mirror of
https://github.com/SimoneAvogadro/android-reverse-engineering-skill.git
synced 2026-10-18 21:53:03 +08:00
Simone Avogadro
73fc97535e
Distinct new capability: instead of only replacing method bodies with a return, the patcher can now INJECT working code. Used to defeat the IAB TCF consent dialog at the root: in Subway Surfers 28 classes across 13 SDKs read the IABTCF_* SharedPreferences to decide whether to track, so writing a reject-all state there makes every TCF-honoring SDK self-limit and removes the nag. Mechanism (documented as its own feature in references/consent-neutralization.md): - targets-file lines gain an optional 3rd field <class>:<method>:<inject-kind> (back-compatible: 2-field lines and wildcards unchanged; verified no regression on the other 47 entries). _schema.json adds category `consent` and an `inject` field (stub optional). registry-scan.py emits the 3rd field. neutralize.sh gains a guarded code-injection branch (SKIP_INJECT on signature mismatch), bash 3.2/BSD-safe, no new GNU-isms. - registry/consent-umptcf.json (google-ump-consent): writes reject-all IABTCF_* (consent AND legitimate-interest all-zero, gdprApplies=1 always, AddtlConsent="1~", plus a decode-verified reject-all TCString) to the default SharedPreferences on BOTH requestConsentInfoUpdate (the near- universal first UMP call) and loadAndShowConsentFormIfRequired, then fires the success/dismiss callbacks; canRequestAds=true and getConsentStatus= OBTAINED keep the app from re-showing the form. If neither hook is present it is a safe no-op. Complements, does not replace, SDK neutralization: non-TCF trackers (Firebase, Singular) ignore IABTCF and still need direct stubbing. Reviewed twice (build + adversarial), assembled and rebuilt on Subway; on-device behavior still to be confirmed. Docs updated to 48 SDKs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tae7iP5Zh8tax1Sn9p3A5