mobile-reverse-skill

A single, shared Claude Code and Codex skill for reverse-engineering mobile apps (Android and iOS), end to end: from a target to a verified reconstruction of a target API (endpoints, request fields, and the client-side signing / encryption scheme), with an optional replay PoC when requested and in scope.

/reverse-skill reverse the login API from com.example.aa

It merges the strongest parts of five community RE skill collections into one coherent workflow, standardized on the tools this repo prefers:

• IDA Pro 9.3 for native analysis (.so and iOS Mach-O) — supports both an IDA MCP server and a no-MCP headless (idalib) export path. Ghidra is an optional fallback for architectures where IDA’s coverage is weak; nothing requires it.
• gojue/ecapture (eBPF) for TLS capture — observes TLS buffers without a terminating proxy or a change to certificate pinning. The GUI ecaptureQ is supported too.
• SeeFlowerX/stackplz (eBPF) for native function / syscall / hardware-breakpoint tracing, selected for the required observations and kernel support. Instrumentation effects and coverage are recorded; neither eBPF nor Frida is guaranteed unobservable.
• ASC for focused DEX reference searches and class decompilation, jadx for full-source decode, apktool for manifest/resources/smali, Frida for gap-filling dynamic hooks (with a documented distinction between Stalker/QBDI code-cache effects and other hook mechanisms; target-specific behavior must be measured).

Why one skill

Reversing something like a login API isn’t a single trick — it’s decode → find the endpoint → capture ground truth → align code to traffic → reverse the native signer → name the crypto → reconstruct and prove it. Each source skill did part of that well; this stitches them into one phased flow with shared state so the phases actually feed each other, and adds a discipline that stops the model from inventing an algorithm name it can’t back up.

Install

Requires Python 3.8+ and Bash (macOS, Linux, or WSL). Existing Claude Code commands remain supported:

./install.sh                      # copy into ~/.claude/skills/reverse-skill
./install.sh --link               # link Claude Code to this checkout
./install.sh --agent codex        # copy into ~/.agents/skills/reverse-skill
./install.sh --agent both         # one shared snapshot, links from both agents
./install.sh --agent both --link  # both agents link directly to this checkout

For ongoing development, use --agent both --link: after git pull, both agents see the same updated instructions, scripts, assets, references, and KB. Keep this checkout in place. For a snapshot independent of the checkout, use --agent both; the canonical copy is ~/.local/share/mobile-reverse-skill/reverse-skill. Re-run