I had the need to take an existing Android APK, tweak it, and rebuild. This is not too difficult, but I did have to download the tools from a few different sites, and find a full list of instructions. Thus to make this easier, here is a quick recap of what’s needed.

Download the following:

• apktool - tool for reverse engineering Android apk files. In this case can extract and rebuild.
• keytool - Java tool for creating keys/certs. Comes with the JDK.
• jarsigner Java tool for signing JAR/APK files. Comes with the JDK.
• zipalign - archive alignment tool, that comes with the Android SDK.

Some extras:

• JD-GUI - Java Decompiler
• dex2jar - Converts Android dex files to class/jar files.

Instructions:

We assume you are on a Linux or Mac, but this will work (with some tweaking) on Windows. Install a recent Java JDK, then the Stand-alone Android SDK, and finally apktool.

Optionally setup some alias:

alias apktool='java -jar ~/bin/apktool_2.0.1.jar'
alias dex2jar='~/bin/dex2jar-2.0/d2j-dex2jar.sh'
alias jd-gui='java -jar ~/bin/jd-gui-1.3.0.jar'

First, unpack the application.apk file. This will create a “application” directory with assets, resources, compiled code, etc.

apktool d -r -s application.apk

Now poke around, and edit any of the files in the application directory. If you wish to decompile any java you can do the following:

# Convert the Dex files into standard class files
dex2jar application/classes.dex

# Now use the JD (Java Decompiler) to inspect the source
jd-gui classes-dex2jar.jar

Once you have made your changes, you need to repack the APK. This will create a my_application.apk file:

apktool b -f -d application
mv application/dist/application.apk my_application.apk

The APK must be signed before it will run on a device. Create a key if you don’t have an existing one. If prompted for a password, enter anything (but remember it).

keytool -genkey -v -keystore my-release-key.keystore -alias alias_name \
                   -keyalg RSA -keysize 2048 -validity 10000

Now sign the APK with the key:

# Sign the apk
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name

# Verify apk
jarsigner -verify -verbose -certs my_application.apk

Finally, the apk must be aligned for optimal loading:

zipalign -v 4 my_application.apk my_application-aligned.apk

Voila, now you have a my_application-aligned.apk file, which you can side load onto your device.

I’m more excited than I should be, but today I noticed that Comcast has enabled IPv6 on my home internet connection. All my devices in the home have picked up one or more Internet routable IPv6 addresses. Here are a few screen shots:

So this is very cool, but this has identified a few issues. The most important of which, is that I had previously been using my NAT as a firewall, protecting all devices on the internal network. However, now they all have external IP addresses, they are effectively open to the Internet and un-firewalled. That’s not an issue for my Linux machines, but could be problematic for my girlfriend’s Windows laptop, and my various embedded devices (phones, tablets, and TVs).

Over a month ago I install “Bloat Freezer Free”, a tool designed to kill of particular services running in the background, such as those installed by your phone manufactor. It seemed to be working fine, but in the last few days I’ve been getting a green star in my notification bar alerting me to “There is a update to the Android Market”. If I click it, it takes me to some spyware looking site to download a new market place. Then today I get an alert with the same green star saying “Badoo”. If it click that it links me via some porn advertiser and I end up at the Google Market for the Badoo app.

I got out the Android SDK, and I figured out the notification was coming from the Bloat Freezer tool! After a few searches I find a article about how that tool is using a push notification system, AirPush, to send me spam.

I have now removed this app, and writing this blog entry to helpful save others from this hassle.

UPDATE – I reported this bug and it was promptly fixed the next day. Read the bug report for solution on how to fix.

Android 2.2 just came out and along with it came a updated set of SDK tools. I’ve been using these tools on Windows, but today I took my Linux laptop out and I’ve been sat in a coffee shop hyped up on caffeine but completely unproductive because I’m going round in circles with what I think is a bug.

So, I’m trying the new library feature, where you can have a Android library project, which is referenced by one or more Android projects. This allows multiple projects to easily share the same code. The problem is when I set-up my Android project to use a library project I get the following error printed in my eclipse console:

ERROR: Unknown option '--auto-add-overlay'
Android Asset Packaging Tool

and the code fails to compile. If I remove the reference to the library project this error goes away.

The error is coming from the aapt command, which seems to be installed multiple times, once for each SDK version:

$ locate -r "aapt$"
/home/bramp/android-sdk-linux_86/platforms/android-3/tools/aapt
/home/bramp/android-sdk-linux_86/platforms/android-4/tools/aapt
/home/bramp/android-sdk-linux_86/platforms/android-7/tools/aapt
/home/bramp/android-sdk-linux_86/platforms/android-8/tools/aapt

Checking each command I see that only versions 7 and 8 have the –auto-add-overlay option. Both my library and main projects are targeted at Android 1.6 (i.e. android-4). I tried re-targeting my main project to Android 2.2 (i.e. android-8) and the problem seems to go away.

So for the moment this seems an annoyance, but I can live with it by setting my target to 2.2. Hopefully Google will release a fix so I can still use the older targets with the new library feature.

Just a quick update:
I noticed that on Windows all versions of the aapt tool support the ‘–auto-add-overlay’ option. So what I suspect has happened is that someone forgot to update the aapt binary for the old platforms.

Everyone plays foursquare (the location based android/iPhone app) differently. However, there are no offical rules on what venues are acceptable, and when you can and can’t check-in. So I wanted to write down the rules that I play by:

1. You talk about foursquare.
2. You talk about foursquare.
3. When someone is near by you go find them.
4, Get as many people to a check-in as possible.
5. One check-in at a time.
6. Check-in with Android, iPhone, or Blackberry devices.
7. You check-in as long and late as you can.
8. If this is your first night at foursquare, you have to check-in.

Ok, so that was my attempt of humour by parodying the rules of fight club.

I actually do play by a set of rules

1. I only check-in to venues where I'm using their service. For example, I only 
  check-in to a coffee shop if I buy a drink, or I check-in to a train station
  only if I get on or off a train.

2. I don't check into venues which I am passing though. For example, if my train 
  goes through a train station, but I'm staying on the train I won't check-in. 
  Or if my girlfriend is dragging me around clothes shops, I won't check-in 
  unless I'm actually buying something myself.

3. I only check-in to real stationary public venues. I don't add my house, or
  other made up places, and I don't check-in into venues such as the number 
  2 bus.

4. I don't check-in after the fact, for example if I forget at the time to 
  check-in. For example, I was recently in Belgium, and I had pre-added a few 
  places I knew I would be going to, however, I was unable to check-in due to my 
  lack of internet :(

5. I always add full complete information for any venue I create. Sometimes
  when I'm out I'm unable to find the full data, so I fill in as much as I can, and
  later when I get back to my PC I make sure I complete the venue's details
  fully.

So these are my rules and I’m sure they will evolve as I play the game more. I would love to hear other people’s rules.