p4nda0s/reverse-skills
8 skills10k installs14.7k starsGitHub
Install
npx skills add https://github.com/p4nda0s/reverse-skillsSkills in this repo
1Rev FridaThe rev-frida skill generate Frida hook scripts using modern Frida API Activate when the user wants to write Frida scripts hook functions at runtime trace calls or arguments or return values intercept native or ObjC or Java methods dump memory or exports or handle native module load timing for Android and other targets rev-frida Frida Script Generator Generate Frida instrumentation scripts for dynamic analysis hooking and runtime inspection Overview Use Frida for native export hooks Java or ObjC method hooks runtime tracing argument or return-value capture memory dumping loader-aware native instrumentation Important Modern Frida CLI The modern Frida CLI does not use no-pause A spawned process resumes after the script is loaded bash Spawn and hook frida U f com example app l hook js Attach to running process frida U com example app l hook js Attach by PID frida U p 1234 l hook js Modern API Reference Module Symbol Lookup javascript const mod Process getModuleByName libssl so mod name mod base mod size mod path const ptr1.5kinstalls2Rev SymbolThe rev-symbol skill complements rev-struct by focusing on function, global, and symbol name recovery during reverse engineering. It uses IDA MCP or exported decompilation data to correlate call graphs, string references, vtables, and logging patterns into meaningful symbol names. Agents apply naming conventions, avoid overwriting confirmed symbols, and document confidence levels for suggested renames. The skill accelerates malware and firmware analysis when stripped binaries hide identifiers but behavioral patterns remain. Use alongside rev-struct when rebuilding comprehension of unknown binaries.1.3kinstalls3Rev StructThe rev-struct skill reconstructs data structure definitions by analyzing memory access patterns across functions and call chains in reverse engineering workflows. It prefers IDA Pro MCP when connected so agents query decompilation and cross-references directly without exported files. When MCP is unavailable, it consumes IDA-NO-MCP exports with decompile C files and prompts users to install the INP.py plugin and export via Ctrl-Shift-E. Analysis correlates field offsets, pointer arithmetic, and repeated member accesses to infer struct layouts, array strides, and nested types. Output documents recovered typedefs with evidence from accessing functions and warns when coverage is incomplete. Use during malware or binary analysis when structure layouts are unknown but access patterns are observable in IDA.1.3kinstalls4Rev Dex Dumperrev-dex-dumper in p4nda0s/reverse-skills dumps DEX files from a running Android application's memory to support unpacking and deobfuscation workflows. The skill bundles the panda-dex-dumper binary relative to SKILL.md and documents pushing it to a device with adb push, setting execute permissions, and running the dumper against a live process to extract decrypted DEX that never appears on disk in the APK. Developers reach for rev-dex-dumper when static APK analysis fails because classes load from encrypted or packed dex at runtime. The workflow targets defeat of class-loading packers common in protected Android binaries during authorized security research or malware analysis. Agents activate on requests to unpack an APK, dump DEX from memory, or extract decrypted dex files from a running app. Output is recovered DEX artifacts ready for jadx or similar decompilers.1.3kinstalls5Rev Idapythonrev-idapython is a skill from p4nda0s/reverse-skills that serves as an IDAPython and IDALib script reference for reverse engineering workflows. It activates when developers write IDAPython inside IDA, run IDALib headless analysis, operate on IDB databases, debug with IDA, manipulate memory and registers, traverse functions blocks and instructions, use the Hex-Rays decompiler API, handle obfuscation, or batch-process binaries. The skill distinguishes IDAPython scripts in the IDA GUI from IDALib headless automation and is intended as a snippet source when agents generate analysis code. Security researchers and malware analysts reach for rev-idapython when they need correct IDA APIs instead of guessing decompiler or cross-reference calls.1.3kinstalls6Rev Unicorn Debugrev-unicorn-debug is a Claude Code skill from p4nda0s/reverse-skills for debugging and emulating specific functions with the Unicorn CPU emulation engine. The workflow loads raw binary segments, identifies context dependencies such as JNI calls, syscalls, and libc functions, then simulates them through hook mechanisms so a single function can run in isolation. Developers reach for rev-unicorn-debug when they need to trace algorithm behavior, decrypt data by emulating a routine, or bypass environment dependencies without launching the complete program. The skill emphasizes loading files raw first and incrementally stubbing external interactions until the target fragment produces observable output.1.3kinstalls7Rev U3d Dumprev-u3d-dump is a Unity IL2CPP symbol dumper skill from p4nda0s/reverse-skills for iOS and Android builds. Unity IL2CPP compiles C# to native code, stripping names from binaries while preserving them in global-metadata.dat. The skill extracts method names, addresses, and type definitions, then generates IDA and Ghidra import scripts to map native functions back to original C# symbols. Developers reach for rev-u3d-dump when analyzing IL2CPP games in disassemblers or building mods that need accurate function identification. Prerequisites include access to IL2CPP binaries and the matching global-metadata.dat from the build.1.2kinstalls8Rev Ios Dumprev-ios-dump is a Claude Code skill in p4nda0s/reverse-skills that automates iOS app decryption (砸壳) on jailbroken hardware. App Store IPAs ship FairPlay-encrypted; static analyzers need a decrypted Mach-O extracted at runtime. The skill orchestrates frida-ios-dump: Frida instruments the running app, memory is dumped, and a decrypted IPA is pulled over SSH or USB via iproxy. Developers reach for rev-ios-dump when they must decrypt an iOS app, dump an IPA from a device, or feed IDA, Ghidra, or Hopper a readable binary. Prerequisites include frida-server on device, Python dependencies from requirements.txt, and SSH key access. The workflow targets bundle identifiers or display names with python dump.py, yielding decrypted IPA files ready for unzip, class-dump, and disassembly.705installs