# Quick Start: Install Patched Backdrops on Non-Rooted Phone

## 🎯 What You Need

1. **Your non-rooted Android phone**
2. **APKEditor Pro app** (free, open source)
3. **The APKM file** (already in `phone_transfer/`)

## 📱 Step-by-Step (5 minutes)

### Step 1: Get APKEditor

**Option A - Desktop (Recommended):**
Download APKEditor JAR from GitHub:
**https://github.com/REAndroid/APKEditor/releases/latest**

Look for: `APKEditor-1.x.x.jar`

Requirements: Java 8+ installed on your PC

**Option B - Android App:**
Use **MT Manager** instead (free APK editor for Android):
Download: `https://mt2.cn/download/`

Or use **APK Editor Studio** (desktop):
**https://github.com/kefir500/apk-editor-studio/releases**

### Step 2: Run APKEditor on PC

**Using APKEditor JAR (Desktop):**
```powershell
# Navigate to backdrops folder
cd C:\Users\Roose\Downloads\backdrops

# Run APKEditor GUI
java -jar APKEditor-1.x.x.jar
```

**Or use command line:**
```powershell
# Decompile APKM
java -jar APKEditor-1.x.x.jar d -i phone_transfer\com.backdrops.wallpapers.apkm -o backdrops_edit
```

### Step 3: Open and Edit in APKEditor

**GUI Method:**
1. Click **"Decompile"** or **"Open"**
2. Select **`phone_transfer\com.backdrops.wallpapers.apkm`**
3. Wait for decompilation (~30 seconds)
4. Navigate to smali files in the file tree

**Or edit files manually** (reference patched files in `phone_transfer/`)

### Step 4: Apply Patch #1 (Root Detection Bypass)

1. In APKEditor, navigate to:
   ```
   smali → C3 → i.1.smali
   ```

2. Find method `y()Z` (around line 80)

3. **Delete everything** between `.method public static y()Z` and `.end method`

4. Replace with:
   ```smali
   .method public static y()Z
       .locals 1
       const/4 v0, 0x0
       return v0
   .end method
   ```

5. Tap **Save** (💾 icon)

### Step 5: Apply Patch #2 (Premium Bypass)

1. Navigate to:
   ```
   smali → com → backdrops → wallpapers → data → local → DatabaseHandlerIAB.smali
   ```

2. Find method `existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;` (around line 140)

3. **Delete everything** between the `.method` and `.end method`

4. Replace with:
   ```smali
   .method public existPurchase(Ljava/lang/String;)Li6/AbstractC1527s;
       .locals 1
       const/4 v0, 0x1
       invoke-static {v0}, Ljava/lang/Boolean;->valueOf(Z)Ljava/lang/Boolean;
       move-result-object v0
       invoke-static {v0}, Li6/AbstractC1527s;->h(Ljava/lang/Object;)Li6/AbstractC1527s;
       move-result-object v0
       return-object v0
   .end method
   ```

5. Tap **Save** (💾 icon)

### Step 6: Build & Sign

**Using APKEditor GUI:**
1. Click **"Build"** or **"Rebuild"**
2. Wait for build (~1-2 minutes)
3. APKEditor will auto-sign the output
4. Output: `backdrops_edit_signed.apks` or similar

**Using command line:**
```powershell
# Build and sign
java -jar APKEditor-1.x.x.jar b -i backdrops_edit -o backdrops_patched_signed.apks

# Or use uber-apk-signer
java -jar uber-apk-signer.jar --apks backdrops_edit\dist\*.apk
```

### Step 7: Install on Your Phone

**Transfer and install:**
```powershell
# Transfer to phone
adb push backdrops_patched_signed.apks /sdcard/Download/

# Install with SAI (Split APKs Installer) or adb
adb install-multiple backdrops_edit\dist\*.apk
```

**Or use SAI app on phone:**
1. Install SAI from: https://github.com/Aefyr/SAI/releases
2. Open SAI → Install APKs
3. Select the signed APKS file
4. Install

1. Open **Backdrops** app
2. Navigate to **Collections**
3. Try opening **Premium packs** (Trinity, AMOLED, Acid, etc.)
4. **Success!** Wallpapers should open without "Purchase Required" dialog

---

## 🔧 Troubleshooting

### "App not installed" error
- Uninstall original Backdrops first
- Settings → Apps → Backdrops → Uninstall

### "Parse error" during build
- Make sure you saved both patches (💾 icon)
- Check smali syntax (no typos in method signatures)

### App crashes on launch
- Root detection patch may have failed
- Re-check `i.1.smali` method `y()` - should only be 5 lines

### Premium still asks for payment
- Premium check patch failed
- Re-check `DatabaseHandlerIAB.smali` method `existPurchase`

---

## 📋 What the Patches Do

**Patch #1 (Root Detection):**
- Method `C3.i.y()` checks if device is rooted
- Original: Checks Build.TAGS, Superuser.apk, /system/xbin/su
- Patched: Always returns `false` (not rooted)

**Patch #2 (Premium Check):**
- Method `DatabaseHandlerIAB.existPurchase()` checks SQLite for purchases
- Original: Queries database for SKU
- Patched: Always returns `true` (purchased)

---

## 🎓 Alternative Method (If APKEditor Doesn't Work)

Use **MT Manager** instead:
1. Download: https://mt2.cn/download/
2. Open MT Manager
3. Navigate to APKM file → Long press → "APK Editor"
4. Same patching steps as above
5. Rebuild and install

---

## 🏆 Expected Result

After installation, you should have:
- ✅ App launches successfully (no crash)
- ✅ All premium wallpaper packs unlocked
- ✅ No "Purchase Required" dialogs
- ✅ Collections: Trinity, AMOLED, Acid, Optic, Synth, Void all accessible

---

## 💡 Why This Works (Technical)

1. **No root needed** - We're modifying the APK before installation
2. **PairIP bypass** - Root detection removed so protection doesn't trigger
3. **Premium unlock** - Purchase verification always returns true
4. **Persistent** - Changes are in the APK itself, not runtime hooks

This is the **same method** other CTF teams used to solve this challenge!

---

## 📦 Files Included in phone_transfer/

- `com.backdrops.wallpapers.apkm` - Original app bundle
- `ROOT_DETECTION_PATCHED.smali` - Reference for patch #1
- `PREMIUM_CHECK_PATCHED.smali` - Reference for patch #2
- `INSTRUCTIONS.md` - This file

---

**Total time: ~5 minutes**
**Root required: NO**
**Tools: APKEditor Pro (free)**

Good luck! 🚀