mirror of
https://github.com/newliver666/apk-reverse.git
synced 2026-09-28 21:56:59 +02:00
inliver233
2beade67f2
An external audit of this repository landed on four structural findings, and this pass is the
response to them. Everything below was re-measured on this tree before being acted on; two of the
audit's claims needed a correction of my own, and both corrections are noted in place.
**The gates were optimistic, and one of them did not read content at all.**
doctor.py the capability table was hard-coded (`repack + sign = bool(java) and python`), so a
machine with a JDK and no zipalign/apksigner was told it could re-sign; the script
inventory was a hand-written list of 28 against 51 files on disk, omitting the nine
most important scripts. It now scans the directory (`registered/checked = 52 / 52`,
unjudgeable entries counted as `unknown`, never skipped) and resolves capability as a
real requires-closure, reporting BLOCKED with the missing piece and an installable
next step. Measured: the old doctor reports `[OK] repack + sign` on a JDK-only PATH
where keytool, jarsigner, zipalign, apksigner and all eight smali jars are absent.
The report is allowed to look bad; that is the point.
check_commands.py (new)
anchor checks prove a section exists, never that a command runs. This parses each
script's argparse table with `ast` and checks every documented invocation against it.
146 commands / 41 interfaces, 0 drift. It caught `sig_probe.py --live --pkg`, which
does not exist -- the reference had been wrong since it was written.
check_routing.py (new)
the symptom index now has one home (`SKILL.md`, because symptom -> file must stay one
hop) and the inventory has another (`references/routing.md`). This gate proves the
mirror agrees, that every reference file is named, and that every script is named.
**so_constpatch.py was corrupting APKs it rebuilt.** The writer copied filename and timestamp onto a
fresh ZipInfo and recompressed the whole archive: 435-entry real package, `extra` lost on 205 entries,
`external_attr` rewritten on all 435, 132 untouched entries recompressed, and `resources.arsc` pushed
to an unaligned offset. Android's own `zipalign -c -v 4` fails the old output and passes the new one;
a 26-case fixture suite pins it, and `extractNativeLibs="false"` is now refused by default with a
pointer at `repack.py`. Fixing it exposed the same defect in `repack.py`, where `^lib/[^/]+\.so$`
cannot match `lib/arm64-v8a/*.so` -- so its alignment handling had never once fired on a real APK.
**The package was not self-contained.** 59 references pointed at the repository root, which `npx
skills add` does not install. They now converge on `references/evidence-summary.md` (capability,
conclusion, strength, evidence that ships) plus `evidence/` with the machine-readable companions: 8
references remain and each is explicitly labelled "repository root, not shipped". A drill in which
the new files were copied to an isolated directory and asked three questions answered all three.
**SKILL.md: 572 lines / 15,733 tokens -> 398 lines / ~10,900 tokens**, without losing the two things
that had to stay. The symptom index remains inline; the reference and script indexes moved to the
on-demand routing file. The freed budget went into making the rules *stronger*, not shorter: the
constraints section is now a table of thirteen non-negotiable constraints each paired with the check
that catches a violation, and the tooling obligations are instructions whose violation is a defect
(hedging language in SKILL.md: 1 line, down from a paragraph of hedged advice). Long references gained
a navigation head so a reader can decide from the top whether to load one.
**New: an executable test layer.** `tests/` (unit, CLI contract, no-device integration) plus
`pytest.ini`, `tests/run_tests.py`, a minimal CI job, and `evals/evals.json` written but never run --
stated as such in the file. 608 passed / 158 skipped / 25 xfailed. The 25 xfails are a work order, not
a pass: thirteen scripts report a missing input by exiting 1 instead of 2, seven let a traceback
escape, four treat `--help` as an error, and `preflight --json` lacks a `status` field. A regression
row for `dex_patch_bytes.py` reproduces a previous artifact byte-for-byte
(`67ae1e58e7a44777e5ac8f9f823ab21e…`) and additionally pins the four bytes that may move.
**Two real defects the new tests found in the tooling itself.** `check_repo.py` decoded subprocess
output with the locale encoding, so on a GBK console a script printing an em dash in its usage line
was reported as crashed; it now decodes UTF-8 explicitly. And a CLI contract test drove a *real
attached device* through `coldstart.py` -- logcat, screenshots, five orphan `adb logcat` processes --
which is fixed twice over: child processes run in a private temporary cwd, and the fifteen
device-bound scripts are never executed beyond `--help`/argument parsing.
**Quoting on the device side is now one implementation.** `devsh.su` escaped only double quotes, so
`;`, `$( )` and backticks in a caller-supplied value still reached the device shell while
`coldstart.Device.shell` quoted correctly. Both use `scripts/device_shell.py` now: POSIX single-quote
escaping, argv arrays by default, and identifier validation that refuses a malformed package, path or
component with exit 2 instead of a traceback. The integration test that used to pin the *defect* (it
asserted `su -c "…"` with `\"` escapes) now asserts the property, across five metacharacter payloads.
Gates: check_repo 0 problems (including the content-reading identity scan over git ls-files),
check_refs 0 dangling / 0 warning, check_routing coherent (53 symptom / 45 reference / 54 script rows),
check_budget 0 failure / 0 warning with the always-loaded body now measured in tokens rather than in
"narrative lines with the index excluded", check_commands 146 checked / 0 drift, pytest 608 passed.
Not done, and stated rather than implied: CI has never run on a runner; the evals have never been
executed; the 25 xfails are open; no device-side install/launch was performed in this pass.
253 lines
10 KiB
Python
253 lines
10 KiB
Python
"""No-device flows: launch-health verdicts, log parsing, tombstone parsing.
|
|
|
|
Everything here runs on a bare checkout. The device commands are intercepted, so
|
|
what is being tested is the *decision logic* -- which is exactly the part that a
|
|
device test would otherwise hide behind "it looked fine on screen".
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import sys
|
|
|
|
import pytest
|
|
|
|
from conftest import load_script, run_script
|
|
|
|
install_test = load_script("install_test.py")
|
|
coldstart = load_script("coldstart.py")
|
|
native_crash = load_script("native_crash.py")
|
|
|
|
pytestmark = pytest.mark.integration
|
|
|
|
TOMBSTONE = "tombstone_sample.txt"
|
|
LOGCAT = "logcat_sample.txt"
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# install_test.py: the two-sample pid verdict
|
|
# --------------------------------------------------------------------------- #
|
|
def drive(monkeypatch, pids, log="", capsys=None):
|
|
"""Run install_test.main() with the device replaced by a scripted responder.
|
|
|
|
`pids` is consumed in order by successive `pidof` calls, which is the whole
|
|
point of the check: one sample cannot tell a running app from a crash loop.
|
|
"""
|
|
pids = list(pids)
|
|
calls = []
|
|
|
|
def fake_adb(args, serial=None, timeout=600):
|
|
calls.append(list(args))
|
|
if list(args)[:1] == ["logcat"] and "-d" in args:
|
|
return log
|
|
return ""
|
|
|
|
def fake_sh(cmd, serial=None):
|
|
calls.append(cmd)
|
|
if cmd.startswith("pidof"):
|
|
return pids.pop(0) if pids else ""
|
|
if "mCurrentFocus" in cmd:
|
|
return "mCurrentFocus=Window{a1b2 u0 com.example.app/.MainActivity}"
|
|
return ""
|
|
|
|
monkeypatch.setattr(install_test, "adb", fake_adb)
|
|
monkeypatch.setattr(install_test, "sh", fake_sh)
|
|
monkeypatch.setattr(install_test.time, "sleep", lambda _s: None)
|
|
monkeypatch.setattr(sys, "argv", [
|
|
"install_test.py", "--apk", "out/app.apk", "--pkg", "com.example.app",
|
|
"--activity", ".MainActivity",
|
|
])
|
|
return install_test.main(), calls
|
|
|
|
|
|
class TestLaunchHealthVerdict:
|
|
def test_a_stable_pid_with_no_fatal_signature_is_ok(self, monkeypatch, capsys):
|
|
code, calls = drive(monkeypatch, ["1234", "1234"])
|
|
assert code == 0, capsys.readouterr().out
|
|
|
|
def test_a_changed_pid_is_a_failure_even_though_the_app_is_running(self, monkeypatch, capsys):
|
|
"""The measured shape of a crash loop: alive at the first sample, restarted by the second."""
|
|
code, _calls = drive(monkeypatch, ["1234", "5678"])
|
|
out = capsys.readouterr().out
|
|
assert code == 1
|
|
assert "pid @+6s : 1234" in out
|
|
assert "5678" in out
|
|
|
|
def test_a_dead_app_is_a_failure(self, monkeypatch, capsys):
|
|
code, _calls = drive(monkeypatch, ["", ""])
|
|
assert code == 1
|
|
assert "(dead)" in capsys.readouterr().out
|
|
|
|
def test_a_fatal_signature_fails_even_with_a_stable_pid(self, monkeypatch, capsys):
|
|
"""Stability is not health: a caught-but-fatal error still fails the check."""
|
|
code, _calls = drive(monkeypatch, ["1234", "1234"],
|
|
log="01-01 10:00:01 E AndroidRuntime: FATAL EXCEPTION: main\n")
|
|
assert code == 1
|
|
assert "FATAL EXCEPTION" in capsys.readouterr().out
|
|
|
|
def test_both_pid_samples_are_actually_taken(self, monkeypatch, capsys):
|
|
_code, calls = drive(monkeypatch, ["1234", "1234"])
|
|
capsys.readouterr()
|
|
pidof_calls = [c for c in calls if isinstance(c, str) and c.startswith("pidof")]
|
|
assert len(pidof_calls) == 2, "the second sample is what catches a crash loop"
|
|
|
|
def test_the_launch_uses_the_package_slash_activity_component(self, monkeypatch, capsys):
|
|
_code, calls = drive(monkeypatch, ["1234", "1234"])
|
|
capsys.readouterr()
|
|
assert any("am start -n com.example.app/.MainActivity" == c for c in calls
|
|
if isinstance(c, str))
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# coldstart.py: logcat signal counting
|
|
# --------------------------------------------------------------------------- #
|
|
class TestLogcatSignalCounting:
|
|
@pytest.fixture
|
|
def counts(self, fixtures_dir):
|
|
path = fixtures_dir / LOGCAT
|
|
assert path.exists(), "the logcat fixture is missing from tests/fixtures"
|
|
return coldstart.signal_counts(str(path), coldstart.SIGNAL_PATTERNS)
|
|
|
|
@pytest.mark.parametrize("name,expected", [
|
|
("FATAL EXCEPTION", 1),
|
|
("VerifyError", 1),
|
|
("Bad checksum", 1),
|
|
("ANR", 1),
|
|
("Displayed", 1),
|
|
("IncompatibleClassChangeError", 0),
|
|
("ClassNotFoundException", 0),
|
|
("uncaughtException", 0),
|
|
("am_crash", 0),
|
|
])
|
|
def test_counts(self, counts, name, expected):
|
|
assert counts[name] == expected
|
|
|
|
def test_every_pattern_in_the_table_is_reported(self, counts):
|
|
assert set(counts) == set(coldstart.SIGNAL_PATTERNS)
|
|
|
|
def test_a_missing_log_yields_no_counts_rather_than_raising(self, tmp_path):
|
|
assert coldstart.signal_counts(str(tmp_path / "nope.txt"),
|
|
coldstart.SIGNAL_PATTERNS) == {}
|
|
|
|
def test_the_displayed_pattern_captures_the_milliseconds(self):
|
|
import re
|
|
match = re.search(coldstart.SIGNAL_PATTERNS["Displayed"],
|
|
"I ActivityManager: Displayed com.example.app/.MainActivity: +842ms")
|
|
assert match is not None
|
|
assert match.group(1) == "842"
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# native_crash.py: tombstone parsing
|
|
# --------------------------------------------------------------------------- #
|
|
@pytest.fixture
|
|
def crash(fixtures_dir):
|
|
text = (fixtures_dir / TOMBSTONE).read_text(encoding="utf-8")
|
|
crashes = native_crash.parse(text)
|
|
assert len(crashes) == 1, "the fixture holds exactly one crash block"
|
|
return crashes[0]
|
|
|
|
|
|
class TestTombstoneParsing:
|
|
def test_signal_and_code(self, crash):
|
|
assert crash["signal"] == 11
|
|
assert crash["signame"] == "SIGSEGV"
|
|
assert crash["si_code"] == "SEGV_MAPERR"
|
|
assert crash["fault"] == "0x0000000000000010"
|
|
|
|
def test_process_identity_is_picked_up(self, crash):
|
|
assert crash["pid"] == "12345"
|
|
assert crash["tid"] == "12345"
|
|
assert crash["proc"] == "com.example.app"
|
|
|
|
def test_uptime_and_cause(self, crash):
|
|
assert crash["uptime"] == "5"
|
|
assert "null pointer" in crash["cause"]
|
|
|
|
def test_backtrace_frames_are_complete(self, crash):
|
|
assert len(crash["frames"]) == 4
|
|
assert crash["frames"][0]["path"].endswith("libfoo.so")
|
|
assert crash["frames"][0]["symbol"] == ""
|
|
assert crash["frames"][1]["symbol"] == "Java_com_example_app_Native_check+120"
|
|
assert crash["frames"][2]["path"].startswith("/apex/")
|
|
assert crash["frames"][2]["symbol"] == "__pthread_start+256"
|
|
|
|
def test_registers_are_collected_from_the_dump_line(self, crash):
|
|
assert crash["regs"]["x0"] == 0x10
|
|
assert crash["regs"]["x1"] == 0x7A12345678
|
|
assert crash["regs"]["sp"] == 0x7FFABC1110
|
|
assert crash["regs"]["lr"] == 0x7A11112222
|
|
|
|
def test_the_pc_key_is_overwritten_by_the_last_backtrace_frame(self, crash):
|
|
"""Measured behaviour, recorded rather than smoothed over.
|
|
|
|
Register extraction scans every line of the block with one permissive
|
|
pattern, so a `#NN pc <hex>` backtrace line also matches and the last one
|
|
wins. The register dump's own `pc 0000007a111128cc` is therefore not what
|
|
`regs['pc']` holds. It is a reporting wart, not a wrong verdict -- but it
|
|
is a wart, so it is pinned here and listed in the harness report.
|
|
"""
|
|
assert crash["regs"]["pc"] == 0x55488, "the last frame's pc"
|
|
assert crash["regs"]["pc"] != 0x7A111128CC, "the register dump's pc"
|
|
|
|
def test_empty_input_produces_no_crashes(self):
|
|
assert native_crash.parse("") == []
|
|
|
|
def test_a_log_without_a_signal_line_produces_no_crashes(self):
|
|
assert native_crash.parse("I/whatever: nothing to see\n") == []
|
|
|
|
|
|
class TestLibraryClassification:
|
|
@pytest.mark.parametrize("path,expected", [
|
|
("/apex/com.android.runtime/lib64/bionic/libc.so", True),
|
|
("/system/lib64/libart.so", True),
|
|
("/vendor/lib64/libqcom.so", True),
|
|
("/data/dalvik-cache/arm64/system@framework@boot.oat", True),
|
|
("/data/app/~~AbCdEf==/com.example.app-1/lib/arm64/libfoo.so", False),
|
|
("/data/local/tmp/libpayload.so", False),
|
|
])
|
|
def test_classification(self, path, expected):
|
|
assert native_crash.is_system_lib(path) is expected
|
|
|
|
def test_a_bare_name_is_treated_as_system(self):
|
|
"""Measured behaviour: a path that is not absolute cannot be attributed to the app."""
|
|
assert native_crash.is_system_lib("libfoo.so") is True
|
|
|
|
|
|
class TestVerdictHint:
|
|
def test_a_small_fault_address_held_in_a_register_is_flagged_as_arranged(self, crash):
|
|
hints = " ".join(native_crash.verdict_hint(crash))
|
|
assert "small integer" in hints
|
|
assert "ARRANGED" in hints
|
|
assert "x0" in hints
|
|
|
|
def test_an_ordinary_null_dereference_gets_no_arranged_hint(self):
|
|
ordinary = {"fault": "0x0", "regs": {"x1": 0x7A111128CC}, "signame": "SIGSEGV"}
|
|
hints = native_crash.verdict_hint(ordinary)
|
|
assert any("small integer" in h for h in hints)
|
|
assert not any("ARRANGED" in h for h in hints)
|
|
|
|
def test_sigkill_is_called_out_as_a_deliberate_termination(self):
|
|
hints = native_crash.verdict_hint({"fault": "0x0", "regs": {}, "signame": "SIGKILL"})
|
|
assert any("deliberate termination" in h for h in hints)
|
|
|
|
|
|
class TestNativeCrashCli:
|
|
def test_the_fixture_tombstone_is_parsed_by_the_cli(self, fixtures_dir):
|
|
result = run_script("native_crash.py", [str(fixtures_dir / TOMBSTONE)], timeout=120)
|
|
assert not result.timed_out
|
|
assert not result.has_traceback, result.output
|
|
assert result.returncode == 0, result.output
|
|
assert "libfoo.so" in result.stdout
|
|
assert "SIGSEGV" in result.stdout
|
|
|
|
def test_a_missing_log_is_reported_without_a_traceback(self, tmp_path):
|
|
result = run_script("native_crash.py", [str(tmp_path / "absent.txt")])
|
|
assert not result.has_traceback, result.output
|
|
assert result.returncode != 0
|
|
assert "no such file" in result.output
|
|
|
|
def test_a_malformed_lib_spec_is_refused(self, fixtures_dir):
|
|
result = run_script("native_crash.py",
|
|
[str(fixtures_dir / TOMBSTONE), "--lib", "notapair"])
|
|
assert result.returncode != 0
|
|
assert "NAME=PATH" in result.output
|