Skip to content

v0.0.3

Choose a tag to compare

View all tags
@SysAdminDoc SysAdminDoc released this 02 Oct 02:02
· 133 commits to main since this release
v0.0.3
7b3a63a

HushGram v0.0.3 has 35 patches for Instagram 449.0.0.52.84 (arm64-v8a, version code 385511871), fourteen more than v0.0.2. It still runs on Android 9 and newer. Most of the new patches were asked for in #1.

Before you sign in, read the section of that name in the README. A re-signed Instagram can't pass Google's Play Store check whatever the patches do, so a spare account keeps your main one out of it.

New patches

  • Hide suggested posts. Posts and reels from accounts you don't follow come out of your home feed, along with the rows of suggested accounts and what Instagram mixes in from Threads. Each has its own switch in a new Feed section. If nobody you follow has posted lately, Home shows Instagram's own welcome card instead of a placeholder that never loads.
  • Start Home on Following, off until you pick it. Home opens on accounts you follow, with Instagram's own picker at the top for switching to For you or Favorites. Turn on Only accounts you follow under it and For you leaves the picker.
  • Hide suggested stories. Stories from accounts you don't follow leave the row at the top of Home. A second switch, off to start, takes the whole row away.
  • Hide Meta AI. The search bars in the Search tab and in your messages go back to a plain search, and a search's results lose the "Ask a follow-up" bar. Home's top bar loses Meta AI's buttons, and Meta AI's videos and chats come out of your feed too.
  • Hide the Explore grid, off until you pick it. The Search tab keeps its search bar and the grid of posts and reels under it is gone. Searching still works.
  • Keep the reel speed. Lock a reel at 2x with Instagram's own lock and the next reels play at 2x as well. Slide the lock off, or restart Instagram, to go back to normal speed. Ads always start at normal speed.
  • Show if a profile follows you. Someone's profile says Follows you or Doesn't follow you beside their name. piko had it first.
  • Remove the empty space at the bottom, off until you pick it. When your phone hides its navigation bar completely, or Instagram runs in a pop-up window, the tab bar sits on the bottom edge instead of over an empty strip. MyInsta and piko had this fix first.
  • Hide the Repost button, off until you pick it. The Repost button and its count are gone from posts and reels. Share still sends a post to someone.
  • Story ring size, off until you pick it. The rings in the stories row can be drawn anywhere from 70% to 130% of Instagram's size.
  • Hide group buttons on the share sheet, off until you pick it. The New group button next to the share sheet's search bar is gone, and so is the button that sends to several picked people as a group, which leaves Send separately.
  • Pure black dark mode, off until you pick it. Dark mode's near-black gray becomes pure black. Menus and sheets keep their own grays, so nothing disappears into the background.
  • Open developer options, off until you pick it. A long press on the Home tab opens Instagram's own developer options, where its server flags can be looked at and overridden. piko had the idea first.
  • Start on x86 devices, from Hushfacebook. Instagram stops crashing or freezing on an x86 device that runs its arm code through Android's translator, like an x86 Chromebook or an emulator. Phones with arm chips run as before.

Fixes and changes

  • Turn off double tap to like has two switches under it, On posts and On reels, so you can keep double tap to like on posts and still not like a reel by accident. Asked for in #6.
  • Clean up Reels also hides the floating bubbles of friends who liked or commented and the Liked by and Followed by line with friends' faces. Reported in #7.
  • Download any video works on a carousel and saves the page that's on screen. Turn on Download feed photos and photo posts get a Download row too, saving the largest size Instagram has.
  • Disable analytics now refuses Instagram's crash reports and startup pings to b-www.facebook.com and keeps usage events off its realtime stream. It also skips the "Set up on new device" screens asking for contacts and location, which would otherwise come back on every start. piko found that loop first.
  • Open links in external browser keeps a link you follow inside an ad's page in the app, with the ad.
  • Tap to play and Download any reel read Instagram's yes or no answers in a form that still loads if an update changes how they're returned.
  • Resume long videos has a Clear remembered positions row that deletes the spots it keeps and cancels any restore that's waiting, even when playback is off or paused. Tap it again within 10 seconds to undo once.
  • Ring size, Playback quality and Only accounts you follow say which switch turns them on while that switch is off, and keep your choice.
  • The HushGram row at the top of Settings and activity wraps its title at large text sizes instead of cutting it off.
  • The Before you sign in notice and the README's sign-in advice stick to what's known. They no longer rank install methods by risk. The notice is updated in all five translations.
  • With Debug logging on, the diagnostic report shows how many of their code targets Disable analytics, Sanitize sharing links and Start on x86 devices found when you patched.
  • View stories anonymously now says what a phone showed. A story you've watched keeps its colored ring and keeps showing as new.

Under the hood

  • The build moved to Gradle 9.8.0 and Guava 33.7.2, which fixes GHSA-xxph-c9ww-hj94. Guava only runs while the patches are built, and the bundle doesn't ship it.
  • The dependency audit now checks the build's own tools apart from the shipped bundle. Netty, JDOM and jose4j in those tools moved past their affected versions.
  • Eighteen more hooks are pinned in the patched-build check, and a hook that takes a boolean fails the build.
  • The release receipt reads each patch's target coverage out of the patched APK, so a required target that's missing stops the release even when its patch applied.
  • Every script that came over from Hushfacebook names the commit it came from.
  • The release tooling's own tests no longer refuse the source commit of a release after the first one.

Update steps

  1. You need Morphe Manager 1.32.0 or newer. If HushGram is already a source, update it there. Otherwise add it with this link: https://morphe.software/add-source?github=SysAdminDoc%2FHushGram
  2. Patch Instagram 449.0.0.52.84, the arm64-v8a build with version code 385511871. That's the build these patches were checked against.
  3. Install over your current HushGram build with the same Manager signing key. Android keeps Instagram's data that way, so you stay signed in. A different key means uninstalling first.
  4. The .mpp here is a patch bundle for Morphe Manager, not an Instagram APK.

Known limitations

  • Start on x86 devices hasn't been tried on an x86 device yet. On an arm phone Instagram starts and runs as before.
  • A few parts of this release were checked in tests and against Instagram's code but never seen on a phone, because the test account doesn't get them. That covers Home's Meta AI buttons, suggested stories in the stories row, friends' activity in Reels, a profile that shows Follows you, and sending to a group from the share sheet.
  • Clear remembered positions and its Undo were checked in tests and an offscreen preview, not on a phone yet.
  • Tap to play leaving a reel stopped by a tappable sticker to Instagram was read from Instagram 449's code. No reel like that turned up on a phone.
  • Instagram 449 ignores an Arabic app language, so HushGram's right-to-left layout was only checked with Android's forced right-to-left setting.
  • Sanitize sharing links cleans what Copy link and Share hand out on 449. Instagram's server adds the stkn key, and no scan of the app shows it, so a new Instagram build needs a real shared link checked.
  • The diagnostic report's target counts say what matched when you patched. They don't show that a request was stopped while the app ran.
  • A re-signed Instagram can't pass Google's Play Store check, and Instagram checks the app when you sign in.

Validation

658 runtime tests and 369 patch tests passed locally, none skipped, including the tests that read the real Instagram build. All 35 patches applied to Instagram 449.0.0.52.84 (version code 385511871) without forcing, and the patched build passed the resource table and injected-code checks. Disable analytics found all 7 of its code targets, Sanitize sharing links all 5 and Start on x86 devices both of its 2. The manifest changes only by the three advertising permissions Remove the advertising ID takes out. OSV has no advisory for any library the bundle carries (gson 2.14.0, kotlin-stdlib 2.4.20 and annotations 13.0).

Every file here is listed in SHA256SUMS.txt, and release-receipt-0.0.3.json says what applied to Instagram 449.0.0.52.84 and which toolchain built the bundle.

Assets 6
Loading