# rev-frida

A skill that writes Frida instrumentation scripts for runtime analysis: hooking functions, tracing calls, dumping memory. Useful when reversing Android apps and native libraries.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2200 installs · ★ 2314
- Author: P4nda0s
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-frida/SKILL.md
- Updated: 2026-05-06
- HTML: https://affpapa.org/en/nevibecode/skills/rev-frida

## What it does

The skill activates when you ask for a Frida script, a runtime hook on some function, capture of arguments or a return value, interception of a native, ObjC or Java method, a memory dump, or export enumeration. Output targets the current API: `Process.getModuleByName()`, `mod.getExportByName()`, `Interceptor.attach`, `NativeFunction`, `Memory.scan`. The old `--no-pause` flag is gone from its examples, since a spawned process resumes once the script loads.

Module load timing gets its own section. The skill refuses to assume your target `.so` is already mapped. Its preferred route is a hook on `android_dlopen_ext` or `dlopen`, installing the real hooks in `onLeave`; an immediate `Process.findModuleByName()` check covers libraries already in memory, and timer polling stays a last resort. Modules are deduplicated by base address rather than by path.

Hooking `.init`, `.init_array`, constructors or `JNI_OnLoad` blindly is something the skill pushes back on. Those spots are fragile. Libraries run one-time setup there, a bad hook can kill the process before the real target logic executes, and early interception shifts timing enough to hide the behaviour you wanted to study. Before it suggests an init-stage hook, the skill wants a reason for hooking that early plus the exact module and function involved.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-frida -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rev-frida/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rev-frida/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-frida -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rev-frida/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-frida -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rev-frida/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install P4nda0s/reverse-skills rev-frida
```

2. **Manually: put the files in place**
- File: `.github/skills/rev-frida/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-frida -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-frida
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rev-frida/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-frida -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-frida/SKILL.md

## When to use it
- hook a native export in `libssl.so` and print its arguments
- trace a Java `onCreate` method inside an Android app
- dump a memory region and inspect it with `hexdump()`
- catch the moment a target `.so` loads and hook it after constructors run
- capture a function's return value without patching its code

## Example prompts
- Write a Frida script that hooks `SSL_read` in `libssl.so` and prints the first two arguments
- Hook `android.app.Activity.onCreate` and print the call stack
- Make a script that waits for `libtarget.so` to load and hooks the `target_export` export

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [p4nda0s/reverse-skills](https://affpapa.org/en/nevibecode/by/p4nda0s/reverse-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md