mirror of
https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git
synced 2026-10-29 12:42:21 +08:00
Simone AvogadroandClaude Sonnet 5.5
b3fe549259
The per-vendor packer/RASP rules were selected from APKiD's rule set (GPL-3.0 or commercial); they are removed together with the [A:<rule>] source map and the vendor names. What stays: PairIP (seen in protected apps), the Play Licensing library and the Play Integrity / SafetyNet clients (public Google package names). New generic check (check_packed_code / Test-PackedCode, sh + ps1): components declared in AndroidManifest.xml (Application, activities, services, receivers, providers) that have no class in the decoded smali. >= 3 declared and >= 3 missing; >= 50% missing = medium, >= 80% = high; activity-alias and android.* are ignored. The protector is not named. Coverage trade-off: protections that hide nothing (e.g. a native anti-tamper SDK) are no longer reported, and the 'none' message now says so. Validated on the 21 decoded trees of the corpus: output identical to before (af1945 signature-vm, bulldozer license, the rest none, no false positive; a clean app misses 0-5 of 78-179 declared classes) and on a synthetic packed tree; sh == ps1 through Windows PowerShell 5.1. New tests/unit/t_protection.sh (26 checks); tests/run.sh quick passes. Docs updated (CLAUDE.md, SKILL.md, neutralize.md, neutralization-guide.md). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKSiYpKT5YKAMowGEgUwAw