SmartGlance reverse patch

Experimental patch script for SmartGlance APKs.

The script was tested on SmartGlance 1.0.8. Other SmartGlance builds may work, but obfuscated class names can change between releases. Reverify every patched APK before use.

Reviewed sample APK:

https://smart1.qinghui365.com/SmartGlance-v1.0.8-release.apk

In the repo:

SmartGlance-v1.0.8-release.apk

• Original APK SHA256: 447cb67f3c813118500df96cb8c6e8146aaec350074862d4c381a3a5250053b5

Why?

A relative got themselves a cheap, smart case from aliexpress and I wanted to make sure they could use it safely without their data being sold to anyone or the app doing anything shady.

What it changes

• Removes INTERNET.
• Removes ACCESS_NETWORK_STATE.
• Removes REQUEST_INSTALL_PACKAGES.
• Removes HIGH_SAMPLING_RATE_SENSORS.
• Sets allowBackup=false.
• Sets usesCleartextTraffic=false.
• Appends -offline to versionName.
• Renames the app label to SmartGlance Offline.
• Rewords update UI strings as offline build strings.
• Makes the update check and update download coroutine return immediately.
• Replaces the vendor update base URL with http://127.0.0.1/ as a fallback.
• Lowers magnetic sensor polling from fastest rate to UI rate.
• Disables the silent looping MediaPlayer keepalive by default.

The optional --keep-media-keepalive flag keeps the original silent media keepalive. Use that build if the default build stops responding after the phone has been idle.

Install from GitHub

Use GitHub Releases for public APK downloads. APK binaries belong in release assets, not repository history.

Recommended APK:

SmartGlance-v1.0.8-release-offline-patched.apk

Fallback APK, only for phones where the recommended build stops responding in the background:

SmartGlance-v1.0.8-release-offline-media-keepalive.apk

Release page:

https://github.com/8times4/smartglance-reverse-patch/releases/tag/v1.0.8-offline

Phone install steps:

1. Open the latest GitHub release on the phone.
2. Download the recommended APK above.
3. Uninstall the vendor SmartGlance app (if installed).
4. Open the downloaded APK.
5. Allow "install unknown apps" if Android asks.
6. Install and open SmartGlance Offline.

Maintainer release checklist:

smartglance-reverse-patch/patch_smartglance_offline.sh \
  smartglance-reverse-patch/SmartGlance-v1.0.8-release.apk

smartglance-reverse-patch/patch_smartglance_offline.sh --keep-media-keepalive \
  smartglance-reverse-patch/SmartGlance-v1.0.8-release.apk \
  smartglance-reverse-patch/dist/SmartGlance-v1.0.8-release-offline-media-keepalive.apk

shasum -a 256 smartglance-reverse-patch/dist/*.apk

Attach the two APKs from dist/ to a GitHub release. Put the SHA256 values in the release notes.

Requirements

• apktool
• Android SDK build-tools with zipalign and apksigner
• keytool

On macOS:

brew install apktool
export ANDROID_HOME="$HOME/Library/Android/sdk"

Build

Default offline build:

smartglance-reverse-patch/patch_smartglance_offline.sh \
  smartglance-reverse-patch/SmartGlance-v1.0.8-release.apk

Output:

smartglance-reverse-patch/dist/<input-name>-offline-patched.apk

Keep the silent media keepalive:

smartglance-reverse-patch/patch_smartglance_offline.sh --keep-media-keepalive \
  smartglance-reverse-patch/SmartGlance-v1.0.8-release.apk \
  smartglance-reverse-patch/dist/SmartGlance-v1.0.8-release-offline-media-keepalive.apk

The script signs with this local debug key:

~/.android/smartglance-offline-debug.keystore

Android treats the patched APK as a different signer from the vendor APK. Uninstall the vendor-signed app before installing the patched build.

Install with adb

adb uninstall vip.wexiang.SmartGlance
adb install smartglance-reverse-patch/dist/SmartGlance-v1.0.8-release-offline-patched.apk

Verify

Check removed permissions:

BUILD_TOOLS=$(find "${ANDROID_HOME:-$HOME/Library/Android/sdk}/build-tools" -mindepth 1 -maxdepth 1 -type d | sort | tail -n 1)
"$BUILD_TOOLS/aapt2" dump permissions \
  smartglance-reverse-patch/dist/SmartGlance-v1.0.8-release-offline-patched.apk

Expected absent permissions:

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.HIGH_SAMPLING_RATE_SENSORS

Check startup:

adb logcat -c
adb shell monkey -p vip.wexiang.SmartGlance -c android.intent.category.LAUNCHER 1
sleep 5
adb shell pidof vip.wexiang.SmartGlance
adb logcat -d | grep -Ei 'FATAL EXCEPTION|missing INTERNET|product\.expcover'

Expected result: pidof prints a process id, and the grep prints nothing.

NFC test

The Android emulator is not enough for the NFC flow. The app uses NfcAdapter.enableReaderMode and expects a real NfcA tag or case.

adb logcat -c
adb shell am start -n vip.wexiang.SmartGlance/vip.wexiang.ui.MainActivity
adb logcat | grep -Ei 'vip.wexiang|enableReaderMode|NFC|读取|校验|设备|数据|activated'

Good signs:

enableReaderMode
读取数据
校验设备，匹配

Bad signs:

密码不匹配
数据不合法
设备不匹配

Hardware NFC simulation needs a Proxmark3, Chameleon, PN532, or similar device configured as a compatible NfcA or Type-2 tag with password auth. A real case is simpler.

Research notes

Static, dynamic, MobSF, Ghidra RPC, NFC, and patch notes live in:

smartglance-reverse-patch/research/