entropy▌

Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines. Activates for requests involving ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, or real-time encryption activity alerting.

More code begets more code. Entropy accumulates. This skill biases toward the smallest possible codebase.

Minimize total codebase size by systematically identifying and removing unnecessary code. \n \n Focuses on final code amount, not effort or churn; a 50-line addition that deletes 200 lines is a win \n Requires loading a reference mindset from the skill's philosophy directory before proceeding \n Applies three core questions: what's the smallest codebase that solves this, does the change reduce total code, and what can be deleted as a result \n Flags common traps like status quo bias, premature f