# Desktop Solution - Repackage Backdrops for Non-Rooted Phone

## Requirements

- **Java 8+** installed on your PC
- **APKEditor JAR** (desktop tool, not APK)
- **ADB** for transferring files
- **Your non-rooted Android phone**

---

## Quick Setup

### 1. Download APKEditor JAR

Go to: https://github.com/REAndroid/APKEditor/releases/latest

Download: **APKEditor-1.x.x.jar** (e.g., `APKEditor-1.3.9.jar`)

Place it in the `backdrops` folder.

### 2. Verify Java

```powershell
java -version
# Should show Java 8 or higher
```

If not installed, download from: https://www.java.com/download/

---

## Patching Method (Choose One)

### Method A: Use Already-Patched Files (FASTEST)

We already have the patched smali files! Just rebuild:

```powershell
# Navigate to backdrops folder
cd C:\Users\Roose\Downloads\backdrops

# The patched base is already built at:
# backdrops_repack\dist\base_patched.apk

# Copy it with original splits
Copy-Item "backdrops_repack\dist\base_patched.apk" "final_install\base.apk" -Force
Copy-Item "backdrops_clean\split_*.apk" "final_install\" -Force

# Sign everything with same key
java -jar uber-apk-signer.jar --apks final_install --overwrite
```

**Problem:** Split signatures won't match (we tried this already).

### Method B: Use APKEditor to Rebuild Everything

APKEditor can handle the APKM directly:

```powershell
# Decompile the APKM
java -jar APKEditor-1.x.x.jar d -i phone_transfer\com.backdrops.wallpapers.apkm -o apkeditor_output

# Now manually patch the smali files:
# 1. Copy our patched files over the originals
Copy-Item "backdrops_repack\smali\C3\i.1.smali" "apkeditor_output\base\smali\C3\i.1.smali" -Force
Copy-Item "backdrops_repack\smali\com\backdrops\wallpapers\data\local\DatabaseHandlerIAB.smali" "apkeditor_output\base\smali\com\backdrops\wallpapers\data\local\DatabaseHandlerIAB.smali" -Force

# Rebuild with APKEditor
java -jar APKEditor-1.x.x.jar b -i apkeditor_output -o backdrops_final.apks
```

### Method C: Use APKEditor GUI (RECOMMENDED)

```powershell
# Launch APKEditor GUI
java -jar APKEditor-1.x.x.jar

# Then:
# 1. File → Decompile → Select phone_transfer\com.backdrops.wallpapers.apkm
# 2. Wait for decompilation
# 3. In file tree: Navigate to base\smali\C3\i.1.smali
# 4. Edit method y() - replace with patched version (see below)
# 5. Navigate to base\smali\com\backdrops\wallpapers\data\local\DatabaseHandlerIAB.smali
# 6. Edit method existPurchase() - replace with patched version (see below)
# 7. Build → Rebuild → Save as backdrops_patched.apks
```

---

## The Patches (Copy-Paste Ready)

### Patch 1: Root Detection Bypass

**File:** `base/smali/C3/i.1.smali`

**Find method:** `y()Z`

**Replace entire method body with:**

```smali
.method public static y()Z
    .locals 1
    const/4 v0, 0x0
    return v0
.end method
```

### Patch 2: Premium Bypass

**File:** `base/smali/com/backdrops/wallpapers/data/local/DatabaseHandlerIAB.smali`

**Find method:** `existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;`

**Replace entire method body with:**

```smali
.method public existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;
    .locals 1
    const/4 v0, 0x1
    invoke-static {v0}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
    move-result-object v0
    invoke-static {v0}, Li6/AbstractC1527s;->h(Ljava/lang/Object;)Li6/AbstractC1527s;
    move-result-object v0
    return-object v0
.end method
```

---

## Installation on Phone

### Option 1: Using SAI (Split APKs Installer)

```powershell
# Transfer the built APKS file
adb push backdrops_patched.apks /sdcard/Download/

# On phone:
# 1. Install SAI from: https://github.com/Aefyr/SAI/releases
# 2. Open SAI
# 3. Tap "Install APKs"
# 4. Select backdrops_patched.apks
# 5. Install
```

### Option 2: Using ADB install-multiple

If APKEditor outputs individual APKs:

```powershell
# Install all APKs together
adb install-multiple backdrops_output\*.apk
```

---

## Why APKEditor Works Better

**APKEditor** (the JAR tool) properly:
- Handles APKM/APKS bundle formats
- Preserves split APK structure
- Signs all splits with matching signatures
- Maintains AndroidManifest.xml correctly
- Handles resource-only split APKs

This is why other CTF teams used it successfully.

---

## Troubleshooting

### "Failed to open dex files" error
The split APKs are corrupted. Make sure:
- You're using APKEditor to rebuild (not manual signing)
- All signatures match across splits

### "Signature mismatch" error
- Uninstall original Backdrops first: `adb uninstall com.backdrops.wallpapers`
- Make sure APKEditor signed everything

### "App not installed"
- Check if you have storage space
- Try installing with SAI instead of adb

---

## Alternative: Use Our Pre-Patched Files

We already have the patched base APK at:
```
backdrops_repack\dist\base_patched.apk
```

And patched smali files in:
```
backdrops_repack\smali\C3\i.1.smali
backdrops_repack\smali\com\backdrops\wallpapers\data\local\DatabaseHandlerIAB.smali
```

You can use these with APKEditor:
1. Decompile original APKM
2. Replace the two smali files
3. Rebuild with APKEditor

---

## Expected Result

✅ App launches without crash  
✅ All premium packs accessible (Trinity, AMOLED, Acid, etc.)  
✅ No "Purchase Required" dialogs  
✅ Works on non-rooted phone  

---

## Summary

**Best approach:** Use APKEditor JAR (GUI mode) to:
1. Decompile the APKM
2. Apply both smali patches
3. Rebuild as APKS
4. Install via SAI or adb

This matches what other CTF teams did to solve this challenge on non-rooted devices.