Hi3-Patcher/docs/protection.md

Android protection removal

One pipeline removes AnoSDK (overseas) or Mobile ACE/TSS (CN); the variants differ only in the constants in protection/profile.rs, and --variant auto picks one from the libraries present. It restores four protected ARM64 libraries, neutralizes the SDK startup and native API calls, drops the protection libraries, and signs a new APK.

Variant profiles

Field	AnoSDK	Mobile ACE/TSS
Regions	SEA, GLB, JP, KR, TW	CN
Decoder library	libanort.so	libtprt.so
Guard library	libanogs.so	libtersafe2.so
Key record XOR	0xDF	0x49
Decoder symbol	g_acf_array	g_tprt_pfn_array
Application class	com.ano.gshell.AnoApplication	com.ace.gshell.AceApplication
SDK class	com.gamesafe.ano.AnoSdk	com.tencent.tp.TssSdk
Native APIs	6 AnoSDK*	5 tp2_*

Identification (protection/mod.rs)

Checks ChannelConfig (ChannelName/BundleIdentifier) against the variant's regions, confirms both protection libraries are ARM64 ELFs, and rejects APKs that also contain the other variant's libraries. ARM64 is the only supported ABI.

Restore (protection/loader.rs)

• permutation follows the decoder symbol through its routine and GOT reference to the eight-page permutation (a digit string permuting 0..8).
• Each 48-byte protected-section descriptor is matched to an ELF section by name, RVA, file offset and size. The Base64 key record at descriptor table +0x1A4 is XORed with the variant byte: magic 0x20240829, key id 1 drives restoration, and the mode at +0x184 (1 or 2) selects page treatment. Each restored section must match its recorded CRC-32.
  • Large sections: AES-128-CBC over 0x4000 bytes in 0x800-byte chunks from 0x2000 - (RVA & 0xFFF) (key: the value's repeated lowercase hex; IV 0x02..0x11, reset per chunk). Mode 1 XORs and shuffles 0x4000 fragments across eight 0x10000 strides; mode 2 XORs the remainder.
  • Small sections: whole-section XOR.
• BBMG311DIS12IMP gives the protected import count (+16), .rela.plt RVA (+24), entry count (+28) and excluded GOT slots (+32/+36); selected import r_info values are rotated back into order. BBMG311ENC12IAI gives the constructor array RVA (+16) and count (+20). The wrapper DT_INIT, the decoder library's DT_NEEDED entry and the APS2/RELA wrapper relocations are cleared, and the fread/fwrite/fclose GOT imports are restored. The removed DT_INIT RVA is passed to the API helper.

Neutralize (protection/native.rs)

In restored libil2cpp.so, finds the SDK API names and the guard library name in .rodata, traces ADRP/ADD references to them, and redirects each resolver BL to a 16-byte helper written over the removed DT_INIT initializer. The helper returns a pointer to a function that returns zero; other P/Invoke resolutions are untouched. Aborts if the initializer is still active, an API is missing, or the call graph is ambiguous.

DEX edits (protection/dex.rs)

Three methods are edited after each call is validated:

Method	Edit
Application.<clinit>	NOP both native library loads (20 bytes)
Application.attachBaseContext	Replace the invoke + move-result after the superclass call with return/NOPs (8 bytes)
SDK class <clinit>	NOP the guard library load (const-string 10 bytes, or const-string/jumbo 12 bytes); keep the return

All 8 attachBaseContext bytes are rewritten because leftover operand words after the return would still fail DEX verification. Checksums are recomputed.

Output

The decoder and guard libraries are dropped; the restored libraries and edited DEX files are repacked and signed by android::sign. Any mismatched marker, CRC, method or resolver layout aborts the patch.