root
25f2286cb6
README 242 -> 180 lines: the 14-row tool table becomes three sentences pointing at capabilities.py, Read this first merges into Scope, and the six-script maintenance block becomes a table. Every path, command and anchor is unchanged. README.zh-CN follows the same eight sections, and picks up two drifts: it named hwprobe.py as the cheapest first command (SKILL.md and the English README say doctor.py), and it translated triage as 'three categories', which sends a reader looking for categories that do not exist. docs/primer is the Windows reverse-engineering tutorial series with an index, corrected in three places: x64dbg instead of OllyDbg, offsets fixed only within one build, and IAT hooking assuming the target imports the API it hooks. docs/tool-acquisition keeps the part capabilities.py does not answer: licence classes, id resolution on the host, and what proves a tool runs.
Windows 逆向入门（讲义）
面向人的入门连载，按学习顺序读。它不是 skills/exe-reverse/ 的一部分：那个 skill 是给
agent 按症状和门禁查的，这里是把同一批概念按由浅入深的顺序铺开给读者。
篇目
| 文件 | 内容 |
|---|---|
exe1.md |
原理：程序怎么加载、基址与偏移、代码与数据的区别 |
exe2.md |
缺失（原连载未找到这一篇） |
exe3.md |
方法：找偏移的六条路 |
exe4.md |
利用：外部工具、DLL 注入与 hook |
exe5.md |
工具：CE、IDA、x64dbg |
读到这三处要注意
exe5.md的调试器是 x64dbg，不是早期教程里的 OD。OllyDbg 只支持 32 位且早已停止更新。exe1.md的“偏移固定”只在同一个构建内成立。同一份 exe 每次加载偏移不变，但重新编译就变； 跨版本要靠特征码重新定位，不能死记地址。exe3.md的“拦截系统函数”默认目标是走 IAT 的。运行时解析 API 或直接发系统调用的目标， 导入表里没有那一行，这一招会落空。
概念上和 skills/exe-reverse/SKILL.md 的 references/pe-structure.md、
references/recon.md、references/injection-and-hooking.md 对应；遇到具体操作时看 skill，不要只看讲义。