What problem does it solve? CTF mobile challenges often hide the decisive logic behind runtime trust boundaries like request signers, JNI bridges, and SSL pinning, which static analysis alone cannot reveal. This Skill provides a structured workflow for instrumenting an Android app at the narrowest effective boundary to recover signed requests and accepted server-side branches. ## Core Features & Use Cases - Static Triage Before Hooking: Map the manifest, exported components, deeplinks, native libraries, shared prefs, SQLite databases, and pinning logic before touching the runtime. - Narrow Boundary Hooking: Hook request signers, crypto helpers, JNI marshaling, keystore access, or WebView bridges with Frida instead of broad UI-level hooks, capturing plaintext inputs and signed outputs together. - Replay of Accepted Paths: Rebuild the smallest request sequence (state, nonce, body, signature, headers) that reaches the accepted server-side branch as proof of the trust boundary. - Use Case: During a CTF, you receive an APK whose flag endpoint rejects unsigned requests. Use this Skill to locate the signer in a JNI library, hook its input and output with Frida, bypass SSL pinning, and replay a valid signed request. ## Quick Start Activate the ctf-sandbox-orchestrator first, then ask it to hook the target APK's request signer and recover a replayable signed request.
