rev-frida — Claude Code skill: Frida hook script generator
A skill that writes Frida instrumentation scripts for runtime analysis: hooking functions, tracing calls, dumping memory. Useful when reversing Android apps and native libraries.
npx skills add P4nda0s/reverse-skills --skill rev-frida -a claude-codeWhat rev-frida does
The skill activates when you ask for a Frida script, a runtime hook on some function, capture of arguments or a return value, interception of a native, ObjC or Java method, a memory dump, or export enumeration. Output targets the current API: Process.getModuleByName(), mod.getExportByName(), Interceptor.attach, NativeFunction, Memory.scan. The old --no-pause flag is gone from its examples, since a spawned process resumes once the script loads.
Module load timing gets its own section. The skill refuses to assume your target .so is already mapped. Its preferred route is a hook on android_dlopen_ext or dlopen, installing the real hooks in onLeave; an immediate Process.findModuleByName() check covers libraries already in memory, and timer polling stays a last resort. Modules are deduplicated by base address rather than by path.
Hooking .init, .init_array, constructors or JNI_OnLoad blindly is something the skill pushes back on. Those spots are fragile. Libraries run one-time setup there, a bad hook can kill the process before the real target logic executes, and early interception shifts timing enough to hide the behaviour you wanted to study. Before it suggests an init-stage hook, the skill wants a reason for hooking that early plus the exact module and function involved.
What it helps with
- hook a native export in
libssl.soand print its arguments - trace a Java
onCreatemethod inside an Android app - dump a memory region and inspect it with
hexdump() - catch the moment a target
.soloads and hook it after constructors run - capture a function's return value without patching its code
Example prompts for the agent
- Write a Frida script that hooks
SSL_readinlibssl.soand prints the first two arguments - Hook
android.app.Activity.onCreateand print the call stack - Make a script that waits for
libtarget.soto load and hooks thetarget_exportexport
How to install rev-frida
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-frida -a claude-code2Manually: put the files in place
~/.claude/skills/rev-frida/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/rev-frida/
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-frida -a codex2Manually: put the files in place
.agents/skills/rev-frida/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-frida -a cursor2Manually: put the files in place
.cursor/skills/rev-frida/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install P4nda0s/reverse-skills rev-frida2Manually: put the files in place
.github/skills/rev-frida/SKILL.md1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-frida -a gemini-cli2Platform CLI
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-fridaManually: put the files in place
.devin/skills/rev-frida/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-frida -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about rev-frida
How do I install rev-frida in Claude Code?
Run npx skills add P4nda0s/reverse-skills --skill rev-frida -a claude-code. The skill lands at ~/.claude/skills/rev-frida/SKILL.md.
What does rev-frida do?
It generates Frida scripts for dynamic analysis: hooking native, Java and ObjC methods, tracing calls, capturing arguments and return values, dumping memory.
Why does the skill warn against hooking constructors and JNI_OnLoad?
Libraries do one-time setup in those places, so a bad hook can crash the process before the target logic runs. Early interception also changes timing and hides the behaviour you are studying.
