SSAID or ANDROID_ID validation Bypass using Dalvik bytecode Patch - hpAndro Vulnerable Application

? CTF Link: http://ctf.hpandro.raviramesh.info
♚ All applications on Playstore: https://play.google.com/store/apps/dev?id=7722940558815307513
♛ Consolidate challenges app: https://play.google.com/store/apps/details?id=com.hpandro.androidsecurity
? YouTube Channel: https://www.youtube.com/AndroidAppSec
? Facebook Page: https://www.facebook.com/hpAndro1337
?Twitter handle: https://twitter.com/hpandro1337

#SSAID or #ANDROID_ID validation #Bypass using #Dalvik #bytecode #Patch - #hpAndro Vulnerable Application
=====================================================
Android ID (Settings.Secure.ANDROID_ID or SSAID) has a different value for each app and each user on the device. Developers requiring a device-scoped identifier should instead use a resettable identifier, such as Advertising ID, giving users more control. Advertising ID also provides a user-facing setting to limit ad tracking.

The ANDROID_ID value won't change on package uninstall/reinstall, as long as the package name and signing key are the same. Apps can rely on this value to maintain state across reinstalls.

If an app was installed on a device running an earlier version of Android, the Android ID remains the same when the device is updated to Android O, unless the app is uninstalled and reinstalled.

The Android ID value only changes if the device is factory reset or if the signing key rotates between uninstall and reinstall events.

This change is only required for device manufacturers shipping with Google Play services and Advertising ID. Other device manufacturers may provide an alternative resettable ID or continue to provide ANDROID ID.

Best practices for working with Android identifiers
Avoid using hardware identifiers. In most use cases, you can avoid using hardware identifiers, such as SSAID (Android ID), without limiting the required functionality.

Android 10 (API level 29) adds restrictions for non-resettable identifiers, which include both IMEI and serial number. Your app must be a device or profile owner app, have special carrier permissions, or have the READ_PRIVILEGED_PHONE_STATE privileged permission in order to access these identifiers. https://developer.android.com/training/articles/user-data-ids

=========================================
Dalvik Bytecode: https://source.android.com/devices/tech/dalvik/dalvik-bytecode
http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html

===================================
00:00 - Intro
00:10- APK Download
00:42 - APKTOOL Download
00:50 - jadx-gui Download
01:12 - Install APK File and Check Task
02:08 - Decode APK to SMALI code using APKTOOL
02:50 - jadx-gui - APK to Java
03:23 - Find Validation Logic in JAVA Code
04:00 - Find validation logic in SMALI Code
04:25 - Mapping Java and SMALI code
05:40 - Modify Bytecode and change SMALI code
06:40 - Repack SMALI code into APK file using APKTOOL
07:39 - APK Sign using keytool and apksigner
08:58 - Install Patched APK file and get the flag
10:08 - Reference