All right, guys, let's come to our final section for this.
So the last thing we need to do is we need to know how to sign an application and therefore, we need
to understand why we have to sign an application.
And this is what we are going to learn in this section here.
All right.
Here we've got our smartphone with the following two applications.
We've got the com example mail and we've got the com example checks.
Now the com example mail wants to check if there's any update available in the Google Play store and
the Google Play store corresponding with the new update of its version.
So the new package version now is a question how can we make sure that this update is regarding to this
application?
Well, there seems to be a pretty easy question, right, because we have this package name and this
package name is a unique identifier for this application.
Yeah, that's true.
But the package name is only a unique identifier for this application on this device, not for the Google
play store.
So how can we make sure that both applications are really from the same developer?
Because I can simply open up Android studio and create an own package name with com example dot main.
And this would be pretty ridiculous if this application now fetches update from a different developer
based on this package name.
And this is the problem that's signing source.
So the developer is creating a private key and the developer can now sign this application with this
private key.
So it's a public private crypto based operation.
It's like writing your signature under this application.
And now the Google Play Store has the signed application by the developer, and the application is also
asking the Google Play Store if there are any updates available.
And now the Google Play Store can check.
Oh yeah, both applications has been signed with the same key, so they are from the same developer
and they have the same package name.
The one in the Google Play store has the higher version as the application on the device.
So this is an update for this application on the device.
So let's imagine you lose this private key for your application.
This means the attacker who got this private key has the possibility to update your application so the
attacker can sign a new version of your application and all other applications will be updated so the
attacker could insert some malware.
Therefore, please make sure that you keep your private key private stored in some software safe or
even in some hardware safe.
I also assumed that big tech companies store their private keys.
Like, Yeah, other companies, they are diamonds or things like this.
Because if an attacker can get this private key, this would be super bad for this company.
All right.
Besides signing an application, we can do even more stuff because this whole process verifies the author
of this app, and we can use this for more advanced features.
We have seen that applications sometimes need the ability to share data between each other.
Let's assume we've got this com example of mail application and we've got the com example dot calendar
application.
It would be nice if the calendar can keep or if the mail application can access those calendar.
And yeah, schedule meetings and stuff like this.
We have seen we can export these activities, content providers or whatever we choose in this case,
but we have also seen that this is a pretty bad idea because every other application can also access
them so the developer can declare those activities, content providers or other components with an own
tech, which means if this application is signed by the same certificate, then those two applications
can share these data between this connection.
This means that these activities, content providers or whatever we talk about are not exposed to the
whole world.
These are just exported to application that has been signed by this developer.
And this is super great because the data exchange can happen and there's also no security vulnerability
until the attacker has the private key, but then the whole system will messed up.
So this is some safe way to exchange these data based on the signing process.
So we do not need this during this course to exchange data based on the same signing certificate.
But it's good to know that this option exists because if you are a developer, then please use this
instead of exporting your activities to the outside world.
We have talked a lot about signing an application and we also talked a little bit about the handy features
that comes with this signature or signing an application.
Now we want to finally look at how to sign an application because this is the last step that is required
for our final challenge at the end of this section.
So let's do a quick recap.
So we've got our game APK.
This is the application we want to modify and our aim is the game mode.
APK The modified version which is in this purple or however you call this color version.
What we have to do is we have to decompile or decode this application first.
Then we get the directory structure, which we are pretty familiar with this right now.
We know the purpose of those files and we can do our modification on this.
For example, if we want to change the source code, we can modify the smiley files or even the resources
in.
Assets directory and things like this.
After we've done our modification, we need to build this directory structure back again into an application.
And this is what APK Tool B does.
This is our point where we are right now.
So now we need to sign this application that we can install this and designing can be done with the
char sign.
This was my approach for the last seven years, so by using the char signer we can sign this application.
But this is not working anymore for Android version 11.
I stumbled across this during the preparation of this course and I got super freaked out.
Why is it not working anymore?
What?
What have they changed?
And stuff like this.
Okay.
And then I figured out that they have changed designing process.
So the layout is a little bit different and this is what Char Sinha is not handling anymore.
Therefore, we have a new approach for this, but it's also not that complicated.
We simply have to use simple line first and then the APK signer.
What zip line does is it prepares some offsets, some pets for the certificate that the application
has the certificate at the correct place.
So if the certificate is longer or smaller, it will fit into the correct place right now and the application
can then reference to this and can install the successful.
And yeah, this is how we can sign an application now for the Android version 11 because this is the
most up to date version and this is what you deserve when you have purchased this course.
A working solution for the most up to date version right now.
All right.
Let's see how we can do this, because signing requires a certificate and a private key.
So how can we create this?
So our certificates needs to be stored in a key store, which is some kind of save.
And we can create a new key store by opening a terminal using the key tool and providing the following
parameters.
It looks a little bit complicated, I'm absolutely honest with you, but let's go through to this and
you will figure out, okay, we can handle this.
So the first parameter is generate a new key, dash chain key, and this simply generates a new private
key.
Then we've got a dash V option which is not verbose.
It's print a certificate in a human readable form.
So normally your certificate will be stored in some binary form, but with the dash li option we can
say okay, it is human readable, which is a little bit more easier afterwards.
Then we have to provide a new file and this is the key store.
In this case we are creating a new key store because this file doesn't exist.
Then we have to provide an alias name, which is the reference to our certificate.
In this case it's just alias underscore name, but we can choose whatever we like.
For example, Utme or EpiPen testing or hacking certificate, things like this.
We just have to remember this alias name, but we can also print it out later on.
Of course, then we use the key algorithms, which is RSA, a key size.
We use 2048 because it's just a hacking certificate and it doesn't have to be that secure.
And then we've got the validity, pretty hard word validity.
Yeah, that's correct.
Which simply describes how many days the certificate is valid.
So in this case, it's valid for one year and that's all.
Then we have created our key store.
So the next step is now to use this key store, the certificate within this key store to sign this application.
And this is where Sha signer has been used in the past.
We can use char sign signer with the parameters we have provided.
We just need to reference to the alias name.
So the alias name which is orange right here is the alias name which has been defined as the reference
for the certificate in the key store.
So these names need to be similar, of course.
Otherwise the char sign I cannot find the certificate in the key store and that's it.
And after using char signer we can also use zip align to meet those offsets.
But this hasn't been that necessary in the past.
Sometimes it was necessary, but it's pretty rare.
So I guess I used it, let's say five up to ten times within the last seven years, the zip alignment
to get the certificate correct.
But this has changed right now.
So now we have to do the approach for Android version 11.
And this is the same regarding to the key store file.
So we are creating a new key store and after creating this key store, we now use zip align first and
afterwards we simply use APK Signer and provide the key store file and the APK file and that's all.
So I would recommend we take a look at this approach and we keep this approach, not the other one,
because this is the most up to date and this will work on all versions.
All right.
So let's do this now in practice.
All right.
Welcome back.
This whole theory stuff might be a little bit confusing, so let's do this in practice and then you
will see.
Okay, it's not that hard.
We now create our own key store and then we sign an application with a certificate that is stored in
this key store.
So let's go.
We open a new terminal, make this a little bit bigger and.
Then we used this key tool command.
But before.
Let's make sure.
Okay.
There's no key store here available.
I put this in the home directory, but you can put it whatever you like.
You just have to remember the reference, of course.
So I'm using the key tool command here.
And you can also find this in the PDF Cheat sheet in this which is attached to this course.
So if you want to copy paste this, feel free to do so.
Otherwise we go through the parameters and you can also type them in.
Now we've got this key tool alias.
This is the alias name and this is the reference to the certificate that gets stored in this key store
afterwards.
So we are creating a new key store and a new signing certificate in one step here.
This is with the chain key parameter here.
Key algorithms error is a the key size and this one here is now the key store file.
So I put this in the current directory under the name Android Dash app dash dash key store signature
algorithms sha one and validity, which is still a hard word, is 365 days.
Then we've got dash v four.
Make the certificate human readable and not verbose.
This is not a verbose flag.
This does make the certificate human readable.
Okay, now we need to end our password.
Why?
Because it's a key store.
And this key store is a kind of safe.
And this safe wants to be protected with a password.
The default password for Java applications or Java key stores is change it.
And I stick to this, but you can choose whatever you like right here.
I have to retype this and now we have to define the parameters for our signing certificate.
So we have to provide first and last name and we can take whatever we want.
We can leave them unknown or define values because this is a self signed certificate and we do not care
about this.
So yeah, we can put in whatever values we like.
All right.
I chose here Udemy, for example, and here hacking.
And this is unknown.
This is unknown, this is unknown.
This is unknown.
And here this is the last master question here is if you have passed the test because if you hit enter,
you have to repeat the step right now.
So here the key store file is checking if all those values are correct.
And yeah, in my case, I hit our type in.
Yes.
And then enter and then the key store gets generated.
If you stumbled across this and you already hit no, then please repeat the step until you reach here
again.
All right.
It says a new certificate has been generated and also a new key store which is here right now.
Let's check this.
We've got a new file and this is the Android Key Store.
If you want to print these values, let me clean this real quick.
We can use the key tool with the Dash L list command.
And then we have to provide the key store file, Android app, key store, and then we can list those
certificates.
Of course, we have to provide the correct password for this.
And here we can see we've got one certificate which is referenced by Alias underscore name.
This is the fingerprint and here are some features.
It's signed with SHA1, with RSA and things like this.
Now, if you want to add a new certificate into this key store, we can use the same command.
So the same key to the command, you can use your arrow keys on the keyboard to browse in the history.
So arrow keys up three or four times.
Then you get the command back.
The only thing we have to change is, of course the alias name, because this is the reference to the
certificate and I choose Udemy in this case.
Now, you do not have to do this.
I'm just showing this to you that you understand what's going on right here.
I also make a nice explanation.
I hope it is nice with my drawing board afterwards.
So yeah.
Sit back and relax.
Stick to one certificate.
You will be fine with this.
Okay.
And a key store passport.
It's change it for me.
Now I say I'm a developer.
Aptiv and these data are correct.
Now the second certificate has been added.
Clear the screen.
Let's verify this.
All right.
We can see two entries.
We've got one our alias name, and now we've got Udemy.
And this Udemy has now just developer certificate status.
Okay, let me bring up my drawing board and show you what we have done so far that you can follow this
a little bit easier.
So here we are in the home directory and what we've done is we've created a new key store with the generate
new key.
We also did add new certificates.
In our case, there are now two certificates right there.
One is referenced by the alias underscore name and one is referenced with the alias named Udemy.
So these are now both stored in this key store.
And if you want to use one of them, we have to provide the correct alias name.
Of course, for this one, we have to provide alias name.
And for this one we have to provide Udemy.
This is what we've done so far.
All right, now let's sign our application.
We have compiled and edited the contacts before to an space pane application.
So let me show this real quick to you.
Here we are, space paying decompile.
Here we have space and here we have the Android manifest example with the newly added permission right
here.
Then we did build back this app again and we've got this destination and here we've got our base APK
Now we want to assign this APK and install it on our virtual device.
But before we do this, let me show you something real quick, because this application has not been
signed right now.
I will show you.
I use ADB Shell.
Well, no, I'm a writer.
I have to start the emulator first.
And so I did start this emulator right now let's see, ADB, Shell, no devices.
I have of course connect to this first.
All right.
Now it's up and I use ADB install base APK.
And that says, no, I'm not going to install this application because it has no signing certificate.
Let's decompile this and verify this.
So apk tool the on the base apk which is the code.
But I say decompile.
We're going to open this in a directory.
And within the original directory there should be this meta inf directory and this one is missing.
And the meta info directory contains all designing information the signature file, the manifest file,
and also the signature itself.
So this one has not been added right now.
If we now sign this application and they compile it afterwards, there should be a meta inf directory
corresponding to our certificate.
So let's do this.
I'm going to delete the base directory.
Please be careful if you have followed me so far that you do not delete the base.
AP Okay, all right.
And now we use the zip line first to make sure that the alignment and the offsets are correct afterwards.
So let's take a look at the zip line parameters.
We've got zip a line and then there should be verbose output and we have to use an alignment which is
on Android applications always for bytes.
Now we have to provide an in file which is the our base APK and we have to provide an out file because
zip alignment is not doing this operation on the same file.
Therefore we named this out APK for example.
It saves verification successful.
So this application now has been signed.
We use the APK signer to install this application right now.
So APK sign up.
We say sign using this key store and we use our out APK file.
The passport has been changed.
And now in my case it says, Ooh, there are more than one cert entries.
We have to choose which one we want to use.
If you only have one certificate in your keystone, then you will be fined.
It will automatically use this one.
In this case, I simply say dash, dash keys, key alias.
And in my case I use, for example, Udemy, or now let's say I use alias underscore name.
Then we are equivalent and have the similar certificate and things like this.
Not a similar certificate but the similar alias name.
Oh, and please make sure that you have the parameters at the correct place in your arguments so this
is not possible afterwards.
We have to do this before.
All right.
Now I have to use the password again and yeah, no error message.
So I would assume this application has now been signed.
And here we can see our new out APK file and this file can be simply ignored.
So now we can say adb install out APK.
And we get an error because the package name signature does not match the previous installed version.
We have instructed space ping application before and now we want to update this application with a signature
that is different.
This is the case we talked about designing process.
We cannot update an application based on the same package name but different certificate.
Therefore, we have to uninstall this first or we have to.
We can also use ADB install to override this file, but uninstalling is way more clean.
So let's uninstall this application.
So I swipe this up.
I hold this pretty long with my left mouse button, and then I simply drag it to uninstall.
All right.
Uninstalled space pane.
Now let's install our modified version with the context permission.
So if you are installing process hangs at this moment, please take a look at the virtual machine because
here we can see, oh, it's blocked by play protect because it doesn't include the latest privacy protections,
but we can say install anyway.
And we don't want to send notifications to Google.
So now we should have this application being installed.
So here we have now this application installed and if you click on this.
We can see it's working.
So we can now start playing this game.
But yeah, we already did this.
But if you want to make yourself familiar with it, feel free to go on.
I will quit out and have a look into the settings, the permissions of this app.
So apps.
SpaceX ping a permission.
No.
This one.
And here we can say can see call logs and contacts.
So we've got now two permissions added beside evaporate.
Evaporate is not listed here because this application doesn't request the permission on a virtual machine.
But here we can see our modification has been successful.
We have added and permission into this application, which is great.
In the next video we take a look at the meta info directory because this one is missing right now in
our Android structure.