Skip to content

Commit

Permalink
update GMS Attestation and Google Photos spoof patches
Browse files Browse the repository at this point in the history
  • Loading branch information
@Archfx
Archfx committed Oct 26, 2024
1 parent 7396ab1 commit 116874b
Show file tree
Hide file tree
Showing 8 changed files with 77 additions and 84 deletions.
69 changes: 31 additions & 38 deletions .../platform_frameworks_base/0001-gmscompat-Change-attestation-and-instrumentation-to-.patch
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
From 6bb6ae865746aa6cf8258396daa95edbca434f8e Mon Sep 17 00:00:00 2001
From 6d4be4de8f059d099625c98126a08723d186f1fd Mon Sep 17 00:00:00 2001
From: Alberto Ponces <[email protected]>
Date: Thu, 9 Nov 2023 12:33:55 +0100
Subject: [PATCH 1/8] gmscompat: Change attestation and instrumentation to pass
Expand All @@ -9,14 +9,14 @@ Updated by many people like @dereference23, @Stallix, @dyneteve, @neobuddy89 and
Adapted by @iceows for his own AOSP A13 GSI.
Adapted by @ponces based on the work of @chiteroman to pass newest Play Integrity API.
---
core/java/android/app/Instrumentation.java | 4 +
.../internal/gmscompat/AttestationHooks.java | 100 ++++++++++++++++++
.../keystore2/AndroidKeyStoreSpi.java | 3 +
3 files changed, 107 insertions(+)
core/java/android/app/Instrumentation.java | 4 +
.../internal/gmscompat/AttestationHooks.java | 93 +++++++++++++++++++
.../keystore2/AndroidKeyStoreSpi.java | 3 +
3 files changed, 100 insertions(+)
create mode 100644 core/java/com/android/internal/gmscompat/AttestationHooks.java

diff --git a/core/java/android/app/Instrumentation.java b/core/java/android/app/Instrumentation.java
index db216b1af..9445bc1b5 100644
index db216b1af974..9445bc1b581a 100644
--- a/core/java/android/app/Instrumentation.java
+++ b/core/java/android/app/Instrumentation.java
@@ -63,6 +63,8 @@ import android.view.WindowManagerGlobal;
Expand Down Expand Up @@ -46,10 +46,10 @@ index db216b1af..9445bc1b5 100644

diff --git a/core/java/com/android/internal/gmscompat/AttestationHooks.java b/core/java/com/android/internal/gmscompat/AttestationHooks.java
new file mode 100644
index 000000000..eb59bed82
index 000000000000..99e61ae74007
--- /dev/null
+++ b/core/java/com/android/internal/gmscompat/AttestationHooks.java
@@ -0,0 +1,100 @@
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
Expand Down Expand Up @@ -80,7 +80,6 @@ index 000000000..eb59bed82
+/** @hide */
+public final class AttestationHooks {
+ private static final String TAG = "GmsCompat/Attestation";
+ private static final boolean DEBUG = false;
+
+ private static final String PACKAGE_GMS = "com.google.android.gms";
+ private static final String PACKAGE_FINSKY = "com.android.vending";
Expand All @@ -91,39 +90,32 @@ index 000000000..eb59bed82
+
+ private AttestationHooks() { }
+
+ private static void setBuildField(String key, String value) {
+ private static void setPropValue(String key, String value) {
+ try {
+ Log.i(TAG, "Spoofing Build." + key + " with value \"" + value + "\"");
+ Field field = Build.class.getDeclaredField(key);
+ Log.i(TAG, "Spoofing " + key + " with value \"" + value + "\"");
+ Class clazz = Build.class;
+ if (key.startsWith("VERSION.")) {
+ clazz = Build.VERSION.class;
+ key = key.substring(8);
+ }
+ Field field = clazz.getDeclaredField(key);
+ field.setAccessible(true);
+ field.set(null, value);
+ field.set(null, field.getType().equals(Integer.TYPE) ? Integer.parseInt(value) : value);
+ field.setAccessible(false);
+ } catch (NoSuchFieldException | IllegalAccessException e) {
+ Log.e(TAG, "Failed to spoof Build." + key, e);
+ }
+ }
+
+ private static void setVersionField(String key, Object value) {
+ try {
+ Log.i(TAG, "Spoofing Build.VERSION." + key + " with value \"" + value + "\"");
+ Field field = Build.VERSION.class.getDeclaredField(key);
+ field.setAccessible(true);
+ field.set(null, value);
+ field.setAccessible(false);
+ } catch (NoSuchFieldException | IllegalAccessException e) {
+ Log.e(TAG, "Failed to spoof Build." + key, e);
+ } catch (Exception e) {
+ Log.e(TAG, "Failed to spoof " + key, e);
+ }
+ }
+
+ private static void spoofBuildGms() {
+ setBuildField("PRODUCT", "oriole_beta");
+ setBuildField("DEVICE", "oriole");
+ setBuildField("MANUFACTURER", "Google");
+ setBuildField("BRAND", "google");
+ setBuildField("MODEL", "Pixel 6");
+ setBuildField("FINGERPRINT", "google/oriole_beta/oriole:15/AP41.240823.009/12329489:user/release-keys");
+ setVersionField("SECURITY_PATCH", "2024-09-05");
+ setVersionField("DEVICE_INITIAL_SDK_INT", Build.VERSION_CODES.LOLLIPOP);
+ setPropValue("PRODUCT", "komodo_beta");
+ setPropValue("DEVICE", "komodo");
+ setPropValue("MANUFACTURER", "Google");
+ setPropValue("BRAND", "google");
+ setPropValue("MODEL", "Pixel 9 Pro XL");
+ setPropValue("FINGERPRINT", "google/komodo_beta/komodo:15/AP41.240823.009/12329489:user/release-keys");
+ setPropValue("VERSION.SECURITY_PATCH", "2024-09-05");
+ setPropValue("VERSION.DEVICE_INITIAL_SDK_INT", "32");
+ }
+
+ public static void initApplicationBeforeOnCreate(Application app) {
Expand All @@ -140,18 +132,19 @@ index 000000000..eb59bed82
+
+ private static boolean isCallerSafetyNet() {
+ return sIsGms && Arrays.stream(Thread.currentThread().getStackTrace())
+ .anyMatch(elem -> elem.getClassName().contains("DroidGuard"));
+ .anyMatch(elem -> elem.getClassName().toLowerCase()
+ .contains("droidguard"));
+ }
+
+ public static void onEngineGetCertificateChain() {
+ if (isCallerSafetyNet() || sIsFinsky) {
+ Log.i(TAG, "Blocked key attestation sIsGms=" + sIsGms + " sIsFinsky=" + sIsFinsky);
+ Log.i(TAG, "Blocked key attestation");
+ throw new UnsupportedOperationException();
+ }
+ }
+}
diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java
index e6a63b9c4..6a80c14c9 100644
index e6a63b9c4c17..6a80c14c9837 100644
--- a/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java
+++ b/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java
@@ -48,6 +48,7 @@ import android.system.keystore2.ResponseCode;
Expand Down
24 changes: 12 additions & 12 deletions ...s/personal/platform_frameworks_base/0002-gmscompat-Spoof-Pixel-XL-for-Google-Photos.patch
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
From 3ca70b42c7f24ce1138f2c3a78ef00bf720cb22a Mon Sep 17 00:00:00 2001
From 193037f39fbe1019329ca0e5562279b70e8570ea Mon Sep 17 00:00:00 2001
From: vladsendrix <[email protected]>
Date: Fri, 31 Dec 2021 03:18:04 +0100
Subject: [PATCH 2/8] gmscompat: Spoof Pixel XL for Google Photos
Expand All @@ -9,34 +9,34 @@ Change-Id: I905e40625b07ebf500cbb3ce1deadedee2e624c5
1 file changed, 14 insertions(+)

diff --git a/core/java/com/android/internal/gmscompat/AttestationHooks.java b/core/java/com/android/internal/gmscompat/AttestationHooks.java
index eb59bed82..563bad8a8 100644
index 99e61ae74007..efa41e2a9b5f 100644
--- a/core/java/com/android/internal/gmscompat/AttestationHooks.java
+++ b/core/java/com/android/internal/gmscompat/AttestationHooks.java
@@ -32,6 +32,7 @@ public final class AttestationHooks {
@@ -31,6 +31,7 @@ public final class AttestationHooks {

private static final String PACKAGE_GMS = "com.google.android.gms";
private static final String PACKAGE_FINSKY = "com.android.vending";
+ private static final String PACKAGE_PHOTOS = "com.google.android.apps.photos";
private static final String PROCESS_UNSTABLE = "com.google.android.gms.unstable";

private static volatile boolean sIsGms = false;
@@ -74,6 +75,15 @@ public final class AttestationHooks {
setVersionField("DEVICE_INITIAL_SDK_INT", Build.VERSION_CODES.LOLLIPOP);
@@ -66,6 +67,15 @@ public final class AttestationHooks {
setPropValue("VERSION.DEVICE_INITIAL_SDK_INT", "32");
}

+ private static void spoofGooglePhotos() {
+ setBuildField("PRODUCT", "marlin");
+ setBuildField("DEVICE", "marlin");
+ setBuildField("MANUFACTURER", "Google");
+ setBuildField("BRAND", "google");
+ setBuildField("MODEL", "Pixel XL");
+ setBuildField("FINGERPRINT", "google/marlin/marlin:10/QP1A.191005.007.A3/5972272:user/release-keys");
+ setPropValue("PRODUCT", "marlin");
+ setPropValue("DEVICE", "marlin");
+ setPropValue("MANUFACTURER", "Google");
+ setPropValue("BRAND", "google");
+ setPropValue("MODEL", "Pixel XL");
+ setPropValue("FINGERPRINT", "google/marlin/marlin:10/QP1A.191005.007.A3/5972272:user/release-keys");
+ }
+
public static void initApplicationBeforeOnCreate(Application app) {
if (PACKAGE_GMS.equals(app.getPackageName()) &&
PROCESS_UNSTABLE.equals(Application.getProcessName())) {
@@ -84,6 +94,10 @@ public final class AttestationHooks {
@@ -76,6 +86,10 @@ public final class AttestationHooks {
if (PACKAGE_FINSKY.equals(app.getPackageName())) {
sIsFinsky = true;
}
Expand Down
4 changes: 2 additions & 2 deletions patches/personal/platform_frameworks_base/0003-monet-Use-Style.SPRITZ-by-default.patch
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
From cdb439e3ef319cd3ec2817a69b5da7f7e9255b9d Mon Sep 17 00:00:00 2001
From 061bb69be8e88148772e74feb81cbffc750dc38d Mon Sep 17 00:00:00 2001
From: Alberto Ponces <[email protected]>
Date: Sun, 26 Feb 2023 22:13:35 +0000
Subject: [PATCH 3/8] monet: Use Style.SPRITZ by default
Expand All @@ -9,7 +9,7 @@ Change-Id: Ia44ba56c8daa07033b290de89bb300bda9d39d86
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java b/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java
index 4963aae08..9c67b44fc 100644
index 4963aae08ab7..9c67b44fccbd 100644
--- a/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java
+++ b/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java
@@ -146,7 +146,7 @@ public class ThemeOverlayController implements CoreStartable, Dumpable {
Expand Down
38 changes: 19 additions & 19 deletions .../platform_frameworks_base/0004-fw-b-Use-ro.build.version.incremental-to-signal-OTA-.patch
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
From 22a165579df84085b3e18608264c616159b21bfe Mon Sep 17 00:00:00 2001
From 5a78da60f3da79efc1f435784572050fd6b7a118 Mon Sep 17 00:00:00 2001
From: dhacker29 <[email protected]>
Date: Tue, 24 Nov 2015 01:53:47 -0500
Subject: [PATCH 4/8] fw/b: Use ro.build.version.incremental to signal OTA
Expand All @@ -19,10 +19,10 @@ Change-Id: If0eb969ba509981f9209ffa37a949d9042ef4c2a
7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/core/java/android/app/admin/SystemUpdateInfo.java b/core/java/android/app/admin/SystemUpdateInfo.java
index 9e6c91f4ec313..7459b0e05e3af 100644
index 9e6c91f4ec31..7459b0e05e3a 100644
--- a/core/java/android/app/admin/SystemUpdateInfo.java
+++ b/core/java/android/app/admin/SystemUpdateInfo.java
@@ -133,7 +133,7 @@ public void writeToXml(TypedXmlSerializer out, String tag) throws IOException {
@@ -133,7 +133,7 @@ public final class SystemUpdateInfo implements Parcelable {
out.startTag(null, tag);
out.attributeLong(null, ATTR_RECEIVED_TIME, mReceivedTime);
out.attributeInt(null, ATTR_SECURITY_PATCH_STATE, mSecurityPatchState);
Expand All @@ -31,7 +31,7 @@ index 9e6c91f4ec313..7459b0e05e3af 100644
out.endTag(null, tag);
}

@@ -142,7 +142,7 @@ public void writeToXml(TypedXmlSerializer out, String tag) throws IOException {
@@ -142,7 +142,7 @@ public final class SystemUpdateInfo implements Parcelable {
public static SystemUpdateInfo readFromXml(TypedXmlPullParser parser) {
// If an OTA has been applied (build fingerprint has changed), discard stale info.
final String buildFingerprint = parser.getAttributeValue(null, ATTR_ORIGINAL_BUILD );
Expand All @@ -41,10 +41,10 @@ index 9e6c91f4ec313..7459b0e05e3af 100644
}
try {
diff --git a/core/java/android/content/pm/PackagePartitions.java b/core/java/android/content/pm/PackagePartitions.java
index ff80e614be58b..da3b68ecf789f 100644
index ff80e614be58..da3b68ecf789 100644
--- a/core/java/android/content/pm/PackagePartitions.java
+++ b/core/java/android/content/pm/PackagePartitions.java
@@ -131,7 +131,7 @@ private static String getFingerprint() {
@@ -131,7 +131,7 @@ public class PackagePartitions {
final String partitionName = SYSTEM_PARTITIONS.get(i).getName();
digestProperties[i] = "ro." + partitionName + ".build.fingerprint";
}
Expand All @@ -54,10 +54,10 @@ index ff80e614be58b..da3b68ecf789f 100644
}

diff --git a/services/appwidget/java/com/android/server/appwidget/AppWidgetXmlUtil.java b/services/appwidget/java/com/android/server/appwidget/AppWidgetXmlUtil.java
index d781cd8d58d89..c1b2c5824b519 100644
index d781cd8d58d8..c1b2c5824b51 100644
--- a/services/appwidget/java/com/android/server/appwidget/AppWidgetXmlUtil.java
+++ b/services/appwidget/java/com/android/server/appwidget/AppWidgetXmlUtil.java
@@ -100,7 +100,7 @@ public static void writeAppWidgetProviderInfoLocked(@NonNull final TypedXmlSeria
@@ -100,7 +100,7 @@ public class AppWidgetXmlUtil {
out.attributeInt(null, ATTR_WIDGET_FEATURES, info.widgetFeatures);
out.attributeInt(null, ATTR_DESCRIPTION_RES, info.descriptionRes);
out.attributeBoolean(null, ATTR_PROVIDER_INHERITANCE, info.isExtendedFromAppWidgetProvider);
Expand All @@ -66,7 +66,7 @@ index d781cd8d58d89..c1b2c5824b519 100644
}

/**
@@ -111,7 +111,7 @@ public static AppWidgetProviderInfo readAppWidgetProviderInfoLocked(
@@ -111,7 +111,7 @@ public class AppWidgetXmlUtil {
@NonNull final TypedXmlPullParser parser) {
Objects.requireNonNull(parser);
final String fingerprint = parser.getAttributeValue(null, ATTR_OS_FINGERPRINT);
Expand All @@ -76,10 +76,10 @@ index d781cd8d58d89..c1b2c5824b519 100644
}
final AppWidgetProviderInfo info = new AppWidgetProviderInfo();
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index c0b8034b9a562..dd7d5cea82a83 100644
index c0b8034b9a56..dd7d5cea82a8 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -2229,7 +2229,8 @@ public Set<String> getInstallConstraintsAllowlist() {
@@ -2229,7 +2229,8 @@ public class PackageManagerService implements PackageSender, TestUtilityService
if (mIsUpgrade) {
PackageManagerServiceUtils.logCriticalInfo(Log.INFO,
"Upgrading from " + ver.fingerprint + " (" + ver.buildFingerprint + ") to "
Expand All @@ -89,7 +89,7 @@ index c0b8034b9a562..dd7d5cea82a83 100644
}
mPriorSdkVersion = mIsUpgrade ? ver.sdkVersion : -1;
mInitAppsHelper = new InitAppsHelper(this, mApexManager, mInstallPackageHelper,
@@ -2387,7 +2388,7 @@ public Set<String> getInstallConstraintsAllowlist() {
@@ -2387,7 +2388,7 @@ public class PackageManagerService implements PackageSender, TestUtilityService
| Installer.FLAG_CLEAR_APP_DATA_KEEP_ART_PROFILES);
}
}
Expand All @@ -99,10 +99,10 @@ index c0b8034b9a562..dd7d5cea82a83 100644
}

diff --git a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
index ff8abf8794874..0babd99a511ba 100644
index ff8abf879487..0babd99a511b 100644
--- a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
+++ b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
@@ -1399,8 +1399,6 @@ public static void enforceSystemOrRoot(String message) {
@@ -1399,8 +1399,6 @@ public class PackageManagerServiceUtils {
// that starts with "eng." to signify that this is an engineering build and not
// destined for release.
if (isUserDebugBuild && incrementalVersion.startsWith("eng.")) {
Expand All @@ -111,7 +111,7 @@ index ff8abf8794874..0babd99a511ba 100644
// Heuristic: If the /system directory has been modified recently due to an "adb sync"
// or a regular make, then blow away the cache. Note that mtimes are *NOT* reliable
// in general and should not be used for production changes. In this specific case,
@@ -1408,6 +1406,7 @@ public static void enforceSystemOrRoot(String message) {
@@ -1408,6 +1406,7 @@ public class PackageManagerServiceUtils {
File frameworkDir =
new File(Environment.getRootDirectory(), "framework");
if (cacheDir.lastModified() < frameworkDir.lastModified()) {
Expand All @@ -120,10 +120,10 @@ index ff8abf8794874..0babd99a511ba 100644
cacheDir = FileUtils.createDir(cacheBaseDir, cacheName);
}
diff --git a/services/core/java/com/android/server/pm/Settings.java b/services/core/java/com/android/server/pm/Settings.java
index 39565526f33ee..d410f237fd07c 100644
index 39565526f33e..d410f237fd07 100644
--- a/services/core/java/com/android/server/pm/Settings.java
+++ b/services/core/java/com/android/server/pm/Settings.java
@@ -484,7 +484,7 @@ public static class VersionInfo {
@@ -484,7 +484,7 @@ public final class Settings implements Watchable, Snappable, ResilientAtomicFile
public void forceCurrent() {
sdkVersion = Build.VERSION.SDK_INT;
databaseVersion = CURRENT_DATABASE_VERSION;
Expand All @@ -133,10 +133,10 @@ index 39565526f33ee..d410f237fd07c 100644
}
}
diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java
index 1cd77ffcedaa2..b918cfa56f40d 100644
index 1cd77ffcedaa..b918cfa56f40 100644
--- a/services/core/java/com/android/server/pm/ShortcutService.java
+++ b/services/core/java/com/android/server/pm/ShortcutService.java
@@ -5248,7 +5248,7 @@ void injectRestoreCallingIdentity(long token) {
@@ -5248,7 +5248,7 @@ public class ShortcutService extends IShortcutService.Stub {

// Injection point.
String injectBuildFingerprint() {
Expand Down
4 changes: 2 additions & 2 deletions ...ersonal/platform_frameworks_base/0005-SystemUI-Add-left-padding-for-keyguard-slices.patch
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
From 37f057dcbb2c09130fd745170f3e83eb46535884 Mon Sep 17 00:00:00 2001
From afb9cc61c4856b40426946d96bb8dd69950e3c07 Mon Sep 17 00:00:00 2001
From: LuK1337 <[email protected]>
Date: Fri, 27 May 2022 01:13:39 +0200
Subject: [PATCH 5/8] SystemUI: Add left padding for keyguard slices
Expand All @@ -10,7 +10,7 @@ Change-Id: I2735028472aa46bad412c69948936fb30c5fa36c
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/packages/SystemUI/src/com/android/keyguard/KeyguardSliceView.java b/packages/SystemUI/src/com/android/keyguard/KeyguardSliceView.java
index 7b5325d4e..d8be862e1 100644
index 7b5325d4eaa6..d8be862e19ac 100644
--- a/packages/SystemUI/src/com/android/keyguard/KeyguardSliceView.java
+++ b/packages/SystemUI/src/com/android/keyguard/KeyguardSliceView.java
@@ -49,6 +49,7 @@ import com.android.internal.annotations.VisibleForTesting;
Expand Down
4 changes: 2 additions & 2 deletions ...l/platform_frameworks_base/0006-Add-android.permission.READ_PHONE_STATE-to-manifest.patch
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
From fd9ded0e5692e15d1b97c582f546c962441271a5 Mon Sep 17 00:00:00 2001
From 6ed5e8f8df73add8ec18964f3f94b90af47fc686 Mon Sep 17 00:00:00 2001
From: Janson Kang <[email protected]>
Date: Mon, 14 Dec 2015 11:13:24 +0800
Subject: [PATCH 6/8] Add "android.permission.READ_PHONE_STATE" to manifest
Expand All @@ -9,7 +9,7 @@ Change-Id: I78d90166635bbdf6b74e2a02efc1029387b4ad8d
1 file changed, 1 insertion(+)

diff --git a/packages/SystemUI/AndroidManifest.xml b/packages/SystemUI/AndroidManifest.xml
index 666d93925..e47dde0c1 100644
index 666d939257dc..e47dde0c1af1 100644
--- a/packages/SystemUI/AndroidManifest.xml
+++ b/packages/SystemUI/AndroidManifest.xml
@@ -68,6 +68,7 @@
Expand Down
Loading

0 comments on commit 116874b

Please sign in to comment.