[Android Q&A, Help & Troubleshooting] tablet_seeker:
Introduction/Goal:​

Hello everyone!

I am a long time subscribed user of and investor in Squid, an awesome note taking app.

The project is largely supported by the open source community and was originally meant to be a free alternative to Samsung Notes.

They are struggling with websites who offer APK versions of the app, which have been modified to unlock Premium features which normally require a paid subscription.

I want to figure out what modifications have been made to the APK (with unlocked premium), so that the weakness can be understood and patched.

I know a little bit of java but can't claim to fully understand any of this. Some help would be greatly appreciated.

Thanks!

Files/Attachments:​

APK:​

Both APK versions are attached:

Original APK: com.steadfastinnovation.android.projectpapyrus_3.9.3.4-GP-3090304_minAPI21(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk

Modified APK: Squid-Premium-v3.9.3.4-GP_build_3090304-Mod-armeabi-v7aarm64-v8ax86x86_64.apk

Download Links:

Original (APKMirror): https://www.apkmirror.com/apk/stead...arkup-pdfs-3-9-3-4-gp-2-android-apk-download/

Modified (APKCAP): https://apkcap.org/squid-take-notes-markup-pdfs-v3-9-3-4-gp-premium-apk-mod/

Diff Files:​

Complete diff (containing all changes/differences)​

I have extracted the Smali Code of both APKs and analyzed the differences with two linux programs called "diff" and "kompare" (graphical version of diff).

squid_diff_unified.patch: Unified diff Format (attached)

squid_diff_normal.patch: Normal diff Format (attached)

​

Summary of most important code changes/differences​

A codensed summary of the most important code changes/differences.

"<" marks the lines present in the original APK (on top)

">" marks the changed lines in the modified APK (below)

If either "<" or "> is missing, it means that the lines are not present in the opposing APK

code_diff.txt (attached)

90% of all differences in the code are countless instances of ".line1", ".line2", ".line3", ".line4", ".line5"..... which are present in the original APK and have been removed in the modified version.

Example pic:

Analysis:​

Being an amateur I am limited in my understanding of the code changes, but there are a few things that stood out.

Here is the summarized version of the most important code changes:

"<" marks the lines present in the original APK (on top)

">" marks the changed lines in the modified APK (below)

If either "<" or "> is missing, it means that the lines are not present in the opposing APK

File path of extracted original APK: original/smali

File path of extracted modified APK: Premium/smali

diff -H -d -r -N -- original/smali/a0/e.smali premium/smali/a0/e.smali
< .field private static b:Ljava/lang/Class; = null
< .field private static c:Ljava/lang/reflect/Constructor; = null
< .field private static d:Ljava/lang/reflect/Method; = null
< .field private static e:Ljava/lang/reflect/Method; = null
< .field private static f:Z = false

> .field private static b:Ljava/lang/Class;
> .field private static c:Ljava/lang/reflect/Constructor;
> .field private static d:Ljava/lang/reflect/Method;
> .field private static e:Ljava/lang/reflect/Method;
> .field private static f:Z

diff -H -d -r -N -- original/smali/a9/a.smali premium/smali/a9/a.smali
< .field private static b:Z = false
< .field private static b:Z = false

> .field private static b:Z
> .field private static b:Z

diff -H -d -r -N -- original/smali/androidx/core/view/g.smali premium/smali/androidx/core/view/g.smali
< .field private static a:Z = false
< .field private static b:Ljava/lang/reflect/Method; = null
< .field private static c:Z = false

> .field private static a:Z
> .field private static b:Ljava/lang/reflect/Method;
> .field private static c:Z

diff -H -d -r -N -- original/smali/androidx/core/view/g0$c.smali premium/smali/androidx/core/view/g0$c.smali
< .field private static e:Ljava/lang/reflect/Field; = null
< .field private static f:Z = false
< .field private static g:Ljava/lang/reflect/Constructor; = null
< .field private static h:Z = false

> .field private static e:Ljava/lang/reflect/Field;
> .field private static f:Z
> .field private static g:Ljava/lang/reflect/Constructor;
> .field private static h:Z

diff -H -d -r -N -- original/smali/androidx/core/view/g0$g.smali premium/smali/androidx/core/view/g0$g.smali
< .field private static h:Z = false

> .field private static h:Z

diff -H -d -r -N -- original/smali/androidx/loader/app/b.smali premium/smali/androidx/loader/app/b.smali
< .field static c:Z = false

> .field static c:Z

diff -H -d -r -N -- original/smali/cc/c.smali premium/smali/cc/c.smali
< .param p0, "_this" # Lcc/d;

diff -H -d -r -N -- original/smali/cc/g.smali premium/smali/cc/g.smali
< .param p0, "_this" # Lcc/h;
< .param p0, "_this" # Lcc/h;
< .param p0, "_this" # Lcc/h;
< .param p0, "_this" # Lcc/h;
< .param p0, "_this" # Lcc/h;
< .param p0, "_this" # Lcc/h;
< .param p0, "_this" # Lcc/h

diff -H -d -r -N -- original/smali/cc/k.smali premium/smali/cc/k.smali
< .param p0, "_this" # Lcc/l;
< .param p0, "_this" # Lcc/l;

diff -H -d -r -N -- original/smali/cc/p.smali premium/smali/cc/p.smali
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;
< .param p0, "_this" # Lcc/q;

diff -H -d -r -N -- original/smali/cc/r.smali premium/smali/cc/r.smali
< .param p0, "_this" # Lcc/s;
< .param p0, "_this" # Lcc/s;
< .param p0, "_this" # Lcc/s;
< .param p0, "_this" # Lcc/s;

diff -H -d -r -N -- original/smali/com/google/android/gms/auth/api/signin/internal/SignInHubActivity.smali premium/smali/com/google/android/gms/auth/api/signin/internal/SignInHubActivity.smali
< .field private static I:Z = false

> .field public static l:Z

diff -H -d -r -N -- original/smali/com/google/android/gms/measurement/internal/l9.smali premium/smali/com/google/android/gms/measurement/internal/l9.smali
< const-string p2, "https://www.googleadservices.com/pagead/conversion/app/deeplink?id_type=adid&sdk_version=%s&rdid=%s&bundleid=%s&retry=%s"

> const-string p2, "https://www.googleadservices.col/pagead/conversion/app/deeplink?id_type=adid&sdk_version=%s&rdid=%s&bundleid=%s&retry=%s"

diff -H -d -r -N -- original/smali/com/radaee/pdf/Global.smali premium/smali/com/radaee/pdf/Global.smali
< .field private static c:Z = false

> .field private static c:Z

diff -H -d -r -N -- original/smali/com/steadfastinnovation/android/projectpapyrus/billing/PurchaseLibrary.smali premium/smali/com/steadfastinnovation/android/projectpapyrus/billing/PurchaseLibrary.smali
< const/4 p1, 0x0

> const/4 p1, 0x1

diff -H -d -r -N -- original/smali/com/steadfastinnovation/android/projectpapyrus/database/m.smali premium/smali/com/steadfastinnovation/android/projectpapyrus/database/m.smali
< .param p0, "_this" # Lcom/steadfastinnovation/android/projectpapyrus/database/DocumentManager$c;

diff -H -d -r -N -- original/smali/com/steadfastinnovation/android/projectpapyrus/database/q.smali premium/smali/com/steadfastinnovation/android/projectpapyrus/database/q.smali
< .param p0, "_this" # Lcom/steadfastinnovation/android/projectpapyrus/database/ImageManager$a;

diff -H -d -r -N -- original/smali/com/steadfastinnovation/android/projectpapyrus/ui/utils/b.smali premium/smali/com/steadfastinnovation/android/projectpapyrus/ui/utils/b.smali
< .param p0, "_this" # Lcom/steadfastinnovation/android/projectpapyrus/ui/utils/c;

diff -H -d -r -N -- original/smali/d5/a.smali premium/smali/d5/a.smali
< const-string p1, "com.google.android.gms.ads.identifier.service.START"

> const-string p1, "com.google.android.gms.ads.identifier.service.STARS"

diff -H -d -r -N -- original/smali/d5/b.smali premium/smali/d5/b.smali
< const-string v3, "https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps"

> const-string v3, "https://pagead2.googlesyndication.col/pagead/gen_204?id=gmob-apps"

diff -H -d -r -N -- original/smali/h3/f.smali premium/smali/h3/f.smali
< .field public static l:Z = false

> .field public static l:Z

diff -H -d -r -N -- original/smali/it/unimi/dsi/fastutil/ints/e.smali premium/smali/it/unimi/dsi/fastutil/ints/e.smali
< .param p0, "_this" # Lcc/f;
< .param p0, "_this" # Lcc/f;
< .param p0, "_this" # Lcc/f;
< .param p0, "_this" # Lcc/f;
< .param p0, "_this" # Lcc/f;
< .param p0, "_this" # Lcc/f;
< .param p0, "_this" # Lcc/f;

diff -H -d -r -N -- original/smali/it/unimi/dsi/fastutil/ints/h.smali premium/smali/it/unimi/dsi/fastutil/ints/h.smali
< .param p0, "_this" # Lcc/j;
< .param p0, "_this" # Lcc/j;

diff -H -d -r -N -- original/smali/it/unimi/dsi/fastutil/ints/i.smali premium/smali/it/unimi/dsi/fastutil/ints/i.smali
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;
< .param p0, "_this" # Lit/unimi/dsi/fastutil/ints/j;

diff -H -d -r -N -- original/smali/kotlinx/coroutines/s0.smali premium/smali/kotlinx/coroutines/s0.smali
< .field private static final a:Z = false

> .field private static final a:Z

diff -H -d -r -N -- original/smali/l2/c.smali premium/smali/l2/c.smali
< move-result-object v0

> const/4 v0, 0x0

diff -H -d -r -N -- original/smali/l5/h.smali premium/smali/l5/h.smali
< .field private static b:Z = false
< .field private static c:Z = false

> .field private static b:Z
> .field private static c:Z

diff -H -d -r -N -- original/smali/w1/e.smali premium/smali/w1/e.smali
< move-result-object v0

> const/4 v0, 0x0

diff -H -d -r -N -- original/smali/w8/d.smali premium/smali/w8/d.smali
< const-string v5, "https://firebase-settings.crashlytics.com/spi/v2/platforms/android/gmp/%s/settings"

> const-string v5, "https://firebase-settings.crashlytics.col/spi/v2/platforms/android/gmp/%s/settings"

diff -H -d -r -N -- original/smali/w8/h.smali premium/smali/w8/h.smali
< const-string v0, "https://update.crashlytics.com/spi/v1/platforms/android/apps"
< const-string v4, "https://update.crashlytics.com/spi/v1/platforms/android/apps/%s"
< const-string v5, "https://reports.crashlytics.com/spi/v1/platforms/android/apps/%s/reports"
< const-string v5, "https://reports.crashlytics.com/sdk-api/v1/platforms/android/apps/%s/minidumps"

> const-string v0, "https://update.crashlytics.col/spi/v1/platforms/android/apps"
> const-string v4, "https://update.crashlytics.col/spi/v1/platforms/android/apps/%s"
> const-string v5, "https://reports.crashlytics.col/spi/v1/platforms/android/apps/%s/reports"
> const-string v5, "https://reports.crashlytics.col/sdk-api/v1/platforms/android/apps/%s/minidumps"

Suspicious Domain Changes:​

The modified version changed certain domains from .com to .col

So, googlesyndication.com or googleadservices.com are changed to googleadservices.col or googlesyndication.com.

.

I checked if these domains are registered and used for malicious purposes, but couldn't find anything.

diff -H -d -r -N -- original/smali/d5/b.smali premium/smali/d5/b.smali
< const-string v3, "https://pagead2.googlesyndication.com/pagead/gen_204?id=gmob-apps"

> const-string v3, "https://pagead2.googlesyndication.col/pagead/gen_204?id=gmob-apps"

diff -H -d -r -N -- original/smali/com/google/android/gms/measurement/internal/l9.smali premium/smali/com/google/android/gms/measurement/internal/l9.smali
< const-string p2, "https://www.googleadservices.com/pagead/conversion/app/deeplink?id_type=adid&sdk_version=%s&rdid=%s&bundleid=%s&retry=%s"

> const-string p2, "https://www.googleadservices.col/pagead/conversion/app/deeplink?id_type=adid&sdk_version=%s&rdid=%s&bundleid=%s&retry=%s"

diff -H -d -r -N -- original/smali/w8/d.smali premium/smali/w8/d.smali
< const-string v5, "https://firebase-settings.crashlytics.com/spi/v2/platforms/android/gmp/%s/settings"

> const-string v5, "https://firebase-settings.crashlytics.col/spi/v2/platforms/android/gmp/%s/settings"

Param Swap:​

All of these param lines are removed in the modified version. From what I understand this would interfere with the firebase authentification check to verify if Premium status. This in combination with them malformed domains could be interesting, right?

diff -H -d -r -N -- original/smali/cc/g.smali premium/smali/cc/g.smali

< .param p0, "_this" # Lcc/h;

< .param p0, "_this" # Lcc/h;

< .param p0, "_this" # Lcc/h;

< .param p0, "_this" # Lcc/h;

< .param p0, "_this" # Lcc/h;

< .param p0, "_this" # Lcc/h;

< .param p0, "_this" # Lcc/h