القائمة
Android exploit PoC construction skill. Turns one DECX proof-graph finding into one buildable PoC app, with optional compile and adb deployment when explicitly requested.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when running DECX CLI commands to open APK, DEX, JAR, or framework targets; inspect classes, methods, source, xrefs, inheritance, or search results; inspect manifests, components, resources, AIDL, Binder metadata, or permissions for Android targets; or manage DECX sessions.
APK app-layer vulnerability hunting with DECX. Use when analyzing exported components, deep links, WebView/Provider/Service/Receiver IPC paths, app attack surfaces, or composed APK exploit chains.
Android framework vulnerability hunting with DECX. Use when analyzing processed framework bundles, system_server, Binder services, AIDL implementations, vendor/OEM framework code, or privileged framework IPC exploit chains.
Generate DECX vulnerability reports from proof-graph finalized findings. Use after decx-app-vulnhunt or decx-framework-vulnhunt has produced finding records; prefer HTML reports and optionally emit Markdown.
| name | decx-poc |
| description | Android exploit PoC construction skill. Turns one DECX proof-graph finding into one buildable PoC app, with optional compile and adb deployment when explicitly requested. |
| metadata | {"requires":{"bins":["node","decx"]}} |
Turn one finalized finding from the evidence graph into one buildable poc-<target> project.
Use only when the user asks to build or prepare a PoC from one DECX verified chain. Query the evidence graph with node scripts/decx-analysis-db.mjs. Do not use for vulnerability discovery, chain tracing, report generation, or generic exploit-writing advice. If no verified chain exists, route back to the relevant vulnhunt skill.
Default ceiling: build-ready unless the user explicitly asks for compile or deploy. Templates: assets/poc-template-app/ and assets/poc-template-server/.
node scripts/decx-analysis-db.mjs chains <dir> --root-prefix entrypoint --leaf-prefix impact
node scripts/decx-analysis-db.mjs path <dir> --from <entrypoint_fact> --to <sink_fact>
node scripts/decx-analysis-db.mjs ancestors <dir> --fact <sink_fact>
Determine target kind from fact prefixes: service-entrypoint or binder-reachability → framework; otherwise app.
Fields needed: entrypoint + sink fact IDs, trigger details (from fact body/evidence), victim package/class or framework service name, component type or Binder interface, guard outcome facts, impact details, DECX port/session.
Before writing any PoC code:
path --from <entrypoint> --to <sink> returns a connected chainIf any check fails: write a dead-end fact with the blocker reason, stop PoC construction. Do not write exploit code, create a project, compile, deploy, or state runtime-validated / poc-validated.
- [ ] Read one verified chain (chains/path/ancestors)
- [ ] Run Sink Re-Verification Protocol
- [ ] Select trigger and requirements
- [ ] Create or reuse PoC project (setup-poc.mjs)
- [ ] Load one matching reference (references/index.md)
- [ ] Implement exploit
- [ ] Register exploit in ExploitRegistry
- [ ] Optional compile (explicit request only)
- [ ] Optional deploy and runtime check (explicit request only)
- [ ] Close DECX session
# Proof graph queries
node scripts/decx-analysis-db.mjs chains <dir> --root-prefix entrypoint --leaf-prefix impact
node scripts/decx-analysis-db.mjs path <dir> --from <entrypoint_fact> --to <sink_fact>
node scripts/decx-analysis-db.mjs ancestors <dir> --fact <sink_fact>
node scripts/decx-analysis-db.mjs export <dir>
# DECX session
decx process open "<apk-path>" -P <port>
decx ard framework open "<jar>" --name "<target>" -P <port>
decx code method-source "<full-method-sig>" -P <port>
decx process close --port <port>
# PoC project
node skills/decx-poc/scripts/setup-poc.mjs <target-app>
node skills/decx-poc/scripts/check-env.mjs
cd poc-<target>/app && timeout 300 ./gradlew assembleDebug --no-daemon
| Rule | Rationale |
|---|---|
| One active chain in context | prevents contamination |
One poc-<target> per target, one exploit id per finding | reuse project, not exploits |
applicationId under com.poc.*, allowBackup="false" | PoC hygiene |
| Replace every placeholder with verified target values | stale values = no-op exploit |
Hidden-API exemption for framework Binder calls (HiddenApiBypass.addHiddenApiExemptions("")) | ServiceManager/Stub.asInterface need it; omitting → NoSuchMethodException at runtime |
Framework findings use direct Binder calls, NOT startActivity/bindService/sendBroadcast | wrong delivery = PoC never reaches target |
| Close DECX session in the same response that completes the PoC | resource cleanup |
| Log a real proof signal, not a theory statement | "returned rows" not "exploit executed" |
Two-stage exploits modeled as capture → trigger | explicit handle acquisition |
references/index.md — PoC shape routing matrixreferences/poc-workflow.md — output contract, compile/deployreferences/poc-base.md — shared registration + success signal contractreferences/poc-app-*.md, references/poc-framework-service.md — per-surface code templates