Doppel 2.3

Doppel 2.3: support for Android 17, a new Read languages group, far fewer details that fingerprint a device, ids of device makers, commands refused instead of rewritten, and search on the screen of an app.

Read this first if you used 2.2:

• The fake boot time of 2.2 is removed. Hooks on SystemClock.elapsedRealtime do not reach compiled app code on Android 12 and later, so apps got a mix of fake and real times, like WhatsApp voice notes 35 minutes long, and could still work out the real boot time.
• Commands of restricted apps are refused, no longer rewritten. A restricted app runs no program, like one which may not run (Cannot run program: error=13, Permission denied), so no shell trick reaches the data the other hooks fake. Programs in the app's own native library folder still run. This applies to Run commands and to the groups whose values commands could read. Allowed commands and Allowed command lines in Fake values are gone.
• Custom scripts: scripts now only get the base, bit32, math, string, table, os (time, date, clock, difftime) and luajava libraries. io, coroutine, package, dofile, loadfile, string.dump and luajava.loadLib are gone, so a definition of your own using them stops working.
• The fake id of SD cards is removed: it hid nothing, since paths keep the real one, and it broke apps using it.

Android 17

• Apps targeting Android 17 get the fake Build fields too.
• Definitions for Android 17 hook the advertising id and identifier services again, after ServiceDispatcher.doConnected changed.
• Files.exists sees hidden files as gone again, also for VPN interfaces.

Privacy

• Read languages, a new group: fakes the device languages from one setting (Languages in Fake values, default en-US) through the default locale, locale list, ICU and properties, and keeps the language chosen for the app. New groups are off, so turn it on where you want it.
• Device fingerprints: codec names without the chip vendor, OpenGL ES and EGL extensions without those of vendors, GPU renderer and vendor unknown, 8 processors, /proc/cpuinfo and /proc/meminfo reduced to what kernels print, fonts of device makers left out, memory limits rounded, plain thermal, audio output and vibrator details, and display density which agrees with the screen.
• Device makers: identifier services of Xiaomi, OPPO (HeyTap), Samsung, Huawei, Honor, Nubia and MSA are denied, also when they reuse a known Binder interface, with their id providers and ids in settings.
• Fake DRM id: comes from the fake Android ID, so it is per app and new each boot. It was zeros, one id which never changed, which libraries use as a device id. The Widevine system id stays real, since DRM apps like Netflix verify the device with it.
• Photos and videos: no location in EXIF, original media and video metadata. Do not restrict Get location for camera, gallery and photo editing apps.
• Network: the local IP of sockets, /proc/net and network commands are hidden, and a request for VPN networks finds none.
• Hidden apps: left out of many more lookups, like install sessions, network and storage statistics, device admins, account types, sync adapters, sticky broadcasts, intent selectors, AppOps checks and the live wallpaper.
• Files: hidden files stay hidden by File.getCanonicalPath, through paths like /./, //, .., /proc/self/root and /proc/self/cwd, and in their sizes, times and folder listings. More hardware, root and Magisk files are hidden.
• Tracking: the User-Agent of OkHttp and HttpURLConnection is reduced like WebView, Amazon APS, Google Analytics and Firebase consent are off through their own opt-outs, and hooks install in apps shrunk by R8, like OkHttp in LinkedIn. More SDKs are covered, like Umeng and Unity Ads.
• Security: the Doppel app of another user or a work profile no longer reads the data of the owner, only the owner changes definitions, the framework service is accepted only from root or system, and release builds no longer log setting values.

Interface

• Search on the screen of an app, in groups and hooks.
• Open the app with a button in the toolbar of its screen. View log is now View activity, like the tab.
• Screens offer Retry when loading fails and show an error when the service did not answer, instead of a false Saved or an empty list. Backups no longer come out empty.
• A notification tells when the service cannot load its data, since restricted apps start without hooks then.
• The editor asks before replacing a definition, and imports and restores ask before replacing built-in definitions. A restore names the definitions of a backup, whose scripts run inside the apps they restrict.
• Better screen reader support, colors, spacing, RTL and shorter labels.

Speed

• Scripts of definitions go only to the screens which need them, instead of 4.8 MB of shared scripts.
• Usage reports are sent and written in batches, and each boot resets only what needs it.

Fixes

• Apps with Read VPN restricted no longer crash when a VPN connects, or when they copy or parcel its network info.
• unbindService no longer crashes an app after a refused bind to a hidden app.
• Links open in a visible app when a hidden app is the default browser.
• Media rows of Android 8.1 and 9 keep exact dates.
• An app reinstalled with its data keeps its restrictions, and an archived app added again keeps them too.
• A restore leaves out what it cannot read instead of stopping halfway, and checks that scripts compile.
• A corrupt database opens again without a reboot.

Downloads

• FCM lookups are per thread and only of Play services, with no real values in the log.
• New: WallpaperManager.getDrawable/which hides the wallpaper from getDrawable(int) of Android 14 and later.
• All definitions now start at Android 8.1, with their versions raised, so Downloads shows them as updates.

Installing

• Requires Android 8.1 or later, and LSPosed (or a compatible fork) or Xposed. See Installation.
• Updating from 2.2: install over it, then reboot (not just a soft restart), so LSPosed loads the new version.
• In LSPosed, enable Doppel with System Framework and the apps to restrict in its scope, or use the In LSPosed scope toggle.
• Coming from XPrivacyLua: uninstall XPrivacyLua first. Doppel is a separate app (sk.akano12.doppel) that uses the same service, so the two cannot be active side by side.

Verifying the download

Signing certificate SHA-256:

A0:F2:1E:B3:95:12:FA:90:4F:04:6C:F1:66:E7:86:07:F5:95:4F:00:F1:43:00:2D:35:89:EA:71:FD:EA:71:F4

APK SHA-256:

ae85d99b99dd306e66c85e73c6bb4e2dcc65f19a95e800d483864fd54d9162aa

Check the certificate with apksigner verify --print-certs Doppel-v2.3-203-release.apk.

Doppel 2.2

Doppel 2.2: a boot time of its own for each app, the LSPosed scope from the app's screen, faster app starts, a new Activity overview, and Android 8.1 or later.

Privacy

• A boot time of its own for each app. The time since boot is the same for all apps, so the boot time (the clock minus it) linked apps until the next restart. Each restricted app now adds its own offset of 10 to 120 minutes, new each boot, to SystemClock.elapsedRealtime, its nanos and the process start time, and /proc/stat and /proc/uptime (also through cat) match. Timers and durations are unchanged, and alarms on this clock and the age of location fixes are corrected. Part of Use.Tracking.
• Boot id and memory size by every path: also through java.nio, other paths to the same file (like /proc/self/root/proc/meminfo) and cat of more files.
• Battery: the faked level is in 10% steps and never below 15%.
• Hidden apps: content providers answer like Android for an unknown app, and ordered broadcasts to hidden apps reach no receiver.
• The storage volume UUID is made of its fake id, so both agree.

Interface

• In LSPosed scope, a new toggle on the screen of an app: turn it on to add the app to Doppel's LSPosed scope (LSPosed asks you to confirm), off to remove it, without opening LSPosed. It shows when the framework has the modern (libxposed) API, not for System Framework and Doppel itself. Like a restriction, the change applies when the app restarts.
• Activity: the overview follows the filter and the search, with restrictions or errors by day for the last week and today by hour; the list shows the entries the overview counts.
• Log: an arrow opens a row in full when its text does not fit.
• Apps: swipe the actions of a row back to close them.
• No more flicker when switching between light and dark or opening Activity.
• The "not running" screen links to the FAQ answer for it.

Speed

• App starts read and compile each Lua script once for all hooks that share it, and the Apps list loads only what it shows of each hook.
• Fewer calls and lookups in hooked apps: the Firebase opt-out once per instance, account types, keyboard and accessibility lists kept for a while, notification channels made once.

Fixes

• registerTelephonyCallback: the callbacks of apps are registered again, only their cell info and cell location methods do not run.
• Downloads only shows overlaps with built-in hooks for your Android version.
• Data of other users is kept when Doppel is removed for the owner only.
• Notifications open the main screen directly.
• Saving values of a persistent app says to restart the device.

Downloads

• Removed: BlockGuardOs.open (Fif). It blocked /apex, where Android 10 and later keep time zone data, ICU and Conscrypt, and it ran on every file an app opened. If you installed it, remove it in the Hooks tab.
• New: Intika's PackageManager hooks for the flags of Android 13 and later. Fixed: SystemProperties.get.default/custom keeps defaults, the c2dm intent is kept.
• No more download counts; they came from the old XPrivacyLua server and never changed.

Android 8.1 or later

• Doppel now needs Android 8.1 (LSPosed needs it too). 42 definitions for Android 7.1 and earlier are gone; their restrictions move to the definitions that replaced them. On Android 6 or 7, stay on 2.1.
• The legacy Xposed API stays for frameworks without the modern one.

Installing

• Requires Android 8.1 or later, and LSPosed (or a compatible fork) or Xposed. See Installation.
• Updating from 2.1: install over it, then reboot (not just a soft restart), so LSPosed loads the new version.
• In LSPosed, enable Doppel with System Framework and the apps to restrict in its scope, or use the new In LSPosed scope toggle.
• Coming from XPrivacyLua: uninstall XPrivacyLua first. Doppel is a separate app (sk.akano12.doppel) that uses the same service, so the two cannot be active side by side.

Verifying the download

Signing certificate SHA-256:

A0:F2:1E:B3:95:12:FA:90:4F:04:6C:F1:66:E7:86:07:F5:95:4F:00:F1:43:00:2D:35:89:EA:71:FD:EA:71:F4

APK SHA-256:

a70732a8b8d0c938f388068d57553e2075a0fc935507456fe425a9a76b765789

Check the certificate with apksigner verify --print-certs Doppel-v2.2-202-release.apk.

Doppel 2.1

Doppel 2.1: identifiers that change on each boot, a built-in command filter, hidden hardware ids, a faster way to restrict apps, and many fixes.

Privacy

• Identifiers new each boot. The serial, Android ID, IMEI and MEID can be Fixed or Each boot. Each boot gives every app a different value, which changes after a restart, so apps cannot follow you across apps or over time. Same for all apps gives all apps one value per boot. The values come from a secret of the Doppel service that is new each boot and that no app can read. Android ID, IMEI and MEID are new each boot by default; a value you set before stays fixed.
• Run commands, a new group: apps can only run the shell commands you allow in Fake values (like getprop, uname, or a regular expression); others, like su and id, fail and show up in Activity. It checks every program of a script, also behind sh -c, env, exec and busybox. Allowed commands still get the fake values of the other groups.
• Permanent hardware ids hidden. Files of /sys that identify the device do not exist for restricted apps: the unique id of the chip (Samsung chip-id), the serial of the SD card and of UFS storage, the touchscreen, the light sensor calibration and the fingerprint sensor. Also for shell commands like cat, head and dd, and through links.
• More faked values: /proc/meminfo with rounded sizes, a boot id of its own for each app, the times of the shared storage folders (which tell when the device was set up), the install times of other apps, the Bluetooth addresses of connected input devices, and the mobile operator properties.
• Analytics: more SDKs blocked (Clarity, Amplitude, Branch, Singular), and the Crashlytics opt-out can no longer be undone by an app.
• The service answers only Doppel and Android. Apps signed with the same key can no longer read or change settings; apps without restrictions get the answers of a device without Doppel.

Interface

• Swipe an app in Apps, or tap its badge, for Restrict all, Remove all and Groups, each with Undo. Groups opens a sheet with all groups by section.
• All / None per section, on the screen of an app and in the groups sheet.
• Fake values: Fixed or Each boot for the identifiers, a clear button per field, and a bar with Discard and Save only when something changed. The Clear button, easily mistaken for Cancel, is gone.
• Tapping the icon of a group shows its full description.
• Headers scroll away with a compact bar on all tabs and screens; the log of one app looks like the Activity tab; tapping a restriction in the log opens its hook.
• Settings keep their place when you change the accent, theme or pure black background.
• Clearer text on the accent colors, in the light and the dark theme.

Fixes

• Apps that start work early, like Facebook, no longer crash a few times on start: hooks are installed before the app's own code runs.
• Restrict all, Remove all and Undo only change the hooks that change, so the use of the others is kept and the app is not stopped for nothing.
• SubscriptionInfo.getSubscriptionId is no longer faked to a subscription that does not exist, which broke SMS and calls on multi-SIM phones; phone number and SIM serial are empty instead of null.
• Scripts can use ROM classes that declare types the ROM lacks (like on Samsung).
• Restoring a backup handles renamed and newer definitions, stops the changed apps and ends with a summary.
• Screens closed while loading no longer crash.

Downloads

• 83 definitions removed that duplicated built-in ones or no longer worked, and the Fif command filter, which Run commands replaces. Installed definitions stay installed.
• New: Radar, Localytics and Ogury blockers. Fixed: the Google FCM set, the property blacklist, BlockGuardOs.open, File.mkdir(s) and others.

Installing

• Requires Android 6.0 or later, and LSPosed (or a compatible fork) or Xposed. See Installation.
• Updating from 2.0: install over it, then reboot (not just a soft restart), so LSPosed loads the new version.
• In LSPosed, enable Doppel with System Framework and the apps to restrict in its scope. Add only the apps you restrict.
• Coming from XPrivacyLua: uninstall XPrivacyLua first. Doppel is a separate app (sk.akano12.doppel) that uses the same service, so the two cannot be active side by side.

Verifying the download

Signing certificate SHA-256:

A0:F2:1E:B3:95:12:FA:90:4F:04:6C:F1:66:E7:86:07:F5:95:4F:00:F1:43:00:2D:35:89:EA:71:FD:EA:71:F4

APK SHA-256:

9c9786af6abe99ec388f9505cb3e4964b475dd040bf53bb52e3cc512e8f96a5e

Check the certificate with apksigner verify --print-certs Doppel-v2.1-201-release.apk.

Doppel 2.0

First release of Doppel, the continuation of XPrivacyLua by Marcel Bokhorst (M66B).

What's new

• New Material 3 interface: Apps, Activity, Hooks and Settings, with a floating navigation bar
• Fake values, a log with the real and fake values, a hook editor and backup built in, no pro app needed
• Modern Xposed API (LSPosed) next to the legacy API
• Hooks updated for current Android versions
• New restrictions: battery, biometrics, debugging state, device settings and features, memory and storage, time zone, VPN state
• Shared definitions available offline in Downloads
• Light and dark theme, accent colors, a pure black background and a choice of app icons

Installing

• Requires Android 6.0 or later, and LSPosed (or a compatible fork) or Xposed. See Installation.
• In LSPosed, enable Doppel with System Framework and the apps to restrict in its scope, then reboot.
• Coming from XPrivacyLua: uninstall XPrivacyLua first. Doppel is a separate app (sk.akano12.doppel) that uses the same service, so the two cannot be active side by side.

Verifying the download

Signing certificate SHA-256:

A0:F2:1E:B3:95:12:FA:90:4F:04:6C:F1:66:E7:86:07:F5:95:4F:00:F1:43:00:2D:35:89:EA:71:FD:EA:71:F4

APK SHA-256:

db20eb713f18d4c10a1a2d011dd5c166da06dbd42101060b083cc5c00dc77cd6

Check the certificate with apksigner verify --print-certs Doppel-v2.0-200-release.apk.