yashsingh1/xdaforums huggingface dataset:
[Xposed General] tiliarou:
Safetynet under VirtualXposed might not pass but why do you need it that way ? (not criticizing, I'm just asking the purpose to understand better)

Isn't the purpose of VirtualXposed to be able to pass safetynet outside of the VM, i.e. in the normal android environment (because we don't actually modify the system)?
[Xposed General] aneeskamuhammed:
youtube won't play without google play services

I installed the new update (v 0.11.2). but when I opened youtube showing "youtube won't play without google play services". what should I do to get google play service or microG? Do I have to install any app?

thanks in advance.
[Xposed General] joppy:
I didn't see this coming. Been missing out on the xposed stuff all winter because I haven't rooted the Mate 10.

This is wicked cool.

How does this affect battery life and performance?

---------- Post added at 01:44 PM ---------- Previous post was at 12:51 PM ----------

Yeah thats what she said :laugh:

---------- Post added at 02:15 PM ---------- Previous post was at 01:44 PM ----------

It would be very helpful for the community if you would post code of your findings. As your posts stands right now you bark loud but does not back your claims with any proof. I myself am not proficient enough to find backdoors or other crap in the code yet. But if you post your findings you can help educate the lesser minds like me. Also it seems they didn't use a closed source, it is open but for commercial use you need to purchase license. Or so I read.

I think that if virtualxposed does work and does not have malicious code then this is the dawn of a new day for developers as well as the user base. If this works and stuff can be run in containers the potential of this is huge. We could do away with rooted phones. As more and more secure apps require unrooted phones to work properly it has become tiresome to use a rooted device.
[Xposed General] tiliarou:
I would also enjoy [MENTION=3878921]agraceful[/MENTION] lights on where he found close source code. Not denying it as I didn't search myself in the code but would be good to post some evidence at this stage...

Moreover, if the devs don't understand what they are doing and [MENTION=3878921]agraceful[/MENTION] does, then he could probably code a much better app without security/privacy concerns ?
[Xposed General] joppy:
[MENTION=3878921]agraceful[/MENTION] I did not mean to call you out or to ridicule you. I am simply asking for what backdoor you found to try to learn. We should all be concerned about what apk's we feed our devices but long term users here like me tend to have their guard down because we trust the xda community and the developers. If someone is stepping outside their comfort zone trying to bring us new ways to use our phones we should expect some static. Until proven beyond doubt such a backdoor exist I will give the developer the benefit of the doubt.

However if someone is deliberately putting malicious code in apps posted here on our forum, needed steps should be taken to inform all users about such an apk. Anyone trying to prey on the community should be called out and the code should be posted in public and the exploit made known so we all can learn from this to better avoid such instances in the future.

When people like you with 10+ years of coding find malicious code I really hope you will reconsider and post you findings so that we all can make a well informed decision to use such an app or not.

As this thread stands now, we lesser minds don't know what to do or who to trust. And for people like me that are not solid programmers we don't even have the skills to read hundreds of lines of codes to look for malicious code, because we don't know what to look for.
[Xposed General] marsen2567:
Wow! This is a promising development. Keeping a close-eye on this.
[Xposed General] Lesley001:
VirtualXposed without root.

Please is the app out for download?
[Xposed General] potyqa:
Yes, here: https://github.com/android-hacker/VirtualXposed/releases
[Xposed General] wawan20:
did u using stock Samsung ROM bro ?
[Xposed General] Netharion:
This seems really promising but I can't get it to work with XHangouts, XHangouts states "XHangouts is not activated by Xposed". Even though it is.
[Xposed General] Okusac:
Can someone send me a link so that I can download the virtual xposed app
[Xposed General] YuriRM:
It has been posted several times before! Search the thread.
[Xposed General] andrew2432:
Link
[Xposed General] Okusac:
Yeah... I've seen it. Thanks
[Xposed General] koolicecream:
Installed instagram but when try to login... It shuts in virtual... Any solution.?
[Xposed General] Lesley001:
Thanks brov for the app.
[Xposed General] langithitam:
Hy [MENTION=8994560]weishu[/MENTION],

Just want to report :

Huawei Huawei Y5c Huawei Y5c Android 4.4.2 (KitKat) : can't be installed

Redmi Note 5a ugg MIUI 9 Noughat : installed

is there any requirement for this app?
[Xposed General] YuriRM:
Have you read the requirements?
[Xposed General] dimex:
Of course not. Reading? Spending a few minutes researching? Why? I'd rather just press a few buttons to install and then complain here when it doesn't work.
[Xposed General] YuriRM:
[MENTION=2443009]langit[/MENTION]hitan

There are over one million users of VirtualXposed. Most of them are Chinese. Are you hopeful that he reads their messages and yours too?
[Xposed General] andrew2432:
https://github.com/android-hacker/VirtualXposed/

From the readme:

VirtualXposed is a simple APP based on VirtualApp and epic that allows you to use an Xposed Module without needing to root, unlock the bootloader, or flash a custom system image. (Supports Android 5.0~8.1)

The only two restriction of VirtualXposed are:

1. Unable to modify system, so any Module which modifies system won't be able to work properly.

2. Currently resource hooks are not supported. (Theming modules use Resource Hooks).
[Xposed General] koko115:
Any idea how add root for virtual xposed ?
[Xposed General] YuriRM:
Like Magisk?
[Xposed General] koko115:
Yes. Or supersu. I mean add root only for virtual xposed.
[Xposed General] Namnodorel:
I think since Root necessarily has influence on a ton of system stuff, it wouldn't make much sense in VX.
[Xposed General] koko115:
Can some one tell me how properly install oryginal play store with my login to google ? I want install my paid apps in virtual xposed like xmessenger privacy premium.
[Xposed General] syafeeq05:
Lol, yes, only for a moment, hahaha
[Xposed General] fil3s:
Can I reboot my device with this app? Module? Oppo r11s
[Xposed General] nde123456:
It's a gift from God for users in China since it provide the xposed modules for Wechat and QQ which are the most popular apps in China.

It's totally useless if you want to modify system. It may be useful if you want to modify non-system apps.

No bootloader unlocking, no ROM flashing, no root, no brick risk, just install an app and delete it whenever you want.

[MENTION=8994560]weishu[/MENTION] Great idea and great job. Thanks a lot.
[Xposed General] mrshmi:
Any updates on code review?
[Xposed General] andrew2432:
Recentish github commit for runtime permissions and response from dev!
[Xposed General] eddyo1993:
Does anyone have the apk for it? Or at least explain how to obtain it
[Xposed General] sumitarora2:
https://github.com/android-hacker/VirtualXposed/releases/download/0.11.5/VirtualXposed_0.11.5.apk
[Xposed General] ItzShadowz:
Play Store compatibility to install paid apps without license errors would be great! Keep up the good work
[Xposed General] manos78:
Hi,

As this project has future, I suggest to open a new thread listing supported (fully/partially compatible) Xposed modules. For sure, current list will be small, as developers doesn't check his modules with this software. However, for the user it will be very usefull.

You agree? :confused:
[Xposed General] sumitarora2:
Yes, it is a nice idea and it will also be helpful for everyone using virtual xposed.
[Xposed General] agraceful:
LMFAO!
[Xposed General] ticktock666:
For someone who bashed this project to hell and back Including the xda editor staff for posting about it, while vehemently refusing to provide any proof or details able your "findings", you seem to follow this thread actively.

The only reason I can think of for what you're doing is trolling, i mean this is some /b quality stuff.
[Xposed General] agraceful:
Let's see, the code got changed quite quickly after I said there was malicious code found. NOBODY except me has bothered going through the code. I don't do other's work for them. And again, this does NOTHING that a third party app can't already do. It will not and cannot replace Xposed in any way shape or form but people still think it's something. If you can't dazzle them with brilliance then baffle them with bull****. And boy, have they.
[Xposed General] xpirad:
1. It's already clear that it's a false alarm. If you have followed the original github issue you'd know.

2. Please tell me what kind of third party app can run xposed without root. would appreciate that.

3. It's not meant to replace xposed. It's for people who don't want to root their phone but want to use xposed.

And.Ugh, I really hope you can just shut up your mouth. :)You're doing no good here.
[Xposed General] tiliarou:
Commits are available on github, feel free to show us the commit ref which hid the malicious code, please feel also free to highlight the malicious part.

We are not saying you are lying but you still didn't show any evidence...
[Xposed General] weishu:
Yes, great idea.

Some users say XInstra/XExternalSD/ADBlocker works well, but I do not use these apps/modules(some apps are not available in China :(

I only test some Chinese modules myself, could you give me a Xposed module list you often use?
[Xposed General] weishu:
Sad.

My hard working is regard as "hiding malicious code". Please figure out the "malicious code", ok?

VirtualXposed won't and can not replace Xposed, it just provides a convenient way for users who don't want to root/unlock bootloader.
[Xposed General] andrew2432:
[MENTION=8994560]weishu[/MENTION]

App crashes on my galaxy tab 8 with Resurrection remix MM. installs fine but then starts crashing stuff all around. Needed to twrp to delete due to processes stopping.
[Xposed General] koko115:
VirtualXposed crash when i go to search in any app.

And app settings app crash after turn on any app.

Problems is after update june security patch in galaxy S9
[Xposed General] weishu:
close the AutoFill framework in Settings-Languages.
[Xposed General] koko115:
ok works. But now samsung pass no work in apps.
[Xposed General] Zerikwan:
Confirm working on Samsung Galaxy Note FE

Android 8.0.0 (API 26)

VX version 0.11.5

tested with XInsta module v.2.0.6
[Xposed General] Myrmeko:
Thanka for the advice, but it doesnt work on my phone.

Maybe is because of Touchwiz. I dunno...
[Xposed General] Soumy1234:
Is there a way to shortcut apps in the virtual environment to the actual launcher so that we don't always have to go to virtual Xposed to open our apps?
[Xposed General] soulife:
Is this why I keep getting a mention?
[Xposed General] syafeeq05:
When I am trying to open the modules, the loading take for ages. Currently the Low Ram module activated, on stock Samsung J1 Ace. Don't tell me its not working on TouchWiz hahaha
[Xposed General] kroening.s:
Deleted
[Xposed General] M66B:
The latest version of XPrivacyLua supports VirtualXposed:

https://xdaforums.com/showpost.php?p=76960499&postcount=2902
[Xposed General] Infy_AsiX:
edit: wrong thread
[Xposed General] weishu:
The author of XPrivacyLua has made support for VirtualXposed in newly release of XPrivacyLua, you can use XPL in any version of VirtualXposed. Many thanks for [MENTION=2799345]M66B[/MENTION]!! Here is download link:

http://repo.xposed.info/module/eu.faircode.xlua

And the README: https://github.com/android-hacker/VirtualXposed/wiki/Privacy-control(XPrivacyLua)

If you encountered any problem, please contact me.
[Xposed General] Sirius@15:
Awesome!

How did you manage to make it work system wide sir? I was under impression that both the app and xpl need to be in the virtualxposed environment.

Does this mean gravitybox can also work someday?
[Xposed General] weishu:
No, It can not work system wide, it only take effect for apps in VirtualXposed. (Both XPL and apps need to be installed in VXP)

gracitybox can never be supported (no way to implement it)
[Xposed General] koko115:
I have XPL Pro from Play store. But how get this pro in VirtualXposed ?

How install Play Store with my google login and password in VirtualXposed
[Xposed General] M66B:
You'll need to install the Play store in VirtualXposed (I have no idea if this is possible) or use the standalone XPrivacyLua pro companion app (for information on this: https://contact.faircode.eu/?product=xluastandalone).
[Xposed General] koko115:
[MENTION=8994560]weishu[/MENTION] how install play store with my donate apps ? No fake store.
[Xposed General] scottjay:
Same question but with x messenger privacy which I bought on the play store and has license checks
[Xposed General] koko115:
Exactly. I have too xmessenger pro buyed in play store like XprivacyLua... how use this ? Why only fake store or yelp work ?

M66B want from me twice donate 10€ for standalone version. But i buy pro in play store.
[Xposed General] M66B:
It is not that I want it twice, but Google doesn't allow using purchases outside of the Play store. This is being explained in the email you've got too. I am not going to risk my Google developer account for this.
[Xposed General] goofwear:
Can you please add the option for root inside of the virtual exposed
[Xposed General] AndroBuddy007:
Sure asking something impossible to be done is really funny.

Root requires system level modification so virtual box really can't help here I guess.
[Xposed General] safwan ck:
if anyone got issue regarding the security of this virtual xposed, you can watch this video as it summaries all the issue

https://youtu.be/8Mf0XQlu9Sw

[YOUTUBE]https://youtu.be/8Mf0XQlu9Sw[/YOUTUBE]
[Xposed General] M66B:
Facebook exists for more than five months too, so it must be safe ...

Note that I am not saying that VirtualXposed is safe or not, just that the wrong arguments are being used. Only a serious code audit and verifying that the published APK is built from the published code can tell if VirtualXposed is safe or not.
[Xposed General] safwan ck:
Agree with you.

More than 1000 people already used this virtual xposed and still no issue is found on this.
[Xposed General] M66B:
Millions of people use Facebook and still ...

So, that isn't a good argument either.
[Xposed General] safwan ck:
argument is not good at all. Facebook is another story. If we look this xda also got security problem, only thing is to look how bad is that issue.
[Xposed General] M66B:
My argument is perfectly fine. You simply cannot say if something has a lot of users that it is safe to use. There are lots of examples of this.

As I see it, you are trying to tell that VirtualXposed is safe to use with the wrong arguments. Only a thorough code review can tell if it is safe and nothing else.
[Xposed General] Zerikwan:
That's the real problem here.

Other people only say this is safe without any real proof. And the worst is that some people say this VX is not safe, telling the code that he found is insecure, but then he refuse to reveal what he found.

If you could review the code, please do it for us. Or if you know someone who could do that, we will glad to see it and get the answer of this question.
[Xposed General] M66B:
I am sorry, but I am not going to do this. It would be a huge task, which could not be completed anyway because Xposed is not open source. Before you are going to reference to the Xposed GitHub: beta versions of Xposed are not there.
[Xposed General] weishu:
I agree with your opinions : lots of users != safe
[Xposed General] weishu:
But i am sure that VirtualXposed is safe :) The project is fully open source and free, I have never made any money from it( exclude the 5$ donation), if it is harmful, what am i aiming for?
[Xposed General] M66B:
Open source is not a guarantee that something is safe to use. Making no money could be considered as an extra risk because "what are you aiming for?" then.

As already pointed out the project is not fully open source because the used Xposed version is not open source.

Only a thorough code review by an independent expert can tell if an app is safe to use.
[Xposed General] weishu:
Logically speaking, you are right. But i do not agree with it.

And maybe you have some misunderstandings with VirtualXposed: The source code of VirtualXposed has no relation with Xposed itself, it doesn't denpends on Xposed and doesn't use any code of Xposed, VirtualXposed is fully open source.

The Xposed version used by VirtualXposed (91) is hardcode by me :https://github.com/android-hacker/e...ava/me/weishu/exposed/ExposedBridge.java#L415 (you can change it to anything).

In fact, both Xposed and VirtualXposed can run Xposed modules, they have no relations at all except that.
[Xposed General] M66B:
So, I am right, but I am not?

VirtualXposed is still using Xposed, so if it is safe to use depends also on if it is safe to use Xposed because you cannot use VirtualXposed without Xposed. If you want to write software to autopilot a plane, it is not enough to say the autopilot software is safe because the plane could still crash because of a bug in the operating system the autopilot software is running on.

Anyway, the only relevant thing is that only a code review by an independent expert can tell if VirtualXposed is safe to use or not.
[Xposed General] weishu:
You are right doesn't means i must agree with it.

VirtualXposed doesn't use Xposed, you can use VirtualXposed without Xposed installed on the device.( you can use VirtualXposed and Xposed together of course)
[Xposed General] M66B:
Facts are facts and are not something you agree on or not.

I think this is a bit misleading. You can use VirtualXposed without Xposed installed on your device, but that does not mean you are not using Xposed because Xposed is integrated into VirtualXposed.
[Xposed General] weishu:
I intergrated Xposed Installer to VirtualXposed, but Xposed Installer != Xposed.

The Xposed Installer in VirtualXposed is only used for managing Xposed modules(disable/enable/download modules), you can uninstall it from VirtualXposed if you want, the Installer doesn't affect VirtualXposed. the modified version is also open source: https://github.com/android-hacker/XposedInstaller

Maybe you are right, code review by an independent expert is needed, there are so many misunderstandings.
[Xposed General] M66B:
Can you explain me how/where you hook into functions without Xposed? If you really do, would it be possible to build an alternative Xposed version with it? In my view Xposed is slowly dying because there are only infrequent updates, so an alternative would be welcome.
[Xposed General] weishu:
I write a java method hook library : https://github.com/tiann/epic, it modifies the AOT code generated by Android Runtime(inline hook), this library can hook functions like Xposed( but the implementation is different). but epic only take effect in app's process itself, it can not inject into other app's process.

So i use VirtualApp to run "other apps", in this way, "other apps" run in my process and i can use epic to hook into them.

The implementation of VirtualXposed and Xposed are so different: Xposed modifies the code of libart.so and app_process at compile-time, this can take more control, but it must modify system(by flash ROM or Migisk), VirtualXposed modify the code of methods at runtime-time in app. I think it is difficult to make an alternative of Xposed base on VirtualXposed.

And VirtualXposed is far less mature than Xposed, it is not stable enough now...
[Xposed General] M66B:
I see. epic is epic ;)

Would it be possible to alter an app during making an application?

https://android.googlesource.com/pl...ter/core/java/android/app/LoadedApk.java#1019

I am aware that this would require modifying Android somehow.

Edit: would it be feasible to add x86 support to epic?
[Xposed General] weishu:
Yes, we can modify the LoadedApk and load epic to do Xposed hooks, this needs to modify Android, too. But it is easier than modify libart.so and app_process.

It is feasible to add support for x86, but i am not familiar with x86 assembly :(
[Xposed General] M66B:
How about wrapping an app with a loader? I know VirtualXposed is basically doing this, but the big disadvantage is that you need to launch VirtualXposed first to launch an app. It would be much nicer if we could have wrapped apps on the default launcher.
[Xposed General] weishu:
I fix this by shortcut: you can create a shortcut of apps in VirtualXposed on system's default launcher, when you click the shortcut, it launch the inner app directly, without needing launch VirtualXposed first.

But the wrapper idea is great! It can fix some other issue, such as share and pay: apps outside of VirtualXposed can not call inner apps, we can just make a wrap and keep the same package name of the app, then it can receive original intent. I will try it, thank you!
[Xposed General] M66B:
IMO wrapping apps with a loader would be a huge improvement. No more questions about permissions, full isolation of apps (running apps together in one process is a security risk) and a more native experience (no more VirtualXposed container, 'just' an app to do the wrapping).

Edit: removing the dependency of VirtualApp would be nice because it has a questionable license and it would make reviewing the code a lot easier.
[Xposed General] weishu:
Great idea, it seems perfect. I am trying to implement it, thank you!
[Xposed General] ItzShadowz:
Seems great! Would this mean paid apps e.g. xmessenger privacy premium would work?
[Xposed General] sumitarora2:
But some apps which check for signature verification or google/facebook login will not work?
[Xposed General] weishu:
We can hook it.
[Xposed General] sumitarora2:
Then it's awesome?
[Xposed General] bnwg:
Looking forward to the wrapping with loader version
[Xposed General] M66B:
[MENTION=8994560]weishu[/MENTION] you could unpack an APK, modify the manifest to reference an instrumentation class which could do the 'epic' stuff in Instrumentation.onCreate and repack the APK.

https://android.googlesource.com/pl...ter/core/java/android/app/LoadedApk.java#1057
[Xposed General] akhilkedia94:
Yes, adding an instrumentation class to modify the loader seems like a great idea!

No more messing with MicroG as well! (while microG is great, the majority of apps I have come across tend to not work with it - They always ask me to update to latest Google's Play Services :( ). And VirtualXposed+MicroG does not have the best stability by itself as well - I have noticed frequent crashes.

And while some apps which do signature checks might not work (yes, we can possibly hook the most common way to do signature checks, but it'll be a cat and mouse game), these apps tend be fairly few in my experience. (Mostly restricted to banking/finance related apps.) - And these apps tend to look for Xposed too generally, which virtualXposed does not hide natively. (You can try some xposed modules to hide xposed, but mileage varies.)
[Xposed General] Vivacity:
Sorry guys i'm a little outdated. Never thought this virtual xposed thing would be possible and it looks awesome. However i am getting an error with my banking app after cloning it in virtual xposed. Says safetynet request failed. I installed microG. Just wondering if there is any way to fix this?
[Xposed General] Namnodorel:
microG isn't working well in the recent versions, much less to circumvent SafetyNet. So no hope that you're going to get it fixed here, you gotta wait for microG to be updated for that to happen.
[Xposed General] Vivacity:
[MENTION=7034101]Namnodorel[/MENTION] Thanks for your reply. I'll watch microG closely then.
[Xposed General] weishu:
VirtualXposed supports Android 9.0 now, here is the download link: https://fir.im/2fl4

(Just for test, not release. Do not use it unless you know what you are doing.)