castle-reverse

What problem does it solve?

This Skill eliminates the need for manual, undocumented reverse-engineering of Castle.io anti-bot SDKs to access or reproduce their request tokens, which are required to bypass or integrate with Castle-protected applications and websites.

Core Features & Use Cases

• Full Android v3.1.1 (Highwind) Token Reverse-Engineering: Complete documentation of the obfuscated token generation logic, including the 3-layer nibble-XOR crypto scheme and 38-field device fingerprint collection, with no reliance on XXTEA encryption used in older web versions.
• Web SDK v2.6.0 Support: Includes an archived open-source reimplementation of the web/JS SDK token v11 algorithm for browser-based Castle.io integration.
• Ready-to-Use Tooling: Provides offline token generators, decoders, and Frida hooks for live token capture and byte-exact verification of reversed logic.
• Use Case: For example, a security tester can use this Skill to generate valid X-Castle-Request-Token values for an Android app using Castle.io protection, without sending requests to the live Castle Risk API.

Quick Start

Use the castle-reverse skill to generate a valid X-Castle-Request-Token for a target Android app by providing its publishable key and the device's captured fingerprint field values.