[Android Software/Hacking General [Developers Only]] linuxct:
Pixel Launcher O-3743572​

​

​

Tamper the app with a new signature and/or code modifications you need, preferably using latest Google's Framework, if possible. This will make the app crash (forced by Google Play Services).

Grab a logcat of the crash. It'll show a code similar to this.

05-18 22:23:14.104 13300 13300 E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.google.android.apps.nexuslauncher
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1620)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1573)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: [B]at com.google.android.gms.common.internal.p.zza(Unknown Source)[/B]
05-18 22:23:14.104 13300 13300 E AndroidRuntime: [B]at com.google.android.gms.common.internal.y.eU(Unknown Source)[/B]
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at com.google.android.gms.internal.cr.wV(Unknown Source)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at com.google.android.gms.internal.bO.run(Unknown Source)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at com.google.android.gms.internal.bj.run(Unknown Source)
05-18 22:23:14.104 13300 13300 E AndroidRuntime: at java.lang.Thread.run(Thread.java:818)
05-18 22:23:14.105 2070 3515 W ActivityManager: Force finishing activity com.google.android.apps.nexuslauncher/.NexusLauncherActivity

Pay attention to the first two lines that mention com.google.android.gms inside the stacktrace, as we will need to check them later. We need to check those two since the first one presents many references called zza.

Now, we are going to locate the part of the code we need to "destroy" in order to locate the class that calls those functions. This is needed because, as explained, there are many methods called the same way in our code, but with different headers. If the method only appeared once, like in Gmail example, we don't need to do this. But, since it does,

Navigate to the folder that contains the mentioned files. According to the stacktrace, the route should be something like smali/com/google/android/gms/common/internal. With an advanced text editor, like Atom, Notepad++, Kate, etc., open the file mentioned in the second line that contains com.google.android.gms inside the stacktrace. In this case, y.smali.

The part that goes after the last dot inside the stacktrace lines are called methods. Inside the file you've opened, try to search for the method that is referenced in the first line in the stacktrace that mentions com.google.android.gms, which in this case is "zza".

You'll see that, right after the method we've searched for, there is another class mentioned in it, between parenthesis (in fact, it's the header of the method we're trying to find). Copy everything until you see the semicolon that means the end of it. In this case looks like this

Lcom/google/android/gms/common/internal/zzt;Lcom/google/android/gms/common/internal/GetServiceRequest

Now open the file mentioned in the first line that contains com.google.android.gms inside the stacktrace, which in this case is p.smali.

Inside the file you've just opened, try to search for the method header that you just copied from the other class. There should appear 1 single result.

Once you're finally in this method, you have to "destroy" it. What I did was just changing a const/4 value I found in it from 0x0 to 0x1, and it was more than enough to make my phone reject the class (which is what we're looking for). In case there aren't any const/4 values, you can also cut and paste some portions of the code to a new text document and that will also make our phone reject the class (but, if you do so, please be careful not to lose them and remember the exact spot they were located, since we will need to put them back later).

Using Apktool, build the application, sign it and install it in your device. If Apktool rejects to build the code, try changing other parts as explained in the point above.

Grab a new logcat of the crash. It will look something like this.

05-18 22:38:13.749 13541 13541 E AndroidRuntime: java.lang.VerifyError: Rejecting class com.google.android.gms.common.internal.p because it failed compile-time verification (declaration of 'com.google.android.gms.common.internal.p' appears in /data/app/com.google.android.apps.nexuslauncher-1/base.apk)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at [B]com.google.android.gms.common.internal.zzu$zza.zzha[/B](Unknown Source)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at com.google.android.gms.common.internal.f.onServiceConnected(Unknown Source)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at com.google.android.gms.common.internal.A.onServiceConnected(Unknown Source)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher.doConnected(LoadedApk.java:1224)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher$RunConnection.run(LoadedApk.java:1241)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:739)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at android.os.Looper.loop(Looper.java:148)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:5461)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
05-18 22:38:13.749 13541 13541 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
05-18 22:38:13.751 2070 3026 W ActivityManager: Force finishing activity com.google.android.apps.nexuslauncher/.NexusLauncherActivity

Pay attention to the first line of the stacktrace that mentions com.google.android.gms. Thankfully, there was another class/method just before onServiceConnected, so we are lucky to edit it.

Navigate to the folder in which the file is located. In this case, it'll look something like smali/com/google/android/gms/common/internal. Now, open the file mentioned in the stacktrace, which in this case is zzu$zza.smali (as you can see in this example, it can contain a dollar symbol in it).

Find the method referenced in the stacktrace (which could be the first method in the entire class, or even the only one). In my case, it's "zzha".

Inside the method, there are conditional tags, that look something like :cond_X, where X is a number. Find the conditional tag that, right below it, has just a return-object v0, in case it exist. In my case it exists, and it's :cond_1. Inside the method, you will see that there are sentences like if-eqz and if-nez, which make the application jump inside to a :cond_X tag if a variable contains zero in the first case, of if it doesn't contain a zero, like in the second case. Find the if-eqz or if-nez sentence that involves jumping to the :cond_X tag you just located. In my case the line looks something like this

if-eqz p0, :cond_1

Now that the line is located, change the kind of operation it does. If it's doing a if-eqz like in my case, change it to a if-nez. If it's doing a if-nez, change it to if-eqz. This will make the application jump and exit the code

(As another solution, you can remove the entire method, and just leave the generation of const/4 v0, 0x0 and the return-object v0. I'm not sure if, at this point, it will reject the class or not, but it can also be a solution if the above doesn't work).

Undo the changes you did before you recompiled the code, so you need to go back to the class you "destroyed" and put it back just as it was before (if you didn't close the text editor before, you can always Control+Z it ;))

Recompile, sign and try if it works. I hope it does ;)

The workspace with the changes made is attached as reference.