How reverse-skill Handles Dynamic Analysis of Android Applications Using Frida

The reverse-skill framework automates Frida-based dynamic analysis through a routing system that maps APK tasks to the apk-reverse skill, providing a PowerShell runner script and documented hook patterns for runtime inspection.

Android reverse engineering often requires both static and dynamic techniques. The reverse-skill repository by zhaoxuya520 implements a structured workflow where Frida serves as the primary dynamic instrumentation engine for analyzing running Android applications. This article explains how the framework orchestrates Frida operations, from tool discovery to script injection.

Routing System for Android APK Analysis

The framework's entry point for any Android-related task is a centralized routing mechanism.

In skills/config/routing.json, the system maps the APK / Android app hint to the apk-reverse skill. This routing decision triggers the entire Android-specific toolchain, including Frida integration. The routing table ensures that analysts never manually configure tool selection—the framework infers the correct skill based on input file type.

// Conceptual excerpt from skills/config/routing.json
{
  "pattern": "*.apk",
  "skill": "apk-reverse",
  "tools": ["frida", "jadx", "apktool"]
}

Tool discovery happens through skills/scripts/lib/ToolDiscovery.ps1, which registers Frida with purpose 'Frida 动态注入' (Frida dynamic injection) and links the executable to the runner helper.

The Frida Runner: frida-run.ps1

The PowerShell script at apk-reverse/scripts/frida-run.ps1 is the unified CLI entry point for all Frida operations. It wraps the native Frida CLI (frida, frida-ps) and exposes convenience parameters for common workflows.

Device and Process Enumeration

Before attaching to a target, analysts enumerate available devices and running processes:

# List connected devices

pwsh -File "C:\reverse-skill\apk-reverse\scripts\frida-run.ps1" -ListDevices

# List processes on USB-connected device

pwsh -File "C:\reverse-skill\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses

Application Spawning and Script Injection

The -Spawn parameter launches an application in a suspended state, attaches the Frida injector, then resumes execution with the specified JavaScript hook loaded:

pwsh -File "C:\reverse-skill\apk-reverse\scripts\frida-run.ps1" `
    -Usb `
    -Spawn `
    -Package com.example.myapp `
    -ScriptPath "C:\hooks\sslPinBypass.js"

Key parameters include:

• -Usb – Target USB-connected devices (typical for physical Android phones)
• -Spawn – Start the application fresh rather than attaching to a running instance
• -Package – Specify the target application's package name
• -ScriptPath – Path to the JavaScript hook file

The script internally forwards these arguments to frida -U -f <pkg> -l <script>, providing a consistent PowerShell-native interface.

Hook Patterns and Anti-Debug Techniques

The framework's documentation in skills/reverse-engineering/tools-dynamic.md catalogs common Frida patterns for Android analysis. Two fundamental interception mechanisms are emphasized:

Interceptor.attach for Method Tracing

Use Interceptor.attach to observe function entry and exit without altering behavior:

Interceptor.attach(Module.findExportByName(null, "strcmp"), {
    onEnter: function(args) {
        console.log("[strcmp] comparing:", args[0].readCString(), "vs", args[1].readCString());
    }
});

Interceptor.replace for Runtime Patching

Use Interceptor.replace to substitute entire function implementations, effective for bypassing security controls:

Java.perform(() => {
    const CertificatePinner = Java.use('okhttp3.CertificatePinner');
    CertificatePinner.check.overload('java.lang.String', 'java.security.cert.Certificate').implementation = function(host, cert) {
        console.log('[+] SSL pinning bypassed for', host);
        // Accept any certificate by doing nothing
    };
});

This pattern targets OkHttp's certificate pinning—common in modern Android applications—and demonstrates how reverse-skill enables real-time verification of static analysis hypotheses.

Integration with Static Analysis Workflow

The framework bridges static and dynamic phases through skill composition. When an APK contains native .so libraries:

1. Static phase – jadx or apktool decompiles Dalvik bytecode; radare2 or ida-reverse skills analyze native libraries
2. Hypothesis formation – Analysts identify candidate functions (e.g., strcmp comparisons for license checks, memcmp for cryptographic validation)
3. Dynamic validation – The frida-run.ps1 script injects hooks to confirm control flow and extract runtime values

This pivot from static to dynamic is automated through the routing layer—no manual path configuration required.

Pipeline Automation

Environment setup is handled by skills/scripts/refresh-tool-index.sh, which:

• Detects Frida installation on the system
• Adds Frida to the skill's tool index with version metadata
• Ensures the frida-run.ps1 script paths are correctly resolved

Running this script prepares any CI/CD or analysis workstation for immediate Frida operations.

Summary

• Routing – skills/config/routing.json automatically directs APK files to the apk-reverse skill
• Tool registration – ToolDiscovery.ps1 identifies Frida as a dynamic injection capability
• Execution wrapper – frida-run.ps1 provides unified PowerShell access to device listing, process enumeration, spawning, and script injection
• Documentation – tools-dynamic.md contains authoritative hook patterns for Android-specific scenarios
• Automation – refresh-tool-index.sh maintains environment readiness

Frequently Asked Questions

What Frida commands does reverse-skill support through its PowerShell wrapper?

The frida-run.ps1 script supports device enumeration (-ListDevices), process listing (-ListProcesses), application spawning (-Spawn -Package), and custom script injection (-ScriptPath). It translates these parameters to native frida and frida-ps CLI invocations.

How does reverse-skill choose when to use Frida versus static tools?

The routing table in skills/config/routing.json maps file patterns to skills. APK files route to apk-reverse, which includes both static tools (JADX, apktool) and dynamic tools (Frida). Analysts explicitly invoke the Frida runner when runtime inspection is required.

Can reverse-skill Frida hooks target specific Android versions or emulators?

Yes. The frida-run.ps1 script accepts -Usb for physical devices and can target emulators or remote Frida-server instances through additional parameter combinations documented in tools-dynamic.md.

Where are example Frida scripts for common Android bypasses documented?

The markdown file skills/reverse-engineering/tools-dynamic.md contains patterns for SSL pinning bypass, anti-debug circumvention, and memory scanning, with JavaScript implementations targeting Android-specific frameworks like OkHttp.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}