Bulletproof Android™: Practical Advice for Building Secure Apps

Remove App Store Check

Disassemblers were commonly used hacking tools in the 80s and 90s to crack an unlicensed copy of an application. A quick edit of an if statement or two, flip a Boolean from true to false on a license check, and the app is suddenly licensed.

We can disassemble the APK into Smali code using backsmali.jar, make modifications to the Smali code, reassemble it using smali.jar, and then resign it using jarsigner to create our own fake version of an APK.

Let’s look at how we would remove some licensing code to use our fake APK somewhere that the original developers didn’t want it used. Returning to our SIP app from earlier, let’s first add some code to only let the Android app work if it’s downloaded from Google Play.

To protect ...