Trace Android Native Runtime

Status: active. Approved on 2026-07-30; continue validating it only in authorized runtime work. Do not use it for normal reverse analysis until it is explicitly activated.

This Skill builds a reproducible evidence chain across Android Java/Kotlin, JNI, native shared libraries, runtime-loaded modules, and network callbacks within an authorized scope.

Quick start

Use $trace-android-native-runtime to analyze the Java -> JNI -> native call chain in this user-owned Android
application.

Main capabilities

• Coordinate JADX, Frida, IDA, and ADB instead of relying on one decompiler result.
• Handle process selection, Java runtime readiness, dynamic shared-library loading, and multi-process behavior.
• Map IDA addresses through RVA and the current process load bias instead of reusing stale ASLR addresses.
• Distinguish controlled ART/JIT signals, debuggerd loops, and genuine native crashes.
• Observe real input, protected output, and response processing at stable Java/native boundaries without rewriting an algorithm prematurely.
• Reproduce benign JNI calls in Unidbg from the exact managed signature, then add narrow typed environment callbacks incrementally while preserving ABI, threading, and class semantics.
• Report facts, inferences, reproduction evidence, address mappings, and the next validation step.

Use it only for applications, devices, and test environments that the user owns or is explicitly authorized to analyze.

Authorization does not permit prohibited objectives. Immediately stop detailed JADX/IDA work, ADB/Frida access, hooks, breakpoints, address/script output, and request replay when the objective involves credential, session, or key theft/replay; authentication, payment, licensing, DRM, CAPTCHA, risk-control, or anti-cheat bypass; identity or device-fingerprint spoofing; mass-account abuse; covert surveillance; persistence; or enforcement evasion. Return only a non-actionable functional overview, data categories, trust boundaries, and defensive guidance.

Ordinary parameter algorithms remain allowed with public, synthetic, or user-owned inputs: serialization, encoding, Base64, compression, checksums, timestamps, nonces, hashes, HMAC, and standard cryptographic primitives. Refuse the entire detailed workflow if the objective changes to impersonation, bypass, or unauthorized access.

Install for Codex

Link the complete trace-android-native-runtime/ source directory into the user Skill directory. The link must resolve to a directory whose top level directly contains SKILL.md; do not install by copying the source.

Windows PowerShell:

$skillsRoot = Join-Path $HOME ".agents\skills"
$source = (Resolve-Path "<repository-root>\trace-android-native-runtime").Path
$link = Join-Path $skillsRoot "trace-android-native-runtime"
New-Item -ItemType Directory -Force -Path $skillsRoot | Out-Null
if (Test-Path -LiteralPath $link) { throw "Destination already exists: $link" }
New-Item -ItemType Junction -Path $link -Target $source | Out-Null

macOS:

skills_root="$HOME/.agents/skills"
source_dir="$(cd "<repository-root>/trace-android-native-runtime" && pwd)"
link_path="$skills_root/trace-android-native-runtime"
mkdir -p "$skills_root"
if [ -e "$link_path" ] || [ -L "$link_path" ]; then echo "Destination already exists: $link_path" >&2; exit 1; fi
ln -s "$source_dir" "$link_path"

Codex normally detects Skill changes automatically; restart it if the Skill does not appear. Invoke it as $trace-android-native-runtime. For cross-agent reuse, CC Switch v3.13 or newer can use ~/.agents/skills as shared source storage: open Skills, scan/import the local Skill if needed, enable the target agents, and sync. Recheck safety restrictions, tools, and permissions after import.

Files

• SKILL.md: complete analysis workflow and safety boundary.
• references/evidence-workflow.md: evidence ledger and call-chain analysis.
• references/ida-frida-debugging.md: process, module, rebase, Frida, and signal diagnosis.
• references/unidbg-emulation.md: signature-first harness construction and incremental environment modeling.
• references/safety-boundaries.md: decision matrix for allowed work, refusal, and high-level-only summaries.
• scripts/analyze_android_maps.py: read-only /proc/<pid>/maps parser for module load bias and address ownership.