Flinkd!

With the recent release of Android 5.x, I decided that it was time to release an update on how to install the Google Play Store on the Android Emulator.  This document outlines the steps required using the latest version of the Android SDK (Revision 24.0.2) and is focused on Android 5.0.1 (API 21).

Install the Android 5.0.1 Image

With that, let’s begin by launching the SDK manager. We’ll first need to ensure that Android 5.0.1 (API 21) is installed.

[pyoor@localhost]$ cd ~/android-sdk/tools/
[pyoor@localhost tools]$ ./android sdk

If it’s not, check the top level element, “Android 5.0.1 (API 21),” and click “Install 15 Packages.”  Then, when prompted, accept the license agreement and continue.

Create the AVD

Once installed, close the SDK manager and launch the AVD manager.

[pyoor@localhost tools]$ ./android avd

Here we’ll need to create a new AVD which utilizes the Android 5.0.1 platform and has snapshots enabled so that any changes we make are persistent.  Also, due to the increased size of the 5.0.1 image, we’ll need to allocate at least 2048MB of RAM for our AVD.

Download the GAPPS Package

Next we need to pull down the appropriate Google Apps package that matches our Android AVD version.  In this case we’ll be using the gapps-lp-20141109-signed.zip package.  You can download that file from BasketBuild here.

[pyoor@localhost]$ md5sum gapps-lp-20141109-signed.zip
  367ce76d6b7772c92810720b8b0c931e gapps-lp-20141109-signed.zip

In order to install Google Play, we’ll need to push the following 4 APKs to our AVD (located in ./system/priv-app/):

• GmsCore.apk
• GoogleServicesFramework.apk
• GoogleLoginService.apk
• Phonesky.apk

[pyoor@localhost]$ unzip -j gapps-lp-20141109-signed.zip \
  system/priv-app/GoogleServicesFramework/GoogleServicesFramework.apk \
  system/priv-app/GoogleLoginService/GoogleLoginService.apk \
  system/priv-app/Phonesky/Phonesky.apk \
  system/priv-app/GmsCore/GmsCore.apk -d ./

Push APKs to the Emulator

With our APKs extracted, let’s launch our AVD using the following command.

[pyoor@localhost tools]$ ./emulator @Flinkd -no-boot-anim

This may take several minutes the first time as the AVD is created. Once started, we need to remount the AVDs system partition as read/write so that we can push our packages onto the device.

[pyoor@localhost]$ cd ~/android-sdk/platform-tools/
[pyoor@localhost platform-tools]$ ./adb remount

Next, push the APKs to our AVD:

[pyoor@localhost platform-tools]$ ./adb push GmsCore.apk /system/priv-app/
[pyoor@localhost platform-tools]$ ./adb push GoogleServicesFramework.apk /system/priv-app/
[pyoor@localhost platform-tools]$ ./adb push GoogleLoginService.apk /system/priv-app/
[pyoor@localhost platform-tools]$ ./adb push Phonesky.apk /system/priv-app/

Profit!

And finally, reboot the emualator using the following commands:

[pyoor@localhost platform-tools]$ ./adb shell stop && ./adb shell start

Once the emulator restarts, we should see the Google Play package appear within the menu launcher. After associating a Google account with this AVD we now have a fully working version of Google Play running under our emulator:

As it has been well over a year since my last post here, I’d like to let those of you that still follow this blog that I am in fact, still active and actually quite busy to say the least. Recently I had the privilege to publish two articles for Team Corelan which documented the process I use when attempting to identify the root cause of a crash and determine its exploitability. Links to those two articles can be found below:

• Root Cause Analysis – Memory Corruption Vulnerabilities
• Root Cause Analysis – Integer Overflows

Furthermore, with the help of iDefense Vulnerability Contributor Program, I’m awaiting the public disclosure of a number of bugs I’ve identified ofter the past few months. Once public, I hope to provide some additional details and proof of concept code here.

And finally, I have a number of home brew projects that I’ve been using in my private fuzz farm over the past few months that I hope to make available to the general public. Please check back here soon for updates.