frida-rcs-hack/scripts/system_server_child.js

function trace(tag) {
    Log.e((tag || '') + Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new()))
}

function readFile(path) {
    var FileOutputStream = Java.use('java.io.FileOutputStream')
    var FileInputStream = Java.use('java.io.FileInputStream')
    var File = Java.use('java.io.File')
    var InputStreamReader = Java.use('java.io.InputStreamReader')
    var BufferedReader = Java.use('java.io.BufferedReader')
    var ByteArrayOutputStream = Java.use('java.io.ByteArrayOutputStream')

    var file = File.$new(path)
    var fileInputStream = FileInputStream.$new(file)

    var inputStreamReader = InputStreamReader.$new(Java.cast(fileInputStream, Java.use('java.io.InputStream')))
    var bufferedReader = BufferedReader.$new(inputStreamReader)
    var line
    var content = ''
    while ((line = bufferedReader.readLine()) !== null) {
        content += line + '\n'
    }

    bufferedReader.close()
    inputStreamReader.close()
    fileInputStream.close()

    return content
}

setImmediate(() => {
    Java.perform(function () {
        const Log = Java.use('android.util.Log')

        function log(msg) {
            console.log(`\x1b[30m[system_server] ${msg}\x1b[0m`)
            Log.d('frida-system_server', msg)
        }

        const WifiServiceImpl = Java.use('com.android.server.wifi.WifiServiceImpl')
        WifiServiceImpl.getFactoryMacAddresses.overload().implementation = function () {
            const original = this.getFactoryMacAddresses()
            const spoof = ['00:00:00:00:00:00']
            log(`WifiServiceImpl.getFactoryMacAddresses() called, returning: ${spoof}, original: ${original}`)
            return spoof
        }
    })
})