Is it possible to inject code in an android application?

Question

I would like to inject code in an android application at runtime. I have tried to use dx tool to generate a dexfile in the sdcard but when i want to instantiate, it fails. Are there any tools to inject code generating new dalvik bytecode? I am studing some libraries, aspecjt or guice for android. Is it better to work with a script language?

Thanks people :)

Sounds like whatever you're doing is extremely wrong and even if it does work, has more malicious use than legitimate — Falmarri, Nov 23 '10 at 19:56
This is not the idea, i would like to use a tool similar to BCEL Or to ASM. You can adapt the code to the available information. ;P — Sergio, Nov 23 '10 at 20:06
If you would like to extend one of your own self written applications by invoking dynamically added code, please re-write the question to say so. — Chris Stratton, Nov 23 '10 at 20:24

score 8 · Answer 1 · edited Sep 17 '19 at 12:23

Dexmaker is new and designed just for this. Here's part of the example from the project website:

    DexMaker dexMaker = new DexMaker();

    // Generate a HelloWorld class.
    TypeId<?> helloWorld = TypeId.get("LHelloWorld;");
    dexMaker.declare(helloWorld, "HelloWorld.generated", Modifier.PUBLIC, TypeId.OBJECT);
    generateHelloMethod(dexMaker, helloWorld);

    // Create the dex file and load it.
    File outputDir = new File(".");
    ClassLoader loader = dexMaker.generateAndLoad(HelloWorldMaker.class.getClassLoader(),
            outputDir, outputDir);
    Class<?> helloWorldClass = loader.loadClass("HelloWorld");

    // Execute our newly-generated code in-process.
    helloWorldClass.getMethod("hello").invoke(null);

score 2 · Answer 2 · answered Nov 24 '10 at 00:01

You can specify your own DEX file with the DexClassLoader class. This is used by a few apps that want "plugin" behavior.

There's nothing on the device that will generate DEX files, however. There is no mechanism for generating code on the fly and making use of it.

score 0 · Answer 3 · answered Mar 01 '12 at 11:54

Generating Dalvik Bytecode at Runtime on-device Using ASM or BCEL

This example use ASM and BCEL to generete two classes on-device. The classes are created into SD Card memory and then they are loaded into Android operating system dynamically.

The following class is the template of the example:

public class HelloWorld {
    public static void hello(){
        int a=0xabcd;
        int b=0xaaaa;
        int c=a-b;
        String s=Integer.toHexString(c);
        System.out.println(s);
    }

}

Firstly I have used BCEL or ASM to create a new ad-hoc class in SD Card. Secondly I have converted the Java Class to a Dex Class with the Dxclient utiliy in SD Card. Finally I have created a jar file and then I have loaded this package into the device from SD Card

DXClient reference

https://github.com/headius/dexclient/blob/master/src/DexClient.java

score -2 · Answer 4 · answered Aug 08 '13 at 13:55

-2

You can look this page, but you have to use some tools like APKTool, SignApk.

http://blackhatcrackers.blogspot.de/2013/05/injecting-custom-code-into-android-apks.html

answered Aug 08 '13 at 13:55

Goshawk

89
1
1
8

He's asking about live code injection at runtime. Not reverse engineering and recompiling it. – ShihabSoft Dec 07 '16 at 15:32

score -15 · Accepted Answer · answered Nov 23 '10 at 20:05

-15

No, it is not possible. Android application permissions would not work if that was possible.

answered Nov 23 '10 at 20:05

Juhani

5,076
5
33
35

6

Android application permissions are totally unrelated to this. The permissions (like network access and external storage) have to work for native code, so they're built on Linux process security mechanisms rather than language features. Barring a security hole, there is nothing an application can do to circumvent them. – fadden Nov 24 '10 at 00:03

Is it possible to inject code in an android application?

5 Answers5

Linked