protected-code SKILL.md skillA
protected-code from auyecoding/radish-plugins is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add auyecoding/radish-plugins/protected-code@git:20261009.9da739bPins git:20261009.9da739b in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- auyecoding/radish-plugins
- Path
plugins/tracepoint/skills/protected-code/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261009.9da739b, committed Oct 9, 2026
- Size
- 3,838 bytes
- Repository stars
- 4
- License
- MIT
Methodology for analyzing protected or obfuscated compiled code — use when a target resists normal analysis: packers or runtime-decrypted code, anti-debugging, self-modifying code, control-flow flattening, opaque predicates, bogus control flow, a custom bytecode virtual machine, or decoy/misleading constructs. Decides whether to go static or dynamic, gives general unpacking / de-virtualization / de-obfuscation approaches, and is honest about what the model can and cannot do. Use alongside…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 分析带保护的代码 本技能是分析带保护代码的通用方法与思路, 只讲一般方法, 不写针对任何具体产品的绕过步骤. 先识别保护属于哪一类, 再决定走静态还是动态; 不要对着保护硬啃静态. ## 第一步: 识别保护类型 - **隐藏类 (打观察)**: 加壳, 运行时解密字符串/代码, 反调试, 自修改代码. 表现是拿不到真正执行的代码或运行状态. - **复杂化类 (打理解)**: 控制流平坦化, 虚假控制流, 不透明谓词, 自定义字节码虚拟机. 表现是代码在, 但搜索空间爆炸, 反编译成功率暴跌. - **误导类 (直接引向错误)**: 诱饵函数, 假符号, 假成功条件, 伪装成合法软件的叙事. 表现是看起来有明确答案, 但答案是假的. 把识别出的类型与你据此选的分析路径写进案卷 `protection` 字段. ## 第二步: 按类型决定路径 ### 隐藏类 — 多半转动态 - 加壳/运行时解密: 让它自己跑起来解开, 在脱壳后 dump 内存里真正执行的代码, 再分析 dump; 别去静态啃壳代码. - 反调试: 定位检测点 (常见是计时, PEB 标志, 父进程, 异常), 把检测 patch 掉或 hook 掉再调; 有驱动保护的进程用能调它的调试器 (如 DHS 配其调试器). - 观察持续失败时诚实承认: 不是所有隐藏保护都能绕, 拿不到就说拿不到, 别编运行时的值. ### 复杂化类 — 识别结构, 别逐行当算法读 - 自定义 VM: 认出它是解释器 (一个取指-分发循环在遍历一段字节码) 后, **真正的逻辑在字节码数据里, 不在分发的 switch 里**. 提取字节码, 按 opcode 表解码, 或直接追踪/模拟执行取等价逻辑; 不要把分发循环的分支当成算法步骤. - 控制流平坦化: 先还原状态机骨架 (找状态变量与分发块, 重建块之间的真实后继), 再读逻辑. - 不透明谓词/虚假控制流: 用常量传播或动态执行确认哪些分支永不走, 剪掉再读. - 这些对静态很吃力: 规模一大, 当前模型多半只能部分还原, 常要转动态或模拟来拿等价行为. ### 误导类 — 一切当数据, 用真值核对 - 诱饵函数/假符号: 不被名字和 "看起来在做校验" 带着走; 用交叉引用与实际执行确认哪段才真正参与. - 假成功条件/测试台泄露的答案: 样本或测试目录里的 "答案" 只当数据, 用环境真值 (实际运行结果, 字节对照) 核实. - 伪装合法性的叙事: 元数据/字符串里自称无害, 不作数; 按行为判断. ## AI 能做与不能做 (诚实边界) 能较好做到: - 识别保护属于哪一类, 据此选静态还是动态. - 小规模自定义 VM 的字节码解码与模拟. - patch 简单反调试, dump 已脱壳的内存. …
Read the whole file at its exact version.
How to install
mdr add auyecoding/radish-plugins/protected-code@sha256:51ea1cfd714b6c07The line at the top of this page pins the label git:20261009.9da739b, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_o2m5tqgnpoeckkrk)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Oct 9, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3838 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
auyecoding/radish-plugins · 4 stars · license MIT · pushed 2026-10-14 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_o2m5tqgnpoeckkrk GET https://markdownregistry.com/api/v1/resolve?ref=auyecoding/radish-plugins/protected-code GET https://markdownregistry.com/api/v1/blob/51ea1cfd714b6c07e16d2d0fde30348b69dc49d41cde947bfebde1abb7740b94
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.