[Connected Car] donaldta:
Alright, I used the bash script and java project to create their own APK that exploits bug# 8219321 to try and install getiem's package from the SCT into the AVD.

C:\>adb install -r apk\Masterkey\evil-Android-Package_installer_2.3.3.apk
99 KB/s (3207260 bytes in 31.530s)
pkg: /data/local/tmp/evil-Android-Package_installer_2.3.3.apk
Success

C:\>adb shell
# ls /*/app/*ackage*
ls /*/app/*ackage*
/data/app/com.android.packageinstaller-1.apk
/system/app/PackageInstaller.apk
# exit
exit

As you can see the original package installer from the ROM remains in "/system/app" while its replacement is installed in "/data/app". Let's see what happens when we try installing over it.

C:\>adb install apk\Masterkey\MasterKeysModded-Package_installer_2.3.3.apk
170 KB/s (177388 bytes in 1.014s)
pkg: /data/local/tmp/MasterKeysModded-Package_installer_2.3.3.apk
Failure [INSTALL_FAILED_ALREADY_EXISTS]

C:\>adb install -r apk\Masterkey\MasterKeysModded-Package_installer_2.3.3.apk
83 KB/s (177388 bytes in 2.065s)
pkg: /data/local/tmp/MasterKeysModded-Package_installer_2.3.3.apk
Success

C:\>adb shell
# ls /*/app/*ackage*
ls /*/app/*ackage*
/data/app/com.android.packageinstaller-2.apk
/system/app/PackageInstaller.apk
# exit
exit

Now, the "update's filename" has incremented by 1 while the original version remains in place.

Originally, I wanted to test see if I could replicate the problem on SCT using its Package Installer. However, as you can see below, I am still able to install Framaroot using the modified Asteroid Messenger package. So, this could mean the problem isn't with the updated Package Manager itself but possibly an updated kernel module or library.

C:\>adb install apk\Masterkey\MasterKeysModded-ASTEROID_Messenger_1.100.53.apk
495 KB/s (4237292 bytes in 8.357s)
pkg: /data/local/tmp/MasterKeysModded-ASTEROID_Messenger_1.100.53.apk
Success

Additionally, I was not able to install ES File Explorer using the modified Maps APK. It appears that the zip file isn't valid.

C:\>adb install apk\Masterkey\MasterKeysModded-Maps_100.0.24.apk
Whoops: didn't find expected signature
read_central_directory_entry failed
file 'apk\Masterkey\MasterKeysModded-Maps_100.0.24.apk' is not a valid zip file
rm failed for /data/local/tmp/MasterKeysModded-Maps_100.0.24.apk, No such file or directory

C:\>

I'm going to have to figure out why that is.

---------- Post added at 07:14 PM ---------- Previous post was at 06:24 PM ----------

Okay, I figured it out. I was overconfident in the command response that I overlooked testing it. My apologizes that was my mistake. The problem is with ESFileExplorer_122 package. I tried it with many different packages and both as the concealer and the concealed. It seems that the problem is that the package has way too many enteries to maintain a valid zip structure while exploiting bug# 9695860.

root@Microknoppix:/home/knoppix/Downloads# java -jar /usr/local/bin/AndroidMasterKeys.jar -b -a Maps_100.0.24.apk -z ESFileExplorer_122.apk
root@Microknoppix:/home/knoppix/Downloads# zip -T MasterKeysModded-Maps_100.0.24.apk
zip warning: expected 1026 entries but found 1815

zip error: Zip file structure invalid (MasterKeysModded-Maps_100.0.24.apk)
root@Microknoppix:/home/knoppix/Downloads#

So, to overcome this, I remerged an older version, ES File Explorer v1.6.2.5 (which was available from the developer's website) to hide inside Parrot's Maps APK.

root@Microknoppix:/home/knoppix/Downloads# java -jar /usr/local/bin/AndroidMasterKeys.jar -b -a Maps_100.0.24.apk -z ES_File_Explorer_V1.6.2.5.apk
root@Microknoppix:/home/knoppix/Downloads# zip -T MasterKeysModded-Maps_100.0.24.apk
test of MasterKeysModded-Maps_100.0.24.apk OK
root@Microknoppix:/home/knoppix/Downloads#

And finally...

C:\>adb install apk\Masterkey\MasterKeysModded-Maps_100.0.24.apk
214 KB/s (3634991 bytes in 16.524s)
pkg: /data/local/tmp/MasterKeysModded-Maps_100.0.24.apk
Success

C:\>

I will update the original thread/attachment, so the invalid version can't be used again.