修改apk而不反编译它

Question

I understand that this is an odd question, but I have this situation:

I serve an apk directly from a site, this apk has a WebView inside of it which will open a "secure" part of a website.

I would like to track down those who download it, and those who then open it, so I have thought of this:

I compile the apk with the URL written in this way (or in a similar one) :

www.myserver.com/secretplace/landing.php?token=##########

then, just before a user downloads it, I change those ########## characters with a token created on the fly and store in the database, when the user opens the apk, I can check the token and recognize that that was the user that downloaded the apk at that specific moment. I want to change it as if I load the apk in notepad and change it manually...

I really understand that this is odd, but...do you think it will work?

Does someone have some other idea on how to track users who download an apk for those who open it?

the question is: it is possible to modify an apk without decompile it? is there a problem? are there some limitations? such as, "yes you can modify it, but you must use the same number of characters" which could be acceptable.

NOTES: tha apk download and the fact the users MUST use APK to access the site is mandatory.

Answer 1

Yeah, your question is very odd. Anyway, you can do that (in parts). The apk is a compressed folder and you can open it. But more part of code are compiled. But your assets are not. So, you can change some asset file and read it from your app. There is no secure here, but you could just use some log in system if you wanted that (Besides, anyway to use hash in apk will fail in secure because you can just copy the apk to another device).

There is other way. You can compile your apk on the fly. Use your webservice to change the code you want. Read this: http://developer.android.com/tools/building/building-cmdline.html

Well, I really recomend you to try some login system with tokens like OAuth (but that is with you).