ghidra-static SKILL.md skillA
ghidra-static from cristallin2006/ghidra-skill-for-dsh is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cristallin2006/ghidra-skill-for-dsh/ghidra-static@git:20261008.272fbf0Pins git:20261008.272fbf0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cristallin2006/ghidra-skill-for-dsh
- Path
ghidra-static/SKILL.md- Versions recorded
- 6
- Latest version
- git:20261008.272fbf0, committed Oct 8, 2026
- First version recorded
- Sep 22, 2026
- Size
- 8,110 bytes
- Repository stars
- 11
- License
- MIT
对已建立基本认知的二进制做静态深挖（static analysis / reverse engineering）：反编译（decompile）、xref 追数据流、语义标注、patch 二进制、导出交付。触发：反编译某函数、提取算法/flag 逻辑、打补丁、批量导出伪码、CTF 逆向题主体攻坚。前提是已知样本类型——未知样本先走 re-triage。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Ghidra Static（场景 2：深挖它） 前置：未知样本先分诊 → `~/.dsh/skills/re-triage`／后继：交付（报告+产物）；具体命令 → `~/.dsh/skills/ghidra-core` > **铁律 5（确认即标注）**：搞清一个函数立即改成语义名 + 写 plate comment（地址/作用/依据）。结论必须带地址和可复现命令。（全文见 ghidra-core §1） > > **证据台账**：本 skill 全程经 ghidra-core `scripts/ledger.py` 落账——`query` 先查后析、`observe` 观察入账（同区第二次回访被脚本强制要求 `--delta`，答不出 = 断路器）、`conclude` 权威结论写入即锁定、`stuck` 卡点必记。机制见 ghidra-core `references/evidence-ledger.md`。 > > **铁律 8（读数纪律）**：关键常量用 ghidra-core `scripts/read_views.py` 三视图取唯一权威读数并 `conclude` 锁定；反编译器的 hex/字符串渲染只是视图（会吞前导 0），引用前先 `--expect-hex` 对照；观测矛盾先怀疑读数，不怀疑程序；求逆前先正向跑通流水线。（全文见 ghidra-core §1） > > **铁律 9/10（缓冲区归属 + 验证独立性）**：imm-store 拼栈上常量必须按 disp 区间归属变量并 `--expect-len` 核对声明长度；求逆前 MUST 过 ghidra-core `scripts/crypto_sanity.py check`，求逆后 MUST 过 `check-result`，exit 2 = 读数可疑禁止求逆。`conclude` 强制 `--source`/`--independent`——patch 态/自写 harness/单一来源的结论标 ⚠UNVERIFIED，禁止原样交付；宣布「不可满足」前必须先正向复现已知输出。（全文见 ghidra-core §1，patch 态细则见 re-dynamic §4） ## 路径约定 ```bash SK="$HOME/.dsh/skills/ghidra-core/scripts" # 唯一代码家 # Windows: RPC="$HOME/Desktop/src/ghidra-bridge/ghidra-rpc-venv/Scripts" # ghidra-rpc CLI # WSL/Linux: RPC="$HOME/ghidra-rpc-venv/bin" ``` …
Read the whole file at its exact version.
How to install
mdr add cristallin2006/ghidra-skill-for-dsh/ghidra-static@sha256:2794c760e7b4a2bdThe line at the top of this page pins the label git:20261008.272fbf0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_3m2owqknzycq5sik)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 6 versions of this file, between Sep 22, 2026 and Oct 8, 2026, about one every 3 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261008.272fbf0 latest | 2026-10-08 | 272fbf0 | 8,110 B | A | view · diff |
| git:20261003.f9fa17b | 2026-10-03 | f9fa17b | 7,467 B | A | view · diff |
| git:20260926.11ae325 | 2026-09-26 | 11ae325 | 7,401 B | A | view · diff |
| git:20260925.4bbd849 | 2026-09-25 | 4bbd849 | 7,349 B | A | view · diff |
| git:20260922.0fbfbd4 | 2026-09-22 | 0fbfbd4 | 6,166 B | A | view · diff |
| git:20260922.6233b3e | 2026-09-22 | 6233b3e | 5,729 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8110 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cristallin2006/ghidra-skill-for-dsh · 11 stars · license MIT · pushed 2026-10-11 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_3m2owqknzycq5sik GET https://markdownregistry.com/api/v1/resolve?ref=cristallin2006/ghidra-skill-for-dsh/ghidra-static GET https://markdownregistry.com/api/v1/blob/2794c760e7b4a2bd5ff9d336bd7c447fc280e4b2914c055f12ca1efbd0adb305
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.