This commit is contained in:
chiteroman 2024-01-02 21:57:34 +01:00
parent f49984ec9a
commit 4ea417beff
4 changed files with 57 additions and 43 deletions

View File

@ -11,8 +11,8 @@ android {
applicationId "es.chiteroman.bootloaderspoofer" applicationId "es.chiteroman.bootloaderspoofer"
minSdk 26 minSdk 26
targetSdk 34 targetSdk 34
versionCode 37 versionCode 38
versionName '3.7' versionName '3.8'
} }
buildTypes { buildTypes {

View File

@ -11,8 +11,8 @@
"type": "SINGLE", "type": "SINGLE",
"filters": [], "filters": [],
"attributes": [], "attributes": [],
"versionCode": 37, "versionCode": 38,
"versionName": "3.7", "versionName": "3.8",
"outputFile": "app-release.apk" "outputFile": "app-release.apk"
} }
], ],

View File

@ -1,8 +1,8 @@
package es.chiteroman.bootloaderspoofer; package es.chiteroman.bootloaderspoofer;
import android.app.AndroidAppHelper; import android.app.AndroidAppHelper;
import android.app.Application;
import android.content.Context; import android.content.Context;
import android.content.SharedPreferences;
import android.content.pm.PackageManager; import android.content.pm.PackageManager;
import android.security.keystore.KeyGenParameterSpec; import android.security.keystore.KeyGenParameterSpec;
import android.security.keystore.KeyProperties; import android.security.keystore.KeyProperties;
@ -39,6 +39,8 @@ import org.bouncycastle.util.io.pem.PemReader;
import java.io.StringReader; import java.io.StringReader;
import java.math.BigInteger; import java.math.BigInteger;
import java.security.KeyPair; import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyPairGeneratorSpi;
import java.security.KeyStore; import java.security.KeyStore;
import java.security.KeyStoreSpi; import java.security.KeyStoreSpi;
import java.security.SecureRandom; import java.security.SecureRandom;
@ -50,6 +52,7 @@ import java.util.LinkedList;
import de.robv.android.xposed.IXposedHookLoadPackage; import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook; import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge; import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers; import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage; import de.robv.android.xposed.callbacks.XC_LoadPackage;
@ -537,8 +540,7 @@ public final class Xposed implements IXposedHookLoadPackage {
@Override @Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) { public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) {
PackageManager pm = AndroidAppHelper.currentApplication().getPackageManager(); if (!lpparam.isFirstApplication) return;
SharedPreferences sp = AndroidAppHelper.currentApplication().getSharedPreferences("settings", Context.MODE_PRIVATE);
final var systemFeatureHook = new XC_MethodHook() { final var systemFeatureHook = new XC_MethodHook() {
@Override @Override
@ -554,52 +556,63 @@ public final class Xposed implements IXposedHookLoadPackage {
} }
}; };
XposedHelpers.findAndHookMethod(pm.getClass(), "hasSystemFeature", String.class, systemFeatureHook); try {
XposedHelpers.findAndHookMethod(pm.getClass(), "hasSystemFeature", String.class, int.class, systemFeatureHook); Application app = AndroidAppHelper.currentApplication();
XposedHelpers.findAndHookMethod(sp.getClass(), "getBoolean", String.class, boolean.class, new XC_MethodHook() { Class<?> PackageManagerClass, SharedPreferencesClass;
@Override
protected void beforeHookedMethod(MethodHookParam param) {
String key = (String) param.args[0];
if ("prefer_attest_key".equals(key)) param.setResult(Boolean.FALSE); if (app == null) {
PackageManagerClass = XposedHelpers.findClass("android.app.ApplicationPackageManager", lpparam.classLoader);
SharedPreferencesClass = XposedHelpers.findClass("android.app.SharedPreferencesImpl", lpparam.classLoader);
} else {
PackageManagerClass = app.getPackageManager().getClass();
SharedPreferencesClass = app.getSharedPreferences("settings", Context.MODE_PRIVATE).getClass();
} }
});
XposedHelpers.findAndHookMethod(KeyGenParameterSpec.Builder.class, "setAttestationChallenge", byte[].class, new XC_MethodHook() { XposedHelpers.findAndHookMethod(PackageManagerClass, "hasSystemFeature", String.class, systemFeatureHook);
@Override XposedHelpers.findAndHookMethod(PackageManagerClass, "hasSystemFeature", String.class, int.class, systemFeatureHook);
protected void beforeHookedMethod(MethodHookParam param) {
attestationChallengeBytes = (byte[]) param.args[0];
}
});
XposedHelpers.findAndHookMethod("android.security.keystore2.AndroidKeyStoreKeyPairGeneratorSpi", lpparam.classLoader, "generateKeyPair", new XC_MethodHook() { XposedHelpers.findAndHookMethod(SharedPreferencesClass, "getBoolean", String.class, boolean.class, new XC_MethodHook() {
@Override @Override
protected void afterHookedMethod(MethodHookParam param) { protected void beforeHookedMethod(MethodHookParam param) {
KeyPair kp = null; String key = (String) param.args[0];
try { if ("prefer_attest_key".equals(key)) param.setResult(Boolean.FALSE);
kp = (KeyPair) param.getResultOrThrowable();
} catch (Throwable t) {
XposedBridge.log(t);
} }
});
} catch (Throwable t) {
XposedBridge.log(t);
}
if (kp == null) { try {
XposedHelpers.findAndHookMethod(KeyGenParameterSpec.Builder.class, "setAttestationChallenge", byte[].class, new XC_MethodHook() {
kp = keyPair_EC; @Override
protected void beforeHookedMethod(MethodHookParam param) {
} else { attestationChallengeBytes = (byte[]) param.args[0];
String algorithm = kp.getPrivate().getAlgorithm();
if (KeyProperties.KEY_ALGORITHM_EC.equals(algorithm)) {
kp = keyPair_EC;
} else {
kp = keyPair_RSA;
}
} }
});
} catch (Throwable t) {
XposedBridge.log(t);
}
param.setResult(kp); try {
} KeyPairGeneratorSpi keyPairGeneratorSpi_EC = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore");
}); XposedHelpers.findAndHookMethod(keyPairGeneratorSpi_EC.getClass(), "generateKeyPair", new XC_MethodReplacement() {
@Override
protected Object replaceHookedMethod(MethodHookParam param) {
return keyPair_EC;
}
});
KeyPairGeneratorSpi keyPairGeneratorSpi_RSA = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_RSA, "AndroidKeyStore");
XposedHelpers.findAndHookMethod(keyPairGeneratorSpi_RSA.getClass(), "generateKeyPair", new XC_MethodReplacement() {
@Override
protected Object replaceHookedMethod(MethodHookParam param) {
return keyPair_RSA;
}
});
} catch (Throwable t) {
XposedBridge.log(t);
}
try { try {
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore"); KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");

View File

@ -2,5 +2,6 @@
<resources> <resources>
<string-array name="scope"> <string-array name="scope">
<item>io.github.vvb2060.keyattestation</item> <item>io.github.vvb2060.keyattestation</item>
<item>io.github.vvb2060.mahoshojo</item>
</string-array> </string-array>
</resources> </resources>