4 Commits

Author	SHA1	Message	Date
inliver233	1dc1d9b707	Fix the command gate's blind spot, and make --json actually be JSON ... A reviewer reported seven drifting commands in the evidence record. Reproduced, the report split three ways, and the middle category was the useful one: the gate had been scoring them clean. Not reproducible, with the measurement: tests/run_tests.py -q runs. The wrapper forwards its arguments to pytest (`args = list(argv[1:]) or ["-q"]`), and documents that in its own usage. dcc.py already written as `cd tools/_work/bench/repos/dcc` followed by `python dcc.py ...` -- an external checkout, not a shipped script. Real, and fixed here: seven commands in two evidence records named a **workbench** script with no path at all (`analyze_pair.py`, `make_skeleton.py`, `ttd_attach.py`, `b2_measure.py`). The files exist under `tools/`, which .gitignore excludes, so a reader copying one from the repository root gets "No such file" -- and two of those documents wrote the correct path elsewhere, so they disagreed with themselves. **The actual defect was in `check_commands.py`, not in the seven lines.** `resolve_script()` tried the document's own directory first, so a bare `analyze_pair.py` inside `docs/tool-verification/` resolved to `tools/_work/bench/unpack/b3/analyze_pair.py` -- a real file -- and passed. Resolution now follows the order a reader would try (repository root, then the skill's scripts, then the document's own directory, which is what `../x.py` in a nested README legitimately means); a bare name that only resolves under `tools/` is `unqualified-workbench`; and that class counts as **drift, not as a skip**, because it is a one-token fix that a reader cannot run. The first attempt classified it as a low-confidence warning, which would have left all seven in place. One exception is honoured and pinned: a code block opening with `cd tools/_work/bench/repos/dcc` is telling the reader where to stand, so a bare `python dcc.py` after it is correct. `documented_commands()` now reports whether a `cd` preceded the command in the same block, and that case is skipped as `workbench-after-cd`. Two defects of this pass's own, found while fixing it: --json emitted the RESULT= token after the JSON document, so `--json | jq` failed with "Extra data". The token is gone from that path; the status is a field in the document, and the exit code carries the same meaning. The fix's own substitution left four literal backslashes before `$` in the two files it edited -- a character a reader would copy by mistake. Removed, and verified absent. `tests/integration/test_check_commands_gate.py` pins the resolution order, the drift classification, the `cd` exception, and a clean pass over the committed tree, so this cannot come back silently. Gates: check_commands 153 checked / 0 drift, check_repo 0 problem, check_refs 0 dangling / 0 warning, check_routing coherent, check_budget 0 failure / 0 warning, pytest 613 passed / 158 skipped / 25 xfailed.	2026-09-22 02:18:40 +08:00
inliver233	2beade67f2	Reconstruction pass: make the gates tell the truth, make the package self-contained, keep the one-hop symptom index ... An external audit of this repository landed on four structural findings, and this pass is the response to them. Everything below was re-measured on this tree before being acted on; two of the audit's claims needed a correction of my own, and both corrections are noted in place. **The gates were optimistic, and one of them did not read content at all.** doctor.py the capability table was hard-coded (`repack + sign = bool(java) and python`), so a machine with a JDK and no zipalign/apksigner was told it could re-sign; the script inventory was a hand-written list of 28 against 51 files on disk, omitting the nine most important scripts. It now scans the directory (`registered/checked = 52 / 52`, unjudgeable entries counted as `unknown`, never skipped) and resolves capability as a real requires-closure, reporting BLOCKED with the missing piece and an installable next step. Measured: the old doctor reports `[OK] repack + sign` on a JDK-only PATH where keytool, jarsigner, zipalign, apksigner and all eight smali jars are absent. The report is allowed to look bad; that is the point. check_commands.py (new) anchor checks prove a section exists, never that a command runs. This parses each script's argparse table with `ast` and checks every documented invocation against it. 146 commands / 41 interfaces, 0 drift. It caught `sig_probe.py --live --pkg`, which does not exist -- the reference had been wrong since it was written. check_routing.py (new) the symptom index now has one home (`SKILL.md`, because symptom -> file must stay one hop) and the inventory has another (`references/routing.md`). This gate proves the mirror agrees, that every reference file is named, and that every script is named. **so_constpatch.py was corrupting APKs it rebuilt.** The writer copied filename and timestamp onto a fresh ZipInfo and recompressed the whole archive: 435-entry real package, `extra` lost on 205 entries, `external_attr` rewritten on all 435, 132 untouched entries recompressed, and `resources.arsc` pushed to an unaligned offset. Android's own `zipalign -c -v 4` fails the old output and passes the new one; a 26-case fixture suite pins it, and `extractNativeLibs="false"` is now refused by default with a pointer at `repack.py`. Fixing it exposed the same defect in `repack.py`, where `^lib/[^/]+\.so$` cannot match `lib/arm64-v8a/*.so` -- so its alignment handling had never once fired on a real APK. **The package was not self-contained.** 59 references pointed at the repository root, which `npx skills add` does not install. They now converge on `references/evidence-summary.md` (capability, conclusion, strength, evidence that ships) plus `evidence/` with the machine-readable companions: 8 references remain and each is explicitly labelled "repository root, not shipped". A drill in which the new files were copied to an isolated directory and asked three questions answered all three. **SKILL.md: 572 lines / 15,733 tokens -> 398 lines / ~10,900 tokens**, without losing the two things that had to stay. The symptom index remains inline; the reference and script indexes moved to the on-demand routing file. The freed budget went into making the rules *stronger*, not shorter: the constraints section is now a table of thirteen non-negotiable constraints each paired with the check that catches a violation, and the tooling obligations are instructions whose violation is a defect (hedging language in SKILL.md: 1 line, down from a paragraph of hedged advice). Long references gained a navigation head so a reader can decide from the top whether to load one. **New: an executable test layer.** `tests/` (unit, CLI contract, no-device integration) plus `pytest.ini`, `tests/run_tests.py`, a minimal CI job, and `evals/evals.json` written but never run -- stated as such in the file. 608 passed / 158 skipped / 25 xfailed. The 25 xfails are a work order, not a pass: thirteen scripts report a missing input by exiting 1 instead of 2, seven let a traceback escape, four treat `--help` as an error, and `preflight --json` lacks a `status` field. A regression row for `dex_patch_bytes.py` reproduces a previous artifact byte-for-byte (`67ae1e58e7a44777e5ac8f9f823ab21e…`) and additionally pins the four bytes that may move. **Two real defects the new tests found in the tooling itself.** `check_repo.py` decoded subprocess output with the locale encoding, so on a GBK console a script printing an em dash in its usage line was reported as crashed; it now decodes UTF-8 explicitly. And a CLI contract test drove a *real attached device* through `coldstart.py` -- logcat, screenshots, five orphan `adb logcat` processes -- which is fixed twice over: child processes run in a private temporary cwd, and the fifteen device-bound scripts are never executed beyond `--help`/argument parsing. **Quoting on the device side is now one implementation.** `devsh.su` escaped only double quotes, so `;`, `$( )` and backticks in a caller-supplied value still reached the device shell while `coldstart.Device.shell` quoted correctly. Both use `scripts/device_shell.py` now: POSIX single-quote escaping, argv arrays by default, and identifier validation that refuses a malformed package, path or component with exit 2 instead of a traceback. The integration test that used to pin the *defect* (it asserted `su -c "…"` with `\"` escapes) now asserts the property, across five metacharacter payloads. Gates: check_repo 0 problems (including the content-reading identity scan over git ls-files), check_refs 0 dangling / 0 warning, check_routing coherent (53 symptom / 45 reference / 54 script rows), check_budget 0 failure / 0 warning with the always-loaded body now measured in tokens rather than in "narrative lines with the index excluded", check_commands 146 checked / 0 drift, pytest 608 passed. Not done, and stated rather than implied: CI has never run on a runner; the evals have never been executed; the 25 xfails are open; no device-side install/launch was performed in this pass.	2026-09-22 01:37:51 +08:00
inliver233	6cffc3d2ac	Absorption pass: take the mechanics from four external skill repositories, keep our discipline ... Four projects were cloned for comparison (reverse-skill, awesome-game-security, android-reverse-engineering-claude-skill, MobileRE-Skill) and read for what they do that this repository does not. None is vendored and none becomes a runtime dependency: what crosses over is a phase order, a checklist or a command pattern, with the source URL and the retrieval date recorded in the file that absorbed it. The rule applied to every candidate: does this make a judgement easier or a verification harder? The repository is a decision-and-verification layer, and the four things kept are all of that kind. new scripts/scan_leaks.py target identity scanned before publishing, with an explicit do-not-anonymize list and four RESULT=/exit states new references/precedents/ the positive half of the record: route including dead ends, a grade per assertion, measured pits, and a write-back checklist new scripts/svc_scan.py does a libc-level hook structurally see this call at all new scripts/anti_detect_probe.js observer-only: name the check, and report the environment it reads new references/desensitization-and-leak-scans.md new references/dart-aot.md sections the 32-bit snapshot's real string-record format check_repo.py now delegates the identity scan to scripts/scan_leaks.py and runs it over git ls-files, so the gate reads content instead of layout for the first time. An explicit file list cannot be narrowed by the default work-area exemptions -- that defect was caught by the gate itself. Two claims that this repository had already written down turned out to be wrong, and both are recorded as refuted rather than quietly rewritten: dart-aot.md the armv7 string table was documented as [len*2 u32le][UTF-16LE]. It is not. The same extractor keeps 4,980 chained entries on arm64 and zero on armv7, and the byte layer shows the 32-bit record is [header u32][byte-count u32le][UTF-8 payload]: two adjacent literals carry 0x46 (70) and 0x48 (72), exactly their byte lengths. The zero was a format mismatch, not an empty table. The engine-version banner on the same target is 66 bytes of "0.0.1" with a blank build id, so the documented regex returns a version-shaped lie. leak scan the pass that added the scanner found 26 strong hits inside its own evidence file on the day it was written -- the fixture's literal match values, quoted to prove the rules fire. The corpus may contain values; the published surface may not. Measured, not asserted. The check that fires was named on a public MASTG target: three arms with one variable, the control alive at the end and the probe arm dead in about 300 ms, with strstr("frida") at t=303 ms and no tombstone. Reproducibility is bounded honestly -- one full sequence in three arms, on a target whose whole window is sub-second. svc_scan.py's two independent decoders agree on an identical 214-site set, and ptrace-free dumping gained a negative boundary: a target whose dex is deflated inside its APK has no whole-image dex in memory to export, for reasons that say nothing about protection. Also in this pass: the detector-locating pipeline (detection-and-anti-analysis.md Step 3) with its branch conditions; the layered Java-to-svc descent and the dump's honesty boundary in advanced-unpacking.md; a sourced capability-gap list in toolchain.md where every row is graded URL-verified or measured; the RESULT=-token convention; and SKILL.md opening with an immediate-action block, because the symptom index and the gates were sitting in the part of a long file nobody reads. Gates: check_repo.py 0 problem, check_refs.py 0 dangling / 0 warning, check_budget.py 0 failure / 0 warning / 1 pre-existing note. The scan reports RESULT=leaks_found_strong_only, exit 0: four endpoint/weak hits, all of them addresses from the RFC 5737 documentation range in usage examples.	2026-09-21 22:51:09 +08:00
inliver233	6221a072ca	Benchmark pass: measure the documented routes, close five tool gaps, correct four claims ... Public targets under the existing routes, recorded per row in tests/benchmark.md with each row's own strength label: the MASTG crackmes (equal-length patch -> repack -> re-sign with a zero-change control, and the anti-debug race with its time-to-death baseline), DexPatcher's ezAndroid sample, two real split APK sets, and a self-built extraction-skeleton set. Hardening-shape discrimination now separates Java2C from an extraction shell, a VMP and JNI sinking. New: java2c_probe.py and java2c-and-jni-sinking.md; split-apk.md with repack.py growing set inventory, unified re-signing and merge; protobuf_decode_raw.py cross-checked against the official runtime; vmp_diff_harness.py and its cost table; kernelsu_syscall_mask.py with three kernel-side templates; stalker_trace.js gains Stalker.exclude() and a zero-event warning. Corrections, each because a measurement contradicted a recorded conclusion: the trivial-body ratio is bimodal rather than a threshold and the old threshold claim was deleted; a Dex-VMP verdict was withdrawn after dexdump contradicted a hand-written opcode table; the assumption that Stalker.exclude() fixes zero-event delivery is disproved (it keeps the process alive, nothing more); and a repack.py signing-path claim expired mid-pass when a second writer added one. Emulated and kernel-side routes are labelled unverified where no toolchain or device could run them; each evidence file states what was not run.	2026-09-21 21:57:23 +08:00