New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

TH08 Executable Reconstruction

by N0zoM1z0 in N0zoM1z0/th08

Reconstructs bounded functions from the original Japanese TH08 1.00d executable for a source decompilation project, using hash-verified target evidence and labeled corroboration.

MITAuto-check passedDevelopment

Install TH08 Executable Reconstruction

skills CLI
$ npx skills add N0zoM1z0/th08 --skill th08-re -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install N0zoM1z0/th08 th08-re --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/N0zoM1z0/th08.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/th08-re .claude/skills/th08-re && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
th08-re
GitHub stars
105
Token cost
~1.3k tokens
SKILL.md length
556 words
Files
2
Skills in repo
5
Repo updated
First seen
Licence
MIT

At a glance

Reconstructs bounded functions from the original Japanese TH08 1.00d executable for a source decompilation project, using hash-verified target evidence and labeled corroboration.

  • Works in 4 steps: Read AGENTS.md, docs/ARCHITECTURE.md,… → Run → Fail closed on IDA until its active TH08… → …
  • Recovering a function's source from the TH08 executable
  • SKILL.md covers Preflight, Recover and implement and Handoff
  • Calls python3 and git

What it does

Work is limited to the single target defined in `config/target.toml`: the Japanese 1.00d build, pinned by SHA-256, image base, entry point and text range. Preflight means reading `AGENTS.md`, the architecture and workflow docs, the relevant mapping rows and the handoff notes, then running `scripts/verify-target.py` and `scripts/validate-tracking.py --require-target`. IDA is not trusted until its database passes the documented check, with verified `objdump` or a headless Ghidra import used meanwhile, and IDA semantic evidence is never used as a matching claim. The claims file must be header-only and the writable scope kept to one bounded area.

When recovering code, the agent records facts as Observed, Inferred or Unknown, inspects whole functions with their callers, callees, strings, globals, access widths and stack cleanup, and favors coherent clusters within one translation unit. The inherited TH08 source serves as a hypothesis where it is stubbed, and TH06 and TH07 only corroborate semantics or compiler behavior. Calling convention, return behavior, field offsets and exceptional paths are recovered before source is shaped, and large switch dispatchers are audited on three independent surfaces. The excerpt ends in that audit.

When your agent uses it

  • Recovering a function's source from the TH08 executable
  • Naming functions and recovering ABI details or struct layouts for TH08
  • Migrating inherited source into the decompilation project

Example prompts

  • “Reconstruct the next bounded function cluster in the TH08 executable and label what is observed.”
  • “Recover the calling convention and field offsets for this routine.”
  • “Verify the target executable and tracking files before I start on a new function.”

Requirements

  • Python 3 for the verification scripts
  • The TH08 1.00d executable matching the pinned hash
  • objdump, Ghidra or IDA for disassembly

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Read AGENTS.md, docs/ARCHITECTURE.md, docs/RE_WORKFLOW.md, the
  2. Run
  3. Fail closed on IDA until its active TH08 database passes
  4. Confirm config/claims.csv is header-only and keep one bounded writable

What it can do on your machine

Read from SKILL.md and the folder at commit 67e7e49. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python3
    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

TH08 Executable Reconstruction loads about 1.3k tokens when it runs. Until then it costs about 79 tokens; SKILL.md has 556 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~79
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from N0zoM1z0/th08 at commit 67e7e49, republished under its MIT licence (© N0zoM1z0). 556 words, ~1,254 tokens.

Download SKILL.mdSave it as .claude/skills/th08-re/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
th08-re
description
Reconstruct bounded functions from the original Japanese TH08 1.00d executable using hash-attested target evidence, upstream GensokyoClub source, and explicitly labeled TH06/TH07 corroboration. Use for TH08 disassembly, ABI recovery, function naming, layout recovery, source migration, or implementation work.

TH08 reconstruction

Work only against the target in config/target.toml: Japanese 1.00d, SHA-256 330fbdbf58a710829d65277b4f312cfbb38d5448b3df523e79350b879213d924, image base 0x00400000, entry 0x004A619E, and .text 0x00402000–0x004B3B77.

Preflight

  1. Read AGENTS.md, docs/ARCHITECTURE.md, docs/RE_WORKFLOW.md, the relevant config/mapping.csv and config/reccmp-functions.csv rows, and docs/RE_HANDOFF.md.

  2. Run:

    bash
    python3 scripts/verify-target.py
python3 scripts/validate-tracking.py --require-target

  3. Fail closed on IDA until its active TH08 database passes docs/IDA_MCP.md. The canonical SHA belongs to resources/th08.exe; if IDA reports a different loader/database hash, establish mapped-image identity with the required metadata and multi-point read-only byte samples. Use verified-target objdump or the dedicated headless Ghidra import until then. Never use IDA semantic evidence as a matching claim.

  4. Confirm config/claims.csv is header-only and keep one bounded writable scope. Reconcile mapping/Ghidra boundaries against complete target control flow.

Recover and implement

  1. Record facts as Observed, Inferred, or Unknown. Target bytes, imports, relocations, and directly decoded accesses are observations.
  2. Inspect the full function plus callers, callees, adjacent code, strings, globals, access widths, stack cleanup, and saved registers. Prioritize coherent high-ROI clusters in one translation unit: a sub-0x20 getter or predicate may unlock a nearby callback's REL32, and a neighboring CutChain often shares the same object profile and chain globals. Investigate getter, callback, then CutChain; adjacency is a prioritization signal, not proof of boundaries, ownership, or semantics.
  3. Use the inherited TH08 source as a hypothesis when it is stubbed or incomplete. Use TH06 and TH07 only as semantic or compiler corroboration.
  4. Recover calling convention, return behavior, field offsets, side effects, and exceptional paths before shaping source. For a large switch dispatcher that is not exact yet, audit source presence with three independent surfaces: enumerate every primary and nested jump- table slot including shared/default handlers; compare the target direct-call destination multiset with the built function's REL32 multiset; and reconcile returns, fallthroughs, field offsets, and access widths. This can justify implemented.csv, never matches.csv. RunEcl is already exact. Its opcode audit is retained at scripts/analysis/historical/runecl-audit-dispatch.py only for reproducing the completed investigation; do not select it as new work from stale notes.
  5. Implement the smallest coherent function in its existing module. Do not manufacture behavior, paste decompiler output, patch target bytes, or use assembly/byte arrays/padding to force code shape. If a semantically exact leaf differs only by compiler profile or epilogue, inspect its address cluster and callers before reshaping the body: a member defined for one subsystem may have been emitted in another subsystem's translation unit. Preserve the class owner while testing the target-proven TU/profile, as with GameManager::SetYoukaiGauge in Player.obj.
  6. Treat shared layouts, canonical mapping names, config/implemented.csv, and config/match-units.toml as high-risk changes. Re-run every affected exact unit before committing them. Before publishing aggregate totals after a shared header/layout/compiler/object-graph change, run python3 scripts/analysis/verify-exact-units.py --all; its cold build is part of the evidence, and --reuse-build is not sufficient.
  7. Use $th08-matching for the focused VC7 build and strict comparison.
Show full SKILL.md (94 more words)Show less

When Ghidra-backed original objects are needed and Ghidra is configured, use the target-verifying disposable import path:

bash
python3 scripts/export_ghidra_objs.py --import-csv

Do not substitute an existing or remote database whose input identity is not attested.

config/implemented.csv means source-present only. Never promote it or a mapping row into an exact-match claim without the canonical comparator result.

Handoff

Report address and size, observations, inferences, unknowns, files changed, target inspection commands, focused unit/result, and remaining ABI or layout risk. Run python3 scripts/validate-tracking.py --require-target, python3 scripts/ci.py, and git diff --check before a session checkpoint. Do not commit binaries, toolchains, databases, reports, or credentials.

© N0zoM1z0, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in .agents/skills/th08-re of N0zoM1z0/th08.

  • SKILL.md
  • agents/openai.yaml

Open the folder on GitHubat commit 67e7e49

Compare with similar skills

TH08 Executable Reconstruction next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

TH08 Executable Reconstruction compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
TH08 Executable Reconstruction this skillN0zoM1z0/th08105—~1.3kAutomated safety check: PassMIT
Ghidra ReOrbitCurve/firmware-reverse-engineering216—~4.2kAutomated safety check: PassApache-2.0
Binary Reaiskillstore/marketplace4331 repos~2.6kAutomated safety check: PassNone
Rea Changelog Updatemorluto/rea80k—~1.9kAutomated safety check: PassMIT
Bench ExperimentDavidClawson/OpenScope-2C53T116—~1kAutomated safety check: PassGPL-3.0
Rea Tool Designmorluto/rea80k—~239Automated safety check: PassMIT

Similar skills

  • Ghidra Re

    OrbitCurve/firmware-reverse-engineering

    Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic…

    216 GitHub stars~4.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Binary Re

    aiskillstore/marketplace

    This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work.

    433 GitHub starsUsed in 1 repo~2.6k tokens
    SecurityAuto-check passed

  • Rea Changelog Update

    morluto/rea

    Prepare or rewrite REA release changelogs and GitHub release notes from pinned Git history, with verified contributor thanks and Release Please synchronization.

    80k GitHub stars~1.9k tokensUpdated today
    DevelopmentAuto-check passed

  • Bench Experiment

    DavidClawson/OpenScope-2C53T

    Run and record a hardware experiment on the 2C53T bench using a controlled five-step cycle.

    116 GitHub stars~1k tokensUpdated today
    SecurityAuto-check passed

  • Rea Tool Design

    morluto/rea

    Design or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics.

    80k GitHub stars~239 tokensUpdated today
    SecurityAuto-check passed

  • Renderdoc GPU Debug

    rudybear/renderdoc-skill

    GPU frame debugging with RenderDoc via rdc-cli. An agent skill from rudybear/renderdoc-skill.

    212 GitHub stars~4k tokensUpdated 7 mo ago
    DevelopmentAuto-check passed

More from N0zoM1z0/th08

  • TH08 Library Recovery

    N0zoM1z0/th08

    Covers recovering and verifying the VC7 C runtime, compiler-runtime and D3DX library functions in the TH08 decompilation, with hash-pinned evidence.

    105 GitHub stars~877 tokensUpdated today
    Auto-check passed

  • TH08 Typed Reconstruction

    N0zoM1z0/th08

    Generates and reads target-pinned instruction and ABI fact packets for a source reconstruction project, to guide source shaping before a strict comparison.

    105 GitHub stars~2.8k tokensUpdated today
    Auto-check passed

  • TH08 Exact Function Matching

    N0zoM1z0/th08

    Builds TH08 functions with the repository's VC7 toolchain and compares each against the hash-attested 1.00d binary to tune code generation and verify exact matches.

    105 GitHub stars~8.7k tokensUpdated today
    Auto-check passed

  • TH08 Semantic Reconstruction

    N0zoM1z0/th08

    Replaces raw offsets and anonymous fields in a TH08 C++ source reconstruction with evidence-backed names and types, without changing accepted bytes or playable behavior.

    105 GitHub stars~2.3k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about TH08 Executable Reconstruction

What does TH08 Executable Reconstruction do?

Reconstructs bounded functions from the original Japanese TH08 1.00d executable for a source decompilation project, using hash-verified target evidence and labeled corroboration. 00d build, pinned by SHA-256, image base, entry point and text range.py --require-target`.

When should I use TH08 Executable Reconstruction?

TH08 Executable Reconstruction fits situations like: recovering a function's source from the TH08 executable; naming functions and recovering ABI details or struct layouts for TH08; migrating inherited source into the decompilation project.

How do I install TH08 Executable Reconstruction in Claude Code?

Run `npx skills add N0zoM1z0/th08 --skill th08-re -a claude-code`. Or copy the skill folder (.agents/skills/th08-re in N0zoM1z0/th08) into .claude/skills/th08-re in your project. Claude Code loads it when a task matches its description.

How do I install TH08 Executable Reconstruction in Codex?

Run `npx skills add N0zoM1z0/th08 --skill th08-re -a codex`. Or copy the skill folder (.agents/skills/th08-re in N0zoM1z0/th08) into .agents/skills/th08-re in your project. Codex loads it when a task matches its description.

Can I use TH08 Executable Reconstruction in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add N0zoM1z0/th08 --skill th08-re -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/th08-re, .gemini/skills/th08-re, .github/skills/th08-re and .opencode/skills/th08-re in your project.

What does TH08 Executable Reconstruction need to run?

Going by SKILL.md and its folder, TH08 Executable Reconstruction needs the command-line tools its instructions call (python3 and git). Our summary lists: Python 3 for the verification scripts; The TH08 1.00d executable matching the pinned hash; objdump, Ghidra or IDA for disassembly.

Does TH08 Executable Reconstruction access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is TH08 Executable Reconstruction safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does TH08 Executable Reconstruction use?

TH08 Executable Reconstruction is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does TH08 Executable Reconstruction use?

About 1.3k tokens (SKILL.md is roughly 5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to TH08 Executable Reconstruction?

Skills that share tags, products or a category with TH08 Executable Reconstruction: Ghidra Re (OrbitCurve/firmware-reverse-engineering, 216 stars), Binary Re (aiskillstore/marketplace, 433 stars), Rea Changelog Update (morluto/rea, 80k stars) and Bench Experiment (DavidClawson/OpenScope-2C53T, 116 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains TH08 Executable Reconstruction?

N0zoM1z0 (a GitHub user) maintains it in N0zoM1z0/th08, which has 105 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on October 11, 2026.

Source: N0zoM1z0/th08 on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.