Using Java Reflection with Eclipse ADT to Access Internal/Hidden API classes.
Purpose
We present a way to access all the Internal and Hidden Java packages/classes
in the AOS. To do this we need to both repackage the Android.jar and hack the
Eclipse ADT plugin, to allow using these internal packages.
Posting
==================================================
Do NOT post general questions/requests on how to
do this or that, they will not be answered here.
DO post if you have additional tricks, hacks or
information that can help/benefit this tutorial.
==================================================
Background
There are two reasons one cannot use internal packages. One reason is that, if
you're using Eclipse as your development platform, those packages are
internally blocked in the Eclipse ADT plugin. Second reason is that the normal
development android.jar runtime does not contain those *.class files that
belong to the internal packages.
"There is no easy way to use com.android.internal package (internal API) or
anything marked with @hide attribute (hidden API) without using reflection.
That’s because android.jar file does not contain classes from internal and
hidden API and because of this nobody can reference those classes in compile
time."
Thus we need to first restore the "original" android.jar which will allow us
to use internal and hidden APIs. But the runtime equivalent of Android SDK’s
android.jar file is framework.jar. This file is located in the
/system/framework/ directory of your device. We will extract and use this for
our pleasure.
The general procedure:
A) Grab the "full" framwork.jar from your device
B) extract the class files
C) add them to "full" android.jar ??
D) Hack the Eclipse ADT plugin jar.
Finally, NOTHING would have been possible without the excellent step-by-step
instructions on the devmaze-blog by senior Android developer Ievgenii Nazaruk
(aka. "inazaruk"). THANK YOU Ievgenii!References
http://stackoverflow.com/questions/...d-sdk-with-hidden-and-internal-apis-available
http://stackoverflow.com/questions/...-state-permission-for-apps-ran-on-gingerbread
http://code.google.com/p/smali/wiki/DeodexInstructions
http://code.google.com/p/adt-addons/
The General Procedure
NOTE: All this was performed on Windows Vista with Cygwin.(1) Grab BOOTCLASSPATH from init.rc
Find the line in your init.rc file that reads something like:
Code:
[SIZE=2]export BOOTCLASSPATH /system/framework/core.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar[/SIZE]
Extract and reformat the path to:
Code:
[SIZE=2]core.jar:bouncycastle.jar:ext.jar:framework.jar:android.policy.jar:services.jar:core-junit.jar[/SIZE]
(2) Grab the "framework" from your device
Create a working directory somewhere, let's call it "_framework":
Code:
[SIZE=2]mkdir ./_framework[/SIZE]
[SIZE=2]cd _framework[/SIZE]
Grab all the framework files from your device:
Code:
[SIZE=2]adb pull /system/framework .[/SIZE]
Rename directory if needed.
NOTE-1: From now on I'll assume you know where you are!
NOTE-2: Most GB 2.3.4+ devices uses .odex'ed files,
with name pairs like: <package>.jar and <package>.odex.
These need to be converted.
(3) Use baksmali with (1)
You can also use baksmali with the switch: -d <framwork-dir>.
The general command is something like below, but in windows there may be "wrappers"
that allow you to just type "baksmali" without the "java -jar" prefix and without
the ".jar" post fix. Anyway here is the command I used:
Code:
[SIZE=2]java -Xmx1024m -jar ./../../baksmali.jar -a 10 -c :core.jar:bouncycastle.jar:ext.jar:framework.jar:android.policy.jar:services.jar:core-junit.jar -x framework.odex[/SIZE]
==> This results in all files put in the "out" sub-directory.
This directory contain 3 sub-directories (for GB 2.3.4):
Code:
[I]android [/I](Hidden APIs)
[I]com [/I](Internal APIs)
[I]javax [/I](Hidden APIs)
NOTE: If you are using Google's own API's, you will probably also need to add
those packages to the path above. (Eg. Email.jar, etc etc ?)
(4) Then use smali to create a dex file from "out" directory
Code:
java -jar smali.jar out
==> creates out.dex from "out" directory.
(5) Run dex2jar on out.dex
Code:
[SIZE=2]./dex2jar.bat out.dex[/SIZE]
==> creates out_dex2jar.jar
(This .jar contain close to 4900 files at 12 MB!)
(6) Rename "out_dex2jar.jar" to "framework-classes.zip"
Code:
[SIZE=2]mv out_dex2jar.jar framework-classes.zip
unzip framework-classes.zip[/SIZE]
(7) Find and copy your Android SDK's android.jar file
Go to: /path/to/android-sdk-windows/platforms/android-X/android.jar
where X is the API level of interest. This obviously have to match the
API level of the files you extracted from your device in: /system/framework .
This .jar file contain more than 5300 files when expanded, but missing all
the internal packages. Our job is to add them back in.
Let's first make a copy that we can use to expand and add files from (6):
Code:
cp android.jar custom-android.zip
unzip custom-android.zip
(8) Add all *.class files from (6) in to (7)
Copy and replace all existing *.class files from framework-classes.zip into
custom-android.zip:
Code:
[SIZE=2]cp -R /path/to/framework-classes/* /path/to/custom-android/.[/SIZE]
The root content of that directory should then look something like this:
Code:
[SIZE=2]android[/SIZE]
[SIZE=2]assets[/SIZE]
[SIZE=2]com[/SIZE]
[SIZE=2]dalvik[/SIZE]
[SIZE=2]java[/SIZE]
[SIZE=2]javax[/SIZE]
[SIZE=2]junit[/SIZE]
[SIZE=2]META-INF[/SIZE]
[SIZE=2]org[/SIZE]
[SIZE=2]res[/SIZE]
[SIZE=2]AndroidManifest.xml[/SIZE]
[SIZE=2]resources.arsc[/SIZE]
(9) Rename directory and create your new "classy-android.jar"
We rename it so not confuse with the original:
Code:
mv custom-android classy-android
zip classy-android
mv classy-android.zip classy-android.jar
IMPORTANT:
Make absolutely sure that the folder structure of your zip archive
is exactly the same as what you intended. To check, unzip the file
and see if it is what you (and eventually Eclipse) would expect.
(For example, if you use 7zip to zip a directory file called "test",
into "test.zip", you may end-up extracting it to ./test/test/... )
(10) Enabling & Restricting Access to classy-android.jar
Instead of just replacing the android.jar with classy-android.jar, we choose
to create a customized Android platform. This way you can enable the Internal
and Hidden API's for those projects requiring them, while other standard
projects doesn't have access to those.
(a) Go to: /path/to/android-sdk-windows/platforms/
and copy the relevant directory (for example):
Code:
cp -R android-10 android-10-internals
(b) Replace android.jar with your classy-android.jar:
Code:
cp classy-android.jar android.jar
("cp" overwrites!)
(c) Edit the build.prop file:
Edit/replace the following lines:
Code:
[SIZE=2]ro.build.version.sdk=10 ==> ro.build.version.sdk=[COLOR=Black][B]-10[/B][/COLOR][/SIZE]
[SIZE=2]ro.build.version.release=2.3.3 ==> ro.build.version.release=2.3.internal[/SIZE]
(11) Customizing the Eclipse ADT
In order to be able to use com.android.internal packages in the Eclipse ADT,
you have to disable the internal protection mechanism of the plugin, that
prevent you to use these libraries. You can see this by right-clicking on your
project package and navigate to:
Code:
[SIZE=2]==> Properties ==> Java Build Path ==> Libraries (tab) [/SIZE]
[SIZE=2]--> Android 2.x.x --> android.jar [/SIZE]
[SIZE=2]--> "Access rules: 1 rule defined": [B][COLOR=Red](X)[/COLOR][/B] [B]Forbidden: com/android/internal/**[/B][/SIZE]
This can not be removed (bug?), even though the interface allows changing, it
never persists after closing the Properties window. So we have to hack it!
The way to do it, is to hexedit the correct java class file and change the
name from "internal" to "internax". First let's find the correct file. The
plugin file is located in the ./eclipse/plugins/ directory, and its name is
something like:
Code:
com.android.ide.eclipse.adt_18.0.0.v201203301601-306762.jar
(a) make a backup copy of this (with the exact name preserved) in another directory.
(b) make a another copy of this in another directory.
(c) unzip (b) in that directory
Code:
[SIZE=2]cp com.android.ide.eclipse.adt_18.0.0.v201203301601-306762.jar hacked_adt.zip[/SIZE]
[SIZE=2]unzip hacked_adt.zip[/SIZE]
[SIZE=2]cd hacked_adt[/SIZE]
This is a huge directory system, so forget poking around in it,
just go to the correct sub-directory:
Code:
[SIZE=2]cd ./com/android/ide/eclipse/adt/internal/project/[/SIZE]
Then find the correct file and the approximate string location within that file:
Code:
[SIZE=2]strings.exe -f -4 -t x ./*.class |grep "android\/internal"[/SIZE]
It happens to be in "AndroidClasspathContainerInitializer.class". Now, use a
hexeditor to find and change the string "com/android/internal/**"
to "com/android/internax/**". That will do it!
Now zip-up your hacked jar directory and copy it over the old one.
(Remember that "cp" overwrites without warning!)
Code:
[SIZE=2]zip hacked_adt[/SIZE]
[SIZE=2]cp hacked_adt.zip /path/to/eclipse/plugins/com.android.ide.eclipse.adt_18.0.0.v201203301601-306762.jar[/SIZE]
You Are Done!
Enjoy your newly hacked Eclipse! Errors
If you get any errors;
1. make sure you have zipped up everything properly as warned before.
2. make sure you have included Google API packages in your BOOTCLASSPATH in step (3).
3. Try to "clean-up" the Java by: "Right-Click" ==> Source ==> "Clean Up...".
4. Google them
5. Ignore them
6. Give up. Not! But I can't help you!
If it still doesn't work, try to download inazaruk's pre-compiled set of internal android.jar's from here.
(For android 7,8,10,15.)
WIP! <here be dragons2>
For a project using internal package imports, see my thread:
"[TOOL][APP][WIP] Native AT Command Injector"
<here be more dragons>
Following the instructions in posts 1-2 above, may not always work. It is not known to me at this time, why it shouldn't. One theory is that it can have something to do with how Eclipse and Android.jar is packaging their files and the resulting sizes.
This was mentioned in this Stackoverflow post:
"Jar files: why does extracting then compression a jar file create a file of a different size to the original?"
Then reading the man pages for "jar" we can inform ourselves with:
Code:
[SIZE=2] c Creates a new archive file named jarfile (if f is specified) or to
standard output (if f and jarfile are omitted). Add to it the
files and directories specified by inputfiles.
u Updates an existing file jarfile (when f is specified) by adding
to it files and directories specified by inputfiles.
x Extracts files and directories from jarfile (if f is specified) or
standard input (if f and jarfile are omitted). If inputfiles is
specified, only those specified files and directories are
extracted. Otherwise, all files and directories are extracted.
t Lists the table of contents from jarfile (if f is specified) or
standard input (if f and jarfile are omitted). If inputfiles is
specified, only those specified files and directories are listed.
Otherwise, all files and directories are listed.
i Generate index information for the specified jarfile and its
dependent jar files.
[/SIZE]
More info is provided here:
The JAR Overview @
http://java.sun.com/javase/6/docs/technotes/guides/jar/jarGuide.html
The JAR File Specification @
http://java.sun.com/javase/6/docs/technotes/guides/jar/jar.html
The JARIndex Spec @
http://java.sun.com/javase/6/docs/technotes/guides/jar/jar.html
JAR Tutorial @
http://java.sun.com/docs/books/tutorial/jar/
pack200 Reference Page @
http://java.sun.com/javase/6/docs/technotes/tools/share/pack200.html
Another theory is that it may have something to do with what seem to be, that Google have revoked the the use of MODIFY_PHONE_STATE since Android 2.3, and that this influences the Eclipse behavior, when using and modifying older android.jar's. This was mentioned here and here.
Any help would be very much appreciated!
< bump >
Hi, thanks for the info, I made it using linux and worked really nice, these were the lines that I used, hope be useful.
This is my Android folder at home
Code:
Android/
├── eclipse
├── ndk
├── platforms-internals
├── sdk
└── tools
Start an avd running the desired API to modify in this case API-17
Code:
$ emulator -avd avd_api_17 -no-window &
Get the framework
Code:
$ cd ~/Android/
$ mkdir _framework
$ cd _framework
$ adb -s emulator-5554 pull /system/framework .
Grab BOOTCLASSPATH
Code:
$ adb -s emulator-5554 shell cat init.rc | grep BOOTCLASSPATH > bootclasspath
I didn't have the tools used in this tutorial, so I included the steps for getting them
Decompile with baskmali
Code:
$ cd ~/Android/tools
$ wget https://smali.googlecode.com/files/baksmali-1.4.2.jar
$ cd ~/Android/_framework
$ java -Xmx1024m -jar ../tools/baksmali-1.4.2.jar -a 17 -c core.jar:core-junit.jar:bouncycastle.jar:ext.jar:framework.jar:telephony-common.jar:mms-common.jar:android.policy.jar:services.jar:apache-xml.jar -x framework.odex
The parameter -a for baksmali refers to the API we are working with.
Generate out.dex with smali
Code:
$ cd ~/Android/tools
$ wget https://smali.googlecode.com/files/smali-1.4.2.jar
$ cd ~/Android/_framework
$ java -jar ../tools/smali-1.4.2.jar out
Get internal and hidden classes using dex2jar
Code:
$ cd ~/Android
$ wget https://dex2jar.googlecode.com/files/dex2jar-0.0.9.15.zip
$ unzip dex2jar-0.0.9.15.zip
$ rm dex2jar-0.0.9.15.zip
$ cd _framework/
$ ../tools/dex2jar-0.0.9.15/d2j-dex2jar.sh out.dex
$ unzip out-dex2jar.jar -d framework-classes
Add these classes to plataform's default android.jar
Code:
$ cd ~/Android
$ unzip sdk/platforms/android-17/android.jar -d custom-android
$ cp -r _framework/framework-classes/* custom-android/
$ rm -r _framework
$ cd custom-android
$ zip -r ../custom-android.jar *
$ cd ..
$ rm -r custom-android
Create new extended platform
Code:
$ cd ~/Android
$ cp -r sdk/platforms/android-17 platforms-internals/android-17-internals
$ mv custom-android.jar platforms-internals/android-17-internals/android.jar
$ vi platforms-internals/android-17-internals/build.prop
ro.build.version.release=4.2.2
ro.build.version.release=4.2.2.internal
$ ln -s ~/Android/platforms-internals/android-17-internals ~/Android/sdk/platforms/android-17-internals
I use a symlink for keep it a little organized
Hack ADT
Code:
$ cd ~/Android
$ unzip eclipse/plugins/com.android.ide.eclipse.adt_22.0.4.v201307151829--741630.jar -d hacked_adt
Go to right folder
Code:
$ cd hacked_adt/com/android/ide/eclipse/adt/internal/project/
Find file where is our desired string
Code:
$ strings -f -a -t x * | grep "android\/internal"
Edit with an hex editor
Code:
$ bless AndroidClasspathContainerInitializer.class &
Here we change the l for the x.
Replace original file making a backup
Code:
$ cd ~/Android
$ cp eclipse/plugins/com.android.ide.eclipse.adt_22.0.4.v201307151829--741630.jar eclipse/plugins/com.android.ide.eclipse.adt_22.0.4.v201307151829--741630.jar.original
$ cd hacked_adt/
$ zip -r ../eclipse/plugins/com.android.ide.eclipse.adt_22.0.4.v201307151829--741630.jar *
$ cd ..
$ rm -r hacked_adt
This worked for me... thanks E:V:A
I got just one error related to a dropbox class, but i think this is not important... hope that
lenieto3 said:
...Start an avd running the desired API to modify in this case API-17... This worked for me... I got just one error related to a dropbox class, but i think this is not important...
Click to expand...
Click to collapse
Thanks and sorry for late reply. I'm very happy to hear these instructions still works with API-17! Could you also upload your hacked JAR somewhere so that people can save some time when experimenting?
I was just here to check-in and try to bump this thread to see if it is still useful to anyone.
E:V:A said:
Thanks and sorry for late reply. I'm very happy to hear these instructions still works with API-17! Could you also upload your hacked JAR somewhere so that people can save some time when experimenting?
I was just here to check-in and try to bump this thread to see if it is still useful to anyone.
Click to expand...
Click to collapse
ive got access to ActivityManager's hidden methods.
I want to use the removeTask method, but it keeps saying that I dont have the REMOVE_TASKS permissions even though I added it to the manifest (and turned off lint).
Permission Denial: removeTask() from pid=9963, uid=10179 requires android.permission.REMOVE_TASKS
Does someone know if there are any automated tools to do/performs steps 1-9?
I'd like to see a tool to automatically pull (from phone), extract and create a compatible android.jar.
@Mohammad_Adib: Sorry, this is the wrong thread for those type of questions.
see this link stackoverflow.com|questions|30656933|android-system-framework-jar-files
Goodmorning,
I use apktool to decompile the apk. I edit some file in res folder, now I want to edit some java source file from apk and recompile with apktool to run the "new" android application.
With Dex2jar & jd-gui i extract the java source code.
Now i want to edit and covert into .smali because Apktool can build the application with smali code.
I found a script that uses 2 file(dx.jar and backsmali.jar)
1- javac myClass.java //compile myClass.java in myClass.dex
2-java -jar tools/dx.jar --dex --output= myClass.dex myClass.class // convert myClass.class in myClass.dex
3-java -jar tools/baksmali.jar -o myClass.smali myClass.dex //convert myClass.dex in myClass.smali
Javac work great it produce the file myClass.class.
The step 2 and 3 makes me trouble,the prompt show me a message:
trouble processing:
bad class file magic (cafebabe) or version (0034.0000)
...while parsing BuildConfig.class
...while processing BuildConfig.class
1 warning
no classfiles specified
Can't find the file BuildConfig.dex
impossible find C:\Users\Lorenzo\Desktop\java2smali\BuildConfig.dex
impossible find the file .
Please someone can help me?
sorry for my english....
Lollipop deodexing
Deodexing apk's on lollipop is almost as simple as API < 21 and only invoves two extra steps.
The workflow for the new deodex process is as follows below. The <arch> is the architecture for the apk being deodexed.
oat2dex boot system/framework/<arch>/boot.oat
oat2dex <path/to/app/<arch>/app.odex> system/framework/<arch>/odex
baksmali as normal
smali as normal
The actual behind-the-scenes info
ART changes things with its 'Ahead of Time Compiling'. Android creates a boot.oat on boot containing the classpath jars that apks
link against for functionality. Before these the .odex for the classpath was compatible with baksmali/smali, but due to changes with
ART vs Dalvik this is no longer the case now. The classpath needs to extracted from the boot.oat. The resulting dex/ and odex/ are then
used to create a bootclasspath that can be used to create a baksmali/smali compatible odex, by essentially deoptimizing it. Once
the compatible odex is created, baksmali and smali can be used like normal - even allowing smali edits to exisiting APKs.
A working (manual) example
To get started you will need to pull the framework directory off the device.
Code:
mkdir framework
cd framework
adb pull system/framework
The next step is to pull the app's folder from system/app or system/priv-app.
For this example I will be using SecSettings2.apk from a Samsung Galaxy S6.
Code:
mkdir SecSettings2
cd SecSettings2
adb pull /system/priv-app/SecSettings2
The next step is to determine the architecture of the apk to be deodexed. This is done checking whether the directory that the
apk's folder contents were extracted to contains an arm or arm64 folder (32-bit or 64-bit, respectively).
The SecSettings2.apk is 64-bit as its folder contains an arm64 folder.
Once the architecture is determined, the next step is to extract the classpath from boot.oat. Replace arm64 with arm below
if your app is only 32-bit.
Code:
oat2dex boot framework/arm64/boot.oat
This will extract the classpath from the boot.oat and place the dex and odex into separate directories in framework/<arch>.
Now the classpath can be used to create a compatible odex that baksmali and smali is compatible with. Note that the result odex
will have a .dex extension. This is NOT to be placed into the apk as the app will NOT work.
Code:
oat2dex SecSettings2/arm64/SecSettings2.odex framework/arm64/odex
We now have a odex (labled SecSettings2.dex in SecSettings2/) that is compatible with baksmali and smali.
To baksmali the odex:
Code:
baksmali -a 21 -x SecSettings2.dex -d framework -o smali/SecSettings2
To deodex the smali into a dex:
Code:
smali smali/SecSettings2
The last command outputs a classes.dex that is going to go into the apk.
Code:
zip -gjq SecSettings2 classes.dex
Now we need to remove the arm or arm64 folder from the apk's location on the device.
Code:
adb shell su -c 'mount -o remount,rw /system'
adb shell su -c 'rm -rf system/priv-app/SecSettings2/arm64'
Now we simply need to push the apk to the device, fix permissions, and reboot.
Code:
adb push SecSettings2.apk /data/local/tmp/
adb shell su -c 'dd if=/data/local/tmp/SecSettings2.apk of=/system/priv-app/SecSettings2/SecSettings2.apk'
adb shell su -c 'chmod 644 /system/priv-app/SecSettings2/SecSettings2.apk'
adb reboot (You may need to wipe data depending on the app being deodexed)
That's it. Happy modding
But I have made it easy for ya.....
deodex-app makes it stupid simple to deodex an apk from the device by running one command
Code:
./deodex-app SecSettings2.apk
That's it. The script will determine the apk's location in system, check if it's already deodexed, pull the neccessary
files to perform the deodexing, and will push the apk back to the device and reboot.
/lazydev
Huge credits to @JesusFreke for baksmali and smali, and credit to @svadev for the updated oat2dex
Hey guys I'm wondering if someone could help me setup smali/baksmali on linux.
I downloaded the jar. Put the jar, the odex file, and the folder containing my framework files inside the same folder opened a command window inside that folder.
But when I try to call baksmali with
java -jar baksmali-2.2b4.jar -x LGEIME.odex -d ddt -o outclass
I get an error saying -x is an unknown command.
Thanks for any help anyone can provide.
Figured out the new smali/baksmali has new commands. Haben't had to deodex anything, but have smalied a dex file.
Hi ...
i am try to de-odex my stock rom... when i try auto deodexer, 2 file get error:
SemcContactsProvider.odex and Dialer.odex (both in "/system/priv-app")
I try to manual deodexing
I check my BOOTCLASSPATH:
Code:
adb shell
cat $BOOTCLASSPATH$
and run this commend:
Code:
java -jar baksmali.jar -x -c :core-oj.jar:core-libart.jar:conscrypt.jar:okhttp.jar:core-junit.jar:bouncycastle.jar:ext.jar:framework.jar:telephony-common.jar:voip-common.jar:ims-common.jar:apache-xml.jar:org.apache.http.legacy.boot.jar:tcmiface.jar:telephony-ext.jar:WfdCommon.jar:oem-services.jar:qcmediaplayer.jar Dialer.odex -o Dialer
get error: Cannot locate boot class path file /system/framework/core.jar
But not such file in Sony Stock ROM !!!
How can i deodex the stock nougat? tnx
Okey I solved
close the topic tnx