● Сообщество
SimoneAvogadro
⚡ Сразу
Android Reverse Engineering Skill
автор SimoneAvogadro · SimoneAvogadro/android-reverse-engineering-skill
Claude Code skill for Android APK reverse engineering — apktool, jadx, Frida workflows.
A skill bundle that teaches Claude how to do real Android reverse engineering: unpack APKs, decompile to Java with jadx, patch smali, hook with Frida. It chains the right tools instead of one-shotting jadx and giving up.
Зачем использовать
Ключевые функции
- End-to-end workflow: pull APK → unpack → decompile → search → patch → repack → sign
- Frida script scaffolding for runtime hooks
- Smali patching with checksum-safe repack
- Built-in checklists for common targets (cert pinning, root detection)
- Pairs with a
bin/ toolchain bootstrap
Живое демо
Как выглядит на практике
android-reverse-engineering-skill.replay
▶ готово
Сценарии использования
Реальные сценарии: Android Reverse Engineering Skill
Когда использовать: You need to inspect a Flutter/OkHttp app's traffic and pinning blocks Burp.
Предварительные требования
- Server/skill installed and authenticated — See repo README
Поток
-
Identify pinning
Decompile target.apk and find all references to TrustManager / CertificatePinner / Flutter's HttpClient.✓ Скопировано
→ List of hooks to patch
-
Patch + Frida
Generate a Frida script that no-ops checkServerTrusted across both Java and Flutter paths.✓ Скопировано
→ Frida .js + run command
Итог: Working MITM channel on a test target you own.
Подводные камни
- Reversing apps you don't have rights to is illegal in most jurisdictions. The skill assumes you've documented authorization. — Reversing apps you don't have rights to is illegal in most jurisdictions. The skill assumes you've documented authorization.
Стоимость и лимиты
Во что обходится
- Квота API
- See provider docs for rate limits
- Токенов на вызов
- Varies by tool
- Деньги
- See repo README for pricing details
- Совет
- Cache tool results and avoid repeated identical calls.
Безопасность
Права, секреты, радиус поражения
Хранение учётных данных: Use environment variables; never commit secrets
Исходящий трафик: Tool calls go to the provider's API as documented
Устранение неполадок
Частые ошибки и исправления
apktool fails to unpack
Use the latest apktool (≥2.9). Older versions miss new resource tables.
Проверить: apktool --version ≥ 2.9
repack signs but won't install
Use uber-apk-signer with --allow-resign and target the right SDK level.
Проверить: adb install -r app-signed.apk
Альтернативы
Android Reverse Engineering Skill в сравнении
| Альтернатива | Когда использовать | Компромисс |
|---|
| trailofbits/skills | You want broader security skills | More generic; less Android-specific |