# rev-unicorn-debug

A reversing skill that runs one function from a binary inside Unicorn, stubbing JNI, syscalls and libc so emulation reaches the return.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1800 installs · ★ 2314
- Author: P4nda0s
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-unicorn-debug/SKILL.md
- Updated: 2026-05-06
- HTML: https://affpapa.org/en/nevibecode/skills/rev-unicorn-debug

## What it does

The skill handles the case where you want one function, not the whole binary: a license check, a string decryption loop, a slice of a native library. The agent reads the file as raw bytes and maps them into Unicorn memory, skipping the ELF, PE or Mach-O headers. Shorter path, fewer places to trip. Raw mapping fails when the code references segments at fixed addresses — then it parses headers minimally, only the segments actually in use.

Next it lists what the target calls outward: `malloc`, `memcpy`, `GetStringUTFChars`, syscalls, `operator new`. Each address gets a hook, and a Python stand-in answers: a bump allocator for `malloc`, a fake `JNIEnv` table with RET stubs at every entry. Once the stand-in returns, PC is set to LR and the original function never runs.

First attempts crash. The skill loops: run, read the faulting address and access type from the callback, add the hook, map the page, adjust registers, run again. Tracing stays at block level, since an instruction log on a long range is unreadable. You need Python and the Unicorn engine in place. A reference table covers ARM64, ARM32, x86-64, x86-32 and MIPS32: stack pointer, link register, argument registers, return register, syscall mechanism.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rev-unicorn-debug/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rev-unicorn-debug/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rev-unicorn-debug/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rev-unicorn-debug/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install P4nda0s/reverse-skills rev-unicorn-debug
```

2. **Manually: put the files in place**
- File: `.github/skills/rev-unicorn-debug/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-unicorn-debug
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rev-unicorn-debug/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-unicorn-debug -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-unicorn-debug/SKILL.md

## When to use it
- emulate a single function from a native library without launching the app
- recover decrypted strings by running only the relevant code path
- stub out JNI calls so emulation reaches the return
- map the missing page at the faulting address
- cap an infinite loop with an execution counter

## Example prompts
- Emulate this check function in Unicorn and tell me what it returns for my input.
- Trace just the string decryption range, no need to run the whole binary.
- Stub the JNI calls, emulation keeps dying inside `GetStringUTFChars`.

## Similar
- [leanrea](https://affpapa.org/en/nevibecode/skills/leanrea.md) — skill · 1300 installs
- [ctf-rev](https://affpapa.org/en/nevibecode/skills/ctf-rev.md) — skill · 321 installs
- [binutils](https://affpapa.org/en/nevibecode/skills/binutils.md) — skill · 608 installs
- [reverse-engineering-tools](https://affpapa.org/en/nevibecode/skills/reverse-engineering-tools.md) — skill · 544 installs
- [safe-debug](https://affpapa.org/en/nevibecode/skills/safe-debug.md) — skill · 335000 installs
- [insforge-debug](https://affpapa.org/en/nevibecode/skills/insforge-debug.md) — skill · 56700 installs

From the same set: [p4nda0s/reverse-skills](https://affpapa.org/en/nevibecode/by/p4nda0s/reverse-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md