1
<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="36" android:compileSdkVersionCodename="16" package="com.example.helloworld" platformBuildVersionCode="36" platformBuildVersionName="16">
2
    <permission android:name="com.example.helloworld.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" android:protectionLevel="signature"/>
3
    <uses-permission android:name="com.example.helloworld.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"/>
4
    <application android:allowBackup="true" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:dataExtractionRules="@xml/data_extraction_rules" android:debuggable="true" android:extractNativeLibs="false" android:fullBackupContent="@xml/backup_rules" android:icon="@mipmap/ic_launcher" android:label="@string/app_name" android:roundIcon="@mipmap/ic_launcher_round" android:supportsRtl="true" android:theme="@style/Theme.Helloworld">
5
        <activity android:exported="true" android:name="com.example.helloworld.MainActivity">
6
            <intent-filter>
7
                <action android:name="android.intent.action.MAIN"/>
8
                <category android:name="android.intent.category.LAUNCHER"/>
9
            </intent-filter>
10
        </activity>
11
        <meta-data android:name="flag" android:value="hidden"/>
12
        <provider android:authorities="com.example.helloworld.androidx-startup" android:exported="false" android:name="androidx.startup.InitializationProvider">
13
            <meta-data android:name="androidx.emoji2.text.EmojiCompatInitializer" android:value="androidx.startup"/>
14
            <meta-data android:name="androidx.lifecycle.ProcessLifecycleInitializer" android:value="androidx.startup"/>
15
            <meta-data android:name="androidx.profileinstaller.ProfileInstallerInitializer" android:value="androidx.startup"/>
16
        </provider>
17
        <receiver android:directBootAware="false" android:enabled="true" android:exported="true" android:name="androidx.profileinstaller.ProfileInstallReceiver" android:permission="android.permission.DUMP">
18
            <intent-filter>
19
                <action android:name="androidx.profileinstaller.action.INSTALL_PROFILE"/>
20
            </intent-filter>
21
            <intent-filter>
22
                <action android:name="androidx.profileinstaller.action.SKIP_FILE"/>
23
            </intent-filter>
24
            <intent-filter>
25
                <action android:name="androidx.profileinstaller.action.SAVE_PROFILE"/>
26
            </intent-filter>
27
            <intent-filter>
28
                <action android:name="androidx.profileinstaller.action.BENCHMARK_OPERATION"/>
29
            </intent-filter>
30
        </receiver>
31
    </application>
32
</manifest>

1
import struct
2
import zipfile
3
import os
4
import sys
5
from base64 import b64encode
6

7
FLAG = ''
8
APK_File = "hiddenfile.apk"
9

10

11
def inject_into_androidmanifest(apk_file, string_to_inject):
12
    # Sequentially put the base64 encoded string character by character into the AndroidManifest file
13
    # https://android.googlesource.com/platform/frameworks/base/+/56a2301/include/androidfw/ResourceTypes.h
14
    characters = list(string_to_inject)
15
    output_file = "hiddenfile.apk"
16

17
    # TODO: YOUR CODE HERE
18
    pass
19

20

21
apk_file = sys.argv[1]
22
string_to_inject = b64encode(FLAG.encode()).decode()
23
print(string_to_inject)
24

25
if not os.path.exists(apk_file):
26
    print(f"[!] Error: File not found: {apk_file}")
27
    sys.exit(1)
28

29
try:
30
    inject_into_androidmanifest(apk_file, string_to_inject)
31
except Exception as e:
32
    print(f"\n[!] Error: {e}")
33
    import traceback
34
    traceback.print_exc()
35
    sys.exit(1)