mirror of
https://github.com/chiteroman/PlayIntegrityFix.git
synced 2025-02-08 04:09:48 +08:00
first changes for inject variant
This commit is contained in:
parent
1b3dde79a3
commit
7b2902919c
4
.github/workflows/android.yml
vendored
4
.github/workflows/android.yml
vendored
@ -2,9 +2,9 @@ name: Android CI
|
|||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches: [ "main" ]
|
branches: [ "inject" ]
|
||||||
pull_request:
|
pull_request:
|
||||||
branches: [ "main" ]
|
branches: [ "inject" ]
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
@ -25,8 +25,8 @@ android {
|
|||||||
applicationId = "es.chiteroman.playintegrityfix"
|
applicationId = "es.chiteroman.playintegrityfix"
|
||||||
minSdk = 26
|
minSdk = 26
|
||||||
targetSdk = 35
|
targetSdk = 35
|
||||||
versionCode = 18500
|
versionCode = 1
|
||||||
versionName = "v18.5"
|
versionName = "v1-inject"
|
||||||
multiDexEnabled = false
|
multiDexEnabled = false
|
||||||
|
|
||||||
externalNativeBuild {
|
externalNativeBuild {
|
||||||
@ -114,9 +114,14 @@ tasks.register("copyFiles") {
|
|||||||
|
|
||||||
dexFile.copyTo(moduleFolder.resolve("classes.dex"), overwrite = true)
|
dexFile.copyTo(moduleFolder.resolve("classes.dex"), overwrite = true)
|
||||||
|
|
||||||
soDir.walk().filter { it.isFile && it.extension == "so" }.forEach { soFile ->
|
soDir.walk().filter { it.isFile }.forEach { soFile ->
|
||||||
val abiFolder = soFile.parentFile.name
|
val abiFolder = soFile.parentFile.name
|
||||||
val destination = moduleFolder.resolve("zygisk/$abiFolder.so")
|
var destination = File("")
|
||||||
|
if (soFile.name == "libinject.so") {
|
||||||
|
destination = moduleFolder.resolve("inject/$abiFolder.so")
|
||||||
|
} else if (soFile.name == "libzygisk.so") {
|
||||||
|
destination = moduleFolder.resolve("zygisk/$abiFolder.so")
|
||||||
|
}
|
||||||
soFile.copyTo(destination, overwrite = true)
|
soFile.copyTo(destination, overwrite = true)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -1,13 +1,18 @@
|
|||||||
cmake_minimum_required(VERSION 3.5)
|
cmake_minimum_required(VERSION 3.22.1)
|
||||||
|
|
||||||
project("playintegrityfix")
|
project("playintegrityfix")
|
||||||
|
|
||||||
|
add_library(zygisk SHARED main.cpp)
|
||||||
|
|
||||||
|
add_library(inject SHARED inject.cpp)
|
||||||
|
|
||||||
|
target_link_libraries(zygisk PRIVATE log stdc++)
|
||||||
|
|
||||||
find_package(cxx REQUIRED CONFIG)
|
find_package(cxx REQUIRED CONFIG)
|
||||||
|
|
||||||
link_libraries(cxx::cxx)
|
|
||||||
|
|
||||||
add_library(${CMAKE_PROJECT_NAME} SHARED main.cpp)
|
|
||||||
|
|
||||||
add_subdirectory(Dobby)
|
add_subdirectory(Dobby)
|
||||||
|
|
||||||
target_link_libraries(${CMAKE_PROJECT_NAME} PRIVATE log dobby_static)
|
target_link_libraries(dobby cxx::cxx)
|
||||||
|
target_link_libraries(dobby_static cxx::cxx)
|
||||||
|
|
||||||
|
target_link_libraries(inject PRIVATE log dobby_static)
|
||||||
|
19
app/src/main/cpp/inject.cpp
Normal file
19
app/src/main/cpp/inject.cpp
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
#include <android/log.h>
|
||||||
|
#include <jni.h>
|
||||||
|
#include "json.hpp"
|
||||||
|
#include "dobby.h"
|
||||||
|
|
||||||
|
#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, "PIF", __VA_ARGS__)
|
||||||
|
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, "PIF", __VA_ARGS__)
|
||||||
|
|
||||||
|
static std::string dir;
|
||||||
|
static JNIEnv *env;
|
||||||
|
|
||||||
|
extern "C" [[gnu::visibility("default"), maybe_unused]]
|
||||||
|
void init(char *rawDir, JavaVM *jvm) {
|
||||||
|
dir = rawDir;
|
||||||
|
LOGD("[INJECT] GMS dir: %s", dir.c_str());
|
||||||
|
jvm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6);
|
||||||
|
|
||||||
|
LOGD("[INJECT] Done!");
|
||||||
|
}
|
@ -1,260 +1,234 @@
|
|||||||
#include <android/log.h>
|
#include <android/log.h>
|
||||||
#include <sys/system_properties.h>
|
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
|
#include <errno.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
#include <sys/stat.h>
|
||||||
|
#include <dlfcn.h>
|
||||||
#include "zygisk.hpp"
|
#include "zygisk.hpp"
|
||||||
#include "dobby.h"
|
|
||||||
|
|
||||||
#define JSON_NOEXCEPTION 1
|
|
||||||
#define JSON_NO_IO 1
|
|
||||||
|
|
||||||
#include "json.hpp"
|
|
||||||
|
|
||||||
#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, "PIF", __VA_ARGS__)
|
#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, "PIF", __VA_ARGS__)
|
||||||
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, "PIF", __VA_ARGS__)
|
#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, "PIF", __VA_ARGS__)
|
||||||
|
|
||||||
#define DEX_PATH "/data/adb/modules/playintegrityfix/classes.dex"
|
#define DEX_PATH "/data/adb/modules/playintegrityfix/classes.dex"
|
||||||
|
|
||||||
#define TS_PATH "/data/adb/modules/tricky_store"
|
#define LIB_64 "/data/adb/modules/playintegrityfix/inject/arm64-v8a.so"
|
||||||
|
#define LIB_32 "/data/adb/modules/playintegrityfix/inject/armeabi-v7a.so"
|
||||||
|
|
||||||
#define DEFAULT_JSON "/data/adb/modules/playintegrityfix/pif.json"
|
#define DEFAULT_JSON "/data/adb/modules/playintegrityfix/pif.json"
|
||||||
#define CUSTOM_JSON_FORK "/data/adb/modules/playintegrityfix/custom.pif.json"
|
#define CUSTOM_JSON_FORK "/data/adb/modules/playintegrityfix/custom.pif.json"
|
||||||
#define CUSTOM_JSON "/data/adb/pif.json"
|
#define CUSTOM_JSON "/data/adb/pif.json"
|
||||||
|
|
||||||
static inline ssize_t xread(int fd, void *buffer, size_t count) {
|
#define TS_PATH "/data/adb/modules/tricky_store"
|
||||||
auto *buf = static_cast<char *>(buffer);
|
|
||||||
ssize_t total = 0;
|
|
||||||
|
|
||||||
|
static ssize_t xread(int fd, void *buffer, size_t count) {
|
||||||
|
ssize_t total = 0;
|
||||||
|
char *buf = static_cast<char *>(buffer);
|
||||||
while (count > 0) {
|
while (count > 0) {
|
||||||
ssize_t ret = read(fd, buf, count);
|
ssize_t ret = read(fd, buf, count);
|
||||||
|
if (ret < 0) return -1;
|
||||||
if (ret < 0) {
|
|
||||||
// Retry if interrupted
|
|
||||||
if (errno == EINTR) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
// If 0, we've hit EOF (read no more data)
|
|
||||||
if (ret == 0) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
buf += ret;
|
buf += ret;
|
||||||
total += ret;
|
total += ret;
|
||||||
count -= ret;
|
count -= ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
return total;
|
return total;
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline ssize_t xwrite(int fd, const void *buffer, size_t count) {
|
static ssize_t xwrite(int fd, const void *buffer, size_t count) {
|
||||||
auto *buf = static_cast<const char *>(buffer);
|
|
||||||
ssize_t total = 0;
|
ssize_t total = 0;
|
||||||
|
const char *buf = static_cast<const char *>(buffer);
|
||||||
while (count > 0) {
|
while (count > 0) {
|
||||||
ssize_t ret = write(fd, buf, count);
|
ssize_t ret = write(fd, buf, count);
|
||||||
|
if (ret < 0) return -1;
|
||||||
if (ret < 0) {
|
|
||||||
// Retry if interrupted
|
|
||||||
if (errno == EINTR) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Technically, write returning 0 is unusual (e.g., disk full); handle it if needed
|
|
||||||
if (ret == 0) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
buf += ret;
|
buf += ret;
|
||||||
total += ret;
|
total += ret;
|
||||||
count -= ret;
|
count -= ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
return total;
|
return total;
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool DEBUG = false;
|
static bool copyFile(const char *origin, const char *dest, mode_t perms) {
|
||||||
static std::string DEVICE_INITIAL_SDK_INT, SECURITY_PATCH, BUILD_ID;
|
int fd_in, fd_out;
|
||||||
|
ssize_t bytes_read, bytes_written;
|
||||||
|
char buffer[4096];
|
||||||
|
|
||||||
typedef void (*T_Callback)(void *, const char *, const char *, uint32_t);
|
fd_in = open(origin, O_RDONLY);
|
||||||
|
if (fd_in < 0) {
|
||||||
static T_Callback o_callback = nullptr;
|
|
||||||
|
|
||||||
static void modify_callback(void *cookie, const char *name, const char *value, uint32_t serial) {
|
|
||||||
|
|
||||||
if (!cookie || !name || !value || !o_callback) return;
|
|
||||||
|
|
||||||
const char *oldValue = value;
|
|
||||||
|
|
||||||
std::string_view prop(name);
|
|
||||||
|
|
||||||
if (prop == "init.svc.adbd") {
|
|
||||||
value = "stopped";
|
|
||||||
} else if (prop == "sys.usb.state") {
|
|
||||||
value = "mtp";
|
|
||||||
} else if (prop.ends_with("api_level")) {
|
|
||||||
if (!DEVICE_INITIAL_SDK_INT.empty()) {
|
|
||||||
value = DEVICE_INITIAL_SDK_INT.c_str();
|
|
||||||
}
|
|
||||||
} else if (prop.ends_with(".security_patch")) {
|
|
||||||
if (!SECURITY_PATCH.empty()) {
|
|
||||||
value = SECURITY_PATCH.c_str();
|
|
||||||
}
|
|
||||||
} else if (prop.ends_with(".build.id")) {
|
|
||||||
if (!BUILD_ID.empty()) {
|
|
||||||
value = BUILD_ID.c_str();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (strcmp(oldValue, value) == 0) {
|
|
||||||
if (DEBUG) LOGD("[%s]: %s (unchanged)", name, oldValue);
|
|
||||||
} else {
|
|
||||||
LOGD("[%s]: %s -> %s", name, oldValue, value);
|
|
||||||
}
|
|
||||||
|
|
||||||
return o_callback(cookie, name, value, serial);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void (*o_system_property_read_callback)(prop_info *, T_Callback, void *) = nullptr;
|
|
||||||
|
|
||||||
static void my_system_property_read_callback(prop_info *pi, T_Callback callback, void *cookie) {
|
|
||||||
if (pi && callback && cookie) o_callback = callback;
|
|
||||||
return o_system_property_read_callback(pi, modify_callback, cookie);
|
|
||||||
}
|
|
||||||
|
|
||||||
static bool doHook() {
|
|
||||||
void *ptr = DobbySymbolResolver(nullptr, "__system_property_read_callback");
|
|
||||||
|
|
||||||
if (ptr && DobbyHook(ptr, (void *) my_system_property_read_callback,
|
|
||||||
(void **) &o_system_property_read_callback) == 0) {
|
|
||||||
LOGD("hook __system_property_read_callback successful at %p", ptr);
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
LOGE("hook __system_property_read_callback failed!");
|
|
||||||
return false;
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
fd_out = open(dest, O_WRONLY | O_CREAT | O_TRUNC, perms);
|
||||||
|
if (fd_out < 0) {
|
||||||
|
close(fd_in);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
while ((bytes_read = read(fd_in, buffer, sizeof(buffer))) > 0) {
|
||||||
|
ssize_t total_written = 0;
|
||||||
|
while (total_written < bytes_read) {
|
||||||
|
bytes_written = write(fd_out, buffer + total_written, bytes_read - total_written);
|
||||||
|
if (bytes_written < 0) {
|
||||||
|
close(fd_in);
|
||||||
|
close(fd_out);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
total_written += bytes_written;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bytes_read < 0) {
|
||||||
|
close(fd_in);
|
||||||
|
close(fd_out);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
fchmod(fd_out, perms);
|
||||||
|
|
||||||
|
close(fd_in);
|
||||||
|
close(fd_out);
|
||||||
|
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
static char *concatStr(const char *str1, const char *str2) {
|
||||||
|
size_t len = strlen(str1) + strlen(str2) + 1;
|
||||||
|
|
||||||
|
char *buffer = static_cast<char *>(calloc(len, sizeof(char)));
|
||||||
|
|
||||||
|
strcpy(buffer, str1);
|
||||||
|
|
||||||
|
strcat(buffer, str2);
|
||||||
|
|
||||||
|
return buffer;
|
||||||
|
}
|
||||||
|
|
||||||
|
static void companion(int fd) {
|
||||||
|
size_t len = 0;
|
||||||
|
xread(fd, &len, sizeof(size_t));
|
||||||
|
|
||||||
|
char *dir = static_cast<char *>(calloc(len, sizeof(char)));
|
||||||
|
ssize_t size = xread(fd, dir, len);
|
||||||
|
dir[size] = '\0';
|
||||||
|
|
||||||
|
LOGD("[COMPANION] GMS dir: %s", dir);
|
||||||
|
|
||||||
|
char *libFile = concatStr(dir, "/libinject.so");
|
||||||
|
#if defined(__aarch64__)
|
||||||
|
copyFile(LIB_64, libFile, 0777);
|
||||||
|
#elif defined(__arm__)
|
||||||
|
copyFile(LIB_32, libFile, 0777);
|
||||||
|
#endif
|
||||||
|
free(libFile);
|
||||||
|
|
||||||
|
LOGD("[COMPANION] copied lib");
|
||||||
|
|
||||||
|
char *dexFile = concatStr(dir, "/classes.dex");
|
||||||
|
copyFile(DEX_PATH, dexFile, 0644);
|
||||||
|
free(dexFile);
|
||||||
|
|
||||||
|
LOGD("[COMPANION] copied dex");
|
||||||
|
|
||||||
|
char *jsonFile = concatStr(dir, "/pif.json");
|
||||||
|
if (!copyFile(CUSTOM_JSON, jsonFile, 0777)) {
|
||||||
|
if (!copyFile(CUSTOM_JSON_FORK, jsonFile, 0777)) {
|
||||||
|
copyFile(DEFAULT_JSON, jsonFile, 0777);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
free(jsonFile);
|
||||||
|
|
||||||
|
LOGD("[COMPANION] copied json");
|
||||||
|
|
||||||
|
free(dir);
|
||||||
|
|
||||||
|
bool ok = true;
|
||||||
|
xwrite(fd, &ok, sizeof(bool));
|
||||||
|
|
||||||
|
LOGD("[COMPANION] end");
|
||||||
}
|
}
|
||||||
|
|
||||||
class PlayIntegrityFix : public zygisk::ModuleBase {
|
class PlayIntegrityFix : public zygisk::ModuleBase {
|
||||||
public:
|
public:
|
||||||
void onLoad(zygisk::Api *api, JNIEnv *env) override {
|
void onLoad(zygisk::Api *api_, JNIEnv *env_) override {
|
||||||
this->api = api;
|
this->api = api_;
|
||||||
this->env = env;
|
this->env = env_;
|
||||||
}
|
}
|
||||||
|
|
||||||
void preAppSpecialize(zygisk::AppSpecializeArgs *args) override {
|
void preAppSpecialize(zygisk::AppSpecializeArgs *args) override {
|
||||||
|
|
||||||
if (!args) {
|
|
||||||
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
||||||
return;
|
|
||||||
|
bool isGms = false, isGmsUnstable = false;
|
||||||
|
|
||||||
|
const char *name = env->GetStringUTFChars(args->nice_name, nullptr);
|
||||||
|
|
||||||
|
if (name) {
|
||||||
|
isGmsUnstable = strcmp(name, "com.google.android.gms.unstable") == 0;
|
||||||
|
env->ReleaseStringUTFChars(args->nice_name, name);
|
||||||
}
|
}
|
||||||
|
|
||||||
auto dir = env->GetStringUTFChars(args->app_data_dir, nullptr);
|
const char *dir = env->GetStringUTFChars(args->app_data_dir, nullptr);
|
||||||
|
|
||||||
if (!dir) {
|
if (dir) {
|
||||||
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
isGms = strstr(dir, "/com.google.android.gms") != nullptr;
|
||||||
return;
|
isGmsUnstable &= isGms;
|
||||||
|
if (isGmsUnstable) {
|
||||||
|
targetDir = strdup(dir);
|
||||||
}
|
}
|
||||||
|
|
||||||
bool isGms = std::string_view(dir).ends_with("/com.google.android.gms");
|
|
||||||
|
|
||||||
env->ReleaseStringUTFChars(args->app_data_dir, dir);
|
env->ReleaseStringUTFChars(args->app_data_dir, dir);
|
||||||
|
|
||||||
if (!isGms) {
|
|
||||||
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
|
||||||
return;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!isGms)
|
||||||
|
return;
|
||||||
|
|
||||||
api->setOption(zygisk::FORCE_DENYLIST_UNMOUNT);
|
api->setOption(zygisk::FORCE_DENYLIST_UNMOUNT);
|
||||||
|
|
||||||
auto name = env->GetStringUTFChars(args->nice_name, nullptr);
|
if (!isGmsUnstable)
|
||||||
|
|
||||||
if (!name) {
|
|
||||||
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
|
||||||
return;
|
return;
|
||||||
}
|
|
||||||
|
|
||||||
bool isGmsUnstable = std::string_view(name) == "com.google.android.gms.unstable";
|
|
||||||
|
|
||||||
env->ReleaseStringUTFChars(args->nice_name, name);
|
|
||||||
|
|
||||||
if (!isGmsUnstable) {
|
|
||||||
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
int fd = api->connectCompanion();
|
int fd = api->connectCompanion();
|
||||||
|
|
||||||
size_t dexSize = 0, jsonSize = 0;
|
size_t len = strlen(targetDir) + 1;
|
||||||
std::string jsonStr;
|
xwrite(fd, &len, sizeof(size_t));
|
||||||
|
xwrite(fd, targetDir, len);
|
||||||
|
|
||||||
xread(fd, &dexSize, sizeof(size_t));
|
bool ok = false;
|
||||||
xread(fd, &jsonSize, sizeof(size_t));
|
xread(fd, &ok, sizeof(bool));
|
||||||
|
|
||||||
if (dexSize > 0) {
|
|
||||||
dexVector.resize(dexSize);
|
|
||||||
xread(fd, dexVector.data(), dexSize);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (jsonSize > 0) {
|
|
||||||
jsonStr.resize(jsonSize);
|
|
||||||
jsonSize = xread(fd, jsonStr.data(), jsonSize);
|
|
||||||
jsonStr[jsonSize] = '\0';
|
|
||||||
json = nlohmann::json::parse(jsonStr, nullptr, false, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
bool trickyStore = false;
|
|
||||||
xread(fd, &trickyStore, sizeof(bool));
|
|
||||||
|
|
||||||
bool testSignedRom = false;
|
|
||||||
xread(fd, &testSignedRom, sizeof(bool));
|
|
||||||
|
|
||||||
close(fd);
|
close(fd);
|
||||||
|
|
||||||
LOGD("Dex file size: %ld", dexSize);
|
|
||||||
LOGD("Json file size: %ld", jsonSize);
|
|
||||||
|
|
||||||
parseJSON();
|
|
||||||
|
|
||||||
if (trickyStore) {
|
|
||||||
LOGD("TrickyStore module detected!");
|
|
||||||
spoofProvider = false;
|
|
||||||
spoofProps = false;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (testSignedRom) {
|
|
||||||
LOGD("--- ROM IS SIGNED WITH TEST KEYS ---");
|
|
||||||
spoofSignature = true;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void postAppSpecialize(const zygisk::AppSpecializeArgs *args) override {
|
void postAppSpecialize(const zygisk::AppSpecializeArgs *args) override {
|
||||||
if (dexVector.empty() || json.empty()) return;
|
if (!targetDir) return;
|
||||||
|
|
||||||
UpdateBuildFields();
|
char *lib = concatStr(targetDir, "/libinject.so");
|
||||||
|
void *handle = dlopen(lib, RTLD_NOW);
|
||||||
|
free(lib);
|
||||||
|
|
||||||
if (spoofProvider || spoofSignature) {
|
if (!handle) {
|
||||||
injectDex();
|
LOGE("Error loading lib: %s", dlerror());
|
||||||
} else {
|
free(targetDir);
|
||||||
LOGD("Dex file won't be injected due spoofProvider and spoofSignature are false");
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (spoofProps) {
|
dlerror();
|
||||||
if (!doHook()) {
|
|
||||||
dlclose();
|
void (*init)(char *, JavaVM *);
|
||||||
}
|
*(void **) (&init) = dlsym(handle, "init");
|
||||||
} else {
|
|
||||||
dlclose();
|
const char *error = dlerror();
|
||||||
|
if (error) {
|
||||||
|
LOGE("Error loading symbol: %s", error);
|
||||||
|
dlclose(handle);
|
||||||
|
free(targetDir);
|
||||||
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
json.clear();
|
JavaVM *jvm = nullptr;
|
||||||
dexVector.clear();
|
env->GetJavaVM(&jvm);
|
||||||
dexVector.shrink_to_fit();
|
|
||||||
|
init(targetDir, jvm);
|
||||||
|
|
||||||
|
free(targetDir);
|
||||||
}
|
}
|
||||||
|
|
||||||
void preServerSpecialize(zygisk::ServerSpecializeArgs *args) override {
|
void preServerSpecialize(zygisk::ServerSpecializeArgs *args) override {
|
||||||
@ -264,265 +238,9 @@ public:
|
|||||||
private:
|
private:
|
||||||
zygisk::Api *api = nullptr;
|
zygisk::Api *api = nullptr;
|
||||||
JNIEnv *env = nullptr;
|
JNIEnv *env = nullptr;
|
||||||
std::vector<char> dexVector;
|
char *targetDir = nullptr;
|
||||||
nlohmann::json json;
|
|
||||||
bool spoofProps = true;
|
|
||||||
bool spoofProvider = true;
|
|
||||||
bool spoofSignature = false;
|
|
||||||
|
|
||||||
void dlclose() {
|
|
||||||
LOGD("dlclose zygisk lib");
|
|
||||||
api->setOption(zygisk::DLCLOSE_MODULE_LIBRARY);
|
|
||||||
}
|
|
||||||
|
|
||||||
void parseJSON() {
|
|
||||||
if (json.empty()) return;
|
|
||||||
|
|
||||||
if (json.contains("DEVICE_INITIAL_SDK_INT")) {
|
|
||||||
if (json["DEVICE_INITIAL_SDK_INT"].is_string()) {
|
|
||||||
DEVICE_INITIAL_SDK_INT = json["DEVICE_INITIAL_SDK_INT"].get<std::string>();
|
|
||||||
} else if (json["DEVICE_INITIAL_SDK_INT"].is_number_integer()) {
|
|
||||||
DEVICE_INITIAL_SDK_INT = std::to_string(json["DEVICE_INITIAL_SDK_INT"].get<int>());
|
|
||||||
} else {
|
|
||||||
LOGE("Couldn't parse DEVICE_INITIAL_SDK_INT value!");
|
|
||||||
}
|
|
||||||
json.erase("DEVICE_INITIAL_SDK_INT");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("spoofProvider") && json["spoofProvider"].is_boolean()) {
|
|
||||||
spoofProvider = json["spoofProvider"].get<bool>();
|
|
||||||
json.erase("spoofProvider");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("spoofProps") && json["spoofProps"].is_boolean()) {
|
|
||||||
spoofProps = json["spoofProps"].get<bool>();
|
|
||||||
json.erase("spoofProps");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("spoofSignature") && json["spoofSignature"].is_boolean()) {
|
|
||||||
spoofSignature = json["spoofSignature"].get<bool>();
|
|
||||||
json.erase("spoofSignature");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("DEBUG") && json["DEBUG"].is_boolean()) {
|
|
||||||
DEBUG = json["DEBUG"].get<bool>();
|
|
||||||
json.erase("DEBUG");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("FINGERPRINT") && json["FINGERPRINT"].is_string()) {
|
|
||||||
std::string fingerprint = json["FINGERPRINT"].get<std::string>();
|
|
||||||
|
|
||||||
std::vector<std::string> vector;
|
|
||||||
auto parts = fingerprint | std::views::split('/');
|
|
||||||
|
|
||||||
for (const auto &part: parts) {
|
|
||||||
auto subParts = std::string(part.begin(), part.end()) | std::views::split(':');
|
|
||||||
for (const auto &subPart: subParts) {
|
|
||||||
vector.emplace_back(subPart.begin(), subPart.end());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (vector.size() == 8) {
|
|
||||||
json["BRAND"] = vector[0];
|
|
||||||
json["PRODUCT"] = vector[1];
|
|
||||||
json["DEVICE"] = vector[2];
|
|
||||||
json["RELEASE"] = vector[3];
|
|
||||||
json["ID"] = vector[4];
|
|
||||||
json["INCREMENTAL"] = vector[5];
|
|
||||||
json["TYPE"] = vector[6];
|
|
||||||
json["TAGS"] = vector[7];
|
|
||||||
} else {
|
|
||||||
LOGE("Error parsing fingerprint values!");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("SECURITY_PATCH") && json["SECURITY_PATCH"].is_string()) {
|
|
||||||
SECURITY_PATCH = json["SECURITY_PATCH"].get<std::string>();
|
|
||||||
}
|
|
||||||
|
|
||||||
if (json.contains("ID") && json["ID"].is_string()) {
|
|
||||||
BUILD_ID = json["ID"].get<std::string>();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void injectDex() {
|
|
||||||
LOGD("get system classloader");
|
|
||||||
auto clClass = env->FindClass("java/lang/ClassLoader");
|
|
||||||
auto getSystemClassLoader = env->GetStaticMethodID(clClass, "getSystemClassLoader",
|
|
||||||
"()Ljava/lang/ClassLoader;");
|
|
||||||
auto systemClassLoader = env->CallStaticObjectMethod(clClass, getSystemClassLoader);
|
|
||||||
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionDescribe();
|
|
||||||
env->ExceptionClear();
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
LOGD("create class loader");
|
|
||||||
auto dexClClass = env->FindClass("dalvik/system/InMemoryDexClassLoader");
|
|
||||||
auto dexClInit = env->GetMethodID(dexClClass, "<init>",
|
|
||||||
"(Ljava/nio/ByteBuffer;Ljava/lang/ClassLoader;)V");
|
|
||||||
auto buffer = env->NewDirectByteBuffer(dexVector.data(),
|
|
||||||
static_cast<jlong>(dexVector.size()));
|
|
||||||
auto dexCl = env->NewObject(dexClClass, dexClInit, buffer, systemClassLoader);
|
|
||||||
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionDescribe();
|
|
||||||
env->ExceptionClear();
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
LOGD("load class");
|
|
||||||
auto loadClass = env->GetMethodID(clClass, "loadClass",
|
|
||||||
"(Ljava/lang/String;)Ljava/lang/Class;");
|
|
||||||
auto entryClassName = env->NewStringUTF("es.chiteroman.playintegrityfix.EntryPoint");
|
|
||||||
auto entryClassObj = env->CallObjectMethod(dexCl, loadClass, entryClassName);
|
|
||||||
auto entryPointClass = (jclass) entryClassObj;
|
|
||||||
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionDescribe();
|
|
||||||
env->ExceptionClear();
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
LOGD("call init");
|
|
||||||
auto entryInit = env->GetStaticMethodID(entryPointClass, "init", "(Ljava/lang/String;ZZ)V");
|
|
||||||
auto jsonStr = env->NewStringUTF(json.dump().c_str());
|
|
||||||
env->CallStaticVoidMethod(entryPointClass, entryInit, jsonStr, spoofProvider,
|
|
||||||
spoofSignature);
|
|
||||||
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionDescribe();
|
|
||||||
env->ExceptionClear();
|
|
||||||
}
|
|
||||||
|
|
||||||
env->DeleteLocalRef(entryClassName);
|
|
||||||
env->DeleteLocalRef(entryClassObj);
|
|
||||||
env->DeleteLocalRef(jsonStr);
|
|
||||||
env->DeleteLocalRef(dexCl);
|
|
||||||
env->DeleteLocalRef(buffer);
|
|
||||||
env->DeleteLocalRef(dexClClass);
|
|
||||||
env->DeleteLocalRef(clClass);
|
|
||||||
|
|
||||||
LOGD("jni memory free");
|
|
||||||
}
|
|
||||||
|
|
||||||
void UpdateBuildFields() {
|
|
||||||
jclass buildClass = env->FindClass("android/os/Build");
|
|
||||||
jclass versionClass = env->FindClass("android/os/Build$VERSION");
|
|
||||||
|
|
||||||
for (auto &[key, val]: json.items()) {
|
|
||||||
if (!val.is_string()) continue;
|
|
||||||
|
|
||||||
const char *fieldName = key.c_str();
|
|
||||||
|
|
||||||
jfieldID fieldID = env->GetStaticFieldID(buildClass, fieldName, "Ljava/lang/String;");
|
|
||||||
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionClear();
|
|
||||||
|
|
||||||
fieldID = env->GetStaticFieldID(versionClass, fieldName, "Ljava/lang/String;");
|
|
||||||
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionClear();
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (fieldID != nullptr) {
|
|
||||||
std::string str = val.get<std::string>();
|
|
||||||
const char *value = str.c_str();
|
|
||||||
jstring jValue = env->NewStringUTF(value);
|
|
||||||
|
|
||||||
env->SetStaticObjectField(buildClass, fieldID, jValue);
|
|
||||||
if (env->ExceptionCheck()) {
|
|
||||||
env->ExceptionClear();
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
LOGD("Set '%s' to '%s'", fieldName, value);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
};
|
};
|
||||||
|
|
||||||
static std::vector<char> readFile(const char *path) {
|
|
||||||
FILE *file = fopen(path, "rb");
|
|
||||||
|
|
||||||
if (!file) return {};
|
|
||||||
|
|
||||||
fseek(file, 0, SEEK_END);
|
|
||||||
long size = ftell(file);
|
|
||||||
fseek(file, 0, SEEK_SET);
|
|
||||||
|
|
||||||
std::vector<char> vector(size);
|
|
||||||
fread(vector.data(), 1, size, file);
|
|
||||||
|
|
||||||
fclose(file);
|
|
||||||
|
|
||||||
return vector;
|
|
||||||
}
|
|
||||||
|
|
||||||
static bool checkOtaZip() {
|
|
||||||
std::array<char, 256> buffer{};
|
|
||||||
std::string result;
|
|
||||||
bool found = false;
|
|
||||||
|
|
||||||
std::unique_ptr<FILE, decltype(&pclose)> pipe(
|
|
||||||
popen("unzip -l /system/etc/security/otacerts.zip", "r"), pclose);
|
|
||||||
if (!pipe) return false;
|
|
||||||
|
|
||||||
while (fgets(buffer.data(), buffer.size(), pipe.get()) != nullptr) {
|
|
||||||
result += buffer.data();
|
|
||||||
if (result.find("test") != std::string::npos) {
|
|
||||||
found = true;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return found;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void companion(int fd) {
|
|
||||||
|
|
||||||
std::vector<char> dex, json;
|
|
||||||
|
|
||||||
if (std::filesystem::exists(DEX_PATH)) {
|
|
||||||
dex = readFile(DEX_PATH);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (std::filesystem::exists(CUSTOM_JSON)) {
|
|
||||||
json = readFile(CUSTOM_JSON);
|
|
||||||
} else if (std::filesystem::exists(CUSTOM_JSON_FORK)) {
|
|
||||||
json = readFile(CUSTOM_JSON_FORK);
|
|
||||||
} else if (std::filesystem::exists(DEFAULT_JSON)) {
|
|
||||||
json = readFile(DEFAULT_JSON);
|
|
||||||
}
|
|
||||||
|
|
||||||
size_t dexSize = dex.size();
|
|
||||||
size_t jsonSize = json.size();
|
|
||||||
|
|
||||||
xwrite(fd, &dexSize, sizeof(size_t));
|
|
||||||
xwrite(fd, &jsonSize, sizeof(size_t));
|
|
||||||
|
|
||||||
if (dexSize > 0) {
|
|
||||||
xwrite(fd, dex.data(), dexSize);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (jsonSize > 0) {
|
|
||||||
xwrite(fd, json.data(), jsonSize);
|
|
||||||
}
|
|
||||||
|
|
||||||
std::string ts(TS_PATH);
|
|
||||||
bool trickyStore = std::filesystem::exists(ts) &&
|
|
||||||
!std::filesystem::exists(ts + "/disable") &&
|
|
||||||
!std::filesystem::exists(ts + "/remove");
|
|
||||||
xwrite(fd, &trickyStore, sizeof(bool));
|
|
||||||
|
|
||||||
bool testSignedRom = checkOtaZip();
|
|
||||||
xwrite(fd, &testSignedRom, sizeof(bool));
|
|
||||||
}
|
|
||||||
|
|
||||||
REGISTER_ZYGISK_MODULE(PlayIntegrityFix)
|
REGISTER_ZYGISK_MODULE(PlayIntegrityFix)
|
||||||
|
|
||||||
REGISTER_ZYGISK_COMPANION(companion)
|
REGISTER_ZYGISK_COMPANION(companion)
|
||||||
|
@ -12,6 +12,6 @@ If you download [Play Integrity API Checker](https://play.google.com/store/apps/
|
|||||||
|
|
||||||
If you want to pass new Device verdict you must spoof a valid certificate chain. You can spoof it using [TrickyStore](https://github.com/5ec1cff/TrickyStore) module along PIF (recommended).
|
If you want to pass new Device verdict you must spoof a valid certificate chain. You can spoof it using [TrickyStore](https://github.com/5ec1cff/TrickyStore) module along PIF (recommended).
|
||||||
|
|
||||||
# v18.5
|
# v1
|
||||||
|
|
||||||
- Fix Device verdict not passing on some devices.
|
- Initial release
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
id=playintegrityfix
|
id=playintegrityfix
|
||||||
name=Play Integrity Fix
|
name=Play Integrity Fix
|
||||||
version=v18.5
|
version=v1-inject
|
||||||
versionCode=18500
|
versionCode=1
|
||||||
author=chiteroman
|
author=chiteroman
|
||||||
description=Universal modular fix for Play Integrity (and SafetyNet) on devices running Android 8-15
|
description=Universal modular fix for Play Integrity (and SafetyNet) on devices running Android 8-15
|
||||||
updateJson=https://raw.githubusercontent.com/chiteroman/PlayIntegrityFix/main/update.json
|
updateJson=https://raw.githubusercontent.com/chiteroman/PlayIntegrityFix/main/update.json
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
{
|
{
|
||||||
"version": "v18.5",
|
"version": "v1",
|
||||||
"versionCode": 18500,
|
"versionCode": 1,
|
||||||
"zipUrl": "https://github.com/chiteroman/PlayIntegrityFix/releases/download/v18.5/PlayIntegrityFix_v18.5.zip",
|
"zipUrl": "https://nightly.link/chiteroman/PlayIntegrityFix/workflows/android/inject/PlayIntegrityFix.zip",
|
||||||
"changelog": "https://raw.githubusercontent.com/chiteroman/PlayIntegrityFix/main/changelog.md"
|
"changelog": "https://raw.githubusercontent.com/chiteroman/PlayIntegrityFix/inject/changelog.md"
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user