mobile-reverse

Q: How do I install mobile-reverse?

Run npx skills add https://github.com/zhaoxuya520/reverse-skill --skill mobile-reverse in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/mobile-reverse/ (personal) or .claude/skills/mobile-reverse/ (project).

by zhaoxuya520Mobile

Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.

Installs: 1.3K
Last 24h: +13
Trending rank: #7604
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/zhaoxuya520/reverse-skill --skill mobile-reverse

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads mobile-reverse automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Mobile Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-reverse.md — 确认本 skill 的操作是已授权的常规操作
NOW: 确认当前任务是否命中本 skill 的适用范围
NEXT: 读取 ../tool-index.md，校验工具可用性和实际路径
NEXT: 缺工具时调用 bootstrap，不要猜路径
ACT: 进入"工作流"第一步并执行，不要停在确认状态

Android + iOS 统一逆向方法论 Frida / Objection / OWASP MSTG / SSL Pinning Bypass

适用场景

Android APK 逆向与安全测试
iOS IPA 逆向与安全测试
移动应用运行时动态插桩
SSL Pinning / Root 检测 / 越狱检测绕过
移动端加密算法提取（AES/RSA/HMAC 密钥）
移动应用渗透测试（OWASP MASTG）
非 Root/越狱环境下的应用测试

四阶段工作流

Phase 1: 信息收集

Android：
□ APK 获取（Google Play / APKMirror / adb pull）
□ Manifest 分析: 权限、导出组件、Intent Filter、backup 标志
□ androguard: androguard analyze APK → 组件/权限/签名
□ APKLeaks: 硬编码 API Key / Token / Secret 扫描
□ 加固检测: 是否加壳（360/腾讯/梆梆/爱加密）

iOS：
□ IPA 获取（App Store / ipatool / Apple Configurator）
□ 解密 App Store 二进制: frida-ios-dump / Clutch
□ Info.plist 分析: ATS 配置、URL Scheme、Queries Schemes
□ class-dump: 导出 ObjC 类结构
□ 加固检测: 是否使用 Swift/ObjC 混淆

Phase 2: 静态分析

跨平台：
□ JADX-GUI: APK → Java 源码（Android）
□ Ghidra / Hopper: .so / Mach-O 反编译
□ radare2 / Cutter: CLI 快速侦察

Android 专项：
□ apktool d app.apk → smali 代码 + 资源
□ dex2jar: DEX → JAR → JD-GUI
□ smali/baksmali: Dalvik 字节码修改

iOS 专项：
□ class-dump: 导出 ObjC 头文件
□ Swift 符号恢复: swift-demangle
□ dsymutil: 调试符号提取
□ otool -L: 查看动态库依赖
□ jtool2: Mach-O 分析

Phase 3: 动态分析

Frida — 通用动态插桩：
□ frida-ps -U: 列出设备进程
□ frida-trace -U -i "open*" com.app: 追踪函数调用
□ 自定义 Hook 脚本: 修改参数/返回值、调用私有方法

Objection — Frida 增强层（无需写脚本）：
□ objection -g "com.app" explore
□ android root disable / ios jailbreak disable
□ android sslpinning disable / ios sslpinning disable
□ android keystore list / ios keychain dump
□ env / ls / sqlite connect

Frida Gadget（免 Root/越狱）：
□ 注入 frida-gadget.so / FridaGadget.dylib 到 APK/IPA
□ 重新签名 → 安装 → 无需设备权限即可 Hook
□ objection patchapk --source app.apk（全自动）

Phase 4: 网络分析

□ Burp Suite: 拦截 HTTP/HTTPS，修改请求/响应
□ mitmproxy: 脚本化代理（Python API）
□ Wireshark: PCAP 抓包分析
□ 证书安装: Android 用户证书 → 系统证书（Magisk + MoveCert）
□ SSL Pinning 绕过: Frida/Objection/Xposed/SSL Kill Switch 2
□ WebSocket / gRPC 流量分析

常见绕过速查

SSL Pinning

# Objection（最简）
objection -g "com.app" explore
android sslpinning disable

# Frida 通用脚本
frida -U -l ssl_pinning_bypass.js -f com.app

# Xposed（Android）
TrustMeAlready 模块 → 全局禁用证书校验

Root / 越狱检测

# Objection
android root disable
ios jailbreak disable

# Frida 自定义（多层检测）
Java.perform(function() {
    var RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");
    RootBeer.isRooted.implementation = function() { return false; };
    // 额外绕过: Magisk su 检测、frida-server 检测、/proc/self/maps 检测
});

反调试

# Android
frida -U -l anti_debug_bypass.js -f com.app
# 绕过: ptrace(TracerPid)、/proc/self/status、isDebuggerConnected()

# iOS
# 绕过: PT_DENY_ATTACH、sysctl CTL_KERN/KERN_PROC/KERN_PROC_PID
frida -U -l ios_anti_debug.js -f com.app

移动端加密提取

// Android — Hook Cipher.getInstance 获取密钥+算法
Java.perform(function() {
    var Cipher = Java.use("javax.crypto.Cipher");
    Cipher.getInstance.overload('java.lang.String').implementation = function(algo) {
        console.log("[Cipher] Algorithm: " + algo);
        return this.getInstance(algo);
    };
    Cipher.init.overload('int', 'java.security.Key').implementation = function(mode, key) {
        console.log("[Cipher] Key: " + bytesToHex(key.getEncoded()));
        return this.init(mode, key);
    };
});

// iOS — Hook CCCrypt
Interceptor.attach(Module.findExportByName("libcommonCrypto.dylib", "CCCrypt"), {
    onEnter: function(args) {
        console.log("CCCrypt op: " + args[0] + " alg: " + args[1]);
        console.log("Key: " + hexdump(args[3], { length: args[4].toInt32() }));
    }
});

工具链

工具	平台	用途
JADX-GUI	A	Java 反编译
apktool	A	APK 解包/重建
Ghidra	A+I	多架构反编译
Hopper	I	iOS 专用反汇编
Frida	A+I	动态插桩
Objection	A+I	Frida REPL 增强
MobSF	A+I	自动化 SAST+DAST
class-dump	I	ObjC 类导出
frida-ios-dump	I	IPA 解密
jtool2	I	Mach-O 分析
Burp Suite	A+I	HTTP 拦截
mitmproxy	A+I	脚本化代理

A=Android, I=iOS

参考

references/frida-objection-deep.md — Frida + Objection 深度用法
references/ios-reverse-guide.md — iOS 逆向专项
references/anti-detection-bypass.md — Root/越狱/反调试/SSL Pinning 绕过

任务完成自检（声称完成前 MUST 通过）

我是否执行了工作流中的每一步（而不是只阅读）？
我是否基于 tool-index 使用了真实工具路径？
我是否产出了可复现证据（命令/脚本/截图/报告）？
我是否完成并回写了 RULES 要求的 Checklist 项？

FAQ

What does the mobile-reverse skill do?

Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.

How do I install mobile-reverse?

Run npx skills add https://github.com/zhaoxuya520/reverse-skill --skill mobile-reverse in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/mobile-reverse/ (personal) or .claude/skills/mobile-reverse/ (project).

Which AI agents can use mobile-reverse?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is mobile-reverse safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains mobile-reverse?

It is published by zhaoxuya520 in zhaoxuya520/reverse-skill. It has 1,266 recorded installs.

More from zhaoxuya520/reverse-skill

View all →

reverse-engineering

zhaoxuya520/reverse-skill

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

Security1.9K installs

pentest-tools

zhaoxuya520/reverse-skill

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

Security1.8K installs

apk-reverse

zhaoxuya520/reverse-skill

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

Backend & APIs1.7K installs

reverse-skill-router

zhaoxuya520/reverse-skill

Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.

Security1.5K installs

ida-reverse

zhaoxuya520/reverse-skill

IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "看看这个exe", "分析这个dll", "帮我破解", "找一下密码", "这个软件怎么注册", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.

Backend & APIs1.5K installs

radare2

zhaoxuya520/reverse-skill

Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, rabin2, rasm2, radiff2, r2pipe, or asks for radare2 command help on Windows/Linux/macOS.

DevOps & Cloud1.4K installs

Popular mobile skills

View category →

design-mobile-apps

designed-by-ai/skills

Design mobile app screens with Sleek, edit Sleek projects, and implement their designs in React Native or HTML.

Mobile1.1M installs

ios-design

uizze.sh

Design and review iOS UI/UX for iPhone apps in SwiftUI, UIKit, or React Native. Use for mobile app design, screen redesigns, navigation flows, typography, forms, keyboard and safe-area layout, and accessibility checks. Apply Apple Human Interface Guidelines and consult real product references through the optional Uizze connection.

Mobile416.5K installs

vercel-react-native-skills

vercel-labs/agent-skills

React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.

OfficialMobile256.7K installs

animate-expo

emilkowalski/skills

Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use animate.

Mobile140.1K installs

xcode-project-setup

firebase/agent-skills

Safely modifies Xcode projects (.pbxproj) to add Swift Packages and link files. Use this skill whenever an iOS project needs dependencies installed (e.g. Firebase, Alamofire).

OfficialMobile131.2K installs

firebase-remote-config-basics

firebase/agent-skills

Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.

OfficialMobile121.7K installs

mobile-reverse

Install

Install

Describe the task

Review the result

SKILL.md

Mobile Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

适用场景

四阶段工作流

Phase 1: 信息收集

Phase 2: 静态分析

Phase 3: 动态分析

Phase 4: 网络分析

常见绕过速查

SSL Pinning

Root / 越狱检测

反调试

移动端加密提取

工具链

参考

任务完成自检（声称完成前 MUST 通过）

FAQ

More from zhaoxuya520/reverse-skill

Popular mobile skills