competition-crypto-mobile

Recovers transform chains, stego payloads, and mobile signing paths in CTF challenges.

21|8|Updated Aug 3, 2026
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill competition-crypto-mobile-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: competition-crypto-mobile
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/CTF-Sandbox-Orchestrator/competition-crypto-mobile
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill competition-crypto-mobile-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? CTF challenges involving encoded blobs, hidden media payloads, or mobile app trust boundaries often stall because solvers guess at algorithms instead of following a repeatable decode-and-hook workflow. This Skill provides a structured methodology for crypto, steganography, and mobile challenges inside an established sandbox. ## Core Features & Use Cases - Transform Chain Recovery: Reconstructs container, compression, encoding, XOR/substitution, crypto, and integrity stages in order while preserving exact keys, IVs, nonces, and offsets. - Steganography Inspection: Examines metadata, chunk layout, palettes, alpha planes, LSBs, thumbnails, and appended trailers with evidence-ranked decode attempts. - Mobile Trust-Boundary Analysis: Traces APK/IPA manifests, exported components, deeplinks, native libraries, signer logic, token storage, SSL pinning, and protobuf or RPC boundaries. - Use Case: Given a CTF APK that signs requests with a hidden native function, use this Skill to locate the signer logic, hook the narrowest JNI boundary, and replay a valid signed request. ## Quick Start After $ctf-sandbox-orchestrator is active, ask the agent to decode the challenge blob, inspect the image for hidden payloads, or hook the APK signing path using this Skill.

Frequently Asked Questions about competition-crypto-mobile

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decode an unknown encoded blob in a CTF challenge?▼

Reconstruct the transform chain step by step: container, compression, encoding, XOR or substitution, crypto, integrity check, then final parse. Record exact keys, IVs, nonces, salts, and byte order at each stage rather than guessing algorithms.

How do I find hidden data in steganography images?▼

Inspect metadata, chunk layout, palettes, alpha planes, LSBs, thumbnails, and appended trailers in that order. Rank decode attempts by evidence found in the file rather than brute-forcing every possible method.

How do I hook an APK signer to replay signed requests?▼

Start with the manifest, exported components, native libraries, and shared preferences to locate signer logic. Then hook the narrowest boundary such as the signer function, crypto helper, or JNI bridge, and reproduce the signed request with captured parameters.

When should I use this skill instead of a dedicated Android or iOS skill?▼

Use this skill for mixed crypto, stego, and mobile challenges. For deep Android dynamic tracing or JNI hooks prefer the Android hooking skill, and for iOS Keychain or Objective-C runtime tracing prefer the iOS runtime skill.

Can this skill run without the sandbox orchestrator active?▼

No, it is a downstream specialization that requires $ctf-sandbox-orchestrator to have already established sandbox assumptions, node ownership, and evidence priorities. If that has not happened, route back to the orchestrator first.