agentleFS
Sign inStart free
z91772524-aiz91772524-ai/pojia-next-mac/skills/pojia-memory/SKILL.md

pojia-memory

Skill39 starsChanged 34 days agoMITView on GitHub

Cross-platform process memory, dump, runtime, heap, pointer-chain, signature, structure, and memory-forensics analysis for Windows, Linux, Android, Unity IL2CPP, Unreal, native applications, crash dumps, and raw memory images. Use when Codex receives a PID, process name, memory dump, module offset, AOB pattern, pointer chain, runtime address, crash dump, Volatility artifact, Frida target, or needs ReadProcessMemory/process_vm_readv code, map/module discovery, structure reconstruction, memory diffing, hooks, watchpoints, dump analysis, or rollback-safe patch tooling.

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 3 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈3

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Use scripts/aob_scan.py for wildcard byte-pattern scans and scripts/dump_strings.py for offset-aware ASCII/UTF-16 extraction.

    line 26
  2. Distinctive:

    Prefer module resolution, signatures, and validated pointer paths over hard-coded absolute addresses.

    line 36
  3. Distinctive:

    Use controlled state changes, memory diffs, watchpoints, allocation hooks, and access-width patterns to recover structures.

    line 37
  4. Distinctive:

    Verify readable/writable regions and bounds before access.

    line 38

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Pojia Memory

Resolve runtime addresses and structures from evidence, then produce repeatable tooling.

Start

  1. Establish architecture, pointer width, endianness, target OS/runtime, and artifact type.
  2. Distinguish absolute addresses, module-relative offsets, signatures, pointer chains, handles, and generated references.
  3. Record module mappings, page protections, thread/heap context, and address provenance.
  4. Use scripts/aob_scan.py for wildcard byte-pattern scans and scripts/dump_strings.py for offset-aware ASCII/UTF-16 extraction.

Select references

  • Windows live process, dumps, WinDbg, RPM/WPM: read references/windows.md.
  • Linux, Android, Frida, IL2CPP: read references/linux-android.md.
  • Raw dumps, structures, pointer chains, memory forensics: read references/dump-structures.md.

Execute

  • Prefer module resolution, signatures, and validated pointer paths over hard-coded absolute addresses.
  • Use controlled state changes, memory diffs, watchpoints, allocation hooks, and access-width patterns to recover structures.
  • Verify readable/writable regions and bounds before access.
  • For patches, capture original bytes, validate expected bytes, restore protections, and provide rollback.

Deliver

Return the address derivation, mapping evidence, recovered structure, complete reader/scanner/hook/patch code, error handling, logs, and verification steps.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free