inliver233
a552157f1b
Worked end-to-end on a real unobfuscated commercial app (single-dex, no packer,
server-driven launch screen) and folded back everything that cost time. Net +17
files, no new dependencies, no sample-specific identifiers.
New references
byte-level-patching.md
The technique that was missing entirely. Equal-length in-place edits beat
method rebuilding (measured on a real sample: method rewrite grew debug_info
924 B -> 22.8 KB and the dex 4.32 MB -> 7.73 MB), but four failure modes are
silent: same-length is not enough, branch polarity, verifier legality, and
stale dex header fields. Covers locating an instruction's exact offset (why
listings and byte-pattern guesses both fail), the instruction width table and
the two traps that desynchronise a decode, neutralise-a-branch vs redirect-it,
and the header's signature-then-checksum order.
server-config-and-updates.md
The most common shape of "ad" in a modern app, and the one usually
mis-diagnosed: the server supplies UI the client renders. The two-layer fetch
(local fallback then remote override) that proves it, finding the config DTOs
through the field names data classes keep, why you patch the decision and not
the data, deciding the scope of "remove", and remote re-enable / cached config
durability.
New scripts
dexutil.py dependency-free dex reader: structural walk, exact
instruction decode, dex header recompute/verify in the
correct order, branch-target and operand helpers
dex_find_insn.py locate an instruction by decoded semantics, print its exact
byte offset with context and BOTH sides of any branch
dex_patch_bytes.py equal-length byte patches from a JSON spec: semantic match,
polarity pin via expect_next, equal-length enforcement,
verifier check, header recompute, re-decode to prove it landed
dex_check_verifier.py does any conditional branch target a move-result (bypassing
its producer)? Compares builds and separates pre-existing
findings from regressions the patch introduced
coldstart.py cold-launch capture: timed screenshot burst + logcat signals
+ installed-build facts + launch timing, and a warning when
the foreground activity is not the app
check_repo.py maintenance check: every script parses and answers --help,
every referenced path resolves, every file is documented
Fixes found while running the above
repack.py wrote archives with a plain zipfile writer, which cannot satisfy
the Android R+ install gate: resources.arsc must be STORED *and*
4-byte aligned, and a zip extra record cannot express a 1-3 byte
pad (a stored filler entry is inserted instead). Also fixes the
central-directory pointer and adds an alignment gate to the output.
usb_net_proxy.py, dex_strpatch.py
crashed on --help with a traceback instead of printing usage.
Updated
toolchain.md ddc added (single-binary dex->Java with query subcommands,
with measured timings and its real limits); "not on PATH is
not not-installed" with the search commands; which signer
to use and why jarsigner breaks alignment
repack-and-sign.md alignment requirement and its arithmetic; dex header
recompute; jarsigner hazard; vendor install interception
([N] with no symbolic constant -> root pm install); the
installer can keep owning the screen after an install
recon.md resolve package identity from a tool, not from hand-read
AXML strings (a wrong package sends all later device queries
nowhere); snapshot the config surface during recon
long-task-discipline.md captures you never looked at are not evidence (incl. the
consistent-but-wrong-window variant); long-context decay and
the record shape that survives it
dynamic-frida.md when live attach cannot work at all: static instrumentation,
static read, and self-recorded evidence, with the control
build caveat each one carries
ad-removal.md server-driven config is usually the EASIEST case, not the
hardest; a three-way zero result is a positive finding;
scope note on local brand splash vs promotional content
pitfalls.md P37 stale dex header checksum, P38 [-124] alignment,
P39 bare-numeric install failure, P40 wrong-window evidence,
P41 inverted branch polarity, P42 decode desynchronisation
SKILL.md, README.md symptom index, reference/script indexes and requirements
updated for all of the above
81 lines
3.0 KiB
Python
81 lines
3.0 KiB
Python
"""Pre-commit checks: every script parses and answers --help; every referenced file exists."""
|
|
import ast
|
|
import os
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
|
|
ROOT = os.path.dirname(os.path.abspath(__file__))
|
|
os.chdir(ROOT)
|
|
|
|
fail = []
|
|
|
|
print("== python syntax + --help ==")
|
|
for name in sorted(os.listdir('scripts')):
|
|
if not name.endswith('.py'):
|
|
continue
|
|
path = os.path.join('scripts', name)
|
|
try:
|
|
ast.parse(open(path, encoding='utf-8').read())
|
|
except SyntaxError as e:
|
|
fail.append('%s: syntax error %s' % (path, e))
|
|
print(' FAIL %s' % path)
|
|
continue
|
|
r = subprocess.run([sys.executable, '-B', path, '--help'],
|
|
capture_output=True, text=True, timeout=60)
|
|
# A script may exit non-zero on --help if it uses the "print usage and exit 2"
|
|
# convention. That is acceptable; a traceback is not.
|
|
crashed = 'Traceback (most recent call last)' in (r.stderr or '')
|
|
helped = bool((r.stdout or '').strip()) or bool(r.stderr)
|
|
ok = (not crashed) and helped
|
|
verdict = 'ok' if r.returncode == 0 and not crashed else \
|
|
('usage-ok rc=%d' % r.returncode if ok else 'CRASH rc=%d' % r.returncode)
|
|
print(' %-32s %s' % ('%s --help' % name, verdict))
|
|
if not ok:
|
|
fail.append('%s --help crashed: %s' % (path, (r.stderr or '')[:300]))
|
|
|
|
print("\n== markdown references resolve ==")
|
|
refs = set(os.listdir('references'))
|
|
scripts = set(os.listdir('scripts'))
|
|
missing = []
|
|
for name in ['SKILL.md', 'README.md'] + ['references/' + f for f in refs if f.endswith('.md')]:
|
|
text = open(name, encoding='utf-8').read()
|
|
for m in re.finditer(r'`?(references/[A-Za-z0-9_\-]+\.md)', text):
|
|
target = m.group(1).split('/')[1]
|
|
if target not in refs:
|
|
missing.append('%s -> %s' % (name, m.group(1)))
|
|
for m in re.finditer(r'`?(scripts/[A-Za-z0-9_\-]+\.(?:py|js))', text):
|
|
target = m.group(1).split('/')[1]
|
|
if target not in scripts:
|
|
missing.append('%s -> %s' % (name, m.group(1)))
|
|
if missing:
|
|
for x in sorted(set(missing)):
|
|
print(' MISSING %s' % x)
|
|
fail.extend(missing)
|
|
else:
|
|
print(' all referenced reference/script paths exist')
|
|
|
|
print("\n== every reference file is reachable from SKILL.md or README.md ==")
|
|
bodies = open('SKILL.md', encoding='utf-8').read() + open('README.md', encoding='utf-8').read()
|
|
unlisted = [f for f in sorted(refs) if f.endswith('.md') and f not in bodies]
|
|
for f in unlisted:
|
|
print(' UNLISTED references/%s' % f)
|
|
if unlisted:
|
|
fail.append('unlisted references: %s' % unlisted)
|
|
|
|
print("\n== every script is mentioned somewhere in the docs ==")
|
|
all_docs = bodies
|
|
for f in refs:
|
|
if f.endswith('.md'):
|
|
all_docs += open('references/' + f, encoding='utf-8').read()
|
|
undoc = [s for s in sorted(scripts) if s.endswith(('.py', '.js')) and s not in all_docs]
|
|
for s in undoc:
|
|
print(' UNDOCUMENTED scripts/%s' % s)
|
|
if undoc:
|
|
fail.append('undocumented scripts: %s' % undoc)
|
|
|
|
print("\n== result: %d problem(s) ==" % len(fail))
|
|
for f in fail:
|
|
print(' - %s' % f)
|
|
sys.exit(1 if fail else 0)
|