
支持Android应用逆向工程的Claude代码技能
概览
这是一项Claude代码技能,可以反编译Android APK/XAPK/JAR/AAR文件,应用中使用——Retrofit端点、OkHttp调用、硬编码URL、认证模式——这样你可以在没有原始源代码的情况下记录和复现它们。 : 现代 Android 应用是 Kotlin/KMP,并被 R8 高度混淆。这项技能可以从 R8 无法剥离的元数据中恢复,并从 中提取 API——不仅仅是经典的 Retrofit/OkHttp 栈。请参见下面的 Kotlin 名称恢复。 :*.ps1脚本和bash脚本是社区最近贡献的,仍在稳定中。如有问题,请在仓库(非贡献者上游分支)上开启issue:PowerShell脚本由@SimoneAvogadro维护。 - Vineflower 或 Fernflower —— 在复杂 Java 代码中输出更好- dex2jar —— 用于在 APK/DEX 文件中使用 Fernflower 的需要 详细安装说明请参见插件/android-reverse-engineering/skills/android-reverse-engineering/references/setup-guide.md。
概述(AI 翻译)
这是一个Claude代码技能,可以反编译Android APK/XAPK/JAR/AAR文件,并提取应用使用的HTTP API——Retrofit 端点、OkHttp调用、硬编码URL、认证模式——这样你可以在没有原始源代码的情况下记录和复现它们。
一流的Kotlin支持:现代Android应用是Kotlin/KMP,并被R8高度混淆。该技能能从R8无法剥离的元数据中恢复原始Kotlin类名称,并从Ktor、Apollo(GraphQL)和Koin中提取API——而不仅仅是经典的Retrofit/OkHttp堆栈。详见下方Kotlin名称恢复。
Windows / PowerShell 支持(实验性):
*.ps1脚本与 bash 脚本是社区近期贡献,仍在稳定中。如有任何问题,请在本仓库(非贡献者上游分支)开启问题:PowerShell 脚本由 @SimoneAvogadro 维护。
目录
- 它的作用
- 要求
- 安装
- 使用情况
- 存储库结构
- 参考文献
- 致谢
- 免责声明
- 许可证
它的作用
| 能力 | 描述 |
|---|
本页由 AI 翻译,技术细节请以原文为准。
README
以下为原文 README 节选,完整内容请查看原文。
Android Reverse Engineering & API Extraction — Claude Code skill
A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs used by the app — Retrofit endpoints, OkHttp calls, hardcoded URLs, authentication patterns — so you can document and reproduce them without the original source code.
First-class Kotlin support: modern Android apps are Kotlin/KMP, heavily obfuscated with R8. This skill recovers the original Kotlin class names from metadata R8 cannot strip, and extracts APIs from Ktor, Apollo (GraphQL) and Koin — not just the classic Retrofit/OkHttp stack. See Kotlin name recovery below.
Windows / PowerShell support (experimental): The
*.ps1scripts alongside the bash ones are a recent community contribution, still being stabilised. For any issues please open an issue on this repository (not on the contributors’ upstream forks): the PowerShell scripts are maintained here by @SimoneAvogadro.
Table of Contents
- What it does
- Requirements
- Installation
- Usage
- Repository Structure
- References
- Acknowledgments
- Disclaimer
- License
What it does
| Capability | Description |
|---|---|
| Fingerprint first (Phase 0) | Triage an APK/XAPK in seconds — detect the framework (Flutter / React Native / Cordova / Xamarin / native-Kotlin), HTTP stack, obfuscation level and native libs before spending time on a full decompile |
| Decompile | APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower (single engine or side-by-side comparison) |
| Recover Kotlin names | Rebuild original *Repository / *ViewModel / *UseCase class names from R8-obfuscated binaries using Kotlin metadata that R8 cannot strip |
| Extract APIs | Retrofit, OkHttp, Volley and modern Kotlin/KMP stacks: Ktor, Apollo (GraphQL), Koin DI — endpoints, hardcoded URLs, auth headers, tokens and HMAC request-signing schemes |
| Trace call flows | From Activities/Fragments through ViewModels and repositories down to HTTP calls |
| Analyze structure | Manifest, packages, architecture patterns |
| Handle obfuscation | R8-resistant path/URL extraction plus strategies for navigating ProGuard/R8 output |
推荐工具
换一个关键词,或者移除筛选条件。
安装
npx skillfish add simoneavogadro/android-reverse-engineering-skill