surgery

Device spoofing in Android applications allows developers to manipulate device information, primarily through altering android.os.Build attributes. Existing spoofer applications often fail to modify native system API calls that retrieve genuine device information. Tweaks is a per-app spoofer integrated into AOSP and LineageOS, which changes device properties by modifying memory-mapped files under /dev/properties. It uses a private mount namespace to bind-mount modified property-context files, ensuring only the targeted application receives spoofed values while the rest of the system remains unaffected. The Tweaks app, which is platform-signed, communicates with the TweaksManagerService to write configurations and manage property overrides. The core functionality is handled by propgen, which generates property context files with spoofed values by identifying and patching properties in place. The TweaksManagerService ensures secure interactions and content-addresses generated property areas to allow sharing among apps with identical overrides. The spawn path in ProcessList.startProcess determines whether to apply spoofing based on conditions evaluated by the TweaksLocalService. Security is maintained through SELinux policies, which restrict access to spoofable properties. However, certain elements, such as /proc/self/mountinfo and /system/build.prop, still reveal authentic device information despite the spoofing capabilities of Tweaks. The source code for Tweaks and related patches is available for public access.