● Communauté
SimoneAvogadro
⚡ Instantané
Android Reverse Engineering Skill
par SimoneAvogadro · SimoneAvogadro/android-reverse-engineering-skill
Claude Code skill for Android APK reverse engineering — apktool, jadx, Frida workflows.
A skill bundle that teaches Claude how to do real Android reverse engineering: unpack APKs, decompile to Java with jadx, patch smali, hook with Frida. It chains the right tools instead of one-shotting jadx and giving up.
Pourquoi l'utiliser
Fonctionnalités clés
- End-to-end workflow: pull APK → unpack → decompile → search → patch → repack → sign
- Frida script scaffolding for runtime hooks
- Smali patching with checksum-safe repack
- Built-in checklists for common targets (cert pinning, root detection)
- Pairs with a
bin/ toolchain bootstrap
Démo en direct
Aperçu en pratique
android-reverse-engineering-skill.replay
▶ prêt
Cas d'usage
Usages concrets : Android Reverse Engineering Skill
Quand l'utiliser : You need to inspect a Flutter/OkHttp app's traffic and pinning blocks Burp.
Prérequis
- Server/skill installed and authenticated — See repo README
Déroulement
-
Identify pinning
Decompile target.apk and find all references to TrustManager / CertificatePinner / Flutter's HttpClient.✓ Copié
→ List of hooks to patch
-
Patch + Frida
Generate a Frida script that no-ops checkServerTrusted across both Java and Flutter paths.✓ Copié
→ Frida .js + run command
Résultat : Working MITM channel on a test target you own.
Pièges
- Reversing apps you don't have rights to is illegal in most jurisdictions. The skill assumes you've documented authorization. — Reversing apps you don't have rights to is illegal in most jurisdictions. The skill assumes you've documented authorization.
Coût et limites
Coût d'exécution
- Quota d'API
- See provider docs for rate limits
- Tokens par appel
- Varies by tool
- Monétaire
- See repo README for pricing details
- Astuce
- Cache tool results and avoid repeated identical calls.
Sécurité
Permissions, secrets, portée
Stockage des identifiants : Use environment variables; never commit secrets
Sortie de données : Tool calls go to the provider's API as documented
Dépannage
Erreurs courantes et correctifs
apktool fails to unpack
Use the latest apktool (≥2.9). Older versions miss new resource tables.
Vérifier : apktool --version ≥ 2.9
repack signs but won't install
Use uber-apk-signer with --allow-resign and target the right SDK level.
Vérifier : adb install -r app-signed.apk
Alternatives
Android Reverse Engineering Skill vs autres
| Alternative | Quand l'utiliser | Compromis |
|---|
| trailofbits/skills | You want broader security skills | More generic; less Android-specific |