[APP][XPOSED][6.0+] XPrivacyLua - Android privacy manager

Search This thread

frituurvet

Member
Sep 13, 2021
6
0
Hey guise,

The XPrivacyLua Pro companion app keeps crashing whenever I tap challenge. I paid the >5 to activate but it won't let me. Any ideas?
 

Jhon_Locke

Senior Member
May 16, 2015
95
8
It's the app working well in Android 12? I've blocked everything to a delivery app named Rappi and only allowed location access but somehow it was able to know what kind of phone I have, isn't that supposed to be blocked by the app?
The app sent me this via e-mail:
Dispositivo: Mi A3 Build/SQ3A.220705.004

Same thing with Google Maps, I have blocked everything but location and tracking and the app was able to detect my account
 
Last edited:

VD171

Senior Member
Jun 21, 2012
2,818
2
2,077
127.0.0.1
LG K10
Samsung Galaxy J7
It's the app working well in Android 12? I've blocked everything to a delivery app named Rappi and only allowed location access but somehow it was able to know what kind of phone I have, isn't that supposed to be blocked by the app?
The app sent me this via e-mail:
Dispositivo: Mi A3 Build/SQ3A.220705.004
That looks like: Build.MODEL / Build.DISPLAY.
Group: "Use Tracking".
 
  • Like
Reactions: Jhon_Locke

VD171

Senior Member
Jun 21, 2012
2,818
2
2,077
127.0.0.1
LG K10
Samsung Galaxy J7
What about GMaps getting my account ([email protected])?
You can hide the name (email) of accounts recorded on the device.
But you can't disallow apps from reading their login credentials, it's not same of "Read Account".
The app is just reading the credentials of a previously registered account and not requesting details from the system.
 
Last edited:
  • Like
Reactions: Jhon_Locke

Jhon_Locke

Senior Member
May 16, 2015
95
8
You can hide the name (email) of accounts recorded on the device.
But you can't disallow apps from reading their login credentials, it's not same of "Read Account".
The app is just reading the credentials of a previously registered account and not requesting details from the system.
Thanks for the help.

This is new in Android 12? Because previously (like yesterday) I have been using Android 10 and this didn't happen, Maps was only detecting the fake account I set up in XPrivacyLua (it was something like [email protected]) and not my account. I'm using and always used MicroG, if that's important.
 

VD171

Senior Member
Jun 21, 2012
2,818
2
2,077
127.0.0.1
LG K10
Samsung Galaxy J7
Thanks for the help.

This is new in Android 12? Because previously (like yesterday) I have been using Android 10 and this didn't happen, Maps was only detecting the fake account I set up in XPrivacyLua (it was something like [email protected]) and not my account. I'm using and always used MicroG, if that's important.
Credentials for google apps are given by google framework services.
So, if you are using microg, you can possible fake your google account, I don't know, I'm not sure.
XPrivacyLua can't fake login credentials for google apps.
 

EngineerMind

Senior Member
May 5, 2007
719
187
I know I can fake the GPS location for many apps using XPLUA , but one app (the official McDonalds app) is causing trouble.

1) The app constantly checks to see if "Location" is enabled on the device, and it will complain when it is off and I need to turn it on to continue with seeing the "Deals" menu. The split second I turn it on, it allows me to view the deals menu.

2) So I though issue #1 above is not a big deal because even if I enable location, XPLUA will send the app the fake address I specify. But since I disabled "Use wifi/bluetooth to assist location finding" in the android settings, it now takes the device a few minutes to determine my position because it needs to lock in enough satellites (because it can't use wifi/bluetooth).

Not only is this delay a hassle, it seems that the fake GPS location won't be sent to the app until AFTER the phone locks into those satellites. My theory is that when apps want to know the device's location, they somehow register to the device this desire, then wait for android to broadcast an intent (event) with the location data when the device knows it's location

So, is it possible to do these things in XPLUA:

1) Let an app think that the android "Location" is turned on when it is really not enabled.
2) Simulate and send a fake location broadcast intent right away and send the fake gps location to an app even before the device has locked into the satellites.

#1 would benefit privacy because even though I can use XPLUA to send an app a fake location, by enabling "location", then android itself will know my location, which is not preferred.

Any help would be greatly appreciated :)
 

VD171

Senior Member
Jun 21, 2012
2,818
2
2,077
127.0.0.1
LG K10
Samsung Galaxy J7
Is it possible to:

1) Use XPLUA to trick an app into thinking that "Location" is enabled on a device
2) Send a fake GPS location to an app *before* the device is able to lock into it's location using just satellites.

To keep this thread from having a bunch of posts related to this issue, I created another thread and would greatly appreciate any replies to it:

Probably, yes.
First, you need to know which methods for hooking on Android's source.
Here are source codes for android.location.*
 

Top Liked Posts

  • There are no posts matching your filters.
  • 16
    Version 1.33 is available via GitHub now:

    https://github.com/M66B/XPrivacyLua/releases

    Edit: and also via the Xposed repo.
    13
    Version 1.34 is available on GitHub now:

    https://github.com/M66B/XPrivacyLua/releases

    Thanks @VD171 for contributing a number of Android 13 hook definitions.

    The Xposed repo is currently unreachable for me. Maybe it is completely offline now?
    11
    The Xposed repo is currently unreachable for me. Maybe it is completely offline now?
    Xposed repo is unavaiable for me too for a long.
    Since it is hosted by XDA may @Oswald Boelcke tell us why
    Gentlemen, I think I owe you a response. I approach our Forum Administrator @MikeChannon with this question and the information I've received is that it is no longer available and is no longer being developed. I'm convinced you're also aware that SRD @rovo89 who owned the repo hasn't been posted for more than 4 1/2 years. I suggest not to rely at all that any file, which was made available for download in that repo in the past, might be available in the future there.

    Personally but XPL is my one and only Xposed module, I download updates from Marcel's Github. Marcel, thanks very much for your continous support and presence.
    10
    Thanks, that's great, also to prevent mistakes, and I am sure other people will be happy with this too!
    Done.
    I've fully updated hooks.json and created a pull:
    9
    I believe this is because `android.app.LoadedApk.makeApplication` works differently on Android 13, which is introduced by this commit.

    ---

    Edit: Let me provide more details. I tried to hook `makeApplicationInner(bool, Instrumentation)`, but it didn't work somehow. Therefore, I looked into the function body and found that the returned `app` is actually created by `android.app.Instrumentation.newApplication`, which is why I made this modification.
    Can you please check if this works too?

    https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/java/eu/faircode/xlua/XLua.java#L242

    Test version:

    https://bitbucket.org/M66B/xlua-companion/downloads/XPrivacyLua-v1.33-134-release.apk
  • 312
    XPrivacyLua

    banner_play_store.png


    Really simple to use privacy manager for Android 6.0 Marshmallow and later (successor of XPrivacy).

    Revoking Android permissions from apps often let apps crash or malfunction. XPrivacyLua solves this by feeding apps fake data instead of real data.

    Features:

    • Simple to use
    • Manage any user or system app
    • Extensible
    • Multi-user support
    • Free and open source

    See here for all details, including installation instructions and download link.

    Please read the frequently asked questions before asking a question.

    This XDA thread is about using the latest version of XPrivacyLua. Off topic comments are allowed as long they are related to XPrivacyLua and are in the general interest of the followers of this thread, but anything not related to privacy is not allowed.

    If XPrivacyLua doesn't work and/or when "module not running or updated" is shown, this is almost always caused by an Xposed problem.

    Discussions about purchases are not allowed here, please contact me via here instead.

    XPrivacyLua is being maintained and community supported, but new features won't be added anymore.

    Custom hook definitions will always be part of XPrivacyLua, but there will be community support only. This means that I won't respond to questions about defining custom hooks anymore. See this thread for the reasons.

    If you value your privacy, please consider to support this project with a donation or by purchasing pro features.


    XPrivacyLua is not a permission manager, but a privacy manager. XPrivacyLua doesn't block things and doesn't revoke permissions, but does replace real data by fake data. This means you can grant Android permissions to an app and still let XPrivacyLua prevent the app from seeing privacy sensitive data. Revoking permissions can result in an app refusing to work and/or to crash. However, replacing real by fake data generally doesn't let an app crash.

    Currently restrictions are quite crude because they mostly replace real data by no data. For example restricting the contacts app from getting contacts will result in an empty contact list. In the near future it might be made possible to select the data an app may see, for example just one group of contacts.

    About feature requests and bug reports:

    The goal is to have a tool that can properly protect the privacy of many in the near future. However, it isn't paid work, so I do whatever I like whenever I like it.

    You can request features in this XDA forum. I will read them, but I will not respond to them and they might or might not be implemented. If I know for sure something will not be implemented, I will let you know.

    You can report any problem you have here. There will be no issue tracker on GitHub.

    For now I have decided to not implement restrictions that are useful to prevent tracking only. There are simply too many data items that can be used for tracking and it would take too much time to develop restrictions for all these data items.

    The basic idea is to restrict only things that 'define' you, so which contacts you have, where you are, which apps you use, etc.

    Maybe we can widen the definition of things that the core of XPL covers to "What defines you, and what can be used to spie on you"? This would include camera/audio, but not tracking.

    XPrivacyLua is pretty feature complete and will be maintained and supported and when there is a need new hook definitions will be added to better protect your privacy. For the rest this FAQ applies:

    https://github.com/M66B/XPrivacyLua/blob/master/FAQ.md#FAQ4

    As said before, development will also depend on Xposed development, which is just minimal unfortunately.

    XDA thanks and donations are appreciated.

    XPrivacyLua is supported with Xposed only. There is no support for VirtualXposed and TaiChi.
    68
    I have just released beta version 0.5 in the Xposed repository.

    The XPrivacyLua framework and user interface seems to be stable enough to call this a beta release.

    Besides several bug fixes and improvements two new restrictions were added:
    • Read account name, which mostly holds your e-mail address and will be replace by '[email protected]' when restricted
    • Read clipboard, which will be replaced by the text 'Private' when restricted

    Furthermore the ability to restrict Android system (be careful!) and to restrict system apps was added. It is possible to restrict all of these individually (XPrivacy could not do that).

    Be sure to take a look at the help page in the app again (use the ?-icon), since there were some useful hints added.

    If you appreciate what I am building here, please let me know by means of an XDA thanks and/or a donation, so that I don't get the feeling 'What am I doing this for?'.
    59
    I have just released alpha version 0.12 in the Xposed repository.

    This version has been redesigned for Android Oreo compatibility. The user interface and the restrictions work properly for me, but be aware that a lot has been changed on the inside ("it is bigger on the inside", lol), also for earlier Android versions. There is one thing I know of that needs improving and that is that the user interface might be updated too often with a lot of restrictions, which might cause delays and hangs. I will look into this tomorrow.

    This change was necessary, but it was a lot of work, so XDA thanks and donations are appreciated.
    56
    I have just released beta version 0.25 in the Xposed repository.

    Changelog:

    With this release XPrivacyLua restriction's can be compared with XPrivacy's. There are now over 100 restriction definitions!

    XDA thanks and donations are appreciated.
    53
    @CHEF-KOCH You have been given enough time to respond here. Now I just think it is pretty cowardly to write critical about XPrivacyLua, but not to tell what can actually be improved, especially because you were invited to do so.

    I still like to hear how XPrivacyLua can be improved, but I don't want to hear what is wrong with XPrivacyLua. You'll need to keep the scope of XPrivacyLua in mind (in short: privacy, not security), see the opening post and previous discussions about this for more information.

    Also, if you really know better, I like to see an original work from your hands to prove that. Actions speak louder than words.

    As it is now, you are discouraging one of the few people in the world who really did something substantial to improve privacy on Android. And don't go talking about VPNs, TOR, etc because your private information, like your contacts, will still leak.

    I also think you are pretty ungrateful for what I did so far.

    To others: if you see someone reference one of his blogs, please reference this comment in response.

    Edit: if you agree with this, please add an XDA thanks to this comment, so it will show up in the right column as a reference for others.