[Android Software/Hacking General [Developers Only]] E:V:A:
The General Procedure

NOTE: All this was performed on Windows Vista with Cygwin.

(1) Grab BOOTCLASSPATH from init.rc

Find the line in your init.rc file that reads something like:

[SIZE=2]export BOOTCLASSPATH /system/framework/core.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar[/SIZE]

Extract and reformat the path to:

[SIZE=2]core.jar:bouncycastle.jar:ext.jar:framework.jar:android.policy.jar:services.jar:core-junit.jar[/SIZE]

(2) Grab the "framework" from your device

Create a working directory somewhere, let's call it "_framework":

[SIZE=2]mkdir ./_framework[/SIZE]
[SIZE=2]cd _framework[/SIZE]

Grab all the framework files from your device:

[SIZE=2]adb pull /system/framework .[/SIZE]

Rename directory if needed.

NOTE-1: From now on I'll assume you know where you are!

NOTE-2: Most GB 2.3.4+ devices uses .odex'ed files,

with name pairs like: <package>.jar and <package>.odex.

These need to be converted.

(3) Use baksmali with (1)

You can also use baksmali with the switch: -d <framwork-dir>.

The general command is something like below, but in windows there may be "wrappers"

that allow you to just type "baksmali" without the "java -jar" prefix and without

the ".jar" post fix. Anyway here is the command I used:

[SIZE=2]java -Xmx1024m -jar ./../../baksmali.jar -a 10 -c :core.jar:bouncycastle.jar:ext.jar:framework.jar:android.policy.jar:services.jar:core-junit.jar -x framework.odex[/SIZE]

==> This results in all files put in the "out" sub-directory.

This directory contain 3 sub-directories (for GB 2.3.4):

[I]android [/I](Hidden APIs)
[I]com [/I](Internal APIs)
[I]javax [/I](Hidden APIs)

NOTE: If you are using Google's own API's, you will probably also need to add

those packages to the path above. (Eg. Email.jar, etc etc ?)

(4) Then use smali to create a dex file from "out" directory

java -jar smali.jar out

==> creates out.dex from "out" directory.

(5) Run dex2jar on out.dex

[SIZE=2]./dex2jar.bat out.dex[/SIZE]

==> creates out_dex2jar.jar

(This .jar contain close to 4900 files at 12 MB!)

(6) Rename "out_dex2jar.jar" to "framework-classes.zip"

[SIZE=2]mv out_dex2jar.jar framework-classes.zip
unzip framework-classes.zip[/SIZE]

(7) Find and copy your Android SDK's android.jar file

Go to: /path/to/android-sdk-windows/platforms/android-X/android.jar

where X is the API level of interest. This obviously have to match the

API level of the files you extracted from your device in: /system/framework .

This .jar file contain more than 5300 files when expanded, but missing all

the internal packages. Our job is to add them back in.

Let's first make a copy that we can use to expand and add files from (6):

cp android.jar custom-android.zip
unzip custom-android.zip

(8) Add all *.class files from (6) in to (7)

Copy and replace all existing *.class files from framework-classes.zip into

custom-android.zip:

[SIZE=2]cp -R /path/to/framework-classes/* /path/to/custom-android/.[/SIZE]

The root content of that directory should then look something like this:

[SIZE=2]android[/SIZE]
[SIZE=2]assets[/SIZE]
[SIZE=2]com[/SIZE]
[SIZE=2]dalvik[/SIZE]
[SIZE=2]java[/SIZE]
[SIZE=2]javax[/SIZE]
[SIZE=2]junit[/SIZE]
[SIZE=2]META-INF[/SIZE]
[SIZE=2]org[/SIZE]
[SIZE=2]res[/SIZE]
[SIZE=2]AndroidManifest.xml[/SIZE]
[SIZE=2]resources.arsc[/SIZE]

(9) Rename directory and create your new "classy-android.jar"

We rename it so not confuse with the original:

mv custom-android classy-android
zip classy-android
mv classy-android.zip classy-android.jar

IMPORTANT:

Make absolutely sure that the folder structure of your zip archive

is exactly the same as what you intended. To check, unzip the file

and see if it is what you (and eventually Eclipse) would expect.

(For example, if you use 7zip to zip a directory file called "test",

into "test.zip", you may end-up extracting it to ./test/test/... )

(10) Enabling & Restricting Access to classy-android.jar

Instead of just replacing the android.jar with classy-android.jar, we choose

to create a customized Android platform. This way you can enable the Internal

and Hidden API's for those projects requiring them, while other standard

projects doesn't have access to those.

(a) Go to: /path/to/android-sdk-windows/platforms/

and copy the relevant directory (for example):

cp -R android-10 android-10-internals

(b) Replace android.jar with your classy-android.jar:

cp classy-android.jar android.jar

("cp" overwrites!)

(c) Edit the build.prop file:

Edit/replace the following lines:

[SIZE=2]ro.build.version.sdk=10 ==> ro.build.version.sdk=[COLOR=Black][B]-10[/B][/COLOR][/SIZE]
[SIZE=2]ro.build.version.release=2.3.3 ==> ro.build.version.release=2.3.internal[/SIZE]

(11) Customizing the Eclipse ADT

In order to be able to use com.android.internal packages in the Eclipse ADT,

you have to disable the internal protection mechanism of the plugin, that

prevent you to use these libraries. You can see this by right-clicking on your

project package and navigate to:

[SIZE=2]==> Properties ==> Java Build Path ==> Libraries (tab) [/SIZE]
[SIZE=2]--> Android 2.x.x --> android.jar [/SIZE]
[SIZE=2]--> "Access rules: 1 rule defined": [B][COLOR=Red](X)[/COLOR][/B] [B]Forbidden: com/android/internal/**[/B][/SIZE]

This can not be removed (bug?), even though the interface allows changing, it

never persists after closing the Properties window. So we have to hack it!

The way to do it, is to hexedit the correct java class file and change the

name from "internal" to "internax". First let's find the correct file. The

plugin file is located in the ./eclipse/plugins/ directory, and its name is

something like:

com.android.ide.eclipse.adt_18.0.0.v201203301601-306762.jar

(a) make a backup copy of this (with the exact name preserved) in another directory.

(b) make a another copy of this in another directory.

(c) unzip (b) in that directory

[SIZE=2]cp com.android.ide.eclipse.adt_18.0.0.v201203301601-306762.jar hacked_adt.zip[/SIZE]
[SIZE=2]unzip hacked_adt.zip[/SIZE]
[SIZE=2]cd hacked_adt[/SIZE]

This is a huge directory system, so forget poking around in it,

just go to the correct sub-directory:

[SIZE=2]cd ./com/android/ide/eclipse/adt/internal/project/[/SIZE]

Then find the correct file and the approximate string location within that file:

[SIZE=2]strings.exe -f -4 -t x ./*.class |grep "android\/internal"[/SIZE]

It happens to be in "AndroidClasspathContainerInitializer.class". Now, use a

hexeditor to find and change the string "com/android/internal/**"

to "com/android/internax/**". That will do it!

Now zip-up your hacked jar directory and copy it over the old one.

(Remember that "cp" overwrites without warning!)

[SIZE=2]zip hacked_adt[/SIZE]
[SIZE=2]cp hacked_adt.zip /path/to/eclipse/plugins/com.android.ide.eclipse.adt_18.0.0.v201203301601-306762.jar[/SIZE]

You Are Done!

Enjoy your newly hacked Eclipse!
​

Errors

If you get any errors;

1. make sure you have zipped up everything properly as warned before.

2. make sure you have included Google API packages in your BOOTCLASSPATH in step (3).

3. Try to "clean-up" the Java by: "Right-Click" ==> Source ==> "Clean Up...".

4. Google them

5. Ignore them

6. Give up. Not! But I can't help you!

If it still doesn't work, try to download inazaruk's pre-compiled set of internal android.jar's from here.

(For android 7,8,10,15.)

​