rev-unicorn-debug — Claude Code skill: Unicorn emulation
A reversing skill that runs one function from a binary inside Unicorn, stubbing JNI, syscalls and libc so emulation reaches the return.
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a claude-codeWhat rev-unicorn-debug does
The skill handles the case where you want one function, not the whole binary: a license check, a string decryption loop, a slice of a native library. The agent reads the file as raw bytes and maps them into Unicorn memory, skipping the ELF, PE or Mach-O headers. Shorter path, fewer places to trip. Raw mapping fails when the code references segments at fixed addresses — then it parses headers minimally, only the segments actually in use.
Next it lists what the target calls outward: malloc, memcpy, GetStringUTFChars, syscalls, operator new. Each address gets a hook, and a Python stand-in answers: a bump allocator for malloc, a fake JNIEnv table with RET stubs at every entry. Once the stand-in returns, PC is set to LR and the original function never runs.
First attempts crash. The skill loops: run, read the faulting address and access type from the callback, add the hook, map the page, adjust registers, run again. Tracing stays at block level, since an instruction log on a long range is unreadable. You need Python and the Unicorn engine in place. A reference table covers ARM64, ARM32, x86-64, x86-32 and MIPS32: stack pointer, link register, argument registers, return register, syscall mechanism.
What it helps with
- emulate a single function from a native library without launching the app
- recover decrypted strings by running only the relevant code path
- stub out JNI calls so emulation reaches the return
- map the missing page at the faulting address
- cap an infinite loop with an execution counter
Example prompts for the agent
- Emulate this check function in Unicorn and tell me what it returns for my input.
- Trace just the string decryption range, no need to run the whole binary.
- Stub the JNI calls, emulation keeps dying inside
GetStringUTFChars.
How to install rev-unicorn-debug
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a claude-code2Manually: put the files in place
~/.claude/skills/rev-unicorn-debug/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/rev-unicorn-debug/
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a codex2Manually: put the files in place
.agents/skills/rev-unicorn-debug/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a cursor2Manually: put the files in place
.cursor/skills/rev-unicorn-debug/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install P4nda0s/reverse-skills rev-unicorn-debug2Manually: put the files in place
.github/skills/rev-unicorn-debug/SKILL.md1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a gemini-cli2Platform CLI
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-unicorn-debugManually: put the files in place
.devin/skills/rev-unicorn-debug/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about rev-unicorn-debug
How do I install rev-unicorn-debug in Claude Code?
Run npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a claude-code. The skill lands at ~/.claude/skills/rev-unicorn-debug/SKILL.md.
What does rev-unicorn-debug do?
It emulates individual functions or code fragments with Unicorn and replaces external dependencies with Python stand-ins. That gets you a function's return value or decoded data without running the program.
Which architectures does it cover?
The reference table covers ARM64, ARM32, x86-64, x86-32 and MIPS32, listing argument and return registers, the stack pointer and syscall numbers.
