AUTO_REVERSE

Fully automated reverse-engineering orchestrator. Given a target (Android APK/AAB/XAPK, web URL, or Windows PE), it drives the end-to-end workflow — fingerprinting → planning the analysis chain → static analysis → dynamic analysis → native deep-dive → result synthesis → reproduction & verification — and produces a structured report. This is the entry point of the auto_reverse project, responsible for deciding "which skill/tool to invoke and when, and what to do next once results come back." Trigger scenarios: automated reversing, "reverse this app/website," auto-reverse, fully automated analysis, "here's an APK, run it automatically," "I don't know where to start."

Generic dynamic instrumentation / trace engine for heavily-obfuscated anti-bot JavaScript. Takes ANY obfuscated JS, weaves Babel AST probes (function enter/exit, variable assignments, member reads), recursively re-instruments every runtime-generated string (eval / new Function / string setTimeout) so code that only exists after decryption is also traced, runs it bare in a Node harness on top of an env-supplement-proxy environment, and dumps an aggregated execution trace (hot functions, hot variables, dynamic code-gen layers, candidate sign outputs). Ships an L2 anti-detection prelude (clock freeze defeats timing anti-debug; DebuggerStatement stripping; eval/Function toString spoofing). This is the OBSERVATION layer that stacks on top of env-supplement-proxy / node-bridge-build (which make the JS RUN) — it shows HOW the algorithm computes, not just its output. Use when you must understand the internal computation of obfuscated sign/cookie JS, capture runtime-decrypted algorithm code, or produce an execution tr

Use capa (Mandiant) + FLOSS to perform capability triage and string deobfuscation on native libraries (.so / ELF) and executables—before diving into IDA/Ghidra decompilation, automatically identify what capabilities a binary has (crypto/network/anti-debug/anti-analysis/file operations) and recover obfuscated/encoded/stack-built strings (URLs, keys, C2). Trigger scenarios — capa, floss, analyze .so capabilities, identify crypto algorithms, native library capability overview, deobfuscate strings, triage before digging deep.

Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows. Trigger keywords: decompile APK, Android reverse engineering, extract API, analyze Android app, decompile Android, reverse engineering, trace call chain, extract interfaces

Android reverse-engineering onboarding and fundamentals. Covers device preparation and rooting (unlock bootloader, flash a clean ROM, Magisk root, real-device vs emulator trade-offs), full environment setup (JDK, adb/fastboot, Frida server/tools, Charles/mitmproxy CA certificates), APK internal structure and the forward packaging pipeline, the Android filesystem and partition layout, decompile-and-hook basics, and phone UI automation. Use this when bootstrapping an Android RE workstation, when the user is new to Android reverse engineering, or when they ask how to root a phone, set up Frida/adb/Charles, understand APK/DEX structure, learn the Android filesystem, or automate a device. Trigger keywords — android reverse engineering basics, set up Frida, install adb, root phone, unlock bootloader, flash ROM, Magisk, APK structure, DEX, AndroidManifest, Android filesystem, phone automation, uiautomator2, Charles certificate, JDK install, Android reverse engineering getting started, flashing ROM, root, environment

Fully automatic APK acquisition for Android reversing. Given a package name, it obtains the APK through the first route that works — pull from a connected adb device, use a local file, or download from APKPure's direct-link endpoint (XAPK with splits or single APK) — then optionally installs it back to a device and verifies the package name. This is Phase 0 (Intake) of the auto_reverse orchestrator: it answers "I don't have the APK yet, get it for me" without manual confirmation. Trigger terms: get the apk, download apk, acquire apk, pull apk, automatic apk acquisition, download apk, install apk, app not installed / not available locally.

Bilibili (Bilibili / B-site) Android API reverse-engineering skill — reconstruct Bilibili's APP-API protection and request signing end to end. Covers the APP-API `sign` parameter (appkey + appSecret + MD5 over sorted params, computed inside libbili.so), the `x-bili-ticket` JWT / GenWebTicket HMAC, the OAuth2 `access_key` / `refresh_token` refresh flow, native gRPC capture, native SSL plaintext interception (SSL_write/SSL_read), and the comment API (/x/v2/reply/add). Use when the user mentions bilibili, B-site, Bilibili, BiliDroid, libbili.so, APP-API sign, appkey 1d8b6e7d45233436, x-bili-ticket, access_key / refresh_token refresh, or any reversing of Bilibili Android API requests.

Fully automated Android HTTPS capture skill built on Frida + mitmproxy. Injects an SSL bypass script via attach mode (defeating conscrypt / OkHttp CertificatePinner / NetworkSecurityConfig) and forwards traffic to mitmproxy over adb reverse USB forwarding, saving it as JSONL. Use cases: (1) capturing an Android app's HTTPS traffic; (2) analyzing the API requests triggered by a given action (parameters, signatures, encrypted fields); (3) locating the API when you don't know which endpoints a feature calls. Trigger terms: traffic capture, Frida MITM, SSL bypass, HTTPS decryption, API reversing, certificate pinning bypass.

Build an "environment-patching" fallback bridge for anti-bot SDKs (e.g. PerimeterX / Akamai / similar vendors) using jsdom + 11 env-patching modules + a Python curl_cffi coordinator, without relying on a real browser. Trigger scenarios: (1) a pure-algorithm generator temporarily breaks because the SDK was upgraded and you need a Plan B firefight; (2) a new-site spike — get something working in 30 minutes, then decide whether a pure-algorithm approach is worth it; (3) high-bar endpoints (such as the iFood feed) where the pure-algorithm score is not good enough; (4) adapting the existing ifood/ template to a new site (Grubhub / Walmart / Doordash, etc.). Trigger keywords: node bridge env patching / jsdom fake browser / PX SDK fallback / SDK upgrade emergency / build a bridge for <site> / env-patching template adaptation.

PerimeterX / HUMAN Security SDK reverse-engineering skill — an end-to-end workflow from packet capture to generating _px3/_px2 cookies. Includes 9 algorithm modules (payload/PC/OB/SID/UUID/anti-tamper/hash/memory/ns), CLI tool scripts, a cross-version location manual, a 27-entry OB handler shape-matching table, and 23 real-world gotchas. Validated against iFood + Grubhub (lenient) + Total Wine (strict) + Academy (strict+). Use when the user mentions PerimeterX, HUMAN Security, _pxN cookies, px-cloud.net, sensor.grubhub.com, pxcookie, or any reversing of PX collector POST traffic.

Drive a real Chrome browser via CDP (Chrome DevTools Protocol) for web automation, reverse-engineering, and information gathering. No webdriver fingerprint, does not trigger anti-bot defenses. Use cases: (1) website reverse-engineering (capturing APIs, analyzing JS, intercepting network requests); (2) web search and data collection; (3) web automation that must evade bot detection; (4) analyzing XHR/Fetch/WebSocket traffic; (5) any task requiring a real browser to access a website. Prefer this over the web_search, web_fetch, and browser tools.

Ruishu (Rivers Security) anti-bot pure-algorithm reversing — Cookie T generation + URL suffix handling

Android unpacking/unshelling—use frida-dexdump to dump the DEX released by a hardening packer from memory. Applicable when opening the APK in jadx only shows the packer stub and not the real business code (whole-release packers like Tencent Legu/Bangcle/360 hardening). Trigger scenarios — unpacking, unshelling, frida-dexdump, dump dex, hardening, can't see the real code, packer/shell, unpack.

A complete guide and workflow for decompiling, modifying, and repackaging Android APKs with apktool.

Comprehensive guide and patterns for writing Frida hook scripts for Android (Java & Native).

Patterns and workflows for using JADX MCP to reverse engineer Android applications.

A mitmproxy-based tool for capturing mobile-app network traffic, detecting encrypted parameters, and analyzing APIs.

Use objection (a Frida-based runtime mobile exploration tool) for one-command runtime analysis of Android apps—SSL pinning bypass, root/debugger detection bypass, in-memory class and method enumeration, heap object search and invocation, keystore/filesystem browsing, and runtime hooking, all without hand-writing a Frida script for each target. Trigger scenarios — runtime exploration, objection, SSL unpinning, list loaded classes, dump in-memory objects, bypass root detection, explore an app's runtime state.

iOS app reverse-engineering automation skill. Onboard the device (jailbreak/TrollStore/re-sign) → decrypt/dump the binary → class-dump/binary analysis → Frida dynamic (SSL unpin/jailbreak-detection bypass/keychain) → re-sign and deploy, using iOS tools from the catalog throughout (fetch on demand if missing). Trigger scenarios — reverse an iOS app, decrypt/dump the binary, decrypt IPA, class-dump, iOS Frida, jailbreak-detection bypass, iOS SSL pinning, Mach-O analysis, dyld_shared_cache.

Use Ghidra (the free NSA reverse-engineering framework) + GhidraMCP to analyze Android native libraries (.so) and JNI interfaces—via MCP, let Claude drive Ghidra directly to do decompilation, cross-references, function renaming, string/constant search, and P-code dataflow analysis; plus batch analysis with the analyzeHeadless headless scripting interface. This is the local free IDA replacement (use it when no IDA Pro license is available). Trigger scenarios — analyze .so, Ghidra, decompile native, locate JNI entry, view call graph, native algorithm, ghidra headless, drive Ghidra via MCP.

Workflows and patterns for using IDA MCP and idat (headless) to analyze Android native libraries and JNI interfaces.

Methodology for stubbing out the JNI environment when emulating an Android SO with unidbg. When native code calls back into the Java layer via JNI to obtain data (device info, credentials, system properties, etc.) and raises an UnsupportedOperationException or a [JNI] unhandled error, follow the principle of "read the Java layer first, then supply a reasonable value" and implement these callbacks in an AbstractJni subclass. Trigger scenarios: unidbg reports an unhandled JNI method; stubbing DvmClass/DvmObject/AbstractJni callbacks; crashes related to FindClass/GetStaticField/CallObjectMethod; simulating system properties such as SDK_INT/Build/TelephonyManager.

Guide to emulating Android SO files with Unidbg. Use the JVM-based unidbg framework to locally emulate Android ARM32/ARM64 .so files for reverse engineering, algorithm extraction, signature generation, and reconstructing Java/Native call chains. Covers project structure (unidbg-android/unidbg-api/backend), writing Emulator/DalvikVM/AbstractJni test classes, rootfs configuration, choosing among the Unicorn2/Dynarmic/KVM/Hypervisor backends, and wiring up JNI callbacks (together with jni-env-patching). Trigger scenarios: setting up a unidbg project, running a .so's JNI methods, extracting cryptographic signatures, emulating SO algorithms.

Castle.io (io.castle.android / "Highwind" engine, and the web castle.browser.js) anti-bot reversing — recover how the X-Castle-Request-Token + __cuid (x-castle-client-id) are generated, and reproduce them with an offline generator. Covers the Android native-Java SDK (v3.1.1, fully reversed: hex-assembled device fingerprint + 3-layer nibble-XOR + base64url, NO XXTEA) and the web/JS SDK (v2.6.0 / token v11, via the archived open-source reimpl). Use when a target sends X-Castle-Request-Token / x-castle-client-id, loads castle.browser(.min).js, calls Castle.createRequestToken(), or depends on io.castle.android. Trigger terms: Castle.io, X-Castle-Request-Token, x-castle-client-id, __cuid, io.castle.android, Highwind, castle.browser.js, createRequestToken.

Analyze website API endpoints and JS logic using Playwright. Intercept network requests, extract API patterns, capture encrypted parameters, and export HAR files. Use when the user wants to reverse-engineer a website's API calls, analyze request/response patterns, or understand JS encryption logic.

Windows PE reverse-engineering automation skill (.exe/.dll/.sys). Fingerprint/packer-and-language detection → route by type (.NET decompile / native decompile / unpack) → dynamic debugging → deobfuscation → capability triage, using Windows tools from the catalog throughout (fetch on demand if missing). Trigger scenarios — reverse a Windows program, analyze exe/dll, PE unpacking, .NET decompilation, packer detection, x64dbg debugging, malware sample analysis.