> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/mobile/reverse-android-apks/backdooring-patch-apks.md).
# Backdooring/patch APKs
n this laboratory, we are going to **add a toast message** on the target APK. This approach can be also used to **backdoor the APK** with something **including the frida gadget**.
{% embed url="" %}
{% embed url="" %}
## **1. apktool - decode and compile APK**
The first task is the decoding of the target APK. We can do this using the tool: **apktool**.
{% embed url="" %}
First, we need to access the folder and we have installed the **apktool.jar**, in my case: ***C:\Tools\android**.*
{% hint style="success" %}
Tip: First time, we can **remove the -r option** to decode all the resource and analyze the Android-Manifest.xml file.
{% endhint %}
```
cd C:\Tools\android
PS C:\Tools\android> java -jar .\apktool.jar decode -r 'C:\tmp\xxxx_2.7.3.apk'
I: Using Apktool 2.5.0 onxxxx_2.7.3.apk
I: Copying raw resources...
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Copying META-INF/services directory
PS C:\Tools\android>
```
## 2. Add the payload
After getting the source-code (smali), the frist step is to analyze the **Android-Manifest.xml** file to discover the laucher activity.
We got it! :nerd:
Let's opening the smali file: **com.xxx.xxx.v2.ui.splashscreen.SplashscreenActivity.smali**
After that, we need to find the "**onCreate()**" method (our target).
Here, we can add the code below, a toast message that will be presented when the activity starts.
```
const/4 v0, 0x1
const-string v1, "Backdoored like a baws"
invoke-static {p0, v1, v0}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;
move-result-object v0
invoke-virtual {v0}, Landroid/widget/Toast;->show()V
```
## 3. Build the APK
After adding the target payload, we need to build the APK with the changes. Inside the created folder, we can seethe **apktool.yml file**. It is necessary to proceed. So, we need to execute the akptool build process from this path.
```
(inside the decompiled APK folder (root))
java -jar ..\apktool.jar build -o c:\tmp\backdoored.apk
I: Using Apktool 2.5.0
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether sources has changed...
I: Smaling smali_classes2 folder into classes2.dex...
I: Checking whether resources has changed...
I: Copying raw resources...
I: Copying libs... (/lib)
I: Copying libs... (/kotlin)
I: Copying libs... (/META-INF/services)
I: Building apk file...
I: Copying unknown files/dir...
I: Built apk...
```
## 4. Create keystore with self-signed cert
The next step is to create a **.keystore** to sign the APK. For this, we will use the **keytool.exe** from JRE.
It's important to save some details, including the alias ("**baws**") and the typed password ("**123456**").
```
cd C:\Program Files\Java\jre1.8.0_251\bin
keytool.exe -genkey -v -keystore c:\tmp\.keystore -keyalg RSA -keysize 2040 -validity 365 -alias baws
(...)
Generating 2,040 bit RSA key pair and self-signed certificate (SHA256withRSA) with a validity of 365 days
for: CN=123, OU=123, O=123, L=123, ST=123, C=123
[Storing c:\tmp\.keystore]
```
As observed, the **.keystore** file was created on the *c:\tmp* folder.
## 5. Sign the APK file
Here, you need to use the alias created when you created the keystore file (**baws**, in this case). The password was "**123456**".
```
cd C:\Program Files\AdoptOpenJDK\jdk-11.0.11.9-hotspot\bin
jarsigner.exe -sigalg SHA1withRSA -digestalg SHA1 c:\tmp\backdoored.apk baws -keystore C:\tmp\.keystore
(...)
Enter Passphrase for keystore:
jar signed.
Warning:
The signer's certificate is self-signed.
```
## 6. Align the APK with zipalign
After sign an APK, if you got some erros such as "**Failed to extract native libraries, res=-2]**", probably you need to align the APK.
Before aligning it, you can try to install it:
```
.\adb.exe install C:\tmp\backdored.apk
Performing Streamed Install
adb: failed to install C:\tmp\backdored.apk: Failure [INSTALL_FAILED_INVALID_APK: Failed to extract native libraries, res=-2]
```
{% hint style="danger" %}
Attention: You must use zipalign at one of two specific points in the app building process, depending on the app signing tool you use:
* If you use **apksigner**, only run zipalign before signing the apk file. If you sign your APK using apksigner and make other changes to the APK, the signature will be invalidated.
* If you use **jarsigner**, only run zipalign after signing the APK file.
{% endhint %}
{% embed url="" %}
As I used jarsigner, my last step is align the APK before installing it.
```
zipalign -p -f -v 4 backdored.apk backdored-aligned.apk
```
{% embed url="" %}
Now, it's time to test it
```
.\adb.exe install C:\tmp\backdored-aligned.apk
```
Of course, the APK was modified, **you need to install it anyway**.
When the installation process ends, it's prompted to send the app for a security scan. You should pick "**DON'T SEND**".
**Gotcha**! :sunglasses:
