yashsingh1/xdaforums huggingface dataset:
[Xposed Framework Modules] M66B:
The logcat will contain the methods available when a option hook is not found. Look before the 'optional' line.

NetGuard is the only firewall app where you can block a domain name and have all its IP addresses automatically blocked. All other firewall apps block by IP address, which will fail if a domain name has multiple dynamic IPs (CDN, DNS geo locating).

Fabric's Answers is part of Crashlytics, which is already being disabled:

https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/assets/fabric_with_kits.lua
[Xposed Framework Modules] M66B:
Android build tools includes a code shrinker which removes all unused methods. See here for more details:

https://developer.android.com/studio/build/shrink-code.html
[Xposed Framework Modules] M66B:
Which methods there are in com.facebook.appevents.AppEventsLogger.

Better not the Play store version and better enable ad blocking as instructed.

There is no import from AFWall+.
[Xposed Framework Modules] badabing2003:
Do I have to have the app restricting internet for the api.mixpanel.com to be blocked?

Would Adaway.com need to be uninstalled? or they can coexist?

Thanks
[Xposed Framework Modules] M66B:
If you setup ad blocking following the instructions, you're good to go and Mixpanel is not ;)

There is a NetGuard XDA thread where you can ask questions.
[Xposed Framework Modules] Phoost:
It's the first time I work with hooks. So these might be stupid questions.

I saw the post in xlua about deny access for sdcard.

I tried that out because want to protect one special folder.

I was able to set the BlockGuard.open hook and add this restriction to my favorite explorer App to see if it works. I used the lua posted in xlua fred today(?) for this hook.

My App still see the whole sdcard (internal).

I see the access time of the hook so it's really set. I checked catlog but find just one entry:

02-13 13:27:02.198 I/XLua.Provider(1332): Hook Privacy.BlockGuardOs.open pkg=com.lonelycatgames.Xplore:10083 event=use duration=2 restricted=1 new=null old=/data/misc/keychain/pins function=before

I added some logs in lua. One at the beginning of lua function

(I know lua language)

I don't see the logs from lua. Not in Pro log view nor in catlog verbose level.

Where I see lua logs?

Anything wrong in the log entry above?
[Xposed Framework Modules] M66B:
I have not looked into the modified BlockGuardOs hook yet [MENTION=5297163]Fif_[/MENTION], so I cannot answer your question right now (I am having a busy day today).

About the logging: you'll need to use the log function, which was added by me to log into the logcat. For example:

log('hello world')
log(some_object)

The latter will do a toString on the object.

Relevant source code:

https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/java/eu/faircode/xlua/XLua.java#L747

And, stupid questions do not exist ...

Edit: make sure you reapply the hook after making changes, for example by toggling it off/on (assuming the target app will automatically be force stopped).
[Xposed Framework Modules] Phoost:
Thanks for your quick look. I just want to make sure I'm not on the wrong track.

I did such log(......) calls.

The output should be in catlog? Which level?
[Xposed Framework Modules] M66B:
In the logcat, yes, at informational level.
[Xposed Framework Modules] Fif_:
I have a better version since that post, I'll post it here when I'm done.

I don't see any of the lua log() statement output in the logcat, at any level.
[Xposed Framework Modules] M66B:
I often use the log statement to develop and test hook definitions, so I am pretty sure it works. The line starts with the word Log followed by package name, uid, hook name and at the end with the log output. Maybe you're overlooking it for this reason.

Edit: checking the code you are right, only a debug build will output logging. I will change that in the next release.
[Xposed Framework Modules] M66B:
The just released stable version 1.21.1 will now really write Lua log to the logcat.
[Xposed Framework Modules] M66B:
[MENTION=5297163]Fif_[/MENTION] Now that I had some more time to look closer at the above, I have a few questions/remarks:

Why did you allow access to /system and /vendor? These folders can contain stuff that could be used for tracking. Is is possible to be more specific on what to allow?

Why is it needed to allow the data folder of the WebView? Apps can normally not access data of other apps (blocked by an SELinux policy on recent Android versions).

I think ipairs would be better than pairs here.

The import/export format has been changed in XPrivacyLua version 1.21.1 to make it easier to use the same script for multiple hooks. Try to export something to see how it works. Edit: the old format is still accepted, so no worries.

Internally XPrivacyLua is called XLua because I had a vision the other day ;)

I think XLua is nicer than XPosedLua because the latter sounds as disposing Lua, which is something we don't want to do ;)

To answer your question: XLua is used mainly for privacy related stuff so far, but maybe that is going to change in the near future.

I am a quite modest guy, but I believe XLua could very well, with some more attention, cause a little revolution in how Xposed is being used.
[Xposed Framework Modules] squam974:
DisplayMetrics json Hook

Hi again,

Sorry for the wrong thread :/

I am trying to add a screen size hook to hook.json, but it doesn't work : "DisplayMetrics class not found error"

Could you help me ?

{
"collection": "Privacy",
"group": "Use.Tracking",
"name": "DisplayMetrics.widthPixels",
"author": "Me",
"className": "android.util.DisplayMetrics",
"methodName": "#widthPixels",
"parameterTypes": [],
"returnType": "int",
"minSdk": 13,
"usage": false,
"luaScript": "@value_width_pixels"
},
[Xposed Framework Modules] M66B:
On import the referenced scripts are 'linked', so on export scripts referenced multiple times will be duplicated in multiple definitions. So, you'll need to keep the import file around for development. I like to keep hook definitions in XPrivacyLua simple to prevent bugs.

Maybe a useful note: you can use hook:getName() to make things conditional in a Lua script.

And another one: you could use something like this to edit a JSON file: https://jsoneditoronline.org (not tested, just an example)

I will look later into your work in more detail, but is seems quite solid to me.

I am not sure of I am going to make your script part of XPrivacyLua, which would also mean taking responsibility for maintenance, but if I do, you'll be credited properly.

The idea was to have a hook definition repository, but for now there is not enough interest in hook definitions to justify creating such a repository. Hopefully this is going to change.

Edit: about settings/preferences: these need to be registered in some way to be shown in the companion app. I have been thinking to add an attribute to the hook definition for that, but if you have a better idea, please let me know.
[Xposed Framework Modules] M66B:
Class not found means that the class of the method or of the parameter/return types was not found, so double check all names and make sure that there aren't invisible characters like a tab character.

Looking at:

https://developer.android.com/reference/android/util/DisplayMetrics.html

what you want is not going to work. You'll need to hook into getMetrics to modify the value after it has been set:

https://developer.android.com/refer....html#getMetrics(android.util.DisplayMetrics)

Edit: to complicate things further (sorry), Configuration holds screen sizes too:

https://developer.android.com/reference/android/content/res/Configuration.html#screenHeightDp
[Xposed Framework Modules] M66B:
[MENTION=5297163]Fif_[/MENTION] and others: XPrivacyLua version 1.21.2 and the companion app version 0.42 support hook settings (custom values).

How does it work?

Define one or more settings names in a hook definition

Set the custom values either globally or per app using the companion app

Read the values using param:getSetting('setting_name1')

Simplified example definition:

{
"definition": [
{
"group": "Read.Account",
"name": "Account.createFromParcel",
"author": "M66B",
"className": "android.accounts.Account",
"methodName": "CREATOR:createFromParcel",
"parameterTypes": [
"android.os.Parcel"
],
"returnType": "android.accounts.Account",
"luaScript": "@Privacy.Account.createFromParcel",
[B] "settings": [
"setting_name1",
"setting_name2"
][/B]
}
]
}

The default setting value is nil (null).

Edit: this is now documented here too: https://github.com/M66B/XPrivacyLua/blob/master/DEFINE.md
[Xposed Framework Modules] Danmann:
Hi,

I have an app which is working only in my wifi network.

Is it theoretically possible to fake the network and wifi ssid? So that I can use the app with VPN on networks like cell network or another wifi network?

I hadn't enough time ( yet) to check it how that works.

Thanks,

Dan
[Xposed Framework Modules] M66B:
Is this a legal application? (see also the OP)
[Xposed Framework Modules] Danmann:
Yes, it is. It's a wemo app/ device which is firewalled with afwall. Only LAN is available but it needs the home ssid ( which I already changed to my home network) and it figured out somehow that the phone isn't in "wifi mode".

Edit:

Is there a way to change hooks only for one app?
[Xposed Framework Modules] M66B:
This will not be easy, because the network type is available in a lot of place. You will have to look into these and related classes:

https://developer.android.com/reference/android/net/ConnectivityManager.html

https://developer.android.com/reference/android/net/wifi/WifiManager.html
[Xposed Framework Modules] Danmann:
Okidok. I'll have a look.

Maybe you missed my edit.

Is there a way to change hooks only for one app?
[Xposed Framework Modules] M66B:
You could change the flow of control like this:

if param:getPackageName() == 'some.package.name' then
<do something special>
else
<do the regular thing>
end

or you could copy the hook and change its name/group and script and apply the copied/changed hook only to the app(s) you want.
[Xposed Framework Modules] Danmann:
Oh yeah, right. The last one sounds pretty easy :)

Like I said I hadn't time for it yet. Thanks so far.
[Xposed Framework Modules] tiaox:
Am I doing this right? View attachment Appsee.start.json.txt to block invasive AppSee analytics (screen recording of in-app behaviour etc), although I haven't encountered it in the wild yet.

Also, is the syntax for specifying arrays as parameter type documented somewhere? I was looking at the Fabric.with hook to see if it also blocks the Answers kit (not just crashlytics) and I see

[Lio.fabric.sdk.android.Kit;

, which seems to be a Kit array? That's an odd syntax which I haven't seen before, am I missing something obvious here?
[Xposed Framework Modules] Fif_:
I now get it. You can indeed share the code at import time, but once it's loaded, all the code snippets are duplicated. I guess this is better than nothing, but I was hoping for more reuse than just at import time. Please read on:

It's very noticeable to me that the more hooks you have, the slower the app start-up is. While just enabling XPrivacyLua without any hooks enabled doesn't make any difference, using a default set of hooks makes app start-up slower. I'm perfectly willing to pay that price for my privacy's sake, but maybe avoiding compiling every lua snippet every time can makes things faster. I'm thinking that shared code may only be compiled once, leading to faster start-up time. For example, I have twenty or more hooks which pretty much do:

param:setResult(nil)
return true

.

A probably a few more where nil is replaced by false, true, "unknown", etc.

As an example, and very on-topic with Privacy, I've attached a set of hooks for the Radar API documented here. [MENTION=2799345]M66B[/MENTION], feel free to include this in XPrivacyLua if you fancy so.

Speaking of which, is there any reason why the FlurryAgent hooks are disabled by default?

Edit: I've updated the attachment with a new version, you want the one with MD5=a5f219ef03150b4e150ad6d77606b5a0. There was a hook that was missing the optional flag.

The attachment below is obsolete, see this new post for an updated version.
[Xposed Framework Modules] M66B:
Given the documentation:

https://www.appsee.com/docs/android/api

the hook definition seems okay to me.

I would have called setOptOutStatus after the start method and hooked into this method to prevent opting in again because it will likely give less problems. But if it works, it works.

See here about class names:

https://docs.oracle.com/javase/7/docs/api/java/lang/Class.html#getName()
[Xposed Framework Modules] M66B:
Lua scripts are compiled on app start because:

The LuaJ library doesn't support compiling to a byte stream or something else serializable

The LuaJ library has special requirements for thread safety

This could be addressed by modifying LuaJ. However, this is not trivial to say the least.

Background: the hook definitions, compiled or not, need to be transferred to the app process somehow.

Sharing scripts could be a workaround, but would also complicate things. Pre compiling on change would be the best solution anyway.

IMHO it is not worth solving the little start delay of apps at this moment. If there was a lot more interest in XPrivacyLua, I would work on this, but the current number of users does not justify the effort.

Also, I am not sure if compiling is the real/only 'problem'. Transferring the hook definitions is likely not very fast as well. This is because it is not possible anymore to use a service due to stricter SELinux policies. So, I am using the system settings provider as a workaround to transfer data. Unfortunately, content providers are not the fastest form of IPC.

Nevertheless, the observation is correct, there is a little start delay.

The Flurry hooks are not properly tested and can make apps crash.

Edit: scripts are being compiled here:

https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/java/eu/faircode/xlua/XLua.java#L313
[Xposed Framework Modules] Fif_:
And after a few more days of debugging here are some updated versions.

The main difference is the way the logging is done.

Also, there's now a single file for both the File.mkdir and File.mkdirs functions, loading that single file will redefine both hooks.

For the BlockGuardOs.open() call, I also had to whitelist to two following paths:

/data/user_de/0/com.google.android.gms/

/data/app/com.google.android.gms-

The former is need by Hangouts, apparently a native library libcronet.so.<version> lives in /data/user_de/0/com.google.android.gms/, and that's scary that google downloads native code behind our backs :-/

The latter is required for the gmscore library, needed by Maps and other Googlish apps.

The attachments below are obsolete, see this new post for updated versions.
[Xposed Framework Modules] Fif_:
And here's a hook to filter DNS requests. This uses the new custom preferences introduced in XPrivacyLua Pro 1.21.2 (latest and greatest).

Importing the attached will create two new hooks under the (new) "Net.Firewall" category. You'll have to set the "Firewall host/domain black list" either globally or on a per-app basis. The list is space-separated.

Any attempt to resolve any of the hosts within any domain listed will get blocked with a "Privacy" error.

I use this list myself, YMMV:

ad-x.co.uk adcolony.com adjust.com adjust.io altbeacon.org amazon-adsystem.com analytics.query.yahoo.com android.nextapp.com api.braintreegateway.com api.kiip.me api.splkmobile.com appboy.com appsflyer.com appspot.com areametrics.com bugsense.com crashlytics.com crittercism.com crwdcntrl.net cuebiq.com doubleclick.net mobileapptracking.com exacttargetapis.com facebook.com fbcdn-profile-a.akamaihd.net fbcdn.com firebaseio.com flurry.com fyber.com doubleclick.net gameanalytics.com google-analytics.com googleads.g.doubleclick.net googleadservices.com googlesyndication.com googletagmanager.com hockeyapp.net igodigital.com inputtools.google.com inquisitr.com inrix.io kouponmedia.com leanplum.com lesswrong.ru localytics.com log2.tapatalk.com mobilecrashreporting.googleapis.com mopub.com mxplayer.j2inter.com oneaudience.com onradar.com overpass-api.de presage.io prochtenie.ru pubads.g.doubleclick.net qbk1.com quantcount.com radar.io scorecardresearch.com search-log-1.tapatalk.com search-log.tapatalk.com sense360eng.com stats.paypal.com statsonline.pushct.baidu.com suggestqueries.google.com tapjoyads.com tmobi.co tuisong.baidu.com ublackbox.com unity3d.com usebutton.com xone.com yext-pub.com yext.com yieldmo.com zendrive.com zenmxapps.com

Enjoy. [MENTION=2799345]M66B[/MENTION], I know this is no substitute for a real firewall, but I wanted to play with custom preferences :)

Oh, by the way, if you look at the hook, I had to jump through hoops (rawset/rawget) because global variables are not (directly) available. I think they could be useful to perform caching like is done in this hook. The caching seems to be effective, but it seems like every java thread is having its own lua interpreter if I read my logs correctly, which diminishes its effectiveness.

Do you think you could make global variables available (for caching value / maintaining state)?

The attachment below is obsolete, see this new post for an updated version.
[Xposed Framework Modules] M66B:
I see you have been having fun :)

A little remark: LuaJ globals are not thread safe and I see you have been creatively working around the check I had put into place ;)

The right thing to do would be something like this:

local scope = param:getApplicationContext()
param:putValue(name, value, scope)
local value = param:getValue(name, scope)

This likely answers your addition ;)

The above will fix your single cache per thread problem as well.

You can find some more information about LuaJ's thread safety here:

http://www.luaj.org/luaj/3.0/README.html

And to be complete, you can see here why there was a cache per thread:

https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/java/eu/faircode/xlua/XLua.java#L440

This is related to the discussion about pre compiling as well.

I have added a remark about this to the defining hooks documentation too:

https://github.com/M66B/XPrivacyLua/blob/master/DEFINE.md#remarks
[Xposed Framework Modules] Fif_:
Sorry about rawset/rawget, I was eager, but it seems to work so far, including on some heavyweights like Tapatalk.

I'm pleasantly surprised you can attach a complex object (a lua table) to the Java app context, but I'll give it a shot another day.
[Xposed Framework Modules] M66B:
No need for a sorry, but be aware that your solution might result in crashes.
[Xposed Framework Modules] badabing2003:
[MENTION=2799345]M66B[/MENTION]

FYI, I started XPrivacyLua discussion here

https://xdaforums.com/showthread.php?p=75600553 to get around Google breaking unknown sources apps in AA.

Hopefully it gets some traction and more people start using XPrivacyLua.

If you have any suggestions, by all means it's more than welcomed.

BB
[Xposed Framework Modules] badabing2003:
Marcel,

Following up on the previous post

Can you clarify something please?

As I'm trying to come up with a definition file, I'm getting class not found exception on Android Auto

02-18 09:53:28.683 13063 13063 E XLua.Xposed: Caused by: java.lang.ClassNotFoundException: Didn't find class "com.google.android.projection.gearhead" on path: DexPathList[[zip file "/data/app/com.google.android.projection.gearhead-15AEZGfTAdEYVP0Zpfj5Jg==/base.apk"],nativeLibraryDirectories=[/data/app/com.google.android.projection.gearhead-15AEZGfTAdEYVP0Zpfj5Jg==/lib/arm64, /data/app/com.google.android.projection.gearhead-15AEZGfTAdEYVP0Zpfj5Jg==/base.apk!/lib/arm64-v8a, /system/lib64, /vendor/lib64]]
02-18 09:53:28.683 13063 13063 E XLua.Xposed: at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:125)

Here's Emil's response.

Is this something that is not possible to hook to?

Or is it a case of obfuscation?

Thanks

BB
[Xposed Framework Modules] M66B:
If you know the right class and method name, you can hook anything in an app.

com.google.android.projection.gearhead is not a class name, but a package name.

Try com.google.android.projection.gearhead.chd or

com.google.android.projection.gearhead.bzj.

The problem with obfuscation is that in the next release chd and bzj will be different. This also means if you are using a different version of the app, the class/method names will be different.
[Xposed Framework Modules] badabing2003:
Thanks Marcel,

I've already tried these

com.google.android.projection.gearhead.chd

com.google.android.projection.gearhead.bzj

and got the same error.

If I browse AA in dexplorer, I see chd at the root

package chd

it's not under com.google.android.projection.gearhead

should it still be accessible like this?

com.google.android.projection.gearhead.chd

Thanks

BB

These are the definitions I'm trying

{
"script": [
{
"name": "BB.AA.Developer",
"code": "function before(hook, param)\n param:setResult(\"Devloper\")\n return true\nend\n"
}
],
"definition": [
{
"builtin": false,
"collection": "BB",
"group": "AndroidAuto",
"name": "AA.Developer",
"author": "BB",
"description": "",
"className": "com.google.android.projection.gearhead.bzj",
"methodName": "axb.bdv.aGs.aGU.lz",
"parameterTypes": [],
"returnType": "java.lang.String",
"minSdk": 1,
"maxSdk": 999,
"minApk": 0,
"maxApk": 2147483647,
"enabled": true,
"optional": false,
"usage": true,
"notify": false,
"luaScript": "@BB.AA.Developer"
}
]
}

{
"script": [
{
"name": "BB.AA.AllowUnkownSources",
"code": "function before(hook, param)\n param:setResult(\"Developer\")\n return true\nend\n"
}
],
"definition": [
{
"builtin": false,
"collection": "BB",
"group": "AndroidAuto",
"name": "AA.AllowUnkownSources",
"author": "BB",
"description": "",
"className": "com.google.android.projection.gearhead.chd",
"methodName": "xM",
"parameterTypes": [],
"returnType": "java.lang.String",
"minSdk": 1,
"maxSdk": 999,
"minApk": 0,
"maxApk": 2147483647,
"enabled": true,
"optional": false,
"usage": true,
"notify": false,
"luaScript": "@BB.AA.AllowUnkownSources"
}
]
}
[Xposed Framework Modules] M66B:
If there is no package name, which is bad form and quite unusual, although it can be the result of obfuscating, try to omit the package name altogether from the class name.