Angel/PixelIMS
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PixelIMS: build corregido (APIs ocultas con android.jar completo), docs y diagnostico VoLTE Pixel 6 + NeWWW, APK en dist/
Build PixelIMS APK / build (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Angel
2026-09-22 21:26:44 -06:00
parent b5e56b6120
commit 62e4dbf6cf
9 changed files with 233 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+78 -190
View File
@@ -1,220 +1,108 @@
# ⚡ Pixel IMS
# PixelIMS — VoLTE para Pixel con operadores no certificados
**Enable 5G, VoLTE, VoWiFi and VoNR on Google Pixel devices with unsupported carriers — without root.**
Fork de [vvb2060/Pixel IMS](https://github.com/vvb2060/Ims) (motor de bypass v3.1) con interfaz de [TurboIMS](https://github.com/Turbo1123/TurboIMS), **compilado, corregido y verificado en un Pixel 6 con la red de Altán Redes (MVNO NeWWW, México)**.
Built specifically for users in Sri Lanka (Dialog, Mobitel) and other regions where Google has not officially certified local carriers for 5G/IMS features. Works on any Pixel running Android 12+.
Habilita VoLTE, VoWiFi, 5G NR, VoNR, video llamadas, cross-SIM y servicios UT en Google Pixel (Tensor) cuando el operador no está en la lista certificada de Google — **sin root** (vía Shizuku).
---
## Estado verificado
## What This Does
- ✅ Compila desde fuente (ver [Construir desde fuente](#construir-desde-fuente))
- ✅ Instala y aplica la configuración en un **Pixel 6 (oriole) con Android 16, parche 2026-04-05**
- ✅ **VoLTE activo y funcionando** con NeWWW (Red Altán, MCC/MNC 334-140)
- ⚠️ Tras cada reinicio hay que re-aplicar (ver [Comportamiento tras reinicio](#comportamiento-tras-reinicio))
Google Pixel devices use a carrier whitelist enforced at the modem firmware level. If your carrier (e.g. Dialog Axiata, PLMN 413-02) is not on Google's approved list, your Pixel will refuse to connect to 5G and hide VoLTE settings — even when your carrier's 5G network is physically available.
## Requisitos
This app overrides the `CarrierConfigManager` configuration at runtime using a privileged Instrumentation bypass, unlocking:
- Google Pixel 6 o posterior (chip Tensor)
- Android 12+ (`minSdk 31`)
- [Shizuku](https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api) 13.1.5+ (Play Store, gratis)
- Sin root, sin PC obligatorio (solo para la instalación inicial por adb o para arrancar Shizuku por cable)
- **5G NR** — Both NSA (Non-Standalone, 5G anchored to 4G core) and SA (Standalone, full 5G)
- **VoLTE** — HD voice calls over 4G
- **VoWiFi** — Voice calls over WiFi
- **VoNR** — Voice calls over 5G
- **Video Calling (VT)**
- **Cross-SIM Calling**
- **UT Supplementary Services** — call forwarding, call waiting, etc.
## Instalación
---
1. **Instalar el APK** (ya compilado en `dist/PixelIMS-1.0.apk`):
```bash
adb install dist/PixelIMS-1.0.apk
```
2. **Instalar Shizuku** desde Play Store y arrancarlo:
- Sin PC: Developer options → *Depuración inalámbrica* → pairing desde Shizuku, o
- Por cable: `adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh`
3. **Abrir PixelIMS** → conceder permiso de Shizuku → esperar "✅ Ready".
4. **Pulsar "Apply to All SIMs"** → esperar el diálogo de éxito.
5. **Activar el toggle**: Ajustes → Red e internet → SIMs → NeWWW → **Llamadas 4G (VoLTE)** → ON.
6. **Verificar**: `*#*#4636#*#*` → ⋮ → Estado del servicio IMS → "Voice over LTE: Available".
## Requirements
> Nota: la app hace visibles y editables los toggles de VoLTE/VoWiFi en los ajustes del SIM, pero **no los enciende por sí sola** — el paso 5 es manual (y solo una vez).
| Requirement | Details |
|---|---|
| Device | Google Pixel 6 or later (Tensor chip) |
| Android | 12 (API 31) or higher |
| [Shizuku](https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api) | v13+ — free on Play Store |
| Root | ❌ Not required |
| PC | ❌ Not required |
## Comportamiento tras reinicio
---
- La app **se auto-aplica sola** cada vez que Shizuku entrega su binder (no hay que pulsar Apply de nuevo); los toggles quedan guardados.
- Pero **Shizuku no sobrevive al reinicio** sin root: la depuración inalámbrica se apaga. Rutina por reinicio (2 toques): activar depuración inalámbrica → abrir Shizuku y Start. La app hace el resto automáticamente.
- Si el dispositivo reporta "Persistent: Yes" en la app, la config sobrevive reinicios por sí sola (en builds recientes de Android 15/16 normalmente reporta "No").
- **100% automático solo con root (Magisk)**: Shizuku arranca por root al boot y la app se auto-aplica. Costo: desbloquear bootloader (borra datos), Play Integrity, OTA manuales.
## How the Bypass Works
## Construir desde fuente
### Background
El código original **no compila tal cual**: usa ~30 APIs ocultas de Android (`CarrierConfigManager.overrideConfig`, `IActivityManager`, `ITelephony`, `PermissionManager`, etc.) que no existen en el `android.jar` público. Tampoco el upstream (vvb2060/Ims v3.1) compila desde un clon limpio — requiere un `android.jar` completo no versionado en el repo.
Google's carrier whitelist is enforced via `CarrierConfigManager.overrideConfig()`, a privileged Android API that requires the `MODIFY_PHONE_STATE` permission — only granted to system apps. Normal apps and even ADB shell cannot call it directly.
### Correcciones aplicadas a este fork
In October 2025, Google patched **CVE-2025-48617**, which had allowed calling `overrideConfig()` directly from the ADB shell user via Shizuku. That door was closed.
1. `settings.gradle.kts` — eliminado el `versionCatalogs { create("libs") }` duplicado (Gradle auto-importa `gradle/libs.versions.toml` como `libs`).
2. `gradle.properties` — `android.useAndroidX=true` (Shizuku 13.1.5 arrastra `androidx.annotation` transitiva).
3. `MainActivity.java` — `Shizuku.onRequestPermissionsResult()` no existe en Shizuku 13.1.5; reemplazado por `addRequestPermissionResultListener` / `removeRequestPermissionResultListener`.
4. **APIs ocultas** — config migrada a AGP 9.2.0 (plugin `com.android.settings`, DSL en `settings.gradle.kts`) con `compileSdk = release(37)`, y un SDK local cuyo `android.jar` se reemplaza por el **framework completo de Robolectric** (`org.robolectric:android-all:17-robolectric-15733970`, SHA-256 `f6a41ad548bb45cccd3b1d4774cb50d57826dd319b6e5accd6b6269876e12d71`), que sí incluye las clases y métodos ocultos.
### The v3.1 Bypass (Instrumentation trick)
This app uses the approach from **vvb2060's Pixel IMS v3.1**. Instead of calling `overrideConfig()` from the shell user directly, we route through Android's `Instrumentation` framework:
1. `ShizukuProvider` receives the Shizuku binder when Shizuku starts
2. It calls `IActivityManager.startInstrumentation()` with flag `INSTR_FLAG_NO_RESTART`, passing our own PID as a security argument
3. The system launches `PrivilegedProcess` (which extends `Instrumentation`) as a runner
4. Inside `PrivilegedProcess`, we call `startDelegateShellPermissionIdentity()` to elevate our UID
5. We call `overrideConfig()` — the system sees it coming from the Instrumentation context, not directly from shell, bypassing the October 2025 restriction
6. We release delegation and exit
The PID check (`arguments.getInt("pid") == Process.myPid()`) is a security gate ensuring `PrivilegedProcess` only runs when launched by our own provider.
### Key Innovations from vvb2060 v3.1
**`canPersistent()` — Runtime patch-level detection**
Before calling `overrideConfig()`, the app probes private methods in `com.android.phone`'s `CarrierConfigLoader` class at runtime to determine whether persistent overrides are safe:
- No `isSystemApp()` method → old build → persistent = ✅ safe
- Has `isSystemApp()` but no `isSdkSandboxUidInternal()` → intermediate → persistent = ✅ safe
- Has both → latest patch → persistent = ❌ blocked, uses session-only
**`showVoLTE()` — IMS Provisioning layer**
Some carriers block VoLTE at a second layer: IMS provisioning. Even after `CarrierConfigManager` is overridden, the `KEY_VOIMS_OPT_IN_STATUS` provisioning flag can still be set to disabled. This app fixes that by calling `ITelephony.setImsProvisioningInt()` directly. TurboIMS never touched this layer.
**Version fingerprinting**
The app stamps `vvb2060_config_version = VERSION_CODE` into the carrier config bundle. On Shizuku connect, it reads this key back to skip re-applying if the config is already current.
**SDK Sandbox support (Android 14+)**
On locked-bootloader devices on Android 14+, the app may run in an isolated SDK sandbox process. A separate Binder callback path handles this case.
---
## Setup Instructions
### Step 1 — Enable Wireless Debugging
1. Go to **Settings → About Phone**
2. Tap **Build Number** 7 times to enable Developer Options
3. Go to **Settings → System → Developer Options**
4. Enable **Wireless Debugging**
### Step 2 — Set Up Shizuku
1. Install [Shizuku](https://play.google.com/store/apps/details?id=moe.shizuku.privileged.api) from the Play Store
2. Open Shizuku
3. Tap **"Pair using Wireless Debugging"**
4. Follow the pairing dialog (no PC needed)
5. Shizuku status should show **"Running"**
### Step 3 — Install and Run Pixel IMS
1. Install `PixelIMS.apk`
2. Open the app
3. When prompted, grant Shizuku permission
4. Shizuku status in the app should show **✅ Ready**
5. (Optional) Toggle off any features you don't need
6. Tap **"Apply to All SIMs"**
7. When the success dialog appears, tap **"Open Network Settings"**
8. Enable 5G and VoLTE toggles in your SIM settings
### Step 4 — After Each Reboot
Check the **Config** status in the app. If it shows **⬜ Not yet applied**:
- Open Shizuku, tap Start (Wireless Debugging)
- Open Pixel IMS and tap Apply again
If **Persistent mode: Yes** is shown, the config survives reboots automatically.
---
## Building from Source
### Prerequisites
- Android Studio Hedgehog or newer
- JDK 17
- Android SDK 35
### Build
### Pasos reproducibles
```bash
git clone https://github.com/YOUR_USERNAME/PixelIMS.git
cd PixelIMS
./gradlew assembleRelease
# 1. Prerrequisitos: JDK 17+ y Gradle 9.4.1
# https://services.gradle.org/distributions/gradle-9.4.1-bin.zip
# 2. SDK Android (platform-tools, platform android-37.0, build-tools 37.0.0, licencias aceptadas)
# 3. Crear un SDK local con el android.jar completo:
mkdir -p local-sdk/platforms local-sdk/build-tools
cp -r $ANDROID_HOME/platforms/android-37.0 local-sdk/platforms/
curl -o android-all-37.jar \
https://repo1.maven.org/maven2/org/robolectric/android-all/17-robolectric-15733970/android-all-17-robolectric-15733970.jar
cp android-all-37.jar local-sdk/platforms/android-37.0/android.jar # ← reemplazo clave
ln -s $ANDROID_HOME/build-tools/37.0.0 local-sdk/build-tools/37.0.0
ln -s $ANDROID_HOME/licenses local-sdk/licenses
# y ajustar sdk.dir en local.properties
# 4. Compilar:
gradle assembleRelease
# APK en app/build/outputs/apk/release/app-release.apk (firmado con debug key)
```
The signed APK will be at `app/build/outputs/apk/release/app-release.apk`.
¿Por qué un SDK local? `javac` prioriza el `android.jar` del SDK sobre cualquier jar del classpath, así que un módulo de stubs no puede añadir métodos ocultos a clases existentes — la única vía es sustituir el propio `android.jar` por uno completo (el de Robolectric contiene TODO el framework).
---
## Diagnóstico VoLTE en Pixel 6 + NeWWW (Altán 334-140)
## Project Structure
El detalle completo de la investigación con evidencia de logcat/dumpsys está en **[docs/diagnostico-volte-newww.md](docs/diagnostico-volte-newww.md)**. Resumen de la cadena:
```
PixelIMS/
├── app/
│ └── src/main/
│ ├── AndroidManifest.xml
│ └── java/io/github/pixelims/
│ ├── PrivilegedProcess.java ← Core bypass engine (vvb2060 v3.1 logic)
│ ├── ShizukuProvider.java ← Shizuku integration + canPersistent + showVoLTE
│ ├── MainActivity.java ← UI (TurboIMS style + status improvements)
│ ├── SplashActivity.java ← Splash screen
│ └── LocaleHelper.java ← EN/ZH language switching
├── stub/
│ └── src/main/java/ ← Hidden API stubs for compilation
│ ├── android/app/
│ │ ├── IActivityManager.java
│ │ ├── ActivityManager.java ← Hidden INSTR_FLAG constants
│ │ ├── UiAutomationConnection.java
│ │ └── ...
│ ├── android/os/
│ │ └── ServiceManager.java
│ └── com/android/internal/telephony/
│ └── ITelephony.java
└── README.md
```
1. La config de operador se aplica con `persistent=true` y el aprovisionamiento IMS queda `PROVISIONING_VALUE_ENABLED`.
2. El APN `ims` ya viene provisionado en la SIM de NeWWW.
3. La red concede voz sobre LTE: `availableServices=[VOICE,SMS,VIDEO]`, `mVoiceRegState=IN_SERVICE`.
4. El toggle "Llamadas 4G" aparece en Ajustes → SIMs tras aplicar la config — hay que encenderlo.
5. El ImsService del módem Shannon (`com.shannon.imsservice`) corre con normalidad.
---
## VozApp (plan B oficial de Altán)
## Comparison: vvb2060 v3.1 vs TurboIMS v3.0 vs Pixel IMS v1.0
- **`com.altanredes.altanvoip`** — la app de llamadas VoIP del propio operador (Altán Redes) para equipos sin VoLTE nativo. **No está en Play Store**; se distribuye por los centros de ayuda de los MVNOs (BAIT, VIVA MX) y espejos de APK.
- Espejo verificado en esta investigación: APKCombo, `VozApp_2.1.0.apk`, SHA-256 `75dd0dde4f6184568ea2337c5cf397c6a1b0e28a65bf555588f401cdc4af24ed`, firmada por **Neusoft Mobile Solutions Oy** (plataforma "Silta").
- ⚠️ **Crash conocido en Android 16**: `ForegroundServiceStartNotAllowedException` en `com.unikie.vm.application.engine.services.AppStatusService` al arrancar un servicio en foreground desde segundo plano. Es un bug de la app (plataforma Unikie), no del teléfono.
- Con VoLTE nativo funcionando (el objetivo de este proyecto), VozApp queda solo como respaldo.
| Feature | vvb2060 v3.1 | TurboIMS v3.0 | **Pixel IMS v1.0** |
|---|:---:|:---:|:---:|
| Oct 2025 patch bypass | ✅ | ❌ Broken | ✅ |
| User interface | ❌ Headless | ✅ | ✅ |
| Per-feature toggles | ❌ | ✅ | ✅ |
| Per-SIM selection | ❌ | ✅ | ✅ |
| Language switching (EN/ZH) | ❌ | ✅ | ✅ |
| `showVoLTE()` IMS provisioning | ✅ | ❌ | ✅ |
| `canPersistent()` detection | ✅ | ❌ | ✅ |
| `needOverride()` fingerprint | ✅ | ❌ | ✅ |
| Config status shown in UI | ❌ | ❌ | ✅ **New** |
| Persistent mode shown in UI | ❌ | ❌ | ✅ **New** |
| Auto-apply on Shizuku connect | ✅ | ❌ | ✅ |
| SDK Sandbox support (Android 14+) | ✅ | ❌ | ✅ |
| 5G NR signal thresholds | ✅ | ✅ | ✅ |
| `KEY_SHOW_IMS_REGISTRATION_STATUS` | ✅ | ❌ | ✅ |
| Default SIM target | All (forced) | SIM 1 | All SIMs |
| Min Android version | API 34 | API 33 | **API 31** |
| Java version | 21 | 17 | 17 |
## Créditos y licencia
---
- [vvb2060/Ims](https://github.com/vvb2060/Ims) — motor de bypass v3.1 (Instrumentation trick, `canPersistent()`, `showVoLTE()`)
- [Turbo1123/TurboIMS](https://github.com/Turbo1123/TurboIMS) — UI, toggles por feature y por SIM
- [VinujaHerath/PixelIMS](https://github.com/VinujaHerath/PixelIMS) — fork base de este repo
- [RikkaApps/Shizuku](https://github.com/RikkaApps/Shizuku) y [LSPosed/LSPass](https://github.com/LSPosed/LSPass)
## Troubleshooting
El repositorio original no declara licencia. Este proyecto reutiliza ese código con fines de interoperabilidad personal; úsalo bajo tu propio riesgo.
**Shizuku shows "Not Running" after reboot**
Wireless Debugging turns off on reboot. Go to Settings → Developer Options → Wireless Debugging → turn it on, then re-open Shizuku and tap Start.
## Aviso
**Config shows "Not yet applied" after tapping Apply**
Wait 5 seconds and pull down to refresh. The Instrumentation runner takes a moment to complete. If it still shows Not Applied, force-stop the app and try again.
**5G toggle doesn't appear in SIM settings**
Your carrier plan may not include 5G even after the config is unlocked. Confirm with Dialog that your plan supports 5G. Also ensure you're in a Dialog 5G coverage area (Colombo, Kandy, Galle metro areas as of May 2026).
**SecurityException in logcat**
The October 2025 or newer patch may have closed the Instrumentation bypass. Check the GitHub issues page — a new bypass method may be available.
---
## Credits
- **[vvb2060](https://github.com/vvb2060/Ims)** — Original Pixel IMS, v3.1 bypass engine, `canPersistent()`, `showVoLTE()`, SDK sandbox support
- **[Turbo1123](https://github.com/Turbo1123/TurboIMS)** — TurboIMS v3.0 UI, per-feature toggles, per-SIM selection, language switching
- **[Rikka](https://github.com/RikkaApps/Shizuku)** — Shizuku framework
- **[LSPosed](https://github.com/LSPosed/LSPosed)** — LSPass hidden API bypass library
---
## Disclaimer
This app overrides carrier configuration at the framework level. It does not modify system partitions and is reversible by uninstalling the app. However, overriding carrier config technically violates carrier policies. Use at your own risk. The authors are not responsible for any issues arising from use of this software.
Esta app sobrescribe la configuración del operador a nivel de framework (no toca particiones; se revierte desinstalando). Técnicamente contradice las políticas del operador. Los autores no se hacen responsables del uso que se le dé.