Make frequent validations with Google via your backend.Always verify purchased item and then give access to the app.The same method is used by websites that distribute hacked applications. The easiest way to achieve this is to write the actual Kotlin/Java code, compile and then decompile it to get the Smali out of it, or directly write Smali bytecode which I prefer for simple tasks like this.Īfter that, the app will always start with the boolean flag true. Doing those kinds of operations on-devices is the red flag 🚩! During the analysis, I found out this application X was saving the boolean flag in the Android SharedPreferences after the successful transaction. I will not go into details, because it can be found anywhere on the internet. The very first step is to decompile the APK into Smali code.

So I downloaded APK and installed it manually but the premium features were not available. Let’s talk about my use case, I purchased a premium feature on Google Play but the app itself was not available on the Huawei store. This blog tries to underline obvious pain points and recommend solutions. The story below applies to a wide range of applications and can be done on different levels. Doing things on-device is never a good idea. It means, sometimes they opt-out validating previously purchased items on app start, therefore leaving an open door for any malicious actor. Sometimes applications try to use shortcuts and do not follow full instructions and recommendations by Google. You can read more on implementation details here: Problem This allows purchased items to be shared across the devices.īut what about Huawei where Google Play Services is not running/available? Huawei provides an almost identical In-App Purchases (IAP) API, although user can’t transfer their purchases and subscriptions between platforms. Once bought with the user’s Google account it is stored forever on the Google server with its unique purchase id. Lots of Android apps offer in-app purchases to users for the premium features or some kind of tokens for games, etc. I rewrote the bytecode to unlock premium features of the app on my device and now I will show you how to prevent it from happening to your apps.ĭo not download APKs from random websites, as they might have injected bytecode and potentially steal the data from device.

This blog is for EDUCATIONAL PURPOSES only as it exposes common vulnerabilities in Android applications.

Smali code injection