CLONE ENGINE NATIVE ANALYSIS - CMasterCloner (apktool smali)
Analysis only. No files changed. Sources: o10.smali, m1.smali, AndroidManifest.xml,
plus the classes they actually load.
1. WHAT THE THREE REQUESTED SOURCES CONTAIN
o10.smali: 0 native methods, 0 loadLibrary.
m1.smali: 0 native methods, 0 loadLibrary.
Manifest: 0 native methods, 0 loadLibrary.
Manifest entry points only:
- application android:name="com.cmaster.cloner.App"
- launcher: com.cmaster.cloner.ui.HomeActivity
- engine target: com.cmaster.cloner.ui.RouterActivity (no intent filter; referenced by oOO0OO)
- android:extractNativeLibs="true", android:multiArch="true"
IMPORTANT: the premise "RouterActivity -> m1 -> o10 -> native" is NOT what the code does.
That chain is pure Java: RouterActivity -> m1.OooOoO() -> o10 -> View. No native call.
The native path is separate and runs through the engine Binder service.
2. NATIVE METHODS ACTUALLY PRESENT
DexUtils.smali
static native classesInit0(int)
dm1.smali (extends tl0 extends android.os.Binder)
OooO(o0O00OOO, int) -> o0O00OOO
OooO0Oo() -> int
OooO0o() -> void
OooO0o0() -> void
OooO0oO() -> o0O00OOO
OooO0oo() -> boolean
OooOO0(o0O00OOO) -> void
OooOO0O(Intent, ActivityInfo) -> void
OooOO0o(o0O00OOO) -> void
OooOOO0() -> void
toString() -> String
dm1.<init>(o0O0o00O, ActivityInfo, Intent, int) calls OooOO0O(intent, activityInfo).
o0O0o00O.smali (extends Object)
static OooO00o(dm1) -> m2
OooO(o0O00OOO, o0O00OOO, boolean, int) -> void
OooO0O0(o0O00OOO) -> dm1
OooO0OO(Intent, ActivityInfo, boolean, int) -> o0O00OOO
OooO0Oo(o0O00OOO) -> void
OooO0o(dm1) -> void
OooO0o0(o0O00OOO) -> o0O00OOO
OooO0oO() -> void
OooO0oo(o0O00OOO, o0O00OOO) -> o0O00OOO
OooOO0(int) -> dm1
OooOO0O() -> o0O00OOO
OooOO0o(o0O00OOO) -> o0O00OOO
toString() -> String
o0O00OOO.smali (extends tl0 extends Binder)
static OooO0oO(IBinder) -> o0O00OOO
static OooO0oo(IBinder) -> o0O00OOO
OooO(dm1) -> void
OooO0OO(int) -> void
OooO0Oo() -> void
OooO0o(int, Intent) -> void
OooO0o0(Intent, String) -> void
toString() -> String
3. loadLibrary CALLS
DexUtils.<clinit> : System.loadLibrary("cm") -> libcm.so
d02.<clinit> : System.loadLibrary(<decrypted>) -> XOR arrays decode to "PPNDZQ",
but u7.OooO00o ORs a random byte, so exact runtime string needs .so/device.
No Java loadLibrary for libcmvm.so. It is loaded from native code (likely dlopen inside
libcm.so). Needs .so to verify.
4. CALL ORDER AND WHAT EACH PASSES
A. VIEW PATH (NO NATIVE)
1. App.attachBaseContext -> oOO0OO.OooOOO0(App) (no native)
2. App.onCreate -> oOO0OO.OooOOO(App) (no native)
3. HomeActivity.onCreate (no native)
4. RouterActivity.onCreate -> m1.onCreate:
- findViewById(0x1020002) -> android.R.id.content ViewGroup
- Class.forName(target) -> m1.OooOoO(Class, Bundle)
- k20 cache lookup -> o10.newInstance()
- o10.OoooO0O(Bundle) (stores Bundle, no native)
- new k5(k20) transaction
- o10.Oooo0o(inflater, parent, bundle)
-> o10.OooOoOO(inflater, parent) -> View
NO native call in this whole chain.
B. ENGINE / NATIVE PATH
5. Engine init:
- hf1.o0000o0O(Context) -> ff1.OooO00o(Context)
- -> pw1.o00O0000() + pw1.o00O00(Context)
- -> new o0O0o0(pw1)
- -> new o0O0o00O(...) + new o0oOo0O0(...)
- o0O0o00O.<clinit> -> DexUtils.classesInit0(0x2e) (46)
- DexUtils.<clinit> -> System.loadLibrary("cm")
- dm1.<clinit> (first load) -> classesInit0(0x1e) (30)
- d02.<clinit> (first load) -> System.loadLibrary("PPNDZQ")
6. Start activity:
- Framework -> pw1.OooO(String, Intent, String, IBinder, String, int, Bundle, int)
- -> o0oOo0O0.OooO0o0(b51, int, String, Intent, String, IBinder, String, int, Bundle, int, int)
- -> o0oOo0O0.OooO0Oo(b51, Intent, String, ActivityInfo, ResolveInfo, o0O00OOO,
String, int, int, String, Bundle, o0O00OOO[], int, int)
- -> o0oOo0O0.OooO0o(o0O00OOO, o0O00OOO, Bundle, dm1)
7. Inside o0oOo0O0.OooO0o(...):
- o0O0o00O.OooO0OO(intent, activityInfo, z, i)
passes target Intent + resolved ActivityInfo + two flags
-> returns o0O00OOO (native activity object)
- o0O0o00O.OooO0O0(o0O00OOO)
passes native activity handle
-> returns dm1
- o0oOo0O0.OooO0OO():
o0O0o00O.OooOO0O() no args -> existing o0O00OOO or null
if null: o0O0o00O.OooO0O0(o0O00OOO) -> dm1
o0O00OOO.OooO(dm1) passes dm1 implementation to attach it
8. dm1.<init> (invoked by native) -> dm1.OooOO0O(intent, activityInfo)
passes target Intent + ActivityInfo to the native binder.
9. WHAT NEEDS THE .SO TO VERIFY
- Every native method body above.
- Meaning of classesInit0(0x2e) and classesInit0(0x1e). Almost certainly JNI
registration IDs, but the mapping is inside libcm.so.
- Whether dm1 is a real native Activity/window or just a Binder handle.
- Whether dm1.OooOO0O actually creates a native window or only binds state.
- d02 exact library name: XOR gives PPNDZQ, but u7.OooO00o ORs a SecureRandom byte,
so the literal is not statically certain.
- How libcmvm.so is loaded (no Java loadLibrary).
- What o0O00OOO.OooO(dm1) does at the native window/attach level.
- Whether o0O0o00O.OooOO0O() returns null on the first call (it drives the OooO0O0 branch).