# AI use cases for Seep Reverse Lab (angusdevgo/Seep-Reverse-Lab) Repo: [angusdevgo/Seep-Reverse-Lab](https://github.com/angusdevgo/Seep-Reverse-Lab) | Use cases: 4 | Page: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/ Seep Reverse Lab is a Lua-based, agent-driven workbench that wraps reverse engineering tools (Radare2, JADX, Apktool, Frida) and runs CWE-602 client-side authorization audits. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Audit an app feature gate for CWE-602 authorization flaws: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/audit-client-feature-gate-cwe-602/ - Map a Windows PE binary's protections and key functions: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/triage-windows-pe-binary-protections/ - Map an APK's control flow without flooding the agent context: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/map-apk-control-flow-within-token-budget/ - Generate a Frida verification hook that fixes its own errors: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/generate-frida-hook-with-self-healing-run/ ## How to audit an app feature gate for CWE-602 authorization flaws with Seep Reverse Lab Repo: [angusdevgo/Seep-Reverse-Lab](https://github.com/angusdevgo/Seep-Reverse-Lab) | Difficulty: Intermediate | Time: 60 minutes | Basis: From the README Decide whether a client-side premium or feature check is local or enforced by the server. **Who it is for:** A security auditor testing a mobile app for authorization flaws, with written permission from the app owner. **The problem:** A feature check may only run on the device, so a user could skip it. The auditor needs to tell local checks from server-enforced ones. **The outcome:** A three-part security report that states whether the gate is a local boolean or server-authoritative, backed by evidence and an airplane-mode confirmation. ### Steps 1. Double-click check.bat to confirm the Seep workspace health before starting. 2. Open the Seep project folder in Claude Code or Codex so the agent loads the project instructions. 3. Give the agent the APK path and the feature name you are authorized to audit. 4. Review the decompiled control-flow skeleton and the knowledge base match the agent reports. 5. Check the airplane-mode confirmation result and the generated security report before sharing it. ### Prompt to paste into your agent ```text Using the Seep Reverse Lab workspace, audit the premium check in for CWE-602 authorization issues, but only for the app I am authorized to test. Expected output: a short report that says whether the gate is local or server-authoritative, with the evidence. Verify that the airplane-mode confirmation was run and recorded. ``` ### Caveat The README describes the bypass and anti-refusal features in detail, so keep every run scoped to an authorized CWE-602 audit and do not use the workbench for unauthorized access. Risk, reverse engineering: Only audit apps you have written permission to test, because the workflow decompiles and runs the target app. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/audit-client-feature-gate-cwe-602/ ## How to map a Windows PE binary's protections and key functions with Seep Reverse Lab Repo: [angusdevgo/Seep-Reverse-Lab](https://github.com/angusdevgo/Seep-Reverse-Lab) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Get architecture, protections, and a function list for a PE file in one agent session. **Who it is for:** A reverse engineer who has received a suspicious or third-party Windows executable and needs a fast first look. **The problem:** Opening a binary cold means checking architecture, bitness, and protections across several tools before the real analysis can begin. **The outcome:** A short summary of architecture, bitness, DEP, ASLR, canary, and PIE status, plus a list of functions and imports to focus on. ### Steps 1. Run check.bat once to confirm Radare2 and the knowledge base are ready. 2. Open the Seep project folder in your agent of choice. 3. Ask the agent to run the binary info, function list, and summary decompile on the target file. 4. Read the protections summary and pick the functions the agent flags as most relevant. ### Prompt to paste into your agent ```text Using the seep MCP tools in the Seep Reverse Lab workspace, triage with seep_r2_info, seep_r2_functions, and seep_r2_decompile in summary mode. Expected output: architecture, bitness, protection flags, and the top functions by interest. Verify that the protection flags match the seep_r2_info output. ``` ### Caveat The README names the Radare2 tools but does not describe the output format, so check the first results against the binary before relying on them. Risk, reverse engineering: Only triage binaries you are authorized to analyze, and keep the samples inside the workspace. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/triage-windows-pe-binary-protections/ ## How to map an APK's control flow without flooding the agent context with Seep Reverse Lab Repo: [angusdevgo/Seep-Reverse-Lab](https://github.com/angusdevgo/Seep-Reverse-Lab) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Decompile an Android APK to a control-flow skeleton to save tokens during analysis. **Who it is for:** An Android security tester who needs to understand app logic but works with an agent that has a limited context window. **The problem:** Full decompiled output for a large APK can exhaust the agent's context and make the analysis drift or stop early. **The outcome:** A folded control-flow skeleton of the app that the agent can reason over, with the README's reported token savings. ### Steps 1. Run check.bat to confirm the APK toolchain (JADX and Apktool) is ready. 2. Open the Seep project folder in your agent. 3. Ask the agent to triage the APK and then decompile it in fold output mode. 4. Review the skeleton and ask the agent to drill into one class at a time. ### Prompt to paste into your agent ```text Using the Seep Reverse Lab workspace, triage and decompile it with seep_apk_decompile in fold mode. Expected output: a control-flow skeleton listing the main classes and their branches. Verify that the skeleton covers the classes the app's main activity calls. ``` ### Caveat The README gives the fold mode token saving as about 60 percent, which is a measured figure from the project, so expect your own savings to vary. Risk, reverse engineering: Decompile only APKs you have permission to analyze. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/map-apk-control-flow-within-token-budget/ ## How to generate a Frida verification hook that fixes its own errors with Seep Reverse Lab Repo: [angusdevgo/Seep-Reverse-Lab](https://github.com/angusdevgo/Seep-Reverse-Lab) | Difficulty: Advanced | Time: 90 minutes | Basis: From the README Create a Frida hook script for an APK and let the agent retry failed runs up to three times. **Who it is for:** An advanced mobile tester who needs a runtime check of a suspected authorization behavior on a device they control. **The problem:** Frida hook scripts often fail on class-name or loading errors, and fixing them by hand takes repeated trial and error. **The outcome:** A generated hook_verify.js script, captured runtime output, and either a working verification or a structured handoff after three attempts. ### Steps 1. Run check.bat and confirm the hook-mcp toolchain is available. 2. Connect your test device or emulator and make sure Frida can reach it. 3. Ask the agent to generate the hook for the target class and run it. 4. Review the captured stdout and any self-healing attempts in the agent log. 5. Stop after the three-attempt limit and take the structured handoff if the hook still fails. ### Prompt to paste into your agent ```text Using the Seep Reverse Lab workspace, generate a Frida hook for in with seep_apk_gen_hook and run it on the connected device. Expected output: hook_verify.js and the captured stdout. Verify that the run stops after three attempts if it does not succeed. ``` ### Caveat The README describes the self-healing loop, but it does not list which error types it can fix, so treat the three-attempt handoff as the point where a human should step in. Risk, reverse engineering: Run Frida hooks only on devices and apps you control or have written permission to test. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/angusdevgo-seep-reverse-lab/generate-frida-hook-with-self-healing-run/