在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
Run in your terminal
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionapk-reverseExecute the skills CLI command in your project's root directory to begin installation:
Package manager
npx skills install zhaoxuya520/reverse-skill/skills/apk-reverseFetches apk-reverse from zhaoxuya520/reverse-skill and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
Restart Cursor to activate apk-reverse. Access via /apk-reversein your agent's command palette.
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.
Submit your Claude Code skill and start earning
Automate repetitive workflows and reduce manual effort
Example
Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example
Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example
Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Package manager
npx skills install zhaoxuya520/reverse-skill/skills/apk-reverseWorks with
1
total installs
1
this week
10.9K
GitHub stars
0
upvotes
| name | apk-reverse |
| description | 在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。 |
端点提取/Frida 自适应等社区对照：../references/community-security-skills.md；动态分析须 scope 授权设备。
NOW: 读取 ../field-journal/precedent-reverse.md — 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取 ../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态当任务属于以下场景时优先使用本 skill：
AndroidManifest.xml.so 时切到 native 分析jadx 1.5.5apktool 3.0.2frida-ps 17.9.6adbjava以下流程高频且参数容易出错，优先用 skill 自带脚本：
jadx + apktool 落盘并产出摘要：scripts/decode.ps1scripts/frida-run.ps1scripts/rebuild-sign-install.ps1scripts/manifest-summary.ps1以下一行命令保持直接调用，不单独封装：
adb devicesadb logcatfrida-ps -Ujadx --versionapktool --versionscripts/decode.ps1用途：
jadx 和 apktoolpackage、java_files、smali_dirs、so_files 等摘要jadx 部分反编译错误但仍然有可用产物的情况示例：
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx
scripts/frida-run.ps1用途：
-f、-n、-U示例：
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"
scripts/rebuild-sign-install.ps1用途：
apktool b 重建 APKzipalign 对齐apksigner 签名与验签adb install示例：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
ProjectDir 同目录，便于和原始包、解包目录放在一起scripts/manifest-summary.ps1用途：
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"
如果要分析 .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so，再结合：
ida-reverseradare2jadx用于：
常用命令：
jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk
apktool用于：
AndroidManifest.xml常用命令：
apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk
frida用于：
常用命令：
frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'
adb用于：
常用命令：
adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .
先确定 APK 大致构成，不急着改包或 Hook。
建议动作：
jadx -d jadx_out app.apk 导出 Java 代码apktool d app.apk -o apktool_out 导出 smali 和资源AndroidManifest.xmlpackageapplication、activity、service、receiverlib/ 目录里是否有 .so优先从 jadx_out 读：
MainActivityApplication常见关键词：
loginsignencryptciphertokenrootcertificatetrustokhttpretrofitwebview如果 Java 代码可读，先在这里定位业务逻辑。
当 jadx 结果不完整、混淆重、或需要实际 patch 时，切到 apktool_out：
smali*/res/values/strings.xmlAndroidManifest.xml优先 patch：
android:exported修改后：
apktool b apktool_out -o rebuilt.apk
或者直接用脚本闭环：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
apktool 重建链路apksigner / zipalign静态分析不足时，用 Frida：
OkHttp / Retrofit / WebView 关键点javax.crypto、MessageDigest原则：
建议：
frida-*scripts/frida-run.ps1.so 分流如果 APK 中包含关键 .so：
apktool 或 jadx 找到 lib/**/*.soradare2ida-reverse遇到这些信号要尽快切 native：
System.loadLibrary() 后关键逻辑消失.so 中最终至少说明：
.so.so 明显承载核心逻辑时继续死磕 Java 层# 反编译 Java
jadx -d jadx_out app.apk
# 解包 APK
apktool d app.apk -o apktool_out
# 重建 APK
apktool b apktool_out -o rebuilt.apk
# 设备与进程
adb devices
frida-ps -U
# 启动并注入
frida -U -f com.example.app -l hook.js
上游入口: skills/SKILL.md（总控）、routing.md
下游出口:
.so → ida-reverse/ 或 radare2/reverse-engineering/tools-dynamic.md（Frida 章节）reverse-engineering/SKILL.md同级关联模块: reverse-engineering/（.so 分析和 Frida 进阶用法）
本 skill 的入口脚本已接入统一自举系统。缺少工具时不会直接报错，而是自动尝试安装。
| 工具 | 可自动安装 | 安装方式 | 说明 |
|---|---|---|---|
| jadx | ✓ | GitHub Release ZIP | 自动下载解压到 %USERPROFILE%\Tools\jadx\ |
| apktool | ✓ | GitHub Release JAR + wrapper | 自动下载 jar 并生成 bat 到 %USERPROFILE%\Tools\apktool\ |
| frida / frida-ps | ✓ | pip install frida-tools | 需要 Python 已安装 |
| adb | ✓ | winget / fallback path | 自动安装 Android Platform-Tools |
| zipalign | ✗ | 需手动安装 Android Build-Tools | sdkmanager "build-tools;35.0.0" |
| apksigner | ✗ | 需手动安装 Android Build-Tools | 同上 |
scripts/decode.ps1：缺 jadx 或 apktool 时自动调用 bootstrap-reverse.ps1scripts/rebuild-sign-install.ps1：缺 adb 或 apktool 时自动调用 bootstrapscripts/frida-run.ps1：当前仍为手动检查（frida 通常已通过 pip 安装）如果自动安装失败，脚本会抛出明确错误并附带手动安装链接。常见原因：
tool-index 使用了真实工具路径？Prerequisites
Time Estimate
15-45 minutes depending on use case complexity
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
apk-reverse has been reliable in day-to-day use. Documentation quality is above average for community skills.
apk-reverse has been reliable in day-to-day use. Documentation quality is above average for community skills.
Registry listing for apk-reverse matched our evaluation — installs cleanly and behaves as described in the markdown.
apk-reverse fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
apk-reverse is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Useful defaults in apk-reverse — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
Keeps context tight: apk-reverse is the kind of skill you can hand to a new teammate without a long onboarding doc.
apk-reverse reduced setup friction for our internal harness; good balance of opinion and flexibility.
apk-reverse reduced setup friction for our internal harness; good balance of opinion and flexibility.
We added apk-reverse from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
showing 1-10 of 49