Open source specific repo - Xposed General

So I look through the built in repo and I install a lot of things on my old phone to play with. However on the primary I only use FOSS. If a module doesn't have a git page then I don't install it.
I was thinking it would be neat if someone maintained a separate F-Droid repo specifically for xposed modules which are open source. Since xposed itself is open source you could have that on there as well.
It'd be nicer if there was a filter option in the program itself but I'm sure the devs are busy and the above would just be easier.

Maybe it is possible to add "Open source modules" in Sort mode (in Xposed Installer -> Download). It will simply check if Source link for module is not empty.
Who can take this idea and contribute this feature to Xposed?

Waking up this thread. I would also really like to have a structured list of modules which are open source for security reasons. Is this available anywhere yet?

E--Man said:
Waking up this thread. I would also really like to have a structured list of modules which are open source for security reasons. Is this available anywhere yet?
Click to expand...
Click to collapse
Maybe we can get "repo db" and look for source code field. But "in app implementation" is prefered. @rovo89

pyler said:
Maybe we can get "repo db" and look for source code field. But "in app implementation" is prefered. @rovo89
Click to expand...
Click to collapse
Where could we obtain the DB with those fields? I would never install any closed-source modules on my devices. Doing so is absolutely ludicrous in my opinion.
Also, is there a list of verified and trusted (by @rovo89 or someone alike) Xposed modules anywhere?
This is a very important topic...
Thanks,
E.

See https://github.com/rovo89/XposedInstaller/issues/249
The information about the source code URL is available in the repository XML file already and could easily be read be the installer. The issue is up for grabbing. I would appreciate a quick outline if the intended implementation though, so I can intervent regarding architectural decisions before someone writes a lot of code.
I can't give any "trust" recommendations for any but my own modules. It would mean that I would have to analyse the complete source code, verify that the APK actually matches that source code and repeat these steps for every new versions.

Well, if module is open source, anybody can check code so I think there is almost zero chance for malwares or so...
Closed sourced and obfuscated modules are the worst ones. Avoid them. They can do basically everything in background and user knows nothing.
So any skilled dev who is able to create new filter in Xposed Installer for open source modules here? It could be good addition.

pyler said:
Well, if module is open source, anybody can check code so I think there is almost zero chance for malwares or so...
Closed sourced and obfuscated modules are the worst ones. Avoid them. They can do basically everything in background and user knows nothing.
So any skilled dev who is able to create new filter in Xposed Installer for open source modules here? It could be good addition.
Click to expand...
Click to collapse
Really?..
Anybody can check sources, but who will?..
And can you trust their results?..
FOSS can be riddled with exploits like Heartbleed for years, and no one will notice anything. There are even competitions on hiding malicious code inside innocent one...
Only a small number of experienced and skilled developers will be able to find such malware, and believe me - 99% of them don't waste their time on reading, understanding and checking for exploits the sources of all software they use...

@rovo89, thanks for responding to this thread.
I am just wondering if anyone has any updates on the development of an Open Source repository.
Also, I feel that it would also be helpful if we had some sort of a "Developer Trust Rating" as well as a "Code Reviewer" status to ensure that the code of a particular module (or even revision if someone volunteers to take it that far) is both safe and/or that the code has been inspected.
Without this, installing modules on devices means we could be installing software that can be as malicious as it can get.
Lastly, where can I download the XML file that lists XPosed modules along with the "source code URL", and how can I validate that the source code in the URL matches that of the XPosed module itself?
Thanks.

E--Man said:
Also, I feel that it would also be helpful if we had some sort of a "Developer Trust Rating" as well as a "Code Reviewer" status to ensure that the code of a particular module (or even revision if someone volunteers to take it that far) is both safe and/or that the code has been inspected.
Click to expand...
Click to collapse
That's a nice vision, but I doubt that you will find enough people to actually do this who you trust and who would be willing to take the responsibility.
E--Man said:
Lastly, where can I download the XML file that lists XPosed modules along with the "source code URL", and how can I validate that the source code in the URL matches that of the XPosed module itself.
Click to expand...
Click to collapse
Check the source code of the installer for the URL, I don't remember it. But there is no way you can check an APK and find out whether it's built from a certain source. That would only be possible if the developer gave the source code to a trusted party, who would compile it and sign it with their keys. If you trust that third party AND inspect the source code, then you can be sure that it's not malicous. That's F-Droid's model, as far as I know.

YaDr said:
Really?..
Anybody can check sources, but who will?..
And can you trust their results?..
FOSS can be riddled with exploits like Heartbleed for years, and no one will notice anything. There are even competitions on hiding malicious code inside innocent one...
Only a small number of experienced and skilled developers will be able to find such malware, and believe me - 99% of them don't waste their time on reading, understanding and checking for exploits the sources of all software they use...
Click to expand...
Click to collapse
Hello there my Russian friend. I will respectfully disagree with you on this point and I will explain why. Right here on XDA, we have many highly-skilled developers who are the authors of countless lines of code translating into ROMs, modules, enhancements, etc. Much (if not all) of these projects are free to distribute and created as a contribution to the community. In other words, to ask "who will check sources" is the same thing as asking "who will create custom ROMs for people?" or "who will create invaluable/indispensable modules such as XPosed?" or even the general question of "why would someone do this for free?".
It is evident that all of these exist already and that people do indeed contribute, so coupled with the fact that the XDA community is over 5 million members in size, I think there will be developers who may be interested.
The only reason I can see someone not supporting this is if they have an interest not to do so, such as being the author of a closed-source (or open-source) malicious module.

"FOSS can be riddled with exploits like Heartbleed for years, and no one will notice anything"
Yeah but if it was closed source there is a chance it would have never been found.
Also saying that "no one would bother to check the code" is a horrible argument. At least give people the option to inspect it if they want to.

Bump, has anyone taken this to the next step? I am still interested!
Please use the QUOTE feature when replying to me to get my attention. Thanks!

Bump, has anyone taken this to the next step? I am still interested! <br />
<br />
Please use the QUOTE feature when replying to me to get my attention. Thanks!<br/>
Please use the QUOTE feature when replying to me to get my attention. Thanks!

I think more filters in general would be a good thing. There are a lot of Asian based apps that I have no interest in, nor do I play Pokemon/Ingress.
Categories for what country you're in or if an app is for gaming/banking/etc... would be nice. Maybe have the API levels it will work with too, and then just not show anything outside of that range.
I suppose someone could just make an F-Droid repo specifically for xposed/magisk apps too, though I would prefer it if it were officially maintained/sanctioned.

Related

[SOURCE] KERNEL Source Released!

Well, this is sure an interesting email that I just received back from LG's support team, when asked about the kernel sources.
The rep seems to know what I'm asking for-- but for whatever reason denies my request (which is reasonable by the GPL).
Anyway, full email here:
Dear Tyler,
Thank you for inquiring of LG Electronics.
We do apologize for any inconvenience this may have caused.
We would be more than happy to provide the Kernel source which is: 2.6.32.9-PERF
[email protected] #1
Unfortunately, the source will not be released.
Please feel free to contact us if you have any additional questions or concerns. Thank you again for contacting LG Electronics.
Maya C
E-Mail Administrator
Customer Interactive Center
LGEAI
-----------Original Customer Inquiry------------
Received Date : 06/22/2011 02:03 10
The type of inquiry : Others
Product/Model No. : CDMA/LGVS910
As per the GPL, is there somewhere that I can find kernel sources for the LGVS910?
It is not on your LG Open Source page, is there an alternate location I should look?
If there is no public place to download the source, what is your timeline for releasing it?
Thank you!
Click to expand...
Click to collapse
Hmm, should I quote the GPL back to them, or try asking nicely again?
thecubed said:
Well, this is sure an interesting email that I just received back from LG's support team, when asked about the kernel sources.
The rep seems to know what I'm asking for-- but for whatever reason denies my request (which is reasonable by the GPL).
Anyway, full email here:
Hmm, should I quote the GPL back to them, or try asking nicely again?
Click to expand...
Click to collapse
Yeah, that's an invalid response if the code is GPLed.
I'm not quite sure why or how they think they can get away with that, considering the source for all their other phones is available here: http://www.lg.com/global/support/opensource/opensource.jsp
Even the tmobile g2x has it's sources posted...
What I wonder is if they're just saying that _this_ kernel's sources won't be posted.
Maybe they're embarassed? Hope not, because I demand this kernel's source!
thecubed said:
I'm not quite sure why or how they think they can get away with that, considering the source for all their other phones is available here: http://www.lg.com/global/support/opensource/opensource.jsp
Even the tmobile g2x has it's sources posted...
What I wonder is if they're just saying that _this_ kernel's sources won't be posted.
Maybe they're embarassed? Hope not, because I demand this kernel's source!
Click to expand...
Click to collapse
They may be protecting Microsoft's interests (they think) or they had a side agreement with Netflix. Either way, they can't deny a derivative work. It doesn't work that way. (at least I think? I haven't read the most recent GPL in a while...lol)
majorpay said:
They may be protecting Microsoft's interests (they think) or they had a side agreement with Netflix. Either way, they can't deny a derivative work. It doesn't work that way. (at least I think? I haven't read the most recent GPL in a while...lol)
Click to expand...
Click to collapse
As far as my understanding of the GPL, any code they modify that is released as GPL must be released as GPL also.
So, they (CodeAurora) modified Linux-2.6.32.9, which is GPL, hence they must release any modifications.
Where it gets grey is in terms of proprietary modules. However, if it's compiled into the kernel, I understand that it must also be released as source also. The only way to avoid that is to use module loading and taint the kernel, which then does some other license-protecting stuff.
Damn, the GPL is complicated.
EDIT: I'm in LG Live Chat right now asking...
thecubed said:
As far as my understanding of the GPL, any code they modify that is released as GPL must be released as GPL also.
So, they (CodeAurora) modified Linux-2.6.32.9, which is GPL, hence they must release any modifications.
Where it gets grey is in terms of proprietary modules. However, if it's compiled into the kernel, I understand that it must also be released as source also. The only way to avoid that is to use module loading and taint the kernel, which then does some other license-protecting stuff.
Damn, the GPL is complicated.
Click to expand...
Click to collapse
Yeah, it gets more so every year, and depending on what version of GPL is in use depends on what the specifics are. I'd have to say even if their module loading taints the kernel, they should be able to (read: must) release the modified source prior to the dirty side mods.
if they are anything like samsung, they will sit on it for as long as possible.
LG Chat:
Jorge: Hello Guest. Welcome to LG Electronics! How may I provide you with excellent service today?
Guest: Hello, I was wondering when the kernel sources for the LGVS910 would be posted? Specifically kernel 2.6.32.9-PERF [email protected]
Jorge: unfortunately we do not have a date
Guest: Any reasonable estimate?
Jorge: I will love to say a date but we do not have information.
Guest: Okay, thank you.
Click to expand...
Click to collapse
Well, maybe the person in the email was misinformed, or just plain ol confused...
thecubed said:
LG Chat:
Well, maybe the person in the email was misinformed, or just plain ol confused...
Click to expand...
Click to collapse
Or... the current rep is stalling? Why would there be a delay? Shouldn't the GPLed kernel be available immediately at request?
I'm going to assume it won't be too long before they release 2.3 for this phone.
majorpay said:
Or... the current rep is stalling? Why would there be a delay? Shouldn't the GPLed kernel be available immediately at request?
I'm going to assume it won't be too long before they release 2.3 for this phone.
Click to expand...
Click to collapse
Me too.
To give LG some benefit of the doubt, it is possible they just don't want to put the work into it, considering they may have something brand new around the corner.
But-- what I worry about is OTA locking down the phone.... hence my want/need for sources, just in case.
thecubed said:
Me too.
To give LG some benefit of the doubt, it is possible they just don't want to put the work into it, considering they may have something brand new around the corner.
But-- what I worry about is OTA locking down the phone.... hence my want/need for sources, just in case.
Click to expand...
Click to collapse
Yes, and I've seen 2.3 turn otherwise perfectly good phones into piles of poo, so I definitely want a way back if that happens here. Resource requirements and overall overhead seems to increase 10 fold on 2.3
Come to think of it... I just realized I should be really worried for the next OTA update...
Now, those of us with clockwork need not worry, since it just will say "invalid signature" when LG's updates try to install (since clockwork is signed with the testkeys from cyanogenmod). Once it says "invalid signature" you'd just click "reboot now" and grab the update file from /cache .
But still... the unknown is killing me!
Isn't that exactly what happend with the thunderbolt?
thecubed said:
Come to think of it... I just realized I should be really worried for the next OTA update...
Now, those of us with clockwork need not worry, since it just will say "invalid signature" when LG's updates try to install (since clockwork is signed with the testkeys from cyanogenmod). Once it says "invalid signature" you'd just click "reboot now" and grab the update file from /cache .
But still... the unknown is killing me!
Click to expand...
Click to collapse
Well, we can work on the assumption that it's never coming... because you know how Verizon is about releasing updates.
However, in the meantime LG needs to cough up the goods per legal requirement. It could all be part of a greater conspiracy, ha! Release the next batch of goods and destroy what had been previously done, THEN release the source code to the first kernel.
So in other words when we get 2.3 they'll unsuspectingly give us everything we need for custom roms and kernels once one of us extracts it from the cache...
Little Buddy Sr.
MXFrodo195 said:
So in other words when we get 2.3 they'll unsuspectingly give us everything we need for custom roms and kernels once one of us extracts it from the cache...
Little Buddy Sr.
Click to expand...
Click to collapse
Not likely... They'll release the source for 2.2 to the public when 2.3 gets pushed. We're helping them find all the holes they left in 2.2.
I guess the phones work differently. I have only experienced OTAs on the original droid. In that phone's case; once you got the OTA and the phone rebooted, it would reboot to clockwork. If you wanted to apply the OTA you just selected "Update from SD" (or something like that). If you didn't you just rebooted the phone. Now granted that it will keep on bugging you that you don't have the latest until you trick it by changing the signature (on one of the prop files I believe it was - not sure if it still works that way).
Someone please let me know what I need to say over live chat or by email ill send or talk with them. Nothing to lose and alot to gain. And several cold beverages of my choice will help. I'm just not in the know on open sorce code etc.... I want to help.
From the GPL:
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
Click to expand...
Click to collapse
As long as they hold out, they are in violation of the GPL. It should be noted, however, that they aren't the only ones in the Android world doing this. It has been the discussion hot topic for a lot of Android device manufacturers.
It could all be nothing, and they may not have "gotten around to it" yet. They have released all their previous and current works. It does question why this phone is on hold, and I'd venture to guess (but could be completely wrong) that it revolves around Microsoft protecting their digs in this machine.
The full thing is here if you want to review it...
http://www.gnu.org/licenses/gpl.html

[Q] Kernels and related

I don't know if this is the right place to ask but I think I'll post here instead of development. I want to get into making my own slightly tweaked kernels but I really know nothing about whets where in the repository (like what file I would look in for clocks or voltages). I was just wondering if someone could point me toward some documentation so I can at least have a but of an idea. Thanks!
Developing anything is pretty complicated without some codding skills so I would advise against trying to code your own kernel although if you want to I can't stop you but in your position I would have posted in android development section you may get faster results.
I have experience in coding in c++, html, some assembly, wrote a very basic bootloader that doesn't really do much for a pc. I'm just looking to make some minor changes. (clocks or voltages)
# include <iostream>
using namespaces std;
void main()
{
cout <<"Well in that case I guess you could but like I said you'll probably get more responses in the android development section then nexus one Q&A.\n\nBTW I'm no expert in c++ just wanted to do this as a little joke all I know are the basics ";
cin.get();
}
NOTE: I know code is not supported in most forums so if a mod wants to delete this feel free it was just a joke so.
Very nice but unfortunately wouldn't compile in my compiler thanks to microsoft requiring include stdfax or whatever it is that I have to add up there with precompiled headers.... A pain but I never really learned gcc and its rules
Will post in dev section thanks for the suggestion!
Oh well I just noticed something and I'm going to guess that's why it didn't compile for you I made a typo up there it's not "namespaces" it's "namespace".
meltbox360 said:
I have experience in coding in c++, html, some assembly, wrote a very basic bootloader that doesn't really do much for a pc. I'm just looking to make some minor changes. (clocks or voltages)
Click to expand...
Click to collapse
All you have to do is browse some of the repositories here in the dev section. Click the GitHub link to pershoot or intersects repository. Then go to the kernel project/source and click "commits" at the top. Look thru each commit to get an idea of what's going and being changed in the kernel. The good stuff will be from months ago so you'll have to keep going back far thru the commits to find the significant changes.
Then setup your own build environment. Cyanogen wiki has a step by step tutorial guide that's straight forward and rather easy to get going.
When done that, just practice making some tiny code changes to the kernel, something that interests you, and try to compile it. You'll prob get an error so tweak it till it compiles with no error, then flash it to your device and see if it works.
It's fun to do and you can get setup pretty quickly with all the info available to us.

[REQ] Xposed Development Guide Request

Hi!
I've been exploring the Xposed Framework for quite a while. There's rich repository of modules based on the framework api.
But I feel that there is quite a dearth of learning resource for people who want to learn about it.
hamzahrmalik has a great tutorial for developing modules although the setting up part is outdated. Also there are very less example for using Helpers, common errors solving and hooking method with parameters(seriously there are loads of posts asking about hooking with parameters but none have a clear answer). Going through source codes to find answers is pain in the bum since most of them have almost no documentation.
Honestly there ought to be a better documentation for the api seeing as how very popular and awesome it is.
Yes, fully agree. I created similar topic to discuss about new project "Xposed Wiki" where we can collect docs, examples but I received no feedback. Maybe such reaction is related to actual state of Xposed at all. Basically dead, no visible (and mainly documentable) progress since August 2014.
I also gave up and built my custom Xposer Installer build with some useful features which will never be implemented in official version since Xposed dev refused it (official statement: due to poor Xposed server - I believe many people would donate some money for better one but... Everything depends on dev's (in)activity).
This project needs the big PSA about its future. Maybe my post sounds too pesimistic but I see no reasons to be optimistic at the moment.
That's it

New Exposed Module

Hi Im looking for a someone who would be willing to help out programming a module I've been working on for some while off and on. Between work, family and everything in between my progress has been a bit slow and I think that someone(or some people) that is interested could be a huge benefit. As of right not the source is not public as that it needs to be cleaned up and some parts rewritten but the application runs and works properly. The module aides in reversing and debugging android applications. My end goal is to try to provide a kinda swiss army knife for reversers. Currently the module is programmed in Android Studio. If you are interested and want to help please PM me. If you have questions you can reply to the thread.
*Moderators* The reason that this is not posted to DevDB is that its just a concept at this point and unfinished. If you feel this should be moved please feel free to move the topic.
Interesting start. Good idea.
Can you share some more info, please? Can you paste basic source on pastebin just to see what is it.
I have some experience with APK hacking (apktool, via Xposed) so maybe I can somehow help. I am also developer of some Xposed modules.
pyler said:
Interesting start. Good idea.
Can you share some more info, please? Can you paste basic source on pastebin just to see what is it.
I have some experience with APK hacking (apktool, via Xposed) so maybe I can somehow help. I am also developer of some Xposed modules.
Click to expand...
Click to collapse
I will send you a pm in a few hrs. At work atm.

Why is pie unsupported still

So far it seems development has ended on this project. After so long of happy modding not able to be done otherwise unless you get a custom ROM, or depending on what you need nothing else can do, anyone (like myself) who is on or upgraded to pie gets no official Xposed support.
Sure, there's EdXposed but it's closed source, and therefore suspect with what it can do to my system and I've heard of issues with it on some devices. If something is making or capable of making such change to my device, I better be able to inspect the source myself and it better have the public eye on it
And there's Tai Chi, but it's mostly in Chinese, which I don't happen to speak. Also not quite as capable
So is there any planned support for Android version beyond 8.1? I mean, Q/10.0 is already in beta. If there isn't, then has development stopped and if so why?
If needed, @rovo89, myself and I'm sure the community would be more then happy to pitch in. I and many others are grateful to what you did, and would be happy to help or carry on your hard work. I personally hold you in high regard, and I mean that seriously. I'm not sure who is more important in the Android modding community: @rovo89 or @topjohnwu
Because development is not necessary to the developers at all.
Please read this:
https://forum.xda-developers.com/showpost.php?p=79162792&postcount=5
EdXposed is IMHO as official as Xposed is and is not a clone and is not and has never been closed source.
clcombs262 said:
Sure, there's EdXposed but it's closed source, and therefore suspect with what it can do to my system and I've heard of issues with it on some devices. If something is making or capable of making such change to my device, I better be able to inspect the source myself and it better have the public eye on it
Click to expand...
Click to collapse
https://github.com/ElderDrivers/EdXposed
Happy inspecting
In fact, sources of "official" Xposed haven't been released for Oreo so far.
C3C076 said:
https://github.com/ElderDrivers/EdXposed
Happy inspecting
In fact, sources of "official" Xposed haven't been released for Oreo so far.
Click to expand...
Click to collapse
Flat style colored keyboard module works with edxposed on pie?
clcombs262 said:
Sure, there's EdXposed but it's closed source, and therefore suspect with what it can do to my system and I've heard of issues with it on some devices. If something is making or capable of making such change to my device, I better be able to inspect the source myself and it better have the public eye on it
Click to expand...
Click to collapse
search and read properly.
Since when EdXposed is closed source?
Thread Closed as per Op's request.
Thanks
SacredDeviL666.

Categories

Resources