thick-client – Coding skill for AI agents

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Thick Client Security Testing

When to Use

• Assessing a desktop application's security posture.
• Checking whether client-side trust decisions can be subverted.

适用场景

• C/S 架构客户端、Electron/Qt/.NET WinForms/WPF
• 本地配置/凭证存储、IPC、命名管道
• 客户端强制校验绕过研究（授权）
• 自动更新通道与代码签名验证

工作流

1. 建边界

□ 进程树、子进程、驱动/服务
□ 监听端口与出站域名
□ 本地敏感路径：%APPDATA%、Keychain、注册表

2. 本地攻击面

□ 明文配置、硬编码密钥、调试开关
□ DLL 劫持/搜索顺序（Windows）
□ 数据库文件（SQLite）权限与加密
□ IPC：谁可连接？是否鉴权？

3. 网络面

□ 系统代理 / 应用自定义 TLS
□ 证书钉扎 → 联合 mobile/js 方法学或 Frida
□ API 越权：客户端隐藏的管理接口

4. 逆向验证

□ .NET → dotnet-reverse；原生 → ida/ghidra；Electron → asar + js-reverse

工具链

| 工具 | 用途 |

|------|------|

| Process Monitor / API Monitor | 行为 |

| Burp / mitmproxy | 流量 |

| dnSpy / IDA / Ghidra | 逆向 |

| Sysinternals | Windows 面 |

| asar / nexe 检测 | Electron |

参考

• references/thick-client-checklist.md
• ../dotnet-reverse/ ../ida-reverse/ ../js-reverse/ ../api-security/

路由上下文

上游: MASTER R32

下游: 纯协议 protocol-reverse；供应链更新 supply-chain-security

任务完成自检

• [ ] 是否画出信任边界？
• [ ] 本地+网络面是否都覆盖？
• [ ] Checklist？

Limitations

• .NET/Java clients need framework-specific tooling.
• Server-side enforcement gaps found client-side still need server confirmation.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).