Skip to content
Get packs

Mobile App Reverse Engineering

Guides an agent through authorized Android and iOS app analysis: unpacking, Frida hooking, SSL pinning and root-detection bypass.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
4 files

What it does

This skill gives an AI agent a structured playbook for taking apart Android (APK) and iPhone (IPA) apps to test their security. It walks through four phases: gathering app files and metadata, static code analysis, runtime instrumentation with Frida and Objection, and network traffic interception with tools like Burp Suite. It also includes ready-made snippets for bypassing SSL certificate pinning, root or jailbreak detection, and anti-debugging, plus examples for extracting encryption keys at runtime.

Great for

  • Security testers doing authorized mobile penetration tests following OWASP MASTG
  • Developers checking how well their own app's pinning and root detection hold up
  • Students learning mobile reverse engineering methodology in a lab with their own or permitted test apps

Skip it if

  • Analyzing or bypassing protections in apps you do not own or have written permission to test, since the skill itself contains no authorization check and bypassing protections in others' apps can be illegal
  • Non-security tasks such as modifying an app's features or removing paywalls, which the skill does not address and which may violate terms of service or law
  • Users unfamiliar with these tools who expect a turnkey, safe automation: several steps (patching APKs, re-signing, installing hooks) can alter or break apps on a device

Try asking

  • “Analyze this APK's manifest for exported components and backup flags, then list the hardcoded secrets it contains.”
  • “Set up Frida and Objection to disable SSL pinning in my own app so I can intercept its traffic in Burp.”
  • “Hook Cipher.getInstance in this Android app to log which encryption algorithm and key it uses during login.”
  • “Walk me through a Phase 1 to Phase 4 mobile security assessment of this IPA for an authorized engagement.”
Step-by-step guide: how to use Mobile App Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the MIT licence and an attribution note.

    mobile-reverse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip mobile-reverse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip mobile-reverse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State the authorization scope and target app explicitly at the start so the agent works only within it, since the skill does not verify this.
  • Use a dedicated test device or emulator and avoid real personal accounts, because the skill involves installing hooks and dumping keychain or keystore data.
  • Review any script or patched APK the agent generates before running it, since the skill instructs the agent to execute tools and modify binaries.

What's inside

  • references/anti-detection-bypass.md
  • references/frida-objection-deep.md
  • references/ios-reverse-guide.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.

Find exactly what
you're looking for