I guess this only works if the modder ( or a potential user who tries to modify ) tries to tamper with AndroidManifest.xml, since they wouldnāt need any signature/modifications of keys whilst doing an ordinary de-compile and re-compile.
Actually, after any edit to apks, signature is modified, let it be even putting a simple file in assets. Upon every single modification in apk, it becomes unsigned
Recompiling using the -c flag will use use the original ones and you donāt have to sign the apk manually later on. Which means someone could potentially change any asset, smali ( java ) or resources without getting caught
I personally used this to avoid the signature change detection that most system apps possess ( atleast commercialized androidx86ās do ). - I was experimenting with system apps btw and most people ( i know ) use the flag if they havenāt touched those files.
Iāve got another question in my head.
So, if theyāre smart enough to modify the app, Iām pretty sure atleast some of them would know how to modify smali. They could just tamper with your extension code and inverse the values just so itād return False instead of True. It just takes an integer level change which ( a single character change ) would defeat the entire selling point of this extension. ( Correct me if Iām wrong )
So, it just feels like. It prevents newbie āmoddersā who try to do some basic level stuff which doesnāt affect the revenue of the app in any ways , but we donāt know about the people whose modifications affect you
Iām not trying to be rude, Iām curious on how thatād be effective.
PS : Iām not showing something unethical, itās just a point being proven.
Iām actually interested in doing so ( Iām curious actually ).
What I meant before wasnāt actually recreating or impersonating, I mentioned about re-using the original key ( using the one that it had been built with ).
Honestly, relying on front-end isnāt that great ( especially when you interact with money ). If your platform/app is likely to be hacked or modded. Itās recommended to do some measures and take legal actions.
PS
My bad, I actually searched it up Androidās new scheme has restrictions and it makes those workarounds obsolete. Thanks for letting me know.
I avoid paid extensions because they check every time server-side. Why I avoid paid extention? The reason Low-end devices already have some lag. and sometimes display annoying popup
Uhm, thereās no such thing in the aix from my side, it finds the Signing Certificate on your device only and avoids opening of apk if thatās modified
Thats how signature works, if any modification in file, it will become unsigned
