[General Questions and Answers] f0k:
Renaming the package did not help, but this time I started adb logcat directly after adb reboot, and found something relevant that came up early in the boot process:

I/PackageManager( 291): /system/app/BackupRestoreConfirmation-1.apk changed; collecting certs
I/dalvikvm( 291): DexOpt: mismatch dep signature for '/system/framework/core.odex'
E/dalvikvm( 291): /system/app/BackupRestoreConfirmation-1.apk odex has stale dependencies
E/dalvikvm( 291): odex source not available -- failing
W/PackageManager( 291): StaleDexCacheError when reading apk: /system/app/BackupRestoreConfirmation-1.apk
W/PackageManager( 291): dalvik.system.StaleDexCacheError: /system/app/BackupRestoreConfirmation-1.apk
W/PackageManager( 291): at dalvik.system.DexFile.isDexOptNeeded(Native Method)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.performDexOptLI(PackageManagerService.java:3080)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.scanPackageLI(PackageManagerService.java:3634)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.scanPackageLI(PackageManagerService.java:2963)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.scanDirLI(PackageManagerService.java:2775)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:1066)
W/PackageManager( 291): at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:837)
W/PackageManager( 291): at com.android.server.ServerThread.run(SystemServer.java:167)
D/PackageManager( 291): No files in app dir /vendor/app

So if I interpret this correctly, there really is a problem with the signatures. Just out of curiosity, I tried whether apps in /vendor/app would be treated differently. I created /vendor/app, moved the .apk and .odex there and rebooted, but get the same error just with different paths.

Some googling informs me that this is probably because the /system/framework/core.odex on my device is not the same as the framework/core.odex in the sysimg I took the odexed BackupRestoreConfirmation.apk from.

From https://android.googlesource.com/pl...roid-4.2.2_r1/vm/analysis/DexPrepare.cpp#1142, it seems it would be trivial to just go ahead and replace the signatures of all dependencies in BackupRestoreConfirmation.odex (with a hexdump, I can see there are nine dependencies). Is the .odex signed to catch such a modification, or would it pass through? And how would I obtain the SHA-1 signatures from the source DEX files? My device apparently knows them.

/edit: They're part of the .odex header, the signature is at offset 0x34 and has 20 bytes, so I could copy out the SHA-1 signatures from the dependencies on my phone and implant them in BackupRestoreConfirmation.odex. But that signature check will be there for a reason, I assume the .odex will point at specific offsets in its dependencies and crash if the dependencies are not the original ones.

So I will either have to recompile BackupRestoreConfirmation.apk from source with WITH_DEXPREOPT=0 or to deodex the compiled one, so I don't need a .odex file at all.

I'm learning a lot more about the internals of Android than I ever intended to :D