├── xposed-ouya-plain-purchases ├── .gitignore ├── src │ └── main │ │ ├── assets │ │ └── xposed_init │ │ ├── res │ │ ├── values │ │ │ └── strings.xml │ │ └── mipmap-hdpi │ │ │ └── broken_encryption_48.png │ │ ├── AndroidManifest.xml │ │ └── java │ │ └── de │ │ └── cweiske │ │ └── ouya │ │ └── plainpurchases │ │ └── PlainPurchases.java └── build.gradle ├── settings.gradle ├── .gitignore ├── gradle.properties └── README.rst /xposed-ouya-plain-purchases/.gitignore: -------------------------------------------------------------------------------- 1 | /build 2 | /release/ 3 | -------------------------------------------------------------------------------- /xposed-ouya-plain-purchases/src/main/assets/xposed_init: -------------------------------------------------------------------------------- 1 | de.cweiske.ouya.plainpurchases.PlainPurchases 2 | -------------------------------------------------------------------------------- /settings.gradle: -------------------------------------------------------------------------------- 1 | include ':xposed-ouya-plain-purchases' 2 | rootProject.name='OUYA plain purchases Xposed module' 3 | -------------------------------------------------------------------------------- /xposed-ouya-plain-purchases/src/main/res/values/strings.xml: -------------------------------------------------------------------------------- 1 | 2 | OUYA plain purchases Xposed module 3 | 4 | -------------------------------------------------------------------------------- /xposed-ouya-plain-purchases/src/main/res/mipmap-hdpi/broken_encryption_48.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cweiske/xposed-ouya-plain-purchases/master/xposed-ouya-plain-purchases/src/main/res/mipmap-hdpi/broken_encryption_48.png -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | /local.properties 4 | /.idea/ 5 | /.idea/caches 6 | /.idea/libraries 7 | /.idea/modules.xml 8 | /.idea/workspace.xml 9 | /.idea/navEditor.xml 10 | /.idea/assetWizardSettings.xml 11 | .DS_Store 12 | /build 13 | /captures 14 | .externalNativeBuild 15 | .cxx 16 | /gradle/ 17 | /gradlew 18 | /gradlew.bat 19 | /README.html 20 | -------------------------------------------------------------------------------- /gradle.properties: -------------------------------------------------------------------------------- 1 | # Project-wide Gradle settings. 2 | # IDE (e.g. Android Studio) users: 3 | # Gradle settings configured through the IDE *will override* 4 | # any settings specified in this file. 5 | # For more details on how to configure your build environment visit 6 | # http://www.gradle.org/docs/current/userguide/build_environment.html 7 | # Specifies the JVM arguments used for the daemon process. 8 | # The setting is particularly useful for tweaking memory settings. 9 | org.gradle.jvmargs=-Xmx1536m 10 | # When configured, Gradle will run in incubating parallel mode. 11 | # This option should only be used with decoupled projects. More details, visit 12 | # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects 13 | # org.gradle.parallel=true 14 | 15 | 16 | -------------------------------------------------------------------------------- /xposed-ouya-plain-purchases/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 4 | 5 | 10 | 13 | 16 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /xposed-ouya-plain-purchases/build.gradle: -------------------------------------------------------------------------------- 1 | apply plugin: 'com.android.application' 2 | 3 | android { 4 | compileSdkVersion 16 5 | buildToolsVersion '19.1.0' 6 | defaultConfig { 7 | applicationId "de.cweiske.ouya.plainpurchases" 8 | minSdkVersion 15 9 | targetSdkVersion 16 10 | versionCode 2 11 | versionName "1.1.0" 12 | } 13 | buildTypes { 14 | release { 15 | minifyEnabled false 16 | } 17 | } 18 | lintOptions { 19 | checkReleaseBuilds false 20 | // Or, if you prefer, you can continue to check for errors in release builds, 21 | // but continue the build even when errors are found: 22 | abortOnError false 23 | } 24 | } 25 | 26 | dependencies { 27 | implementation fileTree(dir: 'libs', include: ['*.jar']) 28 | compileOnly 'de.robv.android.xposed:api:53' 29 | } 30 | -------------------------------------------------------------------------------- /README.rst: -------------------------------------------------------------------------------- 1 | ******************** 2 | OUYA plain purchases 3 | ******************** 4 | 5 | Xposed__ module that deactivates encryption on the OUYA Android gaming console. 6 | 7 | Its goal is that purchase requests get sent plain-text to the 8 | `discover store server`__, 9 | and the server may reply with plain text purchase receipts. 10 | 11 | Works by patching ``javax.crypto.Cipher::doFinal(byte[])`` to return 12 | the input without encryption/decryption. 13 | 14 | It needs to be `installed as system application`__ to prevent 15 | Final Fantasy III from crashing. 16 | 17 | __ https://repo.xposed.info/module/de.robv.android.xposed.installer 18 | __ http://cweiske.de/ouya-store-api-docs.htm 19 | __ http://cweiske.de/tagebuch/ouya-final-fantasy3.htm#howto 20 | 21 | 22 | Development hints 23 | ================= 24 | - Version number can be changed in ``xposed-ouya-plain-purchases/build.gradle`` 25 | -------------------------------------------------------------------------------- /xposed-ouya-plain-purchases/src/main/java/de/cweiske/ouya/plainpurchases/PlainPurchases.java: -------------------------------------------------------------------------------- 1 | package de.cweiske.ouya.plainpurchases; 2 | 3 | import javax.crypto.Cipher; 4 | 5 | import de.robv.android.xposed.IXposedHookLoadPackage; 6 | import de.robv.android.xposed.XC_MethodHook; 7 | import de.robv.android.xposed.XposedBridge; 8 | import de.robv.android.xposed.XposedHelpers; 9 | import de.robv.android.xposed.callbacks.XC_LoadPackage; 10 | 11 | /** 12 | * Hook into Java's main encryption method and simply return the input. 13 | * This disables encryption completely, and allows our OUYA store to retrieve 14 | * plain text requests and send plain text responses that the OUYA understands 15 | * 16 | * @author Christian Weiske 17 | */ 18 | public class PlainPurchases implements IXposedHookLoadPackage 19 | { 20 | @Override 21 | public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) 22 | { 23 | //we cannot filter on lpparam.packagename because that breaks 24 | // in-game receipt decryption 25 | 26 | //XposedBridge.log("Loaded app: " + lpparam.packageName); 27 | 28 | XposedHelpers.findAndHookMethod(Cipher.class, "doFinal", byte[].class, new XC_MethodHook() { 29 | @Override 30 | protected void beforeHookedMethod(MethodHookParam param) { 31 | byte[] input = (byte[]) param.args[0]; 32 | 33 | //XposedBridge.log("input: " + new String(input)); 34 | //XposedBridge.log(new Exception("doFinal stack trace")); 35 | 36 | boolean isJson = input.length > 0 37 | && input[0] == 123// "{" 38 | && input[input.length - 1] == 125;// "}" 39 | boolean isDummyKey = input.length == 16 40 | && (new String(input)).equals("0123456789abcdef"); 41 | 42 | //only prevent some data from being encrypted/decrypted 43 | if (isJson || isDummyKey) { 44 | //XposedBridge.log("returning unencrypted input"); 45 | param.setResult(input); 46 | } 47 | } 48 | }); 49 | } 50 | } 51 | --------------------------------------------------------------------------------