competition-reverse-pwn

1# Competition Reverse Pwn
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill for binary-heavy challenges where the decisive path runs through artifacts, decoded layers, process behavior, crash state, or exploit primitives.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Preserve the original artifact before unpacking, patching, or instrumenting.
122. Start with passive triage: type, headers, sections, imports, strings, entropy, resources.
133. Decide whether the path is reverse-first, DFIR-first, or exploit-first.
144. Tie every claim to an observable boundary: decode edge, persistence edge, crash edge, or leak edge.
155. Reproduce the artifact or primitive from a clean baseline.
16 
17## Workflow
18 
19### 1. Reverse Or Forensic Triage
20 
21- Separate loader, payload, config, and post-decode behavior.
22- Correlate files, memory, logs, registry, services, tasks, IPC, and PCAPs as one graph.
23- Keep decoded or dumped artifacts separate from the pristine sample.
24 
25### 2. Native And Exploit Path
26 
27- Map mitigations, loader behavior, libc or runtime, syscall and IPC surfaces, and protocol framing.
28- Record the primitive, controllable bytes, leak source, target object, and final artifact separately.
29…