。

injects/spoof.js

@@ -18,7 +18,7 @@ const imsi = "255065007246456"
 const countryIso = "ua"
 const subId = ""
 
-const scriptContent = fs
+const source = fs
     .readFileSync(path.resolve(__dirname, "../scripts/spoof.js"))
     .toString()
     .replace("{{mcc}}", mcc)
@@ -33,7 +33,7 @@ const scriptContent = fs
     .replace("{{countryIso}}", countryIso)
     .replace("{{subId}}", subId)
 
-fs.writeFileSync(path.resolve(__dirname, "../scripts/_spoof.js"), scriptContent)
+fs.writeFileSync(path.resolve(__dirname, "../scripts/_spoof.js"), source)
 
 let device = null
 let tracers = []
@@ -116,7 +116,7 @@ class Tracer {
         this.session = session
         session.detached.connect(this._onSessionDetached.bind(this))
 
-        const script = await session.createScript(scriptContent)
+        const script = await session.createScript(source)
         this.script = script
         script.message.connect(this._onScriptMessage.bind(this))
         await script.load()
@@ -133,6 +133,4 @@ class Tracer {
     }
 }
 
-main().catch(e => {
-    console.error(e)
-})
+main() 

injects/spoof_gms.js

@@ -0,0 +1,52 @@
+import frida from "frida"
+import fs from "fs"
+import url from "url"
+import path from "path"
+
+const filePath = url.fileURLToPath(import.meta.url)
+const __dirname = path.dirname(filePath)
+
+const mcc = "255"
+const mnc = "06"
+const simOperator = "25506"
+const networkOperator = "25506"
+const simSerialNumber = "89380062300689131876"
+const iccId = simSerialNumber
+const number = "731848010"
+const imei = "864929043714851"
+const imsi = "255065007246456"
+const countryIso = "ua"
+const subId = ""
+
+const source_gms = fs
+    .readFileSync(path.resolve(__dirname, "../scripts/spoof_gms.js"))
+    .toString()
+    .replace("{{mcc}}", mcc)
+    .replace("{{mnc}}", mnc)
+    .replace("{{simOperator}}", simOperator)
+    .replace("{{networkOperator}}", networkOperator)
+    .replace("{{simSerialNumber}}", simSerialNumber)
+    .replace("{{iccId}}", iccId)
+    .replace("{{number}}", number)
+    .replace("{{imei}}", imei)
+    .replace("{{imsi}}", imsi)
+    .replace("{{countryIso}}", countryIso)
+    .replace("{{subId}}", subId)
+
+let device = null
+
+async function main() {
+    device = await frida.getUsbDevice()
+
+    const processes = await device.enumerateProcesses()
+    for (const process of processes) {
+        if (process.name.startsWith("com.google.android.gms")) {
+            console.log("[*] Attaching to", process.pid, process.name)
+            const session = await device.attach(process.pid)
+            const script = await session.createScript(source_gms)
+            await script.load()
+        }
+    }
+}
+
+main()

scripts/_spoof.js

@@ -212,10 +212,12 @@ Java.perform(function () {
 
         console.log(`str: ${str}, j: ${j}, i: ${i}, i2: ${i2}, str2: ${str2}`)
         // print bundle
-        const entrySet = bundle.entrySet().toArray()
-        for (let i = 0; i < entrySet.length; i++) {
-            const entry = entrySet[i]
-            console.log(`key: ${entry.getKey()}, value: ${entry.getValue()}`)
+        if (bundle) {
+            const keySet = bundle.keySet().toArray()
+            for (let i = 0; i < keySet.length; i++) {
+                const key = keySet[i]
+                console.log(`key: ${key}, value: ${bundle.get(key)}`)
+            }
         }
 
         return this.$init(str, j, i, i2, str2, bundle)
@@ -328,8 +330,6 @@ Java.perform(function () {
 
         console.log("SetAsterismConsentResponse.$init")
         console.log(`i: ${i}, str: ${str}, str2: ${str2}`)
-        return this.$init(i, str, str2)
+        return this.$init(1, 'c4q5zP5Ft4A:APA91bEASr50HwwOY789LSZrcHPT8aG_fT19xlelS35qgIJeC3UBYypAHmmL9IygzlphzTKKz0wCdiQwuoPZMJKvgKPmGi3_imdr1CY0s7fs8qa_LMgNDFfvWEnpTCReAYc7IjThhFQq', 'c4q5zP5Ft4A')
     }
-
-   
 })

scripts/spoof.js

@@ -212,10 +212,12 @@ Java.perform(function () {
 
         console.log(`str: ${str}, j: ${j}, i: ${i}, i2: ${i2}, str2: ${str2}`)
         // print bundle
-        const entrySet = bundle.entrySet().toArray()
-        for (let i = 0; i < entrySet.length; i++) {
-            const entry = entrySet[i]
-            console.log(`key: ${entry.getKey()}, value: ${entry.getValue()}`)
+        if (bundle) {
+            const keySet = bundle.keySet().toArray()
+            for (let i = 0; i < keySet.length; i++) {
+                const key = keySet[i]
+                console.log(`key: ${key}, value: ${bundle.get(key)}`)
+            }
         }
 
         return this.$init(str, j, i, i2, str2, bundle)
@@ -328,8 +330,6 @@ Java.perform(function () {
 
         console.log("SetAsterismConsentResponse.$init")
         console.log(`i: ${i}, str: ${str}, str2: ${str2}`)
-        return this.$init(i, str, str2)
+        return this.$init(1, 'c4q5zP5Ft4A:APA91bEASr50HwwOY789LSZrcHPT8aG_fT19xlelS35qgIJeC3UBYypAHmmL9IygzlphzTKKz0wCdiQwuoPZMJKvgKPmGi3_imdr1CY0s7fs8qa_LMgNDFfvWEnpTCReAYc7IjThhFQq', 'c4q5zP5Ft4A')
     }
-
-   
 })

scripts/spoof_gms.js

@@ -0,0 +1,423 @@
+const mcc = "{{mcc}}"
+const mnc = "{{mnc}}"
+const simOperator = "{{simOperator}}"
+const networkOperator = "{{networkOperator}}"
+const simSerialNumber = "{{simSerialNumber}}"
+const iccId = "{{iccId}}"
+const number = "{{number}}"
+const imei = "{{imei}}"
+const imsi = "{{imsi}}"
+const countryIso = "{{countryIso}}"
+const subId = "{{subId}}"
+function trace() {
+    console.log(
+        Java.use("android.util.Log").getStackTraceString(
+            Java.use("java.lang.Throwable").$new()
+        )
+    )
+}
+Java.perform(function () {
+    const SmsManager = Java.use("android.telephony.SmsManager")
+    SmsManager.getSmsManagerForSubscriptionId.overload("int").implementation =
+        function (i) {
+            const _smsManager = this.getSmsManagerForSubscriptionId(i)
+            console.log(`SmsManager.getSmsManagerForSubscriptionId: ${i}`)
+            return _smsManager
+        }
+
+    SmsManager.getDefault.overload().implementation = function () {
+        const _smsManager = this.getDefault(i)
+        console.log(`SmsManager.getDefault`)
+        return _smsManager
+    }
+
+    SmsManager.getDefaultSmsSubscriptionId.overload().implementation =
+        function () {
+            const _subId = this.getDefaultSmsSubscriptionId()
+            console.log(`SmsManager.getDefaultSmsSubscriptionId: ${_subId}`)
+            return _subId
+        }
+
+    SmsManager.getSubscriptionId.overload().implementation = function () {
+        const _subId = this.getSubscriptionId()
+        console.log(`SmsManager.getSubscriptionId: ${_subId}`)
+        return _subId
+    }
+
+    const SubscriptionInfo = Java.use("android.telephony.SubscriptionInfo")
+    SubscriptionInfo.getMcc.overload().implementation = function () {
+        const _mcc = this.getMcc()
+        console.log(`spoof SubscriptionInfo.getMcc: ${_mcc} -> ${mcc}`)
+        return parseInt(mcc)
+    }
+
+    SubscriptionInfo.getMnc.overload().implementation = function () {
+        const _mnc = this.getMnc()
+        console.log(`spoof SubscriptionInfo.getMnc: ${_mnc} -> ${mnc}`)
+        return parseInt(mnc)
+    }
+
+    SubscriptionInfo.getMccString.overload().implementation = function () {
+        const _mccString = this.getMccString()
+        console.log(
+            `spoof SubscriptionInfo.getMccString: ${_mccString} -> ${mcc}`
+        )
+        return mcc
+    }
+
+    SubscriptionInfo.getMncString.overload().implementation = function () {
+        const _mncString = this.getMncString()
+        console.log(
+            `spoof SubscriptionInfo.getMncString: ${_mncString} -> ${mnc}`
+        )
+        return mnc
+    }
+
+    SubscriptionInfo.getNumber.overload().implementation = function () {
+        const _number = this.getNumber()
+        console.log(`spoof SubscriptionInfo.getNumber: ${_number} -> ${number}`)
+        return number
+    }
+
+    SubscriptionInfo.getIccId.overload().implementation = function () {
+        const _iccId = this.getIccId()
+        console.log(`spoof SubscriptionInfo.getIccId: ${_iccId} -> ${iccId}`)
+        return iccId
+    }
+
+    SubscriptionInfo.getCountryIso.overload().implementation = function () {
+        const _countryIso = this.getCountryIso()
+        console.log(
+            `spoof SubscriptionInfo.getCountryIso: ${_countryIso} -> ${countryIso}`
+        )
+        return countryIso
+    }
+
+    SubscriptionInfo.getSubscriptionId.overload().implementation = function () {
+        const _subId = this.getSubscriptionId()
+        if (!subId) {
+            console.log(_subId)
+            return _subId
+        }
+        console.log(
+            `spoof SubscriptionInfo.getSubscriptionId: ${_subId} -> ${subId}`
+        )
+        return parseInt(subId)
+    }
+
+    const TelephonyManager = Java.use("android.telephony.TelephonyManager")
+    TelephonyManager.getLine1Number.overload().implementation = function () {
+        const _number = this.getLine1Number()
+        console.log(
+            `spoof TelephonyManager.getLine1Number: ${_number} -> ${number}`
+        )
+        return number
+    }
+
+    TelephonyManager.getSimOperator.overload().implementation = function () {
+        const _simOperator = this.getSimOperator()
+        console.log(
+            `spoof TelephonyManager.getSimOperator: ${_simOperator} -> ${simOperator}`
+        )
+        return simOperator
+    }
+
+    TelephonyManager.getNetworkOperator.overload().implementation =
+        function () {
+            const _networkOperator = this.getNetworkOperator()
+            console.log(
+                `spoof TelephonyManager.getNetworkOperator: ${_networkOperator} -> ${networkOperator}`
+            )
+            return networkOperator
+        }
+
+    TelephonyManager.getSimSerialNumber.overload().implementation =
+        function () {
+            const _simSerialNumber = this.getSimSerialNumber()
+            console.log(
+                `spoof TelephonyManager.getSimSerialNumber: ${_simSerialNumber} -> ${simSerialNumber}`
+            )
+            return simSerialNumber
+        }
+
+    TelephonyManager.getSubscriberId.overload().implementation = function () {
+        const _imsi = this.getSubscriberId()
+        console.log(
+            `spoof TelephonyManager.getSubscriberId: ${_imsi} -> ${imsi}`
+        )
+        return imsi
+    }
+
+    TelephonyManager.getImei.overload().implementation = function () {
+        const _imei = this.getImei()
+        console.log(`spoof TelephonyManager.getImei: ${_imei} -> ${imei}`)
+        return imei
+    }
+
+    TelephonyManager.getNetworkCountryIso.overload().implementation =
+        function () {
+            const _countryIso = this.getNetworkCountryIso()
+            console.log(
+                `spoof TelephonyManager.getNetworkCountryIso: ${_countryIso} -> ${countryIso}`
+            )
+            return countryIso
+        }
+
+    TelephonyManager.getSimCountryIso.overload().implementation = function () {
+        const _countryIso = this.getSimCountryIso()
+        console.log(
+            `spoof TelephonyManager.getSimCountryIso: ${_countryIso} -> ${countryIso}`
+        )
+        return countryIso
+    }
+
+    TelephonyManager.getSubscriptionId.overload().implementation = function () {
+        const _subId = this.getSubscriptionId()
+        if (!subId) {
+            console.log(_subId)
+            return _subId
+        }
+        console.log(
+            `spoof TelephonyManager.getSubscriptionId: ${_subId} -> ${subId}`
+        )
+        return parseInt(subId)
+    }
+
+    const PhoneNumberVerification = Java.use(
+        "com.google.android.gms.constellation.PhoneNumberVerification"
+    )
+    PhoneNumberVerification.$init.overload(
+        "java.lang.String",
+        "long",
+        "int",
+        "int",
+        "java.lang.String",
+        "android.os.Bundle",
+        "int",
+        "long"
+    ).implementation = function (str, j, i, i2, str2, bundle, i3, l) {
+        console.log("PhoneNumberVerification.$init")
+
+        console.log(
+            `str: ${str}, j: ${j}, i: ${i}, i2: ${i2}, str2: ${str2}, i3: ${i3}, l: ${l}`
+        )
+        // print bundle
+        const keySet = bundle.keySet().toArray()
+
+        for (let i = 0; i < keySet.length; i++) {
+            const key = keySet[i]
+            console.log(`key: ${key}, value: ${bundle.get(key)}`)
+        }
+
+        return this.$init(str, j, i, i2, str2, bundle)
+    }
+
+    const SetAsterismConsentRequest = Java.use(
+        "com.google.android.gms.asterism.SetAsterismConsentRequest"
+    )
+    SetAsterismConsentRequest.$init.overload(
+        "int",
+        "int",
+        "int",
+        "[I",
+        "java.lang.Long",
+        "int",
+        "android.os.Bundle",
+        "int",
+        "java.lang.String",
+        "java.lang.String",
+        "java.lang.String",
+        "java.lang.String",
+        "java.lang.String",
+        "java.lang.String",
+        "java.lang.String",
+        "java.lang.String",
+        "int"
+    ).implementation = function (
+        i,
+        i2,
+        i3,
+        iArr,
+        l,
+        i4,
+        bundle,
+        i5,
+        str,
+        str2,
+        str3,
+        str4,
+        str5,
+        str6,
+        str7,
+        str8,
+        i6
+    ) {
+        console.log("SetAsterismConsentRequest.$init")
+
+        console.log(
+            `i: ${i}, i2: ${i2}, i3: ${i3}, iArr: ${iArr}, l: ${l}, i4: ${i4}, i5: ${i5}, str: ${str}, str2: ${str2}, str3: ${str3}, str4: ${str4}, str5: ${str5}, str6: ${str6}, str7: ${str7}, str8: ${str8}, i6: ${i6}`
+        )
+        // print bundle
+        const keySet = bundle.keySet().toArray()
+        for (let i = 0; i < keySet.length; i++) {
+            const key = keySet[i]
+            console.log(`key: ${key}, value: ${bundle.get(key)}`)
+        }
+
+        return this.$init(
+            i,
+            i2,
+            i3,
+            iArr,
+            l,
+            i4,
+            bundle,
+            i5,
+            str,
+            str2,
+            str3,
+            str4,
+            str5,
+            str6,
+            str7,
+            str8,
+            i6
+        )
+    }
+
+    const SetAsterismConsentResponse = Java.use(
+        "com.google.android.gms.asterism.SetAsterismConsentResponse"
+    )
+    SetAsterismConsentResponse.$init.overload(
+        "int",
+        "java.lang.String",
+        "java.lang.String"
+    ).implementation = function (i, str, str2) {
+        console.log("SetAsterismConsentResponse.$init")
+        console.log(`i: ${i}, str: ${str}, str2: ${str2}`)
+        return this.$init(i, str, str2)
+    }
+
+    const amac = Java.use("amac")
+    const amlo = Java.use("amlo")
+    const emiy = Java.use("emiy")
+    const emiz = Java.use("emiz")
+    const emis = Java.use("emis")
+    const fiwu = Java.use("fiwu")
+    const ambs = Java.use("ambs")
+    amac.o.overload("amlu", "boolean", "boolean", "fiwt").implementation =
+        function (amluVar, z, z2, fiwtVar) {
+            console.log("amac.o")
+            var z3
+            var z4
+            this._a.value.d("SetConsentRequest: %s", z(fiwtVar.eQ()))
+            var amloVar = this._d.value
+            var emiyVar = Java.cast(emiz.h.eV(), emiy)
+            if (!emiyVar.b.fm()) {
+                emiyVar.O()
+            }
+            var emizVar = Java.cast(emiyVar.b, emiz)
+            emizVar.b = emkm.a(10)
+            emizVar.a |= 1
+            var eV = emis.d.eV()
+            if ((fiwtVar.a & 2) != 0) {
+                var fivnVar = fiwtVar.e
+                if (fivnVar == null) {
+                    fivnVar = fivn.c
+                }
+                var b = fivh.b(fivnVar.a)
+                if (b == 0) {
+                    z3 = false
+                } else if (b == 3) {
+                    z3 = true
+                } else {
+                    z3 = false
+                }
+                if (!eV.b.fm()) {
+                    eV.O()
+                }
+                var fbzbVar = eV.b
+                var emisVar = Java.cast(fbzbVar, emis)
+                emisVar.a |= 1
+                emisVar.b = z3
+                var fivnVar2 = fiwtVar.e
+                if (fivnVar2 == null) {
+                    fivnVar2 = fivn.c
+                }
+                var a2 = fivk.a(fivnVar2.b)
+                if (a2 == 0) {
+                    z4 = false
+                } else if (a2 == 3) {
+                    z4 = true
+                } else {
+                    z4 = false
+                }
+                if (!fbzbVar.fm()) {
+                    eV.O()
+                }
+                var emisVar2 = Java.cast(eV.b, emis)
+                emisVar2.a |= 2
+                emisVar2.c = z4
+            }
+            if (!emiyVar.b.fm()) {
+                emiyVar.O()
+            }
+            var emizVar2 = Java.cast(emiyVar.b, emiz)
+            var emisVar3 = Java.cast(eV.K(), emis)
+            emisVar3.getClass()
+            emizVar2.c = emisVar3
+            emizVar2.a |= 2
+            amloVar.A(amluVar, emjr.REQUEST_SENT, Java.case(emiyVar.K(), emiz))
+            var v = this.v()
+            var akxiVar = this.c
+            var j = this.e
+            if (amag.a == null) {
+                amag.a = ftha.b(
+                    ftgy.UNARY,
+                    "google.internal.communications.phonedeviceverification.v1.PhoneDeviceVerification/SetConsent",
+                    fuem.a(fiwt.k),
+                    fuem.a(fiwu.a)
+                )
+            }
+            a.d(
+                "SetConsentResponse: %s",
+                z(
+                    Java.case(
+                        v.d.g(
+                            amag.a,
+                            akxiVar,
+                            fiwtVar,
+                            j,
+                            TimeUnit.MILLISECONDS,
+                            v.e
+                        ),
+                        fiwu
+                    ).eQ()
+                )
+            )
+            var amloVar2 = this.d
+            var emiyVar2 = Java.case(emiz.h.eV(), emiy)
+            if (!emiyVar2.b.fm()) {
+                emiyVar2.O()
+            }
+            var emizVar3 = Java.case(emiyVar2.b, emiz)
+            emizVar3.b = emkm.a(10)
+            emizVar3.a |= 1
+            amloVar2.A(
+                amluVar,
+                emjr.RESPONSE_RECEIVED,
+                Java.case(emiyVar2.K(), emiz)
+            )
+            var a3 = ambi.b().a(this.b.getApplicationContext())
+            a3.n(z)
+            a3.m(Boolean.valueOf(z2))
+            var b2 = fivj.b(fiwtVar.g)
+            if (b2 == 0) {
+                b2 = 1
+            }
+            var a4 = fivj.a(b2)
+            var edit = Java.case(a3, ambs).c.edit()
+            edit.putInt("device_consent_version", a4)
+            edit.apply()
+        }
+})