yashsingh1/xdaforums huggingface dataset:
[Magisk] fOmey:
Looks to be a broad issue..

Don't think they are bypassing the system services, they are probably just filtering location updates based off providers (complete speculation at this stage, will need to confirm when I'm in front of my PC).

Perhaps rather then relying on the location update(s) to determine if it they are mocked, might be querying the source location provider to determine if they're mocked?

This poses some interesting issues for us tho, going to share my thought process:

If we patch the status of a mock provider, does this in turn break existing spoofers? The patch is going to make them no longer appear as mock providers.

If we decide to patch mock providers, this is going to require patching framework.jar.. recompilation is going to be a issue, if we can even get it to recompile that is.

Can we even patch framework.jar? Is this even possible in modern android? Need to research how to re-generate boot-framework.vdex/.cdex/.oat etc. to reflect our changes.

This all would have been much more do-able using xposed, however xposed no longer passes safety net (supposedly).. if this is true, that renders it useless for our case. (I suspected this would happen... I was considering moving all the patches over to xposed recently, thank god I decide to hold off).

Can we disable the fused location service? Force location updates to be sourced directly from the location service... this seems to be the best route in my opinion, less complicated of a solution and our current patches may still work.

Perhaps we adjust our focus to patching play services instead.. I suspect the patch would need frequent updates tho, I would rather not deal with that.

I'm open to reasonable ideas.. if anyone knows a little more info on point 3.. I'm all ears.

EDIT:

I just tested the current patches and I've got

no rubber banding at all

? I'm not connected to a wifi network at the moment tho.... Galaxy S10, Play Services 19.6.29, android 9.

You guys sure they patched something, doesn't look like it? :confused:

Can we all double check location settings are set to device only... wifi scanning is off... they may have been reset during the update. Only source of location updates should be set to device only... ANYTHING ELSE WILL CAUSE RUBBERBANDING - A SINGLE LOCATION SOURCE SHOULD ONLY BE ENABLED FOR FOOL PROOF RELIABLE SPOOFING..

I can't fix problems I can't reproduce, right now I have zero rubber banding.. pokemon go loading up just fine, while spoofing (I did have to hide magisk manager to stop it *****ing about my device being incompatible).

I'm testing with "GPS joystick 4.1.2 by the theappninjas".. using what they refer to as "privacy mode".
[Magisk] rawika:
Until now it's a Android 10 only issue with latest google play service (19.6.29). You are using Android 9 which reportedly isn't affected.

---------- Post added at 01:33 AM ---------- Previous post was at 01:24 AM ----------

Also I figured out that only pokemon go is affected by this. Wizards Unite worked while Pokemon is not working. (Error 11)

Reverting back to play service before 19.6.29 makes it work again.
[Magisk] Deses:
I can confirm. Everything is set as I did with Android 9, but on Android 10, location spoofing no longer works with Version 19.6.29 (120400-278422107) on my OnePlus 7 Pro.

OnePlus 3T with Oreo is running Version 19.6.29 (040400-278422107) and spoofs fine.
[Magisk] PoochyX:
Why you need 2 one plus phones

([emoji3590]09-09-18[emoji3590])
[Magisk] Deses:
I'm gonna go ahead and ignore that dumb question.
[Magisk] pogo-airsupport:
My worry about this would be regarding whether apps can detect that you disable fusedlocation services.

I know the spoofing community has tried to do so in the past, and ended up getting detected or banned by different apps

Based on my limited experience with coding, I guess with option 5) you could always do a on-the-fly patch that is updated server side, meaning the patch would periodically check whether the signature has changed in play services, and if so, request new code to patch. Mind you, it still requires cat and mouse on your end to maintain.
[Magisk] PoochyX:
Fused locations controls everything

([emoji3590]09-09-18[emoji3590])

---------- Post added at 03:31 AM ---------- Previous post was at 03:30 AM ----------

Fused locations controls everything....

([emoji3590]09-09-18[emoji3590])
[Magisk] fOmey:
Interesting.. Can you guys upload your services.jar? If you upload the generated module, that should be fine.

I'll try figure out if I'm missing something here.. perhaps a new/renamed function that is not being patched in android 10. The fact I have no issues on android 9 leads me to believe this might be the case.

Apps are doing that? Gees... really cracking the whip arnt they?
[Magisk] PoochyX:
FOmey i need you to compile my Kernal make it permissive

...

([emoji3590]09-09-18[emoji3590])
[Magisk] rawika:
There you go.

Unpatched framework directory and module zip file.

https://drive.google.com/drive/folders/1HW6pwW0OQJgQHncA6ehAwX_BVWNUqv1j?usp=sharing
[Magisk] pogo-airsupport:
Or so people say. I've never personally ever tried this.

There's never been any solid proof one way or another.

But this was blamed on the appninja app having a "disable fusedlocation" function if the app is systemized.
[Magisk] cmstew:
Hey, I just wanted to add to the list of Android 10 users stuck without working spoofing. To solidify validity, I just wanted to mention that I have been one of the ones who has constantly been reminding people to turn off wifi/bluetooth scanning, and location accuracy. So this is actually broken this time. :(

I've uploaded the module I created after updating to the November update on Nov 4th.

Hopefully it helps shed some light on things.

Thanks again for all you do!

MODULE: https://drive.google.com/open?id=1pbqZgeZHruGSvrLEB58JGAbJb1qT-sHk

SERVICES JAR: https://drive.google.com/file/d/14-GJhw5LEKUfncZo2n_9A7yGTHMnEMZ_/view?usp=drivesdk
[Magisk] fOmey:
Thanks doesn't appear like I've missed anything.

On another note I did take a peek at the Google play services APK and it does appear like they are filtering out location updates from mock providers.. obfuscation made it a little difficult figuring out what exactly is going on, but I did find new references to mock location providers.

Our options are as follows:

We disable fused location service (easiest option).

We patch mock provider status (probably going to break all known spoofers).

We attempt to patch google play services. However its obfuscated, probably not possible.. but I may look into this and give it a try.

Has anyone actually tried disabling fused location and seeing what the results are?
[Magisk] ErriK89:
If I well understood google in latest play services filtered out mock location provider from updating fused location.

Is it possible to force a mock location as it is not a mock location and provite it to fused location? I think it's option 2 written by fOmey.

I don't know if disabling fused location really works, everything in Android rely on fused location and I think will be very easy to app developer to block fake gps if fused location are not enabled

I will try now to disable mock location. Let see

---------- Post added at 09:55 AM ---------- Previous post was at 09:40 AM ----------

I disabled fused location wirh 19.6.29. i tried with smali installed two apps:

- fake gps (incorporated apps) --> set gps and network but don't set fused loc, as it was also with fused loc enabled

- fake gps pro location (dgsmartstudio) -> set network and fused but not set gps. This app works also with 19.6.29 but it suffers of rubberbanding

In both case pogo shows error 11
[Magisk] 4tress:
Update: installed services v.19.5.68 and got everything working fine.
[Magisk] Hirs_E_Fruit:
I use EDXposed on my OnePlus 7 Pro with Android 10 and I pass SafetyNet, all you have to do is turn on EdXposed Manager Black List feature and turn it on for Play Services, Google Framework and maybe Play Store (but I dont do it cause I need SudoHide).

Just an information for you.

OnePlus 7 Pro, GM1913, 10.0.1 BA and Play Services Version 17.7.86 works fine!

Did try the last 2 days to get spoofing work again on my Xiaomi RedMi Note 4 with an Android 10 Custom ROM but didnt work out, because I need or better I want to spoof with 2 accounts at the sime time and unfortunatley I only habe the 3 GB RAM model where it sometimes closes the GPS Joystick.
[Magisk] rawika:
Disabling fused location through service disabler didn't help. I disabled play services > fused location and the fused location system app.

Using https://play.google.com/store/apps/details?id=com.eclipsim.gpsstatus2 with fused location as gps source I can verify that fused location discards all coordinates given by the spoofer.

Can this be solved by collaborating with the app developer? Or providing a documentation what to do?
[Magisk] DenyDarko:
[MENTION=1620550]fOmey[/MENTION] on another note there aren't that many in active development.

Just a couple of those.

It's obvious that they need to adapt to the change.

It'll hit Android 9 and lower sooner or later
[Magisk] Jkjk12345:
Sorry I'm new to this kind of things, so probably I'm doing something wrong. Also if this isn't the correct place/way to ask this kinda things don't worry about blaming me. So my problem is the following: when I try to use Smali to patch the /system/framework folder it gives me this error:

==> Detected java: 1.8.0_231

==> Processing framework

Error: Invalid or corrupt jarfile bin\apktool.jar

!!! ERROR: Mock location class not found.

This happens every time I try to patch the /system/framework folder grabbed from my device (a Samsung Galaxy S5Mini with Android 6.0.1). I already tried using Fulmics Deodexer on the framework folder, it starts and doesn't give me any error, but then when I go back to Smali and try to patch the framework folder it still gives me this error. I also noticed that inside framework/oat/arm there isn't the services.odex file. I'm not sure if this is okay or not, but I also tried reinstalling the stock firmware with Odin and the file .odex still doesn't exist. I don't know if this can help or not, however this are my /system/framework folder and build.prop file:

ttps://drive.google.com/open?id=1_BQ4dd56Jvdqm1sLO2rqdXrpmvJVuRcI

I omitted the 'h' in the word "https" inside the link because I can't post the entire link due to the fact that I'm a new user of XDA :(
[Magisk] pogo-airsupport:
Disabling fusedlocation doesn't work if per what Fomey said, that google play services is filtering out mocked locations from updating fusedlocations.

By that logic, disabling fusedlocation doesn't change that if google play services are blocking the mocked locations upstream.
[Magisk] PoochyX:
I'm having issues with pogo it won't let me use the app no more it was just fine yesterday now it just closes

([emoji3590]09-09-18[emoji3590])
[Magisk] Hirs_E_Fruit:
Google Play Service Version?
[Magisk] pogo-airsupport:
Downgrade to 19.5.xx version of play services, and turn off automatic updates
[Magisk] PoochyX:
Alright

([emoji3590]09-09-18
[Magisk] ammmze:
I haven't tried that in quite a while. I used to disabled fused locations before the 3 strike policy came out and I did periodically get warnings. Haven't gotten any since turning it off. But not sure if/what else may have changed. So i'm not gonna claim 100% that is/was a trigger.
[Magisk] ralph.bethke1:
Sharing some thoughts/experience about the mock location issue with latest Play services on Android 10:

Once I updated my phone (Xiaomi Mi 9T Pro) to MIUI 11 (based on Android 10 for this device), I also generated a new smali patcher module. Testing with Google maps revealed that location updates from GPS spoofing apps (tried three different ones) where no longer processed within maps. This happens with or without the smali patcher module installed. Whenever a mock location app has been active, Google maps has been unable to update the location.

Reverting to any older play services version immediately allows mock locations to work again.

One of the spoofing apps ("GPS Joystick" from The App Ninjas) had the option to do "indirect mocking", which allowed this app to spoof the location in a way which does work with the new play services and hence mocked locations worked within Google maps. As I am not sure what that option actually does, I have not tried this in any app other than maps. Whatever that option technically does, it at least allows mocking of locations without the location updates being discarded. I cannot judge whether this will be detected by any game and I won't test it, but it has been the only way to have mock location being picked up by maps.

I also tried disabling fused location to no avail.

Gesendet von meinem Mi 9T Pro mit Tapatalk
[Magisk] pogo-airsupport:
I can second that the indirect mocking method works in maps.

Might be worthwhile for Fomey to look into to see whether there's something there worth pursuing.
[Magisk] PoochyX:
Pogo can you decompile my Kernal for me and make it so I can switch between permissive and enforcing when needed...

([emoji3590]09-09-18[emoji3590])
[Magisk] ammmze:
I'm not sure how the indirect mocking works, but I can confirm that indirect mocking does allow the mock locations to get picked up. But in my experience it rubberbands pretty bad. So would probably have to resort to using foil with indirect mocking.
[Magisk] amazingnessn:
I have downgraded and I can mock location, but apps cannot read my current location when mocking isn't on. Google Maps cannot see where I am unless I'm mocking my location, is that normal with smali patcher?
[Magisk] MendyG5:
I downgraded and autoupgrade... i cant keep downgraded.
[Magisk] lividhen99:
Have you tried detach? It might just break Google play services, but hey, it seems worth a try.
[Magisk] ErriK89:
I'm checking gps joystick with upgraded play services and I will confirm if it works.

I found another app (fake gps pro location from dgsmartstudio) that works with latest play services but suffer rubberbanding a bit even with smali patcher installed.

It seems that fake gps pro location doesn't set gps signal but only network signal and this is able to being not filtered by play services and it set fusedlocation properly.

Maybe if there is a possibility to disable completely gps module it stop to do rubberbanding and it works. Maybe this can be done with smalipatcher :)

I confirm that both gos joystic (ninja apps) and fake gps pro location (dgsmartstudio) works with the latest play services. They both works with indirect mocking and doesn't set gps signal but only network location. In this way they are able to set the location through fused location. Drawback is rubberbanding because gps signal is not "written" and gps module continue to works and set real position. I think that thin foil can solve the issue.

A question on smali: is it possible to create a patch in smali that overwrite the gps signal with the signal coming from network? I think this can definitively solve the issue with both apps!

[IMG="Location Status"]https://ibb.co/9NTnnsD[/IMG]
[Magisk] fOmey:
Delete the "bin" directory and restart the patcher.

Thanks for trying that.

That's correct.. That does appear to be what is happening.

I think the options are as follows:

We patch the mock provider status. (using anything other than xposed to do this is going to be very difficult).. we also don't know the side effects of doing this, potentially break spoofers.

We patch play services (going to be very difficult also, obfuscated.. probably going to probably require signature verification patches elsewhere).

We feed location updates directly into the original provider.

Can anyone confirm xposed passes safetynet & is undetectable by apps like Pokemon Go?

I really need a device on Q for testing.. come on Samsung, drop the stable update already!
[Magisk] kittygotwet:
Anyone have this occurring to them? I'm on Android 10 and when I smalipatcher everything works then randomly the spoofing stops. it' just home location. When I patch, I only have mock locations and high volume selected. Should I be selecting anything else?

I've tried repatching and deleting and reinstalling the module to no avail. Seems like I gotta re-install the rom to get it to work.

Any ideas?
[Magisk] fOmey:
Literally covered in the last 3-4 pages of this thread...
[Magisk] kittygotwet:
my apologies, hopefully there's a fix soon.

as of right now uninstalling google play services enables mock locations again, for the time being.
[Magisk] TraceFormer:
Sent you a PM.
[Magisk] pogo-airsupport:
So far, I haven't had any rubberbanding issue trying it today. Mind you, I never really had much in terms of rubberbanding
[Magisk] Hirs_E_Fruit:
OnePlus 7 Pro, Gm1913, 10.0.1 BA

EDXposed installed and passing SafteyNet
[Magisk] lividhen99:
No, on my device at least, edxposed immediately breaks safetynet when installed even with Google services blacklisted, plus when installed the entire system slows to a crawl, but I think that part is my issue.
[Magisk] Hirs_E_Fruit:
I think your settings are just wrong because it works well on my device!
[Magisk] lividhen99:
The only thing I have done is blacklist Google play services and Google services framework and the divice is capping at about 13 frames a second. DOES ANYONE KNOW WHAT'S GOING ON!?!?
[Magisk] Hirs_E_Fruit:
Maybe start with your device stats.

If you dont use EdXposed Module it all works perfect?
[Magisk] melvinJones:
Same in OnePlus 7 too
[Magisk] lividhen99:
[/COLOR]

No. Just the moment it's installed,everytbing breaks. I guess I'm stuck with out it. ?
[Magisk] pogo-airsupport:
Fomey, what if we just played man in the middle, where a patch would capture all spoofed location, and then feed it to google play services as being legit gps data?

You wouldn't have to worry about breaking existing apps, nor would you have to patch play services itself.
[Magisk] ErriK89:
I looked how indirect mocking works on jps joystick app. It works with actual smali patcher but it suffer of rubberbanding due to real gps signal superposed to mock location. Maybe it's just sufficient in smali patcher to replicate the signal generated by indirect mocking in gps overwriting the real gps signal or to completely disable gps module when spoofing is enabled.

In any case by reducing updating time actually this method works on android 10 with latest play services without rubberbanding. Drawback is a big battery drain.
[Magisk] pogo-airsupport:
What do you mean by this sentence?

As well, with location services turned off, I personally don't experience any rubberbanding
[Magisk] ErriK89:
What you mean with "location services turned off"?

If you turn off fusedlocation apps will not works (for example you will get error 11 in pogo)
[Magisk] xavisaldana:
Binary Download 99% for 10 minutes... what can I do?
[Magisk] pogo-airsupport:
Go into location settings, you can turn off Google Location Accuracy
[Magisk] rling:
Enabling Indirect Mocking with App Ninja works with Andoid 10 and Play Services 16, but need to reduce process interval to 100ms from 500ms.

Smali patcher + this option allows one to play.
[Magisk] fOmey:
That could work, I do like this idea... using mock locations can be avoided entirely tho.

I think making spoofers a system app or using root to feed location updates directly is the best route to take.. that's entirely up to the individual spoofer developers to implement tho.

Pretty sure a few exist already... GPS joystick perhaps? I could be wrong.. I also have no idea how they are feeding location updates either.
[Magisk] PoochyX:
Fmoney i need you to make my Kernal permissive

([emoji3590]09-09-18[emoji3590])
[Magisk] pogo-airsupport:
If you try to systemize on Android 10, the app will just crash. That's why the only viable method on Android 10 is the smali patcher

There are some privacy permissions that causes problems as soon as the app is systemized, namely those that allows apps to run processes in the background. Has to do with specific changes made between P and Q.

I had looked into the permissions and how to change it, but I couldn't figure it out through my limited understanding.
[Magisk] fOmey:
I see, so the fact the app is running processes in the background is causing the crash? Not the act of feeding location updates? That sounds like a issue the spoofer developer should be able to fix.. otherwise perhaps a potential patch?

I really need a device running android 10 so I can test all of this for myself and gather some more data, right now I'm just speculating and bouncing ideas off the wall.. all I really have is the info users have provided me, I really don't understand enough about the current situation.

EDIT: I just had an idea, would you like to test something for me? If so reply to this message with a link to a generated module..
[Magisk] pogo-airsupport:
It's accessing a permission/api that is not permissive as a system app. I don't recall what it is on the top of my head. You start seeing errors as soon as the device starts without even having the launch the app. If you try to launch the app, it instantly crashes.

Would be worthwhile to see if we can patch that. Though I do think having a dedicated feeder of location to play services might be a more permanent solution?

Edit: Specific permissions pertain to "Restrictions on starting activities from the background" and ACCESS_BACKGROUND_LOCATION
[Magisk] fOmey:
I do like the feeder idea, but might be a simpler solution.

Can you test something for me?
[Magisk] pogo-airsupport:
Sure
[Magisk] fOmey:
Can you give me a link to your smali patcher magisk module, I'll manually patch out a few things.
[Magisk] ammmze:
I can test
[Magisk] pogo-airsupport:
https://drive.google.com/open?id=1Z1RvHp-bp-WMMZNfKr6O-J4Xpij06udF

Here you go. If it's worth anything, the most recent November update on pixel wasn't able to boot without disabling the previous pre-november module. I had to create a new module.
[Magisk] fOmey:
Please backup before trying this.. this a hail mary shot.
[Magisk] pogo-airsupport:
Boots just fine. But still no GPS signal without indirect mocking.
[Magisk] ammmze:
@f0mey have you had any success finding where in play services they are doing the filtering? I've been looking but haven't found it yet...of course it is expected to be difficult due to the obfuscation. I thought I saw you mention you were gonna look in there.
[Magisk] fOmey:
Search for "isFromMockProvider".
[Magisk] fOmey:
Possible to upload your entire framework directory?
[Magisk] ammmze:
Yea...i'd found that, but I didn't see anything new with that when comparing that with the older play services specifically. Though there is a method that uses `isFromMockProvider` that JADX couldn't decompile, so it's a bit harder to read, the code immediately around that is the same between the 2 play services However there are parts of the method that do diverge. Though some of them appear to be they had swapped the if/else, but there are some farther towards the end that are a fair bit different.

Edit: Though the class appears to to be some places service, so i'm not really confident that is the class with the changes we are concerned with. But if you search for a class that has "Places.PlacesTaskChimeraService.PREFETCHING_TASK_TAG" and "com.google.android.location.places.PlacesTaskService", then the method I was looking through takes the first parameter is a Location object and it does in that method look for isFromMockProvider. Which from what I can tell is fine. I suspect they are looking at something else to further determine if a location is a mock location.
[Magisk] pogo-airsupport:
https://drive.google.com/open?id=1wex7OqOf8ydMruU6QJtseVoEu7Nvoz6F

This is everything extracted by SmaliPatcher (i disabled the patch in magisk and rebooted before extracting). If there's something more you need, I can dig into it a bit more with root explorer in the morning.