Hardcoding input and output directories are a big hindrance for proper distribution packaging of this software.

I hereby feature request that the user has to or can specify the input and output directories by command line options, e.g. -i <inputdir> and -o <outputdir>, and maybe if not specified you default not to something which is a sub-directory of main.py, but which resides in the user's home directory, e.g. ~/.tingle/input/ and ~/.tingle/output/ on unixoid systems, and something similar on Windows.

Regards!

Tried in my Redmi4A (rolex) running on LineageOS 17.1 by yurikoles.

D:\Downloads\minimal_adb_fastboot_1.4.3_portable>python main.py
MENU

1 - Patch file from a device (adb)
2 - Patch file from the input folder

1

*** OS: Windows 10 (win)
*** Python: 3.8.3 (64 bit)
*** Mode: 1
*** Working dir: C:\Users\Zack\AppData\Local\Temp\Tingle-amtqi1eh
*** Selected device: 1de4f5307d83
*** Automounting /system...

ERROR INFO

Type: <class 'FileNotFoundError'>
Name: The system cannot find the file specified (2)

Traceback (most recent call last):
File "main.py", line 588, in
adb_automount_if_needed(SELECTED_DEVICE, "/system")
File "main.py", line 327, in adb_automount_if_needed
output = safe_subprocess_run([DEPS_PATH["adb"], "-s", chosen_device, "shell", "case $(mount) in ' "+partition+" ') echo 'Already mounted';; *) mount '"+partition+"';; esac"])
File "main.py", line 204, in safe_subprocess_run
return subprocess.check_output(command, stderr=subprocess.STDOUT)
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 489, in run
with Popen(*popenargs, **kwargs) as process:
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 854, in init
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified

Does tingle modify /system/lib64/libdpframework.so?

I have an issue with SD Maid which may be linked.

Will investigate but thought that I would ask first.

Help Wanted

I tried to install this library 'libraries' manually but nothing worked so far... I'm using python 3.9.4 btw.

When I try to install the patch, I get the following error message: NameError: name 'true' is not defined. Did you mean: 'True'?

I tried the Needle patch first and got the same error message except the undefined word was false.

How does this app control/limit, which apps can spoof signatures?

Haystack e.g. does/did it via permissions and an entry in the developer tools. How does tingle control it?

Allowing all apps to spoof signatures is obviously dangerous.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Need testing on 64-bit phones since I don't have any 64-bit phone.

Informational -- maybe you want to add it to your README.md:

There is an Arch Linux package of this in the AUR: tingle-git.

Regards!

I become the following error, can you help me?

    1 - From the device (adb)
    2 - From the input folder

1

*** OS: Windows 10 (win32)
*** Mode: 1
*** Selected device: TAXXXXFKP1
*** Working dir: c:\users\user\appdata\local\temp\tmpazekga
*** Pulling framework from device...
100 KB/s (310 bytes in 0.003s)
*** Disassembling framework...

ERROR: No dex file(s) found, probably your file is odexed.

ERROR CODE: 86

I have Install cm13 nightly for falcon device

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

I need /system/framework/framework.jar from Android O for testing.

If you want to help me, send me the file please.

I want to patch my phone (Samsung Galaxy S3 Mini with unofficial CM12.1) with Tingle and it seemed to work, but it didn't finish the process. This is how far I got in the (Linux) Terminal:

$ python main.py 
MENU

    1 - Patch file from a device (adb)
    2 - Patch file from the input folder

> 1

 *** OS: Linux 4.4.0-59-generic (linux)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-3sT0Ca
 *** Selected device: 479000eae2b811ba
 *** Pulling framework from device...
      DEBUG: 4004 KB/s (5535794 bytes in 1.349s)
 *** Decompressing framework...
      DEBUG: Decompressing framework.jar
 *** Disassembling classes...
      DEBUG: Disassembling framework/classes.dex
 *** Patching...
 *** Detected: Android 5.x / CyanogenMod 12
 *** Patching succeeded.
 *** Reassembling classes...
      DEBUG: Assembling out/classes.dex
 *** Recompressing framework...
      DEBUG: Compressing framework.jar
 *** Copying the patched file to the output folder...
 *** Rooting adbd...
      DEBUG: restarting adbd as root
 *** Unlocked ADB: True
 *** Remounting /system...

At this point, it stops going further, but it didn't crash. I'm not able to get a logcat (adb logcat in a different Terminal seems to hang as well and doesn't produce any output).

Any idea what could cause this? And what to do to get around?

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Maybe you should add the information that you have to install 7zip on macOS in the Terminal.

https://superuser.com/questions/548349/how-can-i-install-7zip-so-i-can-run-it-from-terminal-on-os-x

7za is installed.

$ python3 main.py
Where do you want to take the file to patch?

    1 - From a device (adb)                                                                                                                                                                                                           
    2 - From the input folder                                                                                                                                                                                                         

1

*** OS: Linux 4.8.0-040800rc5-generic (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-w9jfhu2h
*** Selected device: 5693a2e4
*** Pulling framework from device...
3672 KB/s (5973800 bytes in 1.588s)
*** Decompressing framework...
DEBUG: Decompressing framework.jar

Error:
Incorrect command line
Traceback (most recent call last):
File "main.py", line 306, in
decompress("framework.jar", "framework/");
File "main.py", line 216, in decompress
subprocess.check_call(decomp_cmd);
File "/usr/lib/python3.5/subprocess.py", line 581, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['7za', 'x', '-y', '-bd', '-bso0', '-tzip', '-oframework/', 'framework.jar', '*.dex']' returned non-zero exit status 7

Hi this is first time i hear about faking google signature
my phone is too slow with google apps ( playstore and playservices )
i really want to use this patch , i need this patch , i try many times but get this error

MENU

1 - Patch file from a device (adb)
2 - Patch file from the input folder

2

*** OS: Windows 10 (win)
*** Python: 3.6.0 (64 bit)
*** Mode: 2
*** Working dir: C:\Users\MOHAMM~1\AppData\Local\Temp\Tingle-kod027kz
*** Device SDK: 21
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
Exception in thread "main" java.lang.UnsupportedClassVersionError: org/jf/baksmali/Main : Unsupported major.minor version 52.0
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(Unknown Source)
at java.security.SecureClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.access$100(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.launcher.LauncherHelper.checkAndLoadMain(Unknown Source)
Traceback (most recent call last):
File "F:\ROMS+sign spoof\tingle-master\main.py", line 598, in
smali_folder, dex_filename, dex_filename_last = find_smali(smali_to_search, "framework/", DEVICE_SDK)
File "F:\ROMS+sign spoof\tingle-master\main.py", line 516, in find_smali
disassemble(search_dir+filename, out_dir, device_sdk)
File "F:\ROMS+sign spoof\tingle-master\main.py", line 483, in disassemble
subprocess.check_call(disass_cmd)
File "C:\Python36\lib\subprocess.py", line 291, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['C:\Windows\system32\java.exe', '-jar', 'F:\ROMS\+sign spoof\tingle-master/tools/baksmali.jar', 'dis', '-l', '--seq', '-o', './smali-classes/', 'framework/classes.dex', '-a', '21']' returned non-zero exit status 1.

here is files you need
https://mega.nz/#!cAdGlKzA!JAdAvJ1Z674BFMCyXX0dT-BDG_uj-F_zguf_39rO46s

thanks alot for your help , sorry for my english

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

As requested here a new issue.

When running "python main.py" in TWRP 3.0.2 recovery with the system partition mounted on an Asus Z00AD (ZE551ML), the process hangs indefenitely on "Rooting adbd"

*** Decompressing framework... DEBUG: Decompressing framework.jar *** Disassembling classes... DEBUG: Disassembling framework/classes.dex *** Patching... *** Detected: Android 7.x / Android 6.0.x / CyanogenMod 13-14 *** Patching succeeded. *** Reassembling classes... DEBUG: Assembling out/classes.dex *** Recompressing framework... DEBUG: Compressing framework.jar *** Copying the patched file to the output folder... *** Rooting adbd...

Pressing ctrl+c prints the following lines:
Traceback (most recent call last): File "main.py", line 522, in enable_device_writing(chosen_one) File "main.py", line 214, in enable_device_writing File "main.py", line 210, in root_adbd subprocess.check_call([DEPS_PATH["adb"], "-s", chosen_device, "wait-for-device"]) File "C:\Users\Bart\AppData\Local\Programs\Python\Python35\lib\subprocess.py", line 581, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['C:\Users\Bart\AppData\Local\Android\android-sdk\platform-tools\adb.exe', '-s', 'F5AZFG159469', 'wait-for-device']' returned non-zero exit status 3221225786

Running "adb -s device_name root" or "adb -s device_name wait-for-device" from within unofficial CM14.1 or TWRP recovery doesn't print any lines. Running "adb -s device_name wait-for-device" in recovery makes the command prompt stall.

Hopefully I have provided enough information. In case I did not please let me know!

If you get a message like this on windows:

 *** OS: Windows 10 (win32)
 *** Mode: 2
 *** Working dir: c:\users\myuser\appdata\local\temp\Tingle-q_ewlx
 *** Decompressing framework...
      DEBUG: Decompressing framework.jar
Traceback (most recent call last):
  File "main.py", line 408, in <module>
    decompress("framework.jar", "framework/")
  File "main.py", line 289, in decompress
    subprocess.check_output(decomp_cmd)
  File "c:\Python27\lib\subprocess.py", line 212, in check_output
    process = Popen(stdout=PIPE, *popenargs, **kwargs)
  File "c:\Python27\lib\subprocess.py", line 390, in __init__
    errread, errwrite)
  File "c:\Python27\lib\subprocess.py", line 640, in _execute_child
    startupinfo)
WindowsError: [Error 5] Access is denied

This is because the included 7za-win32.exe only runs on 32-bit windows. Despite the message at the top (Windows 10 (win32)) I'm running on x64.

A workaround for anybody else running into this problem:

1. Download and install 7Zip. The portable version is fine.
2. Look in the 7Zip install dir for 7z.exe
3. Copy 7z.exe to tingle\tools
4. Rename it to 7za-win32.exe so that the python script will find it.

Hi,

Your patch sends me errors for both methods.
In fact, the Huawei P7 file/folder architectures seems to be my problem (and since i'm not the first Huawei owner encountering difficulties i bet solving this issue would help others too)...i admit i don't know much about file/folder architectures of other devices:

• for a typical system/app, for exemple AirSharing app:
  system/app/AirSharing/AirSharing.apk (file) + system/app/Airsharing/lib (folder); no *.dex file
• for system/framework:
  system/framework/*.jar (lot of files) + system/framework/arm (folder) (with a lot of *.xposed files in it); no *.dex file

All the *.dex files are in : data/dalvik-cache/arm and are named typically directoryX@directoryY@directoryZ@[email protected] (for AirSharing given above, directoryX is "system", directoryY is "app", directoryZ is "AirSharing", appname is AirSharing)

So what do you advice me in order to spoof app signatures?

I'll try to put all *.jar with their associated *.dex in tingle-master/input folder and execute main.py...
If you think the problem doesn't lie here or if you have a better idea, please let me know.
If you implement a new tingle to fix this issue, i'll take it too ;-)
Bye

I hereby express the wish to add a -h|--help option which briefly describes what this software does, how to use it, and which input files are needed.

Regards and thanks for this software!

I have a phone running CM13 with CM recovery
Booted to recovery and sideloaded CM update zip
Then went to Advanced >> Mount /system
When trying to run Tingle get the following error:

$ python3 main.py 
MENU

    1 - Patch file from a device (adb)
    2 - Patch file from the input folder

> 1

 *** OS: Linux 4.8.0-1-amd64 (linux)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-k1k5i_h3
 *** Selected device: WbSPARKPJH0025693
 *** Pulling framework from device...
Traceback (most recent call last):
  File "main.py", line 396, in <module>
    brew_input_file(mode, chosen_one)
  File "main.py", line 263, in brew_input_file
    output = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_one, "pull", "/system/framework/framework.jar", "."], stderr=subprocess.STDOUT)
  File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
    **kwargs).stdout
  File "/usr/lib/python3.5/subprocess.py", line 708, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'WbSPARKPJH0025693', 'pull', '/system/framework/framework.jar', '.']' returned non-zero exit status 1

What am I doing wrong?

Hi,

Coming from microg/UnifiedNlp#133, I wanted to give the unofficial microG installer a try (from https://forum.xda-developers.com/android/development/microg-unofficial-installer-t3432360).

Since I'm using LineageOS 14.1, I first need to add signature spoofing, so i came here to try Tingle.

I downloaded the current version, but here's the output :
`python main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder

1
*** OS: Linux 4.10.0-22-generic (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-sCi2uB
*** Selected device: ????????????
Traceback (most recent call last):
File "main.py", line 402, in
OUTPUT_PATH = os.path.join(SCRIPT_DIR, "output", SELECTED_DEVICE)
File "/usr/lib/python2.7/posixpath.py", line 73, in join
path += '/' + b
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 16: ordinal not in range(128)`

That must be some kind of UTF-8 encoding issue, right ?

I'm trying to patch on android itself. I prefer to use Termux instead of QPython because it is a complete terminal (not just for python). In it I have installed Python 3.7.1 and p7zip 16.02-1. The same error occurs when using option "2" or "3". Attached is my framework.jar in case you need to take a look. Thank you!

`$ python /storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py
MENU

1 - Patch file from a device (adb)
2 - Patch file from the input folder
3 - Patch file directly from the device

3

*** OS: Linux 3.18.19 (android)
*** Python: 3.7.1 (64 bit)
*** Mode: 3
*** Working dir: /data/data/com.termux/files/usr/tmp/Tingle-bcs1i_75
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
Failed to initialize runtime (check log for details)
Traceback (most recent call last):
File "/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py", line 598, in
smali_folder, dex_filename, dex_filename_last = find_smali(smali_to_search, "framework/", DEVICE_SDK)
File "/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py", line 516, in find_smali
disassemble(search_dir+filename, out_dir, device_sdk)
File "/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py", line 483, in disassemble
subprocess.check_call(disass_cmd)
File "/data/data/com.termux/files/usr/lib/python3.7/subprocess.py", line 341, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['/data/data/com.termux/files/usr/bin/dalvikvm', '-Xmx128m', '-cp', '/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/tools/baksmali-dvk.jar', 'org.jf.baksmali.Main', 'dis', '-l', '--seq', '-o', './smali-classes/', 'framework/classes.dex']' returned non-zero exit status 1.
$`

framework.jar.zip

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

The script itself probably already works, but there are some dependencies missing on OS X and it also miss testing.

Currently running CM13 with CM recovery
Installed Tingle but experienced major problem
So trying to reverse using following steps:
In recovery, mount /system
$ adb push "./output/framework.jar.backup" /system/framework/framework.jar
But looks like there is no adb support in CM recovery
No other recovery exists for my phone
How can I revert?

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Tried running this on Oneplus 6 (enchilada) w/ LineageOS 17.1

--

[me@me tingle-master]$ sudo python3 main.py
[sudo] password for me:
MENU

1 - Patch file from a device (adb)
2 - Patch file from the input folder

1

*** OS: Linux 5.6.19-2-MANJARO (linux)
*** Python: 3.8.5 (64 bit)
*** Mode: 1
*** Working dir: /tmp/Tingle-j54jx9we
*** Selected device: 4ceedc75
*** Automounting /system...

ERROR INFO

Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', '4ceedc75', 'shell', "case $(mount) in ' /system ') echo 'Already mounted';; *) mount '/system';; esac"]
Return code: 1
Output: mount: bad /etc/fstab: No such file or directory

Traceback (most recent call last):
File "main.py", line 588, in
adb_automount_if_needed(SELECTED_DEVICE, "/system")
File "main.py", line 327, in adb_automount_if_needed
output = safe_subprocess_run([DEPS_PATH["adb"], "-s", chosen_device, "shell", "case $(mount) in ' "+partition+" ') echo 'Already mounted';; *) mount '"+partition+"';; esac"])
File "main.py", line 204, in safe_subprocess_run
return subprocess.check_output(command, stderr=subprocess.STDOUT)
File "/usr/lib/python3.8/subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/usr/lib/python3.8/subprocess.py", line 512, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', '4ceedc75', 'shell', "case $(mount) in ' /system ') echo 'Already mounted';; *) mount '/system';; esac"]' returned non-zero exit status 1.

I installed the flashable microG services and CarbonROM doesn't support the unifiedNlp package.

To what I understand this tool only patch for signature spoofing and not for unifiedNlp support.
Is that correct?

Thanks for all your awesome work by the way.
I'm new free of Google services and Google related products on my device :)

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Tried running Tingle on my Moto G6 Plus to patch the Lineage OS install I have, but when I try to run main.py, I get this:

$ ./main.py
MENU

    1 - Patch file from a device (adb)
    2 - Patch file from the input folder

> 1

 *** OS: Linux 4.19.0-5-amd64 (linux)
 *** Python: 2.7.16 (64 bit)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-lIHv9p
 *** Selected device: ZY322TXVZ4
 *** Automounting /system...
      DEBUG: Already mounted
 *** Pulling framework from device...

ERROR INFO
==========
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', u'ZY322TXVZ4', 'pull', '/system/build.prop', '.']
Return code: 1
Output: adb: error: failed to copy '/system/build.prop' to './build.prop': remote open failed: Permission denied


ERROR CODE: 90

I made sure that I have superuser privileges by entering the shell through adb and typing 'su'.

Here's the logcat:
logcat.tar.gz

hi,

how does this work? i suppose applying a text diff over backsmalied framework? then this is kind of brittle and will break often with minute framework changes, and could require different diffs for different roms.

consider using dexpatcher instead. i could look into it myself but im travelling and have no time now. disadvantage: less granularity to do changes. advantages: much much less brittle, changes in java without having the exact source code, seems like changes might be very simply implemented as method wrappers. also, dexpatcher can run on the device itself (pure java), and it could probably be cross compiled to native to support patching in recovery; the addon.d mechanism to repatch on system upgrade is even possible.

i can help with the coding of the dexpatcher patch.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Can Tingle patch with adb started from TWRP Recovery?

logcat.txt
Restoring the framework.jar doesn't help either

07-31 12:58:20.804  1154  1154 I dex2oat : /system/bin/dex2oat --compiler-filter=interpret-only -j2
07-31 12:58:20.804  1154  1154 E cutils-trace: Error opening trace file: No such file or directory (2)
07-31 12:58:20.848  1154  1154 I dex2oat : dex2oat took 45.193ms (threads: 2) arena alloc=7KB (7912B) java alloc=69KB (7
0856B) native alloc=1043KB (1068864B) free=1516KB (1552576B)
07-31 12:58:20.880   855   855 I PackageManager.DexOptimizer: Running dexopt (dex2oat) on: /data/app/com.google.android.
apps.maps-1/base.apk pkg=com.google.android.apps.maps isa=arm vmSafeMode=false debuggable=false target-filter=verify-pro
file oatDir = /data/app/com.google.android.apps.maps-1/oat sharedLibraries=null
07-31 12:58:20.921  1157  1157 E cutils-trace: Error opening trace file: No such file or directory (2)
07-31 12:58:20.943  1157  1157 I dex2oat : /system/bin/dex2oat --compiler-filter=verify-profile -j2 --profile-file-fd=7
07-31 12:58:23.838  1157  1157 I dex2oat : Large app, accepted running with swap.

Attempting to run tingle from TWRP without /system mounted (the default behavior, it seems) results in this crash message:

Traceback (most recent call last):
  File "main.py", line 396, in <module>
    brew_input_file(mode, chosen_one)
  File "main.py", line 263, in brew_input_file
    output = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_one, "pull", "/system/framework/framework.jar", "."], stderr=subprocess.STDOUT)
  File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
    **kwargs).stdout
  File "/usr/lib/python3.5/subprocess.py", line 708, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'ZX1G22M5TH', 'pull', '/system/framework/framework.jar', '.']' returned non-zero exit status 1

Perhaps including a couple of adb commands to check if /system is mounted at all before pulling the framework.jar?

On a side note, I saw that Tingle correctly remounts /system as rw if it was mounted ro, but I got this message. Everything worked out and the system got patched, but the DEBUG message is confusing:
*** Remounting /system...
DEBUG: remount of vendor failed: Success
remount failed

It would be nice if this tool could support AndroidP since many custom roms are coming out this year which are based on Android 9

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

I'm on Ubuntu 16.04. All dependencies loaded (according to the script). I had to go out and get 7za, no biggie.

It seemed to almost make it through, but I know the internal structure of the Pixel series is a bit different, so I'm not totally surprised it failed. Any other info you need?

 *** OS: Linux 4.8.0-53-generic (linux)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-j7p3w0_s
 *** Selected device: FA6C30304014
 *** Pulling framework from device...
      DEBUG: 3273 KB/s (16502976 bytes in 4.923s)
 *** Decompressing framework...
      DEBUG: Decompressing framework.jar
 *** Disassembling classes...
      DEBUG: Disassembling framework/classes.dex
 *** Patching...
 *** Detected: Android 7.x / Android 6.0.x / CyanogenMod 13-14
 *** Patching succeeded.
 *** Reassembling classes...
      DEBUG: Assembling out/classes.dex
 *** Recompressing framework...
      DEBUG: Compressing framework.jar
 *** Copying the patched file to the output folder...
 *** Rooting adbd...
      DEBUG: restarting adbd as root
 *** Unlocked ADB: True
 *** Remounting /system...
error: protocol fault (no status)
Traceback (most recent call last):
  File "main.py", line 536, in <module>
    enable_device_writing(SELECTED_DEVICE)
  File "main.py", line 219, in enable_device_writing
    remount_check = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_device, "remount", "/system"]).decode("utf-8")
  File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
    **kwargs).stdout
  File "/usr/lib/python3.5/subprocess.py", line 708, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'FA6C30304014', 'remount', '/system']' returned non-zero exit status 1

Can you add instructions for manual pushing? And perhaps what permissions to set if necessary?

EDIT: Almost forgot this. When I push apps to /system, I have to go here:

/system/system/priv-app

So I think the path needed to push this file back to the Pixel device is:

/system/system/framework/framework.jar

Ironically, when viewing the file system within the OS, you don't see that, but in TWRP it's as clear as day.

Trying it manually in TWRP now.

EDIT (final): It worked!!

I used TWRP to copy the patched framework.jar on my pc (in the "output" folder of this script) into:

/system/system/framework[/framework.jar]

Did chmod 644, pushed gsm_core.apk to /system/system/priv_app and did chmod 644 for the apk. Rebooted and GSM Core reports signature spoofing enabled! Still further testing needed, but we're at the 95% mark on Pixel :-D

Hopefully the script can be updated to fully automate the process as intended!

EDIT: I just got haystack working... only issue was the script didn't wait long enough for remount (device appeared to be unplugged I guess?). Maybe that's the issue in this script a well. On a separate note, within the OS, /system/framework does exist, but under TWRP or bootloader, it's actually /system/system/framework.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Running Tingle with an adbd server that already has root privileges causes the program to stall at the following stage:

*** Patching succeeded.
 *** Reassembling classes...
      DEBUG: Assembling out/classes.dex
 *** Recompressing framework...
      DEBUG: Compressing framework.jar
 *** Copying the patched file to the output folder...
 *** Rooting adbd...
      DEBUG: adbd is already running as root
### Stalls here

I was able to manually push the framework.jar file from the output folder back onto the phone, however, given that my phone basically requires me to have adbd running as root (or else I get "error: insufficient permissions for device"), and killing that server just to restart it and have it get elevated privileges is annoying - especially when Tingle keeps insisting that adbd still has root privileges (on subsequent runs).

Add support for patching Android from inside Android itself.

I try to use Tingle on ROMs from this site:
http://download.jesec.io/
These are unofficial for the S7, but official LineageOS ROMs have the same problem.

Tingle can't deal with those ROMs as framework.jar does not contain .dex files. It assumes they are odexed.
Un-odexer tools cannot deal with the ROMs, too, as they don't contain .odex files. So they are recognized as already unodexed.

I already used a modified stock ROM (called SuperMan) on this S7. Tingle deals with that one flawlessly.

I'm now a bit at a loss. Am I doing something completely wrong with the AOSP ROMs?

For me script crashes on "Remounting /system..." step

MENU

    1 - Patch file from a device (adb)
    2 - Patch file from the input folder

> 1

 *** OS: Linux 4.14.9-1-ARCH (linux)
 *** Python: 3.6.4 (64 bit)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-x2vr8_to
 *** Selected device: 43f8c4790903
 *** Automounting /system...
      DEBUG: Already mounted
 *** Pulling framework from device...
 *** Device SDK: 25
 *** Decompressing framework...
      DEBUG: Decompressing framework.jar
 *** Disassembling classes...
      DEBUG: Disassembling framework/classes.dex
 *** Patching...
 *** Detected: Android 8.x / 7.x / 6.x (or LOS/CM 13-15)
 *** Patching succeeded.
 *** Reassembling classes...
      DEBUG: Assembling out/classes.dex
      WARNING: The reassembling has failed (probably we have exceeded the 64K methods limit)
               but do NOT worry, we will retry.
 *** Moving methods...
      WARNING: Experimental code.
      DEBUG: Disassembling framework/classes2.dex
 *** Reassembling classes...
      DEBUG: Assembling out/classes.dex
      DEBUG: Assembling out/classes2.dex
 *** Recompressing framework...
      DEBUG: Compressing framework.jar
 *** Copying the patched file to the output folder...
 *** Rooting adbd...
      DEBUG: adbd cannot run as root in production builds
 *** Unlocked ADB: False
 *** Remounting /system...

ERROR INFO
==========
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', '43f8c4790903', 'shell', "su -c 'mount -o remount,rw /system /system && mount' | grep ' /system '"]
Return code: 1
Output: mount: '/system' not in /proc/mounts

Traceback (most recent call last):
  File "./main.py", line 720, in <module>
    enable_device_writing(SELECTED_DEVICE)
  File "./main.py", line 365, in enable_device_writing
    remount_check = safe_output_decode(safe_subprocess_run([DEPS_PATH["adb"], "-s", chosen_device, "shell", "su -c 'mount -o remount,rw /system /system && mount' | grep ' /system '"]))  # Untested
  File "./main.py", line 203, in safe_subprocess_run
    return subprocess.check_output(command, stderr=subprocess.STDOUT)
  File "/usr/lib/python3.6/subprocess.py", line 336, in check_output
    **kwargs).stdout
  File "/usr/lib/python3.6/subprocess.py", line 418, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', '43f8c4790903', 'shell', "su -c 'mount -o remount,rw /system /system && mount' | grep ' /system '"]' returned non-zero exit status 1.
                                        

Phone is Xiaomi Redmi Note 4X running AospExtented v4.6/Android 7.1.2, rooted via Magisk if it makes the difference.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Work good Using Qphyton3 from android market for patching smali and used apktool on android to finish compiling smali.

When executing the command, got the following error:

ERROR: Missing executable => 7za
ERROR CODE: 65

I'm running OSX and from the looks of the files in the tools folder, I guess something is missing for OSX.

I came from here souramoo#16 with the same issue. Here are the two files you asked for: boot-fw.zip

My device has /system/framework/arm/boat.oat as well as /system/framework/arm64/boat.oat. They are quite large (about 60MB) so I only included the first one as you requested but if you need the other let me know. When I run your patch this is the output:

$ sudo python3 patch.py
Where do you want to take the file to patch?

1 - From the device (adb)
2 - From the input folder

> 1

*** OS: Linux 4.6.0-1-amd64 (linux)
*** Selected device: 00defa40427cb549
*** Working dir: /tmp/tmp5pkyxhn2
*** Pulling framework from device...
6 KB/s (310 bytes in 0.043s)
*** Disassembling framework...
*** Disassembling classes...
Traceback (most recent call last):
File "patch.py", line 156, in <module>
smali_folder, dex_filename, dex_filename_last = find_smali(smali_to_search, "framework/");
File "patch.py", line 147, in find_smali
dir_list = tuple(sorted(os.listdir(dir)));
FileNotFoundError: [Errno 2] No such file or directory: 'framework/'

I tried copying /system/framework/framework.jar to the input folder and running it again with option 2 but the result is the same.

Thanks for your hard work on this. If you need anything else from me let me know.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

i got in this bad situation here where i patched multiple times. eventually, i wanted to back to the original non-spoofed signature, but because i ran tingle multiple times, the .backup file now refers to an already patched version tingle had downloaded from the phone...

it would seem preferable to rotate those backups or at least not overwrite them to avoid dataloss.

Tingle didn't show any error, and everything else shows as okay in microg (including signature spoofing). Device restart did not help. Any idea how to fix this?

Screenshot

Device: LG G4
Android version: LineageOS 14.1-20170131-NIGHTLY
microg version: 0.2.4-55-g4c4086a

Patched framework.jar from a v7.1.2 ROM does not boot - left it for over an hour. Going back to unpatched file works fine. Is there anything that I can do to troubleshoot?

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Hello, I tried using tingle with my installation of Windows 7 and get following error:

I installed Java and ADB correctly before, enabled USB Debugging on my Android Smartphone, allowed root access for ADB.

Traceback (most recent call last):
File "main.py", line 405, in <module>
brew_input_file(mode, chosen_one)
File "main.py", line 264, in brew_input_file
output = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_one, "pull", "/system/framework/framework.jar", "."]
File "C:\Python27\lib\subprocess.py", line 390, in __init__ errread, errwrite)
File "C:\Python27\lib\subprocess.py", line 640, in _execute_child startupinfo)
WindowsError: [Error 2] The system can't file the corresponding file

I'd be really happy about some help.

Hello. On macos 10.12.3 patched crashing with such error
java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.OutOfMemoryError: Java heap space

I added key "-Xmx512m" to line 333 (assemble function)

ass_cmd = [DEPS_PATH["java"], "-Xmx512m", "-jar", SCRIPT_DIR+"/tools/smali.jar"]
and now it working.

I have no idea which limit really needed, but when compling java growes to near 200mb (as I seen in top).

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

ERROR INFO
==========
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', 'ZX1D23F8R7', 'pull', '/system/build.prop', '.']
Return code: 1
Output: adb: error: failed to copy '/system/build.prop' to './build.prop': remote open failed: Permission denied

ERROR CODE: 90

On Motorola Moto G 2nd gen (2014) titan

Tried first Magisk, then SuperSu, none worked.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Modern devices use system-as-root, so the framework can be in /system/system — while in the recovery at least. I've been doing this:

diff --git i/main.py w/main.py
index bfa95c9..01850e4 100755
--- i/main.py
+++ w/main.py
@@ -428,7 +428,7 @@ def brew_input_file(mode, files_list, chosen_one):
         safe_copy(os.path.join(SCRIPT_DIR, "input", "framework.jar"), os.path.join(TMP_DIR, "framework.jar"))
         safe_copy(os.path.join(SCRIPT_DIR, "input", "build.prop"), os.path.join(TMP_DIR, "build.prop"))
     else:
-        safe_copy("/system/framework/framework.jar", os.path.join(TMP_DIR, "framework.jar"))
+        safe_copy("/system/system/framework/framework.jar", os.path.join(TMP_DIR, "framework.jar"))
 
 
 def decompress(file, out_dir):
@@ -590,7 +590,7 @@ if mode == 1:
 import patches.sig_spoof
 patch_instance = patches.sig_spoof.Patch()
 files_list = patch_instance.get_files_list()
-files_list.append(["/system", "build.prop"])
+files_list.append(["/system/system", "build.prop"])
 
 brew_input_file(mode, files_list, SELECTED_DEVICE)
 
@@ -737,7 +737,7 @@ if mode == 1:
     print_(" *** Pushing changes to the device...")
     try:
         if not DEBUG_PROCESS:
-            output = safe_subprocess_run([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/framework/framework.jar"])
+            output = safe_subprocess_run([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/system/framework/framework.jar"])
             debug(safe_output_decode(output).rstrip())
     except subprocess.CalledProcessError:
         e = sys.exc_info()[1]
@@ -748,7 +748,7 @@ if mode == 1:
             subprocess.check_call([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "reboot", "recovery"])
             subprocess.check_call([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "wait-for-device"])
             enable_device_writing(SELECTED_DEVICE)
-            subprocess.check_output([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/framework/framework.jar"])
+            subprocess.check_output([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/system/framework/framework.jar"])
         else:
             raise
         del e
@@ -759,6 +759,6 @@ print_(" *** All done! :)")
 
 print_(os.linesep + "Your original file is present at "+BACKUP_FILE)
 if mode != 3:
-    print_(os.linesep + "If your device bootloop, please run this command on the pc when the connected device is inside recovery:" + os.linesep + "adb push \""+BACKUP_FILE+"\" /system/framework/framework.jar")
+    print_(os.linesep + "If your device bootloop, please run this command on the pc when the connected device is inside recovery:" + os.linesep + "adb push \""+BACKUP_FILE+"\" /system/system/framework/framework.jar")
 else:
     print_(os.linesep + "Now you should replace the file on your system with the patched file in the output folder.")
diff --git i/patches/sig_spoof.py w/patches/sig_spoof.py
index 3b91333..47c41e4 100755
--- i/patches/sig_spoof.py
+++ w/patches/sig_spoof.py
@@ -20,4 +20,4 @@ class Patch(sys.BasePatch):
         pass
 
     def _set_files_list(self):
-        self.files.append(["/system/framework", "framework.jar"])
+        self.files.append(["/system/system/framework", "framework.jar"])

but proper auto-detection would be better of course :)

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

My new ROM contains a very small framework.jar file:

user@computer:/mnt/img/framework$ find . -ls |grep framework
      826   4344 -rw-r--r--   1 root     root      4448256 Dec 31  2008 ./arm/boot-framework.art
      827  36716 -rw-r--r--   1 root     root     37595032 Dec 31  2008 ./arm/boot-framework.oat
      832     28 -rw-r--r--   1 root     root        28672 Dec 31  2008 ./arm/boot-mediatek-framework.art
      833    276 -rw-r--r--   1 root     root       280812 Dec 31  2008 ./arm/boot-mediatek-framework.oat
      859   6560 -rw-r--r--   1 root     root      6717440 Dec 31  2008 ./arm64/boot-framework.art
      860  42756 -rw-r--r--   1 root     root     43778800 Dec 31  2008 ./arm64/boot-framework.oat
      865     36 -rw-r--r--   1 root     root        36864 Dec 31  2008 ./arm64/boot-mediatek-framework.art
      866    288 -rw-r--r--   1 root     root       293280 Dec 31  2008 ./arm64/boot-mediatek-framework.oat
      896  19668 -rw-r--r--   1 root     root     20137075 Dec 31  2008 ./framework-res.apk
      897      4 -rw-r--r--   1 root     root          126 Dec 31  2008 ./framework.jar
      905      4 -rw-r--r--   1 root     root          310 Dec 31  2008 ./mediatek-framework.jar

Running tingle:

user@computer:/tmp/tingle-master$ ./main.py 
MENU

    1 - Patch file from a device (adb)
    2 - Patch file from the input folder

> 1

 *** OS: Linux 4.11.0-1-amd64 (linux)
 *** Python: 2.7.13 (64 bit)
 *** Mode: 1
 *** Working dir: /tmp/Tingle-_lXrCz
 *** Selected device: CE7P8LKRZHAAYLCI
 *** Pulling framework from device...
      DEBUG: [100%] /system/framework/framework.jar
 *** Device SDK: 24
 *** Decompressing framework...
      DEBUG: Decompressing framework.jar
 *** Disassembling classes...

ERROR: No dex file(s) found, probably the ROM is odexed.

ERROR CODE: 86
user@computer:/tmp/tingle-master$ 

There are no .odex files. What am I doing wrong?