1

I want to monitor the https traffic of an Android app downloaded from google play.

This app can only be run at Android N and above.

So I use Charles proxy and follow this document to modify the apk file.

Here's what I have done:

  1. Download the app from google play.

  2. Use apk extractor to get the apk file of the app.

  3. Run apktool d the_app.apk to extract the apk file.

  4. Modify res/xml/network_security_config.xml and AndroidManifest.xml based on the description of Charles Proxy document.

  5. Run apktool b the_app to package the files back to an apk file.

  6. Install the apk on my Android phone, whose version is 8.

  7. My phone says "App not installed".

Why can't I install the modified apk on my phone?

I've disabled Google Play Protect on my phone.

The apktool is installed by following the description here.

Is there anything I missed?

Improve this question
1

1 Answer 1

Reset to default
2

The generated APK file by apktool needs to be signed before you can install it on a Android phone or emulator:

First you have to create a key-pair for signing stored in a keystore (only required once):

keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000

Note this command uses keytool for JDK. source

Then you have to sign the app using apksigner which is part of the Android SDK:

java -jar build-tools\29.0.3\lib\apksigner.jar sign -ks my-release-key.keystore <apkfile>

Now you can install it on the device:

adb install <apkfile>

If you have the original apk file installed on device you have to uninstall it. because of the changed signature you can install your modified apk file over the already installed original file.

Improve this answer
9
  • Thank you. Where can I download apksinger.jar for my macOS? I've downloaded the "command line tools only" page here, but can't find apksigner in the file I downloaded.
    – Brian
    Jun 22, 2020 at 13:53
  • Do I have to use sdkmanager to install apksigner?
    – Brian
    Jun 22, 2020 at 13:53
  • It seems like that I have to first install build-tools by running sdkmanager --install 'build-tools;29.0.2'
    – Brian
    Jun 22, 2020 at 13:58
  • I've found that apksigner is installed in /usr/local/Caskroom/android-sdk/4333796/build-tools/29.0.3. This path looks is rarely seen to me.
    – Brian
    Jun 22, 2020 at 14:00
  • 2
    @l3l_aze App repackaging requires more modifications and can be detected by the app easily. A lot of apps don't work if you just change the packageName. Therefore changing the packageName may make such a test way more complicated and error prone than it has to be. On the other hand uninstalling the app is simple and can be done by every body.
    – Robert
    Jun 25, 2020 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .