mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 20:14:26 +08:00
inliver233
ca38fa393d
Absorbs four public reverse-engineering write-ups into the skill, and completes
the xvmp IR-virtualizer work started in the hardware pass. 20 files, +1151/-151.
What it adds:
* references/native-vm-recovery.md -- the recovery procedure for a native VM:
VM-existence signals, separating stacked CFF/VM dispatchers, register
anchoring with triple verification, nested-VM segment stacks, STORE-backward
operand slicing with byte provenance, and the clean-re-VM validation loop.
Absorbed, so every step is labelled inferred in the file itself.
* pitfalls P43-P46, including the Go stack-ABI one (a watchpoint hit whose
argument is not in x0-x7 because the frame holds it) and the observer whose
crash silently disarms every observer installed after it.
* vm_handler_slice.py: a nested-dispatch diagnostic (a block repeating 4+ times
inside one segment is a second dispatcher running under the first), plus the
fix for a latent bug this pass's own review found -- diagnostics() had been
measuring len() of the (run, closed) tuples since the open-tail change, which
is always 2, quietly disabling the spin-loop note on the real code path.
* evidence for a completed workbench toolchain and a measured end-to-end run,
recorded in EXTENSION-sampling-crash.md SS5-SS6 and EXTENSION-absorption-kx.md.
Verified on the merged tree, not on the PR branch alone:
* check_repo.py, check_refs.py, check_commands.py, check_routing.py and
check_budget.py pass with zero problems; flake8 and mypy are clean;
* pytest: 772 passed, 172 skipped, 25 xfailed;
* the code change was reproduced independently of the PR's own tests:
nested_loop_segments() flags the repeat-inside-one-segment shape in both the
(run, closed) and the legacy bare-run form, and diagnostics() now reports
avg_segment_len over the run -- 5.0 on a fixture whose tuples are length 2,
where the pre-fix code reported 2.0.
One defect fixed during the merge: the PR's own record says the local copies of
the absorbed write-ups under `.ref/` are "git-ignored in effect", but .gitignore
had no such rule -- it rested on nobody having run `git add -A` yet. The rule is
now explicit, with the reason stated beside it, the same way this file handles
tools/ and the user's own input material.
62 lines
1.4 KiB
Plaintext
62 lines
1.4 KiB
Plaintext
# build artifacts
|
|
*.class
|
|
*.jar
|
|
!skills/apk-reverse/scripts/dexpatch/*.java
|
|
|
|
# working data -- never commit samples or outputs
|
|
*.apk
|
|
*.aab
|
|
*.dex
|
|
*.odex
|
|
*.vdex
|
|
*.oat
|
|
*.so
|
|
*.jks
|
|
*.keystore
|
|
*.pk8
|
|
*.pem
|
|
*.p12
|
|
|
|
# local scratch
|
|
_tmp/
|
|
out/
|
|
work/
|
|
audit_out/
|
|
|
|
# local extension-pass workspace: toolchains, device archives, dumped images, scratch notes.
|
|
# Nothing under tools/ belongs to the repository -- the skill's own evidence record lives in
|
|
# docs/tool-verification/ and carries no target identity or vendored binaries.
|
|
tools/
|
|
|
|
# local input material (the reporting sample and the analysis notes it came with)
|
|
存在问题和例子/
|
|
|
|
# Local copies of the third-party write-ups an absorption pass reads. They are someone else's
|
|
# text, not content of this repository: what ships is the absorbed method under an `inferred`
|
|
# label, plus the anonymized source line in docs/tool-verification/EXTENSION-absorption-*.md.
|
|
# One `git add -A` is all it would take to commit them, so the rule is explicit here rather than
|
|
# resting on "nobody has added them yet".
|
|
.ref/
|
|
|
|
# sandbox installs made while testing `npx skills add .` against this repo
|
|
.claude/
|
|
.agents/
|
|
*.log
|
|
*.jsonl
|
|
*.pcap
|
|
*.png
|
|
*.jpg
|
|
|
|
# python / editors
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
.vscode/
|
|
.idea/
|
|
.DS_Store
|
|
|
|
# local input material -- the same rule as 存在问题和例子/: the reports these passes are based on
|
|
# are the user's material, not content of this repository
|
|
新的建议和思路/
|
|
朋友全面审查和建议/
|