fix(Spotify): Fix login by replacing Spoof signature patch with new Spoof package info patch

[oSumAtrIX]

Spoofing the installer's name may or may not work. Currently testing. So far pretty much everyone reports it's working.

[cyberboh]

I do not have login issue since beginning. Is this issue based region or their account choosen as an A/B tester?

[oSumAtrIX]

Regional and account based A/B.

[LisoUseInAIKyrios]

This fails with the legacy app target 8.6.98.900
Needs a small adjustment.

[oSumAtrIX]

@LisoUseInAIKyrios This is much simpler

[oSumAtrIX]

or just this

[LisoUseInAIKyrios]

But that doesn't replace the installer package and the legacy app probably has the same issue as the latest app target.

[oSumAtrIX]

However IS_SPOTIFY_LEGACY_APP_TARGET may still not be enough. Later versions might still not have the installer name check. I am still not really conviced of the version checking practice we currently have in youtube or spotify. Its difficult to scale

[oSumAtrIX]

But that doesn't replace the installer package and the legacy app probably has the same issue as the latest app target.

The old versions dont have an installer name field in the requests they make. In fact the patch is redundant for old versions of Spotify:

Neither the signature nor the installer name are present.

[LisoUseInAIKyrios]

IS_SPOTIFY_LEGACY_APP_TARGET works by checking for the main activity name, which will be stable unless Spotify changes the main activity again. There's always 1 main activity so there cannot be both old and new names present.

It would be really handy if apktool extracted the app version, but it doesn't so it requires clunky stuff like this.

[LisoUseInAIKyrios]

If it's not sending the package name, then yes I think it can be simplified.

[Brosssh]

clienttoken request on recent app

[oSumAtrIX]

IS_SPOTIFY_LEGACY_APP_TARGET works by checking for the main activity name, which will be stable unless Spotify changes the main activity again. There's always 1 main activity so there cannot be both old and new names present.

It would be really handy if apktool extracted the app version, but it doesn't so it requires clunky stuff like this.

Yes but the installer name might have been added after even if the new activity exists. You are assuming the installer name has been added to the request at the same time the activity has been renamed.

[oSumAtrIX]

If it's not sending the package name, then yes I think it can be simplified.

I'll force push my commit. We can revert if somethings missing there.

[LisoUseInAIKyrios]

For the legacy target, the installer does appear to be sent here. But I'm not sure if this code is reachable

AndroidClientReport.c() {
                String m = l2r.m(jg3Var.b.d()); // Installer package 
                n.copyOnWrite();
                AndroidClientReport.l((AndroidClientReport) n.instance, m);

[Brosssh]

Is it possible to mark this patch as not needed for version < 9? And mandatory for >= 9? 4f87180 is much cleaner imo

[oSumAtrIX]

For the legacy target, the installer does appear to be sent here. But I'm not sure if this code is reachable

AndroidClientReport.c() {
                String m = l2r.m(jg3Var.b.d()); // Installer package 
                n.copyOnWrite();
                AndroidClientReport.l((AndroidClientReport) n.instance, m);

Apparently its missing in the clienttoken request, this also is the case for the unpatched app. I don't think we need to consider anything further than that.

[oSumAtrIX]

Is it possible to mark this patch as not needed for version < 9? And mandatory for >= 9? 4f87180 is much cleaner imo

It can early return, but do we know if the installer name was really added exactly when 9 was introduced?

[LisoUseInAIKyrios]

It can early return, but do we know if the installer name was really added exactly when 9 was introduced?

Slightly older versions of 9.0 are not important. The only versions that matter is the latest, and the single old legacy target.

[oSumAtrIX]

It can early return, but do we know if the installer name was really added exactly when 9 was introduced?

Slightly older versions of 9.0 are not important. The only versions that matter is the latest, and the single old legacy target.

The patch does not break with checking the string on versions that "do not matter" and neither on the ones that matter. However with checking the activity, it'll break with the ones that "do not matter".

[LisoUseInAIKyrios]

Can use two fingerprints (latest and legacy). They're small fingerprints and a little copy paste keeps it simple