feat(patch): Unlimited Google Photos Storage at Original Quality

[itsyourap]

Application

Google Photos (com.google.android.apps.photos)

Issue

This patch will enable unlimited storage at original quality in Google Photos.

Patch

1. Integrate Vanced MicroG into Google Photos
2. Hook android.app.ApplicationPackageManager.hasSystemFeature(String) and android.app.ApplicationPackageManager.hasSystemFeature(String, int) to return true when some feature flags validity is checked by Google Photos. (As far as know, Google uses a compiled library to call the method, so we cannot modify it since it is not bytecode)

Although, we can use Frida to hook the android.app.ApplicationPackageManager.hasSystemFeature(String) method and return true whenever these arguments are passed:-

1. com.google.android.apps.photos.NEXUS_PRELOAD
2. com.google.android.apps.photos.nexus_preload
3. com.google.android.feature.PIXEL_EXPERIENCE
4. com.google.android.apps.photos.PIXEL_PRELOAD
5. com.google.android.apps.photos.PIXEL_2016_PRELOAD

We can easily integrate frida-gadget into the app to hook the method. (I can do this part)

When android.app.ApplicationPackageManager.hasSystemFeature(String) returns true for these arguments, Google Photos provides unlimited storage at Original Quality for no cost. I have already created a Frida script that works for this but I could only test it on rooted devices since for non rooted, Google Photos won't get access to Google Account due to Signature Mismatch. Thats why I am requesting to integrate Vanced MicroG into Google Photos. Also, I can share the Frida Script if you like.

Also, maybe we can get access to Google One features using this.

Motivation

This patch will enable users to get Unlimited Google Photos Storage at Original Quality, which is desired by a lot of people. Also, tinkering with this patch a bit more might enable Google One features for Google Photos

Acknowledgements

• [X] I have searched the existing issues and this is a new and no duplicate or related to another open issue.
• [X] I have written a short but informative title.
• [X] I filled out all of the requested information in this issue properly.

[AwesomeParley]

Does the Frida script actually make google drive not take up space? I remember having this option a long time ago, but they since discontinued it and I had to clear my entire google account of photos due to it having over 20GB of storage being used all of a sudden. I had just assumed this was server-side, but now I am curious.

[itsyourap]

I am using the root version of it for over a year now. There hasn't been any problems. Pixelify-Google-Photos does the same using Xposed/LSPosed Framework on rooted devices/

[itsyourap]

As for proof, these are some screenshots I would like to share :-

These screenshots are taken from a non Google Device. BTW, This also works on emulators. (Tried and tested ✅)

[AwesomeParley]

I am using the root version of it for over a year now. There hasn't been any problems. Pixelify-Google-Photos does the same using Xposed/LSPosed Framework on rooted devices/

Ah I understand how it works now. So basically it's just telling Google "Hey, I'm a Google Pixel, so allow this user to upload Unlimited Google Photos" and then it just does.

Interesting. I do wonder how Vanced MicroG would work with that or if it even can since it's not managed by Revanced. I bet some smart people could figure it out.

[itsyourap]

Yes! Thats how it works. Vanced MicroG will just provide access to the Google Account instead of the original com.google.android.gms to bypass the signature detection. (The same as YouTube Revanced)

[AlyafeiAli]

As for proof, these are some screenshots I would like to share :-

These screenshots are taken from a non Google Device. BTW, This also works on emulators. (Tried and tested ✅)

Interesting. What emulator did you use?

[itsyourap]

Interesting. What emulator did you use?

I used LDPlayer and installed Magisk Delta in its /system partition, enabled Zygisk and flashed LSPosed-Zygisk module and then used Pixelify-Google-Photos module to achieve this.

Instead of using this method, you can also use Frida with root access to hook into the above mentioned methods to achieve the same.

[AlyafeiAli]

As for proof, these are some screenshots I would like to share :-

These screenshots are taken from a non Google Device. BTW, This also works on emulators. (Tried and tested ✅)

Interesting. What emulator did you use?

Interesting. What emulator did you use?

I used LDPlayer and installed Magisk Delta in its /system partition, enabled Zygisk and flashed LSPosed-Zygisk module and then used Pixelify-Google-Photos module to achieve this.

Instead of using this method, you can also use Frida with root access to hook into the above mentioned methods to achieve the same.

Thank you for the detailed explanation, I appreciate it 😄

[AlyafeiAli]

btw, @itsyourap , do you mind sharing the Frida script you created so we can test it as well?

[itsyourap]

btw, @itsyourap , do you mind sharing the Frida script you created so we can test it as well?

Sure! Here you go:-

function getClassFactory(className) {
    let classFactory;
    const classLoaders = Java.enumerateClassLoadersSync();
    for (const classLoader in classLoaders) {
        try {
            classLoaders[classLoader].findClass(className);
            classFactory = Java.ClassFactory.get(classLoaders[classLoader]);
            break;

        } catch (e) {
             // Some Error Occurred
        }
    }
    return classFactory;
}

function hookBuildVariables() {
    const buildClass = Java.use('android.os.Build');
    buildClass.BRAND.value = "google";
    buildClass.MANUFACTURER.value = "Google";
    buildClass.DEVICE.value = "marlin";
    buildClass.PRODUCT.value = "marlin";
    buildClass.MODEL.value = "Pixel XL";
    buildClass.FINGERPRINT.value = "google/marlin/marlin:10/QP1A.191005.007.A3/5972272:user/release-keys";
    console.log('Hooked Build Variables');
}

function hookHasSystemFeature() {
    const className = "android.app.ApplicationPackageManager";
    const classFactory = getClassFactory(className);
    const pmClass = classFactory.use(className);
    const hasSystemFeatureMethod = pmClass.hasSystemFeature;

    hasSystemFeatureMethod.overload('java.lang.String').implementation = function (featureName) {
        console.log(`hasSystemFeature(String) called with featureName : ${featureName}`);

        if (featureName == "com.google.android.apps.photos.NEXUS_PRELOAD"
            || featureName == "com.google.android.apps.photos.nexus_preload"
            || featureName == "com.google.android.feature.PIXEL_EXPERIENCE"
            || featureName == "com.google.android.apps.photos.PIXEL_PRELOAD"
            || featureName == "com.google.android.apps.photos.PIXEL_2016_PRELOAD") {
            return true;
        }

        const result = hasSystemFeatureMethod.call(this, featureName);
        console.log(`Result : ${result}`)
        return result;
    }

    hasSystemFeatureMethod.overload('java.lang.String', 'int').implementation = function (featureName, version) {
        console.log(`hasSystemFeature(String) called with featureName : ${featureName} and version : ${version}`);

        if (featureName == "com.google.android.apps.photos.NEXUS_PRELOAD"
            || featureName == "com.google.android.apps.photos.nexus_preload"
            || featureName == "com.google.android.feature.PIXEL_EXPERIENCE"
            || featureName == "com.google.android.apps.photos.PIXEL_PRELOAD"
            || featureName == "com.google.android.apps.photos.PIXEL_2016_PRELOAD") {
            return true;
        }

        const result = hasSystemFeatureMethod.call(this, featureName, version);
        console.log(`Result : ${result}`)
        return result;
    }

    console.log('Hooked hasSystemFeature method');
}

function main() {
    hookBuildVariables();
    hookHasSystemFeature();
}

Java.perform(() => {
    main();
});

This script spoofs your device as Pixel XL 2016 to Google Photos. This gives us Unlimited Google Photos Storage at Original Quality.

[AlyafeiAli]

This script spoofs your device as Pixel XL 2016 to Google Photos. This gives us Unlimited Google Photos Storage at Original Quality.

Much appreciated, thanks!

[AlyafeiAli]

I can confirm that the Frida script is working perfectly!

[itsyourap]

Yes! We can use this on non-rooted devices by integrating frida-gadget into Google Photos apk, but someone has to integrate Vanced MicroG into it to evade signature detection.

[oSumAtrIX]

ReVanced/revanced-patches-template#1055

[nochlab1]

Is there any chance of this happening any time soon?

[XdekHckr]

why it was rejected from development tho?

[RivelBop]

I would love to see this be integrated, I hope that they won't give up on this idea!

[mountaser]

I can confirm that the Frida script is working perfectly!

@itsyourap would one of you be nice enough to explain how use the frida script? and also @itsyourap is it possible to change the app name so i can have a modded and none mooded apps installed togather? reason is i have a p8p and i assume if the app thinks its a pixel 1 i wont get the magic editor and other features from the pixel 8 pro

[nochlab1]

I can confirm that the Frida script is working perfectly! @itsyourap would one of you be nice enough to explain how use the frida script? and also @itsyourap is it possible to change the app name so i can have a modded and none mooded apps installed togather? reason is i have a p8p and i assume if the app thinks its a pixel 1 i wont get the magic editor and other features from the pixel 8 pro

Yes we know that but we want it on a non rooted phone

[kunal266]

yes is it possible to use this frida script with a non-rooted phone

[gerryave]

Hi everyone, I'm looking for an apk file modified with Frida. It's the first time I've tried to mod with Frida and I can't. I don't understand where I'm going wrong. Would it be possible for some of you to help me or send me an apk modified with Frida so I can have google photos? unlimited on my non-rooted device?

[oSumAtrIX]

This is not a support channel, we get notified about new comments here for development purposes; please move to one of our other platforms you can find on https://revanced.app