Develops ROP chains and heap exploitation primitives from triaged vulnerability crashes.
npx skills add https://github.com/dslsdzc/rev-skills --skill re-exploit-dslsdzc
Please help me install this Agent Skill. Skill: re-exploit Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-exploit Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-exploit-dslsdzc
High-intent search queries and answers about installing and using this skill.
Search gadgets with ROPgadget or ropper for pop rdi, pop rsi, and pop rdx instructions matching the SysV ABI argument order. Build the chain as padding plus gadget addresses plus arguments, and insert a ret gadget before libc calls to maintain 16-byte stack alignment for movaps.
On glibc 2.32 and later, tcache fd pointers are protected by safe-linking, so you must leak a heap address and encode the new fd as new_fd XOR (fd_field_address >> 12). Double free is also blocked by key checks since 2.29, requiring a UAF write to the key field or a size change to a different bin.
Use gdb with pwndbg, whose heap and bins commands display chunk layouts and tcache, fastbin, and unsorted bin linked lists directly. pwntools provides the exploit scripting framework, and checksec reports the binary's protection matrix.
The crash usually occurs at a movaps instruction because the x86-64 ABI requires 16-byte stack alignment at call time. Insert a single ret gadget before the target function call to adjust rsp by 8 bytes and restore alignment.
Build an ORW chain that calls open, read, and write sequentially via ROP to exfiltrate the flag file instead of spawning a shell. If no syscall gadget exists in the binary, leak libc base first and use libc gadgets or SROP via rt_sigreturn.
Use it when a vulnerability is already located and triaged and you need complex ROP chains, heap attacks, or multi-mitigation bypasses. Entry-level tasks like ret2win, simple ret2libc, or format string basics belong to introductory pwn workflows, and unlocated crashes belong to crash triage.
riparinoTriage Windows and Linux crash dumps to determine exploitability.
arbisoftIdentify and triage exploitable security vulnerabilities in code repositories.
yhy0Analyze and exploit CTF binary challenges using Ghidra, pwntools, and dynamic debugging.
jleechanorgTokenize text with Rust-backed BPE, WordPiece, and Unigram tokenizers.
