Eight citations in the reference documents pointed at tools/ paths, and .gitignore excludes tools/ -- so neither an installed skill nor a clone of this repository can open them. Each is now either an inline statement of the fact or a pointer to the evidence file under docs/tool-verification/ that actually holds it. One of the eight was introduced by the benchmark pass itself (protocol-reverse.md cited a workbench script).
The evidence records keep quoting tools/_work/... deliberately: there they are operation records of where a run happened. docs/tool-verification/README.md now states that distinction and the rule that follows from it -- a reference document never cites a tools/ path as its evidence, even when the work happened there.
Public targets under the existing routes, recorded per row in tests/benchmark.md with each row's own strength label: the MASTG crackmes (equal-length patch -> repack -> re-sign with a zero-change control, and the anti-debug race with its time-to-death baseline), DexPatcher's ezAndroid sample, two real split APK sets, and a self-built extraction-skeleton set. Hardening-shape discrimination now separates Java2C from an extraction shell, a VMP and JNI sinking.
New: java2c_probe.py and java2c-and-jni-sinking.md; split-apk.md with repack.py growing set inventory, unified re-signing and merge; protobuf_decode_raw.py cross-checked against the official runtime; vmp_diff_harness.py and its cost table; kernelsu_syscall_mask.py with three kernel-side templates; stalker_trace.js gains Stalker.exclude() and a zero-event warning.
Corrections, each because a measurement contradicted a recorded conclusion: the trivial-body ratio is bimodal rather than a threshold and the old threshold claim was deleted; a Dex-VMP verdict was withdrawn after dexdump contradicted a hand-written opcode table; the assumption that Stalker.exclude() fixes zero-event delivery is disproved (it keeps the process alive, nothing more); and a repack.py signing-path claim expired mid-pass when a second writer added one.
Emulated and kernel-side routes are labelled unverified where no toolchain or device could run them; each evidence file states what was not run.
The previous pass renamed the record directory but left two concrete identifiers in
the transcripts: a package name plus device serial in TOOL-VERDICTS.md, and a
logcat-truncated tag in FINDINGS.md. Both are now <PKG> / <DEVICE>, matching the
convention the extension-pass records already use. No claim, command or conclusion
changes -- only the identifiers.
Closes the six coverage gaps named in an external review of this skill, and moves the
deliverable-form decision out of the single assumption it rested on.
New references (7):
- lsposed-and-modules.md deliver a hook module when a repack is refused
- advanced-unpacking.md extraction shells, FART-style recovery, the root-side dump
- emulation-and-rpc.md call the routine instead of reading it
- native-dbi-and-deobfuscation.md OLLVM, Stalker traces, two measured boundaries
- protocol-reverse.md protobuf/gRPC/QUIC and native-side pinning
- kernel-and-environment-hardening.md when userspace hooking cannot reach the check
- on-device-tooling.md MT Manager, its APK MCP, working from the phone
New scripts (8): dex_dump_validate.py (+ --trim for page-aligned captures),
dex_mem_scan.py, lsposed_scaffold.py, frida_rpc_serve.py + rpc_template.js,
stalker_trace.js + stalker_report.py, mt_mcp_probe.py
SKILL.md:
- G1 carries a four-form deliverable table (rebuilt APK / module / RPC service / report)
with the evidence that says when to leave the repack column, plus a matching hand-off
section on how "verified" moves with the form
- Coverage gains a documented-routes tier carrying its own strength note; Not-covered
loses the now-inaccurate "general unpacker" line and gains the limits that do apply
- 13 new symptom rows, 7 reference rows, 8 script rows, a fifth tooling obligation
- the pid-drift symptom is stated with its competing causes, not a single attribution
toolchain.md gains measured ASC/ddc cards; README gains the structure, capability and
scope entries for everything above; .gitignore stops tracking the local workspace.
Evidence: docs/tool-verification/EXTENSION-*.md (7 files), same three labels as the rest
of the record. Measured: the gradle-free module build chain (5.27 s end to end), a
successful injection confirmed through the LSPosed file channel (9 rounds) after three
logcat queries came back empty on a ROM with a broken logd, 17 dex images recovered by
root-side /proc/<pid>/mem dumping, the trivial-body metric separating a shell skeleton
from real bodies, ASC/ddc on a hardened APK, and Stalker's zero-event and crash
boundaries. The pid-drift attribution was corrected twice against better measurements.
The docstring promised "a smali tree or a directory of dex files" and delivered neither: iter_files() yielded only .smali, a direct .dex was read as UTF-8 text and regex-matched against smali syntax, and a dex-only directory yielded nothing at all. A real dex, a dex directory and a typo path all printed [total refs] 0 and a note blaming the needle, so the one tool the skill recommends for judging blast radius before patching returned a confident false zero.
A .dex is now decoded through dexutil (no baksmali needed), a directory is walked for .smali and .dex alike, an archive is opened for its classes*.dex, input that cannot be read is refused with exit 2 and a reason, and every run prints [scanned] N file(s) so the two cases can never print identically again. Also corrects the recorded exit code for this defect: it was 1, not 0, which moves it from "no signal at all" to "the signal was there and the message contradicted it".
Verified against a fixture whose call graph is known by construction (docs/tool-verification/fixtures/make_fixture_dex.py, committed as the evidence): the .dex and the equivalent smali tree both return 3/2/2, matching what was written. And against the real target: Ljava/lang/String;->length gives 356 refs in 2.3 s where it previously gave 0; a five-dex directory gives 9,472; a typo path exits 2.
Docs updated with it: F9 records the opcode-table finding the fix exposed, F2/F3 and TOOL-VERDICTS.md are corrected, and dex-patching.md now tells the reader to look at the [scanned] line before the count.
Capability-first tooling guidance, plus removal of target identity from the repo.
Toolchain (references/toolchain.md):
- New ASC (droidasc) section + README Requirements row. An agent should reach for an
indexer before any full decompile. Covers install, query subcommands, the division
of labour with ddc (ASC locates, ddc reads), and its measured limits -- including the
unverified-negative trap when a non-ASCII needle goes through a shell, and the
mangled-class case where ASC is the only route.
- ddc: two measured limits -- a renamed class is unreachable via -c, and a decompiled
body can be semantically wrong rather than merely ugly.
- New "Closing a capability gap": installing the missing tool IS the task, with measured
install costs set against the cost of the workaround.
- New "Using the kit's scripts instead of writing your own", with two-tools-disagreeing
as the bug detector it is.
- Ghidra section for the aarch64 case: headless invocation, the flattening caveat, and
the "a decompiler cannot go where the data is not" boundary.
- HaE placed in Tier 3 as traffic triage, naming the three situations where it is the
wrong next step.
Observation ordering:
- SKILL.md: new Tooling section with four obligations; G2 now requires a written
capability inventory; symptom index gains four rows (silent feature loss with no
request at all, telling your patch apart from the target's own behaviour, spawn keeps
the Activity stack down, the device server being killed by the ROM).
- dynamic-frida.md: the patch-then-detach ordering, and device-server survival notes.
- New scripts/spawn_patch_detach.py and scripts/hook_patch_only.js.
Neutrality:
- docs/verification-jiongnew/ -> docs/tool-verification/. Target-specific transcripts
dropped; all target identity removed. The record keeps the measurements and loses
the specimen.
- No target identity remains anywhere in the tree.
check_repo.py: 0 problems. check_refs.py: 182 reachable, 0 dangling, 0 warnings.
The brief asked for the shared-tooling question to be settled by the install product
rather than by preference. Measured with --skill apk-reverse -y --copy in an empty
directory:
the skill is copied whole and self-contained into each detected agent directory
(six here), every file under <agent>/skills/apk-reverse/ -- SKILL.md, all 28
references, all 34 scripts including dexpatch/. Nothing outside the skill directory
is installed, and there is no cross-skill sharing mechanism.
So a root-level shared/ can never work: it is not part of the product. With one skill
there is nothing to share, and had the skill been split the halves would have needed
duplicated scripts or a path that does not survive installation.
VERIFY-OUTPUT.md gains a section recording which premises were re-checked against
primary sources and which did not hold: the blutter build budget and compiler floor,
aotopsy as the no-toolchain route, the idalib-mcp shift away from the GUI plugin, and
that "GNU readelf is on PATH" is false here (it is pyelftools' readelf.py, and MinGW
objdump/nm reject aarch64 outright). Also records one intermittent check_repo.py exit 1
that printed "0 problem(s)" and did not reproduce in five later runs, with the line
numbers of the encoding path that produces it.
Ran the scripts against a real Flutter AOT / multi-dex / 36-.so APK (Dart 3.6.0,
com.tingfeng.tool) and recorded what each one actually did. Two of them were wrong
in the direction that reads as a target finding, one Coverage claim overstated what
ships, and four documentation statements were false.
Fixed:
dart_pprefs.py decoded only the general-purpose register file, so `ldr dN,[x27,#imm]`
(0xFD400000) was never matched and every double constant read from the object pool
was dropped -- 302 pool offsets and 1802 sites on this sample, one of them with 150
references that would have been reported as zero. The documented advice is to count
references before editing a shared constant, so a one-sided quiet gap here produces
exactly the wrong decision. Now covers both register files; a purpose-written
arbiter agrees with it to 0/0 across .text, against 0/302 before.
Documented but deliberately not fixed, because a fix would not have been run:
elf_plt.py misses the last PLT stub slot (`off < fsz - 16`), which on libloader.so
turned a real, called import (dl_iterate_phdr) into "not a resolved stub".
find_refs.py advertises dex-directory input but iter_files() accepts only .smali,
so it answers "no references" with exit 0 for input it never read.
so_constpatch.py's rebuild drops the zip `extra` field and destroys 4 KB alignment.
Each has its root cause and fix sketch recorded.
Documentation corrections in dart-aot.md:
blutter's asm/ does contain full instruction listings with pool annotations -- the
file said to ignore it, and it is the richest artifact in the chain.
The first build costs ~78 s, not "tens of minutes"; MSVC 19.34 suffices, not VS 2022.
The file-PP offset mapping is not recoverable from the binary (4241 shared strings,
4237 distinct deltas), so a snapshot-decoding front end is a dependency, now stated.
Documented aotopsy as the no-toolchain route, and the trap that its version label is
a structural profile name (it says 3.6.2 for a 3.6.0 snapshot).
Coverage now separates what was measured from what is inferred, names blutter/aotopsy
as a prerequisite instead of implying the pool decodes itself, lists the scripts this
pass did not run, and says plainly that the packer / VMP / integrity-check scenarios
were not exercised at all.
Added hand-off points for JNI, dex-observed hardening, and the existing native boundary
documents, plus docs/verification-jiongnew/ -- the evidence record, including the four
gate outputs verbatim. No second skill: the gap is one front-end dependency, not a
subject area, and relocating Flutter docs would not have supplied it.
inliver233