apk-reverse

18 Commits 1 Branch 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
inliver233	e10fb2d308	Add observation-window hygiene and non-Java update gates references/long-task-discipline.md New section: "Keep the observation window clean". Every conclusion rests on "the build I am looking at is the build I made", and that assumption fails silently: something else installs/reverts/clears the target mid-capture, the process was never actually restarted, or the installed artifact is not the one on disk. Guards, cheapest first: pin identity by hash (not filename, and immediately before the window, not hours earlier); declare a capture window and run no install/uninstall/clear inside it; timestamp it; prefer one continuous capture over several short ones. When a window turns out to be contaminated, discard and re-capture rather than salvage - a re-run costs minutes, a wrong conclusion costs the rest of the task and gets re-derived from the same bad evidence. references/updates-and-forced-upgrade.md New Step 6: "when the check is not where you expect", covering three shapes that break the flip-the-comparison plan. - The check is native: a declared update entry point with zero Java callers means the invocation lives in a .so. Ordered remedies, starting with the one that needs no native work at all - attack the response, or feed the check a version it likes. "No Java caller" is not "unpatchable". - The dialog hands off to a browser or WebView: there is no installer call to find, and logcat truncates the URL to `dat=https://host/...`, so a grep gives you a host and no path. Approach table for recovering the real URL, with hooking intent construction as the reliable one. - Server-issued gate with a local fallback: read the failure branch first. If failure defaults to "no update", failing the request is the whole fix and also gives you an offline verification signal; if it defaults to "must update", it makes things worse.	2026-09-20 00:53:25 +08:00
inliver233	0ea42265b7	Add deliverable-form discipline, execution identity, and four reusable scripts Generalized from a long hardened-target engagement. Additions target the failure modes that cost the most time and are not yet covered; nothing here is sample-specific. New discipline - SKILL.md: a third override rule -- deliver in the environment the request requires. A root-only or live-instrumentation result can look like success while failing the actual requirement (unrooted, installable, self-contained). Also adds two classify questions: what form the deliverable must take, and which architecture/library is actually executing. - long-task-discipline.md: "the most expensive drift" -- a constraint table (privilege, modification form, ABI, network, persistence, distribution), the checkpoint question, and how to report a privileged workaround as a fallback rather than a deliverable. Plus "bound every wait": timeouts on every command, budgets calibrated from measurement so slow and hung are distinguishable, and sampling an observable you can inspect instead of sleeping blind. - environment.md: look at the screen instead of driving blind; which of the two screen evidence kinds is trustworthy (an empty accessibility tree is common for runtime-rendered UI, where the image is primary rather than a fallback); emulator console control and adb recovery; preflight before every experiment block. - native-and-so.md: what the device claims vs what the package manager chose vs what is actually mapped; translation layers and their consequences for hooks and native checks; fat-APK ABI selection. - runtime-data.md: when the app rewrites your edit (server refresh vs local regeneration), why chmod/chown cannot work because the app deletes and recreates the file, and the immutable-attribute fix; decoding a value that only looks encrypted. - framework-runtimes.md: string encoding traps (a UTF-8 scan of a UTF-16 snapshot returns nothing and reads as "the strings were stripped"), and non-ASCII obfuscated identifiers -- resolve by shape, not by name. - pitfalls.md: P23 the fix lives in a file the app rewrites; P24 the artifact changed but the wrong one is executing; P25 "search found nothing" treated as "not there". New scripts (parameterized, path-agnostic, all with explicit timeouts) - preflight.py environment check: device, root, ABI/translation, clock skew, leftover proxy/forwards, dead device server, chosen ABI, free space - lib_map.py what is actually mapped into a live process: path, base, architecture from the ELF header, and whether it came from the APK or was materialized at runtime - blob_decode.py search (don't guess) the framing of a stored value, then re-encode the edited payload with the same parameters - snap.py bounded burst screenshots + control-tree capture, with a stall detector and an explicit verdict on whether the tree is usable All four were exercised against a live device while writing: preflight correctly flags multi-device ambiguity and detected the ARM translation layer; lib_map read real ELF headers and identified the translation shim; blob_decode round-tripped a rotation+deflate+base64 blob at realistic size in ~0.2s; snap detected a stalled screen across three hashes.	2026-09-19 22:08:01 +08:00
skill-maintainer	55432780fc	Expand into packer/native/framework/long-task coverage; harden verification discipline New references (loaded on demand, one topic each): - packers.md: reading the shell's rejection signal, distinguishing self-inflicted failures from genuine refusals, mapping the validation boundary via single-variable tests, component-type rules (providers vs activities), picking a native host - framework-runtimes.md: identifying Flutter/RN/Unity/Cordova, the wrong-layer trap, how to tell which layer draws a given UI before committing to a patch direction - native-and-so.md: host-library selection criteria, DT_NEEDED does-not-call-JNI_OnLoad, relocation vs page-permission constraints and relocation-free bootstrapping, replacing Java methods from native code with trampolines and fail-safe guards - long-task-discipline.md: live record structure, conclusion grading, drift checkpoints, handover contents, and the opposite failure of over-documenting Pitfalls: +P18 install reported success but the build was never installed, +P19 internal signal substituted for the user-visible outcome, +P20 not-captured treated as not-present, +P21 two changes then attributing the result, +P22 waiting on something that needs a human to advance. SKILL.md: index the new references; add a runtime check for layer ownership to Q3; add long-task rule; strengthen the verify step; add three hard constraints (user-visible definition of done, no route discarded on compound evidence, prove the device changed before measuring). No app names, package names, or sample-specific identifiers anywhere.	2026-09-19 21:51:51 +08:00

Author

SHA1

Message

Date

inliver233

e10fb2d308

Add observation-window hygiene and non-Java update gates

references/long-task-discipline.md
  New section: "Keep the observation window clean". Every conclusion rests on "the
  build I am looking at is the build I made", and that assumption fails silently:
  something else installs/reverts/clears the target mid-capture, the process was never
  actually restarted, or the installed artifact is not the one on disk. Guards, cheapest
  first: pin identity by hash (not filename, and immediately before the window, not
  hours earlier); declare a capture window and run no install/uninstall/clear inside it;
  timestamp it; prefer one continuous capture over several short ones. When a window
  turns out to be contaminated, discard and re-capture rather than salvage - a re-run
  costs minutes, a wrong conclusion costs the rest of the task and gets re-derived from
  the same bad evidence.

references/updates-and-forced-upgrade.md
  New Step 6: "when the check is not where you expect", covering three shapes that break
  the flip-the-comparison plan.
  - The check is native: a declared update entry point with zero Java callers means the
    invocation lives in a .so. Ordered remedies, starting with the one that needs no
    native work at all - attack the response, or feed the check a version it likes. "No
    Java caller" is not "unpatchable".
  - The dialog hands off to a browser or WebView: there is no installer call to find,
    and logcat truncates the URL to `dat=https://host/...`, so a grep gives you a host
    and no path. Approach table for recovering the real URL, with hooking intent
    construction as the reliable one.
  - Server-issued gate with a local fallback: read the failure branch first. If failure
    defaults to "no update", failing the request is the whole fix and also gives you an
    offline verification signal; if it defaults to "must update", it makes things worse.

2026-09-20 00:53:25 +08:00

inliver233

0ea42265b7

Add deliverable-form discipline, execution identity, and four reusable scripts

Generalized from a long hardened-target engagement. Additions target the failure
modes that cost the most time and are not yet covered; nothing here is sample-specific.

New discipline
- SKILL.md: a third override rule -- deliver in the environment the request requires.
  A root-only or live-instrumentation result can look like success while failing the
  actual requirement (unrooted, installable, self-contained). Also adds two classify
  questions: what form the deliverable must take, and which architecture/library is
  actually executing.
- long-task-discipline.md: "the most expensive drift" -- a constraint table (privilege,
  modification form, ABI, network, persistence, distribution), the checkpoint question,
  and how to report a privileged workaround as a fallback rather than a deliverable.
  Plus "bound every wait": timeouts on every command, budgets calibrated from
  measurement so slow and hung are distinguishable, and sampling an observable you can
  inspect instead of sleeping blind.
- environment.md: look at the screen instead of driving blind; which of the two screen
  evidence kinds is trustworthy (an empty accessibility tree is common for
  runtime-rendered UI, where the image is primary rather than a fallback); emulator
  console control and adb recovery; preflight before every experiment block.
- native-and-so.md: what the device claims vs what the package manager chose vs what is
  actually mapped; translation layers and their consequences for hooks and native
  checks; fat-APK ABI selection.
- runtime-data.md: when the app rewrites your edit (server refresh vs local
  regeneration), why chmod/chown cannot work because the app deletes and recreates the
  file, and the immutable-attribute fix; decoding a value that only looks encrypted.
- framework-runtimes.md: string encoding traps (a UTF-8 scan of a UTF-16 snapshot
  returns nothing and reads as "the strings were stripped"), and non-ASCII obfuscated
  identifiers -- resolve by shape, not by name.
- pitfalls.md: P23 the fix lives in a file the app rewrites; P24 the artifact changed
  but the wrong one is executing; P25 "search found nothing" treated as "not there".

New scripts (parameterized, path-agnostic, all with explicit timeouts)
- preflight.py  environment check: device, root, ABI/translation, clock skew, leftover
                proxy/forwards, dead device server, chosen ABI, free space
- lib_map.py    what is actually mapped into a live process: path, base, architecture
                from the ELF header, and whether it came from the APK or was
                materialized at runtime
- blob_decode.py search (don't guess) the framing of a stored value, then re-encode the
                edited payload with the same parameters
- snap.py       bounded burst screenshots + control-tree capture, with a stall detector
                and an explicit verdict on whether the tree is usable

All four were exercised against a live device while writing: preflight correctly
flags multi-device ambiguity and detected the ARM translation layer; lib_map read real
ELF headers and identified the translation shim; blob_decode round-tripped a
rotation+deflate+base64 blob at realistic size in ~0.2s; snap detected a stalled screen
across three hashes.

2026-09-19 22:08:01 +08:00

skill-maintainer

55432780fc

Expand into packer/native/framework/long-task coverage; harden verification discipline

New references (loaded on demand, one topic each):
- packers.md: reading the shell's rejection signal, distinguishing self-inflicted
  failures from genuine refusals, mapping the validation boundary via single-variable
  tests, component-type rules (providers vs activities), picking a native host
- framework-runtimes.md: identifying Flutter/RN/Unity/Cordova, the wrong-layer trap,
  how to tell which layer draws a given UI before committing to a patch direction
- native-and-so.md: host-library selection criteria, DT_NEEDED does-not-call-JNI_OnLoad,
  relocation vs page-permission constraints and relocation-free bootstrapping,
  replacing Java methods from native code with trampolines and fail-safe guards
- long-task-discipline.md: live record structure, conclusion grading, drift checkpoints,
  handover contents, and the opposite failure of over-documenting

Pitfalls: +P18 install reported success but the build was never installed,
+P19 internal signal substituted for the user-visible outcome,
+P20 not-captured treated as not-present, +P21 two changes then attributing the result,
+P22 waiting on something that needs a human to advance.

SKILL.md: index the new references; add a runtime check for layer ownership to Q3;
add long-task rule; strengthen the verify step; add three hard constraints
(user-visible definition of done, no route discarded on compound evidence,
prove the device changed before measuring).

No app names, package names, or sample-specific identifiers anywhere.

2026-09-19 21:51:51 +08:00