Is it possible to inject code in an android application?

Question

I would like to inject code in an android application at runtime. I have tried to use dx tool to generate a dexfile in the sdcard but when i want to instantiate, it fails. A

Answer 1

Dexmaker is new and designed just for this. Here's part of the example from the project website:

    DexMaker dexMaker = new DexMaker();

    // Generate a HelloWorld class.
    TypeId<?> helloWorld = TypeId.get("LHelloWorld;");
    dexMaker.declare(helloWorld, "HelloWorld.generated", Modifier.PUBLIC, TypeId.OBJECT);
    generateHelloMethod(dexMaker, helloWorld);

    // Create the dex file and load it.
    File outputDir = new File(".");
    ClassLoader loader = dexMaker.generateAndLoad(HelloWorldMaker.class.getClassLoader(),
            outputDir, outputDir);
    Class<?> helloWorldClass = loader.loadClass("HelloWorld");

    // Execute our newly-generated code in-process.
    helloWorldClass.getMethod("hello").invoke(null);

Answer 2

Generating Dalvik Bytecode at Runtime on-device Using ASM or BCEL

This example use ASM and BCEL to generete two classes on-device. The classes are created into SD Card memory and then they are loaded into Android operating system dynamically.

The following class is the template of the example:

public class HelloWorld {
    public static void hello(){
        int a=0xabcd;
        int b=0xaaaa;
        int c=a-b;
        String s=Integer.toHexString(c);
        System.out.println(s);
    }

}

Firstly I have used BCEL or ASM to create a new ad-hoc class in SD Card. Secondly I have converted the Java Class to a Dex Class with the Dxclient utiliy in SD Card. Finally I have created a jar file and then I have loaded this package into the device from SD Card

DXClient reference

https://github.com/headius/dexclient/blob/master/src/DexClient.java

Answer 3

No, it is not possible. Android application permissions would not work if that was possible.

Answer 4

You can specify your own DEX file with the DexClassLoader class. This is used by a few apps that want "plugin" behavior.

There's nothing on the device that will generate DEX files, however. There is no mechanism for generating code on the fly and making use of it.

Answer 5

You can look this page, but you have to use some tools like APKTool, SignApk.

http://blackhatcrackers.blogspot.de/2013/05/injecting-custom-code-into-android-apks.html