Programmatically editing apk files in java

Question

This question gets a little complicated so please bear with me: I have an apk file I am attempting to modify programmatically after installation. I am editing it with another app. I first attempted to do this with the built in java classes for zip file management but when i attempt to completely copy all the files except the file i want to modify and change the file i want to modify the app will not run anymore. I assume this is because of signing or something but when I do the same thing with winRAR (unzip all files, create a new zip archive, copy all files into new zip archive with normal compression) and ssh the new apk into my /data/app folder, it works fine. My question is why this is happening. I think it may have to do with zip headers or something like that does anyone have any ideas?

PS: this is an example of the java process i am using to re-write the zip file:

p = Runtime.getRuntime().exec("su");
ZipInputStream in = new ZipInputStream(new FileInputStream("This is the apk containing the asset I want to use to replace the other asset"));
ZipEntry e;
while((e = in.getNextEntry()) != null)
{
    if(e.getName().equals("asset i want to use to replace the other asset"))
        break;
}
ZipOutputStream out = new ZipOutputStream(new FileOutputStream("the output zip file"));
ZipInputStream original = new ZipInputStream(new FileInputStream("the apk i am trying to modify"));
ZipEntry f;
byte[] buf = new byte[1024];
while((f = original.getNextEntry()) != null)
{
    if(!f.getName().equals("the asset i want to replace"))
    {
        out.putNextEntry(new ZipEntry(f.getName()));
        int len;
        while ((len = original.read(buf)) > 0) {
            out.write(buf, 0, len);
        }
        original.closeEntry();
        out.closeEntry();
    }
    else
    {
        out.putNextEntry(new ZipEntry(e.getName()));
        int len;
        while ((len = in.read(buf)) > 0) {
            out.write(buf, 0, len);
        }
        out.closeEntry();
    }
}
in.close();
out.close();
original.close();

I have run this process on the android system and on windows using regular software, i can open the output in winRAR and it appears to be the same except for the asset file i changed.

Answer 1

The only one thing you should know is how works signing apk tool (work around check sums - they are zip entries. A target folder is META-INF with CERT.RSA - there's present encoded checksum and else debug info, CERT.SF and MANIFEST.MF - with SHA1-Digest - Base64 encoded hashes (they are easy to detect by yourself)). But this is a real hacking! That code can be useful (and used by many "smart programmers" for dinamically changing of picture of application for ex.) and can be dangerous - because your apk file can be increased to GB sizes - if you'll write so.

This trick shouldn't be spreaded between world-wide comunity people and I think - it will be kept in short circles of programmers.