Agent skill

Native Binary Patching

by kveld9 in kveld9/kveld-morphe-patches

ARM64 ELF and binary asset patching guidelines covering libchrome.so host redirection, multi-candidate offset resolution, companion .so trimming, and Hermes bytecode patching.

GPL-3.0Auto-check passedMobile

Install Native Binary Patching

skills CLI
$ npx skills add kveld9/kveld-morphe-patches --skill native-binary-patching -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install kveld9/kveld-morphe-patches native-binary-patching --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/kveld9/kveld-morphe-patches.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/native-binary-patching .claude/skills/native-binary-patching && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
native-binary-patching
GitHub stars
113
Token cost
~1.5k tokens
SKILL.md length
271 words
Files
1
Skills in repo
4
Repo updated
First seen
Licence
GPL-3.0

At a glance

ARM64 ELF and binary asset patching guidelines covering libchrome.so host redirection, multi-candidate offset resolution, companion .so trimming, and Hermes bytecode patching.

  • Works in 4 steps: In-Situ Binary String Redirection… → Multi-Candidate Offset Resolution → Companion Native Library Bloat Trimming → …
  • Mobile work in your project
  • SKILL.md covers 1. In-Situ Binary String…, 2. Multi-Candidate Offset…, 3. Companion Native Library… and 4. React Native Hermes…
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Native Binary Patching is an agent skill from kveld9/kveld-morphe-patches. ARM64 ELF and binary asset patching guidelines covering libchrome.so host redirection, multi-candidate offset resolution, companion .so trimming, and Hermes bytecode patching.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Mobile. It works with Android. The repository describes itself as: Custom Morphe patches on Android. The licence is GPL-3.0.

When your agent uses it

  • Mobile work in your project

Example prompts

  • “/native-binary-patching”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. In-Situ Binary String Redirection (libchrome.so)
  2. Multi-Candidate Offset Resolution
  3. Companion Native Library Bloat Trimming
  4. React Native Hermes Bytecode Asset Patching

What it can do on your machine

Read from SKILL.md and the folder at commit bfc153e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are kotlin).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Native Binary Patching loads about 1.5k tokens when it runs. Until then it costs about 50 tokens; SKILL.md has 271 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~50
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from kveld9/kveld-morphe-patches at commit bfc153e, republished under its GPL-3.0 licence (© kveld9). 271 words, ~1,467 tokens.

Download SKILL.mdSave it as .claude/skills/native-binary-patching/SKILL.md (or your agent's skills folder).
name
native-binary-patching
description
ARM64 ELF and binary asset patching guidelines covering libchrome.so host redirection, multi-candidate offset resolution, companion .so trimming, and Hermes bytecode patching.

Native & Binary Asset Patching Guidelines

1. In-Situ Binary String Redirection (libchrome.so)

Any binary modification executed inside rawResourcePatch targeting ELF libraries (such as lib/arm64-v8a/libchrome.so) must adhere to strict bounds and fingerprint verification protocols.

Production Pattern (BraveBlockTelemetryPatch.kt)

Redirection overwrites domain strings in-place with 0.0.0.0 followed by null bytes (0x00). The replacement length must exactly match the original string length to preserve ELF string table boundaries and segment offsets:

kotlin
val soFile = get("lib/arm64-v8a/libchrome.so")
if (!soFile.exists()) {
    return@execute
}

data class HostEntry(
    val offset: Long,
    val hostName: String,
)

val hostEntries = listOf(
    HostEntry(0x001f9329L, "star-randsrv.bsg.brave.com"),
    HostEntry(0x001f935aL, "collector.bsg.brave.com"),
    HostEntry(0x001f9391L, "usage-ping.brave.com"),
)

val redirectionIp = "0.0.0.0".toByteArray(Charsets.US_ASCII)
var writtenHosts = 0

RandomAccessFile(soFile, "rw").use { raf ->
    for (entry in hostEntries) {
        val expectedBytes = entry.hostName.toByteArray(Charsets.US_ASCII)
        val len = expectedBytes.size
        if (entry.offset + len > raf.length()) {
            throw PatchException("Host offset 0x${entry.offset.toString(16)} out of bounds in libchrome.so")
        }
        val buf = ByteArray(len)
        raf.seek(entry.offset)
        raf.readFully(buf)
        if (!buf.contentEquals(expectedBytes)) {
            throw PatchException(
                "Host fingerprint mismatch at 0x${entry.offset.toString(16)}. " +
                    "Expected: ${entry.hostName}, Found: ${String(buf, Charsets.US_ASCII)}",
            )
        }

        // Construct replacement: "0.0.0.0" + null byte + zero padding to original length
        val replacement = ByteArray(len)
        System.arraycopy(redirectionIp, 0, replacement, 0, redirectionIp.size)
        // Remaining bytes default to 0x00 (null padded)

        raf.seek(entry.offset)
        raf.write(replacement)
        writtenHosts++
    }
}

println("[Block Telemetry] Redirected $writtenHosts / ${hostEntries.size} endpoints to 0.0.0.0 in libchrome.so")

2. Multi-Candidate Offset Resolution

When string table offsets shift slightly between release builds or regional variants, resolve the target offset dynamically from a candidate list rather than hardcoding a single fragile pointer.

Production Pattern (libchrome.so Multi-Candidate Resolution)
kotlin
val syncOffsets = listOf(0x0031b2b2L, 0x0031b2b5L, 0x0031b34fL)
val targetUrl = "https://endpoint.example.com/v1/telemetry"
val expectedBytes = targetUrl.toByteArray(Charsets.US_ASCII)
val len = expectedBytes.size
val redirectionIp = "0.0.0.0".toByteArray(Charsets.US_ASCII)

RandomAccessFile(soFile, "rw").use { raf ->
    val validOffset = syncOffsets.firstOrNull { offset ->
        if (offset + len > raf.length()) return@firstOrNull false
        val buf = ByteArray(len)
        raf.seek(offset)
        raf.readFully(buf)
        buf.contentEquals(expectedBytes)
    } ?: throw PatchException(
        "Sync fingerprint mismatch for $targetUrl in libchrome.so",
    )

    val replacement = ByteArray(len)
    System.arraycopy(redirectionIp, 0, replacement, 0, redirectionIp.size)

    raf.seek(validOffset)
    raf.write(replacement)
}

3. Companion Native Library Bloat Trimming

When applications package unused third-party native binaries (e.g. AI models, XR runtime, or bundled VPN binaries), zeroing them out via writeBytes(byteArrayOf()) preserves file entries in the ZIP header while drastically reducing APK footprint.

Production Pattern (BraveNativeBloatSlimmerPatch.kt)
kotlin
private val EMPTY_STUB_BYTES = byteArrayOf()

private val BLOAT_NATIVE_LIBS = listOf(
    "libimpress_api_jni.so",
    "libwg-go.so",
    "libandroidx.xr.arcore.openxr.so",
    "libarcore_sdk_c.so",
)

val libDir = get("lib/arm64-v8a")
if (libDir.exists() && libDir.isDirectory) {
    BLOAT_NATIVE_LIBS.forEach { libName ->
        val libFile = get("lib/arm64-v8a/$libName")
        if (libFile.exists() && libFile.isFile) {
            val originalSize = libFile.length()
            if (originalSize > 0) {
                libFile.writeBytes(EMPTY_STUB_BYTES)
                savedBytes += (originalSize - libFile.length())
                strippedLibs.add(libName)
            }
        }
    }
}

4. React Native Hermes Bytecode Asset Patching

For React Native Android applications utilizing the Hermes JavaScript engine, the precompiled bundle is stored as a binary asset (assets/index.android.bundle). rawResourcePatch can parse and mutate Hermes Bytecode (HBC) directly.

Production Pattern (HevyUnlockProPatch.kt)
  1. Magic & Version Verification: Assert Hermes magic number (0x1f1903c103bc1fc6L) and target HBC version (e.g. HBC96 = 96).
  2. Table Parsing: Compute 4-byte aligned offsets for function headers, string table, overflow string table, and string storage.
  3. Target Function / Getter Identification: Locate function index by matching string identifier table entries (e.g. "isPro", "isPaying").
  4. Bytecode Opcode Injection: Overwrite the target function prologue with forced return instructions:
    • Hermes bytecode opcodes: LoadConstTrue r0 (0x78 0x00) followed by Ret r0 (0x5C 0x00).
    kotlin
    private val FORCE_TRUE_PROLOGUE = byteArrayOf(0x78.toByte(), 0x00, 0x5C.toByte(), 0x00)
  5. Write Back: Write modified byte array back to bundleFile.writeBytes(bundleBytes).

© kveld9, GPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/native-binary-patching of kveld9/kveld-morphe-patches.

Open the folder on GitHubat commit bfc153e

Compare with similar skills

Native Binary Patching next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Native Binary Patching compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Native Binary Patching this skillkveld9/kveld-morphe-patches113—~1.5kAutomated safety check: PassGPL-3.0
Compose Multiplatform Patternsmonta-app/ocpp-emulator1805 repos~2kAutomated safety check: PassApache-2.0
Phone HarnessShawnPana/phone-harness3.2k—~4.3kAutomated safety check: PassMIT
Stylesarindamxd/camerax-android1324 repos~2.3kAutomated safety check: PassApache-2.0
Verified Emailarindamxd/camerax-android1324 repos~4.7kAutomated safety check: PassApache-2.0
Argent Metro Debuggerbbplayer-app/BBPlayer1.2k—~3.4kAutomated safety check: PassMIT

Similar skills

  • Compose Multiplatform Patterns

    monta-app/ocpp-emulator

    Compose Multiplatform and Jetpack Compose patterns for KMP projects — state management, navigation, theming, performance, and platform-specific UI.

    180 GitHub starsUsed in 5 repos~2k tokens
    MobileAuto-check passed
  • Phone Harness

    ShawnPana/phone-harness

    Control the user's phone — an iPhone through the Mac's iPhone Mirroring window, an Android over adb, or a rented cloud Android: open apps, tap, type, swipe, read the screen.

    3.2k GitHub stars~4.3k tokensUpdated today
    MobileAuto-check passed
  • Styles

    arindamxd/camerax-android

    A skill your agent uses to integrate the Jetpack Compose Styles API into an Android project.

    132 GitHub starsUsed in 4 repos~2.3k tokens
    MobileAuto-check passed
  • Verified Email

    arindamxd/camerax-android

    Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API.

    132 GitHub starsUsed in 4 repos~4.7k tokens
    MobileAuto-check passed
  • Argent Metro Debugger

    bbplayer-app/BBPlayer

    Debug a JS runtime via CDP using argent debugger tools. An agent skill from bbplayer-app/BBPlayer.

    1.2k GitHub stars~3.4k tokensUpdated yesterday
    MobileAuto-check passed
  • 统一 Android XML 资源命名:layout、drawable、mipmap、color、values、id 的前缀与 snakecase 规则;把颜色/圆角/描边/状态编码进文件名(bg、border、textcolor…selector)。

    1.6k GitHub stars~1.3k tokensUpdated 1 mo ago
    MobileAuto-check passed

More from kveld9/kveld-morphe-patches

  • Morphe Patcher

    kveld9/kveld-morphe-patches

    Architecture, patch typology (bytecodePatch, resourcePatch, rawResourcePatch), universal patches, stringOption DSL, fingerprint resolution, compatibility contracts (Constants.kt), and diagnostic…

    113 GitHub stars~2.2k tokensUpdated today
    Auto-check passed
  • Smali Bytecode Hooks

    kveld9/kveld-morphe-patches

    Smali and Dalvik bytecode hooking guidelines, register architecture conventions, multi-return reverse traversal, TwoRegisterInstruction extraction, reflection bridges, and obfuscation guidelines.

    113 GitHub stars~1.6k tokensUpdated today
    Auto-check passed
  • Release Conventions

    kveld9/kveld-morphe-patches

    Semantic release and CI/CD lifecycle, conventional commit standards, release pipeline chain (release.yml and .releaserc), and git branching strategy.

    113 GitHub stars~893 tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Native Binary Patching

What does Native Binary Patching do?

ARM64 ELF and binary asset patching guidelines covering libchrome.so host redirection, multi-candidate offset resolution, companion .so trimming, and Hermes bytecode patching. Native Binary Patching is an agent skill from kveld9/kveld-morphe-patches.so trimming, and Hermes bytecode patching.

When should I use Native Binary Patching?

Native Binary Patching fits situations like: mobile work in your project.

How do I install Native Binary Patching in Claude Code?

Run `npx skills add kveld9/kveld-morphe-patches --skill native-binary-patching -a claude-code`. Or copy the skill folder (.agents/skills/native-binary-patching in kveld9/kveld-morphe-patches) into .claude/skills/native-binary-patching in your project. Claude Code loads it when a task matches its description.

How do I install Native Binary Patching in Codex?

Run `npx skills add kveld9/kveld-morphe-patches --skill native-binary-patching -a codex`. Or copy the skill folder (.agents/skills/native-binary-patching in kveld9/kveld-morphe-patches) into .agents/skills/native-binary-patching in your project. Codex loads it when a task matches its description.

Can I use Native Binary Patching in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add kveld9/kveld-morphe-patches --skill native-binary-patching -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/native-binary-patching, .gemini/skills/native-binary-patching, .github/skills/native-binary-patching and .opencode/skills/native-binary-patching in your project.

What does Native Binary Patching need to run?

SKILL.md names no scripts, command-line tools or credentials: Native Binary Patching is instructions for the agent only.

Does Native Binary Patching access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Native Binary Patching safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Native Binary Patching use?

Native Binary Patching is published under the GPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Native Binary Patching use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Native Binary Patching?

Skills that share tags, products or a category with Native Binary Patching: Compose Multiplatform Patterns (monta-app/ocpp-emulator, 180 stars), Phone Harness (ShawnPana/phone-harness, 3.2k stars), Styles (arindamxd/camerax-android, 132 stars) and Verified Email (arindamxd/camerax-android, 132 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Native Binary Patching?

kveld9 (a GitHub user) maintains it in kveld9/kveld-morphe-patches, which has 113 GitHub stars. The repository holds 4 skills in this directory. The repository was last updated on October 9, 2026.

Source: kveld9/kveld-morphe-patches on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.