beyhan/reverse-skill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ops): blindspot cookbook R52-R81 (#77 batch 2)

Browse Source 
Add analysis-blindspot-cookbook for language/obfuscation/behavior/format/
agent-meta recipes. Detection-oriented; no bypass tutorials. Hook ADF §5,
re-agent-workflow, verify anchors. Not a third master workflow.
This commit is contained in:
yhc
2026-08-14 21:09:20 +08:00
parent dd7c50dc38
commit 038e69fd5b
4 changed files with 97 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/ops/analysis-blindspot-cookbook.md
+73
View File
@@ -0,0 +1,73 @@
# Analysis Blindspot Cookbook (Issue #77 batch 2)
> **SSoT**: blindspot recipes R52-R81. **Not** a third master workflow. Obey ADF R1-R51 + re-agent-workflow + A-T/U-AV first.
> Lab only. Detection+forensics; **no bypass tutorial** for kernel/integrity/injection weaponization.
## 0. Evidence IDs
E-rust-identified, E-golang-identified, E-cpp-rtti, E-objc-msg, E-dotnet-aot, E-string-custom-crypto, E-vmp-protected, E-ollvm-level, E-obfuscation-combo, E-integrity-check, E-proxy-dll, E-process-hollowing, E-apc-inject, E-atom-bombing, E-process-doppelganging, E-exception-chain, E-byovd-advanced, E-edr-callback, E-kernel-protect-tamper, E-uefi-bootkit, E-cloud-cred-theft, E-ole-analysis, E-pdf-malicious, E-wasm-reverse, E-custom-protocol, E-elf-linux, E-llm-hallucination, E-mcp-bootstrap, E-context-pollution, E-anchor-verify
## 1. P0 recipes
### R52 Rust
Trigger: _ZN mangling, core::/std::, panic/unwrap. Action: Rust sigs; panic edges; dynamic if names collapse. Evidence: E-rust-identified. Route: ida/radare2/re.
### R53 Golang
Trigger: runtime.*, go.string.*, newobject. Action: GoReSym-class symbol/type restore; distrust C-like decompile. Evidence: E-golang-identified.
### R56 .NET Native AOT
Trigger: native entry; no classic _CorExeMain/IL path. Action: do not force dnSpy IL workflow; native+AOT tools; managed IL stays dotnet-reverse. Evidence: E-dotnet-aot.
### R57 Custom string crypto
Trigger: high-entropy rdata without standard decoders. Action: entropy -> crypto constants -> dynamic decrypt dump. Evidence: E-string-custom-crypto.
### R58 VMP / virtualizer (tiered)
Trigger: VMP sections, vm_entry, extreme entropy. Action: Tier A qualitative+dynamic + E-vmp-protected; Tier B lab tracer under feasibility gate. MUST NOT claim full static undevirt without Evidence. Evidence: E-vmp-protected.
### R62 Proxy DLL
Trigger: exports overlap system DLL; loads real DLL; odd/missing forwarders. Action: diff exports; Path dropper->proxy->payload (R50). Evidence: E-proxy-dll.
### R78 LLM hallucination
Trigger: API/CFG claims without offset/tool output. Action: R41 grounded bar; else ungrounded. Evidence: E-llm-hallucination.
### R80 Context pollution
Trigger: contradicts confirmed Evidence/timeline; reused rejected hypothesis. Action: re-read timeline+Evidence (R2); drop polluted summary. Evidence: E-context-pollution.
## 2. P1 short rows
| ID | Action | Evidence |
|----|--------|----------|
| R54 C++ RTTI/EH | mark vtables, parse RTTI, xref virtuals | E-cpp-rtti |
| R55 ObjC/Swift | class-dump, objc libs (Darwin) | E-objc-msg |
| R59 OLLVM tier | P0/P1/P2; P2->dynamic; pointer A-T H | E-ollvm-level |
| R60 combo | unflatten then predicates | E-obfuscation-combo |
| R61 integrity | detect self-hash API; lab only | E-integrity-check |
| R63 hollowing | SUSPENDED+unmap+WPM+resume detect | E-process-hollowing |
| R64 APC | QueueUserAPC chain | E-apc-inject |
| R65 AtomBombing | GlobalAddAtom chain | E-atom-bombing |
| R66 doppelganging | TxF transaction chain | E-process-doppelganging |
| R67 SEH+VEH | both + faults | E-exception-chain |
| R68 BYOVD | signed sys + vuln hash DB + IOCTL detect | E-byovd-advanced |
| R69 EDR cb | notify routines | E-edr-callback |
| R70 PG/DSE | detect tamper intent only | E-kernel-protect-tamper |
| R71 UEFI | efi/ESP | E-uefi-bootkit |
| R72 cloud/IMDS | AWS_* / 169.254.169.254 | E-cloud-cred-theft |
| R73 OLE | oleid/olevba/XLM/DDE | E-ole-analysis |
| R74 PDF | /JS /OpenAction /Launch | E-pdf-malicious |
| R75 WASM | wasm2wat imports | E-wasm-reverse |
| R76 C2 proto | magic+handlers lab | E-custom-protocol |
| R77 ELF | LD_PRELOAD/ptrace/proc | E-elf-linux |
| R79 MCP boot | pin path only #76 | E-mcp-bootstrap |
| R81 anchors | P2 idea -> R41/case-review | E-anchor-verify |
## 3. P2 index
OLLVM detail A-T H; IAT/TLS workflow; BYOVD/VBA U-AV; pin #76; decision ADF R1-R51.
## 4. Safety
Authorized lab only. R61/R70/injection = detect+Evidence, no bypass tutorial. Failures still Evidence.
## 5. Checklist add-on
6 language R52-R56; 7 packer tier R58-R60; 8 injection/proxy R62-R67; 9 grounded R78/R80+R41.
skills/ops/analysis-decision-framework.md
+7 -1
View File
@@ -143,4 +143,10 @@ Effort band + A-T pointers -> `E-anti-adversarial` (**no** A-T table copy).
2. R4* validated bar
3. R1 low confidence -> dynamic
4. R43 deadlock -> replan under feasibility gate
5. R8/R23 no default malice/IOC
5. R8/R23 no default malice/IOC
---
## 5. Blindspot appendix (Issue #77 batch 2)
Language runtimes, heavy obfuscation, injection/detect chains, formats, and agent-meta blindspots: see [nalysis-blindspot-cookbook.md](analysis-blindspot-cookbook.md) (**R52-R81**). Decision rules R1-R51 in this file remain superior.
skills/reverse-engineering/references/re-agent-workflow.md
+3
View File
@@ -197,6 +197,9 @@
Before closing Synthesis, apply [nalysis-decision-framework.md](../../ops/analysis-decision-framework.md) **P0 checklist**: R41 grounded claims, R4* validated sufficiency, R1 confidence->dynamic, R2 hypothesis exit, R43 deadlock replan (under feasibility gate), R8/R23 no default malice/IOC. Multi-module -> R50; anti-analysis effort -> R51 + A-T cookbook.
Blindspots (Rust/Go/VMP/injection/OLE/PDF/agent-meta): [nalysis-blindspot-cookbook.md](../../ops/analysis-blindspot-cookbook.md) R52-R81 — detection-oriented; not a parallel master flow.
```text
□ Finding：算法/校验逻辑/可利用点 / 行为结论
skills/scripts/verify-routing-coherence.ps1
+14
View File
@@ -466,6 +466,20 @@ Assert-FileContains $wf77 "analysis-decision-framework" "re-agent-workflow hooks
$rules77 = Join-Path $PackageRoot "RULES.md"
Assert-FileContains $rules77 "analysis-decision-framework" "RULES.md hooks ADF"
# Issue 77 batch 2 blindspot cookbook anchors
$bsc = Join-Path $PackageRoot "skills\ops\analysis-blindspot-cookbook.md"
Assert-FileExists $bsc "analysis-blindspot-cookbook.md (issue77 R52-R81)"
Assert-FileContains $bsc "R52" "BSC R52 Rust"
Assert-FileContains $bsc "E-rust-identified" "BSC E-rust-identified"
Assert-FileContains $bsc "E-vmp-protected" "BSC E-vmp-protected"
Assert-FileContains $bsc "E-llm-hallucination" "BSC E-llm-hallucination"
Assert-FileContains $bsc "E-kernel-protect-tamper" "BSC kernel detect-only id"
Assert-FileContains $bsc "Not** a third master" "BSC not third master workflow"
Assert-FileContains $bsc "no bypass tutorial" "BSC no bypass tutorial"
$adf2 = Join-Path $PackageRoot "skills\ops\analysis-decision-framework.md"
Assert-FileContains $adf2 "analysis-blindspot-cookbook" "ADF links blindspot cookbook"
ALL ROUTING COHERENCE CHECKS PASSED' -ForegroundColor Green
'ALL ROUTING COHERENCE CHECKS PASSED' | Set-Content (Join-Path $ScratchDir 'verify.txt') -Encoding UTF8
exit 0