# 🎯 Quick Start: Bypass Backdrops Root Detection

## The Problem
Backdrops app has **root detection** that makes it crash on startup:
- Checks `Build.TAGS` for "test-keys"
- Checks for `/system/app/Superuser.apk`
- Checks for `/system/xbin/su`

Found in: `C3/C0446i.java` (lines 377-380) and `F3/E.java`

## The Solution - 3 Scripts Created

### ⭐ Method 1: Complete Bypass (RECOMMENDED)
```powershell
.\launch_bypass.ps1
```

**What it does:**
1. Stops the app
2. Launches with Frida in spawn mode (hooks BEFORE app starts)
3. Bypasses root detection
4. Unlocks all premium wallpacks

**After it launches:**
- Wait for `[+] Java runtime available` message
- Type `%resume` and press Enter
- App should start without crashing!

---

### Method 2: Ultra-Early Bypass (If Method 1 Fails)
```powershell
frida -U -f com.backdrops.wallpapers -l frida_ultra_early.js -D 192.168.226.101:5555
```

**Differences:**
- Uses `setImmediate()` for earliest possible hooking
- Hooks File constructor directly
- Blocks Runtime.exec() calls

**After it launches:**
- Type `%resume` and press Enter

---

### Method 3: Manual Commands
```powershell
# 1. Stop app
adb -s 192.168.226.101:5555 shell am force-stop com.backdrops.wallpapers

# 2. Launch with Frida
frida -U -f com.backdrops.wallpapers -l frida_complete_bypass.js -D 192.168.226.101:5555

# 3. When you see hooks loaded, type:
%resume
```

---

## What You Should See

### ✅ Success:
```
[+] Java runtime available
[+] Spoofed Build.TAGS to 'release-keys'
[+] Hooked File.exists() - blocking root paths
[+] Hooked root checker methods in C3.C0446i
[✓] Root detection bypasses installed!
[BYPASS] isPremiumPackUnlocked('backdrops.pack.trinity') -> TRUE
[✓] ALL BYPASSES ACTIVE!
```

### ❌ Still Crashes?
If it still crashes, it's likely the **native library** (libpairipcore.so) that's crashing BEFORE Java hooks load.

**Try this:**
1. Hide Magisk: `adb shell su -c "magisk --hide add com.backdrops.wallpapers"`
2. Rename frida-server to something generic
3. Use a non-rooted device (if possible)
4. Static patching (modify APK directly)

---

## Testing Premium Bypass

1. Open the app (should launch without crash)
2. Navigate to **Collections** or **Packs**
3. Try opening premium packs:
   - Trinity Pack
   - AMOLED Pack
   - Acid Pack
   - Optic Pack
   - Synth Pack
   - Void Pack

4. Wallpapers should open without purchase prompt!

---

## Troubleshooting

### "Error: unable to find process"
→ frida-server not running
```powershell
adb -s 192.168.226.101:5555 shell "/data/local/tmp/frida-server &"
```

### "Terminated" message
→ Native crash, root detection may run before hooks
→ Try `frida_ultra_early.js`

### "Cannot read property 'implementation'"
→ Class not found, app structure changed
→ Check if class names still match

### App freezes after %resume
→ Normal, give it 5-10 seconds to initialize
→ Check logcat: `adb logcat | Select-String Backdrops`

---

## Files Created

| File | Purpose |
|------|---------|
| `frida_complete_bypass.js` | Main bypass script (root + premium) |
| `frida_ultra_early.js` | Ultra-early root bypass |
| `launch_bypass.ps1` | PowerShell launcher (easiest) |
| `ROOT_BYPASS_GUIDE.md` | Detailed technical guide |
| `README_DYNAMIC_ANALYSIS.md` | Full documentation |

---

## Quick Reference

```powershell
# Best method - use this
.\launch_bypass.ps1

# Alternative if that fails
frida -U -f com.backdrops.wallpapers -l frida_ultra_early.js -D 192.168.226.101:5555

# Check if frida-server is running
adb -s 192.168.226.101:5555 shell "ps | grep frida"

# View logs
adb -s 192.168.226.101:5555 logcat | Select-String Backdrops
```

---

## Next Steps

1. Try `.\launch_bypass.ps1`
2. Wait for hooks to load
3. Type `%resume`
4. Test premium wallpacks
5. If crashes, try `frida_ultra_early.js`
6. If still crashes, check `ROOT_BYPASS_GUIDE.md` for advanced solutions

Good luck! 🚀