competition-malware-config

1# Competition Malware Config
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive value is not just "what the sample does," but which config fields, stages, or network parameters the sample hides and when they become plaintext.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Preserve the original sample before unpacking or patching.
122. Separate loader, payload, config blob, and post-decode behavior.
133. Rank candidate config blobs by entropy, field shape, nearby strings, and decode helpers.
144. Record the exact transform chain for each recovered field.
155. Reproduce the decoded config or beacon parameters from the smallest possible path.
16 
17## Workflow
18 
19### 1. Find The Config Boundary
20 
21- Inspect sections, resources, embedded archives, strings, imports, and decode helpers.
22- Identify where config is stored: resource, overlay, encrypted blob, registry seed, network bootstrap, or stage2 memory.
23- Keep one note of when each value becomes plaintext.
24 
25### 2. Reconstruct The Decode Chain
26 
27- Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse.
28- Group all config fields from the same chain together instead of treating them as unrelated clues.
29…