Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.
中文简介正在准备中。当前显示英语简介。
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
安装前可以查看交给 AI 代理的指令内容。
NOW: 读取 ../field-journal/precedent-reverse.md — 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取 ../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态Android + iOS 统一逆向方法论 Frida / Objection / OWASP MSTG / SSL Pinning Bypass
Android：
□ APK 获取（Google Play / APKMirror / adb pull）
□ Manifest 分析: 权限、导出组件、Intent Filter、backup 标志
□ androguard: androguard analyze APK → 组件/权限/签名
□ APKLeaks: 硬编码 API Key / Token / Secret 扫描
□ 加固检测: 是否加壳（360/腾讯/梆梆/爱加密）
iOS：
□ IPA 获取（App Store / ipatool / Apple Configurator）
□ 解密 App Store 二进制: frida-ios-dump / Clutch
□ Info.plist 分析: ATS 配置、URL Scheme、Queries Schemes
□ class-dump: 导出 ObjC 类结构
□ 加固检测: 是否使用 Swift/ObjC 混淆
跨平台：
□ JADX-GUI: APK → Java 源码（Android）
□ Ghidra / Hopper: .so / Mach-O 反编译
□ radare2 / Cutter: CLI 快速侦察
Android 专项：
□ apktool d app.apk → smali 代码 + 资源
□ dex2jar: DEX → JAR → JD-GUI
□ smali/baksmali: Dalvik 字节码修改
iOS 专项：
□ class-dump: 导出 ObjC 头文件
□ Swift 符号恢复: swift-demangle
□ dsymutil: 调试符号提取
□ otool -L: 查看动态库依赖
□ jtool2: Mach-O 分析
Frida — 通用动态插桩：
□ frida-ps -U: 列出设备进程
□ frida-trace -U -i "open*" com.app: 追踪函数调用
□ 自定义 Hook 脚本: 修改参数/返回值、调用私有方法
Objection — Frida 增强层（无需写脚本）：
□ objection -g "com.app" explore
□ android root disable / ios jailbreak disable
□ android sslpinning disable / ios sslpinning disable
□ android keystore list / ios keychain dump
□ env / ls / sqlite connect
Frida Gadget（免 Root/越狱）：
□ 注入 frida-gadget.so / FridaGadget.dylib 到 APK/IPA
□ 重新签名 → 安装 → 无需设备权限即可 Hook
□ objection patchapk --source app.apk（全自动）
□ Burp Suite: 拦截 HTTP/HTTPS，修改请求/响应
□ mitmproxy: 脚本化代理（Python API）
□ Wireshark: PCAP 抓包分析
□ 证书安装: Android 用户证书 → 系统证书（Magisk + MoveCert）
□ SSL Pinning 绕过: Frida/Objection/Xposed/SSL Kill Switch 2
□ WebSocket / gRPC 流量分析
# Objection（最简）
objection -g "com.app" explore
android sslpinning disable
# Frida 通用脚本
frida -U -l ssl_pinning_bypass.js -f com.app
# Xposed（Android）
TrustMeAlready 模块 → 全局禁用证书校验
# Objection
android root disable
ios jailbreak disable
# Frida 自定义（多层检测）
Java.perform(function() {
var RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");
RootBeer.isRooted.implementation = function() { return false; };
// 额外绕过: Magisk su 检测、frida-server 检测、/proc/self/maps 检测
});
# Android
frida -U -l anti_debug_bypass.js -f com.app
# 绕过: ptrace(TracerPid)、/proc/self/status、isDebuggerConnected()
# iOS
# 绕过: PT_DENY_ATTACH、sysctl CTL_KERN/KERN_PROC/KERN_PROC_PID
frida -U -l ios_anti_debug.js -f com.app
// Android — Hook Cipher.getInstance 获取密钥+算法
Java.perform(function() {
var Cipher = Java.use("javax.crypto.Cipher");
Cipher.getInstance.overload('java.lang.String').implementation = function(algo) {
console.log("[Cipher] Algorithm: " + algo);
return this.getInstance(algo);
};
Cipher.init.overload('int', 'java.security.Key').implementation = function(mode, key) {
console.log("[Cipher] Key: " + bytesToHex(key.getEncoded()));
return this.init(mode, key);
};
});
// iOS — Hook CCCrypt
Interceptor.attach(Module.findExportByName("libcommonCrypto.dylib", "CCCrypt"), {
onEnter: function(args) {
console.log("CCCrypt op: " + args[0] + " alg: " + args[1]);
console.log("Key: " + hexdump(args[3], { length: args[4].toInt32() }));
}
});
| 工具 | 平台 | 用途 |
|---|---|---|
| JADX-GUI | A | Java 反编译 |
| apktool | A | APK 解包/重建 |
| Ghidra | A+I | 多架构反编译 |
| Hopper | I | iOS 专用反汇编 |
| Frida | A+I | 动态插桩 |
| Objection | A+I | Frida REPL 增强 |
| MobSF | A+I | 自动化 SAST+DAST |
| class-dump | I | ObjC 类导出 |
| frida-ios-dump | I | IPA 解密 |
| jtool2 | I | Mach-O 分析 |
| Burp Suite | A+I | HTTP 拦截 |
| mitmproxy | A+I | 脚本化代理 |
A=Android, I=iOS
references/frida-objection-deep.md — Frida + Objection 深度用法references/ios-reverse-guide.md — iOS 逆向专项references/anti-detection-bypass.md — Root/越狱/反调试/SSL Pinning 绕过tool-index 使用了真实工具路径？还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
中文简介正在准备中。当前显示英语简介。
Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.
中文简介正在准备中。当前显示英语简介。
Plan and coordinate authorized penetration tests across multiple stages, from reconnaissance to access, privilege escalation, movement between systems, and impact assessment. Assign specialist skills, revise blocked paths, and maintain evidence and progress records for the final report.
中文简介正在准备中。当前显示英语简介。
Transfer known function and variable names from an older binary to a newer version. Compare disassembly and pseudocode with an LLM, produce structured mappings, and apply names and comments in IDA.
中文简介正在准备中。当前显示英语简介。
Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.
中文简介正在准备中。当前显示英语简介。
Automate website navigation, form filling, content collection, and Windows desktop interactions. The skill selects browser or desktop tools for the task and guides screenshot capture and desktop network traffic observation when needed.
中文简介正在准备中。当前显示英语简介。