Function patchSmaliWithGadgetLoad

src/tools/frida.ts:485–562

* Patch a smali file to load a native library in onCreate. * Uses a safe register (bumps .locals/.registers count and uses the new slot). * Adds a marker comment for idempotent detection.

(
    smaliPath: string,
    libBaseName: string,
)

 * Adds a marker comment for idempotent detection.
 */
function patchSmaliWithGadgetLoad(
    smaliPath: string,
    libBaseName: string,
): boolean {
    const content = fs.readFileSync(smaliPath, "utf-8");

    // Check if already patched
    if (content.includes(GADGET_INJECT_MARKER)) return false;

    const lines = content.split("\n");
    const result: string[] = [];
    let patched = false;

    for (let i = 0; i < lines.length; i++) {
        result.push(lines[i]);

        // Find onCreate method and insert after .locals/.registers directive
        if (
            !patched &&
            lines[i]
                .trim()
                .match(/\.method\s+.*onCreate\(Landroid\/os\/Bundle;\)V/)
        ) {
            // Find the .locals or .registers line
            for (i++; i < lines.length; i++) {
                result.push(lines[i]);
                const trimmed = lines[i].trim();
                if (
                    trimmed.startsWith(".locals") ||
                    trimmed.startsWith(".registers")
                ) {
                    const localsMatch = trimmed.match(
                        /\.(locals|registers)\s+(\d+)/,
                    );
                    if (!localsMatch) break;

                    const directive = localsMatch[1];
                    const count = parseInt(localsMatch[2]);
                    let safeReg: string;

                    if (directive === "locals") {
                        // .locals N -> .locals N+1, new register is vN
                        safeReg = `v${count}`;
                    } else {
                        // .registers M with onCreate(Bundle): 2 params (this + Bundle)
                        // locals = M - 2, new local = v(M-2) after bumping to M+1
                        safeReg = `v${count - 2}`;
                    }

                    // Bump the count
                    result[result.length - 1] = lines[i].replace(
                        /\d+/,
                        String(count + 1),
                    );

                    // Insert gadget load code with marker
                    result.push("");
                    result.push(`    ${GADGET_INJECT_MARKER}`);