#!/system/bin/sh
# Early boot: spoof read-only props before most apps start.
# resetprop is provided by Magisk.

MODDIR=${0%/*}
LOGTAG="maribank_device_spoof"

log() {
  echo "[$LOGTAG] $*" >> /cache/maribank_device_spoof.log 2>/dev/null
  echo "[$LOGTAG] $*"
}

if [ ! -f "$MODDIR/serial.txt" ]; then
  # 16-char alphanumeric serial, stable across reboots
  SERIAL=$(cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16)
  [ -z "$SERIAL" ] && SERIAL="MB$(date +%s | tail -c 9)"
  echo "$SERIAL" > "$MODDIR/serial.txt"
fi
SERIAL=$(cat "$MODDIR/serial.txt")

log "serial=$SERIAL"

# --- device identity (SHPSSDK / attestation often reads these) ---
resetprop -n ro.serialno "$SERIAL"
resetprop -n ro.boot.serialno "$SERIAL"
resetprop -n ro.boot.serialno "$SERIAL"
resetprop -n persist.sys.serialno "$SERIAL"

# --- hide root / debug fingerprint ---
resetprop -n ro.debuggable 0
resetprop -n ro.secure 1
resetprop -n ro.adb.secure 1
resetprop -n ro.build.type user
resetprop -n ro.build.tags release-keys
resetprop -n ro.boot.verifiedbootstate green
resetprop -n ro.boot.flash.locked 1
resetprop -n ro.boot.vbmeta.device_state locked
resetprop -n vendor.boot.vbmeta.device_state locked
resetprop -n ro.boot.veritymode enforcing
resetprop -n ro.boot.warranty_bit 0
resetprop -n ro.crypto.state encrypted

# --- adb off (match Java-layer bypass) ---
resetprop -n init.svc.adbd stopped
resetprop -n init.svc.adb stopped
resetprop -n service.adb.root 0
resetprop -n persist.sys.adb_enable 0
resetprop -n persist.adb.wifi.enabled 0

log "post-fs-data done"