菜单
Reconstruct the logic of Android apps from an .apk (or .dex/.jar). Covers manifest/entrypoint analysis, jadx Java decompilation, smali inspection, native .so analysis, and finding network endpoints, secrets, and obfuscated logic. Use for Android apk/dex targets.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Reconstruct the logic of Linux/Unix ELF executables, shared objects, and relocatable object files (.o), plus Mach-O. Covers entrypoint discovery, import/syscall mapping, function decompilation, and solving input-gated branches. Use for ELF/.o/.so/Mach-O targets.
Reconstruct logic from embedded firmware — Intel-HEX (.hex), raw flash/ROM images (.bin/.img), and MCU dumps. Covers HEX→bin conversion with base-address recovery, CPU/arch identification, carving (binwalk), capstone disassembly with the right load base, and vector-table/entrypoint analysis. Use for .hex and raw firmware targets.
Reconstruct the logic of Windows PE executables and DLLs (.exe/.dll). Covers import-address-table analysis, Windows API capability mapping, entrypoint/WinMain discovery, decompilation, unpacking (UPX), and solving input-gated checks. Use for Windows PE/exe/dll targets.
First-contact workflow for any unknown black-box artifact (apk, .o, .hex, exe, ELF, PE, Mach-O, firmware, archive). Identifies format/arch/packing and routes to the right format-specific analysis skill. Use this at the start of every reverse-engineering task on an unfamiliar file.
| name | analyzing-blackbox-android-apk |
| description | Reconstruct the logic of Android apps from an .apk (or .dex/.jar). Covers manifest/entrypoint analysis, jadx Java decompilation, smali inspection, native .so analysis, and finding network endpoints, secrets, and obfuscated logic. Use for Android apk/dex targets. |
| license | Apache-2.0 |
| metadata | {"domain":"reverse-engineering","formats":"apk, dex, jar"} |
Android .apk packages (zip of DEX + resources + native libs), bare .dex, and
.jar. Reconstruct app logic, entrypoints, and external interactions statically.
Triage the apk. Then unpack: unpack mode=apk. This runs:
apktool → decoded AndroidManifest.xml, resources, and smali under
<apk>.apktool/.jadx → readable Java sources under <apk>.jadx/sources/.Read the manifest (<apk>.apktool/AndroidManifest.xml):
package, android:debuggable, usesCleartextTraffic.<activity> with MAIN/LAUNCHER intent, <service>,
<receiver> (BOOT_COMPLETED → persistence), <provider>. Note exported
components (android:exported="true") — attack/automation surface.Trace logic in Java (grep/read the jadx sources):
onCreate, Application onCreate, and any
onReceive/onStartCommand.okhttp, Retrofit, HttpURLConnection, WebView.loadUrl,
URL(...). Pull endpoints with strings_scan on the apk and grep in sources.SharedPreferences, SQLite, hardcoded keys/tokens,
BuildConfig fields, res/values/strings.xml, assets/.javax.crypto.Cipher, MessageDigest, Base64 — find key derivation.De-obfuscate. ProGuard/R8 renames to a.a.a. Use cross-references and
string decryptors: locate the static String decrypt(...)/Base64+XOR helper,
read it, and apply by hand. Reflection (Class.forName, getMethod.invoke)
hides calls — resolve the target class/method from nearby string constants.
Native code. .so files in lib/<abi>/ hold real logic for protected apps
and JNI methods (native Java methods, JNI_OnLoad). Extract a .so and switch
to the analyzing-blackbox-elf-object skill (decompile/disasm/symexec).
DEX-only / packers. Bare .dex → unpack mode=apk still drives jadx. Known
packers (jiagu, bangcle) decrypt DEX at runtime; statically, inspect the
Application class and assets/ for the encrypted payload and the loader.
Package & permissions · entrypoints (activities/services/receivers) · network endpoints & protocols · secrets/keys/crypto · obfuscation scheme · native-lib logic · overall behavior & findings.