"""Scan TNG dex for Promon exit paths and ActivityThread refs.""" import re import sys import zipfile apk = sys.argv[1] if len(sys.argv) > 1 else r"C:\Users\Administrator\AppData\Local\Temp\tng_base.apk" with zipfile.ZipFile(apk) as z: data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex")) patterns = [ rb"handleExitApplication", rb"System;->exit", rb"Runtime;->exit", rb"Process;->killProcess", rb"Runtime;->halt", rb"xwwqazamx/bl", rb"xwwqazamx/w", rb"xwwqazamx/W", rb"addIntoQueue", rb"handleRootingCallback", rb"startForceExit", ] for pat in patterns: hits = len(re.findall(pat, data)) print(f"{pat.decode('utf-8', 'ignore')}: {hits}") print("\n=== xwwqazamx class names (sample) ===") classes = sorted(set(m.group().decode("utf-8", "ignore") for m in re.finditer(rb"Lxwwqazamx/[A-Za-z0-9_$]+;", data))) for c in classes[:60]: print(c) print(f"... total {len(classes)}") for pat in [b"startForceExit", b"ForceExit", b"openSecurityUrl", b"Lxwwqazamx/w;", b"Lxwwqazamx/bl;->"]: print("---", pat.decode()) hits = sorted(set(m.group().decode("utf-8", "ignore") for m in re.finditer(pat + rb"[^\x00]{0,100}", data))) for h in hits[:20]: print(h)