I have created an application which uses interfaces and classes as well as permissions from the hidden API. Now I would like to create a flashable zip file which installs the apk as system app. If I'm right for this I have to sign the apk file with the certificate of the current ROM (because of the hidden API usage).

To be as systemless as possible I thought it would be great to extract the certificate from the ROM and sign the apk within the flash process before copying it to the internal storage. Is this possible?

Or have I misunderstood something and it is much easier as I think?


It seems you've got some misunderstandings here: to sign a package you need the key, which you cannot extract from the ROM (it's not there or it would be a security issue). So you'd need that key only if your app requests permissions protected with the level¹ signature (for signatureOrSystem it suffices making it a system app).

From your question I cannot say what category your app's permissions fall into – but that would be out of scope here anyway, as Android.SE is focused on end-users. To clarify on that, you're better off with Stack Overflow.

¹ Disclosure: link goes to my site

  • Thank you for this helpful answer. I ask because of this permission. Is has no signatureOrSystem but maybe privileged or development are also okay?
    – Cilenco
    Oct 12 '17 at 14:17
  • I'm not 100% sure (our friends at SO should know), but for privileged it should be sufficient to place the .apk into /system/priv-app/ (as Chinmay pointed out). According to the dev docs this replaced system for api 24+ (see details on PROTECTION_FLAG_SYSTEM there). For development, see the first link I've provided in my answer.
    – Izzy
    Oct 12 '17 at 15:30
  • Ah okay thank you! Btw the first link of your answer is protected with htaccess.
    – Cilenco
    Oct 12 '17 at 15:52
  • Oops – fixed that, sorry (was the wrong link). And I will ASAP update that list with the new protLevels added since MM.
    – Izzy
    Oct 12 '17 at 15:57

I've done some experiments with system apps myself. So I'm telling this out of experience — If you've made a release app from Android Studio (try avoiding the debug releases), you don't need any certificate-patching. Go ahead and create a flashable zip with appropriate permissions (0644) that puts the app in /system/app/ or /system/priv-app/ if you need full access to some of the system permissions.

I advise you to first try putting the app manually using any root explorer in the /system directory because flashable zips can get overwhelming if they don't work in few tries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.