Question

I need to instrument the dalvik bytecode of any given .apk file as part of my research and to obtain working, modified .apk with the instrumented bytecode.

I am programming in Java 1.6 under Windows 7.

Input

• The original .apk file with the original, unchanged classes.dex dalvik bytecode.
• the instrumented classes.dex bytecode of the .apk (yes, we assume we already instrumented the bytecode).

Desired output

• The .apk file with the instrumented classes.dex bytecode instead of the original.

Problem statement

What is the most straightforward way to obtain the desired output from Java source code?

Answer 1

Update Apr 12 ’16

Regarding step 2 of original answer:

The sources of current version of ApkBuilder can be found in the official repo here and comment explaining why it should be used can be found also in the official repo.

In your local Android SDK installation, the classes seem to live in android-sdk/tools/lib/sdklib.jar

---

Original answer Nov 30 ’12

Step 1: remove the original classes.dex

To rebuild the .apk with custom classes.dex file first we need to delete the original classes.dex file from it. This can be easily done using the the aapt.exe tool from Android SDK install dir, e.g. located here: c:\Program Files (x86)\Android\android-sdk\platform-tools\aapt.exe

The command:

aapt.exe remove <path-to-the-apk> classes.dex 

will remove the file.

Step 2: rebuild the .apk

There is a lot of confusion about building .apks as the (...)\android-sdk\tools\apkbuilder.bat script is deprecated. See this discussion for details.

Behind the scenes the script calls ApkBuilderMain which calls non-deprecated ApkBuilder.

Based on no longer available unofficial sources, I came up with the following code snippet:

  /**
   * Builds the {@code sourceApk} with bytecode merged from {@code classesDex}. The built .apk file has the same
   * name as {@code sourceApk} and is put in {@code outputDir}.<br/>
   * <br/>
   * <b>Precondition:</b> The {@code sourceApk} doesn't contain {@code classes.dex}, so the {@code classesDex} can be
   * merged into it.
   */  
  private static File buildApk(File sourceApk, File classesDex, File outputDir) throws Exception
  {

    File outputApk;
    try {
      outputApk = new File(outputDir, sourceApk.getName());
      ApkBuilder builder = new ApkBuilder(outputApk, sourceApk, classesDex, ApkBuilder.getDebugKeystore(), null);
      builder.sealApk();
    } catch (ApkCreationException e) {
      throw new Exception(e);
    } catch (SealedApkException e) {
      throw new Exception(e);
    }

    return outputApk;
  }