Spoof MODEL, DEVICE, PRODUCT & FINGERPRINT (1bda2e18) · Commits · e / os / android_frameworks_base

core/java/android/app/Instrumentation.java

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -80,6 +80,8 @@ import java.util.Objects;
	import java.util.StringJoiner;		import java.util.StringJoiner;
	import java.util.concurrent.TimeoutException;		import java.util.concurrent.TimeoutException;

			import com.android.internal.safetynet.SafetyNetHooks;

	/**		/**
	* Base class for implementing application instrumentation code. When running		* Base class for implementing application instrumentation code. When running
	* with instrumentation turned on, this class will be instantiated for you		* with instrumentation turned on, this class will be instantiated for you
	@@ -1359,6 +1361,7 @@ public class Instrumentation {
	Application app = getFactory(context.getPackageName())		Application app = getFactory(context.getPackageName())
	.instantiateApplication(cl, className);		.instantiateApplication(cl, className);
	app.attach(context);		app.attach(context);
			SafetyNetHooks.init(app);
	return app;		return app;
	}		}

	@@ -1377,6 +1380,7 @@ public class Instrumentation {
	ClassNotFoundException {		ClassNotFoundException {
	Application app = (Application)clazz.newInstance();		Application app = (Application)clazz.newInstance();
	app.attach(context);		app.attach(context);
			SafetyNetHooks.init(app);
	return app;		return app;
	}		}

core/java/com/android/internal/safetynet/SafetyNetHooks.java

0 → 100644

+53 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright (C) 2022 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			package com.android.internal.safetynet;

			import java.lang.reflect.Field;
			import java.util.Arrays;

			import android.app.Application;
			import android.os.Build;
			import android.util.Log;

			public final class SafetyNetHooks {

			private static final String TAG = "SafetyNetHooks";
			private static final String GMS_PACKAGE_NAME = "com.google.android.gms";
			private static final String SPOOFED_MODEL = "Pixel 2";
			private static final String SPOOFED_DEVICE_PRODUCT = "walleye";
			private static final String SPOOFED_FINGERPRINT = "google/walleye/walleye:8.1.0/OPM1.171019.011/4448085:user/release-keys";

			private static void setBuildField(String key, String value) {
			try {
			Field field = Build.class.getDeclaredField(key);
			field.setAccessible(true);
			field.set(null, value);
			field.setAccessible(false);
			} catch (NoSuchFieldException \| IllegalAccessException e) {
			Log.e(TAG, "Failed to fake Build." + key, e);
			}
			}

			public static void init(Application app) {
			if (GMS_PACKAGE_NAME.equals(app.getPackageName())) {
			setBuildField("MODEL", SPOOFED_MODEL);
			setBuildField("DEVICE", SPOOFED_DEVICE_PRODUCT);
			setBuildField("PRODUCT", SPOOFED_DEVICE_PRODUCT);
			setBuildField("FINGERPRINT", SPOOFED_FINGERPRINT);
			}
			}
			}