[TUTORIAL] Reverse engineering HTC FM Radio for noobs (on EVO 4G)

[reekotubbs]

@brut.all

Will this work on a .apk that is downloaded (not installed on a device), if so do you have directions on how to use.

 

[midnjerry]

@brut.all

Will this work on a .apk that is downloaded (not installed on a device), if so do you have directions on how to use.

yes, just follow the directions, you can skip the renaming cygwin step.

 

[reekotubbs]

yes, just follow the directions, you can skip the renaming cygwin step.

The directions say you need to:

apktool if ./framework/com.htc.resources.apk

which I don't have since the .apk was not extracted, so what framework or resources do I use?

edit: I used notepad++ to rename all the htc.fm and htc/fm to htc.modradio and htc/modradio, but I get all kind of errors when I try to use the command "apktool b -d .\HtcFMRadio modradio.apk". here is a snippet:
com/google/android/apps/mikevoice/CallConnectingActivity$9.java[94,0] [smali_fil
e, method, statements_and_directives, instruction, fully_qualified_field, nonvoi
d_type_descriptor] mismatched input [@582,3473:3477='.line',<178>,94:0] expectin
g set null
Exception in thread "main" brut.androlib.AndrolibException: Could not smali file
: java.io.ByteArrayInputStream@a9ae05
at brut.androlib.src.DexFileBuilder.addSmaliFile(Unknown Source)
at brut.androlib.src.SmaliBuilder.buildFile(Unknown Source)
at brut.androlib.src.SmaliBuilder.build(Unknown Source)
at brut.androlib.src.SmaliBuilder.build(Unknown Source)
at brut.androlib.Androlib.buildSourcesSmali(Unknown Source)
at brut.androlib.Androlib.buildSources(Unknown Source)
at brut.androlib.Androlib.build(Unknown Source)
at brut.androlib.Androlib.build(Unknown Source)
at brut.apktool.Main.cmdBuild(Unknown Source)
at brut.apktool.Main.main(Unknown Source)

when I did the method skiping the cygwin renaming, everything worked, but when I installed the app it still showed the original htc.fm

 

[smartsreenath]

nice tutorial........

 

[reekotubbs]

@midnjerry

I need your help with this. I keep getting the same errors even when I use cygwin to rename the files.

 

[Brut.all]

The directions say you need to:

apktool if ./framework/com.htc.resources.apk

which I don't have since the .apk was not extracted, so what framework or resources do I use?

If you could run this apk on your device, then this device has all needed resources installed. Just find and pull them out.

edit: I used notepad++ to rename all the htc.fm and htc/fm to htc.modradio and htc/modradio

This isn't that easy. You have to know, what are you doing.

 

[midnjerry]

@midnjerry,

sorry if this is way off topic, but it does deal with the fundamental aspects that you have established here.

Can I use this method to reverse engineer the Google Voice app, so that I can have the same program installed twice for my two different Google voice accounts?

I just want to name the application something else, so that I can install it twice with two different sign in names.

Alright, so it's Google Voice, let's try Brutall's quick method.

First, though, you have to see if the apk has a classes.dex. If it does, then you can skip straight to the apktool step of tutorial. Don't worry about the framework command.

apktool d -d <google-voice-app-name>.apk

browse the directory just created
Edit AndroidManifest.xml

in manifest tag change the name of package=" " to whatever you want.
Save
apktool b -d <output directory> newvoice.apk

sign it

then install it

if you succeed, then go in and test both programs.

If you get an "already installed" error (or some other error), then you'll have to go in and change all old package names to the new package name you decided.

that's command:
find ./ -type f | xargs perl -pi -e 's/<old package name>/<new package name>/g'

so basically, if the first set of instructions don't work, redo everything, and instead of editting the AndroidManifest, do the command in bold, then apktool it back together (don't forget to delete .bak files) then resign, then install.

See if that works.

 

[reekotubbs]

If you could run this apk on your device, then this device has all needed resources installed. Just find and pull them out.



This isn't that easy. You have to know, what are you doing.

Alright, so it's Google Voice, let's try Brutall's quick method.

First, though, you have to see if the apk has a classes.dex. If it does, then you can skip straight to the apktool step of tutorial. Don't worry about the framework command.

apktool d -d <google-voice-app-name>.apk

browse the directory just created
Edit AndroidManifest.xml

in manifest tag change the name of package=" " to whatever you want.
Save
apktool b -d <output directory> newvoice.apk

sign it

then install it

if you succeed, then go in and test both programs.

If you get an "already installed" error (or some other error), then you'll have to go in and change all old package names to the new package name you decided.

that's command:
find ./ -type f | xargs perl -pi -e 's/<old package name>/<new package name>/g'

so basically, if the first set of instructions don't work, redo everything, and instead of editting the AndroidManifest, do the command in bold, then apktool it back together (don't forget to delete .bak files) then resign, then install.

See if that works.

I got it. Here are the steps I used for downloaded .apk

apktool if ./framework/com.htc.resources.apk
apktool d -d googlevoice.apk
rename using notepadd++ (ctrl h use normal setting)
apps/googlevoice to apps/newvoice
apps.googlevoice to apps.newvoice
rename googlevoice/smali/.../apps/googlevoice to .../apps/newvoice
apktool b -d .\googlevoice newvoice.apk
keytool -genkeypair
arsigner -verbose newvoice.apk mykey

cygwin did not work for me it kept screwing up the code for the lexical analyzer.
and just renaming in manifest did not work.

 

[midnjerry]

Bravo! You rock! Cool, you eliminated Cygwin step.

 

[djmcnz]

Nice tutor! I'm glad that finally someone is interested in smali debugging feature ;-)

About package name changing: I must warn you, that this isn't always that easy. It's advanced task, you must understand, what are you doing - otherwise you will get FCs for some apps and you won't know, why. And you don't have to change Java classes package name, so actually changing com.example.android should be enough - there is no need for changing com/example/android and dir names.

And I have few words about the background/theory: dexes, smali, (de)compiling, etc., but I will write them tomorrow

It is an advanced task, I completely agree. However I can't think of a circumstance where you could get away without changing the paths and references.

Pretty much everything.allthings.yesallofit and everything/allthings/yesallofit as well as the dir names an any references to /allthings/yesallofit will also need to be updated. If the base folder has more than one branch then that adds another layer of complexity.

Basically, unless it's a simple, standalone app with no libraries, don't bother trying to alter the package name.

@OP - Windows Grep or similar will do your recursive text replacement in Windows (in your first post you seek suggestions for this).

EDIT: Awesome post btw.

 

[reekotubbs]

brut.all and midnjerry

I tried the method on the newest googlevoice apk backed up on to my sd card using astro.
When I run the second step to create the director for the apk, brut.all stops and gives this error:

I: Baksmaling...
Exception in thread "main" brut.androlib.AndrolibException: brut.androlib.Androl
ibException: File already exists: com.google.android.apps.googlevoice\smali\com\
google\android\apps\googlevoice\MasfLogStopwatch.java
at brut.androlib.Androlib.decodeSourcesSmali(Unknown Source)
at brut.androlib.ApkDecoder.decode(Unknown Source)
at brut.apktool.Main.cmdDecode(Unknown Source)
at brut.apktool.Main.main(Unknown Source)
Caused by: brut.androlib.AndrolibException: File already exists: com.google.andr
oid.apps.googlevoice\smali\com\google\android\apps\googlevoice\MasfLogStopwatch.
java
at brut.androlib.src.SmaliDecoder.decodeClassDefItem(Unknown Source)
at brut.androlib.src.SmaliDecoder.decode(Unknown Source)
at brut.androlib.src.SmaliDecoder.decode(Unknown Source)
... 4 more

Any one knows what gives with this error.

 

[midnjerry]

Are you trying to put it in the same directory as your other versions? Your error messages are littered with "File already exists". If that's not the case, your guess is as good as mine.

 

[reekotubbs]

Are you trying to put it in the same directory as your other versions? Your error messages are littered with "File already exists". If that's not the case, your guess is as good as mine.

The file is in its own directory. I don't know why it says the file already exist. Unless brut.all creates this file and google wised up and put the file in the .apk already to screw up the brut.all process.

I guess I'll have to wait for brut.all to chime in.

 

[Brut.all]

It is an advanced task, I completely agree. However I can't think of a circumstance where you could get away without changing the paths and references.

Pretty much everything.allthings.yesallofit and everything/allthings/yesallofit as well as the dir names an any references to /allthings/yesallofit will also need to be updated. If the base folder has more than one branch then that adds another layer of complexity.

You should note that there are two package name things:

• Android app package name - one stored in AndroidManifest.xml. Android uses it to uniquely identify each app, so you have to change it to install two instances of same app. Its subnames are always separated by dots, so it looks like com.android.example. It could be found in many places and always in normal string form: as XML attributes or Java strings in the code. Of course this makes possible to write e.g. "com.and" + "roid.com" in the code, so you won't find it using find&replace.
• Package names of Java classes - they aren't just normal strings, they're meta data of java classes, so it's much easier to find them - virtual machine must know, what is a package name and what isn't. In Java code they're used in "package com.android.example;", "import com.android.example;", etc. phrases and their subnames are separated by dots. But in Java bytecode, dex files and smali code there are slashes instead of dots, so it's com/android/example and these package names are everywhere, not just in these few phrases. Sometimes, e.g. if app uses Java Reflection API, these package names could be found as normal strings, not meta-data, so they're identical to Android package names - they look something like "const-string v0, "com.android.example"". Fortunately this is rare case.

First package name has special meaning for Android OS, but second one isn't important at all. Usually both package names are the same, but this isn't Android requirement. You could create an app using com.android.example package name, but create Java classes under foo.bar.baz namespace - no problem.

Package names using slashes as separators are always Java package names and you don't have to touch them. Same for names of smali dir subdirs. You should change names separated by dots only, but you have to remember that not every com.android.example string must be an Android package name, so you have to understand, what are you doing. Also sometimes Android package name may be computed in the code, because it's normal Java string, so it may be impossible to find using find&replace and similar methods.

I tried the method on the newest googlevoice apk backed up on to my sd card using astro.
When I run the second step to create the director for the apk, brut.all stops and gives this error:

Could you upload your apk somewhere? Maybe it's case-sensitivity issue of Windows, but this is just a guess.

 

[Untouchab1e]

Quick question!

Ive read comments that the latest version of NetBeans wont let you debug Smali as it doesnt want to handle the comments anymore. If true, what version of NetBeans should I be using?

Thanks

 

[Brut.all]

Quick question!

Ive read comments that the latest version of NetBeans wont let you debug Smali as it doesnt want to handle the comments anymore. If true, what version of NetBeans should I be using?

Thanks

6.8 - works, 6.9 - not.

 

[Untouchab1e]

Thanks mate! Good to know!

 

[Untouchab1e]

Sorry for the bump, but does anyone have the download link for NetBeans 6.8?

EDIT: Silly me.. found it

 

[Untouchab1e]

When I try to connect ddms to NetBeans I jus get a "connection refused" message.. Any ideas?

 

[midnjerry]

When I try to connect ddms to NetBeans I jus get a "connection refused" message.. Any ideas?

did you remember to set the address to localhost? I had trouble with that for the longest time until I changed the default value to localhost.

Also make sure the ports match, try 8700 to begin with.

Oh, I also noticed that when Eclipse and DDMS are running at the same time, you can't see the programs being executed in DDMS. So either close down Eclipse, or use the DDMS plugin in Eclipse instead of running it externally. (It's easier just to close Eclipse).