Merge pull request #2075 from HackTricks-wiki/research_update_src_mobile-pentesting_android-app-pentesting_smali-changes_20260331_025214

Research Update Enhanced src/mobile-pentesting/android-app-p...

Author: carlospolop

src/mobile-pentesting/android-app-pentesting/smali-changes.md

@@ -13,6 +13,22 @@ Using **Visual Studio Code** and the [APKLab](https://github.com/APKLab/APKLab)
 
 Another **script** that facilitates this task a lot is [**https://github.com/ax/apk.sh**](https://github.com/ax/apk.sh)
 
+### Split APKs / App Bundles
+
+Modern targets are commonly delivered as **split APKs** (`base.apk` + `split_config.*.apk`) instead of a single monolithic APK. If you patch only `base.apk`, resources or native libraries can go out of sync and the installation may fail.
+
+Quick triage from a device:
+
+```bash
+adb shell pm path com.example.app
+adb pull /data/app/.../base.apk
+adb pull /data/app/.../split_config.arm64_v8a.apk
+adb pull /data/app/.../split_config.en.apk
+```
+
+If the target is a split package, either rebuild the whole set or use tooling that **joins the APKs first**. [**apk.sh**](https://github.com/ax/apk.sh) is handy here because it can combine split APKs into a single patchable APK and fix public resource identifiers.\
+For Frida/Objection-oriented repacking workflows, also check [Android Anti-Instrumentation & SSL Pinning Bypass](android-anti-instrumentation-and-ssl-pinning-bypass.md).
+
 ## Decompile the APK
 
 Using APKTool you can access to the **smali code and resources**:
@@ -67,6 +83,8 @@ Finally, **sign** the new APK:
 jarsigner -keystore key.jks path/to/dist/* <your-alias>
 ```
 
+`jarsigner` still works for some quick tests, but for modern Android builds **`apksigner` is preferred** because it handles the newer APK signature schemes.
+
 ### Optimize new application
 
 **zipalign** is an archive alignment tool that provides important optimisation to Android application (APK) files. [More information here](https://developer.android.com/studio/command-line/zipalign).
@@ -76,6 +94,12 @@ zipalign [-f] [-v] <alignment> infile.apk outfile.apk
 zipalign -v 4 infile.apk
 ```
 
+If the APK contains bundled native libraries (`lib/*.so`), Android now recommends using **`-P 16`** so the `.so` files are aligned for both 16 KiB and 4 KiB page-size devices:
+
+```bash
+zipalign -P 16 -f -v 4 infile.apk outfile.apk
+```
+
 ### **Sign the new APK (again?)**
 
 If you **prefer** to use [**apksigner**](https://developer.android.com/studio/command-line/) instead of jarsigner, **you should sing the apk** after applying **the optimization with** zipaling. BUT NOTICE THAT YOU ONLY HAVE TO **SIGN THE APPLCIATION ONCE** WITH jarsigner (before zipalign) OR WITH aspsigner (after zipaling).
@@ -84,6 +108,20 @@ If you **prefer** to use [**apksigner**](https://developer.android.com/studio/co
 apksigner sign --ks key.jks ./dist/mycompiled.apk
 ```
 
+A more practical modern flow is:
+
+```bash
+apktool b . -o dist/app-unsigned.apk
+zipalign -P 16 -f -v 4 dist/app-unsigned.apk dist/app-aligned.apk
+apksigner sign --ks key.jks --out dist/app-signed.apk dist/app-aligned.apk
+apksigner verify --verbose --print-certs dist/app-signed.apk
+```
+
+Important notes:
+
+- If you **modify** an APK **after** signing it with `apksigner`, the signature is invalidated and you must sign it again.
+- `apksigner verify --print-certs` is useful to confirm the rebuilt APK is installable and to inspect the certificate that the target will expose at runtime.
+
 ## Modifying Smali
 
 For the following Hello World Java code:
@@ -149,6 +187,13 @@ goto :goto_6 #Always go to: :goto_6
 
 ### Bigger Changes
 
+### Smali gotchas that usually break rebuilds
+
+- Prefer increasing **`.locals`** when you only need temporary registers in the body of an existing method. Parameter registers (`p0`, `p1`...) are mapped to the **highest** registers of the method, so switching blindly to `.registers` often breaks argument layout.
+- `move-result`, `move-result-wide`, and `move-result-object` **must appear immediately after** the matching `invoke-*`. Inserting logging or any other opcode between them makes the method invalid.
+- `long` and `double` values are **wide** values and consume a **register pair**. If you reuse those registers later, remember that `v10` also occupies `v11`.
+- If you need to pass many registers, or very high-numbered ones, use the `/range` variants such as `invoke-virtual/range`.
+
 ### Logging
 
 ```bash
@@ -168,6 +213,34 @@ Recommendations:
   - The new variables should be the next numbers of the already declared variables (in this example should be _v10_ and _v11_, remember that it starts in v0).
   - Change the code of the logging function and use _v10_ and _v11_ instead of _v5_ and _v1_.
 
+### Patching common anti-tamper checks
+
+When an app is repacked, one of the first things that may break is an in-app **signature / installer / integrity** check. Good strings to search in JADX or in the smali tree are:
+
+- `GET_SIGNATURES`
+- `GET_SIGNING_CERTIFICATES`
+- `apkContentsSigners`
+- `MessageDigest`
+- `SHA-256`
+- `Base64`
+- `getInstallerPackageName`
+- `com.android.vending`
+
+Modern apps often call `PackageManager.getPackageInfo(..., GET_SIGNING_CERTIFICATES)`, hash the signer bytes with `MessageDigest`, and compare the result with a hardcoded constant. In practice, it is usually easier to patch the **final boolean / branch** than to rewrite all the signature-handling code.
+
+Example patterns:
+
+```smali
+# Force a boolean result to "valid"
+const/4 v0, 0x1
+
+# Or invert the branch that sends execution to the tamper handler
+if-eqz v0, :tamper_detected   # original
+if-nez v0, :tamper_detected   # patched
+```
+
+If the verification code is noisy, look for the **last comparison** before the error dialog / `finish()` / `System.exit()` / telemetry call and patch there instead of touching the entire routine.
+
 ### Toasting
 
 Remember to add 3 to the number of _.locals_ at the beginning of the function.
@@ -223,5 +296,7 @@ Notes:
 ## References
 
 - SoTap: Lightweight in-app JNI (.so) behavior logger – [github.com/RezaArbabBot/SoTap](https://github.com/RezaArbabBot/SoTap)
+- Android Developers: [apksigner](https://developer.android.com/tools/apksigner) and [zipalign](https://developer.android.com/tools/zipalign)
+- apk.sh: [github.com/ax/apk.sh](https://github.com/ax/apk.sh)
 
-{{#include ../../banners/hacktricks-training.md}}
+{{#include ../../banners/hacktricks-training.md}}