ale5000-git / tingle Goto Github PK
View Code? Open in Web Editor NEWThis project forked from souramoo/needle
Tingle - Android patcher
Home Page: http://forum.xda-developers.com/showthread.php?t=3438764
License: GNU General Public License v3.0
This project forked from souramoo/needle
Tingle - Android patcher
Home Page: http://forum.xda-developers.com/showthread.php?t=3438764
License: GNU General Public License v3.0
Hardcoding input and output directories are a big hindrance for proper distribution packaging of this software.
I hereby feature request that the user has to or can specify the input and output directories by command line options, e.g. -i <inputdir>
and -o <outputdir>
, and maybe if not specified you default not to something which is a sub-directory of main.py
, but which resides in the user's home directory, e.g. ~/.tingle/input/
and ~/.tingle/output/
on unixoid systems, and something similar on Windows.
Regards!
The script itself probably already works, but there are some dependencies missing on OS X and it also miss testing.
Hello. On macos 10.12.3 patched crashing with such error
java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.OutOfMemoryError: Java heap space
I added key "-Xmx512m" to line 333 (assemble function)
ass_cmd = [DEPS_PATH["java"], "-Xmx512m", "-jar", SCRIPT_DIR+"/tools/smali.jar"]
and now it working.
I have no idea which limit really needed, but when compling java growes to near 200mb (as I seen in top).
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Work good Using Qphyton3 from android market for patching smali and used apktool on android to finish compiling smali.
I installed the flashable microG services and CarbonROM doesn't support the unifiedNlp package.
To what I understand this tool only patch for signature spoofing and not for unifiedNlp support.
Is that correct?
Thanks for all your awesome work by the way.
I'm new free of Google services and Google related products on my device :)
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
I came from here souramoo#16 with the same issue. Here are the two files you asked for: boot-fw.zip
My device has /system/framework/arm/boat.oat as well as /system/framework/arm64/boat.oat. They are quite large (about 60MB) so I only included the first one as you requested but if you need the other let me know. When I run your patch this is the output:
$ sudo python3 patch.py
Where do you want to take the file to patch?
1 - From the device (adb)
2 - From the input folder
> 1
*** OS: Linux 4.6.0-1-amd64 (linux)
*** Selected device: 00defa40427cb549
*** Working dir: /tmp/tmp5pkyxhn2
*** Pulling framework from device...
6 KB/s (310 bytes in 0.043s)
*** Disassembling framework...
*** Disassembling classes...
Traceback (most recent call last):
File "patch.py", line 156, in <module>
smali_folder, dex_filename, dex_filename_last = find_smali(smali_to_search, "framework/");
File "patch.py", line 147, in find_smali
dir_list = tuple(sorted(os.listdir(dir)));
FileNotFoundError: [Errno 2] No such file or directory: 'framework/'
I tried copying /system/framework/framework.jar to the input folder and running it again with option 2 but the result is the same.
Thanks for your hard work on this. If you need anything else from me let me know.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
7za is installed.
$ python3 main.py
Where do you want to take the file to patch?1 - From a device (adb) 2 - From the input folder
1
*** OS: Linux 4.8.0-040800rc5-generic (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-w9jfhu2h
*** Selected device: 5693a2e4
*** Pulling framework from device...
3672 KB/s (5973800 bytes in 1.588s)
*** Decompressing framework...
DEBUG: Decompressing framework.jarError:
Incorrect command line
Traceback (most recent call last):
File "main.py", line 306, in
decompress("framework.jar", "framework/");
File "main.py", line 216, in decompress
subprocess.check_call(decomp_cmd);
File "/usr/lib/python3.5/subprocess.py", line 581, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['7za', 'x', '-y', '-bd', '-bso0', '-tzip', '-oframework/', 'framework.jar', '*.dex']' returned non-zero exit status 7
It would be nice if this tool could support AndroidP since many custom roms are coming out this year which are based on Android 9
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Attempting to run tingle from TWRP without /system mounted (the default behavior, it seems) results in this crash message:
Traceback (most recent call last):
File "main.py", line 396, in <module>
brew_input_file(mode, chosen_one)
File "main.py", line 263, in brew_input_file
output = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_one, "pull", "/system/framework/framework.jar", "."], stderr=subprocess.STDOUT)
File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
**kwargs).stdout
File "/usr/lib/python3.5/subprocess.py", line 708, in run
output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'ZX1G22M5TH', 'pull', '/system/framework/framework.jar', '.']' returned non-zero exit status 1
Perhaps including a couple of adb commands to check if /system is mounted at all before pulling the framework.jar?
On a side note, I saw that Tingle correctly remounts /system as rw if it was mounted ro, but I got this message. Everything worked out and the system got patched, but the DEBUG message is confusing:
*** Remounting /system...
DEBUG: remount of vendor failed: Success
remount failed
As requested here a new issue.
When running "python main.py" in TWRP 3.0.2 recovery with the system partition mounted on an Asus Z00AD (ZE551ML), the process hangs indefenitely on "Rooting adbd"
*** Decompressing framework... DEBUG: Decompressing framework.jar *** Disassembling classes... DEBUG: Disassembling framework/classes.dex *** Patching... *** Detected: Android 7.x / Android 6.0.x / CyanogenMod 13-14 *** Patching succeeded. *** Reassembling classes... DEBUG: Assembling out/classes.dex *** Recompressing framework... DEBUG: Compressing framework.jar *** Copying the patched file to the output folder... *** Rooting adbd...
Pressing ctrl+c prints the following lines:
Traceback (most recent call last): File "main.py", line 522, in enable_device_writing(chosen_one) File "main.py", line 214, in enable_device_writing File "main.py", line 210, in root_adbd subprocess.check_call([DEPS_PATH["adb"], "-s", chosen_device, "wait-for-device"]) File "C:\Users\Bart\AppData\Local\Programs\Python\Python35\lib\subprocess.py", line 581, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '['C:\Users\Bart\AppData\Local\Android\android-sdk\platform-tools\adb.exe', '-s', 'F5AZFG159469', 'wait-for-device']' returned non-zero exit status 3221225786
Running "adb -s device_name root" or "adb -s device_name wait-for-device" from within unofficial CM14.1 or TWRP recovery doesn't print any lines. Running "adb -s device_name wait-for-device" in recovery makes the command prompt stall.
Hopefully I have provided enough information. In case I did not please let me know!
Does tingle modify /system/lib64/libdpframework.so?
I have an issue with SD Maid which may be linked.
Will investigate but thought that I would ask first.
When executing the command, got the following error:
ERROR: Missing executable => 7za
ERROR CODE: 65
I'm running OSX and from the looks of the files in the tools folder, I guess something is missing for OSX.
Tried in my Redmi4A (rolex) running on LineageOS 17.1 by yurikoles.
D:\Downloads\minimal_adb_fastboot_1.4.3_portable>python main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
1
*** OS: Windows 10 (win)
*** Python: 3.8.3 (64 bit)
*** Mode: 1
*** Working dir: C:\Users\Zack\AppData\Local\Temp\Tingle-amtqi1eh
*** Selected device: 1de4f5307d83
*** Automounting /system...
Type: <class 'FileNotFoundError'>
Name: The system cannot find the file specified (2)
Traceback (most recent call last):
File "main.py", line 588, in
adb_automount_if_needed(SELECTED_DEVICE, "/system")
File "main.py", line 327, in adb_automount_if_needed
output = safe_subprocess_run([DEPS_PATH["adb"], "-s", chosen_device, "shell", "case $(mount) in ' "+partition+" ') echo 'Already mounted';; *) mount '"+partition+"';; esac"])
File "main.py", line 204, in safe_subprocess_run
return subprocess.check_output(command, stderr=subprocess.STDOUT)
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 489, in run
with Popen(*popenargs, **kwargs) as process:
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 854, in init
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\Zack\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified
Add support for patching Android from inside Android itself.
Patched framework.jar from a v7.1.2 ROM does not boot - left it for over an hour. Going back to unpatched file works fine. Is there anything that I can do to troubleshoot?
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
I'm trying to patch on android itself. I prefer to use Termux instead of QPython because it is a complete terminal (not just for python). In it I have installed Python 3.7.1 and p7zip 16.02-1. The same error occurs when using option "2" or "3". Attached is my framework.jar in case you need to take a look. Thank you!
`$ python /storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
3 - Patch file directly from the device
3
*** OS: Linux 3.18.19 (android)
*** Python: 3.7.1 (64 bit)
*** Mode: 3
*** Working dir: /data/data/com.termux/files/usr/tmp/Tingle-bcs1i_75
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
Failed to initialize runtime (check log for details)
Traceback (most recent call last):
File "/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py", line 598, in
smali_folder, dex_filename, dex_filename_last = find_smali(smali_to_search, "framework/", DEVICE_SDK)
File "/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py", line 516, in find_smali
disassemble(search_dir+filename, out_dir, device_sdk)
File "/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/main.py", line 483, in disassemble
subprocess.check_call(disass_cmd)
File "/data/data/com.termux/files/usr/lib/python3.7/subprocess.py", line 341, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['/data/data/com.termux/files/usr/bin/dalvikvm', '-Xmx128m', '-cp', '/storage/emulated/0/Download/ale5000-git-tingle-a8fafed/tools/baksmali-dvk.jar', 'org.jf.baksmali.Main', 'dis', '-l', '--seq', '-o', './smali-classes/', 'framework/classes.dex']' returned non-zero exit status 1.
$`
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Running Tingle with an adbd server that already has root privileges causes the program to stall at the following stage:
*** Patching succeeded.
*** Reassembling classes...
DEBUG: Assembling out/classes.dex
*** Recompressing framework...
DEBUG: Compressing framework.jar
*** Copying the patched file to the output folder...
*** Rooting adbd...
DEBUG: adbd is already running as root
### Stalls here
I was able to manually push the framework.jar file from the output folder back onto the phone, however, given that my phone basically requires me to have adbd running as root (or else I get "error: insufficient permissions for device
"), and killing that server just to restart it and have it get elevated privileges is annoying - especially when Tingle keeps insisting that adbd still has root privileges (on subsequent runs).
Help Wanted
I tried to install this library 'libraries' manually but nothing worked so far... I'm using python 3.9.4 btw.
Tried running this on Oneplus 6 (enchilada) w/ LineageOS 17.1
--
[me@me tingle-master]$ sudo python3 main.py
[sudo] password for me:
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
1
*** OS: Linux 5.6.19-2-MANJARO (linux)
*** Python: 3.8.5 (64 bit)
*** Mode: 1
*** Working dir: /tmp/Tingle-j54jx9we
*** Selected device: 4ceedc75
*** Automounting /system...
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', '4ceedc75', 'shell', "case $(mount) in ' /system ') echo 'Already mounted';; *) mount '/system';; esac"]
Return code: 1
Output: mount: bad /etc/fstab: No such file or directory
Traceback (most recent call last):
File "main.py", line 588, in
adb_automount_if_needed(SELECTED_DEVICE, "/system")
File "main.py", line 327, in adb_automount_if_needed
output = safe_subprocess_run([DEPS_PATH["adb"], "-s", chosen_device, "shell", "case $(mount) in ' "+partition+" ') echo 'Already mounted';; *) mount '"+partition+"';; esac"])
File "main.py", line 204, in safe_subprocess_run
return subprocess.check_output(command, stderr=subprocess.STDOUT)
File "/usr/lib/python3.8/subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/usr/lib/python3.8/subprocess.py", line 512, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', '4ceedc75', 'shell', "case $(mount) in ' /system ') echo 'Already mounted';; *) mount '/system';; esac"]' returned non-zero exit status 1.
Modern devices use system-as-root, so the framework can be in /system/system
โ while in the recovery at least. I've been doing this:
diff --git i/main.py w/main.py
index bfa95c9..01850e4 100755
--- i/main.py
+++ w/main.py
@@ -428,7 +428,7 @@ def brew_input_file(mode, files_list, chosen_one):
safe_copy(os.path.join(SCRIPT_DIR, "input", "framework.jar"), os.path.join(TMP_DIR, "framework.jar"))
safe_copy(os.path.join(SCRIPT_DIR, "input", "build.prop"), os.path.join(TMP_DIR, "build.prop"))
else:
- safe_copy("/system/framework/framework.jar", os.path.join(TMP_DIR, "framework.jar"))
+ safe_copy("/system/system/framework/framework.jar", os.path.join(TMP_DIR, "framework.jar"))
def decompress(file, out_dir):
@@ -590,7 +590,7 @@ if mode == 1:
import patches.sig_spoof
patch_instance = patches.sig_spoof.Patch()
files_list = patch_instance.get_files_list()
-files_list.append(["/system", "build.prop"])
+files_list.append(["/system/system", "build.prop"])
brew_input_file(mode, files_list, SELECTED_DEVICE)
@@ -737,7 +737,7 @@ if mode == 1:
print_(" *** Pushing changes to the device...")
try:
if not DEBUG_PROCESS:
- output = safe_subprocess_run([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/framework/framework.jar"])
+ output = safe_subprocess_run([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/system/framework/framework.jar"])
debug(safe_output_decode(output).rstrip())
except subprocess.CalledProcessError:
e = sys.exc_info()[1]
@@ -748,7 +748,7 @@ if mode == 1:
subprocess.check_call([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "reboot", "recovery"])
subprocess.check_call([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "wait-for-device"])
enable_device_writing(SELECTED_DEVICE)
- subprocess.check_output([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/framework/framework.jar"])
+ subprocess.check_output([DEPS_PATH["adb"], "-s", SELECTED_DEVICE, "push", "framework.jar", "/system/system/framework/framework.jar"])
else:
raise
del e
@@ -759,6 +759,6 @@ print_(" *** All done! :)")
print_(os.linesep + "Your original file is present at "+BACKUP_FILE)
if mode != 3:
- print_(os.linesep + "If your device bootloop, please run this command on the pc when the connected device is inside recovery:" + os.linesep + "adb push \""+BACKUP_FILE+"\" /system/framework/framework.jar")
+ print_(os.linesep + "If your device bootloop, please run this command on the pc when the connected device is inside recovery:" + os.linesep + "adb push \""+BACKUP_FILE+"\" /system/system/framework/framework.jar")
else:
print_(os.linesep + "Now you should replace the file on your system with the patched file in the output folder.")
diff --git i/patches/sig_spoof.py w/patches/sig_spoof.py
index 3b91333..47c41e4 100755
--- i/patches/sig_spoof.py
+++ w/patches/sig_spoof.py
@@ -20,4 +20,4 @@ class Patch(sys.BasePatch):
pass
def _set_files_list(self):
- self.files.append(["/system/framework", "framework.jar"])
+ self.files.append(["/system/system/framework", "framework.jar"])
but proper auto-detection would be better of course :)
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
If you get a message like this on windows:
*** OS: Windows 10 (win32)
*** Mode: 2
*** Working dir: c:\users\myuser\appdata\local\temp\Tingle-q_ewlx
*** Decompressing framework...
DEBUG: Decompressing framework.jar
Traceback (most recent call last):
File "main.py", line 408, in <module>
decompress("framework.jar", "framework/")
File "main.py", line 289, in decompress
subprocess.check_output(decomp_cmd)
File "c:\Python27\lib\subprocess.py", line 212, in check_output
process = Popen(stdout=PIPE, *popenargs, **kwargs)
File "c:\Python27\lib\subprocess.py", line 390, in __init__
errread, errwrite)
File "c:\Python27\lib\subprocess.py", line 640, in _execute_child
startupinfo)
WindowsError: [Error 5] Access is denied
This is because the included 7za-win32.exe only runs on 32-bit windows. Despite the message at the top (Windows 10 (win32)) I'm running on x64.
A workaround for anybody else running into this problem:
Hi this is first time i hear about faking google signature
my phone is too slow with google apps ( playstore and playservices )
i really want to use this patch , i need this patch , i try many times but get this error
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
2
*** OS: Windows 10 (win)
*** Python: 3.6.0 (64 bit)
*** Mode: 2
*** Working dir: C:\Users\MOHAMM~1\AppData\Local\Temp\Tingle-kod027kz
*** Device SDK: 21
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
Exception in thread "main" java.lang.UnsupportedClassVersionError: org/jf/baksmali/Main : Unsupported major.minor version 52.0
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(Unknown Source)
at java.security.SecureClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.access$100(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.launcher.LauncherHelper.checkAndLoadMain(Unknown Source)
Traceback (most recent call last):
File "F:\ROMS+sign spoof\tingle-master\main.py", line 598, in
smali_folder, dex_filename, dex_filename_last = find_smali(smali_to_search, "framework/", DEVICE_SDK)
File "F:\ROMS+sign spoof\tingle-master\main.py", line 516, in find_smali
disassemble(search_dir+filename, out_dir, device_sdk)
File "F:\ROMS+sign spoof\tingle-master\main.py", line 483, in disassemble
subprocess.check_call(disass_cmd)
File "C:\Python36\lib\subprocess.py", line 291, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['C:\Windows\system32\java.exe', '-jar', 'F:\ROMS\+sign spoof\tingle-master/tools/baksmali.jar', 'dis', '-l', '--seq', '-o', './smali-classes/', 'framework/classes.dex', '-a', '21']' returned non-zero exit status 1.
here is files you need
https://mega.nz/#!cAdGlKzA!JAdAvJ1Z674BFMCyXX0dT-BDG_uj-F_zguf_39rO46s
thanks alot for your help , sorry for my english
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
I'm on Ubuntu 16.04. All dependencies loaded (according to the script). I had to go out and get 7za, no biggie.
It seemed to almost make it through, but I know the internal structure of the Pixel series is a bit different, so I'm not totally surprised it failed. Any other info you need?
*** OS: Linux 4.8.0-53-generic (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-j7p3w0_s
*** Selected device: FA6C30304014
*** Pulling framework from device...
DEBUG: 3273 KB/s (16502976 bytes in 4.923s)
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
*** Patching...
*** Detected: Android 7.x / Android 6.0.x / CyanogenMod 13-14
*** Patching succeeded.
*** Reassembling classes...
DEBUG: Assembling out/classes.dex
*** Recompressing framework...
DEBUG: Compressing framework.jar
*** Copying the patched file to the output folder...
*** Rooting adbd...
DEBUG: restarting adbd as root
*** Unlocked ADB: True
*** Remounting /system...
error: protocol fault (no status)
Traceback (most recent call last):
File "main.py", line 536, in <module>
enable_device_writing(SELECTED_DEVICE)
File "main.py", line 219, in enable_device_writing
remount_check = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_device, "remount", "/system"]).decode("utf-8")
File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
**kwargs).stdout
File "/usr/lib/python3.5/subprocess.py", line 708, in run
output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'FA6C30304014', 'remount', '/system']' returned non-zero exit status 1
Can you add instructions for manual pushing? And perhaps what permissions to set if necessary?
EDIT: Almost forgot this. When I push apps to /system, I have to go here:
/system/system/priv-app
So I think the path needed to push this file back to the Pixel device is:
/system/system/framework/framework.jar
Ironically, when viewing the file system within the OS, you don't see that, but in TWRP it's as clear as day.
Trying it manually in TWRP now.
EDIT (final): It worked!!
I used TWRP to copy the patched framework.jar on my pc (in the "output" folder of this script) into:
/system/system/framework[/framework.jar]
Did chmod 644, pushed gsm_core.apk to /system/system/priv_app and did chmod 644 for the apk. Rebooted and GSM Core reports signature spoofing enabled! Still further testing needed, but we're at the 95% mark on Pixel :-D
Hopefully the script can be updated to fully automate the process as intended!
EDIT: I just got haystack working... only issue was the script didn't wait long enough for remount (device appeared to be unplugged I guess?). Maybe that's the issue in this script a well. On a separate note, within the OS, /system/framework does exist, but under TWRP or bootloader, it's actually /system/system/framework.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Tingle didn't show any error, and everything else shows as okay in microg (including signature spoofing). Device restart did not help. Any idea how to fix this?
Device: LG G4
Android version: LineageOS 14.1-20170131-NIGHTLY
microg version: 0.2.4-55-g4c4086a
Can Tingle patch with adb started from TWRP Recovery?
I want to patch my phone (Samsung Galaxy S3 Mini with unofficial CM12.1) with Tingle and it seemed to work, but it didn't finish the process. This is how far I got in the (Linux) Terminal:
$ python main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
> 1
*** OS: Linux 4.4.0-59-generic (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-3sT0Ca
*** Selected device: 479000eae2b811ba
*** Pulling framework from device...
DEBUG: 4004 KB/s (5535794 bytes in 1.349s)
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
*** Patching...
*** Detected: Android 5.x / CyanogenMod 12
*** Patching succeeded.
*** Reassembling classes...
DEBUG: Assembling out/classes.dex
*** Recompressing framework...
DEBUG: Compressing framework.jar
*** Copying the patched file to the output folder...
*** Rooting adbd...
DEBUG: restarting adbd as root
*** Unlocked ADB: True
*** Remounting /system...
At this point, it stops going further, but it didn't crash. I'm not able to get a logcat (adb logcat
in a different Terminal seems to hang as well and doesn't produce any output).
Any idea what could cause this? And what to do to get around?
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
I hereby express the wish to add a -h
|--help
option which briefly describes what this software does, how to use it, and which input files are needed.
Regards and thanks for this software!
Currently running CM13 with CM recovery
Installed Tingle but experienced major problem
So trying to reverse using following steps:
In recovery, mount /system
$ adb push "./output/framework.jar.backup" /system/framework/framework.jar
But looks like there is no adb support in CM recovery
No other recovery exists for my phone
How can I revert?
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
How does this app control/limit, which apps can spoof signatures?
Haystack e.g. does/did it via permissions and an entry in the developer tools. How does tingle control it?
Allowing all apps to spoof signatures is obviously dangerous.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
I become the following error, can you help me?
1 - From the device (adb) 2 - From the input folder
1
*** OS: Windows 10 (win32)
*** Mode: 1
*** Selected device: TAXXXXFKP1
*** Working dir: c:\users\user\appdata\local\temp\tmpazekga
*** Pulling framework from device...
100 KB/s (310 bytes in 0.003s)
*** Disassembling framework...ERROR: No dex file(s) found, probably your file is odexed.
ERROR CODE: 86
I have Install cm13 nightly for falcon device
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
i got in this bad situation here where i patched multiple times. eventually, i wanted to back to the original non-spoofed signature, but because i ran tingle multiple times, the .backup
file now refers to an already patched version tingle had downloaded from the phone...
it would seem preferable to rotate those backups or at least not overwrite them to avoid dataloss.
My new ROM contains a very small framework.jar file:
user@computer:/mnt/img/framework$ find . -ls |grep framework
826 4344 -rw-r--r-- 1 root root 4448256 Dec 31 2008 ./arm/boot-framework.art
827 36716 -rw-r--r-- 1 root root 37595032 Dec 31 2008 ./arm/boot-framework.oat
832 28 -rw-r--r-- 1 root root 28672 Dec 31 2008 ./arm/boot-mediatek-framework.art
833 276 -rw-r--r-- 1 root root 280812 Dec 31 2008 ./arm/boot-mediatek-framework.oat
859 6560 -rw-r--r-- 1 root root 6717440 Dec 31 2008 ./arm64/boot-framework.art
860 42756 -rw-r--r-- 1 root root 43778800 Dec 31 2008 ./arm64/boot-framework.oat
865 36 -rw-r--r-- 1 root root 36864 Dec 31 2008 ./arm64/boot-mediatek-framework.art
866 288 -rw-r--r-- 1 root root 293280 Dec 31 2008 ./arm64/boot-mediatek-framework.oat
896 19668 -rw-r--r-- 1 root root 20137075 Dec 31 2008 ./framework-res.apk
897 4 -rw-r--r-- 1 root root 126 Dec 31 2008 ./framework.jar
905 4 -rw-r--r-- 1 root root 310 Dec 31 2008 ./mediatek-framework.jar
Running tingle:
user@computer:/tmp/tingle-master$ ./main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
> 1
*** OS: Linux 4.11.0-1-amd64 (linux)
*** Python: 2.7.13 (64 bit)
*** Mode: 1
*** Working dir: /tmp/Tingle-_lXrCz
*** Selected device: CE7P8LKRZHAAYLCI
*** Pulling framework from device...
DEBUG: [100%] /system/framework/framework.jar
*** Device SDK: 24
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
ERROR: No dex file(s) found, probably the ROM is odexed.
ERROR CODE: 86
user@computer:/tmp/tingle-master$
There are no .odex files. What am I doing wrong?
logcat.txt
Restoring the framework.jar
doesn't help either
07-31 12:58:20.804 1154 1154 I dex2oat : /system/bin/dex2oat --compiler-filter=interpret-only -j2
07-31 12:58:20.804 1154 1154 E cutils-trace: Error opening trace file: No such file or directory (2)
07-31 12:58:20.848 1154 1154 I dex2oat : dex2oat took 45.193ms (threads: 2) arena alloc=7KB (7912B) java alloc=69KB (7
0856B) native alloc=1043KB (1068864B) free=1516KB (1552576B)
07-31 12:58:20.880 855 855 I PackageManager.DexOptimizer: Running dexopt (dex2oat) on: /data/app/com.google.android.
apps.maps-1/base.apk pkg=com.google.android.apps.maps isa=arm vmSafeMode=false debuggable=false target-filter=verify-pro
file oatDir = /data/app/com.google.android.apps.maps-1/oat sharedLibraries=null
07-31 12:58:20.921 1157 1157 E cutils-trace: Error opening trace file: No such file or directory (2)
07-31 12:58:20.943 1157 1157 I dex2oat : /system/bin/dex2oat --compiler-filter=verify-profile -j2 --profile-file-fd=7
07-31 12:58:23.838 1157 1157 I dex2oat : Large app, accepted running with swap.
When I try to install the patch, I get the following error message: NameError: name 'true' is not defined. Did you mean: 'True'?
I tried the Needle patch first and got the same error message except the undefined word was false.
ERROR INFO
==========
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', 'ZX1D23F8R7', 'pull', '/system/build.prop', '.']
Return code: 1
Output: adb: error: failed to copy '/system/build.prop' to './build.prop': remote open failed: Permission denied
ERROR CODE: 90
On Motorola Moto G 2nd gen (2014) titan
Tried first Magisk, then SuperSu, none worked.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Hello, I tried using tingle with my installation of Windows 7 and get following error:
I installed Java and ADB correctly before, enabled USB Debugging on my Android Smartphone, allowed root access for ADB.
Traceback (most recent call last):
File "main.py", line 405, in <module>
brew_input_file(mode, chosen_one)
File "main.py", line 264, in brew_input_file
output = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_one, "pull", "/system/framework/framework.jar", "."]
File "C:\Python27\lib\subprocess.py", line 390, in __init__ errread, errwrite)
File "C:\Python27\lib\subprocess.py", line 640, in _execute_child startupinfo)
WindowsError: [Error 2] The system can't file the corresponding file
I'd be really happy about some help.
For me script crashes on "Remounting /system..." step
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
> 1
*** OS: Linux 4.14.9-1-ARCH (linux)
*** Python: 3.6.4 (64 bit)
*** Mode: 1
*** Working dir: /tmp/Tingle-x2vr8_to
*** Selected device: 43f8c4790903
*** Automounting /system...
DEBUG: Already mounted
*** Pulling framework from device...
*** Device SDK: 25
*** Decompressing framework...
DEBUG: Decompressing framework.jar
*** Disassembling classes...
DEBUG: Disassembling framework/classes.dex
*** Patching...
*** Detected: Android 8.x / 7.x / 6.x (or LOS/CM 13-15)
*** Patching succeeded.
*** Reassembling classes...
DEBUG: Assembling out/classes.dex
WARNING: The reassembling has failed (probably we have exceeded the 64K methods limit)
but do NOT worry, we will retry.
*** Moving methods...
WARNING: Experimental code.
DEBUG: Disassembling framework/classes2.dex
*** Reassembling classes...
DEBUG: Assembling out/classes.dex
DEBUG: Assembling out/classes2.dex
*** Recompressing framework...
DEBUG: Compressing framework.jar
*** Copying the patched file to the output folder...
*** Rooting adbd...
DEBUG: adbd cannot run as root in production builds
*** Unlocked ADB: False
*** Remounting /system...
ERROR INFO
==========
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', '43f8c4790903', 'shell', "su -c 'mount -o remount,rw /system /system && mount' | grep ' /system '"]
Return code: 1
Output: mount: '/system' not in /proc/mounts
Traceback (most recent call last):
File "./main.py", line 720, in <module>
enable_device_writing(SELECTED_DEVICE)
File "./main.py", line 365, in enable_device_writing
remount_check = safe_output_decode(safe_subprocess_run([DEPS_PATH["adb"], "-s", chosen_device, "shell", "su -c 'mount -o remount,rw /system /system && mount' | grep ' /system '"])) # Untested
File "./main.py", line 203, in safe_subprocess_run
return subprocess.check_output(command, stderr=subprocess.STDOUT)
File "/usr/lib/python3.6/subprocess.py", line 336, in check_output
**kwargs).stdout
File "/usr/lib/python3.6/subprocess.py", line 418, in run
output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', '43f8c4790903', 'shell', "su -c 'mount -o remount,rw /system /system && mount' | grep ' /system '"]' returned non-zero exit status 1.
Phone is Xiaomi Redmi Note 4X running AospExtented v4.6/Android 7.1.2, rooted via Magisk if it makes the difference.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Hi,
Your patch sends me errors for both methods.
In fact, the Huawei P7 file/folder architectures seems to be my problem (and since i'm not the first Huawei owner encountering difficulties i bet solving this issue would help others too)...i admit i don't know much about file/folder architectures of other devices:
All the *.dex files are in : data/dalvik-cache/arm and are named typically directoryX@directoryY@directoryZ@[email protected] (for AirSharing given above, directoryX is "system", directoryY is "app", directoryZ is "AirSharing", appname is AirSharing)
So what do you advice me in order to spoof app signatures?
I'll try to put all *.jar with their associated *.dex in tingle-master/input folder and execute main.py...
If you think the problem doesn't lie here or if you have a better idea, please let me know.
If you implement a new tingle to fix this issue, i'll take it too ;-)
Bye
Tried running Tingle on my Moto G6 Plus to patch the Lineage OS install I have, but when I try to run main.py, I get this:
$ ./main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
> 1
*** OS: Linux 4.19.0-5-amd64 (linux)
*** Python: 2.7.16 (64 bit)
*** Mode: 1
*** Working dir: /tmp/Tingle-lIHv9p
*** Selected device: ZY322TXVZ4
*** Automounting /system...
DEBUG: Already mounted
*** Pulling framework from device...
ERROR INFO
==========
Type: <class 'subprocess.CalledProcessError'>
Cmd: ['/usr/bin/adb', '-s', u'ZY322TXVZ4', 'pull', '/system/build.prop', '.']
Return code: 1
Output: adb: error: failed to copy '/system/build.prop' to './build.prop': remote open failed: Permission denied
ERROR CODE: 90
I made sure that I have superuser privileges by entering the shell through adb and typing 'su'.
Here's the logcat:
logcat.tar.gz
I try to use Tingle on ROMs from this site:
http://download.jesec.io/
These are unofficial for the S7, but official LineageOS ROMs have the same problem.
Tingle can't deal with those ROMs as framework.jar does not contain .dex files. It assumes they are odexed.
Un-odexer tools cannot deal with the ROMs, too, as they don't contain .odex files. So they are recognized as already unodexed.
I already used a modified stock ROM (called SuperMan) on this S7. Tingle deals with that one flawlessly.
I'm now a bit at a loss. Am I doing something completely wrong with the AOSP ROMs?
I need /system/framework/framework.jar
from Android O for testing.
If you want to help me, send me the file please.
Informational -- maybe you want to add it to your README.md
:
There is an Arch Linux package of this in the AUR: tingle-git
.
Regards!
Maybe you should add the information that you have to install 7zip on macOS in the Terminal.
https://superuser.com/questions/548349/how-can-i-install-7zip-so-i-can-run-it-from-terminal-on-os-x
hi,
how does this work? i suppose applying a text diff over backsmalied framework? then this is kind of brittle and will break often with minute framework changes, and could require different diffs for different roms.
consider using dexpatcher instead. i could look into it myself but im travelling and have no time now. disadvantage: less granularity to do changes. advantages: much much less brittle, changes in java without having the exact source code, seems like changes might be very simply implemented as method wrappers. also, dexpatcher can run on the device itself (pure java), and it could probably be cross compiled to native to support patching in recovery; the addon.d mechanism to repatch on system upgrade is even possible.
i can help with the coding of the dexpatcher patch.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Hi,
Coming from microg/UnifiedNlp#133, I wanted to give the unofficial microG installer a try (from https://forum.xda-developers.com/android/development/microg-unofficial-installer-t3432360).
Since I'm using LineageOS 14.1, I first need to add signature spoofing, so i came here to try Tingle.
I downloaded the current version, but here's the output :
`python main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
1
*** OS: Linux 4.10.0-22-generic (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-sCi2uB
*** Selected device: ????????????
Traceback (most recent call last):
File "main.py", line 402, in
OUTPUT_PATH = os.path.join(SCRIPT_DIR, "output", SELECTED_DEVICE)
File "/usr/lib/python2.7/posixpath.py", line 73, in join
path += '/' + b
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 16: ordinal not in range(128)`
That must be some kind of UTF-8 encoding issue, right ?
Need testing on 64-bit phones since I don't have any 64-bit phone.
I have a phone running CM13 with CM recovery
Booted to recovery and sideloaded CM update zip
Then went to Advanced >> Mount /system
When trying to run Tingle get the following error:
$ python3 main.py
MENU
1 - Patch file from a device (adb)
2 - Patch file from the input folder
> 1
*** OS: Linux 4.8.0-1-amd64 (linux)
*** Mode: 1
*** Working dir: /tmp/Tingle-k1k5i_h3
*** Selected device: WbSPARKPJH0025693
*** Pulling framework from device...
Traceback (most recent call last):
File "main.py", line 396, in <module>
brew_input_file(mode, chosen_one)
File "main.py", line 263, in brew_input_file
output = subprocess.check_output([DEPS_PATH["adb"], "-s", chosen_one, "pull", "/system/framework/framework.jar", "."], stderr=subprocess.STDOUT)
File "/usr/lib/python3.5/subprocess.py", line 626, in check_output
**kwargs).stdout
File "/usr/lib/python3.5/subprocess.py", line 708, in run
output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['/usr/bin/adb', '-s', 'WbSPARKPJH0025693', 'pull', '/system/framework/framework.jar', '.']' returned non-zero exit status 1
What am I doing wrong?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.