[Android Software/Hacking General [Developers Only]] linuxct:
Android Messages 2.2.075 (4023518-30.phone)​

​

​

If you didn't understand quite well the procedure for the Pixel Launcher, here's a similar one.

Tamper the app and grab a log as explained for the Pixel Launcher, above.

06-01 11:12:09.077 17538 17538 E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.google.android.apps.messaging
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1620)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at android.os.Parcel.readException(Parcel.java:1573)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at [B]com.google.android.gms.common.internal.zzv$zza$a.zza[/B](Unknown Source)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at [B]com.google.android.gms.common.internal.zzf.a[/B](Unknown Source)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at com.google.android.gms.internal.cn$c.a(Unknown Source)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at com.google.android.gms.internal.cn$f.run(Unknown Source)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
06-01 11:12:09.077 17538 17538 E AndroidRuntime: at com.google.android.gms.internal.o.run(Unknown Source)

If you have a glance at the first class mentioned that contains com.google.android.gms in it's name, you will see, like in the Pixel launcher, the first class that appears in the stacktrace presents various methods named the same way, in this case there are only two but we have no idea which one is used, so we will find it via the second class mentioned in the stacktrace.

Just like for the Pixel Launcher, we are going to locate the method we need to destroy by using the second file that appears in the stacktrace.

Navigate to the folder that contains the mentioned files. According to the stacktrace, the route should be something like smali/com/google/android/gms/common/internal. With an advanced text editor, like Atom, Notepad++, Kate, etc., open the file mentioned in the second line that contains com.google.android.gms inside the stacktrace. In this case, zzf.smali.

The part that goes after the last dot inside the stacktrace lines are called methods. Inside the file you've opened, try to search for the method that is referenced in the first line in the stacktrace that mentions com.google.android.gms, which in this case is "zzv".

However, unlike in the Pixel Launcher example, there are many references to zzv in our class, so we need to find the ones that are calling to zza (if you remember, the class is called "zzv$zza$a", so we will take advantage of that).

Now, try to find the occurrence in the search that has in the same line both "zzv" and "zza". You'll see they are joined by a ";->", so to short things out, you can search for "zzv;->zza".

You'll see that, right after the method we've searched for, there is another class mentioned in it, between parenthesis (in fact, it's the header of the method we're trying to find). Copy everything until you see the semicolon that means the end of it. In this case looks like this

Lcom/google/android/gms/common/internal/zzu;Lcom/google/android/gms/common/internal/r

Now open the file mentioned in the first line that contains com.google.android.gms inside the stacktrace, which in this case is zzv$zza$a.smali.

Inside the file you've just opened, try to search for the method header that you just copied from the other class. There should appear 1 single result.

Once you're finally in this method, you have to "destroy" it. In this case, the file fqn.smali, method zza(Lcom/google/android/gms/common/internal/zzu;Lcom/google/android/gms/common/internal/r;). Since there aren't any const/4 values, you can also cut and paste some portions of the code to a new text document and that will also make our phone reject the class (but, if you do so, please be careful not to lose them and remember the exact spot they were located, since we will need to put them back later).

Using Apktool, build the application, sign it and install it in your device. If Apktool rejects to build the code, try changing other parts as explained in the point above.

Grab a new logcat of the crash. It will look something like this.

06-01 11:17:25.822 18229 18229 E AndroidRuntime: java.lang.VerifyError: Rejecting class com.google.android.gms.common.internal.zzv$zza$a because it failed compile-time verification (declaration of 'com.google.android.gms.common.internal.zzv$zza$a' appears in /data/app/com.google.android.apps.messaging-2/base.apk)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at [B]com.google.android.gms.common.internal.zzv$zza.zzdf[/B](Unknown Source)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at com.google.android.gms.common.internal.zzf$g.onServiceConnected(Unknown Source)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at com.google.android.gms.common.internal.w$b$a.onServiceConnected(Unknown Source)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher.doConnected(LoadedApk.java:1224)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at android.app.LoadedApk$ServiceDispatcher$RunConnection.run(LoadedApk.java:1241)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:739)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at android.os.Looper.loop(Looper.java:148)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:5461)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:726)
06-01 11:17:25.822 18229 18229 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:616)

Pay attention to the first line of the stacktrace that mentions com.google.android.gms. Thankfully, and just like for the Pixel Launcher, there was another class/method just before onServiceConnected, so we are lucky to edit it. Rest of the steps proceed just as the Pixel Launcher.

Navigate to the folder in which the file is located. In this case, it'll look something like smali/com/google/android/gms/common/internal. Now, open the file mentioned in the stacktrace, which in this case is zzv$zza.smali.

Find the method referenced in the stacktrace (which could be the first method in the entire class, or even the only one). In my case, it's "zzdf".

Inside the method, there are conditional tags, that look something like :cond_X, where X is a number. Find the conditional tag that, right below it, has just a return-object v0, in case it exist. In my case it exists, and it's :cond_1. Inside the method, you will see that there are sentences like if-eqz and if-nez, which make the application jump inside to a :cond_X tag if a variable contains zero in the first case, of if it doesn't contain a zero, like in the second case. Find the if-eqz or if-nez sentence that involves jumping to the :cond_X tag you just located. In my case the line looks something like this

if-eqz p0, :cond_1

Now that the line is located, change the kind of operation it does. If it's doing a if-eqz like in my case, change it to a if-nez. If it's doing a if-nez, change it to if-eqz. This will make the application jump and exit the code

(As another solution, you can remove the entire method, and just leave the generation of const/4 v0, 0x0 and the return-object v0. I'm not sure if, at this point, it will reject the class or not, but it can also be a solution if the above doesn't work).

Undo the changes you did before you recompiled the code, so you need to go back to the class you "destroyed" and put it back just as it was before (if you didn't close the text editor before, you can always Control+Z it ;))

Recompile, sign and try if it works. I hope it does ;)

The workspace with the changes made is attached as reference.