This is a set of bash scripts and Magisk module for patching system JAR files of Android.
Magisk module does following things:
- substitutes JAR in
/system/framework
dir - remounts folders in
/apex/
to be writeable (why? readAPEX
section)
Sometimes tools like Frida or XPosed/LSPosed got detected by app under research, so we need to use some uncommon techniques to bypass detection. One of such technique is patching system libraries (.jar
files, .so
files) to execute code from them as soon as app load them into memory.
- Download latest apktool.jar and put it in this folder
- Choose JAR file you want to modify on your Android from
/system/framework
- Download JAR from device (via ADB) and put it in this folder
- Modify variables in
*.sh
files according to comments on top - Run
./jar_to_smali.sh
, after run you will getyour-jar-file.jar.smali
folder - Modify SMALI files in
your-jar-file.jar.smali
as you wish - Run
smali_to_jar.sh
to build JAR from updated SMALI files (updated JAR will be located inmagisk_module/system/framework/
) - Build Magisk module for replacing origina JAR in
/system/framework
:./build_magisk_module.sh
- Push built magisk module (
jarpatcher.zip
) to device (via ADB) and install ZIP via Magisk on device - Enjoy modified JAR!
Well, most of interesting JARs since Android 10 are distributed in APEX format, which contains .img
with .jar
and .so
libraries. Best explanation of APEX format you may find here. As far as we want to be able to modify all system libraries, we have to be able to modify libraries provided by APEXes as well.
For example, default Java classes like java.lang.String
or java.net.URL
provided to all Android apps via /apex/com.android.art/javalib/core-oj.jar
library.
Native utility for interaction with APEX - apexd
We can interact with APEXes manually via apexd
binary available on every modern Android:
stop
(stop zygote and all apps which are using files from/apex/*
)apexd --unmount-all
(unmount all apex filders)apexd --otachroot-bootstrap
(mounts all apexes back)start
(start zygote with user space)
By default, Magisk module from this project contains service.sh
which remounts some of most interesting APEXes after file system got initialized. This lets you to do substitute JAR's and SO's in runtime like this:
stop
(stop zygote and all apps which are using files from/apex/*
)cp /sdcard/patched-core-oj.jar /apex/com.android.art/javalib/core-oj.jar
start
(start zygote with user space)
After system boots patched version of core-oj.jar
will be loaded in all apps.
If you need some extra APEXes, modify service.sh
(follow comments).
- Enable Magisk Hide ("magisk modifications are reverted for processes on hidelist") and install PlayIntegrityFix module to stay stealth.
- Add researchable app to Magisk Hide list
- Flash TWRP into recovery partition
- Boot TWRP
- In TWRP go to
Advanced -> File Manager
- Remove Magisk module folder
/data/adb/modules/jarpatcher
- Reboot to system