- references/patch-audit.md (new): two independent questions for any self-made patch —
did it land, and is it legal. Length-vs-bytes comparison and the ~800-false-positive
signal that makes byte diffing useless; the equal-length-replacement blind spot that
hides patches from length-only audits (and why tier-2 checking must be driven by the
patch set's own declared targets, not by tier-1 output); verifier-level legality
(move-result must immediately follow its producer) checked as a set-difference so it
runs before the device; text-matching patch traps (whitespace, line endings,
instruction names, anchor uniqueness, re-emitted old fragments, one block per doc);
and auditing the patch set rather than a patch.
- pitfalls P28-P30: stale events-buffer records that read as this build's crash;
a patch that lands and changes nothing because the edited data is not the data the UI
consumes; two observations that cannot distinguish the hypotheses reported as a result.
- verification.md: point the known code-item blind spot at the new reference.
- Unify the four remaining script docstrings (and their inline comments) into English,
and generalise a sample-specific class name out of one of them.
references: recon gains packer identification + unpacking workflow (payload/plaintext size mapping, dump validation, hash de-duplication, business-dex heuristic); repack-and-sign gains the de-shelled repack pipeline, why apktool over binary AXML, and the apksigner scheme-selection caveat; new tls-and-cert documents feature-scoped network failures, dual trust chains and the fix template; new third-party-builds covers auditing a cracked/modded APK before trusting it; dynamic-frida gains version pinning, remote-device path, the four-layer probe and hook-never-fires triage; environment gains UI automation pitfalls; ad-removal gains the single convergence point, dynamic-plugin SDKs and the global timestamp gate; pitfalls gains P13-P17; verification gains rung 7 and the three-signal ad check.
scripts: new frida_probe.js (four-layer runtime probe), run_probe.py and tls_check.py; repack.py fixes two crash-on-default bugs and a misleading META-INF note; datastore_inject.py, PatchMethodExample.java and build_scripts.py lose hardcoded values - the example class name did not match its file and could not compile.
inliver233