Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-mobile-packgit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile-pack)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile-pack"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mobile-pack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-mobile-pack"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-mobile-pack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.04210 |
| Opus 5 | $0.00032 | $0.02105 |
| Sonnet 5 | $0.00013 | $0.00842 |
| Haiku 4.5 | $0.00006 | $0.00421 |
Grade A, and why
re-mobile-pack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android 加固脱壳（DEX 恢复）
何时使用 / 何时不用
- 用：拿到 Android 加固（乐固/360/梆梆/爱加密等）App，需要还原真实 DEX 继续静态分析
- 用：[[re-apk]] 已识别出加固，需要选脱壳路径
- 用：脱壳产物方法体空壳 / 指令抽取，需要修复
- 不用：未确认加固——先 [[re-apk]] 静态确认；普通 App 直接 jadx 即可
- 不用：VMP 虚拟化为主的强壳——转 [[re-anti-analysis]]（[[re-unpack-advanced]] 思路）
- 不用：需要运行时 hook / 绕过检测（那是 [[re-frida]]）
工具准备
动态脱壳默认在受控设备 / 模拟器快照内执行（[[platform-tips]] 最高原则——默认沙箱）。所有工具先验证再使用。
frida + frida-dexdump —— 运行脱壳主力
- frida-tools: 全平台
pip install frida-tools（Python 3.8+；建议 venv）；frida-server 版本必须与主机一致并推送设备（安装与反检测完整流程见 [[re-frida]] 工具准备） - frida-dexdump: 全平台
pip install frida-dexdump（Python 3）——运行时搜索内存中的 DEX 魔数并 dump - 验证:
frida --version；frida-dexdump -h（能看到-U/-f/-d参数） - 用法:
frida-dexdump -U -f <包名>（spawn 起步脱壳）、frida-dexdump -U <pid>（attach）、frida-dexdump -U -f <包名> -d（深度搜索，覆盖多 DEX / 部分抽取）
BlackDex —— 静态脱壳机（免 frida，普通加固首选替代）
- 安装: GitHub release 下载 APK——
https://github.com/CodingGay/BlackDex/releases；32 位与 64 位是两个独立 APK（目标 App 不出现在列表就换另一个架构版本） - 环境: 普通 Android 手机或模拟器，Android 5.0~12，无需 root / 定制环境
- 能力: 覆盖落地加载 / 内存加载 / 指令抽取三类壳；深度模式回填指令抽取的方法体（实验性，可能耗时数分钟或失败）
- 产物:
hook_*.dex（hook 系统 API 得到）与cookie_*.dex（DexFile cookie 技术） - 验证: 安装后能列出目标 App 并完成脱壳
Youpk —— 主动调用脱壳机（抽取加固最强路径）
- 源码/ROM:
https://github.com/Youlor/Youpk——基于 Android 7.1.2_r33 二次开发，仅支持 Google Pixel 1：Android Studio 构建后flash-all.sh刷入定制 ROM - 用法:
adb shell "echo <包名> >> /data/local/tmp/unpacker.config"→ 启动目标 App 自动主动调用脱壳（日志见 "unpack end"）→adb pull /data/data/<包名>/unpacker - 修复:
java -jar dexfixer.jar ./unpacker ./out（配套 DEX 修复，回填方法指令） - 验证:
adb shell ls /data/data/<包名>/unpacker能看到 dex/method 产物
jadx —— 脱壳后反编译（复用 [[re-apk]]）
- 跨 OS 安装与验证见 [[re-apk]] 工具准备；jadx 支持多 DEX 直接分析，避免手工合并
adb —— 设备交互
- Android SDK platform-tools 自带；验证
adb --version；模拟器场景adb shell即可 - dexdump: Android SDK build-tools 自带（步骤 4 DEX 完整性检查用）；验证
dexdump -h
内存转储（[[re-memdump]] 思路）
- frida/objection
memory dump或按 [[re-memdump]] 从转储 grep DEX 魔数dex\n0xx提取——frida-dexdump 不可用时的兜底路径
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 119 lines · 65 tokens per session scan A 9b3bad2bace8
re-mobile-pack is a skill published in the GitHub repository dslsdzc/rev-skills (50 stars, last pushed 11d ago), licensed Apache-2.0. It adds 65 tokens to every session and 4,210 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
android-pentest
A guide for authorized security testing of Android apps, covering APK inspection, runtime testing, traffic capture, code review, and function hooking. An APK is the installable package used by an Android app.
redteam-mobile-detail-pack
Domain routing and boundary guidance for authorized mobile application security testing, including insecure storage, certificate pinning bypass, exposed components, and binary reverse engineering. Use when a task belongs to the mobile testing domain and needs scope, evidence, pivot, or exit criteria.
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
ios-exploiting
A research guide for examining iOS operating-system components, including kernel files, with virtual devices, jailbroken phones, emulators, and binary comparison tools. Corellium is a cloud service that can run virtual iOS devices.