mcpField
E
evasion-research

evasion-research

github.com/wgpsecSecurity1.8k52 installsUpdated 4d ago
Repository

About evasion-research

A skill for researching security techniques on GitHub. It guides researchers through repository and code searches, pattern classification, duplicate checks, and recording findings, with a focus on evasion techniques and loader components.

Key features

  1. 01Five-step research workflow
  2. 02GitHub search command examples
  3. 03Six categories for technique patterns
  4. 04Knowledge-base deduplication rules
  5. 05Research report format

Use cases

  1. 01Search for shellcode loader repositories
  2. 02Find and classify API obfuscation techniques
  3. 03Check whether techniques are already recorded
  4. 04Document security research findings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill evasion-research

After installing, type/evasion-researchin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

evals/
evals.json
recall.json
references/
research-workflow.md

Details

From the project README

GitHub 安全研究方法论

⛔ 深入参考

5 步研究流程

1. GitHub 搜索 → gh search repos / gh search code
2. 仓库分析 → gh repo view + 读关键文件
3. 模式提取 → 按 6 大类分类
4. 去重检查 → 查已有知识库避免重复
5. 入库保存 → 写入 evasion-techniques-db.json / loader-components-db.json

GitHub 搜索命令速查

# 搜仓库
gh search repos "shellcode loader language:C stars:>20" --limit 20
gh search repos "AMSI bypass" --limit 15
gh search repos "syscall direct" --language c --limit 15

# 搜代码
gh search code "VirtualAlloc PAGE_EXECUTE_READWRITE" --language c --limit 30
gh search code "NtCreateThreadEx" --language c --limit 20

6 大技术分类

类别搜索关键词
内存分配VirtualAlloc, HeapCreate, NtAllocateVirtualMemory, MappedFile
代码执行CreateThread, EnumWindows, APC, Fiber, callback
API 混淆API hashing, PEB walk, dynamic resolve
字符串混淆XOR, AES, stack strings, compile-time encryption
反分析IsDebuggerPresent, anti-VM, sandbox detection
Syscalldirect syscall, indirect syscall, SSN, Hell's Gate

去重规则

条件操作
完全同名❌ 跳过（重复）
同技术不同名❌ 跳过（重复）
同目标不同实现✅ 添加（都有价值）
不同目标类似 API✅ 添加（不同用途）

输出格式

## 研究报告

### 发现的技术
1. [技术名] - [简述] - 复杂度: simple/medium/complex

### 知识库状态
- 新增: X 条
- 重复跳过: Y 条
- 变体补充: Z 条

### 参考链接
- <repository-url>

Comments

Markdown supported