Reverse Engineering Skills

Plugin reverse-engineering-skills from marketplace socket in gaelic-ghost/socket. Commands read from the repo's manifest — 1 month ago.

Skills (24)

• analyze-apple-silicon-arm64e

  Analyze AArch64 and Apple arm64e instruction, calling-convention, pointer-authentication, tagged-pointer, Rosetta, and hardware-mitigation evidence. Use when Codex must interpret Apple Silicon disassembly, registers, stack frames, SIMD, compiler idioms, PAC instructions or authenticated pointers, CP

• audit-apple-signing-and-containment

  Audit Apple code signatures, code directories, CDHashes, authorities, Team IDs, designated requirements, provisioning profiles, entitlements, hardened runtime, library validation, notarization, App Sandbox, SIP, Data Vaults, and platform-binary context. Use when Codex must explain an Apple artifact'

• compare-binary-versions

  Compare exact compiled-artifact builds and record reproducible structural, metadata, symbol, dependency, signing, resource, or control-flow differences. Use when Codex must diff binaries, bundles, frameworks, firmware, assemblies, dyld caches, releases, security updates, or beta builds without assum

• connect-hopper-mcp

  Connect an installed Hopper MCP server safely from Codex or Hermes for document navigation, assembly, pseudocode, strings, procedures, and cross-references with a private profile, read-only allowlist, approvals, and data boundaries.

• correlate-apple-symbols-and-crashes

  Match Apple binaries, dSYMs, BCSymbolMaps when applicable, crash reports, IPS logs, panic excerpts, and static-analysis databases by UUID, architecture, load address, and exact build. Use when Codex must symbolicate or assess partial symbolication, translate crash addresses, correlate runtime frames

• evidence-notes-workflow

  Create reproducible reverse-engineering notes from artifacts, copied working files, commands, tool versions, decompiler or disassembler output, observations, inferences, open questions, and follow-up checks. Use when Codex needs to document a binary analysis session, preserve an evidence trail, comp

• inspect-apple-artifact

  Inspect Apple application bundles, extensions, frameworks, dylibs, static archives, XCFrameworks, IPA files, Mach-O executables, dSYMs, crash artifacts, dyld caches, kernel collections, IPSW files, or restore images without changing the original. Use when Codex must identify Apple container structur

• inspect-dotnet-assemblies

  Inspect .NET and .NET Framework assemblies, managed PE files, CIL, manifests, metadata tables, resources, dependencies, target frameworks, runtimeconfig and deps files, portable or Windows PDBs, and generated decompiler output. Use when Codex must distinguish managed, mixed-mode, single-file, ReadyT

• inspect-dyld-shared-cache

  Inspect, map, extract from, or compare Apple dyld shared caches and subcaches while preserving cache-native identity and addresses. Use when Codex must identify a cache by platform, architecture, UUID, and OS build; inventory images, mappings, slide information, local symbols, chained fixups, closur

• inspect-unity-artifacts

  Inspect compiled Unity player, package, data, managed Mono, and IL2CPP artifacts across supported platforms. Use when Codex must identify Unity version and scripting backend; inventory player executables, UnityPlayer, managed assemblies, Assembly-CSharp, GameAssembly, global-metadata.dat, native lib

• perform-apple-dynamic-analysis

  Plan and record bounded dynamic analysis of Apple binaries using supported LLDB, Xcode, Instruments, unified logging, Simulator, physical-device, macOS VM, or research-device surfaces. Use when Codex must verify a static hypothesis at runtime, launch or attach, inspect images, memory regions, regist

• preserve-binary-artifacts

  Create preservation-grade inventories and immutable working practices for compiled artifacts and reverse-engineering research. Use when Codex must preserve binaries, app bundles, firmware, archives, symbols, crash logs, decompiler projects, historical software, research evidence, or FOSS analysis ma

• recover-apple-runtime-metadata

  Recover and validate Objective-C and Swift runtime structure from Apple binaries and generated analysis output. Use when Codex must inspect classes, categories, protocols, selectors, methods, properties, ivars, mangled Swift names, metadata, conformances, witness tables, generic specialization, asyn

• report-apple-security-research

  Turn Apple-platform security research evidence into a reproducible, exact-build technical report. Use when Codex must document affected hardware and OS builds, expected and observed behavior, a minimal test case, artifact hashes, crash or sysdiagnose evidence, impact, mitigations, version bounds, be

• research-apple-kernel-boot-and-firmware

  Inventory and correlate exact-build Apple kernel, kernel collection, KDK, panic, boot-chain, device-tree, IPSW, restore-image, LocalPolicy, SSV, AuxKC, personalization, and firmware artifacts. Use when Codex must compare public XNU or dyld source with shipping binaries, match KDK symbols and UUIDs,

• research-macos-security-control

  Research one macOS security control on an exact build, separating public contracts, private evidence, and hypotheses. Use for TCC, sandbox, entitlements, Gatekeeper, XProtect, Hardened Runtime, SIP, or system-policy changes.

• review-decompiler-output

  Review generated pseudocode or disassembly without presenting it as original source. Use when Codex must interpret, compare, annotate, validate, or summarize output from Cutter, Rizin, Malimite, Ghidra, Hopper, ILSpy, or another decompiler or disassembler; assess recovered types and control flow; tr

• script-hopper-analysis

  Automate repeatable Hopper analysis with its installed Python SDK or extension APIs. Use for deterministic queries, controlled annotations, structured exports, or a scriptable document operation with a checkpointed evidence trail.

• select-analysis-path

  Choose the smallest useful reverse-engineering workflow from an artifact's format, runtime, platform, available evidence, and research question. Use when Codex must decide between metadata inspection, static analysis, decompilation, disassembly, symbol or crash correlation, resource inspection, dyna

• triage-artifact

  Classify compiled artifacts before deeper reverse engineering. Use when Codex needs to inspect an unknown or mixed artifact set such as binaries, app bundles, frameworks, dylibs, DLLs, EXEs, Unity build outputs, IL2CPP metadata, archives, symbol files, crash logs, decompiler output, or disassembler

• use-cutter-and-rizin

  Use Cutter for interactive Rizin-backed binary analysis and Rizin CLI for repeatable inspection, queries, scripts, and exports. Use when Codex must open a binary or shellcode, choose a loader, image, architecture, base address, or analysis preset; navigate functions, graphs, strings, sections, impor

• use-ghidra

  Create Ghidra projects for compiled artifacts. Use for import, loader and analyzer choices, listings, functions, symbols, types, references, graphs, decompiler review, scripts, headless analysis, PyGhidra, comparisons, and archives.

• use-hopper

  Use Hopper on macOS for disassembly, graphs, pseudocode, Objective-C and Swift presentation, procedure and type edits, extensions, and debugging. Use for document setup, navigation, annotation, evidence, comparison, and discovery.

• use-malimite

  Use Malimite as a Ghidra-backed Apple app-package exploration front end for supported IPA files and copied ZIP or application-bundle inputs. Use when Codex must inspect bundle metadata, resources, provisioning data, classes, functions, strings, entry points, cross-references, reconstructed Swift or

Similar plugins