‫Instructor: Hi, within this lecture,
‫we are going to see how we can build
‫this newly manipulated app that we have created
‫and then we are going to see how we can set it up
‫so that it can be run on any device,
‫any Android device, okay?
‫So the big thing about APK tool is that we can rebuild it,
‫as I said before.
‫So we have changed the Dalvik bytecodes.
‫We only changed the tax right now
‫but we could have changed the whole method as well.
‫And we are going to do that within following lectures.
‫We are going to hack into a game, for example,
‫and we are going to manipulate the game
‫in a way that we want.
‫But right now we just change a text.
‫Now, in order to build this,
‫we are going to use the app debug folder over here
‫and we are going to use APK tool.
‫Make sure you are on desktop
‫or your downloads wherever your app debug folder is.
‫We are going to say APK tool and this time help.
‫Why? Because maybe you don't know how to use APK tool.
‫You can read the documentation if you want.
‫You can actually go into the GitHub page
‫of APK tool as well to find about more information.
‫But I'm gonna show you
‫the
‫comment
‫in a very direct way because it's very easy.
‫All you have to do is just hit B rather than D
‫D for decompile and B for build
‫and write app debug or your folder name.
‫So rather than apk, I'm just writing app debug.
‫Even, I'm going to delete it so
‫it won't get very confusing for you.
‫We just have this app debug folder, okay,
‫we're working with that.
‫We can add
‫-: o
‫to
‫specify
‫an output name
‫for our newly created apk file like this.
‫But don't forget to add
‫apk extension
‫at the end of your name
‫like this,
‫newapk.apk
‫and it will build
‫the small codes.
‫It will build the Dalvik bytecode.
‫It will build all the durables and everything inside
‫of resources
‫manifest
‫and it will create our
‫newly
‫signed
‫newly created
‫apk
‫manipulated apk.
‫Okay?
‫But again, we need to sign this.
‫So if you're on Kernel Linux,
‫make sure you upload this to files.fm
‫or any other service and send it
‫to your host machine because you will need to sign it.
‫You will need JDK, Java Development Kit
‫in order to sign this APK
‫so that
‫it can be run
‫on any
‫version of other devices.
‫Okay?
‫And by version, I mean you can actually,
‫maybe you can try this with your emulator,
‫but most of the time it won't work on real devices,
‫like phones or tablets because you need to sign it first.
‫And I've opened my underage studio
‫and the only reason
‫that I've opened this is to run the emulator rather
‫than the application itself.
‫Okay?
‫I don't--
‫I won't have the source codes when I am trying to hack
‫or when I'm trying to reverse engineer and under it apk.
‫So it doesn't matter that I have opened under IT studio.
‫All it matters is that I have a running emulator
‫in my machine
‫so that I can run this newly created APK
‫and try to see if that works or not.
‫So I'm going to
‫delete
‫the
‫existing My Reverse app
‫on my phone, okay?
‫Because we already have this version
‫and we don't want this version.
‫So I'm going to close this down
‫and let me close everything in my emulator
‫and then later on, I'm going to find My Reverse app.
‫So I'm going to delete this
‫like that uninstall, okay.
‫Say okay.
‫And here you go.
‫We have uninstalled this My Reverse app.
‫So in your emulator, you can try to drag and drop like this.
‫As you can see, even in emulator we get this err.
‫it says that APK has failed to install.
‫So this is because of the signing issue.
‫We need to sign this to make sure that it works on devices.
‫So we have covered the signing thing.
‫You can actually generate a signed APK from here
‫but we are going to learn how to manually sign this.
‫Actually, we covered that as well in the backdoor section,
‫right?
‫We had this terminal codes.
‫We had this command prompt codes comment
‫that created a key store for us
‫and then we use Jar Signer to sign
‫our APK
‫with that key store.
‫So I'm going to open my notes one more time.
‫I assume that you already have this notes, but if you don't,
‫you can find it from this resources of this lecture
‫or resources of the backdoor section as well.
‫Remember this key tool and jar signer comments
‫that we have used.
‫That's exactly what we are going to do now.
‫So let me zoom in a little bit so you can see it better.
‫Okay
‫and since this is
‫too
‫long,
‫I'm just gonna copy
‫and paste this, okay?
‫And this will create a key star file for me
‫which I can use
‫to sign
‫APKs.
‫And when I do that, it will ask me
‫for my personal information and I can give them if
‫I want but I can't just leave it blank
‫if I don't want to give out my personal information as well.
‫So after that I'm going to use Jar Signer
‫to use
‫this key store
‫to sign
‫the name APK.
‫So all you have to change is the name
‫of the APK in the second command.
‫So I'm going to create my key store first with my terminal.
‫And since I'm in Mac, I'm going to use my terminal.
‫But if you're on Windows,
‫you can use your command prompt as well.
‫And if you're on Linux,
‫of course you can use your terminal as well.
‫All you need is to copy and paste this comments.
‫So let's do that.
‫First, I'm going to change the APK name
‫to new APK over here, okay?
‫It has to be exactly the same with your own APK name.
‫Then I'm going to copy this first one
‫and
‫paste in my terminal like this.
‫And I'm going to hit enter, it will ask for my password.
‫So this is a new password
‫that you're creating
‫for this
‫key store only.
‫Okay?
‫So you're more than welcome to choose your own password,
‫just type it and it won't show up in your terminal like this
‫for security reasons.
‫Just retype it one more time and hit enter.
‫It's typing actually, but you cannot see it.
‫And over here it will ask you for your first name,
‫last name, city, zip code and stuff.
‫So we can just skip those.
‫Most of the security researchers or hackers tend
‫to skip those.
‫So I'm going to hit enter until I see
‫a
‫no
‫instance, okay?
‫Until I see
‫a no letter over here like this.
‫So if I see this, no
‫then I'm going to type yes and hit enter like this.
‫So here you go.
‫Now we created our key store file and here it is.
‫So now we are going to use this key store, okay?
‫To sign our APK, I've already changed my APK name to be APK.
‫And as you can see,
‫my release keystore.key.keystore is written here as well.
‫Since I didn't change the first one,
‫there is no need to change the second comment as well.
‫So I'm going to paste it and hit enter.
‫It will ask for the password that you have just chosen
‫and just give that password to confirm
‫that you are actually the one who's signing it.
‫And here you go.
‫Now you have a signed APK.
‫Now let me open my emulator
‫and after signing it should work fine like this.
‫And here you go.
‫Now we manage to install the APK.
‫So if I open My Reverse app right now, here you go.
‫Hello Dalvik appears on the main activity screen.
‫So this was a fairly simple example
‫but you have
‫learned
‫how to decompile apps
‫using APK tool,
‫how to manipulate the apps
‫and how to rebuild the apps after you are done.
‫And how to sign your apps to make them ready
‫for using in Android devices.
‫So this is a very, very big step actually.
‫Now all you need to do is to find where you want
‫to manipulate or where you want to change and try to find,
‫try to locate that code
‫in Dalvik bytecode
‫and change it if it's applicable.
‫So
‫if
‫that succeeds,
‫then you will actually change the app.
‫You will actually manipulate the app.
‫This goes for apps, this goes for games.
‫No matter
‫what
‫kind of
‫thing
‫that we are talking about,
‫as long as this is an Android application.
‫It's a big thing.
‫Okay. Of course this is not sufficient for you.
‫You have to do much more exercise.
‫And we are going to try and do some other exercises,
‫other practices in this section
‫and in upcoming sections as well.
‫So I'm not going to leave this here.
‫We're going to use APK tool
‫and the other JDX tool as much as we can during this course
‫'cause they are so important in this process.
‫So I'm gonna stop here and continue within the next one.