Skip to content
Get packs

Android App Hooking for CTF

Guides an agent through hooking Android APKs with Frida to trace signing, pinning and trust boundaries in CTF sandboxes.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a playbook that tells an AI agent how to analyse an Android app while it runs, in a controlled capture-the-flag (CTF) training setting. Instead of only reading code strings, the agent is guided to decide which internal function to watch (for example a request signer or crypto helper), record its inputs and outputs with Frida-style hooks, and rebuild the smallest request the server accepts. It is explicitly an internal downstream skill: it should only be used after a parent skill, ctf-sandbox-orchestrator, has set up the sandbox assumptions, and it defaults to replying in Simplified Chinese unless English is requested.

Great for

  • Security students working through Android CTF challenges in an isolated lab
  • Reverse engineers who already know Frida and want a structured checklist for hook targets and evidence
  • Teams running an internal CTF workflow that routes Android tasks to this specialisation

Skip it if

  • Analysing real apps you do not own or have no authorisation to test, since bypassing pinning and root checks against live services can be illegal or harmful
  • Users with no security background, because the skill assumes familiarity with APKs, Frida, JNI and signing schemes and will not explain them from scratch
  • Pure static string or crypto puzzles, which the skill itself says should go to a broader crypto or mobile skill instead

Try asking

  • “Hook the request signer in this CTF APK and record the signed headers and nonce for one login request”
  • “Trace the JNI boundary between the Java UI and the native library that computes the signature”
  • “Show me which exported activities and deeplinks this sample app exposes before I hook anything”
  • “Reproduce the accepted API request for this challenge using the smallest set of hooks”
Step-by-step guide: how to use Android App Hooking for CTFInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-android-hooking.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-android-hooking.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-android-hooking.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run this only inside an isolated sandbox or emulator with a test account, never on a personal device or production service
  • Load the parent ctf-sandbox-orchestrator skill first so sandbox assumptions and evidence priorities are set
  • Keep the original APK and extracted files untouched; ask the agent to preserve them before any patching or resigning

What's inside

  • agents/openai.yaml
  • references/android-hooking.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.