[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG73MZCP6HXWECFT68MA1Q":3,"skill-same:01M6AG73MZCP6HXWECFT68MA1Q":164},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AG73MZCP6HXWECFT68MA1Q","reverse-engineering-ios-app-with-frida",null,"Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C\u002FSwift method tracing, or iOS binary analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"frida","reverse engineering ios app with frida","ios","engineering","protocols","code","penetration testing","reverse-engineering","mobile-security","pr","testing","owasp-mobile","analyzing","encryption","t1078","t1059","applications","analysis","secrets","cybersecurity","2026-11-10 10:12:30",false,"---\nname: reverse-engineering-ios-app-with-frida\ndescription: 'Reverse engineers iOS applications using Frida dynamic instrumentation\n  to understand internal logic, extract encryption keys, bypass security controls,\n  and discover hidden functionality without source code access. Use when performing\n  authorized iOS penetration testing, analyzing proprietary protocols, understanding\n  obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for\n  requests involving iOS reverse engineering, Frida iOS hooking, Objective-C\u002FSwift\n  method tracing, or iOS binary analysis.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- ios\n- frida\n- reverse-engineering\n- owasp-mobile\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1573\n---\n# Reverse Engineering iOS App with Frida\n\n## When to Use\n\nUse this skill when:\n- Analyzing iOS app internals during authorized security assessments without source code\n- Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps\n- Understanding obfuscated Swift\u002FObjective-C logic through runtime method tracing\n- Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging)\n\n**Do not use** this skill for unauthorized reverse engineering that violates terms of service or intellectual property law.\n\n## Prerequisites\n\n- Jailbroken iOS device with Frida server installed via Cydia\u002FSileo, or non-jailbroken device with Frida Gadget-injected IPA\n- Python 3.10+ with `frida-tools` (`pip install frida-tools`)\n- USB connection to iOS device\n- class-dump or dsdump for Objective-C header extraction\n- Hopper Disassembler or Ghidra for static binary analysis (complementary)\n- Knowledge of Objective-C runtime and Swift name mangling\n\n## Workflow\n\n### Step 1: Extract and Analyze the Binary\n\n```bash\n# On jailbroken device, find app binary\nssh root@\u003Cdevice_ip>\nfind \u002Fvar\u002Fcontainers\u002FBundle\u002FApplication\u002F -name \"TargetApp\" -type f\n\n# Pull decrypted binary (apps from App Store are encrypted with FairPlay)\n# Use frida-ios-dump or Clutch for decryption\npip install frida-ios-dump\ndump.py com.target.app\n\n# Extract Objective-C class headers\nclass-dump -H decrypted_binary -o headers\u002F\nls headers\u002F  # Lists all class header files\n```\n\n### Step 2: Enumerate Classes and Methods at Runtime\n\n```javascript\n\u002F\u002F enumerate_classes.js - List all loaded classes\nJava.perform(function() {});  \u002F\u002F N\u002FA for iOS\n\n\u002F\u002F iOS uses ObjC runtime\nif (ObjC.available) {\n    var classes = ObjC.classes;\n    for (var className in classes) {\n        if (className.indexOf(\"Target\") !== -1 ||\n            className.indexOf(\"Auth\") !== -1 ||\n            className.indexOf(\"Crypto\") !== -1) {\n            console.log(\"[Class] \" + className);\n\n            \u002F\u002F List methods\n            var methods = classes[className].$ownMethods;\n            for (var i = 0; i \u003C methods.length; i++) {\n                console.log(\"  [Method] \" + methods[i]);\n            }\n        }\n    }\n}\n```\n\n```bash\nfrida -U -n TargetApp -l enumerate_classes.js\n```\n\n### Step 3: Trace Method Calls with frida-trace\n\n```bash\n# Trace all methods of a class\nfrida-trace -U -n TargetApp -m \"*[TargetAuth *]\"\n\n# Trace specific patterns\nfrida-trace -U -n TargetApp -m \"*[*Crypto* *]\"\nfrida-trace -U -n TargetApp -m \"*[*KeyChain* *]\"\nfrida-trace -U -n TargetApp -m \"*[*Token* *]\"\n\n# Trace Swift methods (mangled names)\nfrida-trace -U -n TargetApp -m \"*[*$s*Auth*]\"\n```\n\n### Step 4: Hook and Modify Method Behavior\n\n```javascript\n\u002F\u002F hook_auth.js - Intercept authentication logic\nif (ObjC.available) {\n    \u002F\u002F Hook Objective-C method\n    var AuthManager = ObjC.classes.AuthManager;\n    if (AuthManager) {\n        Interceptor.attach(AuthManager[\"- validateToken:\"].implementation, {\n            onEnter: function(args) {\n                \u002F\u002F args[0] = self, args[1] = selector, args[2+] = method args\n                var token = new ObjC.Object(args[2]);\n                console.log(\"[Auth] validateToken called with: \" + token.toString());\n            },\n            onLeave: function(retval) {\n                console.log(\"[Auth] validateToken returned: \" + retval);\n                \u002F\u002F Optionally modify return value\n                \u002F\u002F retval.replace(ptr(1));  \u002F\u002F Force return true\n            }\n        });\n    }\n\n    \u002F\u002F Hook CommonCrypto for encryption analysis\n    var CCCrypt = Module.findExportByName(\"libcommonCrypto.dylib\", \"CCCrypt\");\n    if (CCCrypt) {\n        Interceptor.attach(CCCrypt, {\n            onEnter: function(args) {\n                this.operation = args[0].toInt32();  \u002F\u002F 0=encrypt, 1=decrypt\n                this.algorithm = args[1].toInt32();  \u002F\u002F 0=AES128, 1=DES, 2=3DES\n                this.keyLength = args[4].toInt32();\n                this.key = Memory.readByteArray(args[3], this.keyLength);\n                console.log(\"[CCCrypt] Op:\" + (this.operation === 0 ? \"Encrypt\" : \"Decrypt\"));\n                console.log(\"[CCCrypt] Key: \" + hexify(this.key));\n            },\n            onLeave: function(retval) {\n                console.log(\"[CCCrypt] Status: \" + retval);\n            }\n        });\n    }\n}\n\nfunction hexify(buffer) {\n    var bytes = new Uint8Array(buffer);\n    var hex = [];\n    for (var i = 0; i \u003C bytes.length; i++) {\n        hex.push((\"0\" + bytes[i].toString(16)).slice(-2));\n    }\n    return hex.join(\"\");\n}\n```\n\n### Step 5: Analyze Swift Code\n\n```javascript\n\u002F\u002F swift_analysis.js - Hook Swift methods\n\u002F\u002F Swift methods use name mangling: $s\u003Cmodule>\u003Cclass>\u003Cmethod>\n\u002F\u002F Use frida-trace to discover actual mangled names first\n\nif (ObjC.available) {\n    \u002F\u002F Swift classes that inherit from NSObject are accessible via ObjC runtime\n    var swiftClasses = Object.keys(ObjC.classes).filter(function(name) {\n        return name.indexOf(\"_TtC\") === 0 || name.indexOf(\"TargetApp.\") !== -1;\n    });\n\n    swiftClasses.forEach(function(className) {\n        console.log(\"[Swift] \" + className);\n        var methods = ObjC.classes[className].$ownMethods;\n        methods.forEach(function(method) {\n            console.log(\"  \" + method);\n        });\n    });\n}\n\n\u002F\u002F For pure Swift (non-ObjC-bridged), use Module.enumerateExports\nModule.enumerateExports(\"TargetApp\", {\n    onMatch: function(exp) {\n        if (exp.name.indexOf(\"Auth\") !== -1 || exp.name.indexOf(\"Crypto\") !== -1) {\n            console.log(\"[Export] \" + exp.name + \" @ \" + exp.address);\n        }\n    },\n    onComplete: function() {}\n});\n```\n\n### Step 6: Extract Secrets and Proprietary Data\n\n```javascript\n\u002F\u002F extract_secrets.js\nif (ObjC.available) {\n    \u002F\u002F Hook NSUserDefaults\n    var NSUserDefaults = ObjC.classes.NSUserDefaults;\n    Interceptor.attach(NSUserDefaults[\"- objectForKey:\"].implementation, {\n        onEnter: function(args) {\n            this.key = new ObjC.Object(args[2]).toString();\n        },\n        onLeave: function(retval) {\n            if (retval.isNull()) return;\n            var value = new ObjC.Object(retval);\n            console.log(\"[NSUserDefaults] \" + this.key + \" = \" + value.toString());\n        }\n    });\n\n    \u002F\u002F Hook Keychain access\n    var SecItemCopyMatching = Module.findExportByName(\"Security\", \"SecItemCopyMatching\");\n    Interceptor.attach(SecItemCopyMatching, {\n        onEnter: function(args) {\n            var query = new ObjC.Object(args[0]);\n            console.log(\"[Keychain] Query: \" + query.toString());\n        },\n        onLeave: function(retval) {\n            console.log(\"[Keychain] Result: \" + retval);\n        }\n    });\n}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Objective-C Runtime** | Dynamic runtime enabling method dispatch, class introspection, and method swizzling at runtime |\n| **Swift Name Mangling** | Compiler-applied encoding of Swift function signatures into linker-compatible symbol names |\n| **FairPlay DRM** | Apple's encryption applied to App Store binaries; must be decrypted before static analysis |\n| **class-dump** | Tool extracting Objective-C class declarations from Mach-O binaries for header-level analysis |\n| **CommonCrypto** | Apple's C-level cryptographic library; primary target for encryption key extraction via Frida hooks |\n\n## Tools & Systems\n\n- **Frida**: Dynamic instrumentation framework for iOS runtime hooking and method interception\n- **frida-trace**: Automated tracing utility that generates handler stubs for matched methods\n- **frida-ios-dump**: Tool for decrypting FairPlay-protected iOS apps via memory dumping\n- **class-dump \u002F dsdump**: Objective-C header extraction from Mach-O binaries\n- **Ghidra**: NSA's reverse engineering framework for static ARM64 binary analysis of iOS apps\n\n## Common Pitfalls\n\n- **FairPlay encryption**: Apps downloaded from the App Store are encrypted. You must decrypt before static analysis. Use frida-ios-dump on a jailbroken device.\n- **Swift-only classes**: Pure Swift classes without `@objc` annotation are not visible through `ObjC.classes`. Use `Module.enumerateExports()` instead.\n- **Stripped binaries**: Release builds strip debug symbols. Combine frida-trace with class-dump output for effective analysis.\n- **Anti-Frida measures**: Sophisticated apps check for Frida artifacts (frida-server process, Frida agent strings in memory, injected libraries in dyld). Use stealthy Frida builds or Frida Gadget injection.\n","# Reverse Engineering iOS App with Frida\n\n## When to Use\n\nUse this skill when:\n- Analyzing iOS app internals during authorized security assessments without source code\n- Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps\n- Understanding obfuscated Swift\u002FObjective-C logic through runtime method tracing\n- Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging)\n\n**Do not use** this skill for unauthorized reverse engineering that violates terms of service or intellectual property law.\n\n## Prerequisites\n\n- Jailbroken iOS device with Frida server installed via Cydia\u002FSileo, or non-jailbroken device with Frida Gadget-injected IPA\n- Python 3.10+ with `frida-tools` (`pip install frida-tools`)\n- USB connection to iOS device\n- class-dump or dsdump for Objective-C header extraction\n- Hopper Disassembler or Ghidra for static binary analysis (complementary)\n- Knowledge of Objective-C runtime and Swift name mangling\n\n## Workflow\n\n### Step 1: Extract and Analyze the Binary\n\n```bash\n# On jailbroken device, find app binary\nssh root@\u003Cdevice_ip>\nfind \u002Fvar\u002Fcontainers\u002FBundle\u002FApplication\u002F -name \"TargetApp\" -type f\n\n# Pull decrypted binary (apps from App Store are encrypted with FairPlay)\n# Use frida-ios-dump or Clutch for decryption\npip install frida-ios-dump\ndump.py com.target.app\n\n# Extract Objective-C class headers\nclass-dump -H decrypted_binary -o headers\u002F\nls headers\u002F  # Lists all class header files\n```\n\n### Step 2: Enumerate Classes and Methods at Runtime\n\n```javascript\n\u002F\u002F enumerate_classes.js - List all loaded classes\nJava.perform(function() {});  \u002F\u002F N\u002FA for iOS\n\n\u002F\u002F iOS uses ObjC runtime\nif (ObjC.available) {\n    var classes = ObjC.classes;\n    for (var className in classes) {\n        if (className.indexOf(\"Target\") !== -1 ||\n            className.indexOf(\"Auth\") !== -1 ||\n            className.indexOf(\"Crypto\") !== -1) {\n            console.log(\"[Class] \" + className);\n\n            \u002F\u002F List methods\n            var methods = classes[className].$ownMethods;\n            for (var i = 0; i \u003C methods.length; i++) {\n                console.log(\"  [Method] \" + methods[i]);\n            }\n        }\n    }\n}\n```\n\n```bash\nfrida -U -n TargetApp -l enumerate_classes.js\n```\n\n### Step 3: Trace Method Calls with frida-trace\n\n```bash\n# Trace all methods of a class\nfrida-trace -U -n TargetApp -m \"*[TargetAuth *]\"\n\n# Trace specific patterns\nfrida-trace -U -n TargetApp -m \"*[*Crypto* *]\"\nfrida-trace -U -n TargetApp -m \"*[*KeyChain* *]\"\nfrida-trace -U -n TargetApp -m \"*[*Token* *]\"\n\n# Trace Swift methods (mangled names)\nfrida-trace -U -n TargetApp -m \"*[*$s*Auth*]\"\n```\n\n### Step 4: Hook and Modify Method Behavior\n\n```javascript\n\u002F\u002F hook_auth.js - Intercept authentication logic\nif (ObjC.available) {\n    \u002F\u002F Hook Objective-C method\n    var AuthManager = ObjC.classes.AuthManager;\n    if (AuthManager) {\n        Interceptor.attach(AuthManager[\"- validateToken:\"].implementation, {\n            onEnter: function(args) {\n                \u002F\u002F args[0] = self, args[1] = selector, args[2+] = method args\n                var token = new ObjC.Object(args[2]);\n                console.log(\"[Auth] validateToken called with: \" + token.toString());\n            },\n            onLeave: function(retval) {\n                console.log(\"[Auth] validateToken returned: \" + retval);\n                \u002F\u002F Optionally modify return value\n                \u002F\u002F retval.replace(ptr(1));  \u002F\u002F Force return true\n            }\n        });\n    }\n\n    \u002F\u002F Hook CommonCrypto for encryption analysis\n    var CCCrypt = Module.findExportByName(\"libcommonCrypto.dylib\", \"CCCrypt\");\n    if (CCCrypt) {\n        Interceptor.attach(CCCrypt, {\n            onEnter: function(args) {\n                this.operation = args[0].toInt32();  \u002F\u002F 0=encrypt, 1=decrypt\n                this.algorithm = args[1].toInt32();  \u002F\u002F 0=AES128, 1=DES, 2=3DES\n                this.keyLength = args[4].toInt32();\n                this.key = Memory.readByteArray(args[3], this.keyLength);\n                console.log(\"[CCCrypt] Op:\" + (this.operation === 0 ? \"Encrypt\" : \"Decrypt\"));\n                console.log(\"[CCCrypt] Key: \" + hexify(this.key));\n            },\n            onLeave: function(retval) {\n                console.log(\"[CCCrypt] Status: \" + retval);\n            }\n        });\n    }\n}\n\nfunction hexify(buffer) {\n    var bytes = new Uint8Array(buffer);\n    var hex = [];\n    for (var i = 0; i \u003C bytes.length; i++) {\n        hex.push((\"0\" + bytes[i].toString(16)).slice(-2));\n    }\n    return hex.join(\"\");\n}\n```\n\n### Step 5: Analyze Swift Code\n\n```javascript\n\u002F\u002F swift_analysis.js - Hook Swift methods\n\u002F\u002F Swift methods use name mangling: $s\u003Cmodule>\u003Cclass>\u003Cmethod>\n\u002F\u002F Use frida-trace to discover actual mangled names first\n\nif (ObjC.available) {\n    \u002F\u002F Swift classes that inherit from NSObject are accessible via ObjC runtime\n    var swiftClasses = Object.keys(ObjC.classes).filter(function(name) {\n        return name.indexOf(\"_TtC\") === 0 || name.indexOf(\"TargetApp.\") !== -1;\n    });\n\n    swiftClasses.forEach(function(className) {\n        console.log(\"[Swift] \" + className);\n        var methods = ObjC.classes[className].$ownMethods;\n        methods.forEach(function(method) {\n            console.log(\"  \" + method);\n        });\n    });\n}\n\n\u002F\u002F For pure Swift (non-ObjC-bridged), use Module.enumerateExports\nModule.enumerateExports(\"TargetApp\", {\n    onMatch: function(exp) {\n        if (exp.name.indexOf(\"Auth\") !== -1 || exp.name.indexOf(\"Crypto\") !== -1) {\n            console.log(\"[Export] \" + exp.name + \" @ \" + exp.address);\n        }\n    },\n    onComplete: function() {}\n});\n```\n\n### Step 6: Extract Secrets and Proprietary Data\n\n```javascript\n\u002F\u002F extract_secrets.js\nif (ObjC.available) {\n    \u002F\u002F Hook NSUserDefaults\n    var NSUserDefaults = ObjC.classes.NSUserDefaults;\n    Interceptor.attach(NSUserDefaults[\"- objectForKey:\"].implementation, {\n        onEnter: function(args) {\n            this.key = new ObjC.Object(args[2]).toString();\n        },\n        onLeave: function(retval) {\n            if (retval.isNull()) return;\n            var value = new ObjC.Object(retval);\n            console.log(\"[NSUserDefaults] \" + this.key + \" = \" + value.toString());\n        }\n    });\n\n    \u002F\u002F Hook Keychain access\n    var SecItemCopyMatching = Module.findExportByName(\"Security\", \"SecItemCopyMatching\");\n    Interceptor.attach(SecItemCopyMatching, {\n        onEnter: function(args) {\n            var query = new ObjC.Object(args[0]);\n            console.log(\"[Keychain] Query: \" + query.toString());\n        },\n        onLeave: function(retval) {\n            console.log(\"[Keychain] Result: \" + retval);\n        }\n    });\n}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Objective-C Runtime** | Dynamic runtime enabling method dispatch, class introspection, and method swizzling at runtime |\n| **Swift Name Mangling** | Compiler-applied encoding of Swift function signatures into linker-compatible symbol names |\n| **FairPlay DRM** | Apple's encryption applied to App Store binaries; must be decrypted before static analysis |\n| **class-dump** | Tool extracting Objective-C class declarations from Mach-O binaries for header-level analysis |\n| **CommonCrypto** | Apple's C-level cryptographic library; primary target for encryption key extraction via Frida hooks |\n\n## Tools & Systems\n\n- **Frida**: Dynamic instrumentation framework for iOS runtime hooking and method interception\n- **frida-trace**: Automated tracing utility that generates handler stubs for matched methods\n- **frida-ios-dump**: Tool for decrypting FairPlay-protected iOS apps via memory dumping\n- **class-dump \u002F dsdump**: Objective-C header extraction from Mach-O binaries\n- **Ghidra**: NSA's reverse engineering framework for static ARM64 binary analysis of iOS apps\n\n## Common Pitfalls\n\n- **FairPlay encryption**: Apps downloaded from the App Store are encrypted. You must decrypt before static analysis. Use frida-ios-dump on a jailbroken device.\n- **Swift-only classes**: Pure Swift classes without `@objc` annotation are not visible through `ObjC.classes`. Use `Module.enumerateExports()` instead.\n- **Stripped binaries**: Release builds strip debug symbols. Combine frida-trace with class-dump output for effective analysis.\n- **Anti-Frida measures**: Sophisticated apps check for Frida artifacts (frida-server process, Frida agent strings in memory, injected libraries in dyld). Use stealthy Frida builds or Frida Gadget injection.\n",{"name":5,"tags":57,"author":59,"domain":51,"license":15,"version":60,"nist_csf":61,"subdomain":40,"description":66,"mitre_attack":67},[40,34,32,39,43,58],"penetration-testing","mahipal","1.0.0",[62,63,64,65],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C\u002FSwift method tracing, or iOS binary analysis.\n",[68,69,70,71,72],"T1059","T1056","T1036","T1078","T1573","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Freverse-engineering-ios-app-with-frida",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill reverse-engineering-ios-app-with-frida",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill reverse-engineering-ios-app-with-frida",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill reverse-engineering-ios-app-with-frida","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002FSKILL.md",true,[97,103,108,114,118,122,126,130,134,138,142,146,150,154,160],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"assets\u002Ftemplate.md","ASSET","资产文件",1116,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002Fassets\u002Ftemplate.md",{"path":104,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002FLICENSE",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md","REFERENCE","参考文档",1750,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fci.md",412,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fci.md",{"path":119,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fcodex.md",7665,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fcodex.md",{"path":123,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fcursor.md",3414,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fcursor.md",{"path":127,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fharness-mem.md",583,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fharness-mem.md",{"path":131,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002Finit.md",2556,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Finit.md",{"path":135,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":136,"sourceHtmlUrl":137},"references\u002Fmaintenance.md",751,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fmaintenance.md",{"path":139,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":140,"sourceHtmlUrl":141},"references\u002Fmarketplace.md",2844,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fmarketplace.md",{"path":143,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":144,"sourceHtmlUrl":145},"references\u002Fmirrors-agents-localize.md",1197,"https:\u002F\u002Fgithub.com\u002FChachamaru127\u002Fclaude-code-harness\u002Fblob\u002Fmain\u002Fcodex\u002F.codex\u002Fskills\u002Fharness-setup\u002Freferences\u002Fmirrors-agents-localize.md",{"path":147,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":148,"sourceHtmlUrl":149},"references\u002Fstandards.md",1432,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002Freferences\u002Fstandards.md",{"path":151,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":152,"sourceHtmlUrl":153},"references\u002Fworkflows.md",1724,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002Freferences\u002Fworkflows.md",{"path":155,"resourceType":156,"resourceTypeDesc":157,"sizeBytes":158,"sourceHtmlUrl":159},"scripts\u002Fagent.py","SCRIPT","脚本",6049,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002Fscripts\u002Fagent.py",{"path":161,"resourceType":156,"resourceTypeDesc":157,"sizeBytes":162,"sourceHtmlUrl":163},"scripts\u002Fprocess.py",4141,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Freverse-engineering-ios-app-with-frida\u002Fscripts\u002Fprocess.py",[165,190,213,237,263,290],{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[171],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[173,174,175,176,177,51,178,179,41,37,180,181,182,183,184,185,186,187,188,189],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[196],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[198,186,199,200,177,201,51,41,202,203,204,205,206,207,208,50,209,210,211,212],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":221,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[219,220],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[208,222,223,224,42,51,225,226,202,227,228,229,230,231,232,46,233,234,235,236],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[243],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[245,246,247,51,248,249,250,251,252,253,254,255,256,257,258,259,205,260,261,262],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":264,"name":265,"nameZh":6,"description":266,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":267,"categories":268,"keywords":270,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[269],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[271,272,273,51,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":291,"name":292,"nameZh":6,"description":293,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":294,"categories":295,"keywords":297,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[296],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[177,298,51,299,300,301,302,303,304,305,306,46,307,233,49,308,309,310,311,312],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]