Patching Smali Files

Given a .smali file and a patch instruction, follow this pipeline:

1. Parse file → identify class header, .locals, fields, methods
2. Locate target method/instruction based on user request
3. Apply patch with correct smali syntax
4. Adjust .locals count if new registers were introduced
5. Validate: smali assemble → baksmali disassemble → diff check
6. Backup original file
7. Package: patched .smali + original (backup) + report.txt → ZIP
8. Deliver ZIP with full before/after report

Never skip the round-trip validation step, even for trivial one-line patches.

Progress:
- [ ] Read full .smali file (header, fields, methods, instructions)
- [ ] Identify target method(s) matching user instruction
- [ ] Check current .locals count
- [ ] Write patch using correct smali syntax
- [ ] Recalculate/update .locals if new registers used
- [ ] Backup original file (keep unmodified copy)
- [ ] Run round-trip validation (assemble → disassemble → re-assemble)
- [ ] Compare output vs expected — fix if mismatch or error/warning found
- [ ] Generate diff (before/after snippet) per changed method
- [ ] Write transparent report (file, method, snippet, reasoning)
- [ ] Package patched file + backup + report into ZIP
- [ ] Deliver ZIP with report summary

Step Details

1. Analysis Read the entire file, not just the target method. Note:

• Class name, superclass, implemented interfaces
• All .field declarations
• All .method blocks with their .locals and .registers
• Existing annotations/try-catch blocks that might be affected

2. Patch Application

• Match user's intent to exact instruction(s) — insert, replace, or delete.
• Use valid smali opcodes (invoke-static, const-string, move-result, etc.) with correct register types (v0, p0, etc.).
• If injecting a call (e.g., logging), ensure return type and register slot compatibility.

3. Register Management

• If patch introduces new local variables, increase .locals N accordingly.
• Never reuse a register still holding a live value needed later — trace usage forward from injection point.
• Prefer using unused/spare registers; if none, bump .locals.

4. Round-Trip Validation

smali assemble patched.smali -o patched.dex
baksmali disassemble patched.dex -o verify/
diff original_structure.smali verify/patched.smali

• If assemble fails → syntax error, fix and retry.
• If diff shows unintended structural drift (e.g., register renumbering) → re-check .locals.
• Repeat until zero errors/warnings.

5. Reporting For every changed method, report:

• File path and method signature
• Before snippet (original instructions)
• After snippet (patched instructions)
• Reason for the change (tied to user's request)
• Register changes (if any)

6. Packaging

output.zip
├── patched/<original_path>.smali
├── backup/<original_path>.smali   (unmodified original)
└── report.txt

Example 1: Input: "Inject a log call at the start of onCreate that writes 'DEBUG_LOG' to /sdcard/debug_log.txt"

Output:

File: com/example/MainActivity.smali
Method: onCreate(Landroid/os/Bundle;)V

--- BEFORE ---
.method protected onCreate(Landroid/os/Bundle;)V
    .locals 1
    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V
    return-void
.end method

--- AFTER ---
.method protected onCreate(Landroid/os/Bundle;)V
    .locals 3
    invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

    new-instance v0, Ljava/io/File;
    const-string v1, "/sdcard/debug_log.txt"
    invoke-direct {v0, v1}, Ljava/io/File;-><init>(Ljava/lang/String;)V
    const-string v2, "DEBUG_LOG"
    invoke-static {v0, v2}, Lcom/example/LogUtil;->writeToFile(Ljava/io/File;Ljava/lang/String;)V

    return-void
.end method

Reason: User requested a debug log injection at method start.
Register change: .locals increased from 1 → 3 (v0, v1, v2 added for File/String construction).
Validation: assemble/disassemble round-trip passed, no warnings.

Result packaged as patched_output.zip with backup and report.txt.

Example 2: Input: "Bypass the license check in verifyLicense() — always return true"

Output:

File: com/example/LicenseChecker.smali
Method: verifyLicense()Z

--- BEFORE ---
.method public verifyLicense()Z
    .locals 2
    ... (validation logic) ...
    move-result v0
    return v0
.end method

--- AFTER ---
.method public verifyLicense()Z
    .locals 1
    const/4 v0, 0x1
    return v0
.end method

Reason: User requested unconditional bypass returning true.
Register change: .locals reduced 2 → 1 (unused validation registers removed).
Validation: assemble/disassemble round-trip passed.