dabao1955 526d487f1a Fill the reading-layer gaps the IPC reference exposed ...

The first milksu integration only took the system-boundary material and dismissed the
workflow content as overlapping deeper files. That dismissal was asserted, not audited;
auditing it found five places where the repository owns the procedure but not the
reference material the procedure leans on:

- dex-patching.md: a reading-level smali cheat sheet (type descriptors, register
  conventions and the .registers coupling, the five instruction families that carry
  control flow, obfuscation signatures). The file taught how to edit a method you can
  already read; nothing taught the reading.
- recon.md: the sensitive-behavior grep table (shell-outs, JS bridges, mutable
  PendingIntents, WebView width, dynamic dex loading, intent redirection) -- the
  signature-check section had one pattern, the behaviour sweep had none.
- detection-and-anti-analysis.md: the named Java-level root checks and their one-line
  neutralizations, as the concrete form of Step 2A's "simple, localised check" --
  scoped to the named detector, never a blind stack.
- tls-and-cert.md: the two OkHttp-path client sites (CertificatePinner.check,
  SSLContext.init) that the OkHttp section previously pointed at without naming, each
  annotated with what it honestly buys.
- native-and-so.md: the JNIEnv vtable call shape for reading JNI calls in a stripped
  library, with the offset-calibration caveat.

All absorbed material is marked unverified with the retrieval date (milksu.org,
2026-10-19) at the point of use; syntax and layout facts that follow from documented
platform behaviour are marked inferred. Gates re-run: routing coherent, 409 section
references with zero dangling, repo clean, pytest 751 passed / 194 skipped / 25 xfailed.

2026-10-19 20:29:03 +08:00

..

apk-reverse

Fill the reading-layer gaps the IPC reference exposed

2026-10-19 20:29:03 +08:00