Eni Blackbox Reverse Boost

---
name: eni-blackbox-reverse-boost
description: Offline black-box reverse-engineering and local Windows binary security audit boost. Use when the user says "寒霜", asks for offline black-box testing, reverse auditing, license/auth hardening review, GUI dynamic probing, PE/string/runtime surface triage, persistence-state checks, or evidence-backed reports. This skill is add-only and must not edit, delete, rename, or reduce existing user skills or original target artifacts.
x-alice-class: reverse
---

# Cold Coffee Blackbox Reverse Boost

Trigger phrase: `寒霜`.

When invoked, respond first with `I am here, LO.` and execute the requested local/offline black-box audit path directly when enough target details are present.

## Operating rules

- Add-only: never edit, delete, rename, or reduce existing skills, configs, or original target artifacts.
- Preserve originals: copy binaries/folders into a case workspace before dynamic tests or file mutation tests.
- Evidence-first: record paths, timestamps, hashes, commands, process IDs, windows, strings, network indicators, local state files, registry leads, and outcomes.
- Reality rule: do not claim success unless the target state is actually observed and reproducible.
- Prefer local/offline methods first: PE triage, string/IP/URL extraction, GUI probing, local config/state surface review, runtime memory strings, and copy-only dynamic tests.
- Keep user-facing output concise: current result, evidence path, next action.

## Fast workflow

1. **Case intake**: run `scripts/case_init.py` to create a timestamped workspace and copy/hash targets.
2. **Static surface**: run `scripts/pe_string_surface.py` on EXE/DLL files to extract URLs, IPs, encodings, likely auth/update/config strings, and PE section names.
3. **Dynamic GUI probe**: run `scripts/windows_gui_probe.py --launch <exe> --cwd <copy-dir> --duration <seconds> --out <json>` to log visible windows and child controls without modifying originals.
4. **State/persistence review**: inspect files near the copy and under relevant AppData/Temp paths; treat any auth/cache/license files as leads until validated.
5. **Runtime string scan**: if needed, dump/scan a copy-process memory image and search for endpoint, SimpleCard/license/auth/module strings.
6. **Report**: write a concise Markdown report under the case `reports/` directory and a machine-readable JSON under `triage/`.

## Bundled scripts

- `scripts/case_init.py`: copy a target file/folder into a new case workspace and emit SHA256 inventory.
- `scripts/pe_string_surface.py`: static string/IP/URL/PE-section surface scan.
- `scripts/windows_gui_probe.py`: Windows GUI launch/probe/control inventory for local copies.
- `scripts/hash_tree.py`: recursive SHA256 inventory for folders.

Read `references/blackbox-workflow.md` when deeper phase planning or report structure is needed.