mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 20:44:22 +08:00
inliver233
ce2e4f98e1
Closes the six coverage gaps named in an external review of this skill, and moves the deliverable-form decision out of the single assumption it rested on. New references (7): - lsposed-and-modules.md deliver a hook module when a repack is refused - advanced-unpacking.md extraction shells, FART-style recovery, the root-side dump - emulation-and-rpc.md call the routine instead of reading it - native-dbi-and-deobfuscation.md OLLVM, Stalker traces, two measured boundaries - protocol-reverse.md protobuf/gRPC/QUIC and native-side pinning - kernel-and-environment-hardening.md when userspace hooking cannot reach the check - on-device-tooling.md MT Manager, its APK MCP, working from the phone New scripts (8): dex_dump_validate.py (+ --trim for page-aligned captures), dex_mem_scan.py, lsposed_scaffold.py, frida_rpc_serve.py + rpc_template.js, stalker_trace.js + stalker_report.py, mt_mcp_probe.py SKILL.md: - G1 carries a four-form deliverable table (rebuilt APK / module / RPC service / report) with the evidence that says when to leave the repack column, plus a matching hand-off section on how "verified" moves with the form - Coverage gains a documented-routes tier carrying its own strength note; Not-covered loses the now-inaccurate "general unpacker" line and gains the limits that do apply - 13 new symptom rows, 7 reference rows, 8 script rows, a fifth tooling obligation - the pid-drift symptom is stated with its competing causes, not a single attribution toolchain.md gains measured ASC/ddc cards; README gains the structure, capability and scope entries for everything above; .gitignore stops tracking the local workspace. Evidence: docs/tool-verification/EXTENSION-*.md (7 files), same three labels as the rest of the record. Measured: the gradle-free module build chain (5.27 s end to end), a successful injection confirmed through the LSPosed file channel (9 rounds) after three logcat queries came back empty on a ROM with a broken logd, 17 dex images recovered by root-side /proc/<pid>/mem dumping, the trivial-body metric separating a shell skeleton from real bodies, ASC/ddc on a hardened APK, and Stalker's zero-event and crash boundaries. The pid-drift attribution was corrected twice against better measurements.
54 lines
3.6 KiB
Markdown
54 lines
3.6 KiB
Markdown
# Tool verification record
|
|
|
|
This directory is the **evidence record for the `apk-reverse` skill measured against real
|
|
targets**, kept separate from the skill itself so the Coverage statement in `SKILL.md` can be
|
|
checked against the runs behind it, and so a later reader can tell which claims were *observed*,
|
|
which were *inferred*, and which are still *unverified*.
|
|
|
|
It is **not** a set of target-specific notes kept for reuse, and it deliberately carries **no target
|
|
identity**. The measurements are about the **tools and the skill**; they stay valid whichever APK
|
|
produced them. Where a concrete figure was needed to make a point (a class count, a file size, a
|
|
build time) the figure is kept and the target is named generically.
|
|
|
|
Targets measured: Flutter AOT applications, multi-dex, mid-size native library sets, no packer.
|
|
|
|
The APKs themselves are **not** in this repository (`.gitignore` excludes `*.apk`).
|
|
|
|
## Strength labels
|
|
|
|
Every claim carries one of three labels, used the same way `references/verification.md` uses them:
|
|
|
|
- **observed** — reproduced here, with the exact command and its output.
|
|
- **inferred** — follows from observed facts, but the step itself was not executed.
|
|
- **unverified** — assumed or reported by a tool and not independently confirmed.
|
|
|
|
## Index
|
|
|
|
| File | Covers |
|
|
|---|---|
|
|
| `TOOL-VERDICTS.md` | One verdict per tested script and external toolchain, with the independent cross-check behind it |
|
|
| `FINDINGS.md` | Findings about the skill itself: defects, contradictions, boundary evidence |
|
|
| `REPO-DECISIONS.md` | What changed in the repo as a result, and what deliberately did not |
|
|
|
|
## Extension-pass record
|
|
|
|
The extension pass (the six coverage gaps named in the external review: module ecosystem, extraction
|
|
shells and VMP, emulation/RPC, native DBI, kernel-level environment, protocol layers) keeps its
|
|
evidence here, one file per topic, in the same three labels:
|
|
|
|
| File | Covers |
|
|
|---|---|
|
|
| `EXTENSION-device-run.md` | The on-device run against a hardened Flutter sample: the two control runs, the frida refusals, the **twice-corrected** pid-drift attribution, the failed-dump artefacts checked with `dex_dump_validate.py`, and a shared-device hazard measured with Stalker |
|
|
| `EXTENSION-unpacking.md` | Extraction-shell diagnosis by trivial-body ratio, `dex_dump_validate.py` against a fixture derived from the sample's own shell dex, and the tool's own defect found during the run |
|
|
| `EXTENSION-rootdump.md` | The root-side `/proc/<pid>/maps` + `mem` route that does not use frida: 17 real dex images recovered, the shell skeleton they are not, four device-shell traps, and the negative result on anonymous/ART-heap scanning |
|
|
| `EXTENSION-lsposed.md` | Module route: the gradle-free build chain with timings, three build traps, LSPosed config-DB anatomy, the module that could never have worked, and the root-hiding configuration the device actually has |
|
|
| `EXTENSION-emulation-rpc.md` | ASC/`ddc` measured on a hardened APK, Frida-RPC exercised end to end on a live device, and the unidbg build repair |
|
|
| `EXTENSION-native-dbi.md` | Stalker: the zero-event boundary, the crash from following a hot libc export, and an offline protobuf round-trip that caught a defect in its own decoder |
|
|
| `EXTENSION-kernel-ondevice.md` | The MT Manager APK MCP probe, the module-environment facts it could verify, and the kernel routes that this device's 4.14 kernel puts out of reach |
|
|
|
|
## Adding a run
|
|
|
|
Record the tools, versions and exact commands, and label each claim. Keep target-specific facts out:
|
|
what belongs here is what a future reader can apply to a *different* APK — a defect, a measured
|
|
cost, a method that did or did not work, and the cross-check that settled it.
|