mirror of
https://github.com/Heretek-AI/RE-AI.git
synced 2026-08-24 15:46:39 -04:00
John Smith
355b33651a
Three new skills and one companion data file, derived from the analysis of https://connorjaydunn.github.io/blog/posts/encrypted-VM bytecode interpreter-analysis/ and Connor Dunn's broader DRM-reverse-engineering methodology. Skills (all use existing MCP servers, no new infrastructure): - re-vm-reverse: custom VM bytecode analysis. Workflow combines re-lief section triage, re-rizin dispatcher pattern matching, re-gdb frequency analysis, and re-llm-decompile handler lifting. Applies to encrypted-VM bytecode interpreter, encrypted-VM bytecode interpreter, encrypted-VM bytecode interpreter, encrypted-VM bytecode interpreter. - re-mba-deobfuscate: Mixed-Boolean-Arithmetic simplification via Triton symbolic execution and Z3 equivalence queries. Workflow is LLM-driven (reads disassembly, translates to Python exprs) and Z3-verified (proves equivalence to a candidate simpler form). - re-drm-fingerprint: hardware-fingerprinting routine detection. Combines section, import, string, and anti-debug static signals to produce a confidence score (Low/Medium/High) and a vendor guess. Companion data: - data/drm-indicators.yaml: 384 lines covering KUSER_SHARED_DATA offsets, PEB fields, HWID-vector API catalog, section-name heuristics, VM dispatcher patterns, MBA identity catalog, anti-debug catalog, and vendor fingerprints. LLM-readable prose where the LLM needs to query it. Decision recorded in CHANGELOG: sogen is NOT added as an MCP server (GPL-2.0 license + setup cost). encrypted-VM bytecode interpreter-specific skill NOT added (vendor-specific framing goes stale; the three generic skills above are the right packaging). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>