• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[APP][XPOSED][6.0+] Use Xposed without developing a module

Status
Not open for further replies.
Search This thread

arianat01

Senior Member
Feb 16, 2015
148
64
I'm not sure if it's even going to be possible to do randomization for my hooks the same way that XPL Pro does randomization (at boot).
Which hooks would you think require randomization?
Hi
Is there any simple way to add all hosts/domains to blacklist by your hook?

Sent from my HTC U11 using Tapatalk
 

Fif_

Senior Member
Jun 5, 2013
1,152
1,211
Google Nexus 10
Google Nexus 4
  • Like
Reactions: arianat01

arianat01

Senior Member
Feb 16, 2015
148
64
It uses suffix search, so "just" add all the top-level domains:
com net org arpa ar az ...
Unfortunately, there's now 1500 of them: https://en.m.wikipedia.org/wiki/List_of_Internet_top-level_domains
Why don't you use AfWall or Netguard instead?
You could also flip the logic in the hook and use a whitelist.
apps like netgaurd can't be used with vpn together. AFWall is good.
How can I flip the logic in the hook and use a whitelist. Need I edit hook and just change all blacklist words to whitelist? Sorry I'm noob
Thank you


Sent from my HTC U11 using Tapatalk
 
Last edited:

Fif_

Senior Member
Jun 5, 2013
1,152
1,211
Google Nexus 10
Google Nexus 4
apps like netgaurd can't be used with vpn together. AFWall is good.
How can I flip the logic in the hook and use a whitelist. Need I edit hook and just change all blacklist words to whitelist? Sorry I'm noob
Thank you
No, it's not like that ;)
11 lines from the end of the lua script, you'll fine a line that says:
Code:
if pass then
Change it to:
Code:
if not pass then
And you should be good to go.
Disclaimer: I haven't tested this, but it should work™.

If there's interest (other users than @arianat01), I could upload a version with a white / blacklist toggle.
 
Last edited:

arianat01

Senior Member
Feb 16, 2015
148
64
No, it's not like that ;)
11 lines from the end of the lua script, you'll fine a line that says:
Code:
if pass then
Change it to:
Code:
if not pass then
And you should be good to go.
Disclaimer: I haven't tested this, but it should work[emoji769].

If there's interest (other users than @arianat01), I could upload a version with a white / blacklist toggle.
It's work in many apps I tested. But didn't work in browsers like chrome and Firefox and Puffin.
works great in other apps. That's important for me. So I don't need to use any firewall any more.
Thank you.

Sent from my HTC U11 using Tapatalk
 

Fif_

Senior Member
Jun 5, 2013
1,152
1,211
Google Nexus 10
Google Nexus 4
No, it's not like that ;)
11 lines from the end of the lua script, you'll fine a line that says:

Change it to:
It's work in many apps I tested. But didn't work in browsers like chrome and Firefox and Puffin.
works great in other apps. That's important for me. So I don't need to use any firewall any more.
Thank you.
The XPL "firewall" doesn't work in the browsers because they likely are using native code and hence are out of reach of Xposed.
Glad to hear the hacked hooks fit your purpose.
 
  • Like
Reactions: arianat01

Fif_

Senior Member
Jun 5, 2013
1,152
1,211
Google Nexus 10
Google Nexus 4
So I've been trying to find a solution to the ActivityRecognitionResult.extractResult hook failure with Maps 10.12.1.
See this post for details.

The stock ActivityRecognitionResult.extractResult fails because for some reason, both com.google.android.gms.location.DetectedActivity and com.google.android.gms.location.ActivityRecognitionResult classes are not visible when running inside Maps, and bindClass fails with java.lang.ClassNotFoundException on either class names.

So I started thinking that we may want to modify ActivityRecognitionResult in-place instead of recreating a new one.
Problem #1: GMS is obfucated. The list of recognized activities is help in a java List, inside ActivityRecognitionResult but the member name is "zze" on my device, which is ProGuard-obfuscated and subject to change at any time.
Okay, no problem, I'll enumerate the members and use the only one that's a List. There I hit:
Problem #2: getClass() doesn't work.

In this code:
Code:
function after(hook, param)
    local result = param:getResult()
    if result == nil then
        return false
    end

    local clsResult = result:getClass()
    log('clsResult = ' .. tostring(clsResult))
    if clsResult == nil then
        log('clsResult is nil')
    end
    log('name = ' .. clsResult:getName())

    return false
end

throws this error:
Code:
03-19 19:13:25.616  4436  4436 I XLua.Xposed: Log com.mani.activitylogger:10177 Privacy.ActivityRecognitionResult.extractResult clsResult = class com.google.android.gms.location.ActivityRecognitionResult (string)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: Exception:
03-19 19:13:25.616  4436  4436 E XLua.Xposed: org.luaj.vm2.LuaError: script:30 attempt to call nil
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaValue.checkmetatag(SourceFile:3365)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaValue.callmt(SourceFile:1997)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaValue.call(SourceFile:1450)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaClosure.execute(SourceFile:366)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaClosure.onInvoke(SourceFile:183)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaClosure.invoke(SourceFile:176)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at org.luaj.vm2.LuaValue.invoke(SourceFile:1789)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at eu.faircode.xlua.XLua$5.execute(SourceFile:491)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at eu.faircode.xlua.XLua$5.afterHookedMethod(SourceFile:457)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:374)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at com.google.android.gms.location.ActivityRecognitionResult.extractResult(<Xposed>)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at com.mani.activitylogger.service.ActivitiesLoggerService.onStartCommand(ActivitiesLoggerService.java:192)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at android.app.ActivityThread.handleServiceArgs(ActivityThread.java:3462)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at android.app.ActivityThread.-wrap21(ActivityThread.java)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1657)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at android.os.Handler.dispatchMessage(Handler.java:102)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at android.os.Looper.loop(Looper.java:154)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at android.app.ActivityThread.main(ActivityThread.java:6334)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at java.lang.reflect.Method.invoke(Native Method)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:886)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:776)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 
03-19 19:13:25.616  4436  4436 E XLua.Xposed: Package:
03-19 19:13:25.616  4436  4436 E XLua.Xposed: com.mani.activitylogger:10177
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 
03-19 19:13:25.616  4436  4436 E XLua.Xposed: Method:
03-19 19:13:25.616  4436  4436 E XLua.Xposed: after public static com.google.android.gms.location.ActivityRecognitionResult com.google.android.gms.location.ActivityRecognitionResult.extractResult(android.content.Intent)
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 
03-19 19:13:25.616  4436  4436 E XLua.Xposed: Arguments:
03-19 19:13:25.616  4436  4436 E XLua.Xposed: 0: Intent { cmp=com.mani.activitylogger/.service.ActivitiesLoggerService (has extras) } (android.content.Intent)

The exception is thrown by clsResult:getName().
Yet, clsResult is not nil, as shown by the log statement just before the exception is thrown.
Calling any member function of clsResult fails with the same error, getDeclaredMembers(), newInstance(), etc.

What's happening here? Can't we call getClass() on a java object and get a usable object?
 

M66B

Recognized Developer
Aug 1, 2010
24,881
51,707
So I've been trying to find a solution to the ActivityRecognitionResult.extractResult hook failure with Maps 10.12.1.
See this post for details.

The stock ActivityRecognitionResult.extractResult fails because for some reason, both com.google.android.gms.location.DetectedActivity and com.google.android.gms.location.ActivityRecognitionResult classes are not visible when running inside Maps, and bindClass fails with java.lang.ClassNotFoundException on either class names.

So I started thinking that we may want to modify ActivityRecognitionResult in-place instead of recreating a new one.
Problem #1: GMS is obfucated. The list of recognized activities is help in a java List, inside ActivityRecognitionResult but the member name is "zze" on my device, which is ProGuard-obfuscated and subject to change at any time.
Okay, no problem, I'll enumerate the members and use the only one that's a List. There I hit:
Problem #2: getClass() doesn't work.

In this code:


throws this error:


The exception is thrown by clsResult:getName().
Yet, clsResult is not nil, as shown by the log statement just before the exception is thrown.
Calling any member function of clsResult fails with the same error, getDeclaredMembers(), newInstance(), etc.

What's happening here? Can't we call getClass() on a java object and get a usable object?
You are getting this error because Lua cannot find the class member. The Lua name/member resolver is rather limited and in fact I have already modified it at several places for this reason. It isn't going to be much better without a big structural change, so unfortunately this is not easy to solve :(

A possible alternative might be to intercept the call to enable activity recognition.
 
  • Like
Reactions: arianat01

Fif_

Senior Member
Jun 5, 2013
1,152
1,211
Google Nexus 10
Google Nexus 4
You are getting this error because Lua cannot find the class member. The Lua name/member resolver is rather limited and in fact I have already modified it at several places for this reason. It isn't going to be much better without a big structural change, so unfortunately this is not easy to solve :(

A possible alternative might be to intercept the call to enable activity recognition.
Ugh, that's disappointing for luaj.

Intercepting the API call to enable activity recognition is likely more disruptive to the app as it will change the system behavior: the regular intent callbacks won't be fired for one.

On another subject, I ran into the TaiChi framework . Yet another Xposed replacement. I haven't tried it.
 

Namnodorel

Senior Member
Oct 26, 2015
379
286
Ugh, that's disappointing for luaj.

Intercepting the API call to enable activity recognition is likely more disruptive to the app as it will change the system behavior: the regular intent callbacks won't be fired for one.

On another subject, I ran into the TaiChi framework . Yet another Xposed replacement. I haven't tried it.
Tai-Chi works by patching APKs in a way that enables Xposed modules to get control of their process. For obvious reasons, this doesn't work on the system, and afaik, it is closed source :/
 

ViRb3

Senior Member
Aug 25, 2014
386
810
Hey, sorry for posting in the wrong thread earlier. I am looking for a way to fake the MAC address returned from getHardwareAddress (a byte array), as your hook simply returns 'nothing', which crashes apps. How could I do this? Thanks.
 

M66B

Recognized Developer
Aug 1, 2010
24,881
51,707
Hey, sorry for posting in the wrong thread earlier. I am looking for a way to fake the MAC address returned from getHardwareAddress (a byte array), as your hook simply returns 'nothing', which crashes apps. How could I do this? Thanks.
First of all the app should not crash because returning nothing is a valid return.

The simplest is to overwrite the existing addresses byte by byte. Alternatively, you can create a new array (using Lua's newInstance), but this is more complicated.
 

ViRb3

Senior Member
Aug 25, 2014
386
810
First of all the app should not crash because returning nothing is a valid return.

The simplest is to overwrite the existing addresses byte by byte. Alternatively, you can create a new array (using Lua's newInstance), but this is more complicated.

For the sake of learning something today I decided to take the latter approach. Here's what I have so far:
Code:
    local byteClass = luajava.bindClass('java.lang.Byte')
    local arrayClass = luajava.bindClass('java.lang.reflect.Array')
    local fake = arrayClass:newInstance(byteClass, 6)
    fake[0]=1
    fake[1]=2
    param:setResult(fake)
    return true
However, the hook does not activate, even though it is enabled. Is the script incorrect?
Thanks!
 

M66B

Recognized Developer
Aug 1, 2010
24,881
51,707
For the sake of learning something today I decided to take the latter approach. Here's what I have so far:

However, the hook does not activate, even though it is enabled. Is the script incorrect?
Thanks!
I don't know if the hook is active because I don't know how you defined it and if you enabled it.

In any case, if there is an error in the script, you'll get a status bar notification with an error message when the hook is executed.

The definition looks okay, but details do matter.
 

ViRb3

Senior Member
Aug 25, 2014
386
810
I don't know if the hook is active because I don't know how you defined it and if you enabled it.

In any case, if there is an error in the script, you'll get a status bar notification with an error message when the hook is executed.

The definition looks okay, but details do matter.

Indeed, there seems to be an error in the status bar. Here's the beginning:
Code:
Exception: org.luaj.vm2.LuaError: script:27 index expected, got userdata value = nil at org.luaj.vm2.LuaVal ue.typeerror(SourceFile: 1073) ...

I discovered that lua arrays start from index 1, but even when changing that the error remains. The error line:
Code:
fake[1]=1

Thanks.
 
Status
Not open for further replies.

Top Liked Posts

  • There are no posts matching your filters.
  • 31
    ic_launcher.png

    XPrivacyLua custom hook definitions

    By using XPrivacyLua you can define Xposed hooks and apply them to any app at run time (so, rebooting your device is not necessary). You can write hook code on your device in Lua, which is quite easy to learn.

    See the documentation about how to define hooks.

    Although XPrivacyLua has 'privacy' in its name, new hooks don't need to be privacy related at all. Disabling the built in privacy related hooks is a matter of selecting another collection of hooks.

    This XDA thread is meant to discuss defining hooks, with the restriction that hook definitions must serve a legally allowed purpose. This XDA thread is not meant to make you a developer, so at least some development experience is expected, which means that you'll need to be able to figure out where to hook yourself and that you'll need to be able to write Lua scripts yourself.


    XDA:DevDB Information
    XPrivacyLua hook definitions, Xposed for all devices (see above for details)

    Contributors
    M66B
    Xposed Package Name:

    Version Information
    Status: Beta

    Created 2018-01-28
    Last Updated 2018-04-01
    14
    The latest version of the companion app supports uploading to and downloading from a hook definitions repository, so if you created a hook definition which might be useful to others, consider to upload it.
    9
    @jawz101 because of this shocking article I looked into the Mixpanel API. Since apps using Mixpanel can send data without using a library, it is better to block Mixpanel using a firewall app. The default block list of NetGuard contains the Mixpanel domain name.
    8
    It is really simple to define new hooks. As another example I have added hooks to prevent tracking by the Mixpanel library:
    https://github.com/M66B/XPrivacyLua/commit/3aadf9a3521f44dd84e43c45711fba5c368960de

    This will be in the next release of XPrivacyLua, but you can import the definitions right now if you want, see attachment.

    View attachment Mixpanel.json.txt
    8
    Version 1.13 of XPrivacyLua and version 0.29 of the companion app support defining hooks for constructors and dynamic hooking in Lua scripts.

    See here for an example of dynamic hooking:
    https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/assets/webview_constructor.lua