| name | hermes-apk-reverse-engineering |
| description | Analyze authorized Android APK workspaces with evidence-first APKTool, Smali, native-library, manifest, and Flutter integration workflows. |
Hermes+ Android Workspace Integrity Skill
This skill implements the canonical GEMINI.md contract for authorized Android workspace analysis and transformation. It is complementary guidance; when it differs from GEMINI.md, the root workspace contract is authoritative.
Evidence-first workflow
| Stage | Action | Required evidence |
|---|
| Decode | Run decompile_apk into a dedicated workspace. | Input path/hash, package, SDK values, manifest path, Smali roots, and ABI directories. |
| Analyze | Run analyze_injection_surface without workspace mutation. | Application/activity/JNI/Flutter findings, warnings, and candidate hooks. |
| Prepare | Build or validate the Flutter payload. | ABI coverage, native libraries, assets, build mode, engine identity, and warning set. |
| Integrate | Run inject_flutter_runtime_and_smali only after selecting a supported mode. | Generated descriptors, changed files, register/lifecycle evidence, and warnings. |
| Configure | Run patch_manifest_and_config for reviewed manifest changes. | Exact component, permission, application, and rendering deltas. |
| Verify | Run recompile_align_and_sign as the final output step. | Build, alignment, signature, certificate context, output path, and artifact classification. |
Smali and Android integrity rules
- Treat
.registers, .locals, wide values, parameter registers, labels, and try/catch regions as executable contracts. Never insert instructions based only on a textual method-name match when an overload/signature or control-flow location remains ambiguous.
- Keep
invoke-super and host lifecycle behavior intact. The optional attachBaseContextHook is inserted after base-context attachment and must be reported as unavailable rather than silently skipped when the target lacks a suitable method.
- Validate every generated class descriptor, manifest class name, resource identifier, asset path, and ABI directory against the decoded workspace before building.
- Keep analysis read-only. Any tool that copies assets/libraries, creates Smali, changes XML, runs a build command, writes a signed APK, or replaces an output must disclose that behavior in its result and MCP annotations.
Flutter mode decision table
| Mode | Decision rule |
|---|
activity_overlay | Preferred user-interface mode. Require a cached engine before activity launch and preserve route/entrypoint decisions made before engine startup. |
direct_application_hook | Use only when the target Application class and method implementation are resolvable. Record all changed host methods. |
headless_engine | Use only for non-UI runtime work and do not invent activity or service lifecycle support. |
view_tree_injection | Experimental. Require an exact lifecycle-compatible adapter and host-specific validation before enabling. |
Native library and build policy
nativeLibraryFallback prevents generated initialization from crashing immediately when Flutter libraries cannot load. It is not a successful engine start and must remain visible in the warning set. Package output only after APKTool build, alignment, and signature verification succeed. Describe a default-key artifact as a debug/test artifact unless a verified signing relationship establishes otherwise.
Split sets and restoration
/merge performs split-set planning: validate package identity, version, signer, ABI, language/density, feature, and manifest dependencies before proposing an install set. Do not merge arbitrary split directories into a base APK. /revert is limited to verified patch-set backups and matching hashes; recorded telemetry alone is insufficient for a binary restore.
