Add signature-derived-key coverage, PID attach, MMKV; fix stale question count

New: references/signature-derived-keys.md (apps that use their own signing certificate as crypto key material: detection greps, why offline extraction is unreliable -- the runtime value is a certificate DER from inside the PKCS#7 chain, not the .RSA container -- plus the hardcode-then-verify procedure); scripts/sig_probe.py (offline candidates via --apk, authoritative read via --live, both exercised); pitfalls.md P27 (rebuilt APK installs and renders but every signed request returns empty/-1 signing params). Updated: dynamic-frida.md (attach by PID when enumerate_processes omits the target; verify runtime/Java-bridge availability before blaming the script); runtime-data.md (MMKV format, parse/write snippet, crc32 and in-memory-overwrite traps); server-api.md (route the signature-derived-key case to the new reference); SKILL.md and README.md (new classification question, corrected question count, index entries).
2026-09-19 22:31:32 +08:00
parent cf636c4263
commit 21686e84f1
9 changed files with 594 additions and 4 deletions
@@ -15,7 +15,7 @@ import java.util.List;
 /**
 * dexlib2 定点 patch：把指定方法的实现整体替换为 return-void（或 return 常量）。
 *
- * 为什么不用 baksmali/smali 整树往返：实测本项目的 classes7.dex 往返重建后运行时报
+ * 为什么不用 baksmali/smali 整树往返：实测在一个多 dex 应用上，整树往返重建后运行时报
 *   IncompatibleClassChangeError: Found interface io.ktor.client.engine.HttpClientEngine,
 *   but class was expected
 * （R8 生成的 synthetic access bridge 被破坏）。本工具只改目标方法的 code_item，