bilibili-reverse

What problem does it solve?

This Skill solves the challenge of reverse-engineering Bilibili's heavily obfuscated Android app API protections, including native MD5 request signing, JWT ticket authentication, OAuth2 token refresh, and gRPC traffic capture, which cannot be replicated using outdated public documentation alone.

Core Features & Use Cases

• Native Sign Algorithm Recovery: Precisely reconstruct Bilibili's APP-API sign parameter (MD5 over sorted URL-encoded request params + appSecret streamed as 4 uint32 words) directly from reverse-engineered libbili.so native code, eliminating reliance on stale community resources.
• Authentication Flow Replication: Reproduce the full x-bili-ticket JWT generation (HMAC-SHA256 GenWebTicket) and OAuth2 access_key/refresh_token rotation flows to maintain valid authenticated sessions for automated tooling.
• Native Traffic Capture: Bypass Bilibili's bundled BoringSSL, system proxy ignoring, and anti-Frida detection via Frida native hooks to capture plaintext REST and gRPC traffic directly from SSL_write/SSL_read calls.
• Worked End-to-End Example: Includes a ready-to-use Python script to post comments via the /x/v2/reply/add API, demonstrating full integration of signing, ticket generation, and request replay.
• Use Case: Ideal for security researchers analyzing Bilibili app traffic, developers building automated tools that interact with Bilibili's Android API, or anyone needing to validate or reproduce protected API requests without manual reverse-engineering effort.

Quick Start

Use the bilibili-reverse skill to capture Bilibili app traffic via Frida native hooks, reproduce the sign parameter for a captured request, and replay the request to post a comment to a target video using the provided Python scripts.