From 038e69fd5bfc6328e074d1edf1b9976e96935f07 Mon Sep 17 00:00:00 2001 From: yhc <1964366186@qq.com> Date: Fri, 14 Aug 2026 21:09:20 +0800 Subject: [PATCH] feat(ops): blindspot cookbook R52-R81 (#77 batch 2) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add analysis-blindspot-cookbook for language/obfuscation/behavior/format/ agent-meta recipes. Detection-oriented; no bypass tutorials. Hook ADF §5, re-agent-workflow, verify anchors. Not a third master workflow. --- skills/ops/analysis-blindspot-cookbook.md | 73 +++++++++++++++++++ skills/ops/analysis-decision-framework.md | 8 +- .../references/re-agent-workflow.md | 3 + skills/scripts/verify-routing-coherence.ps1 | 14 ++++ 4 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 skills/ops/analysis-blindspot-cookbook.md diff --git a/skills/ops/analysis-blindspot-cookbook.md b/skills/ops/analysis-blindspot-cookbook.md new file mode 100644 index 0000000..723988c --- /dev/null +++ b/skills/ops/analysis-blindspot-cookbook.md @@ -0,0 +1,73 @@ +# Analysis Blindspot Cookbook (Issue #77 batch 2) + +> **SSoT**: blindspot recipes R52-R81. **Not** a third master workflow. Obey ADF R1-R51 + re-agent-workflow + A-T/U-AV first. +> Lab only. Detection+forensics; **no bypass tutorial** for kernel/integrity/injection weaponization. + +## 0. Evidence IDs + +E-rust-identified, E-golang-identified, E-cpp-rtti, E-objc-msg, E-dotnet-aot, E-string-custom-crypto, E-vmp-protected, E-ollvm-level, E-obfuscation-combo, E-integrity-check, E-proxy-dll, E-process-hollowing, E-apc-inject, E-atom-bombing, E-process-doppelganging, E-exception-chain, E-byovd-advanced, E-edr-callback, E-kernel-protect-tamper, E-uefi-bootkit, E-cloud-cred-theft, E-ole-analysis, E-pdf-malicious, E-wasm-reverse, E-custom-protocol, E-elf-linux, E-llm-hallucination, E-mcp-bootstrap, E-context-pollution, E-anchor-verify + +## 1. P0 recipes + +### R52 Rust +Trigger: _ZN mangling, core::/std::, panic/unwrap. Action: Rust sigs; panic edges; dynamic if names collapse. Evidence: E-rust-identified. Route: ida/radare2/re. + +### R53 Golang +Trigger: runtime.*, go.string.*, newobject. Action: GoReSym-class symbol/type restore; distrust C-like decompile. Evidence: E-golang-identified. + +### R56 .NET Native AOT +Trigger: native entry; no classic _CorExeMain/IL path. Action: do not force dnSpy IL workflow; native+AOT tools; managed IL stays dotnet-reverse. Evidence: E-dotnet-aot. + +### R57 Custom string crypto +Trigger: high-entropy rdata without standard decoders. Action: entropy -> crypto constants -> dynamic decrypt dump. Evidence: E-string-custom-crypto. + +### R58 VMP / virtualizer (tiered) +Trigger: VMP sections, vm_entry, extreme entropy. Action: Tier A qualitative+dynamic + E-vmp-protected; Tier B lab tracer under feasibility gate. MUST NOT claim full static undevirt without Evidence. Evidence: E-vmp-protected. + +### R62 Proxy DLL +Trigger: exports overlap system DLL; loads real DLL; odd/missing forwarders. Action: diff exports; Path dropper->proxy->payload (R50). Evidence: E-proxy-dll. + +### R78 LLM hallucination +Trigger: API/CFG claims without offset/tool output. Action: R41 grounded bar; else ungrounded. Evidence: E-llm-hallucination. + +### R80 Context pollution +Trigger: contradicts confirmed Evidence/timeline; reused rejected hypothesis. Action: re-read timeline+Evidence (R2); drop polluted summary. Evidence: E-context-pollution. + +## 2. P1 short rows + +| ID | Action | Evidence | +|----|--------|----------| +| R54 C++ RTTI/EH | mark vtables, parse RTTI, xref virtuals | E-cpp-rtti | +| R55 ObjC/Swift | class-dump, objc libs (Darwin) | E-objc-msg | +| R59 OLLVM tier | P0/P1/P2; P2->dynamic; pointer A-T H | E-ollvm-level | +| R60 combo | unflatten then predicates | E-obfuscation-combo | +| R61 integrity | detect self-hash API; lab only | E-integrity-check | +| R63 hollowing | SUSPENDED+unmap+WPM+resume detect | E-process-hollowing | +| R64 APC | QueueUserAPC chain | E-apc-inject | +| R65 AtomBombing | GlobalAddAtom chain | E-atom-bombing | +| R66 doppelganging | TxF transaction chain | E-process-doppelganging | +| R67 SEH+VEH | both + faults | E-exception-chain | +| R68 BYOVD | signed sys + vuln hash DB + IOCTL detect | E-byovd-advanced | +| R69 EDR cb | notify routines | E-edr-callback | +| R70 PG/DSE | detect tamper intent only | E-kernel-protect-tamper | +| R71 UEFI | efi/ESP | E-uefi-bootkit | +| R72 cloud/IMDS | AWS_* / 169.254.169.254 | E-cloud-cred-theft | +| R73 OLE | oleid/olevba/XLM/DDE | E-ole-analysis | +| R74 PDF | /JS /OpenAction /Launch | E-pdf-malicious | +| R75 WASM | wasm2wat imports | E-wasm-reverse | +| R76 C2 proto | magic+handlers lab | E-custom-protocol | +| R77 ELF | LD_PRELOAD/ptrace/proc | E-elf-linux | +| R79 MCP boot | pin path only #76 | E-mcp-bootstrap | +| R81 anchors | P2 idea -> R41/case-review | E-anchor-verify | + +## 3. P2 index + +OLLVM detail A-T H; IAT/TLS workflow; BYOVD/VBA U-AV; pin #76; decision ADF R1-R51. + +## 4. Safety + +Authorized lab only. R61/R70/injection = detect+Evidence, no bypass tutorial. Failures still Evidence. + +## 5. Checklist add-on + +6 language R52-R56; 7 packer tier R58-R60; 8 injection/proxy R62-R67; 9 grounded R78/R80+R41. diff --git a/skills/ops/analysis-decision-framework.md b/skills/ops/analysis-decision-framework.md index cd78dd7..2dc0207 100644 --- a/skills/ops/analysis-decision-framework.md +++ b/skills/ops/analysis-decision-framework.md @@ -143,4 +143,10 @@ Effort band + A-T pointers -> `E-anti-adversarial` (**no** A-T table copy). 2. R4* validated bar 3. R1 low confidence -> dynamic 4. R43 deadlock -> replan under feasibility gate -5. R8/R23 no default malice/IOC \ No newline at end of file +5. R8/R23 no default malice/IOC + +--- + +## 5. Blindspot appendix (Issue #77 batch 2) + +Language runtimes, heavy obfuscation, injection/detect chains, formats, and agent-meta blindspots: see [nalysis-blindspot-cookbook.md](analysis-blindspot-cookbook.md) (**R52-R81**). Decision rules R1-R51 in this file remain superior. diff --git a/skills/reverse-engineering/references/re-agent-workflow.md b/skills/reverse-engineering/references/re-agent-workflow.md index 8588b32..0fc6031 100644 --- a/skills/reverse-engineering/references/re-agent-workflow.md +++ b/skills/reverse-engineering/references/re-agent-workflow.md @@ -197,6 +197,9 @@ Before closing Synthesis, apply [nalysis-decision-framework.md](../../ops/analysis-decision-framework.md) **P0 checklist**: R41 grounded claims, R4* validated sufficiency, R1 confidence->dynamic, R2 hypothesis exit, R43 deadlock replan (under feasibility gate), R8/R23 no default malice/IOC. Multi-module -> R50; anti-analysis effort -> R51 + A-T cookbook. +Blindspots (Rust/Go/VMP/injection/OLE/PDF/agent-meta): [nalysis-blindspot-cookbook.md](../../ops/analysis-blindspot-cookbook.md) R52-R81 — detection-oriented; not a parallel master flow. + + ```text □ Finding：算法/校验逻辑/可利用点 / 行为结论 diff --git a/skills/scripts/verify-routing-coherence.ps1 b/skills/scripts/verify-routing-coherence.ps1 index c75a53d..afbab74 100644 --- a/skills/scripts/verify-routing-coherence.ps1 +++ b/skills/scripts/verify-routing-coherence.ps1 @@ -466,6 +466,20 @@ Assert-FileContains $wf77 "analysis-decision-framework" "re-agent-workflow hooks $rules77 = Join-Path $PackageRoot "RULES.md" Assert-FileContains $rules77 "analysis-decision-framework" "RULES.md hooks ADF" + +# Issue 77 batch 2 blindspot cookbook anchors +$bsc = Join-Path $PackageRoot "skills\ops\analysis-blindspot-cookbook.md" +Assert-FileExists $bsc "analysis-blindspot-cookbook.md (issue77 R52-R81)" +Assert-FileContains $bsc "R52" "BSC R52 Rust" +Assert-FileContains $bsc "E-rust-identified" "BSC E-rust-identified" +Assert-FileContains $bsc "E-vmp-protected" "BSC E-vmp-protected" +Assert-FileContains $bsc "E-llm-hallucination" "BSC E-llm-hallucination" +Assert-FileContains $bsc "E-kernel-protect-tamper" "BSC kernel detect-only id" +Assert-FileContains $bsc "Not** a third master" "BSC not third master workflow" +Assert-FileContains $bsc "no bypass tutorial" "BSC no bypass tutorial" +$adf2 = Join-Path $PackageRoot "skills\ops\analysis-decision-framework.md" +Assert-FileContains $adf2 "analysis-blindspot-cookbook" "ADF links blindspot cookbook" + ALL ROUTING COHERENCE CHECKS PASSED' -ForegroundColor Green 'ALL ROUTING COHERENCE CHECKS PASSED' | Set-Content (Join-Path $ScratchDir 'verify.txt') -Encoding UTF8 exit 0