The problem: a core payment module, legacy_auth_v3.jar , needed to run in the new Dalvik runtime. But Android hadn’t read raw JARs like that since Gingerbread. Today’s build system demanded —Dalvik Executable—compressed, optimized, and bytecode-verified.
She bundled classes.dex into an APK, signed it with a debug key, and side-loaded it onto a physical device—a crusty Nexus 5 that had survived four OS upgrades and a coffee spill.
She ran javap -c on the most problematic class. Method verifyPin called javax.crypto.spec.SecretKeySpec —fine. But also sun.security.pkcs.PKCS7 —not fine. Android had stripped all sun.* packages.
She repackaged the patched .class files into a new JAR: patched_auth.jar .
