Feature request

[ray2186014]

Can you also include GNSS spoofing/mocking like this module?:
https://modules.lsposed.org/module/dev.fzer0x.pokegocontrole/

[noobexon1]

Hi @ray2186014 !🙂

Can you please elaborate and give an example of why this is needed? As far as I know, you can simply modify your phone's settings to select GPS, GNSS, or both...

Have a great week!

[ray2186014]

Hi @noobexon1! 👋

To clarify — this isn't about selecting GPS/GNSS mode in Android settings. That only chooses which positioning system the device uses. The request is about spoofing the GNSS satellite metadata that Android exposes via GnssStatus callbacks.

---

Why It Matters — The Detection Vector

When XposedFakeLocation spoofs coordinates, the GnssStatus stream remains untouched and still reflects real satellite data for the device's actual physical location. Advanced apps increasingly cross-check:

• Satellite count and constellation type (GPS, GLONASS, Galileo, BeiDou)
• Per-satellite signal strength (C/N0 values)
• Satellite IDs (SVIDs) and azimuth/elevation geometry
• Whether the satellite geometry is physically consistent with the spoofed coordinates

If an app sees coordinates pointing to Location A, but GnssStatus shows a constellation geometry consistent only with Location B (the real location), that mismatch is a reliable spoofing detection signal — regardless of how cleanly the coordinates themselves are spoofed. This is actively used by anti-cheat systems in games like Pokémon GO.

---

How to Implement It — Technical Approach

Since XFL already hooks the android system server process, GNSS spoofing slots in naturally alongside the existing location hooks. Both Location Joystick and GpsSetter are now closed source, but Android's GNSS stack is fully documented in AOSP, so here's the complete approach:

1. The Hook Target

In system_server, GNSS status is delivered through:

com.android.server.location.gnss.GnssStatusProvider
  └── reportSvStatus() / onReportSvStatus()
        └── dispatches GnssStatus to registered app callbacks via Binder

Hook GnssStatusProvider.reportSvStatus() (or the equivalent internal dispatcher on your target API level) inside the android process — exactly where the existing location hooks already live.

2. Constructing a Fake GnssStatus

Android 10+ (API 29) introduced GnssStatus.Builder, making this straightforward:

val fakeStatus = GnssStatus.Builder().apply {
    // Add realistic satellites for the spoofed location
    // 8-12 satellites is typical for an open-sky urban fix
    addSatellite(
        GnssStatus.CONSTELLATION_GPS,  // constellationType
        5,      // svid
        35.0f,  // cn0DbHz  (signal strength, realistic range: 20-45)
        45.0f,  // elevation
        180.0f, // azimuth
        true,   // hasEphemerisData
        true,   // hasAlmanacData
        true,   // usedInFix
        false,  // hasCarrierFrequency
        0.0f    // carrierFrequency
    )
    // Add more satellites (mix of GPS + GLONASS/Galileo for realism)
}.build()

The key realism parameters to get right:

• Satellite count: 8–14 for a good outdoor fix; fewer indoors
• C/N0 values: 25–45 dBHz range, varying per satellite
• usedInFix: at least 4 satellites marked true (minimum for 3D fix)
• Constellation mix: real devices see GPS + GLONASS at minimum

3. Replacing the Real GnssStatus in the Hook

XposedHelpers.findAndHookMethod(
    "com.android.server.location.gnss.GnssStatusProvider",
    lpparam.classLoader,
    "reportSvStatus",
    // ... parameter types
    object : XC_MethodHook() {
        override fun beforeHookedMethod(param: MethodHookParam) {
            if (callerIsTargetApp(param)) {
                param.args[0] = buildFakeGnssStatus()
                // or skip dispatch entirely if blanking is preferred
            }
        }
    }
)

This is consistent with XFL v0.0.8's existing pattern of intercepting before dispatch and checking caller package — just applied to the GNSS status pipeline instead of the location pipeline.

4. Per-App Filtering (Already Handled)

Since XFL v0.0.7+ already resolves caller identity in system_server for location hooks, the same caller check mechanism applies here. GNSS status is sent only to apps that have registered a GnssStatus.Callback, so the same target app list used for coordinate spoofing covers GNSS spoofing with no additional configuration needed from the user.

---

Note: Location Joystick implements this same approach (system-scoped hook + fake GnssStatus construction), but its source is closed. The AOSP path above is the canonical implementation reference. XFL's existing system-server architecture is already perfectly positioned for this — it's essentially one additional hook on top of the existing ones.

Thanks for the amazing work on this module! 🙏

[noobexon1]

Fair enough. I'll leave this open in case someone wants to implement it. Right now we have more urgent things, but it can be a good addon in the future. Thanks! 👍🏻

[noobexon1]

Assigned myself to this issue. Will be fixed in the next release 🙂