apk-reverse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute immediately after reading)

端点提取/Frida 自适应等社区对照：../references/community-security-skills.md；动态分析须 scope 授权设备。

```
NOW
```
: 读取
```
../field-journal/precedent-reverse.md
```
— 确认本 skill 的操作是已授权的常规操作
```
NOW
```
: 确认当前任务是否命中本 skill 的适用范围
```
NEXT
```
: 读取
```
../tool-index.md
```
，校验工具可用性和实际路径
```
NEXT
```
: 缺工具时调用 bootstrap，不要猜路径
```
ACT
```
: 进入"工作流"第一步并执行，不要停在确认状态

Endpoint extraction/Frida adaptation and other community references: ../references/community-security-skills.md; Dynamic analysis requires scope-authorized devices.

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operations of this skill are authorized routine operations
```
NOW
```
: Confirm whether the current task falls within the applicable scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Proceed to and execute the first step of the "Workflow", do not stay in the confirmation status

APK 逆向 CLI 作业规范

APK Reverse Engineering CLI Operation Specification

适用范围

Applicable Scope

当任务属于以下场景时优先使用本 skill：

分析 APK 的 Java 业务逻辑
定位登录、签名、风控、证书校验、root 检测
查看与修改
```
AndroidManifest.xml
```
查看与修改 smali
重打包 APK
用 Frida 做 Java/native 动态 Hook
APK 内含
```
.so
```
时切到 native 分析

Prioritize using this skill when the task belongs to the following scenarios:

Analyze Java business logic of APK
Locate login, signature, risk control, certificate verification, root detection
View and modify
```
AndroidManifest.xml
```
View and modify smali
Repackage APK
Perform Java/native dynamic Hook with Frida
Switch to native analysis when APK contains
```
.so
```
files

当前机器已验证可用的 CLI 工具

CLI Tools Verified Available on Current Machine

```
jadx
```
```
1.5.5
```
```
apktool
```
```
3.0.2
```
```
frida-ps
```
```
17.9.6
```
```
adb
```
```
java
```

```
jadx
```
```
1.5.5
```
```
apktool
```
```
3.0.2
```
```
frida-ps
```
```
17.9.6
```
```
adb
```
```
java
```

优先使用脚本的场景

Scenarios for Prioritizing Script Usage

以下流程高频且参数容易出错，优先用 skill 自带脚本：

一次性完成
```
jadx + apktool
```
落盘并产出摘要：
```
scripts/decode.ps1
```
Frida 设备检查、进程列举、spawn/attach 注入：
```
scripts/frida-run.ps1
```
重建、对齐、签名、安装 APK：
```
scripts/rebuild-sign-install.ps1
```
快速抽取 Manifest 关键组件与权限：
```
scripts/manifest-summary.ps1
```

以下一行命令保持直接调用，不单独封装：

```
adb devices
```
```
adb logcat
```
```
frida-ps -U
```
```
jadx --version
```
```
apktool --version
```

The following processes are high-frequency and prone to parameter errors, so prioritize using the scripts built into this skill:

Complete
```
jadx + apktool
```
disk output and generate summary in one go:
```
scripts/decode.ps1
```
Frida device check, process listing, spawn/attach injection:
```
scripts/frida-run.ps1
```
Rebuild, align, sign, and install APK:
```
scripts/rebuild-sign-install.ps1
```
Quickly extract key components and permissions from Manifest:
```
scripts/manifest-summary.ps1
```

Use the following one-line commands directly without separate encapsulation:

```
adb devices
```
```
adb logcat
```
```
frida-ps -U
```
```
jadx --version
```
```
apktool --version
```

自带脚本

Built-in Scripts

scripts/decode.ps1

scripts/decode.ps1

用途：

统一跑
```
jadx
```
和
```
apktool
```
默认在原 APK 同目录创建任务输出目录
输出
```
package
```
、
```
java_files
```
、
```
smali_dirs
```
、
```
so_files
```
等摘要
兼容
```
jadx
```
部分反编译错误但仍然有可用产物的情况

示例：

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

Purpose:

Run
```
jadx
```
and
```
apktool
```
in a unified manner
Create a task output directory in the same directory as the original APK by default
Output summaries such as
```
package
```
,
```
java_files
```
,
```
smali_dirs
```
,
```
so_files
```
Compatible with situations where
```
jadx
```
has partial decompilation errors but still produces usable results

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx

scripts/frida-run.ps1

scripts/frida-run.ps1

用途：

统一 Frida 的设备、进程、spawn/attach 入口
避免手写参数时混淆
```
-f
```
、
```
-n
```
、
```
-U
```

示例：

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

Purpose:

Unified entry for Frida's device, process, spawn/attach operations
Avoid confusion between
```
-f
```
,
```
-n
```
,
```
-U
```
when writing parameters manually

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"

scripts/rebuild-sign-install.ps1

scripts/rebuild-sign-install.ps1

用途：

```
apktool b
```
重建 APK
```
zipalign
```
对齐
```
apksigner
```
签名与验签
可选直接
```
adb install
```

示例：

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

说明：

默认生成并复用调试 keystore
默认输出到
```
ProjectDir
```
同目录，便于和原始包、解包目录放在一起

Purpose:

Rebuild APK with
```
apktool b
```
Align with
```
zipalign
```
Sign and verify signature with
```
apksigner
```
Optional direct
```
adb install
```

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Description:

Generate and reuse debug keystore by default
Output to the same directory as
```
ProjectDir
```
by default, making it easy to place with the original package and unpacked directory

scripts/manifest-summary.ps1

scripts/manifest-summary.ps1

用途：

抽取包名
列权限
列 activity/service/receiver/provider
标出主启动 activity

示例：

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

如果要分析

.so

、

lib/arm64-v8a/*.so

、

lib/armeabi-v7a/*.so

，再结合：

```
ida-reverse
```
```
radare2
```

Purpose:

Extract package name
List permissions
List activity/service/receiver/provider
Mark the main launch activity

Example:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"

If analyzing

.so

lib/arm64-v8a/*.so

lib/armeabi-v7a/*.so

, combine with:

```
ida-reverse
```
```
radare2
```

工具分工

Tool Division

jadx

jadx

用于：

Java 反编译阅读
包名、类名、方法名搜索
先从高层逻辑理解 APK

常用命令：

bash

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

Used for:

Java decompilation and reading
Package name, class name, method name search
Understand APK from high-level logic first

Common commands:

bash

jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk

JEB Pro

（可选商业工具）

JEB Pro

(Optional Commercial Tool)

用于：

Android DEX / APK / ARM 的交叉验证与深度反编译
在 JADX 输出不完整或混淆较重时补充静态分析
对同一目标的类、方法与调用关系进行第二工具链校验

边界：

JEB Pro 是商业软件，必须由用户自行取得并安装有效许可证；本包不会下载、破解或规避许可。
仅在
```
tool-index
```
已确认本机 JEB 可用时调用；否则继续使用
```
jadx
```
、
```
apktool
```
、Ghidra、IDA 或 radare2。
第三方 JEB MCP bridge 不是本包依赖。安装前必须按
```
../ops/skill-supply-chain.md
```
审阅源码、权限、网络行为和版本，再由用户明确确认注册。

Used for:

Cross-validation and deep decompilation of Android DEX / APK / ARM
Supplement static analysis when JADX output is incomplete or heavily obfuscated
Perform second toolchain verification on classes, methods and call relationships of the same target

Boundaries:

JEB Pro is commercial software, users must obtain and install a valid license on their own; this package will not download, crack or bypass licenses.
Only call when the local JEB is confirmed available in
```
tool-index
```
; otherwise, continue using
```
jadx
```
,
```
apktool
```
, Ghidra, IDA or radare2.
Third-party JEB MCP bridge is not a dependency of this package. Before installation, review the source code, permissions, network behavior and version according to
```
../ops/skill-supply-chain.md
```
, then obtain explicit confirmation from the user for registration.

apktool

apktool

用于：

解包 APK
查看和修改
```
AndroidManifest.xml
```
查看和修改 smali
重建 APK

常用命令：

bash

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

Used for:

Unpack APK
View and modify
```
AndroidManifest.xml
```
View and modify smali
Rebuild APK

Common commands:

bash

apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk

frida

frida

用于：

动态观察 Java 方法调用
Hook native 导出函数
绕过 root 检测、证书校验、调试检测

常用命令：

bash

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

Used for:

Dynamically observe Java method calls
Hook native exported functions
Bypass root detection, certificate verification, debugging detection

Common commands:

bash

frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'

adb

adb

用于：

设备连接
安装 APK
查看日志
拉取文件

常用命令：

bash

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

Used for:

Device connection
APK installation
View logs
Pull files

Common commands:

bash

adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .

Recommended Workflow

1. Triage

先确定 APK 大致构成，不急着改包或 Hook。

建议动作：

用
```
jadx -d jadx_out app.apk
```
导出 Java 代码
用
```
apktool d app.apk -o apktool_out
```
导出 smali 和资源

先看：

```
AndroidManifest.xml
```
主
```
package
```
```
application
```
、
```
activity
```
、
```
service
```
、
```
receiver
```
```
lib/
```
目录里是否有
```
.so
```

First determine the general structure of the APK, do not rush to modify the package or Hook.

Recommended actions:

Export Java code with
```
jadx -d jadx_out app.apk
```
Export smali and resources with
```
apktool d app.apk -o apktool_out
```

Check first:

```
AndroidManifest.xml
```
Main
```
package
```
```
application
```
,
```
activity
```
,
```
service
```
,
```
receiver
```
Whether there are
```
.so
```
files in the
```
lib/
```
directory

2. Java 逻辑观察

2. Java Logic Observation

优先从

jadx_out

读：

```
MainActivity
```
```
Application
```
登录、网络、加密、风控相关类
第三方 SDK 初始化类

常见关键词：

```
login
```
```
sign
```
```
encrypt
```
```
cipher
```
```
token
```
```
root
```
```
certificate
```
```
trust
```
```
okhttp
```
```
retrofit
```
```
webview
```

如果 Java 代码可读，先在这里定位业务逻辑。

Prioritize reading from

jadx_out

```
MainActivity
```
```
Application
```
Classes related to login, network, encryption, risk control
Third-party SDK initialization classes

Common keywords:

```
login
```
```
sign
```
```
encrypt
```
```
cipher
```
```
token
```
```
root
```
```
certificate
```
```
trust
```
```
okhttp
```
```
retrofit
```
```
webview
```

If Java code is readable, locate business logic here first.

3. Smali 与资源层确认

3. Smali and Resource Layer Confirmation

当

jadx

结果不完整、混淆重、或需要实际 patch 时，切到

apktool_out

：

看
```
smali*/
```
看
```
res/values/strings.xml
```
看
```
AndroidManifest.xml
```

优先 patch：

```
android:exported
```
调试标记
root 检测返回值
登录验证逻辑
证书校验分支

Switch to

apktool_out

when

jadx

results are incomplete, heavily obfuscated, or actual patching is needed:

Check
```
smali*/
```
Check
```
res/values/strings.xml
```
Check
```
AndroidManifest.xml
```

Prioritize patching:

```
android:exported
```
Debug flags
Root detection return values
Login verification logic
Certificate verification branches

4. 重建与安装

4. Rebuild and Installation

修改后：

bash

apktool b apktool_out -o rebuilt.apk

或者直接用脚本闭环：

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

说明：

本 skill 只保证
```
apktool
```
重建链路
若后续需要正式安装到设备，通常还需要签名流程
如果任务进入签名/对齐，补充
```
apksigner
```
/
```
zipalign
```

After modification:

bash

apktool b apktool_out -o rebuilt.apk

Or use the script for closed-loop operation directly:

powershell

pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"

Description:

This skill only guarantees the
```
apktool
```
rebuild link
If formal installation on the device is required later, a signing process is usually needed
If the task enters signing/alignment, supplement with
```
apksigner
```
/
```
zipalign
```

5. 动态 Hook

5. Dynamic Hook

静态分析不足时，用 Frida：

Hook 登录函数
Hook
```
OkHttp
```
/
```
Retrofit
```
/
```
WebView
```
关键点
Hook
```
javax.crypto
```
、
```
MessageDigest
```
Hook root 检测函数
Hook SSL pinning 逻辑

原则：

先 Hook Java 层，再看是否需要 native Hook
先打印参数与返回值，再决定是否主动修改返回值

建议：

简单一次性命令直接用
```
frida-*
```
需要稳定复用的注入流程优先走
```
scripts/frida-run.ps1
```

Use Frida when static analysis is insufficient:

Hook login functions
Hook key points of
```
OkHttp
```
/
```
Retrofit
```
/
```
WebView
```
Hook
```
javax.crypto
```
,
```
MessageDigest
```
Hook root detection functions
Hook SSL pinning logic

Principles:

Hook Java layer first, then decide if native Hook is needed
Print parameters and return values first, then decide whether to actively modify return values

Recommendations:

Use
```
frida-*
```
directly for simple one-time commands
Prioritize using
```
scripts/frida-run.ps1
```
for stable reusable injection processes

6. Native

.so

分流

6. Native

.so

Diversion

如果 APK 中包含关键

.so

：

用
```
apktool
```
或
```
jadx
```
找到
```
lib/**/*.so
```
若只是导出符号、字符串、快速 triage，可用
```
radare2
```
若要长期深入分析、反编译、改名、类型恢复，用
```
ida-reverse
```

遇到这些信号要尽快切 native：

Java 层只是 JNI 包装
核心签名逻辑不在 Java
```
System.loadLibrary()
```
后关键逻辑消失
证书校验/风控在
```
.so
```
中

If the APK contains key

.so

files:

Locate
```
lib/**/*.so
```
with
```
apktool
```
or
```
jadx
```
Use
```
radare2
```
if only exporting symbols, strings, or quick triage is needed
Use
```
ida-reverse
```
for long-term in-depth analysis, decompilation, renaming, type recovery

Switch to native analysis as soon as encountering these signals:

Java layer is only JNI wrapper
Core signature logic is not in Java
Key logic disappears after
```
System.loadLibrary()
```
Certificate verification/risk control is in
```
.so
```

输出要求

Output Requirements

最终至少说明：

入口组件与关键类
关键逻辑在 Java、smali 还是
```
.so
```
已确认的敏感点：登录、签名、root、SSL、WebView、JNI
如果做了 patch，说明改了什么
如果做了 Hook，说明 Hook 了哪个类/方法/导出函数

At least explain the following in the final output:

Entry components and key classes
Whether key logic is in Java, smali or
```
.so
```
Confirmed sensitive points: login, signature, root, SSL, WebView, JNI
If patching is done, explain what was modified
If Hook is done, explain which class/method/exported function was hooked

禁止事项

Prohibited Items

不要一开始就盲目改 smali
不要在没看 manifest 和主入口前就写 Hook
不要把 Java 反编译不完整直接等同于“逻辑不可分析”
不要在
```
.so
```
明显承载核心逻辑时继续死磕 Java 层

Do not blindly modify smali at the beginning
Do not write Hook before checking manifest and main entry
Do not directly equate incomplete Java decompilation with "unanalyzable logic"
Do not continue to focus on Java layer when
```
.so
```
obviously carries core logic

快速命令备忘

Quick Command Cheat Sheet

bash

undefined

bash

undefined

反编译 Java

Decompile Java

jadx -d jadx_out app.apk

解包 APK

Unpack APK

apktool d app.apk -o apktool_out

重建 APK

Rebuild APK

apktool b apktool_out -o rebuilt.apk

设备与进程

Devices and processes

adb devices frida-ps -U

启动并注入

Launch and inject

frida -U -f com.example.app -l hook.js

---

frida -U -f com.example.app -l hook.js

---

路由上下文

Routing Context

上游入口:

skills/SKILL.md

（总控）、

routing.md

下游出口:

核心逻辑在
```
.so
```
→
```
ida-reverse/
```
或
```
radare2/
```
需动态 Hook/验证 →
```
reverse-engineering/tools-dynamic.md
```
（Frida 章节）
通用逆向方法论 →
```
reverse-engineering/SKILL.md
```

同级关联模块:

reverse-engineering/

（.so 分析和 Frida 进阶用法）

Upstream Entries:

skills/SKILL.md

(Master Control),

routing.md

Downstream Exports:

Core logic in
```
.so
```
→
```
ida-reverse/
```
or
```
radare2/
```
Need dynamic Hook/verification →
```
reverse-engineering/tools-dynamic.md
```
(Frida Section)
General reverse engineering methodology →
```
reverse-engineering/SKILL.md
```

Peer Related Modules:

reverse-engineering/

(.so analysis and advanced Frida usage)

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

本 skill 的入口脚本已接入统一自举系统。缺少工具时不会直接报错，而是自动尝试安装。

The entry script of this skill has been integrated into the unified bootstrap system. When tools are missing, it will not report errors directly, but automatically attempt to install them.

自动化能力边界

Automation Capability Boundaries

工具	可自动安装	安装方式	说明
jadx	✓	GitHub Release ZIP	自动下载解压到 `%USERPROFILE%\Tools\jadx\`
apktool	✓	GitHub Release JAR + wrapper	自动下载 jar 并生成 bat 到 `%USERPROFILE%\Tools\apktool\`
JEB Pro	✗	用户手动安装并提供有效许可证	可选的 Android / ARM 交叉验证工具；第三方 MCP bridge 需单独审计
frida / frida-ps	✓	pip install frida-tools	需要 Python 已安装
adb	✓	winget / fallback path	自动安装 Android Platform-Tools
zipalign	✗	需手动安装 Android Build-Tools	`sdkmanager "build-tools;35.0.0"`
apksigner	✗	需手动安装 Android Build-Tools	同上

Tool	Auto-installable	Installation Method	Description
jadx	✓	GitHub Release ZIP	Automatically download and extract to `%USERPROFILE%\Tools\jadx\`
apktool	✓	GitHub Release JAR + wrapper	Automatically download jar and generate bat to `%USERPROFILE%\Tools\apktool\`
JEB Pro	✗	User manually installs and provides valid license	Optional Android / ARM cross-validation tool; third-party MCP bridge requires separate audit
frida / frida-ps	✓	pip install frida-tools	Requires Python to be installed
adb	✓	winget / fallback path	Automatically install Android Platform-Tools
zipalign	✗	Need to manually install Android Build-Tools	`sdkmanager "build-tools;35.0.0"`
apksigner	✗	Need to manually install Android Build-Tools	Same as above

自举触发点

Bootstrap Trigger Points

```
scripts/decode.ps1
```
：缺 jadx 或 apktool 时自动调用
```
bootstrap-reverse.ps1
```
```
scripts/rebuild-sign-install.ps1
```
：缺 adb 或 apktool 时自动调用 bootstrap
```
scripts/frida-run.ps1
```
：当前仍为手动检查（frida 通常已通过 pip 安装）

```
scripts/decode.ps1
```
: Automatically call
```
bootstrap-reverse.ps1
```
when jadx or apktool is missing
```
scripts/rebuild-sign-install.ps1
```
: Automatically call bootstrap when adb or apktool is missing
```
scripts/frida-run.ps1
```
: Currently manual check (frida is usually installed via pip)

自举失败时

When Bootstrap Fails

如果自动安装失败，脚本会抛出明确错误并附带手动安装链接。常见原因：

网络不通（GitHub API / PyPI 不可达）
winget 不可用（Windows 版本过低）
Java 未安装（apktool 依赖 JDK）

If automatic installation fails, the script will throw a clear error with a manual installation link. Common reasons:

Network issues (GitHub API / PyPI unreachable)
winget unavailable (Windows version too low)
Java not installed (apktool depends on JDK)

任务完成自检（声称完成前 MUST 通过）

Task Completion Self-Check (MUST pass before claiming completion)

我是否执行了工作流中的每一步（而不是只阅读）？
我是否基于
```
tool-index
```
使用了真实工具路径？
我是否产出了可复现证据（命令/脚本/截图/报告）？
我是否完成并回写了 RULES 要求的 Checklist 项？

Have I executed every step in the workflow (instead of just reading)?
Have I used real tool paths based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?

apk-reverse

Original

Translation

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute immediately after reading)

APK 逆向 CLI 作业规范

APK Reverse Engineering CLI Operation Specification

适用范围

Applicable Scope

当前机器已验证可用的 CLI 工具

CLI Tools Verified Available on Current Machine

优先使用脚本的场景

Scenarios for Prioritizing Script Usage

自带脚本

Built-in Scripts

scripts/decode.ps1

scripts/decode.ps1

scripts/frida-run.ps1

scripts/frida-run.ps1

scripts/rebuild-sign-install.ps1

scripts/rebuild-sign-install.ps1

scripts/manifest-summary.ps1

scripts/manifest-summary.ps1

工具分工

Tool Division

jadx

jadx

JEB Pro（可选商业工具）

JEB Pro (Optional Commercial Tool)

apktool

apktool

frida

frida

adb

adb

推荐工作流

Recommended Workflow

1. Triage

1. Triage

2. Java 逻辑观察

2. Java Logic Observation

3. Smali 与资源层确认

3. Smali and Resource Layer Confirmation

4. 重建与安装

4. Rebuild and Installation

5. 动态 Hook

5. Dynamic Hook

6. Native .so 分流

6. Native .so Diversion

输出要求

Output Requirements

禁止事项

Prohibited Items

快速命令备忘

Quick Command Cheat Sheet

反编译 Java

Decompile Java

解包 APK

Unpack APK

重建 APK

Rebuild APK

设备与进程

Devices and processes

启动并注入

Launch and inject

路由上下文

Routing Context

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

自动化能力边界

Automation Capability Boundaries

自举触发点

Bootstrap Trigger Points

自举失败时

When Bootstrap Fails

任务完成自检（声称完成前 MUST 通过）

Task Completion Self-Check (MUST pass before claiming completion)

`scripts/decode.ps1`

`scripts/decode.ps1`

`scripts/frida-run.ps1`

`scripts/frida-run.ps1`

`scripts/rebuild-sign-install.ps1`

`scripts/rebuild-sign-install.ps1`

`scripts/manifest-summary.ps1`

`scripts/manifest-summary.ps1`

`jadx`

`jadx`

`JEB Pro`
（可选商业工具）

`JEB Pro`
(Optional Commercial Tool)

`apktool`

`apktool`

`frida`

`frida`

`adb`

`adb`

6. Native
`.so`
分流

6. Native
`.so`
Diversion