What problem does it solve? It provides a structured methodology for tackling binary-heavy CTF challenges—reverse engineering, malware unpacking, memory dump and PCAP inspection, crash debugging, and exploit verification—without losing evidence integrity or mixing up original and modified artifacts. ## Core Features & Use Cases - Reverse and Forensic Triage: Separates loader, payload, config, and post-decode behavior while correlating files, memory, logs, registry, and PCAPs into one execution graph. - Native Exploit Path: Maps mitigations, libc/runtime, syscall surfaces, and protocol framing, recording primitives, leaks, and target objects separately. - Evidence Discipline: Preserves offsets, hashes, crash state, and decoded artifacts as distinct files tied to observable boundaries. - Use Case: During a CTF, after the sandbox orchestrator routes a pwnable challenge here, triage the binary's mitigations, reproduce a crash from a clean baseline, and document the leak and primitive needed for the exploit chain. ## Quick Start Ask the agent to triage and reverse the provided challenge binary under the established sandbox assumptions, then verify the exploit primitive from a clean baseline. ## Quick Start Note This skill activates only after $ctf-sandbox-orchestrator has established sandbox assumptions and routed the task here.
