building-config-extractors
starsforks
How to install building-config-extractors?
meltedinhex/analyst-ai-pack/building-config-extractors
$npx -y skills add meltedinhex/analyst-ai-pack --skill building-config-extractorsBuilds reusable malware configuration extractors by applying a declarative JSON spec
SKILL.md
| 1 | # Building Config Extractors |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have reversed a family's config format and want a reusable, declarative extractor instead of |
| 6 | one-off scripts. |
| 7 | - You need to apply a spec (offset, XOR/base64 layers, field map) to many samples and emit |
| 8 | structured, defanged config. |
| 9 | |
| 10 | **Do not use** a spec built for one variant blindly on another — re-verify offsets/keys per |
| 11 | variant. This skill reads samples statically and executes nothing. |
| 12 | |
| 13 | ## Prerequisites |
| 14 | |
| 15 | - A reversed understanding of the config (location, decode layers, fields) expressed as a JSON |
| 16 | spec. |
| 17 | |
| 18 | ## Safety & Handling |
| 19 | |
| 20 | - Read bytes statically; defang recovered endpoints in output. |
| 21 | |
| 22 | ## Workflow |
| 23 | |
| 24 | ### Step 1: Write the extraction spec |
| 25 | |
| 26 | Define a JSON spec: blob `offset`/`length` (or a `marker` to search), ordered `decode` layers |
| 27 | (`xor` with key, `base64`), and `fields` (name, offset, length, type: `str`/`u16`/`u32`/`ipv4`). |
| 28 | |
| 29 | ### Step 2: Run the extractor |
| 30 | |
| 31 | ```bash |
| 32 | python scripts/analyst.py extract sample.bin --spec family.json |
| 33 | ``` |
| 34 | |
| 35 | Locates the blob, applies decode layers, parses fields, and defangs URL/IP fields. |
| 36 | |
| 37 | ### Step 3: Validate output |
| 38 | |
| 39 | Confirm fields are plausible (valid hosts, ports, IDs); adjust the spec as needed. |
| 40 | |
| 41 | ### Step 4: Reuse |
| 42 | |
| 43 | Store the spec per family and apply across the corpus. |
| 44 | |
| 45 | ## Validation |
| 46 | |
| 47 | - The spec round-trips on a known sample to the expected config. |
| 48 | - Decode layers are applied in order and produce readable output. |
| 49 | - URL/IP fields are defanged in the emitted config. |
| 50 | |
| 51 | ## Pitfalls |
| 52 | |
| 53 | - Hardcoding a variant-specific offset that shifts in other builds — prefer markers. |
| 54 | - Wrong field endianness (`u16`/`u32` little vs big) producing garbage ports. |
| 55 | - Forgetting a decode layer (base64 over XOR) and parsing ciphertext as fields. |
| 56 | |
| 57 | ## References |
| 58 | |
| 59 | - See [`references/api-reference.md`](references/api-reference.md) for the extractor engine. |
| 60 | - ATT&CK T1140 and config-extractor framework concepts (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
