# How Cross-Module Scenarios Work in reverse-skill: APK to .so Analysis Explained

> Discover how cross-module analysis in reverse-skill works for APK to .so analysis. Learn how it automatically detects native libraries and uses IDA Pro or Radare2 for deep inspection.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-14

---

**Cross-module analysis in reverse-skill follows explicit routing rules where the apk-reverse skill automatically detects native libraries and hands off to ida-reverse or radare2 modules for deeper native-code inspection.**

The `reverse-skill` framework treats each binary format as an isolated **skill module**, yet it defines structured **cross-module pathways** so analysts can pivot from high-level Android inspection to low-level native analysis when an APK contains embedded `.so` libraries.

## The APK to .so Workflow: A 5-Step Hand-Off

When analyzing an Android application, the workflow follows a predictable progression from unpacking to native-code disassembly. Each step is documented in the skill files and enforced by the routing matrix.

### Step 1: Unpack the APK and Enumerate Native Libraries

The **apk-reverse** skill serves as the entry point. It invokes standard tooling to extract the APK contents and identify any native libraries present.

- `apktool d` performs the primary unpacking
- `jadx` provides decompiled Java/Kotlin sources for reference
- The `lib/` directory is scanned automatically for `.so` files

See [`skills/apk-reverse/references/android-advanced.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/android-advanced.md) for the extraction methodology.

### Step 2: Identify Core Logic Location in .so Files

Analysts determine whether critical functionality resides in Java/Kotlin layers or native code:

- Search smali output for `native` method declarations
- Review `System.loadLibrary()` calls in decompiled sources
- Flag `.so` files that warrant deeper inspection (e.g., `libtarget.so`)

### Step 3: Routing Decision — Stay or Switch

The decision logic is codified in [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md):

> *"APK 内含 `.so` 时切到 native 分析"* (When the APK contains `.so`, switch to native analysis)

This is not an optional suggestion—it is a prescribed routing rule that ensures consistent workflow execution.

### Step 4: Launch Native Analysis Module

The framework transfers control to the appropriate native-analysis skill:

- **`ida-reverse/`** — For graph-driven disassembly and decompilation
- **`radare2/`** — For scriptable, command-line oriented analysis

Both modules receive the extracted `.so` path and initialize their respective environments.

### Step 5: Deep Native Inspection

Native modules execute their standard workflows:

- Symbol extraction and function boundary detection
- Cross-reference analysis from JNI entry points
- **Frida hooking** via scripts documented in [`skills/apk-reverse/references/frida-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/frida-cookbook.md)

## The Routing Matrix: Formalized Cross-Module Rules

The [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) file explicitly maps this transition:

| Source Module | Action | Condition | Target Module |
|-------------|--------|-----------|---------------|
| APK / Android app | `jadx` decompile + `apktool` unpack | *If core is in `.so`* | `ida-reverse/` or `radare2/` |

This matrix ensures that cross-module analysis is **reproducible across analysts and sessions**, not dependent on individual judgment.

## Practical Code Example: Executing the Full Flow

```powershell

# Step 1: Decode the APK structure

.\apk-reverse\scripts\decode.ps1 -ApkPath app.apk -OutDir decoded

# Step 2: Discover native libraries

Get-ChildItem decoded\lib\* -Recurse -Include *.so

# Step 3: Route to IDA for arm64 native analysis

.\ida-reverse\scripts\load-so.ps1 -SoPath decoded\lib\arm64-v8a\libtarget.so

```

The script paths reflect the actual repository structure, with each skill maintaining its own `scripts/` directory for executable workflows.

## Key Source Files and Their Roles

- **[`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md)** — Primary workflow definition including the native hand-off trigger
- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)** — Global routing matrix governing all cross-module transitions
- **[`skills/apk-reverse/references/android-advanced.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/android-advanced.md)** — `.so` extraction techniques from APK containers
- **[`skills/apk-reverse/references/frida-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/frida-cookbook.md)** — Native function hooking examples bridging Android and `.so` layers
- **[`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) & [`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md)** — Native analysis implementations that receive routed `.so` files
- **[`skills/reverse-engineering/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md)** — High-level orchestration document linking module hierarchies

## Design Principles Behind Cross-Module Analysis

**Modular isolation with explicit coupling.** Each skill operates independently for maintainability, yet the routing matrix creates a **dependency graph** that the framework resolves at runtime.

**Tool-agnostic routing.** The matrix specifies *what* conditions trigger a hand-off, not *how* the target module implements analysis. This allows `ida-reverse` and `radare2` to evolve without breaking upstream workflows.

**Documentation as executable specification.** The routing rules in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files are written in both English and Chinese, reflecting the bilingual nature of the codebase, and are machine-parseable for potential automation.

## Summary

- **Cross-module analysis in reverse-skill** is governed by explicit routing rules, not ad-hoc decisions.
- The **apk-reverse** skill automatically detects `.so` files and triggers hand-off per [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md).
- Analysts transition to **ida-reverse** or **radare2** through standardized scripts that preserve analysis context.
- The **routing matrix** ensures reproducible workflows across APK, ELF, and other binary formats.
- All transitions are documented in skill-specific [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files with bilingual guidance.

## Frequently Asked Questions

### What triggers the APK to .so hand-off in reverse-skill?

The presence of native libraries in the `lib/` directory after APK unpacking triggers the routing rule. Specifically, [`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md) states that when an "APK 内含 `.so`" (APK contains `.so`), the analyst must switch to native analysis. This condition is also encoded in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) for automated tooling.

### Can I force native analysis even if no .so is detected?

The routing matrix assumes standard conditions, but skills are modular and can be invoked directly. You would bypass `apk-reverse` and call `.\ida-reverse\scripts\load-so.ps1` with an externally sourced `.so` file. However, this breaks the cross-module audit trail that `reverse-skill` maintains.

### How does reverse-skill handle multiple .so files in one APK?

The framework does not automatically prioritize among multiple native libraries. The analyst must identify which `.so` contains core logic—typically by grepping smali for `native` declarations or reviewing `System.loadLibrary()` calls—then invoke the appropriate native module with the selected path.

### Is Frida integration part of the cross-module workflow?

Yes. The [`skills/apk-reverse/references/frida-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/references/frida-cookbook.md) provides scripts that bridge Android and native layers, allowing hooks on JNI functions that transition between Java and `.so` code. These scripts are designed to work with `.so` files already extracted through the standard workflow.