Опишете задачата
Към всички skills

android-reverse-engineering

SimoneAvogadro · Разработка

Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows. 中文触发词：反编译APK、安卓逆向、提取API、分析安卓应用、反编译安卓、逆向工程、追踪调用链、提取接口

Оригинален текст · няма потвърден превод на български
Платформи: Не са посочениНиво: Не е посоченоВ индекса: 21.09.2026 г.Обновен в GitHub: 08.09.2026 г.

Първо прочетете инструкцията.

Файлът се зарежда от посочения източник само по ваше действие. Можете да го прочетете тук, да го копирате или да го запазите като .md.

Оригинален SKILL.md
GitHub хранилище
Звезди на репото
7881
Лиценз
Apache-2.0
Последна проверка на записа
21.09.2026 г.

Добавете в своя инструмент.

Командата отваря избора на skills от репозитория. Прочетете файла и условията на автора преди изпълнение.

npx skills add SimoneAvogadro/android-reverse-engineering-skill

Страницата копира текст. Не инсталира и не изпълнява нищо на устройството ви.

Откъс от SKILL.md

Началото на файла на автора, без превод.

Android Reverse Engineering

Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, and produce structured documentation of extracted APIs. Two decompiler engines are supported — jadx for broad Android coverage and Fernflower for higher-quality output on complex Java code — and can be used together for comparison.

Prerequisites

This skill requires Java JDK 17+ and jadx to be installed. Fernflower/Vineflower and dex2jar are optional but recommended for better decompilation quality. Run the dependency checker to verify:

bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh

On Windows (PowerShell):

& "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.ps1"

If anything is missing, follow the installation instructions in ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/references/setup-guide.md.

Workflow

Phase 0: Fingerprint the App (recommended before anything else)

Before installing tools or decompiling, run a fast triage to determine what kind of app you are looking at. Decompiling Java is mostly useless for Flutter, React Native, Cordova/Capacitor, and Xamarin apps — the real code lives elsewhere. The fingerprint script tells you which.

bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/fingerprint.sh <file.apk|file.xapk>

It prints, in one screen:

  • Mobile framework (Flutter / React Native / Cordova / Xamarin / Native Kotlin / etc.) with the file marker that triggered the verdict.
  • HTTP stack (Retrofit, OkHttp, Ktor, Apollo, Volley) detected via DEX string scan — works even when class names are obfuscated.
  • DI / serialization signals (Hilt, Dagger, Koin, kotlinx.serialization, Moshi, Gson, Jackson).
  • Obfuscation level estimate based on root-level short-named packages.
  • Notable third-party SDKs (AppsFlyer, Datadog, Sentry, Firebase, payment SDKs, support/chat SDKs, etc.).
  • Consolidated native libraries across the base APK and all splits — XAPK split bundles often place .so files in config.<abi>.apk, not in base.apk.
  • Recommended next step, which differs by framework (e.g. for Flutter the script suggests blutter / strings libapp.so rather than jadx).

Целият SKILL.md в GitHub