技能 binary-re-tool-setup
📦
binary-re-tool-setup
内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
配置二进制逆向工程工具
当必要工具缺失或配置错误时，逆向工程工作会停滞。此技能指导 radare2、Ghidra、GDB、QEMU、Frida 及相关工具链的设置。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "binary-re-tool-setup" from https://skillstore.io/skills/2389-research-binary-re-tool-setup.md and its manifest at https://skillstore.io/api/skills/2389-research-binary-re-tool-setup/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“binary-re-tool-setup”。 我需要 Ubuntu 上的 ARM 二进制分析工具。
预期结果:
- 一份针对 radare2、qemu-user、gdb-multiarch、binutils 和 ARM sysroots 的优先级清单。
- 清晰区分包安装、验证和可选工具。
- 关于需要管理员批准的命令的说明。
正在使用“binary-re-tool-setup”。 GDB 无法运行我的 ARM 二进制文件。
预期结果:
- 针对架构不匹配、缺少 loader 文件和 sysroot 配置的诊断路径。
- 针对 QEMU gdbserver 和 gdb-multiarch 连接设置的建议检查项。
- 在更改 linker 路径或系统文件之前发出警告。
正在使用“binary-re-tool-setup”。 我希望 Ghidra 和 radare2 反编译准备就绪。
预期结果:
- 针对 radare2、r2ghidra 和 Ghidra headless 支持的设置指导。
- 验证插件可用性和 headless analyzer 访问的步骤。
- 针对大型二进制文件的内存和超时说明。
安全审计
严重v7 • 2026/7/4 打开版本化报告
The skill is legitimate reverse engineering setup guidance, but it includes high-risk operational instructions. Confirmed risks include privileged Docker, sudo package and system changes, curl-to-shell installation, persistent startup-file edits, and unpinned third-party source installs. Most generic backtick findings are Markdown formatting false positives.
1
已扫描文件
486
分析行数
24
复核项
0
已忽略误报
已确认安全问题 (4)
严重
Docker privileged mode
docker run --rm --privileged --platform linux/arm64 \
The command runs Docker with --privileged to register binfmt handlers. Privileged containers can access broad host capabilities and are unsafe for automatic execution.
严重
Docker privileged mode
| `exec format error` in Docker | binfmt not registered | `docker run --privileged tonistiigi/binfmt
The troubleshooting table recommends docker run --privileged for binfmt registration. This grants elevated container privileges and can affect the host kernel interface.
严重
Docker privileged mode
docker run --rm --privileged --platform linux/arm64 \
The command again uses docker run --privileged for binfmt setup. It is a confirmed hard-blocking pattern because it expands container access to the host.
高
Unverified Remote Installer and Source Builds
The skill recommends executing a remote GEF installer and installing source-built YARA without pinning, signatures, or checksums.
The lines show curl-to-shell, an unpinned git clone, and sudo make install. The supply-chain risk is clear from the setup flow.
能力复核项 (24)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Shell command substitution
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
This executes a remote GEF installer through shell command substitution. Running network-fetched shell as code can compromise the host if the source or transport is attacked.
高
Template literal with command substitution
```bash
The flagged block contains the remote shell installer on line 230. The surrounding setup context makes this a real command execution risk, not a harmless template literal.
高
PowerShell invocation
# PowerShell (Administrator) - Install WSL2 with Ubuntu
The block directs an Administrator PowerShell setup flow for WSL2. It is legitimate setup guidance, but it changes system state and is unsafe for automatic execution.
高
sudo privilege escalation
sudo apt update
The command runs apt update with sudo, requiring administrator privileges. This is legitimate package setup, but it modifies system package state if automated.
高
sudo privilege escalation
sudo apt install -y \
The command installs multiple packages with sudo. Administrator package installation is a real host modification risk and requires explicit user approval.
高
sudo privilege escalation
sudo apt install -y \
The command installs ARM sysroot packages with sudo. It is legitimate setup, but it changes system packages with elevated privileges.
高
sudo privilege escalation
sudo apt install -y \
The command installs utility packages with sudo. Elevated package changes can affect the host and should not be run automatically by a skill.
高
sudo privilege escalation
sudo apt update && sudo apt install -y \
The command combines sudo apt update and package installation. This makes broad privileged system changes during WSL setup.
高
sudo privilege escalation
sudo tee -a /etc/wsl.conf > /dev/null << 'EOF'
The command appends configuration to /etc/wsl.conf with sudo. It persistently changes WSL mount behavior and requires administrator review.
高
sudo privilege escalation
sudo pacman -S radare2 qemu-user gdb
The command installs packages through pacman with sudo. It is expected setup, but privileged package installation remains a real host modification risk.
高
sudo privilege escalation
sudo apt install yara
The command installs YARA with sudo. Even trusted package-manager installs require elevated privileges and explicit user approval.
高
sudo privilege escalation
make && sudo make install
The command runs sudo make install after building source. Installing unpinned build output as root can overwrite system files or introduce malicious binaries.
高
Hardcoded URL
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
The hardcoded URL is used in a curl-to-shell installer. This is remote code execution from a third-party endpoint, not just a documentation link.
高
Hidden file in home directory
echo 'export PATH=$PATH:/opt/ghidra/support' >> ~/.bashrc
The command appends to ~/.bashrc, creating persistent shell startup behavior. Startup-file changes should require explicit consent and rollback guidance.
高
Hidden file in home directory
git clone https://github.com/hugsy/gef-extras.git ~/.gef-extras
The command creates a hidden ~/.gef-extras directory containing third-party code. Its later use from GDB startup configuration makes the persistence risk real.
高
Hidden file in home directory
echo 'source ~/.gef-extras/scripts/checksec.py' >> ~/.gdbinit
The command appends a source directive to ~/.gdbinit. This makes GDB automatically load code from a cloned repository in future sessions.
高
Hidden file in home directory
Add to `~/.bashrc` or `~/.zshrc`:
The section instructs users to add environment changes to ~/.bashrc or ~/.zshrc. Persistent startup-file modification is a real configuration risk.
高
Hidden file access
echo 'export PATH=$PATH:/opt/ghidra/support' >> ~/.bashrc
The command writes to ~/.bashrc and changes future shell startup behavior. This is a persistent home-directory configuration change.
高
Hidden file access
echo 'source ~/.gef-extras/scripts/checksec.py' >> ~/.gdbinit
The command writes to ~/.gdbinit so GDB sources cloned code automatically. That is persistent execution behavior in a hidden configuration file.
高
Hidden file access
Add to `~/.bashrc` or `~/.zshrc`:
The line introduces changes to ~/.bashrc or ~/.zshrc. These hidden startup files affect future shells and should not be modified automatically.
高
Symlink creation
| `ld-linux.so.3 not found` | Linker path mismatch | `ln -sf /lib/ld-linux-armhf.so.3 /lib/ld-linux.
The troubleshooting fix suggests force-creating a linker symlink under /lib. If run on a host or privileged container, it can alter dynamic loader behavior.
中
Hardcoded URL
git clone https://github.com/hugsy/gef-extras.git ~/.gef-extras
The command clones third-party GEF extras into the home directory. It introduces external code that is later sourced by GDB configuration without pinning.
中
Hardcoded URL
git clone https://github.com/VirusTotal/yara.git
The command clones YARA source from GitHub before a sudo install step. Without pinning or checksum verification, this creates supply-chain risk.
中
Hidden file access
git clone https://github.com/hugsy/gef-extras.git ~/.gef-extras
The command creates and populates ~/.gef-extras with external code. Hidden home-directory code is later referenced by debugger startup configuration.
风险因素
⚙️ 外部命令 (87)
SKILL.md:37-61 SKILL.md:61-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-96 SKILL.md:96-99 SKILL.md:99 SKILL.md:100-105 SKILL.md:105-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-147 SKILL.md:147-149 SKILL.md:149 SKILL.md:150-156 SKILL.md:156-160 SKILL.md:160-163 SKILL.md:163-169 SKILL.md:169-184 SKILL.md:184-190 SKILL.md:190 SKILL.md:192-195 SKILL.md:195-205 SKILL.md:205-209 SKILL.md:209-218 SKILL.md:218-221 SKILL.md:221-222 SKILL.md:222-224 SKILL.md:224-228 SKILL.md:228-238 SKILL.md:238-242 SKILL.md:242-251 SKILL.md:251-255 SKILL.md:255-260 SKILL.md:260-264 SKILL.md:264-274 SKILL.md:274-278 SKILL.md:278-291 SKILL.md:291-297 SKILL.md:297-299 SKILL.md:299-303 SKILL.md:303-307 SKILL.md:307-315 SKILL.md:315-319 SKILL.md:319-323 SKILL.md:323-329 SKILL.md:329-378 SKILL.md:378-386 SKILL.md:386 SKILL.md:387 SKILL.md:388 SKILL.md:389 SKILL.md:390 SKILL.md:391 SKILL.md:392-396 SKILL.md:396-402 SKILL.md:402-406 SKILL.md:406-412 SKILL.md:412-416 SKILL.md:416-423 SKILL.md:423-427 SKILL.md:427-431 SKILL.md:431-435 SKILL.md:435-439 SKILL.md:439-443 SKILL.md:443-449 SKILL.md:449-453 SKILL.md:453-459 SKILL.md:459-473 SKILL.md:473 SKILL.md:475-485 SKILL.md:230 SKILL.md:228-238 SKILL.md:67 SKILL.md:68 SKILL.md:95 SKILL.md:100 SKILL.md:330 SKILL.md:39 SKILL.md:40 SKILL.md:49 SKILL.md:56 SKILL.md:78 SKILL.md:89 SKILL.md:161 SKILL.md:280 SKILL.md:287
🌐 网络访问 (5)
检测到的模式
Docker privileged mode×3
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/2389-research-binary-re-tool-setup?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/2389-research-binary-re-tool-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-binary-re-tool-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/2389-research-binary-re-tool-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
2389-research. (2026). binary-re-tool-setup security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7BibTeX 引用
@techreport{2389-research-2389-research-binary-re-tool-setup-2026,
author = {2389-research},
title = {binary-re-tool-setup security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "binary-re-tool-setup security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "2389-research"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7"
identifiers:
- type: other
value: "skillstore:2389-research-binary-re-tool-setup:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
71
社区
83
规范符合性
你能构建什么
准备新的分析工作站
在 Linux、WSL2 或 macOS 上开始逆向工程工作之前，安装并验证核心工具。
修复损坏的工具链
诊断缺失命令、插件失败、QEMU 错误和库路径问题。
设置跨架构测试
为 ARM 和其他非原生二进制文件配置 QEMU、sysroots 和调试器。
试试这些提示
检查我的工具链
检查此机器上缺少哪些必需的二进制逆向工程工具。运行安装命令前先询问。
安装核心工具
帮助我准备一个包含 radare2、QEMU user mode、GDB multiarch 和 binutils 的 Linux 二进制逆向工程环境。
修复跨架构执行
我的 ARM 二进制文件无法在 QEMU 下运行。检查架构、sysroot 路径、loader 路径和调试器设置。
设计安全设置计划
为 Ghidra、GEF、Frida、Angr 和 YARA 创建一个安全、可审核的设置计划。将特权步骤与普通用户步骤分开。
最佳实践
- 执行前审核每一条特权命令。
- 尽可能对第三方工具使用固定版本和校验和。
- 在隔离容器或虚拟机内运行有风险的动态分析。
避免
- 不要在未检查并固定版本的情况下执行远程安装脚本。
- 不要在不受信任的主机上运行特权 Docker 容器。
- 未经用户批准，不要追加内容到 shell 启动文件。
常见问题
此技能会直接分析二进制文件吗？
不是。它帮助配置用于二进制分析和调试的工具。
它可以自动安装工具吗？
它提供安装指导，但特权命令应要求明确的用户批准。
涵盖哪些平台？
该技能涵盖 Ubuntu、Debian、WSL2、macOS、基于 Docker 的工作流和 Arch Linux。
它支持跨架构分析吗？
是的。它涵盖 QEMU user mode、sysroots、gdb-multiarch 及相关故障排查。
Ghidra 是必需的吗？
不是。推荐使用 Ghidra 进行反编译，而 radare2 和核心命令行工具是必需的。
为什么安全风险很高？
该指南包含 sudo 命令、特权 Docker、远程安装程序和持久性启动文件更改。
开发者详情
许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
14dc8f201a64f8d30fd131d7f036cd5e788be523
维护新鲜度
2026/7/18
使用量
9 次下载 · 280 次浏览
文件结构
📄 SKILL.md