Eni Unpack Reverse Lab

---
name: eni-unpack-reverse-lab
description: Offline Windows PE packing, unpacking triage, and evidence-backed reverse-engineering workflow. Use when the user says "寒霜" and asks to inspect a local EXE/DLL, identify packers or protectors, triage UPX/PyInstaller/.NET/native/VM-protected binaries, audit local reverse tools, create a copy-only analysis case, decompile or dynamically observe a local binary, or verify whether an authorization state is real, persistent, and cross-machine.
x-alice-class: reverse
---

# Cold Coffee Unpack Reverse Lab

Start with: `I am here, LO.`

Use this skill only for local artifacts. Never edit, rename, delete, or overwrite an original artifact or any pre-existing user skill. Work on a copied case artifact and keep evidence paths, hashes, timestamps, and process cleanup results.

## Fast path

1. Create or reuse a case folder under the workspace; record a SHA-256 baseline.
2. Run `scripts/cold_coffee_native_workflow.py <artifact> --case-dir <case> --dynamic` for the complete bounded workflow, or run the individual scripts below when a phase needs isolation.
3. Run `scripts/pe_pack_triage.py <artifact> --out <case>/triage/pe-pack.json` and `scripts/reverse_tool_audit.py --out <case>/triage/reverse-tools.json` when static-only evidence is sufficient.
4. Choose the shallowest supported route from the indicators below. Treat every indicator as a lead, not proof.
5. For dynamic work, launch only a copied target, keep the window hidden or off-screen, impose a timeout, and clean only processes started from the case path.
6. Report facts separately from inferences. Do not call a status popup, a local branch, or a patched copy a permanent/full-permission result.

## Routing

- **UPX indicators:** record section layout and entropy first; unpack only a copy and re-run triage on the result.
- **PyInstaller indicators:** locate the archive/overlay and Python runtime markers; inventory contents before attempting extraction.
- **.NET indicators:** use metadata/IL tooling when locally available; preserve strong names and original metadata evidence.
- **Native packer/virtualizer indicators:** collect section entropy, imports, runtime allocation/protection changes, anti-debug/update behavior, and stable code regions before focused disassembly.
- **Unknown or mixed indicators:** collect static strings/imports plus a bounded hidden GUI/process trace; stop if the sample becomes destructive or leaves the copied case boundary.

## Authorization evidence gate

Read `references/evidence-gates.md` whenever the user asks for unlocked features, all permissions, long-term activation, persistence, or cross-machine behavior. Require direct evidence for every requested property.

## Resources

- `scripts/pe_pack_triage.py`: read-only PE/header/section/entropy/signature triage.
- `scripts/reverse_tool_audit.py`: inventory locally available unpacking and reverse-analysis tools without changing the system.
- `scripts/runtime_exec_surface.py`: bounded read-only executable-memory map for a copied process.
- `scripts/capture_private_exec_regions.py`: capture only private executable regions from a copied process, with hashes.
- `scripts/scan_x86_dispatch.py`: scan captured code offline for bounded x86 authorization-dispatch signatures.
- `scripts/auth_transport_trace.py`: capture only socket/transport/crypto API metadata from a copied login process; it intentionally excludes payloads and credentials.
- `scripts/isolated_remember_state_probe.py`: inspect copied-process remembered-card persistence using an isolated process-local AppData/Temp sandbox without logging in.
- `scripts/login_memory_map_diff.py`: compare copied-process private allocation metadata before and after a normal bounded login attempt without reading payload memory.
- `scripts/login_control_layout.py`: identify copied login-control labels, IDs, and layout before automation; never submits a login.
- `scripts/runtime_string_xrefs.py`: locate a runtime text string and code references in a copied process without modifying it or sending input.
- `scripts/trial_surface_probe.py`: exercise the copied client's visible trial entry point and record resulting UI state without reading credentials.
- `scripts/cold_coffee_native_workflow.py`: add-only automation wrapper that creates a timestamped case run, collects static/tool evidence, and optionally performs hidden copied-process runtime capture.
- `references/evidence-gates.md`: validation gates that prevent false-positive reverse/audit claims.