[Android Software/Hacking General [Developers Only]] linuxct:
YouTube 12.19.56-1219563300​

​

​

Another one, very similar to Gmail example above.

Keep in mind, you won't be able to log-in with your Google account, but you can still play back any videos you want.

Tamper the app and grab a log as explained for the Pixel Launcher.

06-01 10:56:51.180 16805 16805 E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.google.android.youtube
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1620)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1573)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at [B]jsb.a[/B](Unknown Source)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at jqo.a(Unknown Source)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at kgs.a(Unknown Source)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at kgw.run(Unknown Source)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at kiu.run(Unknown Source)
06-01 10:56:51.180 16805 16805 E AndroidRuntime: at java.lang.Thread.run(Thread.java:818)
06-01 10:56:51.181 6035 6346 W ActivityManager: Force finishing activity com.google.android.youtube/com.google.android.apps.youtube.app.WatchWhileActivity

As you can see, once again the files are not in folders but left outside, in the root of the Smali folder, which probably happens due to a missing framework in Apktool.

Since the very first file that appears in logcat's crash only contains 1 single method, we don't need to locate it like we did on the Pixel Launcher, so we can go to it directly.

Open the file mentioned in the stacktrace and then, "destroy" the method that is referenced in it. In this case, the file jsb.smali, method a. (Once again, there was no const/4 to change but removing the two first invoke-static and move-result-object lines totally did the trick for me).

Recompile, sign and install. Grab a log and check the first line where it crashes.

06-01 11:00:57.877 16985 16985 E AndroidRuntime: java.lang.VerifyError: Rejecting class jsb because it failed compile-time verification (declaration of 'jsb' appears in /data/app/com.google.android.youtube-2/base.apk)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at [B]jqw.onServiceConnected[/B](Unknown Source)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at jrq.onServiceConnected(Unknown Source)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher.doConnected(LoadedApk.java:1224)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher$RunConnection.run(LoadedApk.java:1241)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:739)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at android.os.Looper.loop(Looper.java:148)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:5461)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
06-01 11:00:57.877 16985 16985 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)
06-01 11:00:57.878 6035 8017 W ActivityManager: Force finishing activity com.google.android.youtube/com.google.android.apps.youtube.app.WatchWhileActivity

As you can see, once again there is no class preceding the onServiceConnected methods, like there was in the Pixel Launcher, so we need to edit them directly.

Open the first file mentioned in the stacktrace, "jqw.smali", and locate the onServiceConnected method.

Inside it, we need to find where it calls the class we "destroyed" before, which in this case is named "jsb".

Check the name of the conditional tag :cond_X that appears right above. In this case, it is under :cond_2.

Find all the if-eqz and if-nez sentences that do redirect to the :cond_X you've found, and invert them, from if-eqz to if-nez, and from if-nez to if-eqz.

If the class name appears several times, repeat this for all the conditional tags that contain it.

Undo the changes you did to the "destroyed" class (in this case, jsb.smali).

Recompile, sign and try if it works. I hope it does ;)

The workspace with the changes made is attached here as reference.