r0crawl-skills

name

r0crawl-skills

description

A beginner-friendly full-spectrum reverse-engineering router for Web/JavaScript, Android/iOS, Frida, unpacking, anti-analysis, native binaries, protocols, firmware, malware, games, cloud APIs, CTFs, and reproducible parity testing. Use for reverse, start, unpack, decompile, hook, Frida, bypass detection, APK/SO/DEX/JS/PCAP/WASM/PE/ELF/Mach-O analysis, signature recovery, or a complete investigation from sample to verified result.

r0crawl_skills

Chinese guide

Beginner-first contract

Before using advanced tools, explain:

1. What the target is: web page, JavaScript, APK, DEX, native library, binary, protocol, firmware, or sample.
2. What action matters: launch, login, search, upload, payment, encryption, validation, or network exchange.
3. What material exists: file, URL, HAR, PCAP, log, screenshot, dump, source, or only a description.
4. What result is wanted: explain behavior, locate an entry, write a hook, unpack a runtime artifact, reproduce a request, or write a report.

If no artifact exists, provide a short collection plan instead of pretending to analyze an invisible target.

Start protocol

For start, reverse start, mixed start, or full reverse:

1. Run triage-and-route.
2. Create evidence and a timeline with evidence-collection.
3. Split work into static, runtime, loading/unpacking, protocol, and data-flow tracks.
4. Load only modules matched by the routing tables.
5. Use reconstruction-and-parity for a minimal reproducible result.
6. Use systematic-debugging for every mismatch.
7. Report a beginner summary first, then a technical appendix.

Core routing

Signal	Load first
APK, AAB, DEX, smali, class loader	android-static-analysis, android-unpacking-and-dumping, dex-memory-dump
APK protection, shell, packer, loader, OEP	apk-protection-analysis, native-unpacking, packer-and-loader-analysis
SO, PE, ELF, Mach-O, assembly, decompiler	native-binary-analysis, ida-ghidra-workflow, symbol-recovery-and-structs
Frida, Java.perform, Interceptor, spawn, attach	frida-dynamic-analysis, frida-stealth-hooking
anti-Frida, maps, ports, threads, Gadget, Root, emulator	frida-anti-detection-analysis, root-emulator-detection, anti-analysis-and-integrity
JavaScript hook, fetch, XHR, WebSocket, Proxy, getter/setter	js-hook-engineering, browser-runtime-tracing, webcrypto-hooking
Worker, iframe, ServiceWorker, Blob URL, importScripts	js-worker-hooking, browser-runtime-tracing
obfuscation, JSFuck, AAEncode, webpack, flattened control flow	js-deobfuscation, ast-program-analysis, ollvm-deobfuscation
JSVMP, VMP, opcode, DSL VM, virtual machine	jsvmp-vmp-analysis, virtualization-protection, script-vm-sandbox-analysis
sign, token, cookie, header, encrypted request or response	web-signature-analysis, crypto-dataflow-analysis, reconstruction-and-parity
browser environment, canvas, WebGL, webdriver, fingerprint	browser-env-emulation, browser-fingerprint-analysis
captcha, challenge, WAF, 403, 412, risk control	captcha-protocol-analysis, anti-bot-analysis

Vendor and scenario shortcuts

Clue	Shortcut module
Geetest	vendor-geetest-captcha
Tencent TCaptcha	vendor-tencent-tcaptcha
NetEase Yidun	vendor-netease-yidun
Dingxiang	vendor-dingxiang-captcha
Shumei	vendor-shumei-captcha
Aliyun NVC, AWSC, Baxia	vendor-aliyun-nvc-baxia
JD jcap, H5ST	vendor-jd-jcap-h5st
Ruishu RS, 412, acw_sc	vendor-ruishu-rs
Akamai, _abck, bm_sz, sensor_data	vendor-akamai-bm
Cloudflare, Turnstile, clearance	vendor-cloudflare-waf, vendor-cloudflare-turnstile
AWS WAF, aws-waf-token	vendor-aws-waf
Imperva, Incapsula, Reese84	vendor-imperva-incapsula
DataDome, PerimeterX, Kasada	vendor-datadome, vendor-perimeterx, vendor-kasada
Douyin/TikTok a_bogus, x-bogus	web-douyin-abogus-xbogus
Xiaohongshu x-s, x-t	web-xiaohongshu-xs-xt
Taobao/Tmall MTOP, H5ST	web-taobao-mtop-h5st
Meituan mtgsig	web-meituan-mtgsig
Zhihu zse	web-zhihu-zse
Xueqiu acw, md5__1038	web-xueqiu-acw
WeChat Mini Program	wechat-miniprogram-reversing
React Native, Flutter, Electron	react-native-reversing, flutter-dart-reversing, electron-app-reversing

Evidence contract

Use this case layout:

case/
  case.yaml
  evidence/raw/
  evidence/derived/
  notes/timeline.md
  notes/hypotheses.md
  repro/
  tests/fixtures.jsonl
  report.md

Every result must include a plain-English summary, evidence, route, reproducible check, limitations, and next action. Never treat a static string, one log line, or an automatic decompiler result as a confirmed call chain without independent validation.

Module catalog

Specialized modules live under skills/<name>/SKILL.md. Read only the modules matched by the routing tables. See references/catalog.md, references/tool-matrix.md, references/evidence.md, and docs/BEGINNER.md.