reso7200/molt-dex

脱去应用的外壳，看看下面有什么。

这是一个分阶段、以证据为先的技能，用于逆向工程、修改和评估安卓应用， 从纯 APK 到 高度混淆的 APK。基于 apktool、adb 和 scrcpy，支持运行时 通过 DexKit 和 Xposed API 进行解析和钩子。

---

这是什么

molt-DEX是Claude技能：一个打包的技能 将安卓应用从“这里有APK”转变为“它是如何构建的，如何构建的”流水线 行为，以及它的弱点所在。”

它是从真实工作中提炼出来的，逆向工程并对一个大型混淆应用进行模组改造 （Instagram）在多个版本中流传下来。历经多个版本保存下来的技术就是那些 就在这里烤熟了。

• 完整的混淆谱。 普通应用、R8/ProGuard 名称混淆、字符串加密， 反射、打包、本地存根和防篡改，每种都有检测方法和方法 穿过它。
• apktool，不是JADX。 它推理apktool解码的smali和资源，这些资源是往返的 （你可以重建并重新安装）。Java 反编译只是可选的便利，绝不是源代码 真理。
• **静电信号以理解，设备确认。

---

What it is

molt-DEX is a Claude skill: a packaged pipeline that takes an Android app from “here is an APK” to “here is how it is built, how it behaves, and where its weaknesses are.”

It was distilled from real work, reverse-engineering and modding a large, obfuscated app (Instagram) across many versions. The techniques that survived version after version are the ones baked in here.

• Full obfuscation spectrum. Plain apps, R8/ProGuard name obfuscation, string encryption, reflection, packing, native stubs, and anti-tamper, each with a way to detect it and a way through it.
• apktool, not JADX. It reasons over apktool-decoded smali and resources, which round-trip (you can rebuild and reinstall). A Java decompile is an optional convenience, never the source of truth.
• Static to understand, device to confirm. Read the code to form a hypothesis, then prove or kill it on a real device with adb and scrcpy. Every claim cites evidence: a smali method, a string-table hit, a logcat line, a screenshot.

Why it holds up: resolve by shape, not by name

This is the whole idea. In an obfuscated app you almost never have the real name of a class or method, and whatever name it has changes on the next release. So you never anchor on names. You anchor on things that stay put:

• literal strings a method uses (log lines, error text, QPL tags),
• JSON / wire keys it parses,
• method shape (parameter types, return type, static vs instance, arity),
• class relationships (superclass, implemented interface, callers and callees),
• resource names.

Find the member by that description, statically (a string index over the decoded tree) and at runtime (a DexKit query inside the live app). When the app updates and the method moves, you re-run the same description and find it again. This is why a module built this way keeps working when Instagram ships a new build, and it is the backbone of every stage below.

Authorization: what the work touches