From 0058de24acd673a1f7eb5ebb0f793bd35d091479 Mon Sep 17 00:00:00 2001 From: LittleTurtle2333 Date: Sun, 2 Oct 2022 17:03:31 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0CorePatch=E8=87=B3=E4=B8=8A?= =?UTF-8?q?=E6=B8=B8=E7=89=88=E6=9C=AC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../activity/SettingsActivity.kt | 2 +- .../simplicitytools/hook/XposedEntry.kt | 4 +- .../simplicitytools/hook/app/Android.kt | 5 +- .../app/android/corepatch/CorePatchForQ.java | 142 ++++++++++++++++++ .../{CorePatch.java => CorePatchForR.java} | 55 +++---- .../app/android/corepatch/CorePatchForS.java | 28 ++++ .../android/corepatch/CorePatchForSv2.java | 4 + .../app/android/corepatch/CorePatchForT.java | 85 +++++++++++ .../android/corepatch/CorePatchMainHook.java | 67 +++++++++ 9 files changed, 353 insertions(+), 39 deletions(-) create mode 100644 app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForQ.java rename app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/{CorePatch.java => CorePatchForR.java} (86%) create mode 100644 app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForS.java create mode 100644 app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForSv2.java create mode 100644 app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForT.java create mode 100644 app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchMainHook.java diff --git a/app/src/main/java/com/lt2333/simplicitytools/activity/SettingsActivity.kt b/app/src/main/java/com/lt2333/simplicitytools/activity/SettingsActivity.kt index 42353191..2af614bd 100644 --- a/app/src/main/java/com/lt2333/simplicitytools/activity/SettingsActivity.kt +++ b/app/src/main/java/com/lt2333/simplicitytools/activity/SettingsActivity.kt @@ -586,7 +586,7 @@ class SettingsActivity : MIUIActivity() { TextWithSwitch(TextV(textId = R.string.hide_zen_icon), SwitchV("hide_zen_icon")) } register("about_module", getString(R.string.about_module), true) { - Author(authorHead = getDrawable(R.drawable.app_icon)!!, authorName = getString(R.string.app_name), authorTips = "${SimpleDateFormat("yyyy-MM-dd HH:mm:ss", Locale.getDefault()).format(BuildConfig.BUILD_TIME.toLong())} ${BuildConfig.VERSION_NAME}(${BuildConfig.BUILD_TYPE})", onClickListener = { + Author(authorHead = getDrawable(R.drawable.app_icon)!!, authorName = getString(R.string.app_name), authorTips = "${SimpleDateFormat("yyyy-MM-dd HH:mm:ss", Locale.getDefault()).format(BuildConfig.BUILD_TIME.toLong())}\n${BuildConfig.VERSION_NAME}(${BuildConfig.BUILD_TYPE})", onClickListener = { try { startActivity(Intent(Intent.ACTION_VIEW, Uri.parse("coolmarket://apk/com.lt2333.simplicitytools"))) Toast.makeText(activity, "恳求一个五星好评，Thanks♪(･ω･)ﾉ", Toast.LENGTH_LONG).show() diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/XposedEntry.kt b/app/src/main/java/com/lt2333/simplicitytools/hook/XposedEntry.kt index 0d96fa66..e01e10a2 100644 --- a/app/src/main/java/com/lt2333/simplicitytools/hook/XposedEntry.kt +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/XposedEntry.kt @@ -2,7 +2,7 @@ package com.lt2333.simplicitytools.hook import com.lt2333.simplicitytools.BuildConfig import com.lt2333.simplicitytools.hook.app.* -import com.lt2333.simplicitytools.hook.app.android.corepatch.CorePatch +import com.lt2333.simplicitytools.hook.app.android.corepatch.CorePatchMainHook import com.lt2333.simplicitytools.util.xposed.EasyXposedInit import com.lt2333.simplicitytools.util.xposed.base.AppRegister import de.robv.android.xposed.IXposedHookZygoteInit @@ -35,7 +35,7 @@ class XposedEntry : EasyXposedInit() { override fun initZygote(startupParam: IXposedHookZygoteInit.StartupParam?) { super.initZygote(startupParam) - CorePatch().initZygote(startupParam) + CorePatchMainHook().initZygote(startupParam) } } \ No newline at end of file diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/Android.kt b/app/src/main/java/com/lt2333/simplicitytools/hook/app/Android.kt index c18fe0c5..a0371d66 100644 --- a/app/src/main/java/com/lt2333/simplicitytools/hook/app/Android.kt +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/Android.kt @@ -1,7 +1,7 @@ package com.lt2333.simplicitytools.hook.app import com.lt2333.simplicitytools.hook.app.android.* -import com.lt2333.simplicitytools.hook.app.android.corepatch.CorePatch +import com.lt2333.simplicitytools.hook.app.android.corepatch.CorePatchMainHook import com.lt2333.simplicitytools.util.xposed.base.AppRegister import de.robv.android.xposed.callbacks.XC_LoadPackage @@ -10,8 +10,7 @@ object Android : AppRegister() { override fun handleLoadPackage(lpparam: XC_LoadPackage.LoadPackageParam) { //核心破解 - CorePatch().handleLoadPackage(lpparam) - + CorePatchMainHook().handleLoadPackage(lpparam) autoInitHooks( lpparam, DisableFlagSecure, //允许截图 diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForQ.java b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForQ.java new file mode 100644 index 00000000..1832b04c --- /dev/null +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForQ.java @@ -0,0 +1,142 @@ +package com.lt2333.simplicitytools.hook.app.android.corepatch; + + +import android.content.pm.ApplicationInfo; +import android.content.pm.Signature; + +import com.lt2333.simplicitytools.BuildConfig; + +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.lang.reflect.InvocationTargetException; + +import de.robv.android.xposed.IXposedHookLoadPackage; +import de.robv.android.xposed.IXposedHookZygoteInit; +import de.robv.android.xposed.XC_MethodHook; +import de.robv.android.xposed.XC_MethodReplacement; +import de.robv.android.xposed.XSharedPreferences; +import de.robv.android.xposed.XposedHelpers; +import de.robv.android.xposed.callbacks.XC_LoadPackage; + +public class CorePatchForQ extends XposedHelper implements IXposedHookLoadPackage, IXposedHookZygoteInit { + XSharedPreferences prefs = new XSharedPreferences(BuildConfig.APPLICATION_ID, "config"); + + @Override + public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws IllegalAccessException, InvocationTargetException, InstantiationException { + // 允许降级 + Class packageClazz = XposedHelpers.findClass("android.content.pm.PackageParser.Package", loadPackageParam.classLoader); + hookAllMethods("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader, "checkDowngrade", new XC_MethodHook() { + public void beforeHookedMethod(MethodHookParam methodHookParam) throws Throwable { + super.beforeHookedMethod(methodHookParam); + if (prefs.getBoolean("downgrade", true)) { + Object packageInfoLite = methodHookParam.args[0]; + + if (prefs.getBoolean("downgrade", true)) { + Field field = packageClazz.getField("mVersionCode"); + field.setAccessible(true); + field.set(packageInfoLite, 0); + field = packageClazz.getField("mVersionCodeMajor"); + field.setAccessible(true); + field.set(packageInfoLite, 0); + } + } + } + }); + + hookAllMethods("android.util.jar.StrictJarVerifier", loadPackageParam.classLoader, "verifyMessageDigest", + new ReturnConstant(prefs, "authcreak", true)); + hookAllMethods("android.util.jar.StrictJarVerifier", loadPackageParam.classLoader, "verify", + new ReturnConstant(prefs, "authcreak", true)); + hookAllMethods("java.security.MessageDigest", loadPackageParam.classLoader, "isEqual", + new ReturnConstant(prefs, "authcreak", true)); + hookAllMethods("com.android.server.pm.PackageManagerServiceUtils", loadPackageParam.classLoader, "verifySignatures", + new ReturnConstant(prefs, "authcreak", false)); + + Class signingDetails = XposedHelpers.findClass("android.content.pm.PackageParser.SigningDetails", loadPackageParam.classLoader); + Constructor findConstructorExact = XposedHelpers.findConstructorExact(signingDetails, Signature[].class, Integer.TYPE); + findConstructorExact.setAccessible(true); + Class packageParserException = XposedHelpers.findClass("android.content.pm.PackageParser.PackageParserException", loadPackageParam.classLoader); + Field error = XposedHelpers.findField(packageParserException, "error"); + error.setAccessible(true); + Object[] signingDetailsArgs = new Object[2]; + signingDetailsArgs[0] = new Signature[]{new Signature(SIGNATURE)}; + signingDetailsArgs[1] = 1; + final Object newInstance = findConstructorExact.newInstance(signingDetailsArgs); + hookAllMethods("android.util.apk.ApkSignatureVerifier", loadPackageParam.classLoader, "verifyV1Signature", new XC_MethodHook() { + public void afterHookedMethod(MethodHookParam methodHookParam) throws Throwable { + super.afterHookedMethod(methodHookParam); + if (prefs.getBoolean("authcreak", true)) { + Throwable throwable = methodHookParam.getThrowable(); + if (throwable != null) { + Throwable cause = throwable.getCause(); + if (throwable.getClass() == packageParserException) { + if (error.getInt(throwable) == -103) { + methodHookParam.setResult(newInstance); + } + } + if (cause != null && cause.getClass() == packageParserException) { + if (error.getInt(cause) == -103) { + methodHookParam.setResult(newInstance); + } + } + } + } + } + }); + + //New package has a different signature + //处理覆盖安装但签名不一致 + hookAllMethods(signingDetails, "checkCapability", new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam param) throws Throwable { + super.beforeHookedMethod(param); + if (prefs.getBoolean("digestCreak", true)) { + if ((Integer) param.args[1] != 4 && prefs.getBoolean("authcreak", true)) { + param.setResult(Boolean.TRUE); + } + } + } + }); + hookAllMethods(signingDetails, "checkCapabilityRecover", + new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam param) throws Throwable { + super.beforeHookedMethod(param); + if (prefs.getBoolean("digestCreak", true)) { + if ((Integer) param.args[1] != 4 && prefs.getBoolean("authcreak", true)) { + param.setResult(Boolean.TRUE); + } + } + } + }); + + // if app is system app, allow to use hidden api, even if app not using a system signature + findAndHookMethod("android.content.pm.ApplicationInfo", loadPackageParam.classLoader, "isPackageWhitelistedForHiddenApis", new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam param) throws Throwable { + super.beforeHookedMethod(param); + if (prefs.getBoolean("digestCreak", true)) { + ApplicationInfo info = (ApplicationInfo) param.thisObject; + if ((info.flags & ApplicationInfo.FLAG_SYSTEM) != 0 + || (info.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0) { + param.setResult(true); + } + } + } + }); + } + + @Override + public void initZygote(StartupParam startupParam) { + hookAllMethods("android.content.pm.PackageParser", null, "getApkSigningVersion", XC_MethodReplacement.returnConstant(1)); + hookAllConstructors("android.util.jar.StrictJarVerifier", new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam param) throws Throwable { + super.beforeHookedMethod(param); + if (prefs.getBoolean("enhancedMode", false)) { + param.args[3] = Boolean.FALSE; + } + } + }); + } +} diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatch.java b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForR.java similarity index 86% rename from app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatch.java rename to app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForR.java index c1ea7ceb..3fd7420e 100644 --- a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatch.java +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForR.java @@ -1,15 +1,12 @@ -/** - * 代码来自 https://github.com/LSPosed/CorePatch - * GPL-2.0 License - **/ - package com.lt2333.simplicitytools.hook.app.android.corepatch; + import android.app.AndroidAppHelper; import android.content.pm.ApplicationInfo; import android.content.pm.PackageInfo; import android.content.pm.PackageManager; import android.content.pm.Signature; +import android.util.Log; import com.lt2333.simplicitytools.BuildConfig; @@ -20,7 +17,6 @@ import java.security.cert.Certificate; import java.security.cert.X509Certificate; import java.util.List; import java.util.Map; -import java.util.Objects; import java.util.zip.ZipEntry; import de.robv.android.xposed.IXposedHookLoadPackage; @@ -32,12 +28,17 @@ import de.robv.android.xposed.XposedBridge; import de.robv.android.xposed.XposedHelpers; import de.robv.android.xposed.callbacks.XC_LoadPackage; -public class CorePatch extends XposedHelper implements IXposedHookLoadPackage, IXposedHookZygoteInit { +public class CorePatchForR extends XposedHelper implements IXposedHookLoadPackage, IXposedHookZygoteInit { XSharedPreferences prefs = new XSharedPreferences(BuildConfig.APPLICATION_ID, "config"); @Override public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws IllegalAccessException, InvocationTargetException, InstantiationException { + Log.d(CorePatchMainHook.TAG, "downgrade" + prefs.getBoolean("downgrade->", true)); + Log.d(CorePatchMainHook.TAG, "authcreak" + prefs.getBoolean("authcreak->", true)); + Log.d(CorePatchMainHook.TAG, "digestCreak" + prefs.getBoolean("digestCreak->", true)); + Log.d(CorePatchMainHook.TAG, "UsePreSig" + prefs.getBoolean("UsePreSig->", false)); + // 允许降级 findAndHookMethod("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader, "checkDowngrade", @@ -113,7 +114,7 @@ public class CorePatch extends XposedHelper implements IXposedHookLoadPackage, I public void afterHookedMethod(MethodHookParam param) throws Throwable { super.afterHookedMethod(param); if (prefs.getBoolean("digestCreak", true)) { - if(!prefs.getBoolean("UsePreSig", false)) { + if (!prefs.getBoolean("UsePreSig", false)) { final Object block = constructor.newInstance(param.args[0]); Object[] infos = (Object[]) XposedHelpers.callMethod(block, "getSignerInfos"); Object info = infos[0]; @@ -131,24 +132,28 @@ public class CorePatch extends XposedHelper implements IXposedHookLoadPackage, I Throwable throwable = methodHookParam.getThrowable(); if (throwable != null) { Signature[] lastSigs = null; - if(prefs.getBoolean("UsePreSig", false)) { + if (prefs.getBoolean("UsePreSig", false)) { PackageManager PM = AndroidAppHelper.currentApplication().getPackageManager(); - if(PM == null){ - XposedBridge.log("E: ${}" + BuildConfig.APPLICATION_ID + " Cannot get the Package Manager... Are you using MiUI?"); - }else { + if (PM == null) { + XposedBridge.log("E: " + BuildConfig.APPLICATION_ID + " Cannot get the Package Manager... Are you using MiUI?"); + } else { PackageInfo pI = PM.getPackageArchiveInfo((String) methodHookParam.args[0], 0); PackageInfo InstpI = PM.getPackageInfo(pI.packageName, PackageManager.GET_SIGNATURES); lastSigs = InstpI.signatures; } - }else { - if(prefs.getBoolean("digestCreak", true)) { + } else { + if (prefs.getBoolean("digestCreak", true)) { final Object origJarFile = constructorExact.newInstance(methodHookParam.args[0], true, false); final ZipEntry manifestEntry = (ZipEntry) XposedHelpers.callMethod(origJarFile, "findEntry", "AndroidManifest.xml"); final Certificate[][] lastCerts = (Certificate[][]) XposedHelpers.callStaticMethod(ASV, "loadCertificates", origJarFile, manifestEntry); lastSigs = (Signature[]) XposedHelpers.callStaticMethod(ASV, "convertToSignatures", (Object) lastCerts); } } - signingDetailsArgs[0] = Objects.requireNonNullElseGet(lastSigs, () -> new Signature[]{new Signature(SIGNATURE)}); + if (lastSigs != null) { + signingDetailsArgs[0] = lastSigs; + } else { + signingDetailsArgs[0] = new Signature[]{new Signature(SIGNATURE)}; + } Object newInstance = findConstructorExact.newInstance(signingDetailsArgs); //修复 java.lang.ClassCastException: Cannot cast android.content.pm.PackageParser$SigningDetails to android.util.apk.ApkSignatureVerifier$SigningDetailsWithDigests @@ -156,7 +161,7 @@ public class CorePatch extends XposedHelper implements IXposedHookLoadPackage, I if (signingDetailsWithDigests != null) { Constructor signingDetailsWithDigestsConstructorExact = XposedHelpers.findConstructorExact(signingDetailsWithDigests, signingDetails, Map.class); signingDetailsWithDigestsConstructorExact.setAccessible(true); - newInstance = signingDetailsWithDigestsConstructorExact.newInstance(newInstance, null); + newInstance = signingDetailsWithDigestsConstructorExact.newInstance(new Object[]{newInstance, null}); } Throwable cause = throwable.getCause(); @@ -203,22 +208,6 @@ public class CorePatch extends XposedHelper implements IXposedHookLoadPackage, I } } }); - if (prefs.getBoolean("digestCreak", true) && prefs.getBoolean("UsePreSig", false)) { - Class pmClass = findClass("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader); - Class pPClass = findClass("com.android.server.pm.parsing.pkg.ParsedPackage", loadPackageParam.classLoader); - XposedHelpers.findAndHookMethod(pmClass, "doesSignatureMatchForPermissions", String.class, pPClass, int.class, new XC_MethodHook() { - @Override - protected void afterHookedMethod(MethodHookParam param) { - //If we decide to crack this then at least make sure they are same apks, avoid another one that tries to impersonate. - if (param.getResult().equals(false)) { - String pPname = (String) XposedHelpers.callMethod(param.args[1], "getPackageName"); - if (pPname.contentEquals((String) param.args[0])) { - param.setResult(true); - } - } - } - }); - } } @Override @@ -235,4 +224,4 @@ public class CorePatch extends XposedHelper implements IXposedHookLoadPackage, I } }); } -} \ No newline at end of file +} diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForS.java b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForS.java new file mode 100644 index 00000000..bbe4ee28 --- /dev/null +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForS.java @@ -0,0 +1,28 @@ +package com.lt2333.simplicitytools.hook.app.android.corepatch; + +import java.lang.reflect.InvocationTargetException; + +import de.robv.android.xposed.XC_MethodHook; +import de.robv.android.xposed.XposedHelpers; +import de.robv.android.xposed.callbacks.XC_LoadPackage; + +public class CorePatchForS extends CorePatchForR { + @Override + public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws IllegalAccessException, InvocationTargetException, InstantiationException { + super.handleLoadPackage(loadPackageParam); + if (prefs.getBoolean("digestCreak", true) && prefs.getBoolean("UsePreSig", false)) { + findAndHookMethod("com.android.server.pm.PackageManagerService", loadPackageParam.classLoader, "doesSignatureMatchForPermissions", String.class, "com.android.server.pm.parsing.pkg.ParsedPackage", int.class, new XC_MethodHook() { + @Override + protected void afterHookedMethod(MethodHookParam param) throws Throwable { + //If we decide to crack this then at least make sure they are same apks, avoid another one that tries to impersonate. + if (param.getResult().equals(false)) { + String pPname = (String) XposedHelpers.callMethod(param.args[1], "getPackageName"); + if (pPname.contentEquals((String) param.args[0])) { + param.setResult(true); + } + } + } + }); + } + } +} diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForSv2.java b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForSv2.java new file mode 100644 index 00000000..e40cca4b --- /dev/null +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForSv2.java @@ -0,0 +1,4 @@ +package com.lt2333.simplicitytools.hook.app.android.corepatch; + +public class CorePatchForSv2 extends CorePatchForS{ +} diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForT.java b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForT.java new file mode 100644 index 00000000..f8cd71d5 --- /dev/null +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchForT.java @@ -0,0 +1,85 @@ +package com.lt2333.simplicitytools.hook.app.android.corepatch; + +import android.util.Log; + +import java.lang.reflect.InvocationTargetException; +import java.lang.reflect.Member; + +import de.robv.android.xposed.XC_MethodHook; +import de.robv.android.xposed.XposedBridge; +import de.robv.android.xposed.XposedHelpers; +import de.robv.android.xposed.callbacks.XC_LoadPackage; + +public class CorePatchForT extends CorePatchForSv2 { + @Override + public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws IllegalAccessException, InvocationTargetException, InstantiationException { + super.handleLoadPackage(loadPackageParam); + + findAndHookMethod("com.android.server.pm.PackageManagerServiceUtils", loadPackageParam.classLoader, + "checkDowngrade", + "com.android.server.pm.parsing.pkg.AndroidPackage", + "android.content.pm.PackageInfoLite", + new ReturnConstant(prefs, "downgrade", null)); + + var utilClass = findClass("com.android.server.pm.PackageManagerServiceUtils", loadPackageParam.classLoader); + Class signingDetails = XposedHelpers.findClass("android.content.pm.SigningDetails", loadPackageParam.classLoader); + //New package has a different signature + //处理覆盖安装但签名不一致 + hookAllMethods(signingDetails, "checkCapability", new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam param) { + // Don't handle PERMISSION (grant SIGNATURE permissions to pkgs with this cert) + // Or applications will have all privileged permissions + // https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/content/pm/PackageParser.java;l=5947?q=CertCapabilities + if (((Integer) param.args[1] != 4) && prefs.getBoolean("digestCreak", true)) { + param.setResult(true); + } + } + }); + + if (utilClass != null) { + for (var m : utilClass.getDeclaredMethods()) { + if ("verifySignatures".equals(m.getName())) { + try { + XposedBridge.class.getDeclaredMethod("deoptimizeMethod", Member.class).invoke(null, m); + } catch (Throwable e) { + Log.e("CorePatch", "deoptimizing failed", e); + } + } + } + } + // Package " + packageName + " signatures do not match previously installed version; ignoring!" + // public boolean checkCapability(String sha256String, @CertCapabilities int flags) { + // public boolean checkCapability(SigningDetails oldDetails, @CertCapabilities int flags) + hookAllMethods("android.content.pm.PackageParser", loadPackageParam.classLoader, "checkCapability", new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam param) { + Log.e("CorePatch", "checkCapability"); + // Don't handle PERMISSION (grant SIGNATURE permissions to pkgs with this cert) + // Or applications will have all privileged permissions + // https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/content/pm/PackageParser.java;l=5947?q=CertCapabilities + if (prefs.getBoolean("authcreak", true)) { + if ((Integer) param.args[1] != 4) { + param.setResult(true); + } + } + } + }); + + + if (prefs.getBoolean("digestCreak", true) && prefs.getBoolean("UsePreSig", false)) { + findAndHookMethod("com.android.server.pm.InstallPackageHelper", loadPackageParam.classLoader, "doesSignatureMatchForPermissions", String.class, "com.android.server.pm.parsing.pkg.ParsedPackage", int.class, new XC_MethodHook() { + @Override + protected void afterHookedMethod(MethodHookParam param) { + //If we decide to crack this then at least make sure they are same apks, avoid another one that tries to impersonate. + if (param.getResult().equals(false)) { + String pPname = (String) XposedHelpers.callMethod(param.args[1], "getPackageName"); + if (pPname.contentEquals((String) param.args[0])) { + param.setResult(true); + } + } + } + }); + } + } +} diff --git a/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchMainHook.java b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchMainHook.java new file mode 100644 index 00000000..2cb4f691 --- /dev/null +++ b/app/src/main/java/com/lt2333/simplicitytools/hook/app/android/corepatch/CorePatchMainHook.java @@ -0,0 +1,67 @@ +package com.lt2333.simplicitytools.hook.app.android.corepatch; + +import android.os.Build; +import android.util.Log; + +import de.robv.android.xposed.IXposedHookLoadPackage; +import de.robv.android.xposed.IXposedHookZygoteInit; +import de.robv.android.xposed.XposedBridge; +import de.robv.android.xposed.callbacks.XC_LoadPackage; + +public class CorePatchMainHook implements IXposedHookLoadPackage, IXposedHookZygoteInit { + public static final String TAG = "WooBox: CorePatch"; + + @Override + public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable { + if (("android".equals(lpparam.packageName)) && (lpparam.processName.equals("android"))) { + Log.d(TAG, "Current sdk version " + Build.VERSION.SDK_INT); + switch (Build.VERSION.SDK_INT) { + case Build.VERSION_CODES.TIRAMISU: // 33 + new CorePatchForT().handleLoadPackage(lpparam); + break; + case Build.VERSION_CODES.S_V2: // 32 + new CorePatchForSv2().handleLoadPackage(lpparam); + break; + case Build.VERSION_CODES.S: // 31 + new CorePatchForS().handleLoadPackage(lpparam); + break; + case Build.VERSION_CODES.R: // 30 + new CorePatchForR().handleLoadPackage(lpparam); + break; + case Build.VERSION_CODES.Q: // 29 + new CorePatchForQ().handleLoadPackage(lpparam); + break; + default: + XposedBridge.log(TAG + ": Warning: Unsupported Version of Android " + Build.VERSION.SDK_INT); + break; + } + } + } + + @Override + public void initZygote(StartupParam startupParam) throws Throwable { + if (startupParam.startsSystemServer) { + Log.d(TAG, "Current sdk version " + Build.VERSION.SDK_INT); + switch (Build.VERSION.SDK_INT) { + case Build.VERSION_CODES.TIRAMISU: // 33 + new CorePatchForT().initZygote(startupParam); + break; + case Build.VERSION_CODES.S_V2: // 32 + new CorePatchForSv2().initZygote(startupParam); + break; + case Build.VERSION_CODES.S: // 31 + new CorePatchForS().initZygote(startupParam); + break; + case Build.VERSION_CODES.R: // 30 + new CorePatchForR().initZygote(startupParam); + break; + case Build.VERSION_CODES.Q: // 29 + new CorePatchForQ().initZygote(startupParam); + break; + default: + XposedBridge.log(TAG + ": Warning: Unsupported Version of Android " + Build.VERSION.SDK_INT); + break; + } + } + } +}