mirror of
https://github.com/newliver666/apk-reverse.git
synced 2026-09-28 21:56:59 +02:00
inliver233
ce2e4f98e1
Closes the six coverage gaps named in an external review of this skill, and moves the deliverable-form decision out of the single assumption it rested on. New references (7): - lsposed-and-modules.md deliver a hook module when a repack is refused - advanced-unpacking.md extraction shells, FART-style recovery, the root-side dump - emulation-and-rpc.md call the routine instead of reading it - native-dbi-and-deobfuscation.md OLLVM, Stalker traces, two measured boundaries - protocol-reverse.md protobuf/gRPC/QUIC and native-side pinning - kernel-and-environment-hardening.md when userspace hooking cannot reach the check - on-device-tooling.md MT Manager, its APK MCP, working from the phone New scripts (8): dex_dump_validate.py (+ --trim for page-aligned captures), dex_mem_scan.py, lsposed_scaffold.py, frida_rpc_serve.py + rpc_template.js, stalker_trace.js + stalker_report.py, mt_mcp_probe.py SKILL.md: - G1 carries a four-form deliverable table (rebuilt APK / module / RPC service / report) with the evidence that says when to leave the repack column, plus a matching hand-off section on how "verified" moves with the form - Coverage gains a documented-routes tier carrying its own strength note; Not-covered loses the now-inaccurate "general unpacker" line and gains the limits that do apply - 13 new symptom rows, 7 reference rows, 8 script rows, a fifth tooling obligation - the pid-drift symptom is stated with its competing causes, not a single attribution toolchain.md gains measured ASC/ddc cards; README gains the structure, capability and scope entries for everything above; .gitignore stops tracking the local workspace. Evidence: docs/tool-verification/EXTENSION-*.md (7 files), same three labels as the rest of the record. Measured: the gradle-free module build chain (5.27 s end to end), a successful injection confirmed through the LSPosed file channel (9 rounds) after three logcat queries came back empty on a ROM with a broken logd, 17 dex images recovered by root-side /proc/<pid>/mem dumping, the trivial-body metric separating a shell skeleton from real bodies, ASC/ddc on a hardened APK, and Stalker's zero-event and crash boundaries. The pid-drift attribution was corrected twice against better measurements.
50 lines
828 B
Plaintext
50 lines
828 B
Plaintext
# build artifacts
|
|
*.class
|
|
*.jar
|
|
!skills/apk-reverse/scripts/dexpatch/*.java
|
|
|
|
# working data -- never commit samples or outputs
|
|
*.apk
|
|
*.aab
|
|
*.dex
|
|
*.odex
|
|
*.vdex
|
|
*.oat
|
|
*.so
|
|
*.jks
|
|
*.keystore
|
|
*.pk8
|
|
*.pem
|
|
*.p12
|
|
|
|
# local scratch
|
|
_tmp/
|
|
out/
|
|
work/
|
|
audit_out/
|
|
|
|
# local extension-pass workspace: toolchains, device archives, dumped images, scratch notes.
|
|
# Nothing under tools/ belongs to the repository -- the skill's own evidence record lives in
|
|
# docs/tool-verification/ and carries no target identity or vendored binaries.
|
|
tools/
|
|
|
|
# local input material (the reporting sample and the analysis notes it came with)
|
|
存在问题和例子/
|
|
|
|
# sandbox installs made while testing `npx skills add .` against this repo
|
|
.claude/
|
|
.agents/
|
|
*.log
|
|
*.jsonl
|
|
*.pcap
|
|
*.png
|
|
*.jpg
|
|
|
|
# python / editors
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
.vscode/
|
|
.idea/
|
|
.DS_Store
|