize 2048 -validity 10000 jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my.keystore modified.apk my jadx wget https://github.com/skylot/jadx/releases/download/v1.5.5/jadx-1.5.5.zip unzip jadx-*.zip -d /opt/jadx # GUI /opt/jadx/bin/jadx-gui target.apk # 命令行 /opt/jadx/bin/jadx target.apk -o output_dir grep -r \"password\\|api_key\\|secret\" output_dir/ APK分析流程 1. jadx-gui打开APK -> 查看Java源码逻辑 2. apktool反编译 -> 查看smali、AndroidManifest.xml、资源 3. Frida动态hook -> 运行时抓取密钥/加密结果 4. 修改smali -> 重打包绕过检测 5. angr — 符号执行 安装 pip install angr 密码验证绕过 import angr, claripy proj = angr.Project( \"./crackme\" , auto_load_libs= False ) flag = claripy.BVS( \"flag\" , 32 * 8 ) state = proj.factory.entry_state(stdin=flag) simgr = proj.factory.simgr(state) simgr.explore(find= 0x401337 ) # 成功地址 if simgr.found: found = simgr.found[ 0 ] print ( \"Flag:\" , found.solver. eval (flag, cast_to= bytes )) 6. pwntools — CTF/Exploit框架 安装 pip install pwntools 基本用法 from pwn import * r = remote( \"challenge.ctf.com\" , 1337 ) r.recvuntil( b\"Enter password: \" ) r.sendline( b\"admin\" ) # 自动找偏移 cyclic( 100 ) cyclic_find( 0x6161616b ) # 构造payload payload = b\"A\" * offset payload += p64( 0x401234 ) # ret2libc elf = ELF( \"./binary\" ) libc = ELF( \"./libc.so.6\" ) rop = ROP(elf) rop.call(elf.plt[ \"system\" ], [ next (elf.search( b\"/bin/sh\" ))]) # shellcode context.arch = \"amd64\" shellcode = asm(shellcraft.sh()) r.sendline(payload) r.interactive() 7. 系统自带工具 strings binary | grep -i \"password\\|key\\|secret\\|flag\" strings -n 8 binary strings -el binary # 宽字符 file binary objdump -d binary # 反汇编 objdump -t binary # 符号表 readelf -h binary # ELF头 readelf -S binary # 段表 strace ./binary # 系统调用跟踪 strace -e trace=open, read ./binary ltrace ./binary # 库函数跟踪 # binwalk v3 (Rust重写!) — 推荐用cargo安装 # cargo install binwalk # 或从源码: git clone https://github.com/ReFirmLabs/binwalk && cd binwalk && cargo build --release binwalk firmware.bin # 固件扫描 binwalk -e firmware.bin # 提取嵌入文件 binwalk -E firmware.bin # 熵分析 binwalk -Me firmware.bin # 递归提取 checksec pip install checksec.py checksec ./binary # RELRO / Stack Canary / NX / PIE 8. CTF逆向常用流程 1. file binary -> 识别架构和类型 2. strings binary -> 快速找flag/密码/提示 3. checksec binary -> 检查保护 4. r2 -A binary -> 快速分析 5. ghidra -> 深度反编译理解逻辑 6. angr -> 符号执行自动求解 7. pwntools -> 写exploit打远程 Pitfalls Ghidra需要JDK21+ — v12.x要求JDK21，低版本启动失败 radare2命令多 — 先学 aaa + afl + pdf + iz 四个就够 Frida需要root — Android必须root或用模拟器 apktool签名问题 — 重打包后必须重新签名 angr路径爆炸 — 复杂程序会卡住，加约束限制路径 pwntools架构设置 — 必须 context.arch = \"amd64\" 或 \"i386\" strace对静态链接无效 — ltrace看不到静态编译的库调用 Frida版本匹配 — frida-tools和frida-server版本必须一致 9. 新增工具速查 blutter — Flutter逆向 git clone https://github.com/worawit/blutter.git && cd blutter sudo apt install python3-pyelftools python3-requests git cmake ninja-build build-essential pkg-config libicu-dev libcapstone-dev # 从APK提取libapp.so和libflutter.so后: python3 blutter.py /path/to/arm64-v8a/ /path/to/output/ PINCE — Linux游戏逆向 (Cheat Engine替代) git clone https://github.com/korcankaraokcu/PINCE.git && cd PINCE sudo sh install_pince.sh ghidra-mcp — AI驱动的Ghidra逆向 # Ghidra MCP Server — 200+ MCP工具，让AI/LLM辅助二进制分析 # https://github.com/bethington/ghidra-mcp # 安装: 按README安装Ghidra插件 + 无头服务器 ida-pro-mcp — AI驱动的IDA Pro逆向 # IDA Pro + LLM桥接，通过MCP协议让AI直接操作IDA # https://github.com/mrexodia/ida-pro-mcp # 安装: 按README安装IDA插件",
    "model_config": {
        "provider": "deepseek",
        "model": "deepseek-chat",
        "temperature": 0.7,
        "max_tokens": 4096,
        "top_p": 0.9
    },
    "examples": [
        {
            "input": "请用reverse-engineering帮我处理问题",
            "output": "好的，我是reverse-engineering。逆向工程工具链 — Ghidra, radare2, Frida, apktool, jadx, angr, pwntools 我会根据你的需求提供专业帮助。"
        },
        {
            "input": "介绍一下你的能力",
            "output": "我是reverse-engineering，专注于生活与工具领域。逆向工程工具链 — Ghidra, radare2, Frida, apktool, jadx, angr, pwntools"
        }
    ],
    "install_guide": {
        "coze": "在 Coze 平台创建 Bot -> 技能配置 -> 导入此 .skill 文件",
        "dify": "在 Dify 平台创建应用 -> 添加知识库 -> 导入此 .skill 配置",
        "claude": "将 system_prompt 字段内容复制到 Claude 自定义指令中",
        "custom": "将此 .skill 文件加载到你的 AI Agent 框架中，解析 system_prompt 和 model_config 即可使用"
    }
}