Fully automated reverse-engineering orchestrator. Given a target (Android APK/AAB/XAPK, web URL, or Windows PE), it drives the end-to-end workflow — fingerprinting → planning the analysis chain → static analysis → dynamic analysis → native deep-dive → result synthesis → reproduction & verification — and produces a structured report. This is the entry point of the auto_reverse project, responsible for deciding "which skill/tool to invoke and when, and what to do next once results come back." Trigger scenarios: automated reversing, "reverse this app/website," auto-reverse, fully automated analysis, "here's an APK, run it automatically," "I don't know where to start."
Generic dynamic instrumentation / trace engine for heavily-obfuscated anti-bot JavaScript. Takes ANY obfuscated JS, weaves Babel AST probes (function enter/exit, variable assignments, member reads), recursively re-instruments every runtime-generated string (eval / new Function / string setTimeout) so code that only exists after decryption is also traced, runs it bare in a Node harness on top of an env-supplement-proxy environment, and dumps an aggregated execution trace (hot functions, hot variables, dynamic code-gen layers, candidate sign outputs). Ships an L2 anti-detection prelude (clock freeze defeats timing anti-debug; DebuggerStatement stripping; eval/Function toString spoofing). This is the OBSERVATION layer that stacks on top of env-supplement-proxy / node-bridge-build (which make the JS RUN) — it shows HOW the algorithm computes, not just its output. Use when you must understand the internal computation of obfuscated sign/cookie JS, capture runtime-decrypted algorithm code, or produce an execution tr
Use capa (Mandiant) + FLOSS to perform capability triage and string deobfuscation on native libraries (.so / ELF) and executables—before diving into IDA/Ghidra decompilation, automatically identify what capabilities a binary has (crypto/network/anti-debug/anti-analysis/file operations) and recover obfuscated/encoded/stack-built strings (URLs, keys, C2). Trigger scenarios — capa, floss, analyze .so capabilities, identify crypto algorithms, native library capability overview, deobfuscate strings, triage before digging deep.
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows. Trigger keywords: decompile APK, Android reverse engineering, extract API, analyze Android app, decompile Android, reverse engineering, trace call chain, extract interfaces
Android reverse-engineering onboarding and fundamentals. Covers device preparation and rooting (unlock bootloader, flash a clean ROM, Magisk root, real-device vs emulator trade-offs), full environment setup (JDK, adb/fastboot, Frida server/tools, Charles/mitmproxy CA certificates), APK internal structure and the forward packaging pipeline, the Android filesystem and partition layout, decompile-and-hook basics, and phone UI automation. Use this when bootstrapping an Android RE workstation, when the user is new to Android reverse engineering, or when they ask how to root a phone, set up Frida/adb/Charles, understand APK/DEX structure, learn the Android filesystem, or automate a device. Trigger keywords — android reverse engineering basics, set up Frida, install adb, root phone, unlock bootloader, flash ROM, Magisk, APK structure, DEX, AndroidManifest, Android filesystem, phone automation, uiautomator2, Charles certificate, JDK install, Android reverse engineering getting started, flashing ROM, root, environment
Fully automatic APK acquisition for Android reversing. Given a package name, it obtains the APK through the first route that works — pull from a connected adb device, use a local file, or download from APKPure's direct-link endpoint (XAPK with splits or single APK) — then optionally installs it back to a device and verifies the package name. This is Phase 0 (Intake) of the auto_reverse orchestrator: it answers "I don't have the APK yet, get it for me" without manual confirmation. Trigger terms: get the apk, download apk, acquire apk, pull apk, automatic apk acquisition, download apk, install apk, app not installed / not available locally.
Bilibili (Bilibili / B-site) Android API reverse-engineering skill — reconstruct Bilibili's APP-API protection and request signing end to end. Covers the APP-API `sign` parameter (appkey + appSecret + MD5 over sorted params, computed inside libbili.so), the `x-bili-ticket` JWT / GenWebTicket HMAC, the OAuth2 `access_key` / `refresh_token` refresh flow, native gRPC capture, native SSL plaintext interception (SSL_write/SSL_read), and the comment API (/x/v2/reply/add). Use when the user mentions bilibili, B-site, Bilibili, BiliDroid, libbili.so, APP-API sign, appkey 1d8b6e7d45233436, x-bili-ticket, access_key / refresh_token refresh, or any reversing of Bilibili Android API requests.
Fully automated Android HTTPS capture skill built on Frida + mitmproxy. Injects an SSL bypass script via attach mode (defeating conscrypt / OkHttp CertificatePinner / NetworkSecurityConfig) and forwards traffic to mitmproxy over adb reverse USB forwarding, saving it as JSONL. Use cases: (1) capturing an Android app's HTTPS traffic; (2) analyzing the API requests triggered by a given action (parameters, signatures, encrypted fields); (3) locating the API when you don't know which endpoints a feature calls. Trigger terms: traffic capture, Frida MITM, SSL bypass, HTTPS decryption, API reversing, certificate pinning bypass.