diff --git a/MBCPApp/blob_patches/resources/strings_newapp.xml b/MBCPApp/blob_patches/resources/strings_newapp.xml new file mode 100644 index 0000000..47b50cf --- /dev/null +++ b/MBCPApp/blob_patches/resources/strings_newapp.xml @@ -0,0 +1,378 @@ + + + OPC_NAME_NOT_SET_KEY + OPC_NETWORK_KEY + OPC_NETWORK_NAME_KEY + NO_OPC_SET + OPC_SHARED_PREFERENCES_FILE + OPC_SHARED_PREFERENCES_KEY + OPC_TOKEN_SERVICE_PROVIDER_KEY + OPC_TOKEN_SERVICE_PROVIDER_NAME_KEY + + Navigate home + Navigate up + More options + Done + See all + Choose an app + OFF + ON + Alt+ + Ctrl+ + delete + enter + Function+ + Meta+ + Shift+ + space + Sym+ + Menu+ + Search… + Clear query + Search query + Search + Submit query + Voice search + Share with + Share with %s + Collapse + + + Understand and continue + Please move the face into the frame + You will have to speak loudy these numbers on the screen + Please look straight + Please look straight + Your face is in the frame. Please hold your hand steady! + Please keep your face upright + Please keep your face upright + Please put the camera further away + Please put the camera closer + Please look straight + Please look straight + Please move your face fit in the frame + Found many faces in the frame. Please retake the selfie + Agree + Please remove scarf, mask, sunglasses, hat and take a photo in well-lit condition + Keep your face steady during video recording + Speak loudly and clearly the number on the screen + Hold your phone as high as your face + Video recording tutorial + Please take a video of your face to verify no one is impersonating you + Biometric information + Start demonstration + Verify information + Please watch the tutorial to know how to record video with the best quality + Cancel + Retry + Record selfie video failed + Please move your face fit in the frame + Your facial data does not match. Please try again + Your video is in low quality + Your facial data does not match + Failed. Please record the video again + Error. Please record your voice again + Recording + Speak loudly the number on the screen + androidx.startup + mbbank.onelink.me + MB Bank + This is an app widget description + com.google.android.material.appbar.AppBarLayout$ScrollingViewBehavior + com.google.android.material.bottomsheet.BottomSheetBehavior + Expand halfway + Characters entered %1$d of %2$d + Character limit exceeded %1$d of %2$d + %1$d/%2$d + Clear text + Tap to setup QR + Tap to setup QR + cca90e65-5805-4c06-bc2d-930595fb2cf4 + a4f49867dfa64435bea0bafc1f437f34 + Enable + %1$s can't work properly unless you enable GMS/microG. + Enable GMS/microG + Install + GMS/microG is missing from your device. %1$s still runs without it but some features will be broken. + GMS/microG missing + Google Play services availability + Google Play services error + %1$s is having trouble with Google Play services. Please try again. + %1$s won't run without Google Play services, which are not supported by your device. + Update + %1$s won't run unless you update Google Play services. + Update Google Play services + %1$s won't run without Google Play services, which are currently updating. + New version of Google Play services needed. It will update itself shortly. + Open on phone + Sign in + Sign in with Google + Use password + Copy + Link copied to clipboard + Unknown error + 162583259686-erd52s6o9832jno1lpa9on8t2djnicie.apps.googleusercontent.com + . + . + Error + Advanced + Show dropdown menu + com.google.android.material.transformation.FabTransformationScrimBehavior + com.google.android.material.transformation.FabTransformationSheetBehavior + Copy link + Open in browser + Share link + Miscellaneous + Touch the fingerprint sensor + Fingerprint hardware not available. + This device does not have a fingerprint sensor + Too many attempts. Please try again later. + No fingerprints enrolled. + Fingerprint operation canceled by user. + Not recognized + https://mbmobilebanking6789.firebaseio.com + 162583259686 + You cannot go back to the previous step. Please continue + Warning + Processing... + No PIN, pattern, or password set. + This device does not support PIN, pattern, or password. + Authentication canceled by user. + The server response is invalid or missing. Please try again + Please check your internet connection + AIzaSyAcxvc0vK4vJ3TzLe0PI9gqNIq8ZxmL5NI + 1:162583259686:android:884f0ccb6ad5e1ed + AIzaSyAcxvc0vK4vJ3TzLe0PI9gqNIq8ZxmL5NI + mbmobilebanking6789.appspot.com + + com.google.android.material.behavior.HideBottomViewOnScrollBehavior + Dialog Icon + SDK initialization failed + SDK initialization success + https://mobile.useinsider.com/api/v1/test_device/add + https://mobile.useinsider.com/api/amplification/v1/poll + https://mobileanalytics.useinsider.com + /api/v1/test_device/add + /api/amplification/v1/poll + /api/v1/privacy/gdpr/consent/get + /api/v1/privacy/gdpr/consent/set + /api/v1/geofences + /api/v1/geofences/notify + /api/identity/v3/get + /api/message_center/v2/sdk/get + https://mobile.useinsider.com/api/v1/privacy/gdpr/consent/get + https://mobile.useinsider.com/api/v1/privacy/gdpr/consent/set + https://mobile.useinsider.com/api/v1/geofences + https://mobile.useinsider.com/api/v1/geofences/notify + https://mobile.useinsider.com/api/identity/v3/get + https://mobile.useinsider.com/api/logging/sdk/v2 + https://mobile.useinsider.com/api/message_center/v2/sdk/get + Android + /api/v3/session/start + /api/v3/session/stop + https://mobile.useinsider.com/api/v3/session/start + https://mobile.useinsider.com/api/v3/session/stop + /api/gandalf/v2/live_push + /api/gandalf/v2/start_connection + /api/gandalf/v2/stop_connection + https://mobile.useinsider.com/api/gandalf/v2/live_push + https://mobile.useinsider.com/api/gandalf/v2/start_connection + https://mobile.useinsider.com/api/gandalf/v2/stop_connection + Tab + sans-serif + sans-serif-medium + sans-serif + : + Select AM or PM + Select hour + %1$s o'clock + Select minutes + %1$s minutes + cubic-bezier(0.4, 0.0, 1.0, 1.0) + cubic-bezier(0.0, 0.0, 0.2, 1.0) + path(M 0,0 C 0.05, 0, 0.133333, 0.06, 0.166666, 0.4 C 0.208333, 0.82, 0.25, 1, 1, 1) + cubic-bezier(0.0, 0.0, 1.0, 1.0) + cubic-bezier(0.4, 0.0, 0.2, 1.0) + Range end, + Range start, + AM + Switch to clock mode for the time input. + Hour + Minute + PM + Select time + Switch to text input mode for the time input. + New notification + Remove %1$s + More than %1$d new notifications + %1$d%2$s + Change to next month + Change to previous month + Current selection: %1$s + @android:string/cancel + OK + %1$s + Select Date + Selected date + Column of days: %1$s + Invalid format. + Example: %1$s + Use: %1$s + Invalid range. + Navigate to year %1$s + Out of range: %1$s + Start date – %1$s + %1$s – End date + %1$s – %2$s + Select Range + Start date – End date + Save + Date + End date + Start date + d + m + y + Switch to calendar input mode + Tap to switch to selecting a day + Switch to text input mode + Tap to switch to selecting a year + OK + Next + Kết thúc + Not set + Agree + Please move the ID card into the frame + Make sure the photo is easy to read, with no blur or loss of angle or flare + Make sure your ID card is valid + Tutorial for taking photo of ID card + Please take a photo of your ID card to verify your information + ID card information + Change + Start capturing + Please select the type of document + Continue + Cancel + Do you want to continue to register? + Verify information + - + Back + Accept + Capture + Retake + Retry + Front + Page 2 + Capture + Citizen identification + Citizen identification + Identification documents + Passport + Military ID card + You took the wrong side of the ID card. Please try again + Your photo is unqualified. Please retake a photo of ID + Cannot find the face on your ID card. Please retake the photo + Your ID card is not fully captured. Please try again (OCR005) + Your facial data on ID card and video do not match. Please try again + Your photo is unqualified. Please retake a photo of ID + Make sure your photos are easy to read, with no blur, loss of corners, or glare + Please move the ID card into the frame + Continue + Stop + Do you want to continue to register? + Yes + No + Do you want to go back to previous step? + Please keep your ID straight + Cannot find the face on your ID card + Authentication failed + Authentication successfully + Cannot receive the data of identification session. Please try again + Identifier and bioID do not match + Cannot find the identifier + Your data is being manually reviewed + Cannot identify your data on video and ID card + Authentication failed + Successful registration with highest level + You have tried more than the permitted. Please contact the call center + Please try again. If not successful, please contact the call center + Cannot verify your data + You have exited the identification process + You are not qualify to take the next step + Show password + M12,4.5C7,4.5 2.73,7.61 1,12c1.73,4.39 6,7.5 11,7.5s9.27,-3.11 11,-7.5c-1.73,-4.39 -6,-7.5 -11,-7.5zM12,17c-2.76,0 -5,-2.24 -5,-5s2.24,-5 5,-5 5,2.24 5,5 -2.24,5 -5,5zM12,9c-1.66,0 -3,1.34 -3,3s1.34,3 3,3 3,-1.34 3,-3 -1.34,-3 -3,-3z + M2,4.27 L19.73,22 L22.27,19.46 L4.54,1.73 L4.54,1 L23,1 L23,23 L1,23 L1,4.27 Z + M2,4.27 L2,4.27 L4.54,1.73 L4.54,1.73 L4.54,1 L23,1 L23,23 L1,23 L1,4.27 Z + M3.27,4.27 L19.74,20.74 + Agree + Close + Go to "Settings" + Please allow [APP_NAME] to access the camera and microphone for recording the video + Please allow [APP_NAME] to access the camera and microphone + Please allow [APP_NAME] to access the camera for taking selfie + Please allow [APP_NAME] to access the camera + Please allow [APP_NAME] to access the microphone for recording + Please allow [APP_NAME] to access the microphone + Please allow [APP_NAME] to access the camera and microphone in "Settings" + "%1$s" copied to clipboard. + mbmobilebanking6789 + QR Image + Receive QR + This app may not work correctly without the requested permissions. + This app may not work correctly without the requested permissions. Open the app settings screen to modify app permissions. + . + . + . + . + Search + Please keep the card +until the process is completed + Your current device is not currently compatible + with NFC mode. + +Please try on another device. or restart. + Current device is not compatible + Check your ID card + Notes + Watch the instruction video before proceed + 1. Prepare vaild ID card + 2. Remove the phone case. + 3. Enable NFC and accept the permission if asked. + 4. Do like the video. + 1. Prepare the ID card. + 2. Put it to your phone backcover. + 3. Move the ID card from bottom slowly until the device recognize it. + 4. Keep the card scanning for 5-10 seconds. + 1. Put the ID card to your phone backcover. + 2. Slowly moving the ID card, until the device recognize it, then keep the card until the process is complete. + 999+ + %1$s, %2$s + + Tap to setup QR + Online loan + Phone Topup + Phone Topup + Scan QR + Transfer + + VideoPreviewActivity + Permissions Required + Loading… + Crop + Both input and output Uri must be specified + Edit Photo + Original + Crop + Therefore, override color resource (ucrop_color_toolbar_widget) in your app to make it work on pre-L devices + Rotate + Scale + OFF + ON + Copied "%1$s" to clipboard. + Search + 999+ + %1$s, %2$s + Loading… + OFF + ON + diff --git a/MBCPApp/legacy_patch.sh b/MBCPApp/legacy_patch.sh index 3316c0a..27c1139 100755 --- a/MBCPApp/legacy_patch.sh +++ b/MBCPApp/legacy_patch.sh @@ -30,10 +30,10 @@ do echo "Applying patch [Bypass signature check]..." if [ -d "$DIRPATH"/mbapk/mbapk_unpacked ] then - # Checks for MBShield, if exists then exit function - if [ -f "$DIRPATH"/mbapk/mbapk_unpacked/assets/mbshield.szip ] + # Checks for zShield (mbshield is zShield), if exists then exit function + if [ -f "$DIRPATH"/mbapk/mbapk_unpacked/assets/*.szip ] then - info "MBShield found on unpacked APK ! Bypass signature checks won't be possible if MBShield is present on current unpacked APK !" + info "zShield found on unpacked APK ! Bypass signature checks won't be possible if zShield is present on current unpacked APK !" info "Please use supported version !!!" echo "For React Native : MBBank/MB Lite v1.0 up to v6.3.11" echo "For Flutter : MBBank v6.4.0 up to v6.4.21" diff --git a/MBCPApp/mbcpapp.sh b/MBCPApp/mbcpapp.sh index 2318f83..8c3e56f 100755 --- a/MBCPApp/mbcpapp.sh +++ b/MBCPApp/mbcpapp.sh @@ -51,11 +51,11 @@ COMMIT="$(git rev-parse --short HEAD)" BRANCH="$(git rev-parse --abbrev-ref HEAD)" clear -mbshield_found='MBShield found on [mbapk_unpacked/assets/mbshield.szip] !!! -Patching operation is limited due to MBShield :( +zshield_found='zShield found on [mbapk_unpacked/assets/*.szip] !!! +Patching operation is limited due to zShield :( You need to extract assets from Android device for some patching operation to works properly !!!' -mbshield_not_found='MBShield NOT found on [mbapk_unpacked/assets/] +zshield_not_found='zShield NOT found on [mbapk_unpacked/assets/] Patching operation are all not limited at all ! Asset extraction are not needed :)' @@ -64,8 +64,8 @@ download_tools() { apkeditor_link="https://github.com/REAndroid/APKEditor/releases/download/V1.4.8/APKEditor-1.4.8.jar" cd tools && rm -rf ./*.jar - wget -q --show-progress -O apktool.jar "$apktool_link" || err "downloading apktool failed" - wget -q --show-progress -O apkeditor.jar "$apkeditor_link" || err "downloading apkeditor failed" + wget -q --no-check-certificate --show-progress -O apktool.jar "$apktool_link" || err "downloading apktool failed" + wget -q --no-check-certificate --show-progress -O apkeditor.jar "$apkeditor_link" || err "downloading apkeditor failed" cd .. } @@ -117,12 +117,29 @@ copyHash() { # libapp flutter sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libapp.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libapp_arm64_sum && good "Success dump sha256 libapp (arm64) hash to [mbapk/original_hash] !" sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libapp.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libapp_armv7a_sum && good "Success dump sha256 libapp (armv7a) hash to [mbapk/original_hash] !" - # mbshield - sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libmbshield.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libmbshield_arm64_sum && good "Success dump sha256 libmbshield (arm64) hash to [mbapk/original_hash] !" - sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libmbshield.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libmbshield_armv7a_sum && good "Success dump sha256 libmbshield (armv7a) hash to [mbapk/original_hash] !" - # zimperium - sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libclosestmadagascar.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libclosestmadagascar_arm64_sum && good "Success dump sha256 zimperium (arm64) hash to [mbapk/original_hash] !" - sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libclosestmadagascar.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libclosestmadagascar_armv7_sum && good "Success dump sha256 zimperium (armv7a) hash to [mbapk/original_hash] !" + + # mbshield (zShield) + # exist in MB v6.4.22 ~ v6.5.6 (except v6.4.45 versionCode 658) + [ -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libmbshield.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libmbshield.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libmbshield_arm64_sum && good "Success dump sha256 libmbshield (arm64) hash to [mbapk/original_hash] !" + [ -f 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libmbshield.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libmbshield.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libmbshield_armv7a_sum && good "Success dump sha256 libmbshield (armv7a) hash to [mbapk/original_hash] !" + + # new zshield + zdefend (v6.5.7+) + [ -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libempirememorial.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libempirememorial.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libempirememorial_arm64_sum && good "Success dump sha256 libempirememorial (arm64) hash to [mbapk/original_hash] !" + [ -f 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libempirememorial.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libempirememorial.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libempirememorial_armv7a_sum && good "Success dump sha256 libempirememorial (armv7a) hash to [mbapk/original_hash] !" + + # built in flutter zdefend plugin lib call, it might call to libempirememorial.so + [ -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libcode.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libcode.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libcode_arm64_sum && good "Success dump sha256 libcode (arm64) hash to [mbapk/original_hash] !" + [ -f 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libcode.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libcode.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libcode_armv7a_sum && good "Success dump sha256 libcode (armv7a) hash to [mbapk/original_hash]" + + # old zimperium zdefend + # exist in MB v6.4.72 ~ v6.5.6 + [ -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libclosestmadagascar.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libclosestmadagascar.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libclosestmadagascar_arm64_sum && good "Success dump sha256 zimperium (arm64) hash to [mbapk/original_hash] !" + [ -f 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libclosestmadagascar.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libclosestmadagascar.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libclosestmadagascar_armv7_sum && good "Success dump sha256 zimperium (armv7a) hash to [mbapk/original_hash] !" + + # Tian37 (since MB v6.4.86+) + [ -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libanTian37.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libanTian37.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libanTian37_arm64_sum && good "Success dump libanTian37 (arm64) hash to [mbapk/original_hash] !" + [ -f 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libanTian37.so' ] && sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libanTian37.so | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/libanTian37_armv7a_sum && good "Success dump libanTian37 (armv7a) hash to [mbapk/original_hash] !" + # dex files sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/.cache/classes.dex | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/dex1_sum && good "Success dump sha256 dex1 hash to [mbapk/original_hash]!" sha256sum "$DIRPATH"/mbapk/mbapk_unpacked/.cache/classes2.dex | cut -f 1 -d " " > "$DIRPATH"/mbapk/original_hash/dex2_sum && good "Success dump sha256 dex2 hash to [mbapk/original_hash] !" @@ -147,7 +164,7 @@ unpack_mbcp() { unzip -l mbapk/MBOriginal.apk | grep -oH "flutter_assets" > /dev/null 2>&1 && good "Current app is Flutter!" || { err "Current converted app is not Flutter, or too outdated, cannot continue! Deleting files..." ; rm -rf mbapk/* ; return 1 ; } unzip -l mbapk/MBOriginal.apk | grep -oH "ic-appmb.ttf" > /dev/null 2>&1 && good "Current converted app is MBBank! Continuing" || { err "Current converted app is NOT MBBank! Deleting files..." ; rm -rf mbapk/* ; return 1 ; } - info "Cleaning useless files..." + info "Removing local zimperium detection models..." rm -rf 'mbapk/mbapk_unpacked/root/assets/_4A9w8flncUrhDOG8dyqLi_azBTYT3PlSXz0hiCzRQA_' rm -rf 'mbapk/mbapk_unpacked/root/assets/0QDl12M5S2hKxoKF4cNI4kEX1qDQRMiOd34TXjSjy4M_' rm -rf 'mbapk/mbapk_unpacked/root/assets/2GcdAWdkXGgxPfHSIhzLkrkf2LU6Z_cuZfUWnczoEHw_' @@ -155,9 +172,15 @@ unpack_mbcp() { rm -rf 'mbapk/mbapk_unpacked/root/assets/c7uFHgsHzlQ_T524_4N3h9neXvtcUg0m1ERhEjFpPI8_' rm -rf 'mbapk/mbapk_unpacked/root/assets/ccBu4aSM_mSaMBpFvr14pizu6EGMvwRiZltU_zVJMz0_' rm -rf 'mbapk/mbapk_unpacked/root/assets/DcM3z3tolULDhbn8YrUE7hxOlxZx2oFC5yNQFG1SX9k_' - rm -rf 'mbapk/mbapk_unpacked/root/assets/fPGzhQFvISia1NiVGU8vQx9IpRm63E4_1Xv0Z2ypWUE_' - rm -rf 'mbapk/mbapk_unpacked/root/assets/g9x205p_On9_RR4kI_GdsoQ2pfSrV_OQXSopshyhYVk_' + # v6.5.7+ and new zimperium need this, without it the app will crash in startup, libcode.so + # is new pattern to detect v6.5.7+, older app base with old zimperium does not need this + # so i added condition check, whether if libcode.so is exist or not, if not then it will + # continue to delete the local model as before. + [ ! -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libcode.so' ] && rm -rf 'mbapk/mbapk_unpacked/root/assets/fPGzhQFvISia1NiVGU8vQx9IpRm63E4_1Xv0Z2ypWUE_' + # v6.5.9+ behavior (does not affect v6.5.7/v6.5.8 behavior) + [ ! -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libcode.so' ] && rm -rf 'mbapk/mbapk_unpacked/root/assets/2lclXWtX58GC8tXgJr1E_tmzpvS_K1Q7_0jHeXBaECc_' rm -rf 'mbapk/mbapk_unpacked/root/assets/GXNv8xc5IcVF6TyUgjJpyYFeyHGqUqN7ZS0X_2WRbEE_' + rm -rf 'mbapk/mbapk_unpacked/root/assets/g9x205p_On9_RR4kI_GdsoQ2pfSrV_OQXSopshyhYVk_' rm -rf 'mbapk/mbapk_unpacked/root/assets/H8leCCp85eX0YRvo4WCzqF5MEuj2_9ix6zL2bjnj6hk_' rm -rf 'mbapk/mbapk_unpacked/root/assets/Hput_BfAb8ftOt8hvazec24Eqk0gC5DDY6qALJMLtcI_' rm -rf 'mbapk/mbapk_unpacked/root/assets/MZuOOtdhO6pcGnZ5_kqMPh56hL3LqawBZd05vfIivww_' @@ -183,7 +206,6 @@ unpack_mbcp() { rm -rf 'mbapk/mbapk_unpacked/root/assets/ccBu4aSM_mSaMBpFvr14pizu6EGMvwRiZltU_zVJMz0_' rm -rf 'mbapk/mbapk_unpacked/root/assets/DcM3z3tolULDhbn8YrUE7hxOlxZx2oFC5yNQFG1SX9k_' rm -rf 'mbapk/mbapk_unpacked/root/assets/eB0ZLvEtv8_qoOAcmcB19tx0pnT_RXKn5WU3rOVgK4k_' - rm -rf 'mbapk/mbapk_unpacked/root/assets/fPGzhQFvISia1NiVGU8vQx9IpRm63E4_1Xv0Z2ypWUE_' rm -rf 'mbapk/mbapk_unpacked/root/assets/g9x205p_On9_RR4kI_GdsoQ2pfSrV_OQXSopshyhYVk_' rm -rf 'mbapk/mbapk_unpacked/root/assets/GXNv8xc5IcVF6TyUgjJpyYFeyHGqUqN7ZS0X_2WRbEE_' rm -rf 'mbapk/mbapk_unpacked/root/assets/H8leCCp85eX0YRvo4WCzqF5MEuj2_9ix6zL2bjnj6hk_' @@ -204,7 +226,6 @@ unpack_mbcp() { rm -rf 'mbapk/mbapk_unpacked/root/assets/ZOKOK1a6XCiqYb_a8bYPE9c0rjUf7_n7k77YxX5Ypdw_' rm -rf 'mbapk/mbapk_unpacked/root/assets/zxHdhL4_ZEQLQeo8R2DzSYl9PGss_cKSCQTcZGBtVmU_' # New zimperium for v6.4.67+ - rm -rf 'mbapk/mbapk_unpacked/root/assets/2lclXWtX58GC8tXgJr1E_tmzpvS_K1Q7_0jHeXBaECc_' rm -rf 'mbapk/mbapk_unpacked/root/assets/EHFtsAf7MYH_M7kQF1YX8LeWfU1_RjdRH62oJRE0v38_' rm -rf 'mbapk/mbapk_unpacked/root/assets/KZsyhtgSOXgFDPIf88NF5svaDH3xQ8feGsAQiy1c9_s_' rm -rf 'mbapk/mbapk_unpacked/root/assets/mT0VvAZ00szUCjj1fIELzEtu8jyGYugItWXzMzctw5s_' @@ -219,7 +240,10 @@ unpack_mbcp() { # New zimperium for v6.4.72+ rm -rf 'mbapk/mbapk_unpacked/root/assets/Z1YbTXaPlMjbmWCKXXD0m4wkWyE0I6xxDebGhXz5igk_' rm -rf 'mbapk/mbapk_unpacked/root/assets/zxwCzUaZ8itWQeAMKtyu52RbljJe1Pd8GuV7H4RPsy4_' - + # New zimperium for v6.5.7+ + rm -rf 'mbapk/mbapk_unpacked/root/assets/BHCdF10ojcfyA7xfkrsMHYFMRUCn2CVYK6zKEnI8Jdc_' + rm -rf 'mbapk/mbapk_unpacked/root/assets/i_4CYiKEHQ3wTzTlrx_YVNIvHCgFjnkpMtMf4pgDlic_' + rm -rf 'mbapk/mbapk_unpacked/root/assets/OrE6E3b6dxQnoToaT2eLN48gKz8_Iui_eFezclhtVQk_' info "Creating [mbcp_info] folder..." mkdir 'mbapk/mbapk_unpacked/root/assets/mbcp_info/' @@ -262,14 +286,14 @@ successunpack() { fi } -check_mbshield() { +check_zshield() { is_unpacked || return 1 - if [ -f "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/mbshield.szip ] + if [ -f "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/*.szip ] then - info "$mbshield_found" + info "$zshield_found" iszdefend else - info "$mbshield_not_found" + info "$zshield_not_found" fi } @@ -289,7 +313,15 @@ convert_apks() { info "You probably can continue to unpack APK!" } +newbehavior() { + warn "App is newer v6.5.15+! Patches continue to work, but you can't login" + warn "Until a workaround is implemented :(" + confirm || exit 1 +} + run_patcher() { + # check v6.5.15+ + [ -f "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libnframes.so ] && newbehavior is_unpacked_lib && bash ./parse.sh && bash ./patch.sh } @@ -305,14 +337,14 @@ echo "Original APK must be inside [mbapk] folder !" echo ------------------------------------------------------------- echo "Current commit : $COMMIT ($BRANCH)" echo "Source code : https://git.disroot.org/mbcp/mbbpatch.git" -echo "Documentation : see [docs] folder" +echo "Documentation : see [README.md] or [docs] folder" echo "Written from scratch by Cuynu with love <3" echo ------------------------------------------------------------- echo App status : $(successunpack) echo ------------------------------------------------------------- # Main functions PS3='Please select options to continue : ' -select opt in 'Pull latest commit' 'Unpack APK' 'Convert apks to apk' 'Repack APK' 'Install patched app' 'MBShield Check' 'Patch App' 'Legacy patches' 'Extract assets [ROOT]' 'Launch MBCPApp/MBBank' 'Force close MBCPApp/MBBank' 'Clear MBCPApp/MBBank app data' 'Clean patched app' 'Download/update tools' 'Restart script' 'Exit' +select opt in 'Pull latest commit' 'Unpack APK' 'Convert apks to apk' 'Repack APK' 'Install patched app' 'zShield Check' 'Patch App' 'Legacy patches' 'Extract assets [ROOT]' 'Launch MBCPApp/MBBank' 'Force close MBCPApp/MBBank' 'Clear MBCPApp/MBBank app data' 'Clean patched app' 'Download/update tools' 'Restart script' 'Exit' do case "$opt" in 'Download/update tools' ) download_tools ;; @@ -320,14 +352,14 @@ do 'Repack APK' ) repack_mbcp ;; 'Patch App' ) run_patcher ;; 'Legacy patches' ) run_legacy_patcher ;; - 'MBShield Check' ) check_mbshield ;; + 'zShield Check' ) check_zshield ;; 'Convert apks to apk' ) convert_apks ;; 'Extract assets [ROOT]' ) is_unpacked || exit 1 isvcm1 iszdefend info "If you have v6.4.98 or newer, app resource extraction is no longer possible. Please use older version." - info 'To extract encrypted assets [if current app has MBShield protection] you need rooted device' + info 'To extract encrypted assets [if current app has zShield protection] you need rooted device' info 'And trigger a built-in app assets extraction !' echo ------------------------------------------- PS3='Select options continue, or [3] to quit : ' @@ -341,9 +373,9 @@ do elif [ "$opt" == 'Extract assets' ]; then if [ -d "$DIRPATH"/mbapk/mbapk_unpacked/ ] then - if [ -f "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/mbshield.szip ] + if [ -f "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/*.szip ] then - info "MBShield found ! Continuing !!!" + info "zShield found ! Continuing !!!" warn 'You MUST grant root access to [com.android.shell] in order to extract assets !' info 'Trying to extract assets...' adb shell am force-stop com.mbmobile @@ -386,7 +418,7 @@ then info 'Removing leftover assets...' adb shell rm -rf /sdcard/assets && good "Removed leftover assets !" || err "Failed to remove leftover assets from device !" else - info "MBShield not found ! No need to extract assets !" + info "zShield not found ! No need to extract assets !" fi else err "Can't find [mbapk/mbapk_unpacked] folder, cannot continue ! " @@ -431,32 +463,35 @@ done info "Cleared !" ;; 'Install patched app' ) - info 'Select your patched version to continue' - PS3='Select patched version to continue, or [4] to quit : ' - select opt in 'App patched with newer version [v6.4.59+]' 'App patched with specific version' 'App patched with older version [v6.4.55 or lower]' 'Exit' + echo 'Choose install options :' + ls mbcpapp_apk | grep -q MBCP_Flutter_SelfPatched_$(git rev-parse --short HEAD).apk || err "Couldn't find APK with current commit ID, you might already do new commits : $(git rev-parse --short HEAD)" || warn "Please repack APK again after each new commits !" + PS3='Select option to continue, or [3] to quit : ' + select opt in 'Install & open app' 'Install & delete local detection model & open app' 'Exit' do - if [ "$opt" == 'App patched with newer version [v6.4.59+]' ]; then + if [ "$opt" == 'Install & open app' ]; then if [ -f "$DIRPATH"/mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk ] then warn "MBCP Helper / CorePatch must be installed with disable digest verify on !!!" warn "You must have connected Android device with USB debugging turned on in order to install !!!" adb kill-server adb start-server - adb install "mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk" - adb shell am start -n com.mbmobile/io.flutter.plugins.MainActivity + adb install "mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk" | grep -q Success && echo "App installation successful! Opening app..." && adb shell am start -n com.mbmobile/io.flutter.plugins.MainActivity || echo "Failed to install app, please check your device!" else err "[MBCP_Flutter_SelfPatched_$COMMIT.apk] not found, cannot continue !" fi - elif [ "$opt" == 'App patched with specific version' ]; then + elif [ "$opt" == 'Install & delete local detection model & open app' ]; then + # handle method for newer app + [ -f "$DIRPATH"/mbapk/mbapk_unpacked/root/lib/arm64-v8a/libcode.so ] && warn "This method works best with v6.4.58 ~ v6.5.6. For newer app please block Zimperium host first !" if [ -f "$DIRPATH"/mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk ] then warn "MBCP Helper / CorePatch must be installed with disable digest verify on !!!" warn "You must have connected Android device with USB debugging turned on in order to install !!!" adb kill-server adb start-server - adb install "mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk" + adb shell [ -f /system/bin/su ] || warn "No su binary found in [/system/bin/su] from connected device. Root-related commands will not work!!" + adb install "mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk" | grep -q Success && echo "App installation successful! Opening app..." && adb shell am start -n com.mbmobile/io.flutter.plugins.MainActivity || echo "Failed to install app, please check your device!" # Delete zimperium detection files adb shell su -c rm -rf /data/data/com.mbmobile/files/0* adb shell su -c rm -rf /data/data/com.mbmobile/files/1* @@ -470,6 +505,7 @@ do adb shell su -c rm -rf /data/data/com.mbmobile/files/9* adb shell su -c rm -rf /data/data/com.mbmobile/files/KNOV3PN* adb shell su -c rm -rf /data/data/com.mbmobile/files/zxpolicyme* + adb shell su -c rm -rf /data/data/com.mbmobile/files/zxpolicymd* adb shell su -c rm -rf /data/data/com.mbmobile/files/policyme* warn "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" adb shell su -c 'iptables -t nat -A OUTPUT -p tcp -d 0/0 -j DNAT --to-destination 162.159.153.4:443' @@ -481,21 +517,7 @@ do else err "[MBCP_Flutter_SelfPatched_$COMMIT.apk] not found, cannot continue !" fi - - elif [ "$opt" == 'App patched with older version [v6.4.55 or lower]' ]; then - if [ -f "$DIRPATH"/mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk ] - then - warn "MBCP Helper / CorePatch must be installed with disable digest verify on !!!" - warn "You must have connected Android device with USB debugging turned on in order to install !!!" - adb kill-server - adb start-server - adb install "mbcpapp_apk/MBCP_Flutter_SelfPatched_$COMMIT.apk" - adb shell am start -n com.mbmobile/io.flutter.plugins.MainActivity - else - err "[MBCP_Flutter_SelfPatched_$COMMIT.apk] not found, cannot continue !" - fi - - + elif [ "$opt" == 'Exit' ]; then PS3='Please select options to continue : ' break diff --git a/MBCPApp/patches/add_modified_resources.sh b/MBCPApp/patches/add_modified_resources.sh index 250704d..688eca0 100644 --- a/MBCPApp/patches/add_modified_resources.sh +++ b/MBCPApp/patches/add_modified_resources.sh @@ -15,11 +15,18 @@ nochiptext() { rm -rf strings_temp } +no_resolution() { + warn "App newer than v6.5.7+ ! Using specific strings file instead..." + cp -f 'blob_patches/resources/strings_newapp.xml' 'mbapk/mbapk_unpacked/resources/package_1/res/values/strings.xml' +} + info "Copying modified resources..." cp -r -f 'blob_patches/resources/raw' 'mbapk/mbapk_unpacked/resources/package_1/res/' cp -f 'blob_patches/resources/strings-vi/strings.xml' 'mbapk/mbapk_unpacked/resources/package_1/res/values-vi/' [ $(cat mbapk/mbapk_unpacked/resources/package_1/res/values/strings.xml | grep chip_text) ] && cp -f 'blob_patches/resources/strings/strings.xml' 'mbapk/mbapk_unpacked/resources/package_1/res/values/' || nochiptext +[ $(cat mbapk/mbapk_unpacked/resources/package_1/res/values/strings.xml | grep -q RESOLUTION) ] && cp -f 'blob_patches/resources/strings/strings.xml' 'mbapk/mbapk_unpacked/resources/package_1/res/values/' || no_resolution + info "Copying bootleg_ekyc..." cp -f 'blob_patches/bootleg_ekyc/dotp1_ekyc.png' 'mbapk/mbapk_unpacked/root/assets/flutter_assets/assets/images/dynamic/base/digitalOtp_img_authenguide01.webp' cp -f 'blob_patches/bootleg_ekyc/dotp2_ekyc.png' 'mbapk/mbapk_unpacked/root/assets/flutter_assets/assets/images/dynamic/base/digitalOtp_img_authenguide02.webp' diff --git a/MBCPApp/patches/autopatch_strings.sh b/MBCPApp/patches/autopatch_strings.sh index e13fb4c..b9cb489 100644 --- a/MBCPApp/patches/autopatch_strings.sh +++ b/MBCPApp/patches/autopatch_strings.sh @@ -5,21 +5,6 @@ # shellcheck disable=SC1091 . "$DIRPATH"/common.sh -# Block forced update dialog (does not bypasses GW525) -sed_libapp 's|version_check_update_config|version_nonapp_check_config' -sed_libapp 's|currentVersion|currentMBdevsa' -sed_libapp 's|minVersion|MBDEVSUCKS' - -# Bypass blacklist IP hashes -sed_libapp 's|list_blocked_ip_hash|list_ip_blocked_hash' - -# Bypass malicious apps check -sed_libapp 's|whitelistServices|Servicewhitelist' - -# XPE003 error fixes -sed_libapp 's|isEnableTimeout|isEnableLockout' -sed_libapp 's|zdefend_config|fua0am0_config' - # App update button url sed_libapp 's|market://details?id=com.mbmobile|https://tinyurl.com/mbcpupdate??|' # Facebook button url @@ -177,8 +162,9 @@ sed_libapp 's|Account Balance|Account balance|g' sed_libapp 's|Set as Default Account|Set as default account|g' # App log header info (client.log) +# Spoof app version patch already spoofed with (_mbcp) suffix. #sed_libapp 's|productionrn|mbcpreleases|g' -sed_libapp 's|Open app MBCPApp|Open app MB Bank|g' +#sed_libapp 's|Open app MBCPApp|Open app MB Bank|g' # Wallet (Link management) sed_libapp 's|Link Management|Link management|' diff --git a/MBCPApp/patches/block_adjust_volume_sekyc.sh b/MBCPApp/patches/block_adjust_volume_sekyc.sh index 5de36c6..1752bd7 100644 --- a/MBCPApp/patches/block_adjust_volume_sekyc.sh +++ b/MBCPApp/patches/block_adjust_volume_sekyc.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # PATCHNAME: Block adjust volume on sEKYC -# MAXVER: 6.4.66 +# MAXVER: 6.4.85 # MINVER: # shellcheck disable=SC1091 . "$DIRPATH"/common.sh diff --git a/MBCPApp/patches/bypass_blacklist_iphash.sh b/MBCPApp/patches/bypass_blacklist_iphash.sh new file mode 100644 index 0000000..53acf92 --- /dev/null +++ b/MBCPApp/patches/bypass_blacklist_iphash.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +# PATCHNAME: Bypass blacklist IP hashes +# MAXVER: 6.4.67 +# MINVER: +# shellcheck disable=SC1091 +. "$DIRPATH"/common.sh + +sed_libapp 's|list_blocked_ip_hash|list_ip_blocked_hash|' diff --git a/MBCPApp/patches/bypass_forced_update_dialog.sh b/MBCPApp/patches/bypass_forced_update_dialog.sh new file mode 100644 index 0000000..c4651b2 --- /dev/null +++ b/MBCPApp/patches/bypass_forced_update_dialog.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +# PATCHNAME: Bypass forced update dialog +# MAXVER: 6.4.67 +# MINVER: +# shellcheck disable=SC1091 +. "$DIRPATH"/common.sh + +# Block forced update dialog (does not bypasses GW525) +sed_libapp 's|version_check_update_config|version_check_nonapp_config' +sed_libapp 's|currentVersion|currentMBCPver|' +sed_libapp 's|minVersion|appVersion|' + diff --git a/MBCPApp/patches/bypass_malicious_apps_check.sh b/MBCPApp/patches/bypass_malicious_apps_check.sh new file mode 100644 index 0000000..0042343 --- /dev/null +++ b/MBCPApp/patches/bypass_malicious_apps_check.sh @@ -0,0 +1,10 @@ +#!/usr/bin/env bash +# PATCHNAME: Bypass malicious app check +# MAXVER: 6.4.67 +# MINVER: +# shellcheck disable=SC1091 +. "$DIRPATH"/common.sh + +# Bypass malicious apps check +sed_libapp 's|whitelistService|Servicewhitelist|' + diff --git a/MBCPApp/patches/fix_vtap_cert.sh b/MBCPApp/patches/fix_vtap_cert.sh index f025bad..4645abd 100644 --- a/MBCPApp/patches/fix_vtap_cert.sh +++ b/MBCPApp/patches/fix_vtap_cert.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash -# PATCHNAME: Fix outdated VTAP certificate -# MAXVER: 6.4.89 +# PATCHNAME: Fix VTAP certificate +# MAXVER: # MINVER: # shellcheck disable=SC1091 . "$DIRPATH"/common.sh @@ -17,8 +17,9 @@ info "Not needed for newer app version (like v6.4.94)" nofwfound() { err "no VTAP firmware in [fixcert] folder found!" info "copy [firmware] and [profile] file to [fixcert] folder to continue." - info "[firmware] and [profile] can be found in [assets], please find from newer app." - info "recommended app : v6.4.94" + info "[firmware] and [profile] can be found in [assets], please find from newer or older app." + info "recommended app : v6.4.94 for fixing v6.4.67 ~ v6.4.91" + info "and v6.4.75 for v6.4.92+ for revert old detection behavior." exit 1 } @@ -26,13 +27,11 @@ mkdir -p "$DIRPATH"/fixcert/ [ ! -f "$DIRPATH"/fixcert/firmware ] && nofwfound -[ ! -f "$DIRPATH"/fixcert/profile ] && nofwfound - # fw cp -f "$DIRPATH"/fixcert/firmware "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/ # profile -cp -f "$DIRPATH"/fixcert/profile "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/ +[ -f "$DIRPATH"/fixcert/profile ] && cp -f "$DIRPATH"/fixcert/profile "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/ info "Remove [firmware] and [profile] file from [/data/data/com.mbmobile/files] or clear app data" -info "If the app still keep crashing or throwing expired certificate screen." +info "If the app still keep crashing or throwing expired certificate screen or the detection is still the same." diff --git a/MBCPApp/patches/hide_vtap_root_detection_activity.sh b/MBCPApp/patches/hide_vtap_root_detection_activity.sh index df67fc3..6ae3ac9 100644 --- a/MBCPApp/patches/hide_vtap_root_detection_activity.sh +++ b/MBCPApp/patches/hide_vtap_root_detection_activity.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # PATCHNAME: Hide VTAP root detection activity & dialog -# MAXVER: 6.4.66 +# MAXVER: # MINVER: # shellcheck disable=SC1091,SC2016 . "$DIRPATH"/common.sh diff --git a/MBCPApp/patches/remove_invoke_to_mbshield.sh b/MBCPApp/patches/remove_invoke_to_zshield.sh similarity index 86% rename from MBCPApp/patches/remove_invoke_to_mbshield.sh rename to MBCPApp/patches/remove_invoke_to_zshield.sh index b122dec..b3c957b 100644 --- a/MBCPApp/patches/remove_invoke_to_mbshield.sh +++ b/MBCPApp/patches/remove_invoke_to_zshield.sh @@ -1,11 +1,13 @@ #!/usr/bin/env bash -# PATCHNAME: Remove invoke to mbshield -# MAXVER: 6.4.66 +# PATCHNAME: Remove invoke to zShield +# MAXVER: # MINVER: 6.4.21 # shellcheck disable=SC1091 . "$DIRPATH"/common.sh -warn "Currently only support remove invoke mbshield to [io.flutter.plugins.MainActivity] and [MBBHomeWidgetQR] !!!" +# mbshield is zShield, not mbshield, zimperium renamed it to bank name + shield + +warn "Currently only support remove invoke zShield to [io.flutter.plugins.MainActivity] and [MBBHomeWidgetQR] !!!" info "Copying..." if [[ -f mbapk/mbapk_unpacked/smali/classes4/io/flutter/plugins/MainActivity.smali ]]; then info "Flutter found on classes4 !!" diff --git a/MBCPApp/patches/remove_mbai.sh b/MBCPApp/patches/remove_mbai.sh index 1565d30..251189a 100644 --- a/MBCPApp/patches/remove_mbai.sh +++ b/MBCPApp/patches/remove_mbai.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# PATCHNAME: Remove MB AI Bullshit resources +# PATCHNAME: Remove MB AI Slop resources # MAXVER: # MINVER: 6.4.73 # shellcheck disable=SC1091 @@ -71,3 +71,7 @@ enforcemb # Adapt with new animated search AI logo (v6.4.77+) cp -f 'blob_patches/searchicon/search.png' 'mbapk/mbapk_unpacked/root/assets/flutter_assets/assets/images/static/search_ai.gif' + +# Adapt with more new AI slop icons (v6.5.x) +rm -rf 'mbapk/mbapk_unpacked/root/assets/flutter_assets/assets/images/dynamic/base/mbai_img_camera.webp' +rm -rf 'mbapk/mbapk_unpacked/root/assets/flutter_assets/assets/images/dynamic/base/mbai_img_photo.webp' diff --git a/MBCPApp/patches/remove_new_zimperium_check.sh b/MBCPApp/patches/remove_new_zimperium_check.sh index affb214..0b9781a 100644 --- a/MBCPApp/patches/remove_new_zimperium_check.sh +++ b/MBCPApp/patches/remove_new_zimperium_check.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # PATCHNAME: Remove new zimperium check -# MAXVER: 6.4.66 +# MAXVER: 6.5.5 # MINVER: 6.4.59 # shellcheck disable=SC1091 . "$DIRPATH"/common.sh diff --git a/MBCPApp/patches/remove_qr_wave.sh b/MBCPApp/patches/remove_qr_wave.sh new file mode 100644 index 0000000..497ec9c --- /dev/null +++ b/MBCPApp/patches/remove_qr_wave.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +# PATCHNAME: Remove QR Scanner Wave +# MAXVER: +# MINVER: +# shellcheck disable=SC1091 +. "$DIRPATH"/common.sh + +rm -f "$DIRPATH"/mbapk/mbapk_unpacked/root/assets/flutter_assets/assets/images/static/ic_wave_qr_scanner.webp diff --git a/MBCPApp/patches/remove_useless_lib.sh b/MBCPApp/patches/remove_useless_lib.sh index 7199478..955cfda 100644 --- a/MBCPApp/patches/remove_useless_lib.sh +++ b/MBCPApp/patches/remove_useless_lib.sh @@ -5,8 +5,11 @@ # shellcheck disable=SC1091 . "$DIRPATH"/common.sh +# remove libvvb2060.so (only for older app verion : v6.5.6 or older) +# in newer app, removing it will trigger checksum failing error (GW934 - Re-install app to continue using app) +[ ! -f 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libcode.so' ] && rm -rf 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libvvb2060.so' +[ ! -f 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libcode.so' ] && rm -rf 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libvvb2060.so' + +# remove rootbeer simple check (used in singalarity ekyc) rm -rf 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libtoolChecker.so' rm -rf 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libtoolChecker.so' - -rm -rf 'mbapk/mbapk_unpacked/root/lib/arm64-v8a/libvvb2060.so' -rm -rf 'mbapk/mbapk_unpacked/root/lib/armeabi-v7a/libvvb2060.so' diff --git a/MBCPApp/patches/spoof_appver.sh b/MBCPApp/patches/spoof_appver.sh index 0eb760f..b056436 100644 --- a/MBCPApp/patches/spoof_appver.sh +++ b/MBCPApp/patches/spoof_appver.sh @@ -12,22 +12,46 @@ info "Spoofing app version..." +# v6.5.2x +sed -i 's|"6.5.29"|"6.5.29.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.28"|"6.5.28.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.27"|"6.5.27.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.26"|"6.5.26.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.25"|"6.5.25.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.24"|"6.5.24.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.23"|"6.5.23.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.22"|"6.5.22.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.21"|"6.5.21.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.20"|"6.5.20.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' + +# v6.5.1x +sed -i 's|"6.5.19"|"6.5.19.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.18"|"6.5.18.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.17"|"6.5.17.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.16"|"6.5.16.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.15"|"6.5.15.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.14"|"6.5.14.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.13"|"6.5.13.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.12"|"6.5.12.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.11"|"6.5.11.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.10"|"6.5.10.mbcp"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' + # v6.5.x -sed -i 's|6.5.9|6.5.9.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.8|6.5.8.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.7|6.5.7.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.6|6.5.6.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.5|6.5.5.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.4|6.5.4.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.3|6.5.3.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.2|6.5.2.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.1|6.5.1.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.5.0|6.5.0.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.9"|"6.5.9.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.8"|"6.5.8.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.7"|"6.5.7.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.6"|"6.5.6.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.5"|"6.5.5.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.4"|"6.5.4.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.3"|"6.5.3.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.2"|"6.5.2.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.1"|"6.5.1.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|"6.5.0"|"6.5.0.legacy"|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' # v6.4.9x -sed -i 's|6.4.99|6.4.99.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.4.98|6.4.98.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' -sed -i 's|6.4.97|6.4.97.mbcp|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|6.4.99|6.4.99.legacy|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|6.4.98|6.4.98.legacy|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|6.4.97|6.4.97.legacy|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|6.4.96|6.4.96.legacy|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|6.4.95|6.4.95.legacy|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|6.4.94|6.4.94.legacy|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' @@ -88,7 +112,7 @@ sed -i 's|6.4.49|6.4.49.old|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|6.4.48|6.4.48.old|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|6.4.47|6.4.47.old|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' - +# versionCode spoofing to prevent in-app forced update dialog, and play store / aurora store from replacing with original app :> sed -i 's|704|1000|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|712|1001|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|727|2000|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' @@ -110,6 +134,43 @@ sed -i 's|744|2014|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|745|2015|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|746|2016|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|747|2017|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|749|2018|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|750|2019|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|751|2020|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|752|2021|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|753|2022|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|754|2023|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|755|2024|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|756|2025|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|757|2026|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|758|2027|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +# v6.5.14 +sed -i 's|759|2028|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +# other versions +sed -i 's|760|2028|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|761|2029|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|762|2030|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|763|2031|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|764|2032|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|765|2033|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|766|2034|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|767|2035|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|768|2036|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|769|2037|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|770|2038|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|771|2039|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|772|2040|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|773|2041|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|774|2042|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|775|2043|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|776|2044|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|777|2045|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|778|2046|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|779|2047|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|780|2048|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|781|2049|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' +sed -i 's|782|2050|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' + sed -i 's|v6.4.66|v6.4.68|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' sed -i 's|v6.4.65|v6.4.68|g' 'mbapk/mbapk_unpacked/AndroidManifest.xml' diff --git a/MBCPApp/patches/target_sdk_34.sh b/MBCPApp/patches/target_sdk_34.sh index ac4e793..392aeee 100644 --- a/MBCPApp/patches/target_sdk_34.sh +++ b/MBCPApp/patches/target_sdk_34.sh @@ -5,4 +5,7 @@ # shellcheck disable=SC1091 . "$DIRPATH"/common.sh +# applies for v6.4.62 ~ v6.5.19 sed -i 's|android:targetSdkVersion="35"|android:targetSdkVersion="34"|g' "$DIRPATH"/mbapk/mbapk_unpacked/AndroidManifest.xml +# applies for v6.5.20+ +sed -i 's|android:targetSdkVersion="36"|android:targetSdkVersion="34"|g' "$DIRPATH"/mbapk/mbapk_unpacked/AndroidManifest.xml diff --git a/MBCPApp/patches/whereis_criticalpatches.sh b/MBCPApp/patches/whereis_criticalpatches.sh deleted file mode 100644 index 68e9bd1..0000000 --- a/MBCPApp/patches/whereis_criticalpatches.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env bash -# PATCHNAME: Where is VTAP & Zimperium bypass -# MAXVER: -# MINVER: -# shellcheck disable=SC1091 -. "$DIRPATH"/common.sh - -echo "--------------Why Zimperium and VTAP bypass patches disappeared?--------------" -warn "VTAP and Zimperium bypass is restricted to v6.4.66 only due to MB limitations to v6.4.67+" -info "They added stronger check, it uses SHA-256 to check all of dex files and libraries, if it does not match\n" -info "The app will refuse to login with GW934 error. There is already a bypass in the past, but is fixed." -info "A newer bypass is planned, but I don't have time. I am a student, and in 12th grade, time does not allow me." -echo "------------------------------------------------------------------------------" -echo "So what next???" -echo "From Patcher, just apply other patches, and repack APK" -echo "Since the local root detection model is deleted, you can use my MBZDefend-Fix module" -echo "It uses another way to bypass Zimperium check, and still works :)" -echo "For VTAP bypass? No way, but it is still easily to hide. It will comeback once I achieve another checksum bypass." -exit 169 diff --git a/MBCPApp/patches/xpe003_fix.sh b/MBCPApp/patches/xpe003_fix.sh new file mode 100644 index 0000000..d149245 --- /dev/null +++ b/MBCPApp/patches/xpe003_fix.sh @@ -0,0 +1,10 @@ +#!/usr/bin/env bash +# PATCHNAME: XPE003 Fix +# MAXVER: 6.4.67 +# MINVER: +# shellcheck disable=SC1091 +. "$DIRPATH"/common.sh + +# XPE003 error fixes +sed_libapp 's|isEnableTimeout|isEnableLockout|' +sed_libapp 's|zdefend_config|fua0am0_config|' diff --git a/README.md b/README.md index 0b7e1b4..97a76f9 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,18 @@ > > Older releases (v6.4.90 or older) has mismatch commit ID with this new repo, for reference to the exactly same commit, see [MBCP_VersionReference.md](MBCP_VersionReference.md) in repository. +## Checksum + +- More information about checksum measure : +
+ +- Since v6.5.15+, the checksum is more strict, see [this explain](docs/checksum_newapp.md) for more details. + +- The checksum measure (which throws GW934 as response) is known enabled from the server-side (v6.4.64 works since days 0, but return with GW934 error after 11 days), it requires client (MBCP/MBBank) app to sent the SHA256 hash of 3 app libraries `libapp.so` | `libmbshield.so` | `libclosestmadagascar.so` and all of 5 dex files (classes1->5.dex) to the server for comparing hash, and if it doesn't match, the server will prevent the app from logging in with GW934 error : `Re-install app to continue using app.` +- The other function (eg: DigitalOTP) that works without logging in still works. + +
+ ## Introduction > Fact : MBCP / MBZDefend-Fix is my "hobby project", I maintain it in my free times :> @@ -50,45 +62,48 @@ ## Patches list : +**Not seeing Zimperium bypass?** It is moved to legacy patch, local Zimperium model is already removed when you unpack APK, just apply other patch, repack and use [MBZDefend-Fix](/mbcp/mbzdefend-fix/releases) module to bypass the detection. + ### [📦 `MB Bank : com.mbmobile`](https://t.me/embeeapks) +> Any version from v6.4.63 and above should be patchable, but some version, such as v6.5.15, or v6.4.67+ has enhanced checksum mechanism, the patch still works, but the app itself will refuse to login. *Last updated situation: 2026/09/09* +
| ⚙️ Patch | 📜 Description | 🏦 Suggested version | |:--------:|:--------------:|:-----------------:| -| `Add verified badge` | Replaces the MIC protection shield with verified badge to make it looks more cute :3 | v6.4.0 ~ v6.5.2 | -| `Adaptive launcher icon` | Adds the adaptive & themed icon support to the app. Thanks to @fukiame ! | v6.4.0 ~ v6.5.2 | -| `Proper notification icon` | Temporary fixes for the app notification icon. Thanks to @fukiame ! | v6.4.0 ~ v6.5.2 | -| `Block adjust volume on sEKYC` | Prevent the device volume from being adjusted when entering eKYC activity. (Hidden for v6.4.67+) | v6.4.0 ~ v6.5.2 | -| `Better custom background screen` | Replace the preview custom background from awful to useful. | v6.4.84 ~ v6.5.2 | -| `Change app logo` | Change the app logo with set of icons. | v6.4.0 ~ v6.5.2 | -| `Change widget background to dark ` | Change widget background to dark if you use MBBHomeWidget. | v6.4.0 ~ v6.5.2 | -| `Custom VTAP screen` | Warn users about critical VTAP trigger error from app. | v6.4.53 ~ v6.5.2 | -| `Custom sub-badge` | Replace original animated promotion badge with static badge for Basic users | v6.4.44 ~ v6.5.2 | -| `Disable MB Membership` | Disable the MB Membership badge below pfp and all of it's features. (limited features with v6.4.67+) | v6.4.0 ~ v6.5.2 | -| `Tian37 Fix` | Nuke detection points within Tian37 libraries. | v6.4.87 ~ v6.5.2 | -| `Force portrait screen` | Force the screen always portrait on app, especially when launching app. | v6.4.0 ~ v6.5.2 | -| `Remove MB AI Bullsh*t resources` | Remove the bullsh*t MB AI resources from app. | v6.4.74 ~ v6.5.2 | -| `Remove MB Themes Store` | Remove the MB Themes Store banner from Themes list, preventing access to MB Theme Store. | v6.4.28 ~ v6.5.2 | -| `Remove invoke to mbshield` | Make app don't invoke to mbshield when opening (MainActivity) and (MBBHomeWidgetQR) only (Hidden for v6.4.67+) | v6.4.22 ~ v6.5.2 | -| `Remove new zimperium check` | Remove the new Zimperium (ZDefend) root detection from app. Picked up from Legacy Patch. (Hidden for v6.4.67+) | v6.4.60 ~ v6.5.2 | -| `Remove built-in fonts` | Remove app font and force to use device font for most app components. | v6.4.0 ~ v6.5.2 | -| `Modify app theme` | Modify the built-in app theme from original one to other themes. | v6.4.30 ~ v6.5.2 | -| `Remove garbage permission and activities` | Removes tracking permission & activities from app. | v6.4.0 ~ v6.5.2 | -| `Revert old eMBee logo` | Revert old eMBee logo, especially on product consultation options. | v6.4.53 ~ v6.5.2 | -| `Remove useless libraries` | Remove the useless libraries from app, only for v6.4.67+ | v6.4.67 ~ v6.5.2 | -| `Remove animated QR background` | Remove the animated QR background from bottom navigation bar and replace with white background. | v6.4.43 ~ v6.5.2 | -| `Remove VNPAY VMB20` | Remove the VNPAY Airplane related activities. | v6.4.55 ~ v6.5.2 | -| `Restore old registration resources` | Restore old resources on `onboarding` page. | v6.4.48 ~ v6.5.2 | -| `Hide VTAP root detection activity & dialog` | Hide the old root detection screen and dialog showing "Device is rooted" (might have issues with some HyperOS ROMs). (Hidden for v6.4.67+) | v6.4.0 ~ v6.5.2 | -| `Legacy hide VTAP activity & dialog` | Hide the first root detection screen with dialog showing "Device is rooted" but not bypassing it. (GW908 will still present, unlike standard `Hide VTAP root detection activity & dialog` patch). Only use for some ugly ROMs which is crashing with standard patch. (Hidden for v6.4.67+) | v6.4.53 ~ v6.5.2 | -| `Remove protection shield` | Remove the MIC protection shield on profile picture and login screen. (not app protection) | v6.4.0 ~ v6.5.2 | -| `Remove app from launcher` | Remove the app icon from launcher, and start with `am start` or with MBZDefend-Fix Action/Termux. | v6.4.0 ~ v6.5.2 | -| `Set targetSdkVersion to 34` | Set the `targetSdkVersion` to 34 (Android 14) to prevent UI issues on some activities. | v6.4.10 ~ v6.5.2 | -| `Add modified resources` | Adds the specific strings for MBCP on eKYC phases, and modify the DigiBank logo. | v6.4.0 ~ v6.5.2 | -| `Add anime resources` | Adds anime-related resources to some components inside app. | v6.4.45 ~ v6.5.2 | +| `Add verified badge` | Replaces the MIC protection shield with verified badge to make it looks more cute :3 | v6.4.0 ~ v6.5.14 | +| `Adaptive launcher icon` | Adds the adaptive & themed icon support to the app. Thanks to @fukiame ! | v6.4.0 ~ v6.5.14 | +| `Proper notification icon` | Temporary fixes for the app notification icon. Thanks to @fukiame ! | v6.4.0 ~ v6.5.14 | +| `Better custom background screen` | Replace the preview custom background from awful to useful. | v6.4.84 ~ v6.5.14 | +| `Change app logo` | Change the app logo with set of icons. | v6.4.0 ~ v6.5.14 | +| `Change widget background to dark ` | Change widget background to dark if you use MBBHomeWidget. | v6.4.0 ~ v6.5.14 | +| `Custom VTAP screen` | Warn users about critical VTAP trigger error from app. | v6.4.53 ~ v6.5.14 | +| `Custom sub-badge` | Replace original animated promotion badge with static badge for Basic users | v6.4.44 ~ v6.5.14 | +| `Disable MB Membership` | Disable the MB Membership badge below pfp and all of it's features. (limited features with v6.4.67+) | v6.4.0 ~ v6.5.14 | +| `Tian37 Fix` | Nuke detection points within Tian37 libraries. (Causing GW934 error for v6.5.7+) | v6.4.87 ~ v6.5.14 | +| `Force portrait screen` | Force the screen always portrait on app, especially when launching app. | v6.4.0 ~ v6.5.14 | +| `Fix VTAP certificate` | Update or downgrade VTAP certificate for older/newer app version, so it can work again in future. Read `docs/fix-vtap-cert.md` to know how to use it. | v6.4.67 ~ v6.5.14 | +| `Remove MB AI Slop resources` | Remove the MB AI slop resources from app. | v6.4.74 ~ v6.5.14 | +| `Remove MB Themes Store` | Remove the MB Themes Store banner from Themes list, preventing access to MB Theme Store. | v6.4.28 ~ v6.5.14 | +| `Remove invoke to zShield` | Make the app stop invoking to zShield when opening (MainActivity) and (MBBHomeWidgetQR) only (causing GW934 error for v6.4.67+) | v6.4.22 ~ v6.5.14 | +| `Remove built-in fonts` | Remove app font and force to use device font for most app components. | v6.4.0 ~ v6.5.14 | +| `Modify app theme` | Modify the built-in app theme from original one to other themes. | v6.4.30 ~ v6.5.14 | +| `Remove garbage permission and activities` | Removes tracking permission & activities from app. | v6.4.0 ~ v6.5.14 | +| `Revert old eMBee logo` | Revert old eMBee logo, especially on product consultation options. | v6.4.53 ~ v6.5.14 | +| `Remove useless libraries` | Remove the useless libraries from app, only for v6.4.67+ | v6.4.67 ~ v6.5.14 | +| `Remove animated QR background` | Remove the animated QR background from bottom navigation bar and replace with white background. | v6.4.43 ~ v6.5.14 | +| `Remove VNPAY VMB20` | Remove the VNPAY Airplane related activities. | v6.4.55 ~ v6.5.14 | +| `Restore old registration resources` | Restore old resources on `onboarding` page. | v6.4.48 ~ v6.5.14 | +| `Hide VTAP root detection activity & dialog` | Hide the old root detection screen and dialog showing "Device is rooted" (might have issues with some HyperOS ROMs). (causing GW934 error for v6.4.67+) | v6.4.0 ~ v6.5.14 | +| `Legacy hide VTAP activity & dialog` | Hide the first root detection screen with dialog showing "Device is rooted" but not bypassing it. (GW908 will still present, unlike standard `Hide VTAP root detection activity & dialog` patch). Only use for some ugly ROMs which is crashing with standard patch. (Causing GW934 error for v6.4.67+) | v6.4.53 ~ v6.5.14 | +| `Remove protection shield` | Remove the MIC protection shield on profile picture and login screen. (not app protection) | v6.4.0 ~ v6.5.14 | +| `Remove app from launcher` | Remove the app icon from launcher, and start with `am start` or with MBZDefend-Fix Action/Termux. | v6.4.0 ~ v6.5.14 | +| `Set targetSdkVersion to 34` | Set the `targetSdkVersion` to 34 (Android 14) to prevent UI issues on some activities. | v6.4.10 ~ v6.5.14 | +| `Add modified resources` | Adds the specific strings for MBCP on eKYC phases, and modify the DigiBank logo. | v6.4.0 ~ v6.5.14 | +| `Add anime resources` | Adds anime-related resources to some components inside app. | v6.4.45 ~ v6.5.14 |
@@ -102,8 +117,12 @@ | ⚙️ Patch | 📜 Description | 🏦 Suggested version | |:--------:|:--------------:|:-----------------:| -| `Fix outdated VTAP certificate` | Update new VTAP certificate for older app version, so it can work again in future | v6.4.67 ~ v6.4.90 | | `Autopatch strings` | Modify the strings in-app within `libapp.so`, and also fixes some translation typo in-app. | v6.4.0 ~ v6.4.66 | +| `Bypass blacklist IP hashes` | Bypass the block list of some IP hashes. | v6.4.50 ~ v6.4.66 | +| `Bypass forced update dialog` | Bypass forced update dialog from app. | v6.4.0 ~ v6.4.66 | +| `Bypass malicious app check` | Bypass malicious app check from app. | v6.4.10 ~ v6.4.66 | +| `Block adjust volume on sEKYC` | Prevent the device volume from being adjusted when entering eKYC activity. (causing GW934 error for v6.4.67+) | v6.4.0 ~ v6.4.85 | +| `XPE003 Fix` | Fix XPE003 issues when use bypass zimperium patch. | v6.4.56 ~ v6.4.66 | | `Bypass GW934 checksum` | Bypass the GW934 error rolled-out from MB server-side which prevent MBCP users from logging in to app. Only use this after applied all your patch needs. | v6.4.64 ~ v6.4.66 | | `Remove custom profile picture` | Force the use of default profile picture instead of your current one on MB's server side. | v6.4.0 ~ v6.4.66 | | `Restore old 682 lib` | Restore old v6.4.61 `libapp.so` to prevent enforced `quockhanh` theme changes on v6.4.62. | v6.4.62 | @@ -114,6 +133,7 @@ | `Bypass accessibility & malicious apps check` | Remove the restriction of using the app when an app using accessibility service or "malicious apps" like (HideMyAppList) installed. | v6.4.25 ~ v6.4.54 | | `Remove new root detection` | Remove the new Zimperium (ZDefend) root detection from app. (Now requires workaround for v6.4.56+) | v6.4.15 ~ v6.4.58 | | `Bypass new zimperium detection` | Bypass the root check from Zimperium within app. | v6.4.56 ~ v6.4.63 | +| `Remove new zimperium check` | Remove the new Zimperium (ZDefend) root detection from app. Picked up from Legacy Patch. (causing GW934 error for v6.4.67+) | v6.4.60 ~ v6.5.6 | @@ -330,15 +350,6 @@ Early note : When I created @mbbmod channel back in 2023, no one knows it for mo - [x] Adapt new v6.4.68 trungthu theme -## Old measure - -- More information about GW934 measure : -
- -- The `GW934` error is known enabled from the server-side (v6.4.64 works since days 0, but return with GW934 error after 11 days), it requires client (MBCP/MBBank) app to sent the SHA256 hash of 3 app libraries `libapp.so` | `libmbshield.so` | `libclosestmadagascar.so` and all of 5 dex files (classes1->5.dex) to the server for comparing hash, and if it doesn't match, the server will prevent the app from logging in with GW934 error : `Re-install app to continue using app.` -- The other function (eg: DigitalOTP) that works without logging in still works. - -
## Credits - [apktool](https://github.com/iBotPeaches/Apktool) diff --git a/docs/checksum_newapp.md b/docs/checksum_newapp.md new file mode 100644 index 0000000..e7f3308 --- /dev/null +++ b/docs/checksum_newapp.md @@ -0,0 +1,43 @@ + + +# MBBank v6.5.15+ checksum list + +in first day of v6.5.15+ released, there is no such checksum, it still the same as before, only until 4 days since release, there is toggle in backend that enable the check, remain unaffected for older base + +same as v6.4.63+, in first day nothing happens, no checksum, but after 11 days, checksum appears. + +if one of these is modified (even one bit) will trigger checksum fail that refuse to accept login from + +all of this is both app & server side, server side ask for checksum, the client get sha256 hash and send to server side `getSHFiles` and if something mismatch, the server side will refuse to login and return GW934 as response to app + +```shell +# outside assets (v6.5.15+) +mb.apk/AndroidManifest.xml +mb.apk/lib/arm64-v8a/*.so # previously is libapp / zshield & zdefend libs only since v6.4.63+ +mb.apk/lib/armeabi-v7a/*.so # previously is libapp / zshield & zdefend libs only since v6.4.63+ +mb.apk/classes*.dex # since v6.4.63+ + +# in assets +# zimperium (v6.5.15+) +mb.apk/assets/zimperium_local_model_randomized_filename* +mb.apk/assets/zimperium_encrypted_dex_folder/*.odex +mb.apk/assets/*.szip # zshield encrypted files + +# vkey vtap (v6.5.15+) +mb.apk/assets/firmware # vkey vtap fw +mb.apk/assets/profile # vkey vtap profile +mb.apk/assets/signature # vtap vkey signature +mb.apk/version.json # vtap vkey vos info +mb.apk/voscodesign.vky +mb.apk/vkeylicensepack + +# singalarity ekyc files (v6.5.15+) +mb.apk/assets/sgprofile +mb.apk/assets/smart_ekyc_finall.zip +mb.apk/assets/media_init_data + +# flutter assets (v6.5.15+) +mb.apk/assets/flutter_assets/assets/fonts/* +mb.apk/assets/flutter_assets/fonts/* +mb.apk/assets/flutter_assets/FontManifest.json +``` diff --git a/docs/fix-vtap-cert.md b/docs/fix-vtap-cert.md new file mode 100644 index 0000000..41dda55 --- /dev/null +++ b/docs/fix-vtap-cert.md @@ -0,0 +1,56 @@ +# Fix VTAP Certificate usage + +This patch can't be applied just by cloning regular repo and apply, I already mentioned it requires specific `firmware` (and `profile` for older base) in `fixcert` folder to function + +It can also revert new detection behavior of V-Key (VTAP) like SELinux check, LSPosed, Zygisk check, etc (choose v6.4.78 blobs or older, max to v6.4.53) + +``` +# from fix_vtap_cert.sh : + +# What is [firmware] and [profile]? +# It contains the firmware and certificate for VTAP to communicate with the app connection +# Both [firmware] and [profile] is encrypted with base64 format. +# We do not provide it in the project source, but you can get it from the app itself, in [assets] folder. +``` + +## How to apply it? + +- You can take `firmware` and `profile` file from older app base, then copy to `fixcert` folder in `MBCPApp/` or clone the following repo (it has blobs for some versions) + +``` +# clone vkey vtap blobs repo +git clone https://git.disroot.org/cuynu/vtapfw_blobs.git +cd vtapfw_blobs + +# in vtapfw_blobs folder, the structure are like this +[cuynu@x99e vtapfw_blobs] $ tree +. +├── README.md +├── v6.4.66 +│   ├── firmware +│   └── profile +├── v6.4.75 +│   ├── firmware +│   └── profile +└── v6.5.2 + ├── firmware + └── profile +``` + +- Just choose the proper blobs you want to use, then copy it to `fixcert` folder in `MBCPApp` (in this example i'll use v6.4.75 one, `mbbpatch` cloned in home folder) +``` +cp v6.4.75/firmware ~/mbbpatch/MBCPApp/fixcert +# DO NOT copy profile if you are patching newer base then the blobs one, otherwise it will fail certificate check. +cp v6.4.75/profile ~/mbbpatch/MBCPApp/fixcert +``` + +Then run patcher again `./mbcpapp.sh` -> `Patch App` -> `Fix VTAP Certificate` -> it will work :) + +After installed the patched app, if you have previous data, the old one may still present there, at this point delete with +``` +su -c rm -f /data/data/com.mbmobile/firmware +su -c rm -f /data/data/com.mbmobile/profile +``` + + +