Initial Commit

docs/protection.md

@@ -0,0 +1,81 @@
+# Android protection removal
+
+One pipeline removes AnoSDK (overseas) or Mobile ACE/TSS (CN); the
+variants differ only in the constants in `protection/profile.rs`, and
+`--variant auto` picks one from the libraries present. It restores four
+protected ARM64 libraries, neutralizes the SDK startup and native API
+calls, drops the protection libraries, and signs a new APK.
+
+## Variant profiles
+
+| Field | AnoSDK | Mobile ACE/TSS |
+| --- | --- | --- |
+| Regions | SEA, GLB, JP, KR, TW | CN |
+| Decoder library | `libanort.so` | `libtprt.so` |
+| Guard library | `libanogs.so` | `libtersafe2.so` |
+| Key record XOR | `0xDF` | `0x49` |
+| Decoder symbol | `g_acf_array` | `g_tprt_pfn_array` |
+| `Application` class | `com.ano.gshell.AnoApplication` | `com.ace.gshell.AceApplication` |
+| SDK class | `com.gamesafe.ano.AnoSdk` | `com.tencent.tp.TssSdk` |
+| Native APIs | 6 `AnoSDK*` | 5 `tp2_*` |
+
+## Identification (`protection/mod.rs`)
+
+Checks `ChannelConfig` (`ChannelName`/`BundleIdentifier`) against the
+variant's regions, confirms both protection libraries are ARM64 ELFs, and
+rejects APKs that also contain the other variant's libraries. ARM64 is
+the only supported ABI.
+
+## Restore (`protection/loader.rs`)
+
+- `permutation` follows the decoder symbol through its routine and GOT
+  reference to the eight-page permutation (a digit string permuting
+  `0..8`).
+- Each 48-byte protected-section descriptor is matched to an ELF section
+  by name, RVA, file offset and size. The Base64 key record at descriptor
+  table `+0x1A4` is XORed with the variant byte: magic `0x20240829`, key
+  id 1 drives restoration, and the mode at `+0x184` (1 or 2) selects page
+  treatment. Each restored section must match its recorded CRC-32.
+  - Large sections: AES-128-CBC over `0x4000` bytes in `0x800`-byte
+    chunks from `0x2000 - (RVA & 0xFFF)` (key: the value's repeated
+    lowercase hex; IV `0x02..0x11`, reset per chunk). Mode 1 XORs and
+    shuffles `0x4000` fragments across eight `0x10000` strides; mode 2
+    XORs the remainder.
+  - Small sections: whole-section XOR.
+- `BBMG311DIS12IMP` gives the protected import count (`+16`), `.rela.plt`
+  RVA (`+24`), entry count (`+28`) and excluded GOT slots (`+32/+36`);
+  selected import `r_info` values are rotated back into order.
+  `BBMG311ENC12IAI` gives the constructor array RVA (`+16`) and count
+  (`+20`). The wrapper `DT_INIT`, the decoder library's `DT_NEEDED` entry
+  and the APS2/RELA wrapper relocations are cleared, and the
+  `fread`/`fwrite`/`fclose` GOT imports are restored. The removed
+  `DT_INIT` RVA is passed to the API helper.
+
+## Neutralize (`protection/native.rs`)
+
+In restored `libil2cpp.so`, finds the SDK API names and the guard library
+name in `.rodata`, traces ADRP/ADD references to them, and redirects each
+resolver `BL` to a 16-byte helper written over the removed `DT_INIT`
+initializer. The helper returns a pointer to a function that returns
+zero; other P/Invoke resolutions are untouched. Aborts if the initializer
+is still active, an API is missing, or the call graph is ambiguous.
+
+## DEX edits (`protection/dex.rs`)
+
+Three methods are edited after each call is validated:
+
+| Method | Edit |
+| --- | --- |
+| `Application.<clinit>` | NOP both native library loads (20 bytes) |
+| `Application.attachBaseContext` | Replace the invoke + move-result after the superclass call with return/NOPs (8 bytes) |
+| SDK class `<clinit>` | NOP the guard library load (`const-string` 10 bytes, or `const-string/jumbo` 12 bytes); keep the return |
+
+All 8 `attachBaseContext` bytes are rewritten because leftover operand
+words after the `return` would still fail DEX verification. Checksums are
+recomputed.
+
+## Output
+
+The decoder and guard libraries are dropped; the restored libraries and
+edited DEX files are repacked and signed by `android::sign`. Any
+mismatched marker, CRC, method or resolver layout aborts the patch.