技能 binary-re-tool-setup
📦
binary-re-tool-setup
內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
設定二進位逆向工程工具
當必要工具缺失或設定不當時，逆向工程工作就會停滯。此技能會指引 radare2、Ghidra、GDB、QEMU、Frida 及相關工具鏈的設定。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "binary-re-tool-setup" from https://skillstore.io/skills/2389-research-binary-re-tool-setup.md and its manifest at https://skillstore.io/api/skills/2389-research-binary-re-tool-setup/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「binary-re-tool-setup」。 我需要 Ubuntu 上的 ARM 二進位分析工具。
預期結果:
- 一份針對 radare2、qemu-user、gdb-multiarch、binutils 和 ARM sysroots 的優先順序檢查清單。
- 清楚區分套件安裝、驗證和選用工具。
- 關於需要管理員核准之命令的注意事項。
正在使用「binary-re-tool-setup」。 GDB 無法執行我的 ARM 二進位檔。
預期結果:
- 針對架構不符、缺少 loader 檔案和 sysroot 設定的診斷路徑。
- 針對 QEMU gdbserver 和 gdb-multiarch 連線設定的建議檢查項目。
- 變更 linker 路徑或系統檔案前的警告。
正在使用「binary-re-tool-setup」。 我想準備好 Ghidra 和 radare2 反編譯。
預期結果:
- radare2、r2ghidra 和 Ghidra headless 支援的設定指引。
- 外掛程式可用性和 headless analyzer 存取的驗證步驟。
- 大型二進位檔的記憶體與逾時注意事項。
安全審計
嚴重v7 • 2026/7/4 開啟版本化報告
The skill is legitimate reverse engineering setup guidance, but it includes high-risk operational instructions. Confirmed risks include privileged Docker, sudo package and system changes, curl-to-shell installation, persistent startup-file edits, and unpinned third-party source installs. Most generic backtick findings are Markdown formatting false positives.
1
已掃描檔案
486
分析行數
24
複核項目
0
已忽略的誤報
已確認的安全問題 (4)
嚴重
Docker privileged mode
docker run --rm --privileged --platform linux/arm64 \
The command runs Docker with --privileged to register binfmt handlers. Privileged containers can access broad host capabilities and are unsafe for automatic execution.
嚴重
Docker privileged mode
| `exec format error` in Docker | binfmt not registered | `docker run --privileged tonistiigi/binfmt
The troubleshooting table recommends docker run --privileged for binfmt registration. This grants elevated container privileges and can affect the host kernel interface.
嚴重
Docker privileged mode
docker run --rm --privileged --platform linux/arm64 \
The command again uses docker run --privileged for binfmt setup. It is a confirmed hard-blocking pattern because it expands container access to the host.
高
Unverified Remote Installer and Source Builds
The skill recommends executing a remote GEF installer and installing source-built YARA without pinning, signatures, or checksums.
The lines show curl-to-shell, an unpinned git clone, and sudo make install. The supply-chain risk is clear from the setup flow.
能力複核項目 (24)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Shell command substitution
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
This executes a remote GEF installer through shell command substitution. Running network-fetched shell as code can compromise the host if the source or transport is attacked.
高
Template literal with command substitution
```bash
The flagged block contains the remote shell installer on line 230. The surrounding setup context makes this a real command execution risk, not a harmless template literal.
高
PowerShell invocation
# PowerShell (Administrator) - Install WSL2 with Ubuntu
The block directs an Administrator PowerShell setup flow for WSL2. It is legitimate setup guidance, but it changes system state and is unsafe for automatic execution.
高
sudo privilege escalation
sudo apt update
The command runs apt update with sudo, requiring administrator privileges. This is legitimate package setup, but it modifies system package state if automated.
高
sudo privilege escalation
sudo apt install -y \
The command installs multiple packages with sudo. Administrator package installation is a real host modification risk and requires explicit user approval.
高
sudo privilege escalation
sudo apt install -y \
The command installs ARM sysroot packages with sudo. It is legitimate setup, but it changes system packages with elevated privileges.
高
sudo privilege escalation
sudo apt install -y \
The command installs utility packages with sudo. Elevated package changes can affect the host and should not be run automatically by a skill.
高
sudo privilege escalation
sudo apt update && sudo apt install -y \
The command combines sudo apt update and package installation. This makes broad privileged system changes during WSL setup.
高
sudo privilege escalation
sudo tee -a /etc/wsl.conf > /dev/null << 'EOF'
The command appends configuration to /etc/wsl.conf with sudo. It persistently changes WSL mount behavior and requires administrator review.
高
sudo privilege escalation
sudo pacman -S radare2 qemu-user gdb
The command installs packages through pacman with sudo. It is expected setup, but privileged package installation remains a real host modification risk.
高
sudo privilege escalation
sudo apt install yara
The command installs YARA with sudo. Even trusted package-manager installs require elevated privileges and explicit user approval.
高
sudo privilege escalation
make && sudo make install
The command runs sudo make install after building source. Installing unpinned build output as root can overwrite system files or introduce malicious binaries.
高
Hardcoded URL
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
The hardcoded URL is used in a curl-to-shell installer. This is remote code execution from a third-party endpoint, not just a documentation link.
高
Hidden file in home directory
echo 'export PATH=$PATH:/opt/ghidra/support' >> ~/.bashrc
The command appends to ~/.bashrc, creating persistent shell startup behavior. Startup-file changes should require explicit consent and rollback guidance.
高
Hidden file in home directory
git clone https://github.com/hugsy/gef-extras.git ~/.gef-extras
The command creates a hidden ~/.gef-extras directory containing third-party code. Its later use from GDB startup configuration makes the persistence risk real.
高
Hidden file in home directory
echo 'source ~/.gef-extras/scripts/checksec.py' >> ~/.gdbinit
The command appends a source directive to ~/.gdbinit. This makes GDB automatically load code from a cloned repository in future sessions.
高
Hidden file in home directory
Add to `~/.bashrc` or `~/.zshrc`:
The section instructs users to add environment changes to ~/.bashrc or ~/.zshrc. Persistent startup-file modification is a real configuration risk.
高
Hidden file access
echo 'export PATH=$PATH:/opt/ghidra/support' >> ~/.bashrc
The command writes to ~/.bashrc and changes future shell startup behavior. This is a persistent home-directory configuration change.
高
Hidden file access
echo 'source ~/.gef-extras/scripts/checksec.py' >> ~/.gdbinit
The command writes to ~/.gdbinit so GDB sources cloned code automatically. That is persistent execution behavior in a hidden configuration file.
高
Hidden file access
Add to `~/.bashrc` or `~/.zshrc`:
The line introduces changes to ~/.bashrc or ~/.zshrc. These hidden startup files affect future shells and should not be modified automatically.
高
Symlink creation
| `ld-linux.so.3 not found` | Linker path mismatch | `ln -sf /lib/ld-linux-armhf.so.3 /lib/ld-linux.
The troubleshooting fix suggests force-creating a linker symlink under /lib. If run on a host or privileged container, it can alter dynamic loader behavior.
中
Hardcoded URL
git clone https://github.com/hugsy/gef-extras.git ~/.gef-extras
The command clones third-party GEF extras into the home directory. It introduces external code that is later sourced by GDB configuration without pinning.
中
Hardcoded URL
git clone https://github.com/VirusTotal/yara.git
The command clones YARA source from GitHub before a sudo install step. Without pinning or checksum verification, this creates supply-chain risk.
中
Hidden file access
git clone https://github.com/hugsy/gef-extras.git ~/.gef-extras
The command creates and populates ~/.gef-extras with external code. Hidden home-directory code is later referenced by debugger startup configuration.
風險因素
⚙️ 外部命令 (87)
SKILL.md:37-61 SKILL.md:61-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-96 SKILL.md:96-99 SKILL.md:99 SKILL.md:100-105 SKILL.md:105-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-147 SKILL.md:147-149 SKILL.md:149 SKILL.md:150-156 SKILL.md:156-160 SKILL.md:160-163 SKILL.md:163-169 SKILL.md:169-184 SKILL.md:184-190 SKILL.md:190 SKILL.md:192-195 SKILL.md:195-205 SKILL.md:205-209 SKILL.md:209-218 SKILL.md:218-221 SKILL.md:221-222 SKILL.md:222-224 SKILL.md:224-228 SKILL.md:228-238 SKILL.md:238-242 SKILL.md:242-251 SKILL.md:251-255 SKILL.md:255-260 SKILL.md:260-264 SKILL.md:264-274 SKILL.md:274-278 SKILL.md:278-291 SKILL.md:291-297 SKILL.md:297-299 SKILL.md:299-303 SKILL.md:303-307 SKILL.md:307-315 SKILL.md:315-319 SKILL.md:319-323 SKILL.md:323-329 SKILL.md:329-378 SKILL.md:378-386 SKILL.md:386 SKILL.md:387 SKILL.md:388 SKILL.md:389 SKILL.md:390 SKILL.md:391 SKILL.md:392-396 SKILL.md:396-402 SKILL.md:402-406 SKILL.md:406-412 SKILL.md:412-416 SKILL.md:416-423 SKILL.md:423-427 SKILL.md:427-431 SKILL.md:431-435 SKILL.md:435-439 SKILL.md:439-443 SKILL.md:443-449 SKILL.md:449-453 SKILL.md:453-459 SKILL.md:459-473 SKILL.md:473 SKILL.md:475-485 SKILL.md:230 SKILL.md:228-238 SKILL.md:67 SKILL.md:68 SKILL.md:95 SKILL.md:100 SKILL.md:330 SKILL.md:39 SKILL.md:40 SKILL.md:49 SKILL.md:56 SKILL.md:78 SKILL.md:89 SKILL.md:161 SKILL.md:280 SKILL.md:287
🌐 網路存取 (5)
偵測到的模式
Docker privileged mode×3
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/2389-research-binary-re-tool-setup?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/2389-research-binary-re-tool-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-binary-re-tool-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/2389-research-binary-re-tool-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
2389-research. (2026). binary-re-tool-setup security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7BibTeX 引用
@techreport{2389-research-2389-research-binary-re-tool-setup-2026,
author = {2389-research},
title = {binary-re-tool-setup security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "binary-re-tool-setup security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "2389-research"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/2389-research-binary-re-tool-setup/audits/7"
identifiers:
- type: other
value: "skillstore:2389-research-binary-re-tool-setup:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
71
社群
83
規範符合度
你可以打造什麼
準備新的分析工作站
在 Linux、WSL2 或 macOS 上開始逆向工程工作前，安裝並驗證核心工具。
修復損壞的工具鏈
診斷缺失的命令、外掛程式失敗、QEMU 錯誤和程式庫路徑問題。
設定跨架構測試
為 ARM 和其他非原生二進位檔設定 QEMU、sysroots 和除錯器。
試試這些提示
檢查我的工具鏈
檢查這台機器缺少哪些必要的二進位逆向工程工具。執行安裝命令前請先詢問。
安裝核心工具
協助我準備一個包含 radare2、QEMU user mode、GDB multiarch 和 binutils 的 Linux 二進位逆向工程環境。
修復跨架構執行
我的 ARM 二進位檔無法在 QEMU 下執行。請檢查架構、sysroot 路徑、loader 路徑和除錯器設定。
設計安全設定計畫
為 Ghidra、GEF、Frida、Angr 和 YARA 建立一個安全且可審閱的設定計畫。將需要權限的步驟與一般使用者步驟分開。
最佳實務
- 執行前審閱每一個需要權限的命令。
- 可行時，對第三方工具使用固定版本和 checksums。
- 在隔離容器或虛擬機器內執行有風險的動態分析。
避免
- 不要在未檢查並固定版本的情況下執行遠端安裝程式指令碼。
- 不要在不受信任的主機上執行具權限的 Docker containers。
- 未經使用者核准，不要附加內容到 shell startup files。
常見問題
此技能會直接分析二進位檔嗎？
不會。它協助設定用於二進位分析和除錯的工具。
它可以自動安裝工具嗎？
它提供安裝指引，但需要權限的命令應要求明確的使用者核准。
涵蓋哪些平台？
此技能涵蓋 Ubuntu、Debian、WSL2、macOS、Docker-based workflows 和 Arch Linux。
它支援跨架構分析嗎？
可以。它涵蓋 QEMU user mode、sysroots、gdb-multiarch 和相關疑難排解。
Ghidra 是必要的嗎？
不需要。建議使用 Ghidra 進行反編譯，而 radare2 和核心 command-line tools 則是必要的。
為什麼安全風險很高？
此指南包含 sudo commands、privileged Docker、remote installers 和 persistent startup file changes。
開發者詳細資訊
授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
14dc8f201a64f8d30fd131d7f036cd5e788be523
維護新鮮度
2026/7/18
使用量
9 次下載 · 280 次瀏覽
檔案結構
📄 SKILL.md