Skip to content

1.3.0

Choose a tag to compare

View all tags
@Bouteillepleine Bouteillepleine released this 16 Aug 19:28
· 26 commits to master since this release
v1.3.0
6cf7fa2

Framework mode now works, and it is the recommended way to use DuckUSB: one hook in system_server covers every app at once, with no per-app scope.

⚠️ Scope the right entry

In LSPosed → DuckUSB → Scope, tick "Cadre du sous-système" / package system.

Not "Système Android" / package android — that one does not inject into system_server. Picking it gives you a module that looks enabled and silently does nothing. This release declares an xposedscope recommendation so LSPosed highlights the correct entries. Reboot after scoping.

What's new

  • Framework mode, hooking ContentProvider.attachInfo and then only the settings provider's call(), matched by authority so ROMs that subclass SettingsProvider still work. Callers below uid 10000 (root / system / shell) always see the truth, so adb and the Settings toggle keep working.
  • Diagnostics that prove it. A small binder service inside system_server (never registered with ServiceManager) reports the hook count, uptime, and every caller that was lied to since boot with per-key counts. A mis-scoped module used to look identical to a working one.
  • Live config. Toggles push to system_server over that binder and apply immediately, no reboot.
  • Pause switch — stops all spoofing at once. It does not uninstall hooks or unload the native library; LSPosed's own switch remains the real off.
  • Property spoof is now automatic in scoped non-core apps — the toggle is gone. Scoping an app already states the intent.
  • Mutually exclusive settings layers. Framework mode and per-app spoof cover the same ground; whichever is on greys out the other.
  • UI: merged status card, collapsible caller list, light/dark toggle, regrouped sections, optional verbose logging.

Fixed

  • sys.usb.ffs.ready is no longer spoofed. It is the USB function-filesystem ready flag — machinery the USB stack acts on, not telemetry a detector reads. Claiming 0 could take the whole USB gadget down: no MTP and no adb.
  • Core processes are properly protected. handleLoadPackage fires once per package hosted in a process, not once per process — with the system scope, system_server reports android, com.android.providers.settings, com.android.location.fused, com.android.server.telecom and more, all at uid 1000. The old package-name check caught only the first, so the property spoof could install inside system_server. Now guarded three ways: uid, process name, and package name.
  • OS file-transfer plumbing is spared from both spoofs — com.android.mtp and friends run at app uids, so the uid guard alone does not reach them.

Upgrading

Signed with the same key as 1.1, so this installs as an in-place update — no uninstall, and your LSPosed enable/scope is preserved.

Tested on

OnePlus 15 (CPH2747) / OxygenOS / Android 16 with LSPosed + KernelSU. Framework mode is verified there and nowhere else; other ROMs are unknown, though the provider is matched by authority and the guards key off uid and process name rather than OEM-specific package names.

Assets 3
Loading