Modifying Android Apps Without Source Codes

Modifying Android Apps Without Source Codes

• 1.
  Modifying Android apps withoutsource code By: Ronillo Ang Android Developer
• 2.
  Requirements • Java SDK [http://www.oracle.com/technetwork/java/javase/downloads/index .html] •Android SDK [http://developer.android.com/sdk/index.html] • Apktool [https://bitbucket.org/iBotPeaches/apktool/downloads] • SignApk [http://forum.xda- developers.com/attachment.php?s=ed93891ef99dc601482f8c9b 196c8c4f&attachmentid=1846095&d=1364661948] • Android Studio (Optional) • OpenSSL
• 3.
  A Real WorldExample • We’ll reverse engineer yours truly apps on Google Play • Download UIE Tracker https://play.google.com/store/apps/details?id=ron.an g.uietracker
• 4.
  Get APK • Firstthing to do is to have the APK and saved to your computer’s hard disk • Plug in your device • We need to get the path where the APK is stored on the device: adb shell pm path <package name> • Pull out the APK from the device: adb pull <path>
• 5.
  Decompiling • Now thatwe have the APK on our computer, the second thing to do is to decompile it using apktool • Issue the ff. command on a terminal: java -jar ~/Desktop/apktool1.5.2/apktool_2.0.1.jar d -f <apk>
• 6.
  Modding • You needto learn coding in smali • Smali is a dex format used by Dalvik Virtual Machine • Find out the list of Dalvik operations http://pallergabor.uw.hu/androidblog/dalvik_opcodes .html
• 7.
  Rebuilding • Once finishedwith modding, use apktool to rebuild the modded application. java -jar ~/Desktop/apktool1.5.2/apktool_2.0.1.jar b <modded src>
• 8.
  Signing the moddedAPK • The last thing we need to do in order for our modded apk to work is to digitally sign it with a certificate. • Generate certificate via openssl • Sign the APK with the generated certificated with SignApk tool • In order to upload it on Google Play and Android devices
• 9.
  Signing the moddedAPK • Let’s generate the certificate for signing: openssl genrsa -out key.pem 1024 openssl req -new -key key.pem -out request.pem openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt
• 10.
  Signing the moddedAPK • Finally… java -jar signapk.jar certificate.pem key.pk8 <modded apk> <output apk>
• 11.
  Common Injected Code •The pop-up message box • Method profiling call
• 12.
  The Pop-up MessageBox new-instance v1,Landroid/app/AlertDialog$Builder; invoke-direct {v1,p0}, Landroid/app/AlertDialog$Builder;-><init>(Landroid/content/Context;)V const-string v2,"u666eu901au5bf9u8bddu6846" invoke-virtual {v1,v2}, Landroid/app/AlertDialog$Builder;- >setTitle(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder; const-string v2,"u4f60u597duff0cAndroid!" invoke-virtual {v1,v2},Landroid/app/AlertDialog$Builder;- >setMessage(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder; invoke-virtual {v1},Landroid/app/AlertDialog$Builder;->create()Landroid/app/AlertDialog; move-result-object v2 invoke-virtual {v2},Landroid/app/AlertDialog;->show()V
• 13.
  Method Profiling Call const-stringv0, "123" invoke-static {v0}, Landroid/os/Debug;- >startMethodTracing(Ljava/lang/String;) V invoke-static {}, Landroid/os/Debug;->stopMethodTracing() V A file named 123.trace will be saved on the sdcard, which can be analyse using traceview tool.
• 14.
  Thank You!!!