John Smith 355b33651a feat: add re-vm-reverse, re-mba-deobfuscate, re-drm-fingerprint + drm-indicators.yaml ...

Three new skills and one companion data file, derived from the
analysis of https://connorjaydunn.github.io/blog/posts/encrypted-VM bytecode interpreter-analysis/
and Connor Dunn's broader DRM-reverse-engineering methodology.

Skills (all use existing MCP servers, no new infrastructure):

- re-vm-reverse: custom VM bytecode analysis. Workflow combines
  re-lief section triage, re-rizin dispatcher pattern matching,
  re-gdb frequency analysis, and re-llm-decompile handler lifting.
  Applies to encrypted-VM bytecode interpreter, encrypted-VM bytecode interpreter, encrypted-VM bytecode interpreter, encrypted-VM bytecode interpreter.

- re-mba-deobfuscate: Mixed-Boolean-Arithmetic simplification via
  Triton symbolic execution and Z3 equivalence queries. Workflow
  is LLM-driven (reads disassembly, translates to Python exprs) and
  Z3-verified (proves equivalence to a candidate simpler form).

- re-drm-fingerprint: hardware-fingerprinting routine detection.
  Combines section, import, string, and anti-debug static signals
  to produce a confidence score (Low/Medium/High) and a vendor guess.

Companion data:

- data/drm-indicators.yaml: 384 lines covering KUSER_SHARED_DATA
  offsets, PEB fields, HWID-vector API catalog, section-name
  heuristics, VM dispatcher patterns, MBA identity catalog,
  anti-debug catalog, and vendor fingerprints. LLM-readable prose
  where the LLM needs to query it.

Decision recorded in CHANGELOG: sogen is NOT added as an MCP
server (GPL-2.0 license + setup cost). encrypted-VM bytecode interpreter-specific skill NOT
added (vendor-specific framing goes stale; the three generic skills
above are the right packaging).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-04 11:53:39 -04:00

..

drm-indicators.yaml

feat: add re-vm-reverse, re-mba-deobfuscate, re-drm-fingerprint + drm-indicators.yaml

2026-06-04 11:53:39 -04:00