[Android Software/Hacking General [Developers Only]] linuxct:
Bypass Google's Signature Check​

​

mod any Google application on your own and bypass Google GMS' signature checks!​

Hello everyone,

After the Pixel Launcher Backport success, today I wanted to share a little bit more on how I bypassed Google's Signature Check, in order to get it working after modding and re-signing it with my own key. Please, do keep in mind that Google's signature checks have nothing to do with standard Android systems keychecking, as those just validate the package is using a valid signature. However, Google's signature check is based on GMS, the commonly named Google Play Services framework, and ensures the application hasn't been previously tampered. For now, this is something (as far as I could see) only present in Google's own apps, but I see it could easily extend to other apps in the future.

However, be warned that by doing the following, the app you're using will believe there's no Google Account linked to your device, and thus will ask you to add it. And even if you add it, it will still not work, since this breaks the link between GMS and the app that's being modded. Keep also in mind that it won't work with all apps providing this reason.

This thread will be composed of: a brief explanation on what's going on, what knowledge you need, what we will do, explained in a brief way (which will be the first post), and many, MANY examples I've prepared for you to understand it, as I've seen it's not enough with just two.

#include <std/disclaimer.h>
/* No, your warranty doesn't need to be voided!
* The following tutorial will be used exclusively for educational purposes.
* It shall never be used to modify legitimate apps in malicious ways,
* to distribute malware, spyware and such.
*
* The intention is to open the doors to small developers that want to
* theme or add functionality to other apps, but face the Google Signature
* Check problem. Feel free to add suggestions in the comments.
* Oh, and... Sorry Google :P
*/

What you will need:

Medium knowledge of Android's SMALI: Control structures, methods, classes... (basically Java, but ugly :p), decompilation of applications, signing applications, etc.

A work environment: Java JDK, APKtool by [MENTION=3924617]iBotPeaches[/MENTION] or any other similar tool that supplies baksmali and smali functionality (you can use vanilla JesusFreke's tools too, if you really want to).

Knowledge of Android's logcat: You'll be working with stacktraces and apps giving FCs (Force close) during the tutorial, so you need to know how to find/grab, open, interpret them, and know how to locate something in them.

An application that presents the Google Signature Check crash when you try to open after tampering it. For example:

05-18 10:57:13.561 9540 9540 E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.google.android.apps.nexuslauncher
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1620)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1573)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at com.google.android.gms.common.internal.o.zza(Unknown Source)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at com.google.android.gms.common.internal.x.fs(Unknown Source)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at com.google.android.gms.internal.cy.yQ(Unknown Source)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at com.google.android.gms.internal.bQ.run(Unknown Source)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at com.google.android.gms.internal.bk.run(Unknown Source)
05-18 10:57:13.561 9540 9540 E AndroidRuntime: at java.lang.Thread.run(Thread.java:818)
05-18 10:57:13.562 2070 2952 W ActivityManager: Force finishing activity com.google.android.apps.nexuslauncher/.NexusLauncherActivity

A WERKIN BRAIN ECKSDEE Meeting the above, I'm sure you already had that.

What are the steps? (briefly explained):

Decompile the application, then tamper it by resigning it with our own key or by adding any modifications you need to it.

Grab a log of what went wrong. Read it and locate the first class after the readException errors. The submethod reference is the one we need to "destroy" in order to know what class is actually invoking the signature verification.

Destroy the method in a way that it's still compilable, but will refuse to work on our phone.

Recompile, sign, install and check the logs it throws. Go to the class/method that is referenced right after the class rejection error, edit it in a way that makes it not to check the signature of the package.

Restore the "destroyed" method to it's original state. Recompile, sign, push, test, test and test a trillion times. If it works, then feel free to publish it.

However, during these steps you can find different situations. For instance:

The classes appear in the root of the smali folder named alphabetically, instead of their respective folders. This happens in: Gmail, YouTube...

The first method (the one you needed to "destroy") that you located in the stacktrace is present in that class over a million times, so you need to check the previous classes in the stacktrace to see the full header of the method where it's actually calling. This happens in: Pixel Launcher, Android Messages...

Once the class is destroyed, the first method that appears in the stacktrace is a onServiceConnected, which is harder to mod than if there was any other before it. This happens in: Gmail, YouTube...

Classification of the thread's posts

2nd post: Pixel Launcher O-3743572

3rd post: Android Messages 2.2.075 (4023518-30.phone)

4th post: Gmail 7.5.7.156101332.release

5th post: YouTube 12.19.56

And a few last words before getting to the thing:

I ain't asking for donations, because I really don't need them this time. This is (one of) my hobby, and I don't mind spending time (endless hours) on making high quality threads and explanations. However, if you really feel like I deserve it, you're free to donate, here. (Or you can also leave Thanks!)