[Android Software/Hacking General [Developers Only]] ovimunt:
Muhaha!!! I've just cracked wide open the services.odex on HTC One S (stock)

Yep, that's right! I've managed to decompile that stock services.odex on HTC One S.

You see, some of the libraries (jar and/or odex) in the framework include classes that are defined within other libraries also in the framework. So by default baksmali will do an include on the main libraries (boot classes) i.e. core.jar, ext.jar, framework.jar, android.policy.jar and services.jar and when decompiling any other library files will look inside these main libraries for any undefined classes. Now, if in a standard Android system the services.jar library is self contained, that's not the case on a Sense ROM! :cool: Sense is a very deep level customization effectively integrated into the actual system files, and which comes with its own custom class libraries. That's why out of the box baksmali won't be able to decompile any Sense odexes because it's simply not looking for the right libraries in the right places. All you need to do is to manually specify the custom libraries at the command line and once you do that it will run fine:

java -jar baksmali.jar -d framework -c :com.orange.authentication.simcard.odex:HTCExtension.odex:usbnet.odex -x framework\services.odex -o services.odex-classout

However, the complication doesn't stop there... it would just be too simple... ;) Obviously the structure of the custom libraries is also different from the standard libraries so the bits that need to be changed in the custom ActivityManagerService.smali look slightly different (plus I couldn't find the last one):

======================

.line 14524

const/4 v2, 0x1

if-le v10, v2, :cond_140

.line 14525

const/4 v10, 0x1 (change to 0x3)

.line 14526

const-string v2,

"visible"

move-object/from16 v0, p1

======================

if-ne v0, v2, :cond_17c

.line 14564

const/4 v10, 0x3 (change to 0x4)

.line 14565

const/16 v29, 0x1

.line 14566

const/4 v2, 0x0

move-object/from16 v0, p1

iput-boolean v2, v0, Lcom/android/server/am/ProcessRecord;->hidden:Z

.line 14567

const-string v2,

"heavy"

move-object/from16 v0, p1

======================

.line 14573

:cond_18d

const/4 v10, 0x6 (change to 0x0 for BulletProof, 0x1 for Die-Hard or 0x2 for Hard To Kill)

.line 14574

const/16 v29, 0x1

.line 14575

const/4 v2, 0x0

move-object/from16 v0, p1

iput-boolean v2, v0, Lcom/android/server/am/ProcessRecord;->hidden:Z

.line 14576

const-string v2,

"home"

move-object/from16 v0, p1

======================

.line 14584

const/4 v10, 0x7 (change to 0x5)

.line 14585

const/16 v29, 0x1

.line 14586

const/4 v2, 0x0

move-object/from16 v0, p1

iput-boolean v2, v0, Lcom/android/server/am/ProcessRecord;->hidden:Z

.line 14587

const-string v2,

"previous"

move-object/from16 v0, p1

======================

.line 14604

const/4 v10, 0x4 (change to 0x7)

.line 14605

const-string v2,

"backup"

move-object/from16 v0, p1

======================

if-eqz v2, :cond_163

.line 14554

const/4 v10, 0x2 (I wonder if it's this one :confused:)

.line 14555

const/4 v2, 0x0

move-object/from16 v0, p1

iput-boolean v2, v0, Lcom/android/server/am/ProcessRecord;->hidden:Z

.line 14556

const-string v2, "force-foreground"

move-object/from16 v0, p1

iput-object v2, v0, Lcom/android/server/am/ProcessRecord;->adjType:Ljava/lang/String;

.line 14557

move-object/from16 v0, p1

iget-object v2, v0, Lcom/android/server/am/ProcessRecord;->forcingToForeground:Landroid/os/IBinder;

move-object/from16 v0, p1

iput-object v2, v0, Lcom/android/server/am/ProcessRecord;->adjSource:Ljava/lang/Object;

.line 14558

const/16 v29, 0x0

goto/16 :goto_163

.line 14633

.restart local v13 #boundBySyncManager:Z

.restart local v22 #jt:Ljava/util/Iterator;,"Ljava/util/Iterator<Lcom/android/server/am/ServiceRecord;>;"

.restart local v25 #now:J

.restart local v28 #s:Lcom/android/server/am/ServiceRecord;

:cond_342

move-object/from16 v0, v28

iget-wide v5, v0, Lcom/android/server/am/ServiceRecord;->lastActivity:J

const-wide/32 v30, 0x1b7740

add-long v5, v5, v30

cmp-long v2, v25, v5

if-gez v2, :cond_360

.line 14637

sget v2, Lcom/android/server/am/ProcessList;->SERVICE_ADJ:I

if-le v10, v2, :cond_360

.line 14638

sget v10, Lcom/android/server/am/ProcessList;->SERVICE_ADJ:I

.line 14639

const-string v2,

"started-services"

move-object/from16 v0, p1

======================

(code adapted from zeppelinrox)

In any case, I modified the smali file as above, then I followed all the other steps in your post, replaced the old services.odex on the phone with the patched one and everything went absolutely fine! At least the first time around... In the meantime I've lost the original files I created and I've created new ones and for some f***ing reason it doesn't work anymore... The phone just hangs on boot so I have to restore from recovery! :mad: I've tried wiping the cache and the dalvik-cache but nothing works! :mad: I'll try a few more times and see maybe I can eventually get it to work again, I'll keep you posted.

Anyway, I've included an archive with all the smali files so you can play with them - see below.