31

Recently I noticed that APKs generated in Android Studio (v. 2.3.3) have different inner structure than before. What caught my attention was especially the folder named HACKED-META-INF. Does anybody know what is the purpose of this folder? It contains following files:

HACKED-META-INF/services/io.grpc.ManagedChannelProvider

HACKED-META-INF/services/io.grpc.NameResolverProvider

Recently I updated to build tools to 26.0.2 and compileSdkVersion to 26. Could that be related?

Community
  • 1
  • 1
Lubos
  • 321
  • 3
  • 3
  • 1
    Same here on Android Studio 3.0. If we look at the package name, it comes from [gRPC](https://github.com/grpc/grpc-java) for TLS communication. Google apps like Calendar and Hangouts have it too when you take them from apkmirror since 2016. After some tests, I realised if I remove Firebase dependencies, I don't have these files into my builded apk. So it shouldn't come from the build tools but the Google libraries. My guess it's used to send data to Firebase server, however I don't know why they called it that way... – Blo Oct 27 '17 at 15:11
  • 1
    https://groups.google.com/forum/#!topic/adt-dev/y1RsuoLvVkY – Zoe May 31 '18 at 09:16

1 Answers1

4

https://nakedsecurity.sophos.com/2013/07/10/anatomy-of-a-security-hole-googles-android-master-key-debacle-explained/

"The theory is that if you tamper with either the META-INF files or the app itself, for example to replace files in the package with malware-infected imposters, Android will block the package to protect you from catastrophe."

hope this helps :)

MaterBranch
  • 91
  • 1
  • 2
  • Since this was awarded a bounty as well, I might be missing something, but this doesn't answer the question at all. It does explain the idea behing META-INF/MANIFEST.MF file, but the OP asks about a particular "HACKED" version of this folder - the comments under the question (folder being about extensions (Firebird?) using gRPC seems to be the real answer) - BTW the "HACKED-META-INF/services/io.grpc.XxxxxxProvider" files were listed in the Manifest with their hashes as well for the APK that brought me to this page... – OzgurH May 17 '20 at 17:25