[Magisk] changhuapeng:
Framework Patcher GO

Based on chiteroman's FrameworkPatch, this module modifies framework.jar directly on the phone, to build a valid system-level certificate chain.

This module is compatible with Magisk, KernelSU, and APatch.

For more details or to download the latest release, you can check out: https://github.com/changhuapeng/FrameworkPatcherGO

Frequently Asked Questions

Q: What does this module do?

A: To put it simply, chiteroman's FrameworkPatch is a set of patching instructions that helps spoof your device bootloader and fingerprint without the use of Zygisk and Play Integrity Fix. FrameworkPatch will not pass STRONG integrity out of the box, unless you have a leaked OEM keybox that has not been revoked by Google.

On the other hand,

Framework Patcher GO does none of that

.

Framework Patcher GO simplifies the process of implementing FrameworkPatch by taking over decompiling, smali code patching, recompiling, and then reintegrating the patched system file. So you don't have to do it yourself.

If you have the means to follow through the instructions from FrameworkPatch, then Framework Patcher GO is unnecessary for you.

Q: Where do I get the required classes.dex?

A: A pre-compiled classes.dex is available here. This classes.dex is compiled from FrameworkPatch source and contains whatever keybox and fingerprint included there.

If you are using your own keybox or fingerprint, you can head down to FrameworkPatch GitHub page to build a classes.dex file.

Q: The module installation has failed! What should I do?

A: Unfortunately, your device framework probably contains modifications or is incompatible with FrameworkPatch. If you insisted on trying this module, please save the installation log from the root manager app and upload it here along with your device's unmodified framework.jar for troubleshooting.

Q: Where do I get the framework.jar for troubleshooting?

A: You can extract the framework.jar from your device by enabling USB debugging in developer options, connecting your device to your PC and entering this command on your PC terminal:

adb pull /system/framework/framework.jar

The framework.jar will be saved in the directory that you ran the ADB command from.

Spoiler content hidden.

If you do not have ADB set up, please visit this page to learn more.

Q: After installing the module successfully, my device is bootlooping / apps are crashing / system is feeling sluggish. Please help!

A: Issues like these are commonplace when it comes to patching or overlaying system files. The inherent problem about this module is that the patched framework is overlaid so whatever optimisation the system has for the overlaid components are not working and that will sometimes cause unexpected outcomes like system lagginess or crashes.

Clearing device dalvik cache have been observed to sometimes help solve these problems so that is what you should try first. If that does not work, then there's really no solution other than one that needs your system to be read-write.

Q: After installing the module successfully, my device bootloader still shows unlocked / DEVICE integrity is still not passing / SafetyNet is still failing. Why is that?

A: Since FrameworkPatch are developed through reverse engineering Android systems, it cannot possibly support every ROMs make and model out there because that means every build will have to be reversed engineered.

Some users failing DEVICE integrity have reported that installing osm0sis's PlayIntegrityFork in Scripts-only mode helps to pass DEVICE integrity so you can try that out. If you're using Magisk Kitsune, you'll have to add com.google.android.gms.unstable into MagiskHide.

You can also refer to this table for a list of combinations to solve Play Integrity and SafetyNet issues.

If you're still failing DEVICE integrity, then there's a few checks that you will need to perform:

Check your kernel release string following the instructions here

If you're on a custom ROM, check if your ROM build is signed with a production key with command adb shell unzip -l /system/etc/security/otacerts.zip. You should see releasekey.x509.pem and not testkey.x509.pem.

Q: How can I extract keyboxes or fingerprints from my devices?

A: Attestation keyboxes which contains private keys (ECDSA and RSA) and the corresponding certificate chains are provided by Google to their OEM partners and are stored securely. Your best bet to get a valid and unrevoked keybox will be to buy it on the dark web or from an OEM who is willing to leak their keyboxes.

In short, there is no way to extract keybox from your device unless the manufacturer of your device has screwed up big time.

For fingerprints, they are system/build property made up of information about your ROM. You can find out more about fingerprints and its extraction in the PIF FAQ. However, don't keep your hopes high because not all devices or ROM builds are suitable fingerprint "donors".

Q: The module installation failed with some errors about unzip or busybox binaries. What should I do?

A: Please try this module zip that osm0sis has kindly updated and let us know if it fix the errors for you!