irb(main):078:0> 0x00003dfc
=> 15868
irb(main):079:0> 0x00003dfc + 4
=> 15872
irb(main):080:0> 0x00003dff
=> 15871
irb(main):081:0> 0x00003e00
=> 15872
猜出来了（
AssertionError: Declared filesize does not match real size: 1040187392 vs 15872A: android:roundIcon(0x0101052c)=@0x7f0d0000
A: android:debuggable=(type 0x12)0x1 (Raw: "true")
roundIcon 还是
0x0101052c (我之前已经知道
debuggable 的 offset 了(偏差不超过一字), 现在我把它的 name 改为 37(string pool 里第 38 项)<application android:theme="@7F110017" android:label="@7F1000AC" android:icon="@7F0D0000" android:name="com.drakeet.purewriter.App" android:allowBackup="true" android:largeHeap="true" android:supportsRtl="true" android:fullBackupContent="@7F130000" android:roundIcon="@7F0D0000"/>*="true"
>
🌑
dse@susepc:~/reveng/pw$ aapt dump xmltree dist/pw.apk AndroidManifest.xml|grep 0x0101000f
A: android:*(0x0101000f)=(type 0x12)0x1 (Raw: "true")