mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 20:34:29 +08:00
inliver233
6221a072ca
Public targets under the existing routes, recorded per row in tests/benchmark.md with each row's own strength label: the MASTG crackmes (equal-length patch -> repack -> re-sign with a zero-change control, and the anti-debug race with its time-to-death baseline), DexPatcher's ezAndroid sample, two real split APK sets, and a self-built extraction-skeleton set. Hardening-shape discrimination now separates Java2C from an extraction shell, a VMP and JNI sinking. New: java2c_probe.py and java2c-and-jni-sinking.md; split-apk.md with repack.py growing set inventory, unified re-signing and merge; protobuf_decode_raw.py cross-checked against the official runtime; vmp_diff_harness.py and its cost table; kernelsu_syscall_mask.py with three kernel-side templates; stalker_trace.js gains Stalker.exclude() and a zero-event warning. Corrections, each because a measurement contradicted a recorded conclusion: the trivial-body ratio is bimodal rather than a threshold and the old threshold claim was deleted; a Dex-VMP verdict was withdrawn after dexdump contradicted a hand-written opcode table; the assumption that Stalker.exclude() fixes zero-event delivery is disproved (it keeps the process alive, nothing more); and a repack.py signing-path claim expired mid-pass when a second writer added one. Emulated and kernel-side routes are labelled unverified where no toolchain or device could run them; each evidence file states what was not run.
72 lines
6.0 KiB
Markdown
72 lines
6.0 KiB
Markdown
# Tool verification record
|
|
|
|
This directory is the **evidence record for the `apk-reverse` skill measured against real
|
|
targets**, kept separate from the skill itself so the Coverage statement in `SKILL.md` can be
|
|
checked against the runs behind it, and so a later reader can tell which claims were *observed*,
|
|
which were *inferred*, and which are still *unverified*.
|
|
|
|
It is **not** a set of target-specific notes kept for reuse, and it deliberately carries **no target
|
|
identity**. The measurements are about the **tools and the skill**; they stay valid whichever APK
|
|
produced them. Where a concrete figure was needed to make a point (a class count, a file size, a
|
|
build time) the figure is kept and the target is named generically.
|
|
|
|
Targets measured: Flutter AOT applications, multi-dex, mid-size native library sets, no packer.
|
|
|
|
The APKs themselves are **not** in this repository (`.gitignore` excludes `*.apk`).
|
|
|
|
## Strength labels
|
|
|
|
Every claim carries one of three labels, used the same way `references/verification.md` uses them:
|
|
|
|
- **observed** — reproduced here, with the exact command and its output.
|
|
- **inferred** — follows from observed facts, but the step itself was not executed.
|
|
- **unverified** — assumed or reported by a tool and not independently confirmed.
|
|
|
|
## Index
|
|
|
|
| File | Covers |
|
|
|---|---|
|
|
| `TOOL-VERDICTS.md` | One verdict per tested script and external toolchain, with the independent cross-check behind it |
|
|
| `FINDINGS.md` | Findings about the skill itself: defects, contradictions, boundary evidence |
|
|
| `REPO-DECISIONS.md` | What changed in the repo as a result, and what deliberately did not |
|
|
|
|
## Extension-pass record
|
|
|
|
The extension pass (the six coverage gaps named in the external review: module ecosystem, extraction
|
|
shells and VMP, emulation/RPC, native DBI, kernel-level environment, protocol layers) keeps its
|
|
evidence here, one file per topic, in the same three labels:
|
|
|
|
| File | Covers |
|
|
|---|---|
|
|
| `EXTENSION-device-run.md` | The on-device run against a hardened Flutter sample: the two control runs, the frida refusals, the **twice-corrected** pid-drift attribution, the failed-dump artefacts checked with `dex_dump_validate.py`, and a shared-device hazard measured with Stalker |
|
|
| `EXTENSION-unpacking.md` | Extraction-shell diagnosis by trivial-body ratio, `dex_dump_validate.py` against a fixture derived from the sample's own shell dex, and the tool's own defect found during the run |
|
|
| `EXTENSION-rootdump.md` | The root-side `/proc/<pid>/maps` + `mem` route that does not use frida: 17 real dex images recovered, the shell skeleton they are not, four device-shell traps, and the negative result on anonymous/ART-heap scanning |
|
|
| `EXTENSION-lsposed.md` | Module route: the gradle-free build chain with timings, three build traps, LSPosed config-DB anatomy, the module that could never have worked, and the root-hiding configuration the device actually has |
|
|
| `EXTENSION-emulation-rpc.md` | ASC/`ddc` measured on a hardened APK, Frida-RPC exercised end to end on a live device, and the unidbg build repair |
|
|
| `EXTENSION-native-dbi.md` | Stalker: the zero-event boundary, the crash from following a hot libc export, and an offline protobuf round-trip that caught a defect in its own decoder |
|
|
| `EXTENSION-kernel-ondevice.md` | The MT Manager APK MCP probe, the module-environment facts it could verify, and the kernel routes that this device's 4.14 kernel puts out of reach |
|
|
|
|
## Benchmark-pass record
|
|
|
|
The benchmark pass put **public targets** under the documented routes — `tests/benchmark.md` is the
|
|
matrix, and these files are the evidence behind its rows. Same three labels. Several of these rows
|
|
came back negative, and four of them overturned a conclusion this repository had already recorded;
|
|
those are called out in the matrix rather than buried here.
|
|
|
|
| File | Covers |
|
|
|---|---|
|
|
| `EXTENSION-benchmark-l1-l3.md` | The first two matrix rows: the L1 equal-length patch -> repack -> re-sign chain with its on-screen behaviour change and its zero-change control, and the L3 time-to-death baseline, the two spawn/patch/detach orderings that cannot work, and the terminate path that patching the obvious death site does not stop |
|
|
| `EXTENSION-extraction-shell-bench.md` | `dex_dump_validate.py` against an 11-variant skeleton set: the trivial-body ratio as a bimodal result rather than a threshold, the three script defects the variants exposed, and the ranking that pointed at a modified image until independent review caught it |
|
|
| `EXTENSION-stalker-exclude.md` | Stalker exclusion measured across three arms: the no-follow baseline, the follow that kills the process, and the follow with 20 modules excluded that survives but still delivers zero events |
|
|
| `EXTENSION-java2c.md` | Java2C against JNI sinking: native-declaration density roughly 2000x apart, why a `Java_*` symbol search fails silently, and the Dex-to-C build chain no toolchain on this host could complete |
|
|
| `EXTENSION-vmp-diff.md` | The known-plaintext differential: a 218-of-224-opcode coverage fixture, a closed-loop check that recovered 218/218 mappings with zero fabrications, and the one link that cannot be automated |
|
|
| `EXTENSION-kernel-weapons.md` | The generated KernelSU/APatch scaffold and its three kernel-side templates, all shipped unbuilt, plus the structural correction that a userspace module cannot change a syscall return value |
|
|
| `EXTENSION-split-apk.md` | Two real split sets through both branches: unified re-signing, the merge that is refused by design, the merge that succeeds, and the signer chain this host actually needs |
|
|
| `EXTENSION-protobuf-raw.md` | A schema-free decoder cross-checked against the official runtime and a real DataStore container, with the packed-boundary and proto3-zero ambiguities reproduced on real bytes |
|
|
|
|
## Adding a run
|
|
|
|
Record the tools, versions and exact commands, and label each claim. Keep target-specific facts out:
|
|
what belongs here is what a future reader can apply to a *different* APK — a defect, a measured
|
|
cost, a method that did or did not work, and the cross-check that settled it.
|