i'm new to all the freelance work and since last week i have receive two offer.

The first one was rebranding of an Android App. The client had a version of his application and he want me to add his new logo and colors to his existant app. But he can only send me one APK file. Not the source code. Second mission was a team that want me to add a new functionnality to their existant app. But again they only have one apk file to give me.

Is it normal to work with only an apk and to not have so much contact with the client before starting the work (even if it's not complex like adding a logo to a splashscreen ?) I find this solution really weird especially with the first client since they could just want to make a copy of an app.

It's my first two missions has a freelance so i don't want to lose my first opportunity especially when the task they ask me is pretty simple. But on the other hand i don't want to start my work with illegal jobs...

If anyone can tell me if this is normal in the field or if i should firmly decline those missions ?

Have a good day :)

  • 7
    Do you have any evidence at all that the people who want you to do these things actually own the apps in question?
    – Ben Barden
    May 21 '20 at 21:28
  • 1
    Also, you should simplify the question down a bit. This is a reasonable place to ask the "is this normal" question. It is not a particularly good place to ask the "how do I do this" question (that would be Stack Overflow, I suspect). First get the answer to this question, then (if you wish to continue) go ask that one.
    – Ben Barden
    May 21 '20 at 21:31
  • Thanks for your response. No i have no evidence at all. This i why it seems suspicious. And yes i will simplify the question since i just want to know if this is normal practive to work with APK and not the source code. I know how to work with an APK.
    – Tom
    May 21 '20 at 21:45
  • Also if they don't have the source, they probably don't own the signing key either. Which means you won't be able to update existing published app - be careful not to get blamed for that. I'd say this kind of job smells to high heaven and you shouldn't take it.
    – Mavrik
    May 22 '20 at 20:36

Do i have to do decompile the APK implement what the mission told me, recompile and then deliver the modified app ?

Yes, although there are tools for doing that like https://ibotpeaches.github.io/Apktool/. It isn't perfect, but should do for a reskinning.

I find this solution really weird especially with the first client since they could just want to make a copy of an app.

Companies that use freelancers are typically terrible at keeping their source code simply because they tend to be non-technical. I interviewed for a job where they hired a contractor to develop their app and they were hiring a full time person as the contractor was a dud.

They didn't even know what language/framework the app was built in. I would find what tech I was using when I arrived and figured it out for them.

Another friend works for a company where they hired a contractor to develop their website and the contractor disappeared. That company hired a bunch of developers and assumed they would know how to get into the server. In the end they were lifting HTML and JS off the page to transfer it over.

Friends who freelance have had people try to give them .exe files to edit.

Technical and organizational incompetence could easily explain why they don't have source code and such technical and organizational incompetence is common. But...

But on the other hand i don't want to start my work with illegal jobs...

You should do your best to verify that they actually own it. Try searching for the apks/app names on Google to see if the publisher matches the people who are hiring you or see if they publicly claim the apps already on their websites.

  • Yes this is what i was thinking... That it's not the developper who give me the missions but the HR department where they don't even know what source code is. But like those mission are 1 or 2 days missions and i will put the same effort/time searching if it's their app that i will put doing the real job... If it was a one week or one month mission i would understand and i would dig a little more. Thanks for your response anyway, that really show me that my case will be redundant unfortunatly ahah
    – Tom
    May 22 '20 at 10:30

Offering only APK is common in freelancing, because nobody will trust a new external freelancer. If you were the owner, would you give out all your assets to someone you never met? This is like taking a photo of your credit card and send it out. It's absurd to even expect source code in freelancing from an existing running app, not until you gain the trust. It simply doesn't work like that.

If anyone can tell me if this is normal in the field or if i should firmly decline those missions

Super common. You could decline it but it's possible to do the works without source code. Just charge more hours.

People are more comfortable paying more hours than sending you the source code. I know I'd more than happy to pay you more and not risk of the product being stolen.

  • 1
    Of course, giving away source code is not the good solution anyway because i could totally stole their app. But i was viewing the case from my perspective as a developper. If i want someone to add a functionnality to my app i would have send him like two activity and my gradle files so he can replicate my app environment. So i will of course charging more hours if i have to decompile the apk and understand how their app work and where i have to implement stuff. Thanks for your sharing !
    – Tom
    May 22 '20 at 10:34
  • @Tom, But in Android, you don't need to decompile the APK. The assets are not compiled. The APK is just a zipped folder. The name of the assets are compiled. And the paths are compiled. But the asset files themselves are not. And changing the content of those files doesn't even change the signature. With that being said, if the client requires a different package name and a different signature, then all bets are off, and what you say applies. May 22 '20 at 10:42
  • In Android the assets are not compiled but the java source code is compiled into dex file which can then be decompile to .jar and .java files and their is some case i think where online tools for decompiling apk failed and raise exception on some project. But yes of course that don't change the original question
    – Tom
    May 22 '20 at 10:56

I would find it weird that all you get to work on is APK file, especially branding work

First thing to do, IMHO, is to ask why and check the metadata of APK to validate ownership

  • 2
    No, it's not weird. You can reskin an apk without the source assuming you're willing to use the same signature. It's very easy. It's really pointless to give your code to someone who could potentially steal the source from you. It only becomes a problem if the owner wants to publish under a different package name or with a different signature. May 22 '20 at 1:26

Take a look at the package name, contact the developer directly through the Google Play store to make sure it's the same person (you could also just check if it's the same email address or the same phone number).

Also, before you do anything, ask the client if he wants you to change the package name and the signature. If he doesn't want you to change the signature, that's the easiest scenario. There is no programming required whatsoever.

If he wants you to change the signature (or the package name), then that's going to be much-much more difficult.

I find this solution really weird especially with the first client since they could just want to make a copy of an app.

If the client doesn't want you to change the package name or the signature, then not sharing the code with you was the right move. You don't need it. And it would be a lapse in security to share code with a contractor who doesn't even need it in the first place.

That being said, the owner not wanting to change the signature doesn't mean that he didn't steal the apk. With an unmodified signature, he won't be able to publish the apk to Google Play, but he'll still be able to publish the apk to non-Google Android stores in other markets.

An apk is just zip folder. Rename the extension to zip. Unzip it. See what I mean? The assets are right there. Change the assets.

But don't change their path. Don't change their name. Don't change their dimensions. Don't change their type. Don't break the 9 patch format (if any that you need to modify).

  • Yeah that's what i was going to do but i was finding it weird do to things like that i would have assume it would be easy ahah ! I know that an apk file is simply a zip folder. If they want to steal or copy an app they wouldn't have send me an apk to change the logo they would ask me to change package name etc... If they know how to change that they probably know how to change the splashcreen logo ! Same as all the response i got, i will contact the app developper to check if it's their app. Thanks for your time and your response !
    – Tom
    May 22 '20 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .