0

I have an android apk which on startup check for the device "android ID" to see if it matches with the value embedded in the dex (if I'm understanding the code correctly). See example below:

 protected void onServiceConnected() {
super.onServiceConnected();
if (!Intrinsics.areEqual(Settings.Secure.getString(getContentResolver(), "android_id"), "c76462954894d143")) {
  this.isSupportedDevice = false;
  Toast.makeText((Context)this, "Not supported device!", 1).show();
  return;

and also here:

protected void onCreate(Bundle paramBundle) {
super.onCreate(paramBundle);
setContentView(2131427356);
if (!Intrinsics.areEqual(Settings.Secure.getString(getContentResolver(), "android_id"), "c76462954894d143")) {
  Toast.makeText((Context)this, "Not supported device!", 1).show();
  finish();
}

}

I'm attempting a simple modification to revise the android id "c76462954894d143" stored in the apk to match a new device android id to overcome the check on startup.

So far I have gone down the route of baksmali dex to smali, revised the two areas in which the android id is referenced, smali back to dex. Zipped the file back up. Signed using jarsign and then zipalign.

After installing the app on the new device with the matching android id, the app looks and functions as it did however fails the startup check.

Do you have any suggestions as to where I may be going wrong or what I should consider to overcome the issue.

Appreciate any help.

Thank you.

Brooks
  • 49
  • 1
  • 7
  • `the value embedded in the dex` - you can't generally guess the android_id's value in build time, so if this statement is correct - then the app most probably dynamically tailors (generates?) the class that contains the method and then loads it. Do you see any dynamic dex load API invocations? – Alex Lipov Jan 25 '22 at 07:49
  • If you already have the APK decompiled why not simply comment out those checks? For tracing an unknown app I recommend to use a rooted device and `frida-trace`. It allows you to trace and modify certain method calls at runtime without having to modify the APK file. – Robert Jan 27 '22 at 09:18

0 Answers0