What problem does it solve? Mobile applications hide API endpoints, hardcoded secrets, and client-side logic behind compiled binaries, SSL pinning, and root/jailbreak detection, making security assessment of Android and iOS apps slow and error-prone without a structured methodology. ## Core Features & Use Cases - Four-Phase Methodology: Guides information gathering, static analysis (JADX, apktool, Ghidra, class-dump), dynamic instrumentation (Frida, Objection), and network interception (Burp, mitmproxy) for both platforms. - Defense Bypass Playbooks: Provides layered bypass techniques for SSL pinning, root/jailbreak detection, and anti-debugging, including Frida Gadget injection for non-rooted and non-jailbroken devices. - Cryptographic Key Extraction: Hooks Cipher and CCCrypt calls to recover AES/RSA/HMAC keys and algorithm parameters at runtime. - Use Case: During a mobile penetration test, use this Skill to decrypt an App Store IPA, bypass its jailbreak detection and SSL pinning with Objection, then hook its crypto functions to extract hardcoded API keys and enumerate hidden backend endpoints. ## Quick Start Use the mobile-reverse skill to analyze the target Android APK, bypass its SSL pinning and root detection with Frida, and extract any hardcoded API keys and backend endpoints.
