How to Reverse Engineer Any App or Website: The AI Deconstruction Playbook ⚡

Whether you are auditing an enterprise SaaS application or analyzing a viral consumer mobile app, follow this strict 5-stage sequential pipeline:

Modern web apps are delivered as static client assets, making them transparent to systematic analysis:

1. Checking for Public Source Maps

Often developers forget to disable source maps in production build pipelines (e.g. webpack.config.js or next.config.js). Check if .map files exist:

# Use shuji or restore-source-tree to reconstruct original TypeScript files:
npx restore-source-tree --input-dir ./dist-bundle --output-dir ./src-reconstructed

2. Hooking WebSockets & Fetch Interceptors

Inject a non-invasive observer script in DevTools console or browser extension to log all outbound requests, headers, and WebSocket frames:

// Master Fetch & XHR Spy Hook
const originalFetch = window.fetch;
window.fetch = async (...args) => {
  console.groupCollapsed(`[API Fetch] ${args[0]}`);
  console.log('Request Init:', args[1]);
  const response = await originalFetch(...args);
  const clone = response.clone();
  clone.json().then(data => console.log('Response JSON:', data)).catch(() => {});
  console.groupEnd();
  return response;
};

Android applications package compiled bytecode (DEX), native libraries (.so), and raw resource files into a standard ZIP archive:

Bypassing SSL Certificate Pinning via Frida

To inspect mobile traffic in Charles or Reqable, disable OkHttp / TrustManager pinning with a universal Frida hook script:

// Universal Android SSL Pinning Bypass
Java.perform(function() {
  var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');
  TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
    return untrustedChain; // Return chain without throwing certificate exceptions
  };
  console.log('[+] Universal SSL Pinning bypassed successfully.');
});

Many modern APIs protect their endpoints with client-side signature headers (e.g. x-signature, x-timestamp, x-nonce). Here is how to trace the signature generation function in 3 steps:

1. Step 1: Set XHR Breakpoints on the Endpoint: In Chrome DevTools > Sources > XHR/fetch Breakpoints, add the URL fragment (e.g. /api/v1/feed). Trigger the action on the site.
2. Step 2: Inspect Call Stack: When the breakpoint hits in axios or fetch, walk back up the Call Stack to find the request interceptor where the signature header is computed.
3. Step 3: Extract the Hashing Algorithm: Isolate the secret salt, parameter serialization order (usually alphabetical key sort + query string), and HMAC-SHA256 / MD5 hashing routine. Re-implement it in clean Python or TypeScript.

To ensure total legality and commercial safety, always maintain strict cleanroom separation:

Paste this master prompt into Claude Code, Cursor, or ChatGPT when you want an AI agent to analyze a web bundle, APK, or API capture:

You are a Principal Software Architect and Reverse Engineering Specialist equipped with Somya's Deconstruction Framework. Your mission is to analyze the provided target (frontend bundle, APK decompilation, network HAR, or API payloads) and extract a complete architectural blueprint.

EXECUTION PROTOCOL:
1. Reconnaissance: Map out all observable endpoints, WebSocket channels, data schemas, and authentication flows.
2. Interception Analysis: Inspect the request/response cycle, token refresh mechanisms, and custom signature headers (e.g. timestamp, nonce, HMAC hashing).
3. State & Logic Reconstruction: Deconstruct the client-side state machine, data caching patterns, and optimistic UI synchronization models.
4. Cleanroom Specification: Document the extracted system in formal OpenAPI 3.0 JSON and generate a production-ready, clean TypeScript client library.
5. Security & Moat Audit: Identify rate limits, anti-abuse defenses, and architectural vulnerabilities.

Format your output into:
- System Architecture Diagram (Mermaid)
- Endpoints & Schemas (OpenAPI format)
- Signature Algorithm Breakdown (Step-by-step Python/TypeScript)
- Production-Ready Cleanroom Client Implementation

# 1. Clone the reverse-skill repository
git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

# 2. Refresh the local tool index (Windows PowerShell)
powershell -File skills/scripts/refresh-tool-index.ps1

# (Linux / macOS / Kali):
# bash skills/scripts/refresh-tool-index.sh

# 3. Route your first reverse engineering case
powershell -File skills/scripts/master-route.ps1 -Hint "Deconstruct React web app frontend API signatures"
powershell -File skills/scripts/case-init.ps1 -Hint "Web API analysis" -CaseName "my-target-app" -AuthGranted -TargetUrl "https://api.target.com" -NetworkProfile authorized_target_only