How Cross-Module Scenarios Work in reverse-skill: APK to .so Analysis Explained

Cross-module analysis in reverse-skill follows explicit routing rules where the apk-reverse skill automatically detects native libraries and hands off to ida-reverse or radare2 modules for deeper native-code inspection.

The reverse-skill framework treats each binary format as an isolated skill module, yet it defines structured cross-module pathways so analysts can pivot from high-level Android inspection to low-level native analysis when an APK contains embedded .so libraries.

The APK to .so Workflow: A 5-Step Hand-Off

When analyzing an Android application, the workflow follows a predictable progression from unpacking to native-code disassembly. Each step is documented in the skill files and enforced by the routing matrix.

Step 1: Unpack the APK and Enumerate Native Libraries

The apk-reverse skill serves as the entry point. It invokes standard tooling to extract the APK contents and identify any native libraries present.

• apktool d performs the primary unpacking
• jadx provides decompiled Java/Kotlin sources for reference
• The lib/ directory is scanned automatically for .so files

See skills/apk-reverse/references/android-advanced.md for the extraction methodology.

Step 2: Identify Core Logic Location in .so Files

Analysts determine whether critical functionality resides in Java/Kotlin layers or native code:

• Search smali output for native method declarations
• Review System.loadLibrary() calls in decompiled sources
• Flag .so files that warrant deeper inspection (e.g., libtarget.so)

Step 3: Routing Decision — Stay or Switch

The decision logic is codified in skills/apk-reverse/SKILL.md:

"APK 内含 .so 时切到 native 分析" (When the APK contains .so, switch to native analysis)

This is not an optional suggestion—it is a prescribed routing rule that ensures consistent workflow execution.

Step 4: Launch Native Analysis Module

The framework transfers control to the appropriate native-analysis skill:

• ida-reverse/ — For graph-driven disassembly and decompilation
• radare2/ — For scriptable, command-line oriented analysis

Both modules receive the extracted .so path and initialize their respective environments.

Step 5: Deep Native Inspection

Native modules execute their standard workflows:

• Symbol extraction and function boundary detection
• Cross-reference analysis from JNI entry points
• Frida hooking via scripts documented in skills/apk-reverse/references/frida-cookbook.md

The Routing Matrix: Formalized Cross-Module Rules

The skills/routing.md file explicitly maps this transition:

Source Module	Action	Condition	Target Module
APK / Android app	jadx decompile + apktool unpack	If core is in .so	ida-reverse/ or radare2/

This matrix ensures that cross-module analysis is reproducible across analysts and sessions, not dependent on individual judgment.

Practical Code Example: Executing the Full Flow

# Step 1: Decode the APK structure

.\apk-reverse\scripts\decode.ps1 -ApkPath app.apk -OutDir decoded

# Step 2: Discover native libraries

Get-ChildItem decoded\lib\* -Recurse -Include *.so

# Step 3: Route to IDA for arm64 native analysis

.\ida-reverse\scripts\load-so.ps1 -SoPath decoded\lib\arm64-v8a\libtarget.so

The script paths reflect the actual repository structure, with each skill maintaining its own scripts/ directory for executable workflows.

Key Source Files and Their Roles

• skills/apk-reverse/SKILL.md — Primary workflow definition including the native hand-off trigger
• skills/routing.md — Global routing matrix governing all cross-module transitions
• skills/apk-reverse/references/android-advanced.md — .so extraction techniques from APK containers
• skills/apk-reverse/references/frida-cookbook.md — Native function hooking examples bridging Android and .so layers
• skills/ida-reverse/SKILL.md & skills/radare2/SKILL.md — Native analysis implementations that receive routed .so files
• skills/reverse-engineering/SKILL.md — High-level orchestration document linking module hierarchies

Design Principles Behind Cross-Module Analysis

Modular isolation with explicit coupling. Each skill operates independently for maintainability, yet the routing matrix creates a dependency graph that the framework resolves at runtime.

Tool-agnostic routing. The matrix specifies what conditions trigger a hand-off, not how the target module implements analysis. This allows ida-reverse and radare2 to evolve without breaking upstream workflows.

Documentation as executable specification. The routing rules in SKILL.md files are written in both English and Chinese, reflecting the bilingual nature of the codebase, and are machine-parseable for potential automation.

Summary

• Cross-module analysis in reverse-skill is governed by explicit routing rules, not ad-hoc decisions.
• The apk-reverse skill automatically detects .so files and triggers hand-off per skills/routing.md.
• Analysts transition to ida-reverse or radare2 through standardized scripts that preserve analysis context.
• The routing matrix ensures reproducible workflows across APK, ELF, and other binary formats.
• All transitions are documented in skill-specific SKILL.md files with bilingual guidance.

Frequently Asked Questions

What triggers the APK to .so hand-off in reverse-skill?

The presence of native libraries in the lib/ directory after APK unpacking triggers the routing rule. Specifically, skills/apk-reverse/SKILL.md states that when an "APK 内含 .so" (APK contains .so), the analyst must switch to native analysis. This condition is also encoded in skills/routing.md for automated tooling.

Can I force native analysis even if no .so is detected?

The routing matrix assumes standard conditions, but skills are modular and can be invoked directly. You would bypass apk-reverse and call .\ida-reverse\scripts\load-so.ps1 with an externally sourced .so file. However, this breaks the cross-module audit trail that reverse-skill maintains.

How does reverse-skill handle multiple .so files in one APK?

The framework does not automatically prioritize among multiple native libraries. The analyst must identify which .so contains core logic—typically by grepping smali for native declarations or reviewing System.loadLibrary() calls—then invoke the appropriate native module with the selected path.

Is Frida integration part of the cross-module workflow?

Yes. The skills/apk-reverse/references/frida-cookbook.md provides scripts that bridge Android and native layers, allowing hooks on JNI functions that transition between Java and .so code. These scripts are designed to work with .so files already extracted through the standard workflow.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}