SymphoniumCrack/STATE.md

STATE.md — Symfonium/Symphonium Patch State

Status: SYMPHONIUM 14.1.0 WORKING ✓ — License + Crypto + Telemetry all bypassed

Target version

Version	APK	Status
Symphonium 14.1.0 (mobile)	Symphonium 14.1.apk	Working — license + crypto + telemetry bypassed

Patch layers applied (v4 — 14.1.0)

Working directory: apktool_output_v4/, build script: patch_v4.py

1. License gate class: smali/nh3.smali (FirebaseManager)

Method	Purpose	Patch stub
m()	Main license gate — all paths converge, sets hg5.y flag	Returns true, sets hg5.y = true
b()	KeyCheck — Base64 "S2V5Y2hlY2s=" → "KeyCheck", compares hex hash	Returns Boolean.TRUE
c()	RSA decryption validation	Returns null
d()	Firebase initialization ("Problem getting instance")	Returns null — fixes beta popup
h()	Firebase Remote Config check, triggers error state → beta UI + VolumeShaper mute	Returns Integer(0)
j()	Date check (contains "2099") for infinite license	Returns Boolean.TRUE
k()	License state check (46=IAB, 62/67=date-based)	Returns Boolean.TRUE
r()	License expiration date formatter	Returns null

2. Native crypto: smali/app/symfonik/crypto/internal/LibSymfonikWrapper.smali

b() method stub:

• Stores handler param in static field c
• Calls System.loadLibrary("symfonik") in try/catch (loads libsymfonik.so for native get()/set())
• Sets loaded flag b = Boolean.TRUE
• Posts init callback via handler Lrc5.a

Critical: field types change per version. For v4 (14.1.0):

• HandlerInitializable$handler$1.a → La04 (was Lr60 in v3)
• HandlerInitializable$handler$1 implements → Lvz3 (was Lsa3 in v3)
• Handler class → Lrc5 (was La35 in v3)
• Lql constructor arg → 0x14 (was 0x1c in v3)

3. Telemetry nuke

System	Smali	Method	Patch
Firebase Analytics	FirebaseAnalytics.smali	a() logEvent / setCurrentScreen()	Returns void (no-op)
Matomo/Piwik	oa2.smali	b() dispatch	Returns void (no-op)
Crashlytics	b70.smali	j() settings fetch	Returns null
Firebase Installations	vg3.smali	c() HTTP connection	Returns null

4. Config

File	Change
apktool.yml	minSdkVersion 32 → 26 (for v2+v3 signing)

NOT YET PATCHED

• VolumeShaper — audio fade-out DRM not yet bypassed in v4
• AndroidManifest.xml — requiredSplitTypes not yet removed

Build commands

# Decompile
java -Xmx4G -jar apktool.jar d "Symphonium 14.1.apk" -o apktool_output_v4/

# Patch
python3 patch_v4.py

# Cleanup bak files
find apktool_output_v4/ -name '*.smali.bak' -delete

# Rebuild
java -Xmx4G -jar apktool.jar b apktool_output_v4/ -o patched_v4_unsigned.apk

# Sign
java -jar uber-apk-signer.jar --apks patched_v4_unsigned.apk \
  --ks patch-keystore.jks --ksAlias symfonium \
  --ksPass android --ksKeyPass android

Crash fixes applied

#	Error	Root cause	Fix
1	NoSuchFieldError: No field a of type Lr60 in HandlerInitializable$handler$1	Field type changed: Lr60 → La04; Lql init arg 0x1c → 0x14	Updated stub field ref and constant
2	UnsatisfiedLinkError: get() native method	Stub was missing System.loadLibrary("symfonik")	Added try/catch loadLibrary block

Signing

• uber-apk-signer.jar — signing tool
• patch-keystore.jks — primary (alias: symfonium, pass: android)
• my-release-key.jks — alternative

Known remaining issues

1. Rapid skip exits player — pre-existing app bug (concurrency/race condition). Workaround: skip at normal pace.
2. VolumeShaper not patched on v4 — audio fade-out DRM may activate.

Prior versions (archived)

• Symphonium 13.6.5a — class: m9/a0, flag: ws/a.v, handler: La35
• Symfonium TV 14.0.0 — class: za3, flag: r65.y
• Symfonium 2.1.0 — not patched