[Android General] BlackMesa123:
Fully spoof signature check Guide

So I already know there are tons of guides for disable/spoof signature check, but I decided to share my vision of it since I've even been able to resign apks with a different key and without issues (S9+ base, G965FXXS1ARD1), let's start.

First of all you need a custom build of smali/baksmali since the current latest version of the official tool doesn't supports latest DexCode version used in Oreo, so if you try to decompile/recompile core-oj with it, you will face a bootloop caused from baksmali/smali tool that can't decode new Oreo opcodes (invoke-polymorphic). Latest build of SmaliEx supports new Oreo opcodes and can decode them without any issue, so use that one to decode/encode your .dex files (make sure you add -a 26 on the cmd of both baksmali/smali when decoding/encoding your dex files). Once you've setup the tool, decode both "classes.dex" files of core-oj.jar and services.jar frameworks.

core-oj:

- Open /java/security/MessageDigest.smali class and search for isEqual([B[B) method, you'll find something like this:

.method public static isEqual([B[B)Z
.locals 6

const/4 v2, 0x1

const/4 v3, 0x0

if-ne p0, p1, :cond_0

return v2

...

goto :goto_1
.end method

You have to make sure the method always returns 1/true, replace the whole method code inside to this:

.method public static isEqual([B[B)Z
[COLOR="Blue"] .locals 1

const/4 v0, 0x1

return v0[/COLOR]
.end method

- Open /java/security/Signature.smali class and search for verify([B) and verify([BII) methods, you'll find something like this:

.method public final verify([B)Z
.locals 2
.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/security/SignatureException;
}
.end annotation

iget v0, p0, Ljava/security/Signature;->state:I

...

throw v0
.end method

.method public final verify([BII)Z
.locals 2
.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/security/SignatureException;
}
.end annotation

iget v0, p0, Ljava/security/Signature;->state:I

...

throw v0
.end method

Like before, both methods needs to return 1, so replace them as the following:

.method public final verify([B)Z
[COLOR="blue"] .locals 1[/COLOR]
.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/security/SignatureException;
}
.end annotation

[COLOR="Blue"] const/4 v0, 0x1

return v0[/COLOR]
.end method

.method public final verify([BII)Z
[COLOR="blue"] .locals 1[/COLOR]
.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/security/SignatureException;
}
.end annotation

[COLOR="Blue"] const/4 v0, 0x1

return v0[/COLOR]
.end method

- Open /sun/security/util/SignatureFileVerifier.smali class and search for verifyManifestHash method, you'll find something like this:

.method private verifyManifestHash(Ljava/util/jar/Manifest;Lsun/security/util/ManifestDigester;Ljava/util/List;)Z
.locals 12
.annotation system Ldalvik/annotation/Signature;
value = {
"(",

...

:cond_2
return v5
.end method

Same as before, always returns 1/true, so again replace the whole method code inside to this:

.method private verifyManifestHash(Ljava/util/jar/Manifest;Lsun/security/util/ManifestDigester;Ljava/util/List;)Z
[COLOR="Blue"] .locals 1[/COLOR]
.annotation system Ldalvik/annotation/Signature;
value = {
"(",
"Ljava/util/jar/Manifest;",
"Lsun/security/util/ManifestDigester;",
"Ljava/util/List",
"<",
"Ljava/lang/Object;",
">;)Z"
}
.end annotation

.annotation system Ldalvik/annotation/Throws;
value = {
Ljava/io/IOException;,
Ljava/security/SignatureException;
}
.end annotation

[COLOR="Blue"] const/4 v0, 0x1

return v0[/COLOR]
.end method

services.jar:

- Open /com/android/server/pm/PackageManagerService.smali class and search for compareSignatures method, you'll find something like this:

.method static compareSignatures([Landroid/content/pm/Signature;[Landroid/content/pm/Signature;)I
.locals 8

const/4 v3, 0x1

...

:cond_8
return v5
.end method

Here instead of core-oj methods, you have to make sure the method always returns 0/false, so replace the whole method code inside to this:

.method static compareSignatures([Landroid/content/pm/Signature;[Landroid/content/pm/Signature;)I
[COLOR="Blue"] .locals 1

const/4 v0, 0x0

return v0[/COLOR]
.end method

- Optional for installing Old App Versions Over Newer:

Open /com/android/server/pm/PackageManagerService$InstallParams.smali class and search for installLocationPolicy method, you'll find something like this:

.method private installLocationPolicy(Landroid/content/pm/PackageInfoLite;)I
.locals 14

const/4 v13, 0x2

...

return v10
.end method

Now search for "PackageManagerException" string, you'll get something like this:

...

move v1, v7

:goto_3
if-nez v1, :cond_1

:try_start_1
invoke-static {v0, p1}, Lcom/android/server/pm/PackageManagerService;->-wrap35(Landroid/content/pm/PackageParser$Package;Landroid/content/pm/PackageInfoLite;)V
:try_end_1
.catch Lcom/android/server/pm/PackageManagerException; {:try_start_1 .. :try_end_1} :catch_0
.catchall {:try_start_1 .. :try_end_1} :catchall_0

...

All you have to do is replace the "if-nez" before try-catch block to "if-eqz", like this:

...

move v1, v7

:goto_3
[COLOR="Blue"] if-eqz v1, :cond_1[/COLOR]

:try_start_1
invoke-static {v0, p1}, Lcom/android/server/pm/PackageManagerService;->-wrap35(Landroid/content/pm/PackageParser$Package;Landroid/content/pm/PackageInfoLite;)V
:try_end_1
.catch Lcom/android/server/pm/PackageManagerException; {:try_start_1 .. :try_end_1} :catch_0
.catchall {:try_start_1 .. :try_end_1} :catchall_0

...

Now recompile your decoded classes.dex files, put them on their respective jars and push the edited jar to your phone. If all the edits has been done correctly system will boot and you'll be able to decompile/recompile and resign with whatever sign key the apks you want!

Credits to [MENTION=4658360]corsicanu[/MENTION], [MENTION=3096129]one_love_420[/MENTION], [MENTION=4645794]CNexus[/MENTION], [MENTION=1042140]tdunham[/MENTION] and [MENTION=4507636]edzamber[/MENTION], you can find his original MM guide to disable sign check here