Faker Unlocker — Xposed Module

An Xposed/LSPosed module that unlocks all VIP features in Android Faker v2 beta (com.android1500.androidfaker) for educational/practice purposes.

Usage

Steps

1. Install the APK on your device
2. Enable the module in LSPosed/Xposed:
   • Open LSPosed Manager
   • Enable "Faker Unlocker"
   • Scope: com.android1500.androidfaker (should auto-select) and any other app that you want to spoof (the target apps for Android Faker)
   • Force stop Android Faker and reopen

What It Does

This module hooks into Android Faker's app process and bypasses all VIP/premium feature gates:

Architecture (version 2.0.0-beta-9-5)

Hook Layer 1 — Source of Truth
  ms6.b()   → true            Core isVip check (cascades to all ViewModels)
  ms6$a.d() → 1               Account vipStatus
  ms6$a.c() → year 2100       Account vipDueDate

Hook Layer 2 — Native Stability & DEX Spoofing in Target Apps
  Runtime.loadLibrary0        → Blocks "af_native" to prevent anti-tamper kill thread
  Native.doInit               → returns true (anti-tamper bypass)
  Native.getDex               → serves XOR-decrypted payload (via DexExtractor)

Hook Layer 3 — Static Utility Methods
  tg2.w()   → isVipUser=true  Randomization of VIP-only fields
  tg2.j()   → isVipUser=true  Device model application

Hook Layer 4 — UI Display (Cosmetic)
  d6.c()    → 1               UserInfo Parcelable vipStatus
  d6.a()    → year 2100       UserInfo Parcelable dueDate

Hook Layer 5 — Anti-Tamper
  ep5.d()   → true            APK signature verification bypass

Native Stability & SPOOFING (Runtime Extraction)

Android Faker distributes its spoofing classes3.dex payload inside libaf_native.so as an XOR-encrypted blob to evade detection. To safely serve this payload to target apps:

1. Target Crash Prevention: Android Faker spawns an anti-tamper thread (kill()) from JNI_OnLoad when hooking target apps. The module hooks Runtime.loadLibrary0 to block libaf_native.so entirely, preventing the kill thread.
2. Runtime DEX Extraction: Since the .so is blocked, Native.getDex() is no longer available in memory. The module dynamically scans libaf_native.so (either from the filesystem or by extracting it directly from the Faker APK ZIP using DexExtractor), finds the XOR cipher (0x32), and decrypts the DEX blob at runtime.
3. Serving the Payload: It intercepts Native.doInit (bypassing anti-tamper constraints) and Native.getDex(), seamlessly serving the runtime-decrypted DEX directly into memory. No manual extraction needed!

VIP Flow (How It Works)

ms6$a.vipDueDate (account field)
  ↓
ms6.b() — compares vipDueDate > currentTime/1000  ← HOOKED (always true)
  ↓
AuthRepository.userStateFlow → StateFlow<ms6>
  ↓
ViewModels observe flow → extract ms6.b() into isVipUser Boolean
  ↓
UI state classes: fr4.isVipUser, HookState.isVipUser
  ↓
Feature gates: m15039k().getIsVipUser() == Boolean.TRUE → ALWAYS PASSES

Class Name Mapping

Building

Prerequisites

• Android Studio (or Gradle CLI)
• Android SDK 34+
• JDK 11+

Steps

1. Open FakerUnlocker/ in Android Studio as a project
2. Sync Gradle
3. Build → Build APK (./gradlew assembleDebug)

Manual Build (CLI)

cd FakerUnlocker
./gradlew assembleDebug
# APK at: app/build/outputs/apk/debug/app-debug.apk

Logs

Check Xposed/LSPosed logs for hook status:

adb logcat | grep FakerUnlocker

Expected output:

FakerUnlocker: Hooking com.android1500.androidfaker
FakerUnlocker: [OK] ms6.b() → true (core VIP check)
FakerUnlocker: [OK] ms6$a.d() → 1 (VIP status)
FakerUnlocker: [OK] tg2.w() → isVipUser forced true (randomization)
FakerUnlocker: [OK] d6.c() → 1 (UserInfo VIP status)
FakerUnlocker: [OK] ep5.d(Context) → true (signature bypass)
FakerUnlocker: All hooks installed successfully

And in target apps (where location/device info spoofing is applied):

FakerUnlocker: Installing target-app native stability (block + lazy DEX extraction)
FakerUnlocker: [BLOCKED] System.loadLibrary("af_native") — kill thread prevention
FakerUnlocker: [OK] Native.doInit → true
FakerUnlocker: [OK] DEX from Faker APK: 53584 bytes
FakerUnlocker: [SERVED] getDex() → 53584 bytes

Troubleshooting

App crashes after enabling module

Android Faker's native library (libaf_native.so) has extensive anti-tamper:

• /proc/self/maps scanning for RWX memory pages
• ARM64 trampoline detection on libc.so functions (inline hook detection)
• libart.so byte-level integrity comparison (disk vs memory)
• libandroid_runtime.so integrity checks
• TracerPid / ptrace / wchan detection
• Frida thread & memory detection

If the app crashes, try:

1. Use Shamiko (Zygisk module) to hide Xposed from Android Faker
2. Use LSPosed in Zygisk mode (stealthier than Riru)
3. Deny-list the app in Magisk Hide / Zygisk

Hook method not found

If you see [FAIL] messages, the app may have been updated with new obfuscation. The obfuscated names (b, w, j, etc.) change between R8 builds. You'll need to re-analyze the APK with JADX and update the method names.

Disclaimer

This module is created for educational purposes only as part of a reverse engineering practice lab. Do not use it to circumvent legitimate software protections in production.