frida-rcs-hack/scripts/system_server.js

function trace(tag) {
    Log.e((tag || '') + Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new()))
}

function readFile(path) {
    var FileOutputStream = Java.use('java.io.FileOutputStream')
    var FileInputStream = Java.use('java.io.FileInputStream')
    var File = Java.use('java.io.File')
    var InputStreamReader = Java.use('java.io.InputStreamReader')
    var BufferedReader = Java.use('java.io.BufferedReader')
    var ByteArrayOutputStream = Java.use('java.io.ByteArrayOutputStream')

    var file = File.$new(path)
    var fileInputStream = FileInputStream.$new(file)

    var inputStreamReader = InputStreamReader.$new(Java.cast(fileInputStream, Java.use('java.io.InputStream')))
    var bufferedReader = BufferedReader.$new(inputStreamReader)
    var line
    var content = ''
    while ((line = bufferedReader.readLine()) !== null) {
        content += line + '\n'
    }

    bufferedReader.close()
    inputStreamReader.close()
    fileInputStream.close()

    return content
}

setImmediate(() => {
    Java.perform(function () {
        const Log = Java.use('android.util.Log')

        function log(msg) {
            console.log(`\x1b[30m[system_server] ${msg}\x1b[0m`)
            Log.d('frida-system_server', msg)
        }

        const DeviceIdentifiersPolicy = Java.use(
            'com.android.server.os.DeviceIdentifiersPolicyService$DeviceIdentifiersPolicy'
        )

        DeviceIdentifiersPolicy.getSerial.overload().implementation = function () {
            const original = this.getSerial()
            const spoof = '1234567890'
            log(`DeviceIdentifiersPolicy.getSerial() called, returning: ${spoof}, original: ${original}`)
            return spoof
        }

        DeviceIdentifiersPolicy.getSerialForPackage.overload('java.lang.String', 'java.lang.String').implementation =
            function (callingPackage, callingFeatureId) {
                const original = this.getSerialForPackage(callingPackage, callingFeatureId)
                const spoof = '1234567890'
                log(
                    `DeviceIdentifiersPolicy.getSerialForPackage(${callingPackage}, ${callingFeatureId}) called, returning: ${spoof}, original: ${original}`
                )
                return spoof
            }

    })
})