Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to…
Capture one Mira detection case as a structured record. Use when Codex needs to turn a concrete finding, experiment, command output, or risk-environment clue into a reusable case with smells, key clues, judgment seeds, and next checks under the Mira knowledge pipeline.
Route Mira detection findings into a reusable knowledge pipeline. Use when Codex needs to turn a new detection clue, risk-environment observation, or research note into topic confirmation, case capture, topic maintenance, and article update suggestions inside the Mira repository.
Run Mira environment risk collection. Use when the user says /collect, asks to collect or review device environment risks, wants automatic analysis of Android/iOS/Mira runtime signals, or wants to turn fresh Mira observations into reusable risk clues and follow-up checks.
A method for recovering an unknown encryption, signing, or encoding algorithm from an ARM64 execution trace, which is a recorded sequence of processor operations. It uses evidence from the trace and checks possible algorithms against the observed results.
Strong activation entry for AlgoKiller ciphertext-recovery mode. Bind an ARM64 trace, force-load the ciphertext-recovery methodology, and start cipher / algorithm recovery from a target ciphertext.
A method for analyzing ARM64 execution traces, which are detailed records of processor instructions and program activity. It uses a bound trace file and evidence from trace-analysis tools to study execution flow, fields, calls, and data buffers.
Rust CLI reference for the headless-ghidra pipeline. Covers command syntax, flags, output contract, artifact paths, and workspace layout for all ghidra-agent-cli subcommands. Load when: constructing a ghidra-agent-cli command, interpreting its output, resolving a flag or artifact path question, or debugging CLI…
Thoroughly analyze a single function by first recovering its type definitions, constant definitions, vtables, function name and signature, then producing the final decompilation. Use when the user wants a complete per-function analysis following the strict recovery order: types → constants → vtables → function…
Entry skill for the Headless Ghidra YAML-first reverse-engineering pipeline. Use when the user asks to analyze, decompile, triage, resume, or iterate on a binary target with Ghidra/headless-ghidra. Reads artifacts/ /pipeline-state.yaml, routes P0–P4 phase skills, runs gate checks, and manages review pauses. Performs…
Use this skill for any security-testing work inside a Mobix engagement: reviewing captured traffic, planning static or dynamic tests, hunting for IDOR/BOLA, checking JWT/session/token handling, assessing local storage or IPC surface, or writing up findings. Triggers automatically inside mp engage sessions (interactive…
Investigate authorized binaries and runtime behavior with HexWitness's durable evidence MCP and optional Binary Ninja or IDA live tools. Use for function or class discovery, UUID and field mapping, protocol reconstruction, capture comparison, contradiction analysis, evidence-gap planning, and promotion of live…