diff --git a/README.en.md b/README.en.md index 4db340c..8bfc89b 100644 --- a/README.en.md +++ b/README.en.md @@ -1,10 +1,15 @@ -# Shellsmith — Android and iOS App Hardening - -[简体中文](README.md) | English - -[![Latest Release](https://img.shields.io/github/v/release/kairowan/Shellsmith?style=flat-square&label=release&color=6366f1)](https://github.com/kairowan/Shellsmith/releases/latest) -[![CI](https://img.shields.io/github/actions/workflow/status/kairowan/Shellsmith/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/kairowan/Shellsmith/actions/workflows/ci.yml) -[![License](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-green?style=flat-square)](#license) +
+ Shellsmith logo +

Shellsmith

+

Android and iOS App Hardening

+

Local-first · Offline hardening · Integrated signing

+

简体中文 | English

+

+ Latest release + CI + License +

+
Shellsmith is a local-first desktop hardening tool. It protects Android APK/AAB outputs and iOS source projects, signs them, and verifies the results entirely on your machine; APKs, certificates, and signing materials are never uploaded. When BYOS out-of-package keys are explicitly enabled, the artifact IKM is sent only to the self-hosted HTTPS service you configure, never to Shellsmith maintainers. @@ -12,6 +17,8 @@ A desktop GUI is available for Windows, macOS, and Linux, with Chinese and Engli > Use only with applications you own or are authorized to protect. Do not bypass third-party protections or use this tool for unauthorized purposes. +**Quick navigation** · [Capabilities](#core-capabilities) · [Quick Start](#quick-start) · [Compatibility](#compatibility-and-limitations) · [BYOS](#byos-out-of-package-keys) · [Security Scope](#how-it-works-and-security-scope) · [Documentation](#documentation-and-development) + ## Core Capabilities - **Android DEX hardening:** encrypt application DEX files and bind them to the original certificate, then repackage, align, and optionally sign. Baseline anti-debugging and optional strict checks are included. @@ -80,7 +87,9 @@ This removes quarantine; it does not mean the application is notarized by Apple. ## Preview -![Shellsmith protection page illustration](docs/assets/screenshots/readme-protect-main.png) +

+ Shellsmith protection page illustration +

The screenshot illustrates the layout; available options depend on the current version. More screens and instructions are in the [usage guide](docs/usage.md). @@ -158,6 +167,22 @@ Shellsmith does not host the BYOS service. The repository documents a separately ## How It Works and Security Scope +```mermaid +flowchart TB + subgraph Android[Android] + A1[APK / AAB] --> A2[Preflight] + A2 --> A3[DEX hardening] + A3 --> A4[Repackage / align] + A4 --> A5[Sign] + end + subgraph iOS[iOS] + I1[Xcode project] --> I2[Check] + I2 --> I3[Source protection] + I3 --> I4[Archive / Export] + I4 --> I5[Signature verification] + end +``` + ### Android Protection reads the original certificate, compresses and encrypts DEX files, injects the stub, then rebuilds, aligns, and optionally signs the APK. At runtime, the stub checks the environment, validates or decrypts the DEX cache, loads code, and starts the original application. diff --git a/README.md b/README.md index 6ce3398..783fb69 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,15 @@ -# Shellsmith — Android 与 iOS 应用加固工具 - -简体中文 | [English](README.en.md) - -[![最新版本](https://img.shields.io/github/v/release/kairowan/Shellsmith?style=flat-square&label=最新版本&color=6366f1)](https://github.com/kairowan/Shellsmith/releases/latest) -[![CI](https://img.shields.io/github/actions/workflow/status/kairowan/Shellsmith/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/kairowan/Shellsmith/actions/workflows/ci.yml) -[![许可证](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-green?style=flat-square)](#许可证) +
+ Shellsmith logo +

Shellsmith

+

Android 与 iOS 应用加固工具

+

本地优先 · 离线加固 · 签名一体化

+

简体中文 | English

+

+ 最新版本 + CI + 许可证 +

+
Shellsmith 是一款本地优先的桌面加固工具：Android APK/AAB 与 iOS 源码工程的加固、签名和产物验证都在本机完成，APK、证书和签名材料不会上传。显式启用 BYOS 包外密钥时，产物 IKM 只会发送到你配置的自建 HTTPS 服务，不经过 Shellsmith 维护者。 @@ -12,6 +17,8 @@ Shellsmith 是一款本地优先的桌面加固工具：Android APK/AAB 与 iOS > 仅用于保护你拥有合法权利的 Android 与 iOS 应用，请勿用于绕过第三方保护或其他未授权场景。 +**快速导航** · [核心能力](#核心能力) · [快速开始](#快速开始) · [兼容性](#兼容性与限制) · [BYOS](#byos-包外密钥) · [安全边界](#工作原理与安全边界) · [文档](#文档与开发) + ## 核心能力 - **Android DEX 加固**：加密业务 DEX 并绑定原签名证书，重新打包、对齐并按需签名；提供基础反调试和可选的严格保护。 @@ -80,7 +87,9 @@ xattr -rd com.apple.quarantine /Applications/Shellsmith.app ## 界面预览 -![Shellsmith 加固页示意](docs/assets/screenshots/readme-protect-main.png) +

+ Shellsmith 加固页示意 +

截图用于展示页面布局，具体选项以当前版本为准。更多页面与操作说明见[使用指南](docs/usage.md)。 @@ -158,6 +167,22 @@ Shellsmith 不托管 BYOS 服务端。仓库提供一份可独立部署的 Go/Po ## 工作原理与安全边界 +```mermaid +flowchart TB + subgraph Android[Android] + A1[APK / AAB] --> A2[预检] + A2 --> A3[DEX 加固] + A3 --> A4[重打包 / 对齐] + A4 --> A5[签名] + end + subgraph iOS[iOS] + I1[Xcode 工程] --> I2[检查] + I2 --> I3[源码保护] + I3 --> I4[Archive / Export] + I4 --> I5[签名验证] + end +``` + ### Android 加固时读取原签名证书，压缩并加密 DEX，注入壳资源，再重新打包、对齐并按需签名。运行时由壳执行安全检查、校验或解密 DEX 缓存，加载业务代码并启动原应用。