2 Commits

Include renames

Author	SHA1	Message	Date
inliver233	a552157f1b	Close the byte-patching gap, add the server-config path, fix two script crashes ... Worked end-to-end on a real unobfuscated commercial app (single-dex, no packer, server-driven launch screen) and folded back everything that cost time. Net +17 files, no new dependencies, no sample-specific identifiers. New references byte-level-patching.md The technique that was missing entirely. Equal-length in-place edits beat method rebuilding (measured on a real sample: method rewrite grew debug_info 924 B -> 22.8 KB and the dex 4.32 MB -> 7.73 MB), but four failure modes are silent: same-length is not enough, branch polarity, verifier legality, and stale dex header fields. Covers locating an instruction's exact offset (why listings and byte-pattern guesses both fail), the instruction width table and the two traps that desynchronise a decode, neutralise-a-branch vs redirect-it, and the header's signature-then-checksum order. server-config-and-updates.md The most common shape of "ad" in a modern app, and the one usually mis-diagnosed: the server supplies UI the client renders. The two-layer fetch (local fallback then remote override) that proves it, finding the config DTOs through the field names data classes keep, why you patch the decision and not the data, deciding the scope of "remove", and remote re-enable / cached config durability. New scripts dexutil.py dependency-free dex reader: structural walk, exact instruction decode, dex header recompute/verify in the correct order, branch-target and operand helpers dex_find_insn.py locate an instruction by decoded semantics, print its exact byte offset with context and BOTH sides of any branch dex_patch_bytes.py equal-length byte patches from a JSON spec: semantic match, polarity pin via expect_next, equal-length enforcement, verifier check, header recompute, re-decode to prove it landed dex_check_verifier.py does any conditional branch target a move-result (bypassing its producer)? Compares builds and separates pre-existing findings from regressions the patch introduced coldstart.py cold-launch capture: timed screenshot burst + logcat signals + installed-build facts + launch timing, and a warning when the foreground activity is not the app check_repo.py maintenance check: every script parses and answers --help, every referenced path resolves, every file is documented Fixes found while running the above repack.py wrote archives with a plain zipfile writer, which cannot satisfy the Android R+ install gate: resources.arsc must be STORED *and* 4-byte aligned, and a zip extra record cannot express a 1-3 byte pad (a stored filler entry is inserted instead). Also fixes the central-directory pointer and adds an alignment gate to the output. usb_net_proxy.py, dex_strpatch.py crashed on --help with a traceback instead of printing usage. Updated toolchain.md ddc added (single-binary dex->Java with query subcommands, with measured timings and its real limits); "not on PATH is not not-installed" with the search commands; which signer to use and why jarsigner breaks alignment repack-and-sign.md alignment requirement and its arithmetic; dex header recompute; jarsigner hazard; vendor install interception ([N] with no symbolic constant -> root pm install); the installer can keep owning the screen after an install recon.md resolve package identity from a tool, not from hand-read AXML strings (a wrong package sends all later device queries nowhere); snapshot the config surface during recon long-task-discipline.md captures you never looked at are not evidence (incl. the consistent-but-wrong-window variant); long-context decay and the record shape that survives it dynamic-frida.md when live attach cannot work at all: static instrumentation, static read, and self-recorded evidence, with the control build caveat each one carries ad-removal.md server-driven config is usually the EASIEST case, not the hardest; a three-way zero result is a positive finding; scope note on local brand splash vs promotional content pitfalls.md P37 stale dex header checksum, P38 [-124] alignment, P39 bare-numeric install failure, P40 wrong-window evidence, P41 inverted branch polarity, P42 decode desynchronisation SKILL.md, README.md symptom index, reference/script indexes and requirements updated for all of the above	2026-09-20 02:05:41 +08:00
inliver233	ae739bb0c1	Add native tamper/suicide guidance, toolchain map, and three scripts ... references/native-tamper-and-suicide.md - how a hardened library terminates its own process: the mechanisms and their signatures, how to tell which one actually fires, arranged faults that call nothing (defeating every PLT-level fix), resolving a stub to its symbol, forged section headers, function boundaries from PT_GNU_EH_FRAME, scanner traps, and neutralising by returning rather than spinning. references/toolchain.md - what to install, non-interactive invocation, GUI-only tools (ask for a human instead of silently substituting a weaker method), version-alignment traps, and working offline. scripts/elf_plt.py - PLT stub to imported symbol on x86_64 and aarch64 from the relocation table; caller listing; library byte-diff naming each changed stub's symbol. scripts/apk_diff.py - entry-level diff by content hash, so same-size replacements are caught. scripts/native_crash.py - locate a native death from a log or tombstone and flag an arranged fault. pitfalls P31-P36; SKILL.md gains a decision question, a hard constraint on neutralising terminate paths, and cross-references from packers/native-and-so.	2026-09-19 22:47:35 +08:00