mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 21:04:20 +08:00
dabao1955
60224a26b9
The reference set owned the app's own wire (protocol-reverse.md) and the in-process runtime (dynamic-frida.md), but not the platform boundary between them: what the app asks system_server to do over Binder, which Intent/JS-bridge inputs an unmodified build exposes, why an avc: denied is blocking instrumentation, and what a Keystore attestation check means for a rooted-device workflow. That gap is where several long detours start -- a hook that could never fire because SELinux says the domain cannot reach the target, or a "detection" that is actually a server-verified attestation no client patch can satisfy. Everything here is absorbed from an external notes source (milksu.org, Android internals notes, retrieved 2026-10-19) and is labelled accordingly: the commands and hook scripts are unverified in the coverage-and-limits.md sense -- reported by someone else, never run by this repository -- while the platform mechanisms they rest on (AIDL codegen arithmetic, kernel-filled caller identity, FLAG_IMMUTABLE since Android 12) are inferred from documented AOSP behaviour, with a note that each fails loudly if wrong. The strength note at the top of the file states this before any content, and each script carries its own unverified marker, so a reader cannot mistake a starting point for a measured procedure. Routing gains one row next to server-api.md. Gates re-run: check_routing.py coherent (53 rows / 51 files), check_refs.py 0 dangling over 408 section references, check_repo.py clean, pytest 751 passed / 194 skipped / 25 xfailed.