[Android Software/Hacking General [Developers Only]] linuxct:
Gmail 7.5.7.156101332.release​

​

​

The procedure was very similar to the Pixel Launcher one, but some small parts changed.

Keep in mind, you won't be able to log-in with your Google account, but you can still use it for IMAP/POP3, Exchange and ActiveSync accounts.

Tamper the app and grab a log as explained for the Pixel Launcher.

05-18 23:47:35.127 14275 14275 E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.google.android.gm
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1620)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1573)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at [B]fqn.a[/B](Unknown Source)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at fox.a(Unknown Source)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at gpd.a(Unknown Source)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at gph.run(Unknown Source)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at gah.run(Unknown Source)
05-18 23:47:35.127 14275 14275 E AndroidRuntime: at java.lang.Thread.run(Thread.java:818)
05-18 23:47:35.128 2070 2951 W ActivityManager: Force finishing activity com.google.android.gm/.welcome.SetupAddressesActivity
05-18 23:47:35.132 2070 2951 W ActivityManager: Force finishing activity com.google.android.gm/.welcome.WelcomeTourActivity

As you can see, the files are not in folders but left outside, in the root of the Smali folder, which probably happens due to a missing framework in Apktool. That however, won't affect the rest of the tutorial.

Since the very first file that appears in logcat's crash only contains 1 single method, we don't need to locate it like we did on the Pixel Launcher, so we can go to it directly.

Open the file mentioned in the stacktrace and then, "destroy" the method that is referenced in it. In this case, the file fqn.smali, method a. (This time, there was no const/4 to change but removing the two first invoke-static and move-result-object lines totally did the trick for me).

Recompile, sign and install. Grab a log and check the first line where it crashes.

05-18 23:49:59.857 14406 14406 E AndroidRuntime: java.lang.VerifyError: Rejecting class fqn because it failed compile-time verification (declaration of 'fqn' appears in /data/app/com.google.android.gm-1/base.apk)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at [B]fpf.onServiceConnected[/B](Unknown Source)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at fpz.onServiceConnected(Unknown Source)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher.doConnected(LoadedApk.java:1224)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher$RunConnection.run(LoadedApk.java:1241)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:739)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at android.os.Looper.loop(Looper.java:148)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:5461)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
05-18 23:49:59.857 14406 14406 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)

As you can see, unfortunately there is no class preceding the onServiceConnected methods, like there was in the Pixel Launcher, so we need to edit them directly.

Open the first file mentioned in the stacktrace, and locate the onServiceConnected method.

Inside it, we need to find where it calls the class we "destroyed" before, which in this case is named "fqn".

Check the name of the conditional tag :cond_X that appears right above. In this case, it is under :cond_2.

Find all the if-eqz and if-nez sentences that do redirect to the :cond_X you've found, and invert them, from if-eqz to if-nez, and from if-nez to if-eqz.

If the class name appears several times, repeat this for all the conditional tags that contain it.

Undo the changes you did to the "destroyed" class (in this case, fqn.smali).

Recompile, sign and try if it works. I hope it does ;)

The workspace with the changes made is attached as reference.