yashsingh1/xdaforums huggingface dataset:
[Xposed Framework Modules] WhoIsJohnGalt1979:
Is it possible to add this apk to the Magisk Deny list? Reason I ask is, its not discoverable through search on that page. Also, if in lsposed one adds Momo and Ruru along with Key attestation which is recommended, the bootloader unlocked message vanishes from Momo but now Zygisk gets identified. Remove this app and Environment is clean in Momo in addition to Bootloader is unlocked. My apologies if I sound silly.

EDIT: "If the app send the certificate to a secure server, you are ****** and this app is useless. Only select apps which check the presence of an unlocked bootloader, never hook Google apps or system framework unless you want to fail Play Integrity checks lol" It was silly of me to ask. Meh.
[Xposed Framework Modules] simonpunk2013:
chiteroman​

Just want to say thank you for your opensource code(y), now I managed to write my own frida script based on your lsposed code to spoof the bootloader locally on my pixel 3a with stock rom. But there is a slightly difference between the momo app and keyattestation app, in keyattestation app, it seems the class of the certificates[] return from 'KeyStore.getCertificateChain' is NOT 'com.android.org.conscrypt.OpenSSLX509Certificate' but 'com.google.android.gms.org.conscrypt.OpenSSLX509Certificate' which seems it is from google play service, and I need to cast the certificate instance to 'com.google.android.gms.org.conscrypt.OpenSSLX509Certificate' so I can hook the

'getExtensionValue' method.

Besides, I tried to build the stock rom, and using overlay to mount the modified conscrypt.jar and framework.jar before starting zygote, I found that only conscrypt.jar works but not framework.jar, and it only works for momo app. So right now I have no idea to find a way to hook the getExtensionValue method for 'com.google.android.gms.org.conscrypt' in my AOSP, any ideas?
[Xposed Framework Modules] chiteroman:
Yep, you must make your super.img partitions read-write and modify it from recovery. You can modify it unpacking the .img or using systemRW script from here link this:

View attachment 5985109

In TWRP after reboot use:

adb shell mount -w -v /system_root

adb push modifiedFramework.jar /system_root/system/framework/framework.jar

adb shell umount -v /system_root

In some roms framework directory is an overlay so you must modify it from recovery, also check group and permission to be the same or system won't boot. Also zipalign to 4 bytes the framework.jar always.

Now you can modify framework.jar and include hooks like mine (POCO X3 Pro MIUI 14.0.3 Indonesian stock rom):

framework.jar

drive.google.com

My source code of es.chiteroman.Hooks:

Hooks.java

drive.google.com

You must implement Pine:

GitHub - canyie/pine: Dynamic java method hook framework on ART. Allowing you to change almost all java methods' behavior dynamically.

Dynamic java method hook framework on ART. Allowing you to change almost all java methods' behavior dynamically. - canyie/pine

github.com

And remember to move libpine.so to /system/lib64 (check your CPU arch)

Now you can hook any class :)
[Xposed Framework Modules] pndwal:
This has (happily) proved to be incorrect.

A user has been running Uber Driver on old Samsung Galaxy A5 (launched with Android 6.01) for some time and has now published newly devised method to make it run on Xiaomi Mi A3 (LV Android 9.0, Android One OS) here:

Key elements were Zygisk on KernelSU running in Magisk, Alpha Magisk or KernelSU and use of Android Faker, xPrivacyLua, and App Manager modding utilities...

Hope it helps Uber Driver modders! 😋 PW
[Xposed Framework Modules] notoriusboi:
thanks a lot for the effort my guy but i dont understand why if the app sends the certificate chain to a server the app is unpassable?
[Xposed Framework Modules] chiteroman:
Yep, if app send certificate to a server the only way is cracking TEE.
[Xposed Framework Modules] Lucky_069:
Does this app works for banking apps like Yono SBI. The app simply crashes, tried hiding with zygisk and HMA. Still the app won't even open. It force crashes. Anyway to know what's crashing the app or bypass it to make the app work on rooted device?
[Xposed Framework Modules] pndwal:
Clue in OP:

... In other words, this module injects fake certificate extension data (ie. root of trust data which is real, but with needed bytes altered) into listed apps (/processes)... It can do this (with root privileges) for "local attestations", ie where calls and verification of certificates are done in the Android framework and not on a server.

This information:

shows that where hardware-backed key pairs are called and verified remotely (requested by a server directly), there is no opportunity for local interception/tampering key values...

As the linked Key Attestation sample readme (for use of a parser to extract the attestation certificate extension data) says:

So although apps can test the certificate and extensions directly on a device, it is safer to run these checks on a separate trusted server. 👀 PW
[Xposed Framework Modules] notoriusboi:
i dont understand how the attestation work exactly and i also dont understand this

the app im working on sends the certificate chain in a post request to the server so there is a way to intercept and modify the cert chain?

and from the code i read the module hooks and modifys system methods to insert the certificate extention data without modifying the target app so if the unmodified target app that does the attestation verification locally verifies and accepts the cert chain why wouldnt the server do as well?
[Xposed Framework Modules] simonpunk2013:
chiteroman

will the PINE hook module be easily detected? I haven't tried it out, but I have tested that I can just let the app to not load the play service package dynamically in framework.jar, so it will just use conscrypt classes instead, but apps require play service class to work may fail. But this looks fine to me already.

BTW, it took me days to just find out that I need to delete '/system/framework/arm', '/system/framework/arm64' and '/system/framework/oat' to make it work after overlaying the framework.jar....
[Xposed Framework Modules] chiteroman:
If the app checks for the presence of Pine package name yes, but you can modify it.
[Xposed Framework Modules] pndwal:
Good questions, and you probably understand the technical/practical side better than my understanding of the theory, which is only based on reading Google docs. 😜

However, I understand that it's not actually the attestation certificate chain the app has that gets modified; it's only the validation data that is intercepted and returned with spoofed extension data replacing the attestation certificate data...

That's why the "server sample" for validating an Android attestation certificate chain outside the Android framework is provided. "This is the recommended best practice, since if the Android device is rooted or otherwise compromised, on-device validation of the attestation may be inaccurate"...

Where 'local attestation' is used to extract the attestation extension data from the attestation certificate and verify (and print) data elements from the attestation extension (ie. done within the Android framework), the tested certificate and extension data cannot be guaranteed/trusted.

https://github.com/google/android-key-attestation/tree/master/server#introduction

A server based setup utilising an ASN.1 parser (eg. from Bouncy Castle) will extract the same attestation certificate extension data, but without risk or interception or manipulation...

Hope it helps...

@chiteroman may be able to add to/clarify this further. 😜 PW
[Xposed Framework Modules] simonpunk2013:
I haven't figured it out how to integrate Pine into the framework, but I managed to put your code into framework.jar, I don't find any impacts on other apps for now but finally I can now bypass local key attestation and pass CTS profile without any runtime code injection, just plain kernel su, overlayfs module and hiding overlayfs in kernel. So I think that's enough for me ATM, gotta take some rest.

And of course, kudos to your code, much appreciated👍
[Xposed Framework Modules] jd.21:
@chiteroman @pndwal i installed this app and activated in lsposed-zygisk also. after reboot app is not showing in home screen or appdrawer. but, in settings>apps>manage apps the app is there. may i know how to open this app and add a shorcut to homescreen?.

system running on miui 14, a13. custom rom and kernel.
[Xposed Framework Modules] pndwal:
Don't think you can... module seems to lack standard 'app'... I just configured it's app list from LSPosed manager... 😜 PW
[Xposed Framework Modules] Hussein95:
I have mi 10t (k30ultra in china region) and tee is broken and I don't know why I only unlocked bootloader and flashed custom miui rom (eu rom) and have L1 certificates but TEE is broken tried to relock bootloader and flashed stock rom but tee still broken and device is not certified in google play store so how can I fix this?
[Xposed Framework Modules] pndwal:
Still locked?... what verdicts do you get with Play Integrity API Checker?... PW
[Xposed Framework Modules] Hussein95:
I had to unlock bootloader and root to make cts pass and google play certified with modules
[Xposed Framework Modules] pndwal:
So what passed with bootloader locked?

😬 PW
[Xposed Framework Modules] chiteroman:
New release!
[Xposed Framework Modules] pndwal:
@Hussein95

Generally this means OEM messed up keymaster implementation in production... However most devices with "broken TEE" (not really) still have deviceIntegrity pass and therefore will be certified for Play Protect...

Seems yours doesn't even pass deviceIntegrity which is generally needed for Play Protect certification, unless you simply needed to clear Google Play Services data...

Most OnePlus devices were broken as described above (did have deviceIntegrity) for several years, but various other devices have broken keymaster too, inc. some from Xiaomi.

Being a Chinese region model, it may be that Xiaomi care less that device doesn't even meet deviceIntegrity as tested by Google Play Services, a key part of GMS (Google proprietary apps and services), as this is not pre-installed or needed on devices used in China region anyway...

In short, it seems unlikely that your modding attempts caused this... Although more broken than most, it seems like that Xiaomi didn't implement or test keymaster properly...

😬 PW
[Xposed Framework Modules] Hussein95:
China region rom doesn't have google play services support btw so anything I can do to restore keymaster?
[Xposed Framework Modules] pndwal:
As I said, this generally means OEM messed up... And I've never heard of post production fixes for this...

I believe even China hardware/firmware should support AVB/key attestation correctly even when Google APIs are not used...

So you could complain/enquire of Xiaomi but doubtful if they can/will help...

Or continue using rooted with root fixes supporting broken keymaster, but when/if banks start enforcing strongIntegrity you would be able to restore that by locking...

There is a slim chance you've messed up /persist as Poco users (notably) experienced, but Symptoms look different to me... You have L1 and other stuff working it seems... Please say if you have issues with SIM, BT, WiFi, seeing IMEI and S/N etc (normally /persist corruption signs, even if stock/locked)...

🙃 PW
[Xposed Framework Modules] Hussein95:
As I said even I locked bootloader still tee broken and can't restore strongintegrity so I will continue using device with root and ignore this bank app cause everything is working good no issues faced.
[Xposed Framework Modules] lordman1135:
hello, can you add UD app please

Uber - Driver: Drive & Deliver - Apps on Google Play

Earn money with the driver & delivery partner app for Uber, UberEats & Postmates

play.google.com
[Xposed Framework Modules] chiteroman:
Uber Driver checks Strong veredict, nothing to do :(
[Xposed Framework Modules] jd.21:
ok, thank you. key attestation app shows bootloader locked after selecting key attestation app in lsposed module.

but, unfortunately still not passing device integrity or even basic integrity.
[Xposed Framework Modules] chiteroman:
Yeah, to pass BASIC and DEVICE you need this or this
[Xposed Framework Modules] jd.21:
anyone or both should be installed at the same time.

coz, i tried these two modules seperately. no success.

if i install safetynet fix then google play services can't be selected in zygisk denylist. it autmatically deselected after every reboot.
[Xposed Framework Modules] chiteroman:
Yeah, thats how the module works xD.
[Xposed Framework Modules] jd.21:
View attachment 6007731

just now, i tried playintegrity 8.5. above result is before insatllation(with google play services selected). below is after installing the module and reboot(google play services automatically deselected).

View attachment 6007739
[Xposed Framework Modules] Johnn78:
What other except from key attestation we should put to spoof bootloader ? For example should we put the system framework or google services so that to pass the Strong Integrity ?
[Xposed Framework Modules] r29:
Hi

I just came across this thread does this work for uber driver app?
[Xposed Framework Modules] chiteroman:
No, Uber Driver requires Strong so you must lock bootloader.
[Xposed Framework Modules] chiteroman:
You can't pass Strong, this module is only for apps checking cert in local attestations.
[Xposed Framework Modules] r29:
!@$#$ UBER lolll is my days of rooting coming to an end ='((((( SAD Times

Appreciate the quick response 👊
[Xposed Framework Modules] Johnn78:
General the Strong Integrity is failed due to only the unlocked bootloader ?
[Xposed Framework Modules] Muzine:
Hey ! What should i do to make this work?

Thanks!!
[Xposed Framework Modules] pndwal:
Detecting Zygisk...

LSPosed Metagisk Magisk WIP native bridge loaded Zygisk built in Alpha fork + latest Shamiko hides it:

View attachment 6011771

Nb. NB-Z may still not be fully baked but seems conflicts are now resolved... Devs hoped it would be ready for official Magisk 27.0... This PR:

Refactor zygisk to use native bridge to inject

Or you can try it in bleeding edge Alpha if you can't wait, warts and all...

Hope bypass helps you to pass Neet entry test & get admission in a medical college in India... 😛 PW
[Xposed Framework Modules] Muzine:
Hey! Thanks!

I got it working with ksu 😃
[Xposed Framework Modules] pndwal:
@chiteroman, FYI:

With KA app selected and this new privately released Key Attestation app from Alpha discussion TG:

View attachment 6019119

I can't see 'Use app generated attest key' option, but I now get:

View attachment 6019160

... Next, if I select 'Skip verify certificate chain' I can get this:

View attachment 6019161

... I can no longer get 'Bootloader Unlocked' without 'Certificate not trusted' notice... PW
[Xposed Framework Modules] simonpunk2013:
any links for the new apk?
[Xposed Framework Modules] aosp_cat:
Hello, do you know how to hide Momo detection developer mode and adb debugging
[Xposed Framework Modules] HippoMan:
Just want to report that this module works well with the latest Zygisk-based LSPosed under A13 (Nothing 2 device, OS 2.0.3), running Magisk Delta 26.3 . It's successfully preventing at least one "banking" app from detecting unlocked bootloader.

I normally avoid banking apps, but I use one to test mod-and-root-hiding. This partcular banking app I was testing with always used to force-close, but now, with BootloaderSpoofer, this banking app comes up just fine.

By the way, the banking app I'm referring to is the latest version of the app for Sh*ttyBank ... uh, I mean CitiBank.

Good work on BootloaderSpoofer!
[Xposed Framework Modules] spinning_quirK:
I found that v1.1 works but not v1.2 when checking status in Key Attestation app.

1.1 shows locked, 1.2 shows unlocked. Also, 1.2 cannot be directly upgraded over 1.1.

Using latest KSU, ZygiskNext, Lsposed Zygisk and Shamiko.
[Xposed Framework Modules] oslo83:
Could you share v1.1 apk ?

On unlocked huawei with v1.2 it's also not working in Key Attestation app.
[Xposed Framework Modules] HippoMan:
I've been experimenting with this module for the past couple days, and today is the first day I wanted to go to my device's Developer options since I installed this module (not PlayStore Developer options, but system Developer options).

... and I noticed that those Developer options had completely disappeared from my device Settings.

I disabled this module in LSPosed and rebooted, and then the device Developer options returned.

I'm running Android 13 with Magisk Alpha 26401, LSPosed-Zygisk 1.9.2, and @osm0sis' PlayIntegrityFork with a custom pif.json.

Is there any way to run this module on my device with my current Magisk and LSPosed and PlayIntegrityFork configurations where my device Developer options won't disappear?

Thank you in advance.
[Xposed Framework Modules] chiteroman:
v2.0 released!

Release v2.0 · chiteroman/BootloaderSpoofer

Spoof locked bootloader on local attestations. Contribute to chiteroman/BootloaderSpoofer development by creating an account on GitHub.

github.com
[Xposed Framework Modules] HippoMan:
Thank you for this!

The previous version disabled my access to device Developer Options. Will this one do the same?
[Xposed Framework Modules] WhoIsJohnGalt1979:
I have a feeling that was happening cos you were selecting system framework in lsposed. Since it only checks for local attestation only those apps which are looking for local attention if bootloader should be included namely key attestation, momo etc.View attachment 6042709
[Xposed Framework Modules] HippoMan:
Oh, yes, you're correct. I generally select System Framework in LSPosed. I won't do this with the Bootloader Spoofer now.

PS: And yes, without selecting System Framework when installing this module, I indeed still have access to my Developer Options. Thank you!
[Xposed Framework Modules] downhere:
What are the changes?

Is the non-working for OnePlus still effectively?
[Xposed Framework Modules] eXtremeDevil:
Key attestation app reports "Certificate is not trusted" in red but shows bootloader as locked. But momo still recognizes bootloader as unlocked, and of course detects Zygisk if enabled in the module in LSPosed.
[Xposed Framework Modules] deechte:
Any chance this will ever be made to work on Oneplus devices?
[Xposed Framework Modules] chiteroman:
Released v3.2 to fix broken TEE devices and use a valid certificate chain !!!

Release v3.8 · chiteroman/BootloaderSpoofer

Spoof locked bootloader on local attestations. Contribute to chiteroman/BootloaderSpoofer development by creating an account on GitHub.

github.com

One certificate is banned, but if the app doesn't check it in Google servers, you can ignore that error.
[Xposed Framework Modules] jons99:
asus zenfone 9

View attachment 6045078
[Xposed Framework Modules] kodein:
too same problem
[Xposed Framework Modules] Depressed T.Bear:
While 3.0 didn't work, 3.2 does indeed! Never thought that it'd be possible on my TEE broken device! Thank you very much (I know, it's not for ever) :)

View attachment 6045101
[Xposed Framework Modules] chiteroman:
Click on three dots and untick attest device ids
[Xposed Framework Modules] jons99:
I get this without your xposed module

and the second with your module

View attachment 6045323
[Xposed Framework Modules] chiteroman:
Your phone has the keymaster compiled as debug. I recommend to remove the model, Google can blacklist the certificate.
[Xposed Framework Modules] kevinco1:
Any hope of this ever working for OnePlus devices with broken tee?
[Vivo X80 Pro] ferasoss:
Hello there,

I've tried converting Chinese to Global firmware Vivo X80 pro (unlocked bootloader and rooted) and ends up with completely dead bricked after flashing all files on fastboot it's rebooted on a black screen and never went on again!

Can't boot into fastboot mode neither recovery but its can connect to pc via USB-C which is USB-3.1 only! My pc recognize it as "USB root hub" so what does that mean? Please if there is any solution to consider?

Best regards
[Vivo X80 Pro] xXx yYy:
The function of the USB root hub

The USB root hub sits directly on the mainboard of a PC and consists of a control chip that controls the USB ports on the mainboard.

Depending on the design of the mainboard, there can be several USB root hubs. There are several USB ports on each mainboard, which are either accessible at the back of the computer or are internal to the PC on the mainboard as plug-in connections. These internal connections are usually led via a corresponding cable to the USB ports, which are accessible from the front of the PC case.

The USB root hub(s) are responsible for controlling all USB ports present on the PC. A maximum of 127 USB devices can be connected and managed per USB root hub. In order to be able to connect so many devices to the PC, external USB hubs are usually used, which work more or less as distributors.
[Vivo X80 Pro] morpheus620:
why do you do something like this without reading beforehand?

You can't flash to the global version. If you're lucky, your Vivo is now a brick.
[OnePlus Nord ROMs, Kernels, Recoveries, & Other De] Sreeshankar K:
- UNIFIED FBE BUILD -

THIS RECOVERY

SUPPORTS BOTH FBEv1 & FBEv2 ROMS
​

Requirements to flash this recovery

• Basic ADB & fastboot knowledge

• Unlocked bootloader

• Platform tools

Flashing Instructions

• Download the recovery zip file on your PC

• Download and extract latest platform tools

• Extract the recovery.img file from the zip file to the platform tools folder

Using fastboot method:

• Reboot the device into fastboot/bootloader mode

• Open CMD/Terminal in the platform tools folder

• For booting only, use this command:

fastboot boot recovery.img

• For flashing, use this command:

fastboot flash recovery recovery.img

Using ADB sideload method:

• Reboot to existing AOSP/Custom Recovery

• Enable ADB sideload feature

• Copy the recovery zip file to platform tools folder

• Open CMD/Terminal in the platform tools folder

• Use this command:

adb sideload OrangeFox-R11.1_4-Unofficial-avicii.zip

DOWNLOAD

Telegram Support Group

If you like my hardwork please support me by donating

UPI : sreeshankark@axl

PayPal
​

Maintainer: Sreeshankar K

Recovery Source: https://gitlab.com/OrangeFox

Device Tree: https://github.com/Sanju0910/orangefox_device_oneplus_avicii

Kernel Source: Prebuilt kernel from OOS12 AC2003_11_F.19

Credits:

• The TeamWin team - for the TeamWin Recovery Project

• The OrangeFox Team - for the OrangeFox Recovery Project

• AndroiableDroid - for the Unified FBE implementation
[OnePlus Nord ROMs, Kernels, Recoveries, & Other De] Anto426:
thanks
[OnePlus Nord ROMs, Kernels, Recoveries, & Other De] TheSSJ:
So this means i can simply flash this on recovery partition although I'm running stock OOS12 and it will boot into Orangefox?
[OnePlus Nord ROMs, Kernels, Recoveries, & Other De] Sreeshankar K:
Yes. I own OnePlus Nord (avicii) and I tested it. So trust me🙂.
[OnePlus Nord ROMs, Kernels, Recoveries, & Other De] Doc Sniper:
This recovery (OrangeFox-R11.1_4-Unofficial-avicii.zip) recognizes that I have LineageOS 20 installed and that the data partition is encrypted, but unfortunately does not offer me the decryption dialog.

When I try to decrypt the data partition from the menu, I get a password dialog but no swipe pattern.
[OnePlus Nord ROMs, Kernels, Recoveries, & Other De] Sreeshankar K:
Not recovery issue. I already told this to the LineageOS maintainer. He NVM it. LineageOS issue. Contact your LineageOS maintainer.

Tell him to fix it. Nothing to do from my side.

OOS12 decryption works without any issues. OOS12 is also FBEv1 rom.

android_device_oneplus_avicii/vendor.prop at lineage-20 · LineageOS/android_device_oneplus_avicii

Contribute to LineageOS/android_device_oneplus_avicii development by creating an account on GitHub.

github.com

android_device_oneplus_avicii/vendor.prop at lineage-20 · LineageOS/android_device_oneplus_avicii

Contribute to LineageOS/android_device_oneplus_avicii development by creating an account on GitHub.

github.com