[Xposed Framework Modules] Lanchon:
wow all these people asking about 9.17.3... can nobody bother to read?

speaking of the devil...

i was just catching up with last few weeks of messages. i think there are some unanswered questions regarding google services not working.

so i'll try to explain how a few things work:

- apks have (self-signed) signatures and android will refuse to update an apk with another that has a different signature. this protects the app's private data from attackers, such as a malicious apk pretending to be the official one, or the owner of the damn phone who wants to take control of their data stored on this stupid, braindead OS.

- on top of that, android will answer questions to installed apk about the signatures of all installed apks, including self. if you want to patch an app you will have to self sign it, and android acts as a stupid attestator telling everybody on your phone about it, against your will.

for example: if you patch grindr it will have a different signature, so this happens:

- grindr has a Googlopoly Evil Empire's Maps API Key to be able to show maps within the app. grindr pay for the stupid thing when there are totally free alternatives, go figure. they show the map by talking to a goog apk and passing it the key. then the goog spyware asks android for the signature of the requesting app, and if it is not what the empire expects (grindr's) the request is denied. hence: no maps if you patched the app.

- grindr backs up data to the Privacy Pirate empire, again by talking to a goog apk infecting your phone. when the backup is created, this apk records the backup data originator signature (thanks to the OS conspiring against you by attestating this). when a restore is attempted, google will not release the backup to an apk whose signature does not match the stored one at the empire. hence: no backaup restore if you patched the app. google will just not give you this data. under any circumstances. they will show it to you on your account dashboard. you can delete it. but no, you can't get to it. because google thinks it is not your data at all. it's ginder's. or their's. or both. but not yours. you are just the stupid guy that pays for the hardware, the service, and the storage space. denying you this info might go against eurpean law, but AFAIK it hasn't yet been challenged.

- grindr simply asks the stupid OS for its own siganture and see it's unexpected. so, with the help of your OS conspiring against you, it refuses to run. and greatful you should be, because for the time being you are not being banned for that. after all, after trying to sneak past them and failed, who knows, you might just end up paying them instead.

so which are the options for patching:

- you use a rooted OS of course, because android is designed to restrict your freedom and take away your privacy and your money, and does all that well.

- you use a custom runtime that dynamically traps method calls (eg, the various Xposed implementations). the apk is not modified so the orginal signature remains in force, and the native compilation of the apk is just de-optimized where necessary to be able to trap the code dynamically.

- you use a custom ART compiler that patches the code during the install/compilation step. the apk remains untouched but now the native compiled code is patched. but this is static patching and as such is limited to code known when the patch is being applied. it also cannot "hook" methods outside of the apk instead (eg, framework methods), but it can patch the calls to those from the apk; well the calls to those known at static patch time anyway.

- use a static patcher before apk install time, which requires a change of signature, but avoid it being reported. this entails an OS with the famous signature spoofing patch required to run microG (as it needs to pretend to be the Evil Empire). with this patch in the OS, an apk can ask the OS to lie about its signature when attestating about itself to others and self. this is done with a simple manifest entry in the apk stating the signature that has to be reported (say, grindr's) instead of the real apk signature. so maps and backup work again, and grindr itself doesnt know it is patched either.

- if you are not rooted (shame on you, i mean it), then you can run an apk that is a complete android emulator (a rooted one of course), complete with its own Evil Empire services on it, and an Empire Android ID different from that of your real phone. and of course your choice of xposed, grindr mod, grindr, etc, running inside it.

and the lamer option for patching:

- on an unrooted android, use a static patcher before apk install, which requires a change of signature, eg: LSPatch. now i don't know LSPatch (i should take a look some day), but i did my own apk patcher (DexPatcher, which by the way provided the best patched grindr apps ever, for grindr app v1 and v2, including simoultaneous multiple accounts, geolocating everyone, and logging changes of profile text and pics for everyone around all the time... fakes were so so obvious lol. of course i never published those because i didnt want to get in trouble; we didn't know how grindr would react back then. but i did publish the tool i developed for it; so i gave fishing lessons rather than dead fish. i also published the signature spoofing patcher Haystack).

anyway i thought about the problem of adding support to spoof signatures on unrooted phones, but decided against implementing it: if you choose to depend on an unrooted computer ran remotely by third parties, which means you don't care the tiniest bit about your freedom, i shouldn't be asked to save you when suddenly you want your freedom back. if you care for it, trash your phone and buy one with established community support. and yes, when you buy a phone, freedom has to be your no 1 priority, or else you risk losing it. and the stupid banking app? switch banks, they have no bussines telling you who should control your computer. or access the retard bank with the browser instead (use desktop mode for extra retard banks panhandling for app installs). talk to the electronic frontier foundation about suing the bank for denying you service unless you computer is controlled by a partner of theirs (apple and google); you don't pay a cent if they take the case. talk to the EFF about suing the Empire for platformizing anticompetitive practices involving denying services to non-google infected phones. i don't live in the states, i'm not a US citizen, i can't fight your war.

but back to LSPatcher. what does it do? possibly what i thought back then of doing:

- patch all calls to the "get signature" (GS) android api and, if asking for self signature, lie about it (return "it's grindr's, i swear")

- but the apk can use the reflection api to call GS. so instrument all reflection calls as well, and if they are calling GS through reflection, then also lie.

- but they can use the reflect api to call the reflect api to call GS. so also lie when using the reflect api to get to the reflect api: instead of returning the real api, return the stub that lies when necesary or delegates to the real api.

- but they can load DEX bytecode dinamically during runtime. so embed the whole LSPatcher runtime inside the apk just to patch the pieces of code the apk may load dynamically, in case they call GS from them, or in case they call reflection from them, which may then use to chain calls to finally reach GS. (btw @RobbieTechie, you observed ridiculous growth of apk size after LSPatcher... guess what all that code does?)

eventually, once you've gone through the entire huge android runtime, you can patch all code that runs and have nothing escape. and you can do this with a finite patcher program size, given a finite framework size. and then you lie. lie and lie about all the damn GS calls. and finally then patched grindr cannot know it is patched.

but...

LSPatcher cannot do anything about what your malicious unpatched android OS tells the Empire services: maps will see your real signature (no maps), google services framework will see your real signature (no backups). those hoping to use LSPatcher need to accept that these things cannot ever be solved.