Marshall Z. @marshallphase

破甲仓库上游已删库，今早一看 404 github 上已有镜像仓库github.com/mmparko/dsh-pu… 我这里再镜像一次github.com/WoYun520/dsh-p…

Levi 卧云 @zmdsb259414

3 days ago

破甲到底能拿来干啥？？？ 感觉能做出很多好玩的东西，有没有已经尝试过的朋友 我目前做的项目还没有遇到需要破甲和逆向的 你们有什么好玩的点子吗？ dsh 破甲仓库👇 github.com/YuJunZhiXue/ds…

35 24 234 111K 309

x.com/i/article/2111…

做 AI 算命、做排盘网站的朋友注意了，这份开源数据你可以直接拿去用。 我们把 1950–2026 年每一天、每个时辰、男女的紫微命盘全排了一遍：67.5 万张盘 × 13 个维度 = 877 万段解读，204 亿字。断语逐句对照《天纪》原话和《紫微斗数全书》原文，校正了 1150 处，引文逐字可查。 想搭排盘网站的直接用，想训练命理 AI 的直接当语料。161MB 下完，按出生年份一年一个文件。 🔗 github.com/Renhuai123/ziw…

这周 GitHub 涨得最猛的十个 AI 开源项目，会用 AI 的人手里又多了哪些家伙。 01 REA github.com/morluto/rea 第一个，REA，全称 Reverse Engineer Anything，逆向一切。 现在二十六万九千颗星。它四月份才建库，光这一周就涨了二十一万四千颗，今天一天又是三万多。 它火在哪？你看到别的 App 里有个功能做得特别好，以前想知道它是怎么实现的，得懂汇编、会用反编译工具，一行一行去啃。 现在装上 REA，跟你的 AI 说一句：帮我搞清楚这个 App 的搜索是怎么做的，把证据给我看，再在我的项目里做一个类似的。 AI 就会自己去拆：网页、桌面应用，一直拆到最底层的二进制。它会调用 Ghidra、IDA 这些逆向工具，顺着调用链一路往下追，每个结论都附上证据。 他们放出来的案例里，AI 把一个老游戏里计算声音左右声道的函数还原成了 C 代码，三千两百多组测试全部对上，编译出来的六十三个字节和原版一模一样。 也就是说，以后你看到任何一个好功能，都可以先让 AI 替你把它拆开、讲明白。 02 skills github.com/mattpocock/ski… 第二个，skills，作者是 Matt Pocock，TypeScript 圈子里很有名的老师。 二十九万二千颗星，二月份建的库，这一周又涨了一万两千多。 它就是他自己每天写代码真在用的一套 AI 技能，直接从他的工作目录里拿出来公开。他说得很直白：这是给真正做工程的人用的，不是 vibe coding。 最火的一个叫 grill-me，拷问我。AI 动手之前，先反过来把你问一遍：你到底要做什么，边界在哪，哪种情况怎么处理。问清楚了，再写。 还有一个是先写测试：AI 先写一个会失败的测试，亮红灯，再改代码让它变绿。每一步都有反馈，不再闭着眼写。 另外还有排查 bug 的流程、定期给代码架构做体检的技能。每个都很小，可以随便改成你自己的。 装上它，你的 AI 就从一个闷头写代码的新人，变成一个先问清楚、再一步步验证的工程师。 03 diagram-design github.com/cathrynlavery/… 第三个，diagram-design，专门教 AI 画图解的技能。 五万五千八百颗星，四月中旬建库，这一周涨了一万零七百。 你让 AI 画架构图，它一般甩给你一张 Mermaid，方框套方框，又挤又丑。这个技能把四十五种图都定好了规矩：架构图、时序图、四象限、流程、时间线，每一种都有明暗两套样式。 你只要用大白话说：给我画一张我这个应用的架构图，前端、后端、数据库、Redis 缓存。AI 自己挑图的类型，排在四像素的网格上，还会检查有没有重叠、有没有出界。 最后给你一个 HTML 文件，双击就能打开，不用装任何东西。 更厉害的是，你给它一个网址，它会把你网站的配色和字体学过来，以后画的每一张图，都是你自己品牌的样子。 以后写方案、做汇报要配图，一句话就有了。 04 OpenMontage github.com/calesthio/Open… 第四个，OpenMontage，一个开源的 AI 视频制作系统。 六万八千五百颗星，三月底建库，这一周涨了三千三百多。 它做的事，是把你手里的 AI 编程助手，Claude Code、Cursor、Codex 这些，直接变成一个视频工作室。 你说一句：给我做一个六十秒的动画，讲神经网络是怎么学习的。它就自己查资料、写脚本、生成画面和配音、剪辑、合成，最后出成片。 里面有十几条制作流水线，一百多个工具，七百多份技能和制作经验文件。开工之前先给你报价，生成素材之前先给你看分镜，你点了头才开始花钱。 他们有一个示例短片，一根孤独的香蕉和一个猕猴桃交朋友，六十秒，总成本一点三三美元。 你还能扔给它一个你喜欢的视频，它会分析节奏、镜头和风格，照着这个路子，给你做一个新题材的。 05 claude-mem github.com/thedotmack/cla… 第五个，claude-mem，给 AI 加长期记忆。 十万一千颗星。它是去年八月就有的老项目，这个月涨了七千多，这一周三千三百多。 用 AI 写过代码的都知道，开一个新对话，它就全忘了。昨天修过的 bug，定好的方案，你得从头再讲一遍。 claude-mem 会在后台盯着 AI 每次用了什么工具、改了什么，自动记下来，再用 AI 压缩成一条条摘要，存进本地数据库。 下次开新对话，它不是把所有东西一股脑塞回去，而是先查索引，挑出相关的几条，需要了再取细节。官方说，这样大概能省十倍的 token。 Claude Code、Codex、Gemini、OpenCode 都能装。 装上以后，你的 AI 就像一个一直跟着这个项目的老同事，上次聊到哪，它都记得。 06 free-claude-code github.com/Alishahryar1/f… 第六个，free-claude-code，免费用上 AI 编程工具。 六万零八百颗星，一月底建库，这一周涨了三千七百多。 Claude Code、Codex 这些编程工具很好用，但是贵。它的做法，是在你电脑上起一个代理，把这些工具发出去的请求，转给别的模型服务商。 它接了六十一家服务商，包括各家的免费额度，合起来一个月有十三亿多免费 token，也能接你本地的模型。默认用的是英伟达 NIM 上的模型。 十一种编程工具共用一个模型目录。某一家服务挂了，它自动切到你排好的下一个模型，这一轮对话不用重来。 你甚至可以在手机上，用 Telegram 或者 Discord 发一段语音，让它去写代码。 要说清楚，它不是 Anthropic 官方的项目，背后跑的也不是 Claude 本身的模型。但如果你想先零成本试试这类 AI 编程工具，这是现在门槛最低的一条路。 07 knowledge-work-plugins github.com/anthropics/kno… 第七个，knowledge-work-plugins，这个是 Anthropic 官方出的。 两万九千八百颗星，一月份建库，这一周涨了两千六百多。 前面几个都是给写代码的人用的，这个是给不写代码的人：销售、法务、财务、市场、客服、产品经理、做数据的，还有做生物研究的。 一个岗位一个插件，一共十一个。每个插件里打包了这个岗位的专业知识、常用流程、斜杠命令，还接好了公司里常用的工具，比如 Slack、Notion、HubSpot、Snowflake。 比如装了销售插件，打一个命令，它就帮你把客户电话要准备的东西备好；装了法务插件，可以先帮你过一遍合同和保密协议。 而且整个插件只是一堆 Markdown 和 JSON 文件，没有代码。把你们公司的术语和流程写进去，它就变成你们公司自己的版本。 它主要配合 Claude 的 Cowork 用，在 Claude Code 里也能装。 08 AirLLM github.com/lyogavin/airllm 第八个，AirLLM，用小显卡跑超大模型。 三万八千八百颗星。这是二零二三年就有的老项目，这周突然又涨了三千二百多，因为它刚支持了一批新的超大模型。 平时跑一个七百亿参数的模型，要好几张大显卡，因为整个模型得一次全塞进显存。 AirLLM 的思路很简单：模型本来就是一层一层算的，那就别全装进去。模型放在硬盘上，算到哪一层，就只把那一层搬进显存，算完扔掉，再搬下一层。 不用量化，不用蒸馏，也不用剪枝。七百亿参数的模型，四个 G 显存就能跑。现在最大的开源模型 Kimi K3，两万八千亿参数，实测只用了三点七二个 G 的显存。 上个月它还支持了训练：一千二百五十亿参数的模型，六个 G 显存以内就能微调。 代价是慢，它是拿时间换显存。但这意味着，你手边一台普通电脑，也能亲手试一试原来只有机房才跑得动的模型。 09 text-to-cad github.com/earthtojake/te… 第九个，text-to-cad，一句话做出能加工的零件。 两万零七百颗星，四月下旬才建库，这个月涨了四千八百，这一周将近两千。 以前做一个 3D 零件，得打开建模软件，画草图、拉伸、倒角，一步一步建。 现在你跟 AI 说：给我做一个固定树莓派的支架，四个 M2.5 的螺丝孔，壁厚两毫米。它就在你本地生成 3D 模型，导出 STEP、STL、3MF 这些标准格式。 它还会做可制造性检查，看这个零件到底能不能加工出来，再出一张带尺寸的工程图。 最后还能直接连到 3D 打印、钣金和 CNC 加工服务，下单，把实物做出来。 Claude Code、Codex、Cursor、Gemini 都能装。从一句话到一个拿在手里的零件，中间不需要你会建模。 10 OpenSRE github.com/Tracer-Cloud/o… 最后一个，OpenSRE，让 AI 帮你值夜班。 一万一千九百颗星，一月份建库，现在还是公开测试版。 SRE 就是负责线上服务稳定的工程师。半夜服务出了问题，证据散在日志、监控指标、调用链路、最近的发布记录，还有一堆聊天消息里，得一个个去翻。 OpenSRE 是一套开源工具，让你搭自己的 AI SRE。告警一来，它自动去拉相关的日志、指标、链路和最近的部署，先把敏感的标识打上码，再交给模型。 模型在你接好的六十多种工具之间来回查，提出假设、验证假设，最后给你一个带证据的结论，建议怎么修，你同意的话还能直接动手修，再把总结发到 Slack。 你也可以在命令行里直接问它：为什么结账接口变慢了？ 他们想做的，是 AI 运维的训练场：把成千上万种真实的线上故障做成测试，让 AI 在里面练。

万字总结了一下如何去 成为 Agent开发工程师必须掌握的技能，不仅仅包含 Agent 的东西，还有 LLM 基础和后端基础，希望能帮到大家，也欢迎评论区交流补充🥰 x.com/i/article/2108…

I wrote a quick new post on "Digital Hygiene". Basically there are some no-brainer decisions you can make in your life to dramatically improve the privacy and security of your computing and this post goes over some of them. Blog post link in the reply, but copy pasting below too. Every now and then I get reminded about the vast fraud apparatus of the internet, re-invigorating my pursuit of basic digital hygiene around privacy/security of day to day computing. The sketchiness starts with major tech companies who are incentivized to build comprehensive profiles of you, to monetize it directly for advertising, or sell it off to professional data broker companies who further enrich, de-anonymize, cross-reference and resell it further. Inevitable and regular data breaches eventually runoff and collect your information into dark web archives, feeding into a whole underground spammer / scammer industry of hacks, phishing, ransomware, credit card fraud, identity theft, etc. This guide is a collection of the most basic digital hygiene tips, starting with the most basic to a bit more niche. Password manager. Your passwords are your "first factor", i.e. "something you know". Do not be a noob and mint new, unique, hard passwords for every website or service that you sign up with. Combine this with a browser extension to create and Autofill them super fast. For example, I use and like 1Password. This prevents your passwords from 1) being easy to guess or crack, and 2) leaking one single time, and opening doors to many other services. In return, we now have a central location for all your 1st factors (passwords), so we must make sure to secure it thoroughly, which brings us to... Hardware security key. The most critical services in your life (e.g. Google, or 1Password) must be additionally secured with a "2nd factor", i.e. "something you have". An attacker would have to be in possession of both factors to gain access to these services. The most common 2nd factor implemented by many services is a phone number, the idea being that you get a text message with a pin code to enter in addition to your password. Clearly, this is much better than having no 2nd factor at all, but the use of a phone number is known to be extremely insecure due to the SIM swap attack. Basically, it turns out to be surprisingly easy for an attacker to call your phone company, pretend they are you, and get them to switch your phone number over to a new phone that they control. I know this sounds totally crazy but it is true, and I have many friends who are victims of this attack. Therefore, purchase and set up hardware security keys - the industrial strength protection standard. In particular, I like and use YubiKey. These devices generate and store a private key on the device secure element itself, so the private key is never materialized on a suspiciously general purpose computing device like your laptop. Once you set these up, an attacker will not only need to know your password, but have physical possession of your security key to log in to a service. Your risk of getting pwned has just decreased by about 1000X. Purchase and set up 2-3 keys and store them in different physical locations to prevent lockout should you physically lose one of the keys. The security keys support a few authentication methods. Look for "U2F" in the 2nd factor settings of your service as the strongest protection. E.g. Google and 1Password support it. Fallback on "TOTP" if you have to, and note that your YubiKeys can store TOTP private keys, so you can use the YubiKey Authenticator app to access them easily through NFC by touching your key to the phone to get your pin when logging in. This is significantly better than storing TOTP private keys on other (software) authenticator apps, because again you should not trust general purpose computing devices. It is beyond the scope of this post to go into full detail, but basically I strongly recommend the use of 2-3 YubiKeys to dramatically strengthen your digital security. Biometrics. Biometrics are the third common authentication factor ("something you are"). E.g. if you're on iOS I recommend setting up FaceID basically everywhere, e.g. to access the 1Password app and such. Security questions. Dinosaur businesses are obsessed with the idea of security questions like "what is your mother's maidan name?", and force you to set them up from time to time. Clearly, these are in the category of "something you know" so they are basically passwords, but conveniently for scammers, they are easy to research out on the open internet and you should refuse any prompts to participate in this ridiculous "security" exercise. Instead, treat security questions like passwords, generate random answers to random questions, and store them in your 1Password along with your passwords. Disk encryption. Always ensure that your computers use disk encryption. For example, on Macs this total no-brainer feature is called "File Vault". This feature ensures that if your computer gets stolen, an attacker won't be able to get the hard disk and go to town on all your data. Internet of Things. More like @internetofshit. Whenever possible, avoid "smart" devices, which are essentially incredibly insecure, internet-connected computers that gather tons of data, get hacked all the time, and that people willingly place into their homes. These things have microphones, and they routinely send data back to the mothership for analytics and to "improve customer experience" lol ok. As an example, in my younger and naive years I once purchased a CO2 monitor from China that demanded to know everything about me and my precise physical location before it would tell me the amount of CO2 in my room. These devices are a huge and very common attack surface on your privacy and security and should be avoided. Messaging. I recommend Signal instead of text messages because it end-to-end encrypts all your communications. In addition, it does not store metadata like many other apps do (e.g. iMessage, WhatsApp). Turn on disappearing messages (e.g. 90 days default is good). In my experience they are an information vulnerability with no significant upside. Browser. I recommend Brave browser, which is a privacy-first browser based on Chromium. That means that basically all Chrome extensions work out of the box and the browser feels like Chrome, but without Google having front row seats to your entire digital life. Search engine. I recommend Brave search, which you can set up as your default in the browser settings. Brave Search is a privacy-first search engine with its own index, unlike e.g. Duck Duck Go which basically a nice skin for Bing, and is forced into weird partnerships with Microsoft that compromise user privacy. As with all services on this list, I pay $3/mo for Brave Premium because I prefer to be the customer, not the product in my digital life. I find that empirically, about 95% of my search engine queries are super simple website lookups, with the search engine basically acting as a tiny DNS. And if you're not finding what you're looking for, fallback to Google by just prepending "!g" to your search query, which will redirect it to Google. Credit cards. Mint new, unique credit cards per merchant. There is no need to use one credit card on many services. This allows them to "link up" your purchasing across different services, and additionally it opens you up to credit card fraud because the services might leak your credit card number. I like and use privacy dot com to mint new credit cards for every single transaction or merchant. You get a nice interface for all your spending and notifications for each swipe. You can also set limits on each credit card (e.g. $50/month etc.), which dramatically decreases the risk of being charged more than you expect. Additionally, with a privacy dot com card you get to enter totally random information for your name and address when filling out billing information. This is huge, because there is simply no need and totally crazy that random internet merchants should be given your physical address. Which brings me to... Address. There is no need to give out your physical address to the majority of random services and merchants on the internet. Use a virtual mail service. I currently use Earth Class Mail but tbh I'm a bit embarrassed by that and I'm looking to switch to Virtual Post Mail due to its much strong commitments to privacy, security, and its ownership structure and reputation. In any case, you get an address you can give out, they receive your mail, they scan it and digitize it, they have an app for you to quickly see it, and you can decide what to do with it (e.g. shred, forward, etc.). Not only do you gain security and privacy but also quite a bit of convenience. Email. I still use gmail just due to sheer convenience, but I've started to partially use Proton Mail as well. And while we're on email, a few more thoughts. Never click on any link inside any email you receive. Email addresses are extremely easy to spoof and you can never be guaranteed that the email you got is a phishing email from a scammer. Instead, I manually navigate to any service of interest and log in from there. In addition, disable image loading by default in your email's settings. If you get an email that requires you to see images, you can click on "show images" to see them and it's not a big deal at all. This is important because many services use embedded images to track you - they hide information inside the image URL you get, so when your email client loads the image, they can see that you opened the email. There's just no need for that. Additionally, confusing images are one way scammers hide information to avoid being filtered by email servers as scam / spam. VPN. If you wish to hide your IP/location to services, you can do so via VPN indirection. I recommend Mullvad VPN. I keep VPN off by default, but enable it selectively when I'm dealing with services I trust less and want more protection from. DNS-based blocker. You can block ads by blocking entire domains at the DNS level. I like and use NextDNS, which blocks all kinds of ads and trackers. For more advanced users who like to tinker, pi-hole is the physical alternative. Network monitor. I like and use The Little Snitch, which I have installed and running on my MacBook. This lets you see which apps are communicating, how much data and when, so you can keep track of what apps on your computer "call home" and how often. Any app that communicates too much is sus, and should potentially be uninstalled if you don't expect the traffic. I just want to live a secure digital life and establish harmonious relationships with products and services that leak only the necessary information. And I wish to pay for the software I use so that incentives are aligned and so that I am the customer. This is not trivial, but it is possible to approach with some determination and discipline. Finally, what's not on the list. I mostly still use Gmail + Gsuite because it's just too convenient and pervasive. I also use 𝕏 instead of something exotic (e.g. Mastodon), trading off sovereignty for convenience. I don't use a VoIP burner phone service (e.g. MySudo) but I am interested in it. I don't really mint new/unique email addresses but I want to. The journey continues. Let me know if there are other digital hygiene tips and tricks that should be on this list. Link to blog post version in the reply, on my brand new Bear ʕ•ᴥ•ʔ blog cute 👇