npx claudepluginhub jygzyc/decx --plugin decxThis skill uses the workspace's default tool permissions.
Use this skill for general Android reverse-engineering and code navigation with DECX.
Decompiles Android APKs to readable Java/Kotlin source using jadx CLI/GUI. Analyze app logic, discover vulnerabilities, extract hardcoded credentials and secrets.
Decompiles Android APK, XAPK, JAR, AAR files using jadx or Fernflower. Extracts API endpoints from Retrofit, OkHttp, Volley and traces UI-to-network call flows.
Hunts vulnerabilities in Android APKs using DECX CLI and JADX: enumerates attack surfaces, triages exported components and deep links, traces WebView/IPC flows, screens exploitability, generates bilingual reports with PoC handoff.
Share bugs, ideas, or general feedback.
Use this skill for general Android reverse-engineering and code navigation with DECX.
Scope:
decxcli-app-vulnhuntdecxcli-framework-vulnhuntdecxcli-pocdecx code command and every session-backed decx ard command must include -P <port>decx ard commands such as system-services and perm-info do not use -P <port>; they use --serial / --adb-path when needed"package.Class.method(paramType1,paramType2):returnType"... in signatures--help command before retryingdecxcli-app-vulnhunt, decxcli-framework-vulnhunt, or decxcli-pocprocess close can close by name or --port <port>; process list does not take -P <port>search-class and search-method as expensive discovery tools, not default navigation toolsTrack progress with:
DECX Progress
- [ ] Phase 1: Confirm environment or active session
- [ ] Phase 2: Open or reuse target session
- [ ] Phase 3: Identify target class, method, component, or resource
- [ ] Phase 4: Read only the minimal source or metadata needed
- [ ] Phase 5: Follow xrefs or inheritance if needed
- [ ] Phase 6: Close session if no downstream work remains
Use these commands when you need to confirm DECX health:
decx process check -P <port>
decx process status -P <port>
decx process list
Use process check when you are unsure whether the local DECX runtime is ready.
Open a file:
decx process open "<file-or-url>" -P <port>
Useful options:
-P, --port <port> server port
-n, --name <name> explicit session name
--force reopen even if DECX detects an existing conflicting session
Notes:
<file-or-url> can be a local path or an HTTP/HTTPS URL--name when you want a stable session identifier across repeated analysis turnsSession conflict behavior:
--force or a new --name is used--force is usedUse ard first when the question is about Android structure:
decx ard app-manifest -P <port>
decx ard exported-components -P <port>
decx ard app-deeplinks -P <port>
decx ard app-receivers -P <port>
decx ard get-aidl -P <port>
decx ard strings -P <port>
decx ard system-services --serial <serial> --grep <keyword>
decx ard perm-info "<permission>" --serial <serial>
Use code first when the question is about implementation details:
decx code class-context "<class>" -P <port>
decx code class-source "<class>" -P <port>
decx code method-source "<signature>" -P <port>
decx code method-context "<signature>" -P <port>
decx code method-cfg "<signature>" -P <port>
decx code xref-method "<signature>" -P <port>
decx code xref-class "<class>" -P <port>
decx code xref-field "<field>" -P <port>
decx code implement "<interface>" -P <port>
decx code subclass "<class>" -P <port>
Default navigation order:
class-contextclass-source or method-sourcexref-*implement or subclasssearch-* only if the target entry is still unknownPrefer:
method-context when you need callers and callees in one callmethod-source when you need the full bodyclass-context when you need a quick method/field overviewclass-source when you need surrounding contextxref-method when you want only callers (no callees needed)xref-field when you want reads and writesimplement for interfacessubclass for base classes or framework callbacksSearch commands:
decx code search-global "<keyword>" --limit <n> -P <port>
decx code search-class "<class>" "<keyword>" --limit <n> -P <port>
decx code search-method "<name>" -P <port>
Use them only when:
Do not fan out into bulk repeated searches if class-source + xref-* can answer the question.
process| Command | Purpose |
|---|---|
decx process check -P <port> | Check DECX environment and local runtime readiness |
decx process open "<file>" -P <port> | Open a target for analysis |
decx process close "[name]" | Close one session |
decx process close -a | Close all sessions |
decx process list | List active sessions |
decx process status "[name]" -P <port> | Check active server or session status |
code| Command | Purpose |
|---|---|
decx code classes -P <port> | List classes (--limit, --include-package, --exclude-package, --no-regex) |
decx code class-context "<class>" -P <port> | Show class metadata (fields and methods) |
decx code class-source "<class>" -P <port> | Show class source (--limit) |
decx code class-source "<class>" --smali -P <port> | Show class smali |
decx code method-source "<signature>" -P <port> | Show method source |
decx code method-source "<signature>" --smali -P <port> | Show method smali |
decx code method-context "<signature>" -P <port> | Show method signature, callers, and callees |
decx code method-cfg "<signature>" -P <port> | Show method control flow graph as DOT source |
decx code xref-method "<signature>" -P <port> | Show method callers |
decx code xref-class "<class>" -P <port> | Show class references |
decx code xref-field "<field>" -P <port> | Show field reads and writes |
decx code implement "<interface>" -P <port> | List interface implementations |
decx code subclass "<class>" -P <port> | List subclasses |
decx code search-global "<keyword>" --limit <n> -P <port> | Search all class bodies (--limit, --include-package, --exclude-package, --no-regex, --case-sensitive) |
decx code search-class "<class>" "<keyword>" --limit <n> -P <port> | Grep one class (--no-regex, --case-sensitive) |
decx code search-method "<name>" -P <port> | Search method names |
ard| Command | Purpose |
|---|---|
decx ard app-manifest -P <port> | Read AndroidManifest.xml |
decx ard main-activity -P <port> | Show main activity |
decx ard app-application -P <port> | Show application class |
decx ard exported-components -P <port> | List exported components (--type, --exclude-type, --no-regex) |
decx ard app-deeplinks -P <port> | List deep links |
decx ard app-receivers -P <port> | List dynamic receivers (--limit, --include-package, --exclude-package, --no-regex) |
decx ard get-aidl -P <port> | List AIDL interfaces (--limit, --include-package, --exclude-package, --no-regex) |
decx ard system-service-impl "<interface>" -P <port> | Resolve framework service implementation |
decx ard system-services --serial <serial> [--grep <keyword>] | List live Binder/system services as structured JSON |
decx ard perm-info "<permission>" --serial <serial> | Resolve one permission into a structured JSON object |
decx ard all-resources -P <port> | List resource file names (--include, --no-regex) |
decx ard resource-file "<res>" -P <port> | Read one resource file |
decx ard strings -P <port> | Read strings.xml |
adb-backed ard output notes:
system-services returns JSON with:
totalservices[]index, name, interfacesperm-info returns one JSON object with fields like:
permissionpackagelabeldescriptionprotectionLevel--grep on system-services to narrow the runtime surface before choosing an interface for system-service-implself| Command | Purpose |
|---|---|
decx self install | Install decx-server.jar |
decx self install -p | Install prerelease server |
decx self update | Update CLI and server |
decx self update -p | Update with prerelease server |
Method signature:
package.Class.methodName(paramType1,paramType2):returnType
Example:
"com.example.MainActivity.onCreate(android.os.Bundle):void"
Field identifier:
"package.Class.fieldName :type"
Resource path:
"res/xml/file_paths.xml"
decx ard app-manifest -P <port>
decx ard exported-components -P <port>
decx ard app-deeplinks -P <port>
decx code classes -P <port>
decx ard system-services --serial <serial> --grep activity
decx code search-method "login" -P <port>
decx code class-source "com.example.AuthManager" --limit 120 -P <port>
decx code xref-method "com.example.AuthManager.login(java.lang.String,java.lang.String):boolean" -P <port>
decx code xref-field "com.example.AuthManager.mToken" -P <port>
decx code subclass "com.example.BaseActivity" -P <port>
decx code implement "com.example.MyInterface" -P <port>
decx ard get-aidl -P <port>
decx ard system-services --serial <serial> --grep permission
decx ard perm-info "android.permission.DUMP" --serial <serial>
decx ard all-resources --include "res/xml" -P <port>
decx ard resource-file "res/xml/file_paths.xml" -P <port>
decx ard strings -P <port>
Close one session:
decx process close "<name>"
Close all sessions:
decx process close -a
If the user is likely to continue into vulnerability hunting or PoC work, keep the session alive and state which session name and port should be reused.