incogbyte/android-reverse-engineering-claude-skill

Android Reverse Engineering - Claude Code Skill

Author: incogbyte

Claude Code skill that automates Android application reverse engineering. Decompiles APK, XAPK, AAB, DEX, JAR, and AAR files, extracts HTTP endpoints (Retrofit, OkHttp, Volley, GraphQL, WebSocket), traces call flows, analyzes security patterns, documents discovered APIs, and performs adaptive dynamic analysis with Frida — generating custom bypass scripts based on static analysis findings and iterating through crash logs to defeat runtime protections (RASP, root detection, SSL pinning, anti-tamper).

What this skill does

• Decompiles APK, XAPK, AAB, DEX, JAR, and AAR using jadx or Fernflower/Vineflower (individually or side by side for comparison)
• Extracts HTTP APIs: Retrofit endpoints, OkHttp calls, Volley, GraphQL queries/mutations, WebSocket connections, hardcoded URLs, authentication headers
• Traces call flows from Activities/Fragments to network calls, through ViewModels, Repositories, coroutines/Flow, and RxJava chains
• Analyzes app structure: AndroidManifest, packages, architectural pattern (MVP, MVVM, Clean Architecture)
• Audits security: certificate pinning, disabled SSL verification, exposed secrets, debug flags, weak crypto, and Android Fragment Injection (exported PreferenceActivity with missing/permissive isValidFragment)
• Dynamic analysis with Frida: adaptive bypass loop that generates custom scripts based on decompiled code, runs them, captures crash logs, and iterates until protections are bypassed
• Bypasses runtime protections: RASP, root detection (RootBeer, SafetyNet), SSL pinning, anti-tamper, Frida detection — all via targeted hooks generated from static analysis, not generic scripts
• Detects Fragment Injection: flags exported PreferenceActivity subclasses with missing or permissive isValidFragment() overrides, plus dynamic fragment instantiation driven by Intent extras, and provides an adb