| name | r0crawl-skills |
|---|---|
| description | A beginner-friendly full-spectrum reverse-engineering router for Web/JavaScript, Android/iOS, Frida, unpacking, anti-analysis, native binaries, protocols, firmware, malware, games, cloud APIs, CTFs, and reproducible parity testing. Use for reverse, start, unpack, decompile, hook, Frida, bypass detection, APK/SO/DEX/JS/PCAP/WASM/PE/ELF/Mach-O analysis, signature recovery, or a complete investigation from sample to verified result. |
Before using advanced tools, explain:
- What the target is: web page, JavaScript, APK, DEX, native library, binary, protocol, firmware, or sample.
- What action matters: launch, login, search, upload, payment, encryption, validation, or network exchange.
- What material exists: file, URL, HAR, PCAP, log, screenshot, dump, source, or only a description.
- What result is wanted: explain behavior, locate an entry, write a hook, unpack a runtime artifact, reproduce a request, or write a report.
If no artifact exists, provide a short collection plan instead of pretending to analyze an invisible target.
For start, reverse start, mixed start, or full reverse:
- Run
triage-and-route. - Create evidence and a timeline with
evidence-collection. - Split work into static, runtime, loading/unpacking, protocol, and data-flow tracks.
- Load only modules matched by the routing tables.
- Use
reconstruction-and-parityfor a minimal reproducible result. - Use
systematic-debuggingfor every mismatch. - Report a beginner summary first, then a technical appendix.
| Signal | Load first |
|---|---|
| APK, AAB, DEX, smali, class loader | android-static-analysis, android-unpacking-and-dumping, dex-memory-dump |
| APK protection, shell, packer, loader, OEP | apk-protection-analysis, native-unpacking, packer-and-loader-analysis |
| SO, PE, ELF, Mach-O, assembly, decompiler | native-binary-analysis, ida-ghidra-workflow, symbol-recovery-and-structs |
| Frida, Java.perform, Interceptor, spawn, attach | frida-dynamic-analysis, frida-stealth-hooking |
| anti-Frida, maps, ports, threads, Gadget, Root, emulator | frida-anti-detection-analysis, root-emulator-detection, anti-analysis-and-integrity |
| JavaScript hook, fetch, XHR, WebSocket, Proxy, getter/setter | js-hook-engineering, browser-runtime-tracing, webcrypto-hooking |
| Worker, iframe, ServiceWorker, Blob URL, importScripts | js-worker-hooking, browser-runtime-tracing |
| obfuscation, JSFuck, AAEncode, webpack, flattened control flow | js-deobfuscation, ast-program-analysis, ollvm-deobfuscation |
| JSVMP, VMP, opcode, DSL VM, virtual machine | jsvmp-vmp-analysis, virtualization-protection, script-vm-sandbox-analysis |
| sign, token, cookie, header, encrypted request or response | web-signature-analysis, crypto-dataflow-analysis, reconstruction-and-parity |
| browser environment, canvas, WebGL, webdriver, fingerprint | browser-env-emulation, browser-fingerprint-analysis |
| captcha, challenge, WAF, 403, 412, risk control | captcha-protocol-analysis, anti-bot-analysis |
| TLS pinning, TrustManager, Cronet, NSURLSession | tls-pinning-analysis, android-network-stack, crypto-dataflow-analysis |
| PCAP, TCP, UDP, WebSocket, gRPC, Protobuf | protocol-reconstruction, websocket-grpc-analysis |
| iOS, Objective-C, Swift, dyld, jailbreak, IPA | ios-runtime-analysis, ios-unpacking-and-dump, objc-swift-hooking |
| Unity, IL2CPP, Unreal, anti-cheat | unity-il2cpp-analysis, game-security-reversing, anti-cheat-kernel-analysis |
| malware, C2, persistence, IOC, sandbox | malware-triage, malware-dynamic-analysis, detection-rule-engineering |
| firmware, U-Boot, SquashFS, IoT, BLE, USB | firmware-and-iot-analysis, ble-usb-protocol-reversing |
| crash, fuzz, minidump, coverage, harness | fuzzing-and-crash-analysis, crash-dump-symbolication, emulation-unicorn-angr |
| OAuth, JWT, GraphQL, cloud, agent, tool protocol | cloud-api-reversing, llm-agent-security-reversing |
| CTF, crackme, archive, flag, sandbox | ctf-reversing, ctf-sandbox-orchestration |
| Clue | Shortcut module |
|---|---|
| Geetest | vendor-geetest-captcha |
| Tencent TCaptcha | vendor-tencent-tcaptcha |
| NetEase Yidun | vendor-netease-yidun |
| Dingxiang | vendor-dingxiang-captcha |
| Shumei | vendor-shumei-captcha |
| Aliyun NVC, AWSC, Baxia | vendor-aliyun-nvc-baxia |
| JD jcap, H5ST | vendor-jd-jcap-h5st |
| Ruishu RS, 412, acw_sc | vendor-ruishu-rs |
| Akamai, _abck, bm_sz, sensor_data | vendor-akamai-bm |
| Cloudflare, Turnstile, clearance | vendor-cloudflare-waf, vendor-cloudflare-turnstile |
| AWS WAF, aws-waf-token | vendor-aws-waf |
3CA0
| Imperva, Incapsula, Reese84 | vendor-imperva-incapsula |
| DataDome, PerimeterX, Kasada | vendor-datadome, vendor-perimeterx, vendor-kasada |
| Douyin/TikTok a_bogus, x-bogus | web-douyin-abogus-xbogus |
| Xiaohongshu x-s, x-t | web-xiaohongshu-xs-xt |
| Taobao/Tmall MTOP, H5ST | web-taobao-mtop-h5st |
| Meituan mtgsig | web-meituan-mtgsig |
| Zhihu zse | web-zhihu-zse |
| Xueqiu acw, md5__1038 | web-xueqiu-acw |
| WeChat Mini Program | wechat-miniprogram-reversing |
| React Native, Flutter, Electron | react-native-reversing, flutter-dart-reversing, electron-app-reversing |
Use this case layout:
case/
case.yaml
evidence/raw/
evidence/derived/
notes/timeline.md
notes/hypotheses.md
repro/
tests/fixtures.jsonl
report.md
Every result must include a plain-English summary, evidence, route, reproducible check, limitations, and next action. Never treat a static string, one log line, or an automatic decompiler result as a confirmed call chain without independent validation.
Specialized modules live under skills/<name>/SKILL.md. Read only the modules matched by the routing tables. See references/catalog.md, references/tool-matrix.md, references/evidence.md, and docs/BEGINNER.md.