skillboardUpdated every 6 hours
skillboardAndroid APK reverse engineering: unpacking, Java decompilation, smali modification, repacking and signing, Frida dynamic hooking, and native .so analysis with jadx, apktool, adb, and related tools.
5cf4dfe⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
当任务属于以下场景时优先使用本 skill：
AndroidManifest.xml.so 时切到 native 分析jadx 1.5.5apktool 3.0.2frida-ps 17.9.6adbjava以下流程高频且参数容易出错，优先用 skill 自带脚本：
jadx + apktool 落盘并产出摘要：scripts/decode.ps1scripts/frida-run.ps1scripts/rebuild-sign-install.ps1scripts/manifest-summary.ps1以下一行命令保持直接调用，不单独封装：
adb devicesadb logcatfrida-ps -Ujadx --versionapktool --versionscripts/decode.ps1用途：
jadx 和 apktoolpackage、java_files、smali_dirs、so_files 等摘要jadx 部分反编译错误但仍然有可用产物的情况示例：
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx
scripts/frida-run.ps1用途：
-f、-n、-U示例：
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"
scripts/rebuild-sign-install.ps1用途：
apktool b 重建 APKzipalign 对齐apksigner 签名与验签adb install示例：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
ProjectDir 同目录，便于和原始包、解包目录放在一起scripts/manifest-summary.ps1用途：
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"
如果要分析 .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so，再结合：
ida-reverseradare2jadx用于：
常用命令：
jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk
JEB Pro（可选商业工具）用于：
边界：
tool-index 已确认本机 JEB 可用时调用；否则继续使用 jadx、apktool、Ghidra、IDA 或 radare2。../ops/skill-supply-chain.md 审阅源码、权限、网络行为和版本，再由用户明确确认注册。apktool用于：
AndroidManifest.xml常用命令：
apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk
frida用于：
常用命令：
frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'
adb用于：
常用命令：
adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .
先确定 APK 大致构成，不急着改包或 Hook。
建议动作：
jadx -d jadx_out app.apk 导出 Java 代码apktool d app.apk -o apktool_out 导出 smali 和资源AndroidManifest.xmlpackageapplication、activity、service、receiverlib/ 目录里是否有 .so../reverse-engineering/references/nonpe-format-cookbook.md §7–8）：
aapt dump badging + manifest theme/label/icon → E-android-hidden-icon-manifestservice.d / priv-app 等 → E-android-persistence优先从 jadx_out 读：
MainActivityApplication常见关键词：
loginsignencryptciphertokenrootcertificatetrustokhttpretrofitwebview如果 Java 代码可读，先在这里定位业务逻辑。
当 jadx 结果不完整、混淆重、或需要实际 patch 时，切到 apktool_out：
smali*/res/values/strings.xmlAndroidManifest.xml优先 patch：
android:exported修改后：
apktool b apktool_out -o rebuilt.apk
或者直接用脚本闭环：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
apktool 重建链路apksigner / zipalign静态分析不足时，用 Frida：
OkHttp / Retrofit / WebView 关键点javax.crypto、MessageDigest原则：
建议：
frida-*scripts/frida-run.ps1.so 分流如果 APK 中包含关键 .so：
apktool 或 jadx 找到 lib/**/*.soradare2ida-reverse遇到这些信号要尽快切 native：
System.loadLibrary() 后关键逻辑消失.so 中最终至少说明：
.so.so 明显承载核心逻辑时继续死磕 Java 层# 反编译 Java
> ⚠️ Security notice: examples below may include download-and-execute patterns, shown for defensive understanding and authorized testing only. Never run them against systems you do not own.
jadx -d jadx_out app.apk
# 解包 APK
apktool d app.apk -o apktool_out
# 重建 APK
apktool b apktool_out -o rebuilt.apk
# 设备与进程
adb devices
frida-ps -U
# 启动并注入
frida -U -f com.example.app -l hook.js
上游入口: skills/SKILL.md（总控）、routing.md
下游出口:
.so → ida-reverse/ 或 radare2/reverse-engineering/tools-dynamic.md（Frida 章节）reverse-engineering/SKILL.md同级关联模块: reverse-engineering/（.so 分析和 Frida 进阶用法）
本 skill 的入口脚本已接入统一自举系统。缺少工具时不会直接报错，而是自动尝试安装。
| 工具 | 可自动安装 | 安装方式 | 说明 |
|------|-----------|---------|------|
| jadx | ✓ | GitHub Release ZIP | 自动下载解压到 %USERPROFILE%\Tools\jadx\ |
| apktool | ✓ | GitHub Release JAR + wrapper | 自动下载 jar 并生成 bat 到 %USERPROFILE%\Tools\apktool\ |
| JEB Pro | ✗ | 用户手动安装并提供有效许可证 | 可选的 Android / ARM 交叉验证工具；第三方 MCP bridge 需单独审计 |
| frida / frida-ps | ✓ | pip install frida-tools | 需要 Python 已安装 |
| adb | ✓ | winget / fallback path | 自动安装 Android Platform-Tools |
| zipalign | ✗ | 需手动安装 Android Build-Tools | sdkmanager "build-tools;35.0.0" |
| apksigner | ✗ | 需手动安装 Android Build-Tools | 同上 |
scripts/decode.ps1：缺 jadx 或 apktool 时自动调用 bootstrap-reverse.ps1scripts/rebuild-sign-install.ps1：缺 adb 或 apktool 时自动调用 bootstrapscripts/frida-run.ps1：当前仍为手动检查（frida 通常已通过 pip 安装）如果自动安装失败，脚本会抛出明确错误并附带手动安装链接。常见原因：
tool-index 使用了真实工具路径？Adapted from zhaoxuya520/reverse-skill (MIT).
Copy a source-pinned command for your client. You run it yourself.
Destination: .claude/skills/apk-reverse · pinned to the source commit
# Run from your project root
git clone https://github.com/sickn33/agentic-awesome-skills.git .skillboard-tmp
git -C .skillboard-tmp checkout 5cf4dfeb13ea966daa1e117897689cd7991e3f44
mkdir -p ".claude/skills"
cp -r ".skillboard-tmp/plugins/agentic-awesome-skills-claude/skills/apk-reverse" ".claude/skills/"
rm -rf .skillboard-tmpReview the source before running. This copies files into your project; it is not a one-click install and does not verify runtime safety.
sudo apt update && sudo apt install -y gitnpm install -g @anthropic-ai/claude-code# Run from your project root
git clone https://github.com/sickn33/agentic-awesome-skills.git .skillboard-tmp
git -C .skillboard-tmp checkout 5cf4dfeb13ea966daa1e117897689cd7991e3f44
mkdir -p ".claude/skills"
cp -r ".skillboard-tmp/plugins/agentic-awesome-skills-claude/skills/apk-reverse" ".claude/skills/"
rm -rf .skillboard-tmpDestination: .claude/skills/apk-reverse
Scanner static-checks@0.1.0 · commit 5cf4dfeb13ea. Static checks cannot prove runtime safety – review the source and the exact diff before installing. How checks work.
Piping a downloaded script directly into a shell runs unreviewed remote code.
Evidence: curl|sh· fingerprint c6665d489ff93b33
Instructs shell/process/package operations that run commands on the host.
Evidence: pip install· fingerprint 7944ec554efca445
Fetches remote content at runtime, which can change after review.
Evidence: curl· fingerprint 427e4b79b1f0fc90
References parent-directory traversal, which can escape a target directory.
Evidence: ../· fingerprint fa08499e14d0113b