perf: 优化离线加固加载并发布 1.8.6

.github/release-notes/versions/1.8.6.md

@@ -0,0 +1,13 @@
+### 离线加载与兼容修复
+
+- 新产物统一单层压缩，减少加载复制并优化 Android 运行时编译设置；仍兼容旧的 1～3 层载荷，不改变签名与认证校验。
+- 使用标准 DEX 数据边界定位载荷，保留其他布局的兼容扫描，并修复密文中同名标记导致入口误选的问题。
+- 发布版加载器使用固定错误代码，减少内部算法和解析信息暴露；保留已挂起的 Java 异常。首次与缓存加载的认证失败均已验证拒绝启动。
+- 本地逐方法报告增加指令、寄存器、异常区、桥接及协程准入事实；成功与零转换失败报告均可排查，未放宽保护准入或提高覆盖率统计。
+- 修复还原验收中的重复 DEX 扫描，补齐真实 APK 的分层验证。测试范围通过不代表全部业务已覆盖；本次不新增 Native VMP，也不宣称阻止仅凭 APK 的静态还原。
+
+### 升级说明
+
+- 使用配套打包器与运行时重新加固后生效；PVM2 需要 JDK 17 或更高版本。逐方法报告包含业务标识，分享前请脱敏。
+- 保持通用离线加固、手机安装即用；不增加服务器或激活依赖。`balanced` 与 `high` 当前采用相同保护决策，保留选项用于旧配置兼容。
+- 单台 Android 15 真机完成真实 APK 的 620 组输入、62,620 次调用及本轮每包 30 次有效冷启动采样。性能随项目和设备变化；本样本缓存启动额外开销仍为 420.5 ms，不能表述为全部性能目标已达成。

Cargo.toml

@@ -22,3 +22,18 @@ lto = true           # 链接时优化
 strip = "symbols"    # 移除符号表（比 strip = true 更明确、更激进）
 panic = "abort"      # 减少 unwind 代码体积
 codegen-units = 1    # 更激进的跨单元优化
+
+# 手机上每次启动都要认证载荷并初始化解释器，运行时优先优化执行速度。
+# 桌面程序仍沿用体积优先设置；不改变算法、认证或解释器准入规则。
+[profile.release.package.mocikashield]
+opt-level = 2
+
+# 载荷每次启动都需要完整认证；共享密码库也优先优化吞吐，不改变密码协议。
+[profile.release.package.chacha20poly1305]
+opt-level = 3
+
+[profile.release.package.chacha20]
+opt-level = 3
+
+[profile.release.package.poly1305]
+opt-level = 3

apps/shield-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "shield-cli"
-version = "1.8.5"
+version = "1.8.6"
 edition = "2021"
 authors = ["MocikaDev"]
 license = "MIT OR Apache-2.0"

apps/shield-cli/src/args.rs

@@ -364,7 +364,7 @@ pub(crate) struct ProtectArgs {
     /// 保护级别：compat、balanced 或 strict。
     #[arg(long, value_enum)]
     pub profile: Option<ProtectionProfileArg>,
-    /// AI 静态分析抵抗等级；实际映射为 DEXB v6 的 1/2/3 层压缩。
+    /// 额外保护策略等级；新包统一单层压缩，效果以逐方法覆盖和产物验证为准。
     #[arg(long, value_enum)]
     pub ai_resistance: Option<AiResistanceArg>,
     /// Xop transform-only Packer JAR；仅嵌入 PVM2，不引入第二个 Application/JNI 壳。

apps/shield-gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mocika-shield-gui",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "license": "MIT OR Apache-2.0",
   "private": true,
   "type": "module",

apps/shield-gui/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mocika-shield"
-version = "1.8.5"
+version = "1.8.6"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false

apps/shield-gui/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Shellsmith",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "identifier": "dev.mocika.shield-gui",
   "build": {
     "beforeDevCommand": "npm run dev -- --host 127.0.0.1",

apps/shield-gui/src/hooks/use-about-page.ts

@@ -9,7 +9,7 @@ type AppInfo = {
 };
 
 const defaultAppInfo: AppInfo = {
-  version: "1.8.5",
+  version: "1.8.6",
   git_hash: "dev",
   build_date: "unknown",
 };

apps/shield-gui/src/lib/i18n.ts

@@ -160,7 +160,7 @@ const dict = {
     protectionBalanced: "平衡保护（推荐）",
     protectionStrict: "严格代码保护（需 PVM2）",
     aiResistance: "AI 分析抵抗",
-    aiResistanceHint: "该选项映射为 DEXB 多层认证压缩；PVM2 默认使用内置 Packer，仍需填写自有业务类前缀。Hollow/SO 融合仍未开放。",
+    aiResistanceHint: "保留旧配置选项；balanced 与 high 当前采用相同保护决策，不再叠加压缩。效果以逐方法覆盖和产物验证为准。PVM2 使用内置打包器，仍需填写自有业务类前缀。",
     aiResistanceOff: "关闭",
     aiResistanceBalanced: "平衡",
     aiResistanceHigh: "高强度",
@@ -614,7 +614,7 @@ const dict = {
     protectionBalanced: "Balanced protection (recommended)",
     protectionStrict: "Strict code protection (PVM2 required)",
     aiResistance: "AI analysis resistance",
-    aiResistanceHint: "This controls authenticated DEXB compression layers. PVM2 uses the bundled Packer by default and still requires owned business-class prefixes; fused Hollow/SO remain unavailable.",
+    aiResistanceHint: "These options remain for configuration compatibility. Balanced and high currently use the same protection decisions without extra compression layers. Assess protection using method coverage and artifact verification. PVM2 uses the bundled packer and requires owned business-class prefixes.",
     aiResistanceOff: "Off",
     aiResistanceBalanced: "Balanced",
     aiResistanceHigh: "High",

crates/shield-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "shield-core"
-version = "1.8.5"
+version = "1.8.6"
 edition = "2021"
 authors = ["MocikaDev"]
 license = "MIT OR Apache-2.0"

crates/shield-core/src/protection_policy.rs

@@ -55,13 +55,10 @@ impl AiResistance {
         }
     }
 
-    /// DEXB v6 的实际压缩层数，范围固定为 1..=3。
+    /// 新包只压缩一次；重复压缩不提供秘密，不随 AI 保护级别叠加启动成本。
+    /// 运行时继续兼容已有的 1～3 层载荷。
     pub fn compression_layers(self) -> u8 {
-        match self {
-            Self::Off => 1,
-            Self::Balanced => 2,
-            Self::High => 3,
-        }
+        1
     }
 }
 
@@ -199,9 +196,11 @@ mod tests {
     }
 
     #[test]
-    fn ai_resistance_selects_bounded_compression_layers() {
+    fn 压缩不随保护级别重复且严格保护能力保持开启() {
         assert_eq!(AiResistance::Off.compression_layers(), 1);
-        assert_eq!(AiResistance::Balanced.compression_layers(), 2);
-        assert_eq!(AiResistance::High.compression_layers(), 3);
+        assert_eq!(AiResistance::Balanced.compression_layers(), 1);
+        assert_eq!(AiResistance::High.compression_layers(), 1);
+        let policy = ProtectionPolicy::for_profile(ProtectionProfile::Strict, AiResistance::High);
+        assert!(policy.pvm2 && policy.string_jit && policy.native_safe && policy.memory_preferred);
     }
 }

crates/shield-core/src/protection_report.rs

@@ -20,6 +20,9 @@ pub(crate) struct MethodRecord {
     plaintext_policy: Option<String>,
     final_dex_index: Option<u32>,
     final_method_index: Option<u32>,
+    /// 本地准入事实只用于排查，不参与转换成功或覆盖率判定。
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    admission: Option<serde_json::Value>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -792,7 +795,8 @@ mod tests {
             detail.methods.push(serde_json::from_value(serde_json::json!({
                 "module": "base", "descriptor": format!("Lprivate/Secret;->method{i}()V"), "required": false,
                 "input_instruction_bytes": 0, "input_dex": "classes.dex", "transform_status": "skipped",
-                "reason": reason, "artifact_verified": false, "plaintext_policy": null
+                "reason": reason, "artifact_verified": false, "plaintext_policy": null,
+                "admission": {"policy_exclusion": reason, "opcodes": {"invoke-virtual": 1}, "private_fact": "private"}
             })).unwrap());
         }
         for image in [7, 8, 9, 10] {
@@ -828,6 +832,10 @@ mod tests {
         assert_eq!(stored["build"]["status"], "failed");
         assert_eq!(stored["build"]["failure_code"], "PVM2_ZERO_METHODS");
         assert_eq!(stored["methods"].as_array().unwrap().len(), cases.len());
+        assert_eq!(
+            stored["methods"][0]["admission"]["opcodes"]["invoke-virtual"],
+            1
+        );
         assert!(!output.path().join("final.aab").exists());
         assert!(!report_path(&output.path().join("final.aab")).exists());
         #[cfg(unix)]

docs/README.md

@@ -41,6 +41,7 @@ Shellsmith 是 Android 与 iOS 双平台应用加固工具。Android 流程加
 | 了解 Native 库名去品牌化与按任务别名方案 | [design/native-library-alias.md](design/native-library-alias.md) |
 | 了解 Stub DEX 最小化、能力变体与二阶段加载实验 | [design/stub-dex-minimization.md](design/stub-dex-minimization.md) |
 | 了解运行时安全、缓存认证与 Root 策略规划 | [design/runtime-security.md](design/runtime-security.md) |
+| 验证 REA 分析抵抗与 APK 离线恢复边界 | [design/rea-resilience.md](design/rea-resilience.md) |
 | 了解 API 31 以上内存 DEX 正式接入边界 | [design/memory-dex-production.md](design/memory-dex-production.md) |
 | 了解 DEX 结构与方法代码分离研究 | [design/dex-code-separation.md](design/dex-code-separation.md) |
 | 了解工具链轻量化、CI 与 Gradle 集成规划 | [design/toolchain-modernization.md](design/toolchain-modernization.md) |