openclaw/apk-reverse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add detection-and-anti-analysis reference

Browse Source 
A decision file for when the app fights back or the tool cannot run here: separating
detection from a broken environment, choosing between workaround / change-route /
accept by cost instead of escalating, recognising an environment where dynamic
analysis genuinely cannot work (and switching to static rather than proving it
impossible), and keeping 'blocks my analysis' separate from 'blocks the deliverable'.
This commit is contained in:
inliver233
2026-09-19 23:03:15 +08:00
parent 173ad0d463
commit 02c832f847
3 changed files with 139 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SKILL.md
+1
View File
@@ -120,6 +120,7 @@ Load only what the current step needs.
| `references/dart-aot.md` | The logic lives in a Dart AOT snapshot (`libapp.so`): pinning the Dart version, building a matching decompiler, the object pool and reference indexing, register/boolean conventions, locating and patching Dart code |
| `references/native-and-so.md` | Patching in a `.so`, needing code to run before the app's own code, hand-built native payloads that crash inside the linker, or **deciding which library/ABI is actually loaded and executing** |
| `references/native-tamper-and-suicide.md` | The process dies on its own (no Java stack, or a native crash that looks like a bug); you are about to neutralise a `kill`/`exit`/`abort` path; or a hardened library's sections/function boundaries look wrong |
| `references/detection-and-anti-analysis.md` | The app fights back: it dies after you attach, refuses to run on your device, detects root/hook/debugger, or your dynamic tool simply does not work in this environment. **Read the first section before escalating** — the right answer is usually to switch to static, not to fight the detector |
| `references/toolchain.md` | Choosing or invoking tools, something is not installed, a tool's output smells wrong, or you need to know which tools exist only as a GUI |
| `references/ad-removal.md` | Task involves ads, trackers, sponsored cards, splash/interstitial/reward |
| `references/updates-and-forced-upgrade.md` | The patched build must **keep working over time**; the app has any version check, forced-upgrade dialog, self-update installer, or hot-update/resource channel. Load this for essentially every build you intend to ship. |