# Complete Solution: APK Patching + Database Injection

## Why Both Are Needed

1. **Database Injection** alone won't work - app crashes due to root detection
2. **Root Bypass** alone won't work - premium checks still exist
3. **Solution**: Patch the APK to remove root detection, THEN inject database

## Step 1: Extract and Decompile APK

```powershell
# Extract APK from device
adb -s 192.168.226.101:5555 pull /data/app/~~ZfSUhMBHECl7g_UD6bQKBg==/com.backdrops.wallpapers-V9EWh9auAKDB9DnRgNWNgQ==/base.apk backdrops_base.apk

# Decompile with apktool
apktool d backdrops_base.apk -o backdrops_patched
```

## Step 2: Patch Root Detection

### File: `backdrops_patched/smali/C3/C0446i.smali`

Find the root detection method (around line 377 in original Java):

```smali
.method public static x()Z
    # Original code checks for root...
.end method
```

Replace the ENTIRE method body with:

```smali
.method public static x()Z
    .locals 1
    
    # Always return FALSE (not rooted)
    const/4 v0, 0x0
    return v0
.end method
```

### File: `backdrops_patched/smali/F3/E.smali`

Find the OsData constructor and patch `isRooted` field:

```smali
.method public constructor <init>(Ljava/lang/String;Ljava/lang/String;Z)V
    # ... existing code ...
    
    # Change this line:
    # iput-boolean p3, p0, LF3/E;->f1020c:Z
    
    # To this (always set FALSE):
    const/4 p3, 0x0
    iput-boolean p3, p0, LF3/E;->f1020c:Z
    
    # ... rest of code ...
.end method
```

## Step 3: Patch Premium Checks

### File: `backdrops_patched/smali/com/backdrops/wallpapers/data/local/DatabaseHandlerIAB.smali`

Find `existPurchase` method and replace:

```smali
.method public existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;
    .locals 2
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "(Ljava/lang/String;)Li6/AbstractC1527s<Ljava/lang/Boolean;>;"
        }
    .end annotation

    # Always return Single<TRUE>
    const/4 v0, 0x1
    invoke-static {v0}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
    move-result-object v0
    invoke-static {v0}, Li6/AbstractC1527s;->h(Ljava/lang/Object;)Li6/AbstractC1527s;
    move-result-object v0
    return-object v0
.end method
```

Find `getPurchased` method and replace:

```smali
.method public getPurchased(Ljava/lang/String;)Ljava/lang/Boolean;
    .locals 1

    # Always return TRUE
    const/4 v0, 0x1
    invoke-static {v0}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
    move-result-object v0
    return-object v0
.end method
```

## Step 4: Rebuild and Sign APK

```powershell
# Rebuild APK
apktool b backdrops_patched -o backdrops_patched.apk

# Sign APK (using uber-apk-signer or similar)
java -jar uber-apk-signer.jar --apks backdrops_patched.apk

# Output: backdrops_patched-aligned-signed.apk
```

## Step 5: Install Patched APK

```powershell
# Uninstall original
adb -s 192.168.226.101:5555 uninstall com.backdrops.wallpapers

# Install patched version
adb -s 192.168.226.101:5555 install backdrops_patched-aligned-signed.apk

# Launch
adb -s 192.168.226.101:5555 shell am start -n com.backdrops.wallpapers/.activities.MainActivity
```

## Alternative: Magisk Hide + Database Injection

If you have Magisk installed:

```bash
# Hide root from Backdrops
adb shell su -c "magisk --denylist add com.backdrops.wallpapers"

# OR use Shamiko (if using Zygisk)
# Enable Shamiko in Magisk settings
# Add Backdrops to denylist

# Then run database injection
.\SOLUTION.ps1
```

## Alternative: Non-Root Device

The EASIEST solution if available:

1. Use a **non-rooted device/emulator**
2. Install Backdrops normally
3. Use `adb backup` to extract data
4. Modify database in backup
5. Restore backup

```powershell
# Backup app data
adb backup -f backdrops.ab com.backdrops.wallpapers

# Extract backup
java -jar abe.jar unpack backdrops.ab backdrops.tar

# Modify database in extracted files
# Repack and restore
```

## Why This Is Necessary

### The Root Detection Flow:
```
App Launch
  ↓
libpairipcore.so JNI_OnLoad
  ↓
Calls C3.C0446i.x() (root check)
  ↓
If TRUE → CRASH (SIGSEGV)
  ↓
If FALSE → Continue to DatabaseObserver
  ↓
Check Premium via existPurchase()
  ↓
SQLite Query
```

**Both checks must be defeated!**

## Recommended Approach

### Option A: APK Patching (Most Reliable)
- ✅ Permanent solution
- ✅ Works on any device
- ✅ No Magisk needed
- ❌ Requires APK modification skills

### Option B: Magisk Hide + Database (Quickest if Magisk available)
- ✅ Quick setup
- ✅ Original APK unchanged
- ❌ Requires Magisk
- ❌ May not work with all Magisk versions

### Option C: Non-Root Device (Cleanest)
- ✅ No crashes
- ✅ Simple database modification
- ❌ Requires non-rooted device
- ❌ Harder to access database

## Testing After Patch

```powershell
# Check if app runs without crashing
adb -s 192.168.226.101:5555 shell am start -n com.backdrops.wallpapers/.activities.MainActivity
Start-Sleep -Seconds 5
adb -s 192.168.226.101:5555 shell "ps | grep backdrops"

# If process is running → SUCCESS!
# If no output → Still crashing, check logcat
```

## Verify Premium Unlock

```powershell
# Pull database after app runs
adb shell "su -c 'cp /data/data/com.backdrops.wallpapers/databases/premium /data/local/tmp/premium_check.db && chmod 666 /data/local/tmp/premium_check.db'"
adb pull /data/local/tmp/premium_check.db
sqlite3 premium_check.db "SELECT * FROM Premium;"

# Should show all premium SKUs
```

---

**Bottom line**: You MUST defeat root detection first, otherwise the database injection is useless because the app never gets far enough to check the database!