docs: add Transaction Code Resolution section to README

Explains the three-layer detection strategy: DEX bytecode extraction,
compiled version tables with ELF filtering, and live transaction
probing.

Author: xaionaro@dx.center

README.md

@@ -1738,6 +1738,18 @@ go run ./tools/cmd/aospgen -3rdparty tools/pkg/3rdparty -output . -smoke-tests
 
 This discovers all AIDL files across `frameworks-base`, `frameworks-native`, `hardware-interfaces`, and `system-hardware-interfaces`, infers search roots from package declarations, and generates Go proxies for all AOSP services. The current AOSP snapshot produces **5,490 Go files** across **666 packages**.
 
+### Transaction Code Resolution
+
+Each binder method has a numeric transaction code that can differ between Android versions. The generated proxies call `ResolveCode()` at runtime to get the correct code for the device, using a three-layer detection strategy:
+
+1. **DEX bytecode extraction** (primary) — scans `/system/framework/*.jar` on the device, parses DEX bytecode, and reads `TRANSACTION_*` constants from `$Stub` classes. This gives definitive codes for the exact firmware. Results are cached to `/data/local/tmp/.binder_cache/codes.json`.
+
+2. **Compiled version tables + ELF filtering** (fallback) — if DEX extraction fails (e.g. no read access to `/system/framework/`), falls back to pre-compiled tables generated by `genversions` from multiple AOSP revision tags. The API level is detected from the `.note.android.ident` ELF section of `/system/lib64/libbinder_ndk.so`. Candidate revisions are further narrowed by inspecting exported symbols in `/system/lib64/libbinder.so`.
+
+3. **Live transaction probing** (last resort) — if multiple candidate revisions remain, sends a test transaction (`isUserAMonkey()` on ActivityManager) with each candidate's code and picks the revision that returns a valid response.
+
+The `genversions` tool builds these tables by checking out each AOSP revision tag, parsing all AIDL files, and recording the method→code mapping. Revisions with identical tables are deduplicated.
+
 ## Testing and Verification
 
 The project is verified at four levels: