mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 21:04:20 +08:00
dabao1955
ce227a13c5
Three re-audits under new lenses -- the WebView/JS-bridge as an active probe for hidden APIs and core logic (not just a config risk surface), environment blind spots, and jvm-art internals -- each instructed to verify claims against the cnb.cool AOSP mirror. The subagents' network was denied, so the mirror checks were run in the main session: WebView/WebView.java and WebSettings.java javadocs, platform.xml, art/runtime/hidden_api.cc, ActivityThread.java, and libcore's DexPathList.java were all fetched and cited. The probing lens rewrote system-ipc-audit.md section 3 around what the audit found: the bridge-inventory hook over-reported (it printed every declared method; since API 17 only @JavascriptInterface-annotated public methods are exposed -- javadoc-verified, with the targetSdk<17 legacy caveat), the risk table gained a defaults column so absence stops being read as off (setAllowFileAccess defaults true through targetSdk 29; the FileURLs pair has been false-and-deprecated since API 16), and the DevTools entry was split into its two channels (chrome://inspect self-discovers; the forward is for /json, socket found via /proc/net/unix) with the process-wide and debuggable-auto-enable gates stated. New: the five-step probing playbook -- global diff, dictionary probe (enumeration of the injected object returns empty on modern WebView), arity/type oracle with the parallel logcat watch (a Java exception stack can name the handler class without any hook), return-oracle calibration, and the origin-gate read -- each routed back to the Java class for an ordinary hook. jvm-art: the hidden-API boundary sentence in dynamic-frida.md was directionally right and mechanically wrong; it now states the real policy (targetSdk>=28 gating; greylist warn-only; blocklist and greylist-max-X deny -- verified against hidden_api.cc), the caller-domain mechanism that explains why Frida's bridge passes where app reflection fails, and the debuggable/policy exemptions. The classloader walk (pathList -> dexElements -> Element.dexFile, field names verified against current main) joins the frida-dexdump route as the hand-rolled fallback that also says which loader owns a dex. Environment: wireless debugging/pairing (Android 11+, pairing vs connect ports, plaintext-TCP caveat), the -d downgrade gate (INSTALL_FAILED_VERSION_DOWNGRADE is a build-type fact), --user N multi-user handling, and run-as as the cheapest non-root inspection route. One auditor correction was REJECTED by verification: current-main platform.xml assigns the shell uid only INTERNET, so the proposed "shell holds INSTALL_PACKAGES/INJECT_EVENTS" rewrite was itself wrong; the existing measured claim stays, now with the platform fact recorded beside it. Gates re-run: routing coherent, 412 section references zero dangling, repo clean, pytest 751 passed / 194 skipped / 25 xfailed.