# Install Patched Backdrops on Non-Rooted Phone

## Problem with Split APKs
The split APK signatures are corrupted when we try to re-sign them. The proper solution requires specialized tools.

## ✅ WORKING Solution for Non-Rooted Phone

### Method 1: Use APKEditor Pro (EASIEST - RECOMMENDED)

1. **Install APKEditor Pro on your phone**
   - Download from: https://github.com/REAndroid/APKEditor/releases
   - Or: https://t.me/APKEditorChannel

2. **Transfer the APKM file**
   ```powershell
   # From your PC
   adb push com.backdrops.wallpapers.apkm /sdcard/Download/
   ```

3. **Edit and rebuild in APKEditor**
   - Open APKEditor Pro
   - Select "Open as Project"
   - Choose `com.backdrops.wallpapers.apkm`
   - Navigate to: `smali/C3/i.1.smali`
   - Find method `y()Z`
   - Replace entire method with:
     ```smali
     .method public static y()Z
         .locals 1
         const/4 v0, 0x0
         return v0
     .end method
     ```
   - Navigate to: `smali/com/backdrops/wallpapers/data/local/DatabaseHandlerIAB.smali`
   - Find method `existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;`
   - Replace with:
     ```smali
     .method public existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;
         .locals 1
         const/4 v0, 0x1
         invoke-static {v0}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
         move-result-object v0
         invoke-static {v0}, Li6/AbstractC1527s;->h(Ljava/lang/Object;)Li6/AbstractC1527s;
         move-result-object v0
         return-object v0
     .end method
     ```
   - Tap "Build & Sign"
   - Install the generated APK

**Why APKEditor works:** It properly handles split APK manifests and resources during re-signing.

---

### Method 2: Use MT Manager (Android File Manager with APK Tools)

1. **Install MT Manager**
   - Download: https://mt2.cn/download/

2. **Transfer APKM**
   ```powershell
   adb push com.backdrops.wallpapers.apkm /sdcard/Download/
   ```

3. **Extract and edit**
   - Open MT Manager
   - Navigate to `com.backdrops.wallpapers.apkm`
   - Long press → "View"
   - Extract `base.apk`
   - Long press `base.apk` → "APK Editor"
   - Navigate to same smali files as above
   - Apply patches
   - Rebuild

4. **Replace and repack**
   - Replace `base.apk` in APKM
   - Long press APKM → "APK Sign"
   - Install

---

### Method 3: Use SAI (Split APKs Installer) with Exported Bundle

1. **Create signed base APK (already done)**
   ```
   backdrops_final\base.apk (patched and signed)
   ```

2. **Download SAI on phone**
   - https://github.com/Aefyr/SAI/releases

3. **Transfer all APKs**
   ```powershell
   adb push backdrops_final /sdcard/Download/backdrops_patched/
   ```

4. **Install with SAI**
   - Open SAI
   - Select "Install APKs"
   - Choose all files in `backdrops_patched/` folder
   - SAI will handle signature mismatches (rootless mode)

**Note:** This method may still fail due to signature verification.

---

### Method 4: Merge Splits into Single APK (bundletool)

We need Google's `bundletool` to properly merge splits:

```powershell
# Download bundletool
Invoke-WebRequest -Uri "https://github.com/google/bundletool/releases/download/1.15.6/bundletool-all-1.15.6.jar" -OutFile "bundletool.jar"

# Create APKS bundle
java -jar bundletool.jar build-bundle --modules=backdrops_repack\dist\base_patched.apk --output=backdrops.aab

# Generate universal APK
java -jar bundletool.jar build-apks --bundle=backdrops.aab --output=backdrops.apks --mode=universal

# Extract universal APK
Expand-Archive backdrops.apks backdrops_universal
# Then sign: backdrops_universal\universal.apk
```

**Problem:** This requires the original AAB format, which we don't have.

---

## 🎯 RECOMMENDED APPROACH FOR YOUR CASE

Since you mentioned **"another team had that solve"**, they likely used **APKEditor Pro** or **MT Manager**.

### Quick Transfer Package for Your Phone

I'll create a transfer bundle:

```powershell
# Create transfer folder
New-Item -ItemType Directory -Path "phone_transfer" -Force

# Copy patched smali files for manual reference
Copy-Item "backdrops_repack\smali\C3\i.1.smali" "phone_transfer\ROOT_DETECTION_PATCHED.smali"
Copy-Item "backdrops_repack\smali\com\backdrops\wallpapers\data\local\DatabaseHandlerIAB.smali" "phone_transfer\PREMIUM_CHECK_PATCHED.smali"

# Copy original APKM
Copy-Item "com.backdrops.wallpapers.apkm" "phone_transfer\"

# Create instructions
@"
INSTALL INSTRUCTIONS FOR NON-ROOTED PHONE
==========================================

1. Install APKEditor Pro from: https://github.com/REAndroid/APKEditor/releases

2. Transfer this folder to your phone:
   adb push phone_transfer /sdcard/Download/

3. Open APKEditor Pro:
   - Open com.backdrops.wallpapers.apkm as Project
   - Apply patches from ROOT_DETECTION_PATCHED.smali and PREMIUM_CHECK_PATCHED.smali
   - Build & Sign
   - Install

Files to patch:
   smali/C3/i.1.smali → method y()
   smali/com/backdrops/wallpapers/data/local/DatabaseHandlerIAB.smali → method existPurchase()
"@ | Out-File "phone_transfer\INSTRUCTIONS.txt"
```

### Alternative: Pre-built APK (if you trust me)

```powershell
# The patched base.apk is here:
backdrops_final\base.apk
```

Transfer this + all splits to your phone and use **SAI** to install.

---

## Why PC-based Re-signing Failed

1. **Resource-only splits** (language/DPI configs) don't have classes.dex
2. **Removing META-INF** breaks the APK structure for resource-only APKs
3. **zipalign** expects specific entry orders that get corrupted

Android tools like APKEditor handle this properly because they:
- Preserve APK entry order
- Regenerate manifests correctly
- Handle resource-only APKs specially

---

## What Other Teams Probably Did

Looking at typical CTF solutions:
1. Used **APKEditor Pro** on Android directly
2. OR used **Lucky Patcher** (requires root but can generate patches)
3. OR used **NP Manager** for split APK handling
4. OR had access to original AAB file and used bundletool

For **non-rooted phone**, APKEditor Pro is the gold standard.