Skill UI

Expert in developing complete, high-performance firmware and peripheral drivers for ARM Cortex-M platforms (STM32, Teensy, nRF52). Specializes in low-level hardware interaction, including implementing drivers for I²C, SPI, UART, and managing complex concurrency patterns using FreeRTOS/Zephyr. Provides critical guidance on optimizing for determinism, cache coherency, DMA transfers, and memory barriers to ensure reliable embedded system operation.

A specialized skill for writing highly efficient, memory-safe, and robust C code. This guide focuses on best practices for systems programming, including rigorous memory management (malloc/free), advanced pointer arithmetic, POSIX compliance, multi-threading (pthreads), and embedded systems constraints. It emphasizes using static analysis tools, implementing comprehensive error handling, and ensuring performance through proper profiling. Ideal for complex, low-level system tasks.

Guides engineers through initializing MCUs, crafting RTOS-aware drivers, and tuning power/timing for STM32, ESP32, and bare-metal targets; covers constraint analysis, interrupt safety, resource tracking, and validation with static analysis and real-time debugging.

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

Security guardrails embedded in the mortgage plugin that block prompt injection and social-engineering tricks, stop system prompt extraction, guard PII and pricing logic, enforce workflow phases, and ensure conversational inputs stay within refinance scope.

This skill details the process of reverse engineering Go-compiled malware using Ghidra. It involves parsing Go-specific metadata structures like buildinfo and pclntab to recover stripped or obfuscated function names. Users can also extract embedded module paths and dependency strings, providing critical insight into the malware's capabilities and third-party dependencies.

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

A comprehensive workflow for performing static and dynamic analysis of malicious PDF documents. It utilizes tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Ideal for triaging phishing attachments, analyzing exploit documents, and building threat signatures in a controlled forensic environment.

This comprehensive toolkit provides deep static analysis capabilities for suspicious PDF documents. Using tools like PDFiD, pdf-parser, and peepdf, it identifies embedded malicious structures—including JavaScript code, shellcode, auto-actions, and exploit kits—without opening or rendering the file. It is essential for security analysts conducting threat triage, forensic investigation, and assessing potential attack vectors from suspicious attachments.

This guide details advanced methods for detecting and preventing QR code phishing (quishing) attacks. It covers how malicious URLs embedded in images bypass traditional email security filters, requiring multimodal AI, OCR, and robust mobile threat defense solutions. Essential for SOC analysts and security teams.

This tool automates the extraction of embedded configuration details from Agent Tesla Remote Access Trojan (RAT) samples. It is designed to recover crucial exfiltration credentials (SMTP, FTP, Telegram), keylogger settings, and Command and Control (C2) endpoints by analyzing and deobfuscating the .NET assembly structure. Essential for threat intelligence, incident response, and malware reverse engineering.