android-reverse-engineering-complete

name	android-reverse-engineering-complete
description	End-to-end Android reverse-engineering workflow for APK/AAB/XAPK/AAR artifacts: framework fingerprinting, DEX/Java/Kotlin static analysis, Recaf and enigma-mcp coordination, JNI/ELF native tracing, dynamic sandbox validation, and structured API or call-flow recovery.
description_zh	覆盖 APK/AAB/XAPK/AAR 的完整安卓逆向流程：框架指纹、DEX/Java/Kotlin 静态分析、Recaf 与 enigma-mcp 协作、JNI/ELF native 跟踪、动态沙盒验证以及 API/调用链报告。
triggers	["安卓逆向工程","反编译 APK","分析 AAB","提取 Android API","JNI native 分析","Android reverse engineering"]
provenance	{"origin":"openstarry-code","license":"Apache-2.0","maintained_by":"OpenStarry Code contributors"}
metadata	{"opensquilla":{"risk":"high","capabilities":["filesystem-read","filesystem-write","process-control"],"requires_tools":["exec_command","read_file","write_file"],"requires":{"bins":"[Truncated]"}}}

Android Reverse Engineering Complete

This skill incorporates the workflow themes from the Forinxy Android reverse-engineering skill collection. Keep the original package, split packages, signing metadata, and derived outputs separate.

Phase 1: fingerprint and inventory

Hash the artifact and record package/application IDs, versions, split APKs, ABIs, manifest/exported components, permissions, certificates, DEX count, assets, native libraries, frameworks (native Kotlin/Java, Flutter, React Native, Cordova, Xamarin), and network stacks. For Flutter/RN/Cordova/Xamarin, route to framework-specific assets instead of assuming DEX contains the core logic.

Phase 2: managed static analysis

Decode resources with apktool and decompile DEX with jadx; use dex2jar plus Recaf/Vineflower when a second Java view is useful. Build a UI-to-storage and UI-to-network call graph, identify reflection, dynamic loading, crypto, serialization, and exported component boundaries. Use enigma-mcp in the background for reviewed class/member mappings and keep mapping evidence.

Phase 3: native boundary

Inventory lib/<abi>/*.so, locate System.loadLibrary/dlopen, then resolve static Java_* exports and dynamic RegisterNatives/JNI_OnLoad. Match each managed declaration to module, ABI, runtime address, and offset. Hand native residue and protected libraries to native-residue-triage or vmp-3x-native-deobfuscation.

Phase 4: dynamic sandbox

Run the copied package in an emulator or dynamic sandbox with a clean snapshot. Capture one reproducible flow: action, process/thread, API request, JNI call, native module/offset, input, output, and relevant logcat/Frida/IDA evidence. Change one variable per replay and keep test data synthetic.

Completion report

Deliver hashes, decoded resource/DEX trees, component and permission matrix, call graph, endpoint table, Recaf/enigma mappings, JNI/native table, dynamic traces, reproduction steps, and unresolved or framework-specific portions.