1. We disassemble
SemsEmail.apk .
2. The idea is to bypass all the checks, Auto Sync is enabled or not.
3. The standard search method and the exclusion of keywords found that my check is enabled or not Auto Sync
meet all the two methods:
getMasterSyncAutomatically () Z
and
getSyncAutomatically (Landroid / accounts / Account; Ljava / lang / String;) Z
4. As you can see, these methods return a Boolean value, and the "
false "Methods returned when auto-sync is off.
5. Our goal is to get around the limitations of not returning "
true "Values.
By themselves, these methods are in the framework, (framework.jar) and it would be bad form to take and fix the framework itself,
as any other applications that use these methods would also be synchronized together began.
6. We do not need it, so we look for in a folder
smali all classes (files) that contain calls to these methods.
I was found in 9 classes (files), give only the names for example (you may be called quite differently):
My Files, which have found the method calls:
AccountCheckFrequencyFragment $ PeakFrequencyChangeListener.smali
AccountSettingsFragment.smali
AccountSetupOptions.smali
EmailBackupAgent.smali
EmailConnectivityManager.smali
ImapIdleService.smali
Mailbox.smali
MailService.smali
MailService $ 2.smali
Open each file found (again, that you have the name exactly, etc.) and look for the challenges mentioned in Section 3 methods.
Is only an example, how to bypass the conditional check for the auto sync:
EXAMPLE bypass getMasterSyncAutomatically () Z
It was like this:
invoke-static {}, Landroid / content / ContentResolver; ->getMasterSyncAutomatically () Z
move-result v4
and hereinafter referred to as the method this way:
if-eqz v4,: cond_4
...
...
: cond_4
Commenting on the method call, and the transition conditions, it was something like this:
# Invoke-static {}, Landroid / content / ContentResolver; ->getMasterSyncAutomatically () Z
# Move-result v4
and hereinafter referred to as the method this way:
# If-eqz v4,: cond_4
...
...
#: Cond_4
EXAMPLE bypass getSyncAutomatically (Landroid / accounts / Account; Ljava / lang / String;) Z
It was like this:
const-string v2, "com.android.contacts"
invoke-static {v0, v2}, Landroid / content / ContentResolver; ->getSyncAutomatically (Landroid / accounts / Account; Ljava / lang / String;) Z
move-result v2
invoke-virtual {v1, v2}, Landroid / preference / CheckBoxPreference; ->setChecked (Z) V
Doing something like this:
# Const-string v2, "com.android.contacts"
# Invoke-static {v0, v2}, Landroid / content / ContentResolver; ->getSyncAutomatically (Landroid / accounts / Account; Ljava / lang / String;) Z
# Move-result v2
const / 4 v2, 0x1
invoke-virtual {v1, v2}, Landroid / preference / CheckBoxPreference; ->setChecked (Z) V
And we continue to do so in all classes (files), where they found the calls to these methods.
7. When finished, collect
SemsEmail.apk , The original file is added:
- from a folder
build \ apk -
classes.dex