SkillFoxx

Reverse Engineering Skills

A set of reverse engineering skills: symbol and structure recovery, Frida and IDAPython scripting, DEX and IL2CPP dumping, code emulation in Unicorn

  • 2,355 ★ on the repository
  • Last commit
Skill

Broad access

Why this level

  • Removes protection and extracts code from third-party Android and iOS apps
  • Generates and runs Frida and IDAPython scripts, emulates and debugs binary code
All reasons and checks

p4nda0s/reverse-skillsAuthor:P4nda0s

Install

In your terminal, with SkillFoxx CLI

npx skillfoxx add skills/reverse-engineering-skills

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Broad accessThe tool can change data, run commands or handle secrets.

  • Removes protection and extracts code from third-party Android and iOS apps
  • Generates and runs Frida and IDAPython scripts, emulates and debugs binary code

This is third-party code. Review the repository files before installing.

What it does

The set gives the agent methodologies for eight reverse engineering tasks. rev-symbol recovers function names from strings, constants and cross-references, and rev-struct rebuilds data structures from decompiled code. rev-frida generates dynamic instrumentation scripts, and rev-unicorn-debug emulates and debugs selected snippets through the Unicorn engine. rev-dex-dumper pulls DEX files from a running Android app's memory, rev-u3d-dump extracts C# symbol addresses from Unity IL2CPP builds, rev-ios-dump decrypts iOS apps on a jailbroken device, and rev-idapython collects an IDAPython scripting reference. The set is built to work with IDA over MCP or through exports from the IDA-NO-MCP plugin.

Who it is for. For reverse engineers and specialists in malware analysis and mobile app security.

Good fit when

  • You need to recover function names or structures from IDA decompiled code
  • You need a Frida or IDAPython script for a specific analysis task
  • You need to dump DEX from an Android app's memory or extract symbols from a Unity IL2CPP build

Not a fit when

  • You have no rights to analyze the app or binary
  • You have no IDA and no IDA-NO-MCP exports for the skills to work with

Example request

Recover function names from the exports and decompiled code in the IDA export

Limitations

The skills are built around IDA: several steps need IDA Pro connected over MCP or exports from the IDA-NO-MCP plugin. Some skills assume Frida, Unicorn, Android tooling and a jailbroken iOS device. Reverse engineering and app decryption are not always permitted; the legality of use is on the user.

How to disable. Remove the skills with npx skills remove and their names, or delete the rev-* folders from the agent's skills directory.

FAQ

Do I need IDA?

Yes, for most skills. They work either through an IDA Pro connection over MCP or through data exported by the IDA-NO-MCP plugin.

Can I install only some of the skills?

Yes, remove the ones you do not need with npx skills remove and their names.

Discussion

No questions or reviews yet.

Skills

122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.

PluginBroad access239

A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools

SkillBroad access44.6K

A Claude Code skill that unpacks IPA files, finds API endpoints, secrets and vulnerabilities, and analyzes Mach-O binaries.

SkillBroad access120

An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research

MCP serverBroad access1.4K

A library of 196 reverse-engineering modules for agents: web, Android, Frida, native binaries, protocols and malware analysis.

SkillBroad access368

README in short

The README describes eight reverse engineering skills and notes support for many AI tools through the skills installer. Each skill covers its own task: symbols, structures, Frida, Unicorn emulation, DEX dumping, Unity symbol extraction, iOS decryption and an IDAPython reference. The set is built for IDA-NO-MCP: decompilation results are exported from IDA and then analyzed by the agent. Installation is a single npx skills add command, with commands for checking, updating and removing alongside. MIT licensed.

README badge

Original SKILL.md

---
name: rev-symbol
description: Restore function symbols by analyzing code patterns, strings, constants, and cross-references
---

# rev-symbol - Symbol Recovery

Analyze function code characteristics to recover/identify function symbols and names.

## Pre-check

**Determine which IDA access method is available:**

**Option A — IDA Pro MCP (preferred if connected):**
Check if the IDA Pro MCP server is connected (look for an active `ida-pro` or equivalent MCP connection). If connected, you can query IDA directly via MCP tools — no exported files needed. Proceed with the analysis using MCP.

**Option B — IDA-NO-MCP exported data:**
If MCP is not connected, check if IDA-NO-MCP exported data exists in the current directory:

1. Check if `decompile/` directory exists
2. Check if there are `.c` files inside

Report a problem