Bypassing APK Installation Restrictions on Lexar Pexar / Frameo Photo Frames

A guide to installing third-party apps (like Home Assistant) on Frameo-based digital photo frames running Android 11.

## The Problem

Lexar Pexar (and other Frameo-based) digital photo frames come with a heavily locked-down Android 11 installation. While ADB can be enabled in settings, attempting to install any APK results in:

```
Failure [INSTALL_FAILED_INVALID_APK: Package io.homeassistant.companion.android is not allow to install.]
```

This happens because Frameo has modified the Android PackageManagerService to only allow installation of apps that are already present as system apps - effectively creating a whitelist that blocks all third-party installations.

## Requirements

- Lexar Pexar 2K (or similar Frameo-based frame) with ADB enabled
- Linux computer (tested on Ubuntu) with ADB installed
- Java Runtime Environment (JRE)
- The APK you want to install (e.g., Home Assistant)

## Device Information

This guide was tested on:
- **Device:** Lexar Pexar 2K 11" Digital Photo Frame
- **Firmware:** PF1106_V2.05_20250102
- **Android Version:** 11
- **Software:** Frameo

## Understanding the Restriction

### Root Cause

The restriction is implemented in `/system/framework/services.jar`, specifically in the `PackageManagerService` class. A custom `isSystemApp()` method checks if a package is already installed as a system app before allowing installation:

```java
// Pseudocode of the restriction
if (!isSystemApp(packageName)) {
    throw new PrepareFailure("Package " + packageName + " is not allow to install.");
}
```

### Why Standard Workarounds Don't Work

1. **No space on system partition:** The `/system` partition has only ~2.3MB free, not enough for additional APKs
2. **A/B partitioning:** Android 11 uses A/B partitioning, making system modifications difficult
3. **dm-verity:** Verified boot restores any system modifications on reboot

## The Solution

We patch the `isSystemApp()` method in services.jar to always return `true`, temporarily bypassing the restriction. Once an app is installed, it persists in `/data/app/` even after dm-verity restores the original services.jar on reboot.

## Step-by-Step Guide

### Step 1: Enable ADB on the Frame

1. On your Pexar frame, go to **Settings**
2. Find and enable **ADB** (Android Debug Bridge)
3. Connect the frame to your computer via USB
4. Verify connection:
   ```bash
   adb devices
   ```

### Step 2: Extract services.jar

```bash
# Create working directory
cd /tmp

# Pull services.jar from the device
adb pull /system/framework/services.jar
```

### Step 3: Download Required Tools

```bash
# Download baksmali (disassembler)
wget https://bitbucket.org/JesusFreke/smali/downloads/baksmali-2.5.2.jar -O baksmali.jar

# Download smali (assembler)
wget https://bitbucket.org/JesusFreke/smali/downloads/smali-2.5.2.jar -O smali.jar
```

### Step 4: Extract and Disassemble

```bash
# Extract the jar
unzip -o services.jar -d services_extracted

# Disassemble the main dex file
java -jar baksmali.jar d services_extracted/classes.dex -o services_smali
```

### Step 5: Find and Patch the Restriction

First, verify the restriction location:

```bash
grep -n "is not allow to install" services_smali/com/android/server/pm/PackageManagerService.smali
```

Find the `isSystemApp` method:

```bash
grep -n "\.method private isSystemApp(Ljava/lang/String;)Z" services_smali/com/android/server/pm/PackageManagerService.smali
```

Note the line number (e.g., 39141). Find where the method ends:

```bash
grep -n -A100 "\.method private isSystemApp(Ljava/lang/String;)Z" services_smali/com/android/server/pm/PackageManagerService.smali | grep "end method"
```

Now patch the method. Replace the entire `isSystemApp(String)` method with one that always returns `true`:

```bash
cd services_smali/com/android/server/pm/

# Backup original
cp PackageManagerService.smali PackageManagerService.smali.bak

# Create patched version
# Replace START_LINE and END_LINE with actual line numbers from your file
# Example: if method starts at 39141 and ends at 39240

head -n 39140 PackageManagerService.smali > PackageManagerService_patched.smali

cat >> PackageManagerService_patched.smali << 'EOF'
.method private isSystemApp(Ljava/lang/String;)Z
    .registers 2

# PATCHED: Always return true to allow any app installation
    const/4 v0, 0x1
    return v0
.end method
EOF

tail -n +39241 PackageManagerService.smali >> PackageManagerService_patched.smali

mv PackageManagerService_patched.smali PackageManagerService.smali
```

Verify the patch:

```bash
grep -A5 "\.method private isSystemApp(Ljava/lang/String;)Z" PackageManagerService.smali
```

You should see:
```smali
.method private isSystemApp(Ljava/lang/String;)Z
    .registers 2

# PATCHED: Always return true to allow any app installation
    const/4 v0, 0x1
    return v0
.end method
```

### Step 6: Reassemble and Repackage

```bash
cd /tmp

# Reassemble the patched smali to dex
java -jar smali.jar a services_smali -o classes.dex

# Create new services.jar
mkdir -p services_new
cd services_new
unzip ../services.jar
cp ../classes.dex classes.dex
zip -r ../services_patched.jar *
cd ..

# Verify the patched jar is smaller (important for space constraints)
ls -la services.jar services_patched.jar
```

### Step 7: Deploy to Device

```bash
# Remount system as writable
adb shell mount -o remount,rw /

# Make space by removing odex/vdex files (they'll be regenerated)
adb shell rm -f /system/framework/oat/arm/services.odex
adb shell rm -f /system/framework/oat/arm/services.vdex
adb shell rm -f /system/framework/oat/arm64/services.odex
adb shell rm -f /system/framework/oat/arm64/services.vdex
adb shell rm -f /system/framework/services.jar.bprof
adb shell rm -f /system/framework/services.jar.prof

# Push patched jar to data partition first
adb push services_patched.jar /data/local/tmp/services.jar

# Copy to system framework
adb shell cp /data/local/tmp/services.jar /system/framework/services.jar

# Verify
adb shell ls -la /system/framework/services.jar
```

### Step 8: Restart System Server and Install

**Important:** Do NOT do a full reboot, as dm-verity will restore the original services.jar.

```bash
# Restart zygote (this restarts the Android framework without a full reboot)
adb shell setprop ctl.restart zygote
```

Wait about 30 seconds for the UI to restart, then immediately install your app:

```bash
adb install /path/to/your-app.apk
```

You should see:
```
Performing Streamed Install
Success
```

### Step 9: Verify Installation

```bash
# Check if app is installed
adb shell pm list packages | grep homeassistant

# Launch the app
adb shell am start -n io.homeassistant.companion.android/.launch.LaunchActivity
```

## Important Notes

### The App Persists After Reboot

Once installed, the app lives in `/data/app/` which is not affected by dm-verity. You can safely reboot the device - the app will remain installed and functional.

### Future App Installations

If you need to install additional apps later, you'll need to repeat steps 7-8:

1. Remount and make space
2. Copy patched services.jar
3. Restart zygote (not full reboot)
4. Install quickly

### Recovery If Something Goes Wrong

If the device bootloops:

```bash
# Wait for ADB to be available during boot animation
adb wait-for-device
adb shell mount -o remount,rw /
adb push /tmp/services.jar /system/framework/services.jar
adb reboot
```

### Why dm-verity Can't Be Disabled

The bootloader is locked (`adb disable-verity` returns "Device is locked"), so we cannot permanently disable verified boot. This is why we use the "install and persist" approach instead.

## Technical Details

### Partition Layout

| Partition | Size | Free | Notes |
|-----------|------|------|-------|
| / (system) | 772MB | ~2.3MB | dm-verity protected |
| /vendor | 124MB | ~408KB | Read-only |
| /product | 103MB | ~316KB | Read-only |
| /data | 26GB | ~25GB | Writable, apps stored here |

### Key Files

- `/system/framework/services.jar` - Contains PackageManagerService
- `/system/system_ext/priv-app/Frameo/Frameo.apk` - The Frameo app
- `/data/app/` - Where user-installed apps are stored

### The Original isSystemApp Method

The original method:
1. Gets PackageInfo for the package name
2. Checks `applicationInfo.flags & FLAG_SYSTEM (0x1)`
3. Also checks `applicationInfo.flags & FLAG_UPDATED_SYSTEM_APP (0x80)`
4. Returns true only if the package is already a system app

Since new packages aren't installed yet, this check always fails for them.

## Credits

This guide was created through collaborative debugging and reverse engineering. Feel free to share and improve upon it. Thanks to Claude Opus 4.5 too, helped a bunch in debugging and doing that.

## Disclaimer

Modifying system files can potentially brick your device. Proceed at your own risk. This guide is provided for educational purposes.

Jonathan's notes

Navigation

Recent Posts

Friend Links