Android Reverse Engineering Automation with Just - Complete toolkit for APK analysis, Frida instrumentation, MITM proxy, and MobSF integration

GIST_README.md

Android Reverse Engineering Automation with Just

A comprehensive justfile for automating Android application reverse engineering tasks including APK downloading, static analysis with jadx/apktool, dynamic analysis with Frida, MITM proxy setup, and MobSF integration.

Quick Start

Prerequisites

macOS:

# Install Just command runner
brew install just

# Install Android tools
brew install android-platform-tools openjdk

# Install Python tools
pip3 install frida-tools mitmproxy

# Install APK downloader (choose one)
cargo install apkeep
# OR download from: https://github.com/EFForg/apkeep/releases

Linux (Ubuntu/Debian):

# Install Just
curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to ~/bin
# OR: cargo install just

# Install system packages  
sudo apt-get update && sudo apt-get install -y android-tools-adb default-jre python3-pip

# Install Python tools
pip3 install frida-tools mitmproxy

# Install APK downloader
cargo install apkeep

Setup

1. Download the justfile:

   curl -o justfile https://gist.githubusercontent.com/[GIST_URL]/raw/justfile

2. Set up tools automatically:

   just setup-tools

3. Check your setup:

   just check-tools

Common Commands

Quick Analysis

# Download and analyze an app
just download-analyze com.example.app

# Analyze existing APK
just analyze path/to/app.apk

# Quick static scan only
just quick-scan app.apk

Device Management

# List connected devices
just devices

# Create analysis emulator
just create-avd

# Start emulator
just start-emulator

Individual Tools

# Decompile with jadx
just jadx app.apk

# Decode resources with apktool  
just apktool app.apk

# Install Frida server
just install-frida-server

# Hook app with SSL bypass
just hook-ssl com.example.app

# Start MobSF for security analysis
just start-mobsf

Full Workflows

# Complete security audit
just security-audit app.apk

# Dynamic analysis setup
just dynamic-setup app.apk

# MITM proxy setup
just setup-mitm

Available Command Groups

• setup: Tool installation and environment setup
• device: Android device and emulator management
• acquisition: APK downloading and extraction
• analysis: Static analysis with jadx/apktool
• frida: Dynamic instrumentation setup
• mitm: Network traffic interception
• mobsf: Security analysis with MobSF
• dynamic: Runtime analysis workflows
• workflow: Complete analysis pipelines
• utils: Utilities and cleanup

Environment Variables

# Android SDK location (auto-detected)
export ANDROID_SDK_ROOT=/path/to/android-sdk

# Custom output directory  
export output_dir="my-analysis"

Requirements

• Android SDK with platform-tools (adb)
• Java 8+ for jadx/apktool
• Python 3 for Frida and mitmproxy
• Just command runner
• apkeep for APK downloading
• Docker (optional, for MobSF)

Security Note

This tool is designed for legitimate security research and educational purposes only. Always ensure you have proper authorization before analyzing applications. The SSL unpinning capabilities should only be used on applications you own or have explicit permission to test.

Troubleshooting

"Command not found" errors:

# Check tool installation
just check-tools

# Set up Android SDK path
export ANDROID_HOME=/path/to/android-sdk

Emulator won't start:

# Check available AVDs
emulator -list-avds

# Create new AVD if needed
just create-avd

Frida connection issues:

# Check device architecture and install correct server
just install-frida-server

# Verify server is running
just frida-status

Contributing

This justfile is designed to be modular and extensible. Feel free to:

• Add new analysis tools
• Create custom workflow recipes
• Improve cross-platform compatibility
• Add error handling for edge cases

Related Files

• ssl_unpinning.js - Universal Frida script for SSL certificate pinning bypass
• Original inspiration: REasy Node.js toolkit

---

Tip: Run just --list to see all available commands organized by category!

justfile

# Android Reverse Engineering Automation
# REasy justfile - Streamlined commands for Android app analysis

set shell := ["bash", "-uc"]
set export := true
set dotenv-load := true

# Variables
android_sdk := env_var_or_default("ANDROID_SDK_ROOT", env_var_or_default("ANDROID_HOME", "/opt/android-sdk"))
output_dir := "output"
tools_dir := "tools"
frida_scripts_dir := "templates/frida-scripts"
mobsf_port := "8000"
proxy_port := "8080"

# Default recipe - show available commands
default:
    @echo "🔧 REasy Android Reverse Engineering Toolkit"
    @echo "============================================="
    @echo ""
    @just --list

# === SETUP & INSTALLATION ===

# Check if required tools are installed
[group('setup')]
check-tools:
    @echo "🔍 Checking required tools..."
    @echo "ADB: $(which adb || echo '❌ Not found')"
    @echo "Java: $(which java || echo '❌ Not found')"
    @echo "Python: $(which python3 || echo '❌ Not found')"
    @echo "apkeep: $(which apkeep || echo '❌ Not found - install with: cargo install apkeep')"
    @echo "jadx: $(which jadx || echo '❌ Not found')"
    @echo "apktool: $(ls {{tools_dir}}/apktool.jar 2>/dev/null || echo '❌ Not found')"
    @echo "mitmproxy: $(which mitmproxy || echo '❌ Not found - install with: pip install mitmproxy')"
    @echo "frida: $(which frida || echo '❌ Not found - install with: pip install frida-tools')"

# Download and setup analysis tools
[group('setup')]
setup-tools:
    mkdir -p {{tools_dir}}
    @echo "📥 Downloading jadx..."
    curl -L "https://github.com/skylot/jadx/releases/latest/download/jadx.zip" -o {{tools_dir}}/jadx.zip
    unzip -q {{tools_dir}}/jadx.zip -d {{tools_dir}}/jadx
    chmod +x {{tools_dir}}/jadx/bin/jadx
    @echo "📥 Downloading apktool..."
    curl -L "https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool.jar" -o {{tools_dir}}/apktool.jar
    @echo "✅ Tools setup complete"

# Install system dependencies
[group('setup')]
[confirm("Install system packages?")]
install-deps:
    #!/usr/bin/env bash
    if command -v apt-get >/dev/null; then
        sudo apt-get update && sudo apt-get install -y android-tools-adb default-jre python3-pip unzip curl
    elif command -v brew >/dev/null; then
        brew install android-platform-tools openjdk unzip curl
    elif command -v dnf >/dev/null; then
        sudo dnf install -y android-tools java-latest-openjdk python3-pip unzip curl
    fi
    pip3 install frida-tools mitmproxy

# === DEVICE MANAGEMENT ===

# List connected devices and emulators
[group('device')]
devices:
    @echo "📱 Connected devices:"
    @adb devices -l

# Check device details
[group('device')]
device-info:
    @echo "📋 Device Information:"
    @echo "Model: $(adb shell getprop ro.product.model)"
    @echo "Android: $(adb shell getprop ro.build.version.release)"
    @echo "API Level: $(adb shell getprop ro.build.version.sdk)"
    @echo "Architecture: $(adb shell getprop ro.product.cpu.abi)"
    @echo "Root: $(adb shell which su >/dev/null 2>&1 && echo '✅ Available' || echo '❌ Not available')"

# Start Android emulator
[group('device')]
start-emulator avd_name="REasy_AVD":
    @echo "🚀 Starting emulator: {{avd_name}}"
    emulator -avd {{avd_name}} -no-snapshot -no-boot-anim -accel on -gpu host -memory 2048 -http-proxy http://127.0.0.1:{{proxy_port}} &
    @echo "⏳ Waiting for emulator to boot..."
    adb wait-for-device
    @echo "✅ Emulator ready"

# Create new AVD for analysis
[group('device')]
create-avd avd_name="REasy_AVD" api_level="30":
    @echo "📱 Creating AVD: {{avd_name}}"
    echo no | avdmanager create avd -n {{avd_name}} -k "system-images;android-{{api_level}};google_apis_playstore;x86_64" -d "pixel_4" --force
    @echo "✅ AVD created. Start with: just start-emulator {{avd_name}}"

# === APK ACQUISITION ===

# Download APK using apkeep
[group('acquisition')]
download package version="" source="apk-pure":
    #!/usr/bin/env bash
    mkdir -p {{output_dir}}
    timestamp=$(date +%Y-%m-%dT%H-%M-%S-%3NZ)
    output_dir="{{output_dir}}/$timestamp"
    mkdir -p "$output_dir"
    
    if [[ -n "{{version}}" ]]; then
        package_spec="{{package}}@{{version}}"
    else
        package_spec="{{package}}"
    fi
    
    echo "📥 Downloading $package_spec from {{source}}..."
    apkeep -a "$package_spec" -d {{source}} "$output_dir"
    
    # Handle XAPK extraction if needed
    xapk_file=$(find "$output_dir" -name "*.xapk" | head -1)
    if [[ -n "$xapk_file" ]]; then
        echo "📦 Extracting XAPK..."
        extract_dir="${xapk_file%.*}_extracted"
        mkdir -p "$extract_dir"
        unzip -q "$xapk_file" -d "$extract_dir"
        echo "✅ APK ready: $extract_dir/*.apk"
    else
        echo "✅ APK downloaded to: $output_dir"
    fi

# Pull APK from connected device
[group('acquisition')]
pull-apk package:
    #!/usr/bin/env bash
    mkdir -p {{output_dir}}/device-pulls
    echo "📱 Pulling {{package}} from device..."
    apk_path=$(adb shell pm path {{package}} | cut -d':' -f2 | tr -d '\r')
    if [[ -z "$apk_path" ]]; then
        echo "❌ Package {{package}} not found on device"
        exit 1
    fi
    adb pull "$apk_path" "{{output_dir}}/device-pulls/{{package}}.apk"
    echo "✅ Pulled to: {{output_dir}}/device-pulls/{{package}}.apk"

# === STATIC ANALYSIS ===

# Decompile APK with jadx
[group('analysis')]
jadx apk_path output_name="":
    #!/usr/bin/env bash
    if [[ ! -f "{{apk_path}}" ]]; then
        echo "❌ APK file not found: {{apk_path}}"
        exit 1
    fi
    
    if [[ -n "{{output_name}}" ]]; then
        output_dir="{{output_dir}}/{{output_name}}_jadx"
    else
        apk_name=$(basename "{{apk_path}}" .apk)
        output_dir="{{output_dir}}/${apk_name}_jadx"
    fi
    
    mkdir -p "$output_dir"
    echo "🔍 Decompiling with jadx: {{apk_path}}"
    
    if [[ -f "{{tools_dir}}/jadx/bin/jadx" ]]; then
        {{tools_dir}}/jadx/bin/jadx "{{apk_path}}" -d "$output_dir" --show-bad-code
    else
        jadx "{{apk_path}}" -d "$output_dir" --show-bad-code
    fi
    
    echo "✅ Jadx output: $output_dir"

# Decode APK resources with apktool
[group('analysis')]
apktool apk_path output_name="":
    #!/usr/bin/env bash
    if [[ ! -f "{{apk_path}}" ]]; then
        echo "❌ APK file not found: {{apk_path}}"
        exit 1
    fi
    
    if [[ -n "{{output_name}}" ]]; then
        output_dir="{{output_dir}}/{{output_name}}_apktool"
    else
        apk_name=$(basename "{{apk_path}}" .apk)
        output_dir="{{output_dir}}/${apk_name}_apktool"
    fi
    
    mkdir -p "$output_dir"
    echo "🔧 Decoding with apktool: {{apk_path}}"
    
    if [[ -f "{{tools_dir}}/apktool.jar" ]]; then
        java -jar {{tools_dir}}/apktool.jar d "{{apk_path}}" -o "$output_dir" -f
    else
        apktool d "{{apk_path}}" -o "$output_dir" -f
    fi
    
    echo "✅ Apktool output: $output_dir"

# Complete static analysis
[group('analysis')]
static-analysis apk_path: (jadx apk_path) && (apktool apk_path)
    @echo "✅ Static analysis complete for {{apk_path}}"

# Extract strings and analyze APK info
[group('analysis')]
analyze-strings apk_path:
    #!/usr/bin/env bash
    echo "🔤 Extracting strings from {{apk_path}}..."
    mkdir -p {{output_dir}}/strings
    strings_file="{{output_dir}}/strings/$(basename {{apk_path}} .apk)_strings.txt"
    
    strings "{{apk_path}}" > "$strings_file"
    
    echo "🌐 URLs found:"
    grep -E 'https?://[^\s<>"{}|\\^`\[\]]+' "$strings_file" | head -10
    
    echo "🔑 Potential API keys:"
    grep -iE '(api[_-]?key|apikey|token|secret)' "$strings_file" | head -5
    
    echo "✅ Full strings saved to: $strings_file"

# === FRIDA SETUP ===

# Check Frida installation status
[group('frida')]
frida-status:
    @echo "🔍 Frida Status:"
    @echo "CLI: $(frida --version 2>/dev/null || echo '❌ Not installed')"
    @echo "Server on device: $(adb shell ls /data/local/tmp/frida-server 2>/dev/null && echo '✅ Installed' || echo '❌ Not installed')"
    @echo "Server running: $(adb shell ps | grep frida-server >/dev/null && echo '✅ Running' || echo '❌ Not running')"

# Install Frida server on device
[group('frida')]
install-frida-server:
    #!/usr/bin/env bash
    echo "📦 Installing Frida server..."
    
    # Get device architecture
    arch=$(adb shell getprop ro.product.cpu.abi | tr -d '\r')
    echo "Device architecture: $arch"
    
    # Map to Frida architecture names
    case "$arch" in
        "arm64-v8a") frida_arch="arm64" ;;
        "armeabi-v7a") frida_arch="arm" ;;
        "x86") frida_arch="x86" ;;
        "x86_64") frida_arch="x86_64" ;;
        *) echo "❌ Unsupported architecture: $arch"; exit 1 ;;
    esac
    
    # Get Frida version
    version=$(frida --version 2>/dev/null || echo "16.1.4")
    
    # Download Frida server
    url="https://github.com/frida/frida/releases/download/$version/frida-server-$version-android-$frida_arch.xz"
    echo "📥 Downloading: $url"
    
    mkdir -p /tmp/frida-install
    curl -L "$url" -o "/tmp/frida-install/frida-server.xz"
    xz -d "/tmp/frida-install/frida-server.xz"
    
    # Install on device
    adb push "/tmp/frida-install/frida-server" "/data/local/tmp/frida-server"
    adb shell "chmod 755 /data/local/tmp/frida-server"
    
    # Cleanup
    rm -rf /tmp/frida-install
    echo "✅ Frida server installed"

# Start Frida server on device
[group('frida')]
start-frida:
    @echo "🚀 Starting Frida server..."
    @adb shell "nohup /data/local/tmp/frida-server &" || adb shell "su -c 'nohup /data/local/tmp/frida-server &'"
    @sleep 2
    @echo "✅ Frida server started"

# Stop Frida server
[group('frida')]
stop-frida:
    @echo "🛑 Stopping Frida server..."
    @adb shell "pkill frida-server" || adb shell "su -c 'pkill frida-server'"
    @echo "✅ Frida server stopped"

# Attach Frida with SSL unpinning
[group('frida')]
hook-ssl package:
    @echo "🔓 Hooking {{package}} with SSL unpinning..."
    frida -U {{package}} -l "{{frida_scripts_dir}}/ssl_unpinning.js"

# Run custom Frida script
[group('frida')]
frida-script package script_path:
    #!/usr/bin/env bash
    if [[ ! -f "{{script_path}}" ]]; then
        echo "❌ Script not found: {{script_path}}"
        exit 1
    fi
    echo "🔬 Running Frida script on {{package}}"
    frida -U {{package}} -l "{{script_path}}"

# === MITM PROXY ===

# Setup MITM proxy and certificates
[group('mitm')]
setup-mitm:
    @echo "🔒 Setting up MITM proxy..."
    mkdir -p certs
    @echo "Generating certificates..."
    @timeout 5s mitmproxy --set confdir=./certs || true
    @echo "Installing certificate on device..."
    @if adb shell which su >/dev/null 2>&1; then \
        echo "📜 Installing as system certificate (root available)..."; \
        just install-system-cert; \
    else \
        echo "📱 Installing as user certificate..."; \
        just install-user-cert; \
    fi

# Install certificate as system cert (requires root)
[group('mitm')]
install-system-cert:
    #!/usr/bin/env bash
    cert_hash=$(openssl x509 -inform PEM -subject_hash_old -in certs/mitmproxy-ca-cert.pem | head -1)
    openssl x509 -inform PEM -in certs/mitmproxy-ca-cert.pem -out "certs/${cert_hash}.0"
    
    adb push "certs/${cert_hash}.0" "/data/local/tmp/"
    adb shell "su -c 'mount -o rw,remount /system'"
    adb shell "su -c 'cp /data/local/tmp/${cert_hash}.0 /system/etc/security/cacerts/'"
    adb shell "su -c 'chmod 644 /system/etc/security/cacerts/${cert_hash}.0'"
    adb shell "su -c 'mount -o ro,remount /system'"
    echo "✅ System certificate installed"

# Install certificate as user cert (no root required)
[group('mitm')]
install-user-cert:
    adb push certs/mitmproxy-ca-cert.cer /sdcard/mitmproxy-cert.cer
    adb shell "am start -a android.settings.SECURITY_SETTINGS"
    @echo "📋 Please manually install certificate from /sdcard/mitmproxy-cert.cer"

# Start MITM proxy with traffic capture
[group('mitm')]
start-mitm session_name="":
    #!/usr/bin/env bash
    timestamp=$(date +%Y-%m-%dT%H-%M-%S)
    if [[ -n "{{session_name}}" ]]; then
        session_dir="{{output_dir}}/mitm_{{session_name}}_$timestamp"
    else
        session_dir="{{output_dir}}/mitm_$timestamp"
    fi
    mkdir -p "$session_dir"
    
    echo "🌐 Starting MITM proxy..."
    echo "Traffic will be saved to: $session_dir"
    echo "Web interface: http://localhost:8081"
    
    # Configure device proxy
    host_ip=$(hostname -I | awk '{print $1}' || echo "10.0.2.2")
    adb shell "settings put global http_proxy $host_ip:{{proxy_port}}"
    
    # Start mitmproxy
    mitmproxy --listen-port {{proxy_port}} --web-port 8081 --set confdir=./certs -w "$session_dir/flows.mitm"

# === DYNAMIC ANALYSIS ===

# Install APK on device
[group('dynamic')]
install-apk apk_path:
    #!/usr/bin/env bash
    if [[ ! -f "{{apk_path}}" ]]; then
        echo "❌ APK file not found: {{apk_path}}"
        exit 1
    fi
    echo "📲 Installing APK: {{apk_path}}"
    adb install -r -t -g "{{apk_path}}"
    echo "✅ APK installed successfully"

# Launch app with Frida instrumentation
[group('dynamic')]
launch-with-frida package script_path=(frida_scripts_dir + "/ssl_unpinning.js"):
    #!/usr/bin/env bash
    echo "🚀 Launching {{package}} with Frida instrumentation..."
    
    # Start Frida server if not running
    if ! adb shell ps | grep -q frida-server; then
        just start-frida
    fi
    
    # Launch with script
    frida -U -f {{package}} -l "{{script_path}}" --no-pause

# Full dynamic analysis setup
[group('dynamic')]
dynamic-setup apk_path: (install-apk apk_path) start-frida setup-mitm
    @echo "✅ Dynamic analysis environment ready"

# === MOBSF INTEGRATION ===

# Start MobSF Docker container
[group('mobsf')]
start-mobsf:
    @echo "🐳 Starting MobSF container..."
    docker run -it --rm -p {{mobsf_port}}:8000 opensecurity/mobsf:latest
    @echo "🌐 MobSF available at: http://localhost:{{mobsf_port}}"

# Start MobSF in background
[group('mobsf')]
mobsf-daemon:
    @echo "🐳 Starting MobSF daemon..."
    docker run -d --name mobsf -p {{mobsf_port}}:8000 opensecurity/mobsf:latest
    @echo "✅ MobSF running at: http://localhost:{{mobsf_port}}"

# Stop MobSF container
[group('mobsf')]
stop-mobsf:
    @echo "🛑 Stopping MobSF..."
    @docker stop mobsf 2>/dev/null || echo "MobSF container not running"
    @docker rm mobsf 2>/dev/null || true

# Upload APK to MobSF for analysis
[group('mobsf')]
mobsf-scan apk_path:
    #!/usr/bin/env bash
    if [[ ! -f "{{apk_path}}" ]]; then
        echo "❌ APK file not found: {{apk_path}}"
        exit 1
    fi
    
    echo "📤 Uploading {{apk_path}} to MobSF..."
    
    # Check if MobSF is running
    if ! curl -s "http://localhost:{{mobsf_port}}" >/dev/null; then
        echo "❌ MobSF not running. Start with: just start-mobsf"
        exit 1
    fi
    
    # Upload APK
    response=$(curl -s -X POST \
        -F "file=@{{apk_path}}" \
        "http://localhost:{{mobsf_port}}/api/v1/upload")
    
    hash=$(echo "$response" | grep -o '"hash":"[^"]*"' | cut -d'"' -f4)
    
    if [[ -n "$hash" ]]; then
        echo "✅ Upload successful. Hash: $hash"
        echo "🌐 View results: http://localhost:{{mobsf_port}}/static_analyzer/$hash"
    else
        echo "❌ Upload failed"
    fi

# === FULL WORKFLOWS ===

# Complete analysis workflow
[group('workflow')]
analyze apk_path: (static-analysis apk_path) (dynamic-setup apk_path)
    @echo "🎯 Complete analysis workflow finished"
    @echo "📊 Check {{output_dir}} for results"

# Quick analysis (static only)
[group('workflow')]
quick-scan apk_path: (jadx apk_path) (analyze-strings apk_path)
    @echo "⚡ Quick scan complete"

# Security-focused analysis with MobSF
[group('workflow')]
security-audit apk_path: (static-analysis apk_path) (mobsf-scan apk_path)
    @echo "🔒 Security audit complete"

# Download and analyze workflow
[group('workflow')]
download-analyze package version="" source="apk-pure":
    #!/usr/bin/env bash
    echo "🔄 Download and analyze workflow for {{package}}"
    just download {{package}} {{version}} {{source}}
    
    # Find the downloaded APK
    latest_dir=$(ls -1t {{output_dir}} | head -1)
    apk_file=$(find "{{output_dir}}/$latest_dir" -name "*.apk" | head -1)
    
    if [[ -z "$apk_file" ]]; then
        # Check for extracted XAPK
        apk_file=$(find "{{output_dir}}/$latest_dir" -path "*_extracted/*.apk" | head -1)
    fi
    
    if [[ -n "$apk_file" ]]; then
        echo "📋 Analyzing downloaded APK: $apk_file"
        just analyze "$apk_file"
    else
        echo "❌ No APK found in download output"
        exit 1
    fi

# === UTILITIES ===

# Clean up analysis outputs
[group('utils')]
[confirm("Delete all analysis output?")]
clean:
    rm -rf {{output_dir}}/*
    @echo "🧹 Cleanup complete"

# Create analysis report
[group('utils')]
report apk_path:
    #!/usr/bin/env bash
    apk_name=$(basename "{{apk_path}}" .apk)
    report_file="{{output_dir}}/${apk_name}_report.md"
    
    echo "# Analysis Report: $apk_name" > "$report_file"
    echo "Generated: $(date)" >> "$report_file"
    echo "" >> "$report_file"
    
    # APK info
    echo "## APK Information" >> "$report_file"
    aapt dump badging "{{apk_path}}" | head -20 >> "$report_file"
    
    echo "✅ Report generated: $report_file"

# Archive analysis session
[group('utils')]
archive session_dir:
    #!/usr/bin/env bash
    if [[ ! -d "{{session_dir}}" ]]; then
        echo "❌ Session directory not found: {{session_dir}}"
        exit 1
    fi
    
    archive_name="$(basename {{session_dir}}).tar.gz"
    tar -czf "$archive_name" -C "$(dirname {{session_dir}})" "$(basename {{session_dir}})"
    echo "✅ Archive created: $archive_name"

# Quick device screenshot
[group('utils')]
screenshot name="":
    #!/usr/bin/env bash
    if [[ -n "{{name}}" ]]; then
        filename="screenshot_{{name}}_$(date +%s).png"
    else
        filename="screenshot_$(date +%s).png"
    fi
    
    mkdir -p {{output_dir}}/screenshots
    adb shell screencap -p /sdcard/screenshot.png
    adb pull /sdcard/screenshot.png "{{output_dir}}/screenshots/$filename"
    adb shell rm /sdcard/screenshot.png
    echo "📸 Screenshot saved: {{output_dir}}/screenshots/$filename"

# Show help for specific groups
[group('help')]
help-setup:
    @echo "Setup commands:"
    @just --list | grep -A100 "setup:"

[group('help')]  
help-analysis:
    @echo "Analysis commands:"
    @just --list | grep -A100 "analysis:"

[group('help')]
help-workflow:
    @echo "Workflow commands:"
    @just --list | grep -A100 "workflow:"

# Node.js legacy commands (bridge to existing functionality)
[group('legacy')]
reasy-analyze package *args:
    node src/cli.js analyze {{package}} {{args}}

[group('legacy')]
reasy-download package *args:
    node src/cli.js download {{package}} {{args}}

[group('legacy')]
reasy-static apk *args:
    node src/cli.js static {{apk}} {{args}}