Patching Smali Files

Given smali file(s) + an instruction like "force isPremium() to always return true":

1. Locate the target method, record its .locals and register usage.
2. Replace/insert the minimal smali needed, bumping .locals if new registers are used.
3. Round-trip validate: smali assemble → baksmali disassemble → smali assemble again, checking for 0 errors/warnings.
4. Package /patched/, /originals/, patch_report.txt, metadata.json, validation_logs/ into patched_output.zip.
5. Only deliver the ZIP if validation status is PASSED.

Progress:

• Parse instruction → map to action (inject / replace / remove / change-return / add-hook)
• Backup originals, record checksums and tool versions
• Static analysis of target method(s): signature, .locals, live registers, control flow, exception handlers
• Generate patch snippet; compute register needs; insert without breaking labels/control flow
• Round-trip validate (assemble → disassemble → assemble); diff patched regions for semantic equivalence
• Retry fixes on failure (up to max_attempts), logging each attempt
• Package outputs; write patch report
• Deliver ZIP only if PASSED; otherwise deliver report + logs + remediation steps

1. Parse & Normalize Instruction

Map verbs to operations:

• "inject", "add", "log" → inject
• "force return", "always return", "make X return Y" → replace
• "remove check", "bypass", "skip validation" → replace-conditional or remove
• "hook", "call before/after" → add-hook

If the target method is ambiguous, prefer: more specific name match > higher visibility (public > protected > private) > closest matching signature. Document the assumption in the report. For high-risk instructions ("remove all checks", "disable all validation"), require explicit confirmation before proceeding.

2. Pre-check & Setup

• Verify file integrity (checksum each input file).
• Record exact tool versions used (smali/baksmali/java) in metadata.json.
• Copy originals into /originals/ untouched.

3. Static Analysis

For each target method:

• Parse .locals, parameter registers (p0..pN), and which v registers are live at the insertion point.
• Build a simple control-flow view: labels, branches, invoke-*, return* statements, .catch/.catchall blocks.
• Pinpoint the exact insertion point relative to labels/instructions — never guess line numbers blindly.

4. Patch Generation & Insertion

• Use the highest-numbered unused register for new temporaries — never reuse a register that's live later in the method.
• If new registers are needed, increment .locals by exactly the number required (minimal delta).
• Preserve label uniqueness; if inserting new labels, prefix them uniquely (e.g., :patch_inject_1) to avoid collisions.
• Never place instructions after an executed return on the same control-flow path.
• Run static sanity checks: balanced .end directives, valid type descriptors, no duplicate labels, no orphaned branches.

5. Round-Trip Validation (Mandatory)

smali assemble -o out.dex patched_smali_dir/
baksmali disassemble -o roundtrip_smali_dir/ out.dex
smali assemble -o roundtrip.dex roundtrip_smali_dir/

• Capture stdout/stderr of every command into validation_logs/{step}.log.
• Diff patched regions against the round-tripped smali — confirm semantic equivalence (register naming/label renaming by baksmali is fine; logic must match).
• On any error/warning: attempt an automated fix (see Troubleshooting), re-run validation, up to max_attempts times, logging every attempt distinctly (attempt_1.log, attempt_2.log, ...).

6. Smoke Tests (if available)

Run any provided unit tests or lightweight static verifiers against the patched dex; log results.

7. Packaging & Reporting

Build patched_output.zip:

/patched/...
/originals/...
patch_report.txt
metadata.json
validation_logs/

Write patch_report.txt per the Report Template below.

8. Delivery

• If status == PASSED: deliver the full ZIP.
• If status == FAILED: deliver only patch_report.txt + validation_logs/ with remediation steps — never ship a ZIP containing errors/warnings.

Example 1 — Inject logging Input: "inject debug_log.txt write on onCreate" Output: Insert a FileWriter/invoke-* block at the start of onCreate(Landroid/os/Bundle;)V, before any early return. .locals incremented minimally (e.g., 2→4) to hold the writer and string refs. Validation: PASSED, 0 errors, 0 warnings.

Example 2 — Force return value Input: "force isPremium() to always return true" Output: Replace method body:

SMALI
.method public isPremium()Z
    .locals 1
    const/4 v0, 0x1
    return v0
.end method

Reasoning logged: original body and all branches removed since return is unconditional; no live registers to preserve.

Example 3 — Bypass a license check Input: "bypass license check in checkLicense(Ljava/lang/String;)Z" Output: Replace the conditional branch that jumps to a "fail" label with an unconditional path to the "success" path (or a direct const/4 v0, 0x1 / return v0 if the whole method can be simplified). Old labels documented as removed/replaced. Assumption logged: "success" label identified as the block preceding a return with truthy value.