yooma1/qufz

What It Does

AntiFraudBlock is a single-purpose LSPosed module for ColorOS/OPPO Phone Manager (com.coloros.phonemanager). It silences the anti-fraud feature's telemetry and cloud upload paths while leaving local risk detection intact: notifications, dialogs, detection service, and the on-device history page continue to work [citation:3][citation:9].

The README documents the hook targets reverse-engineered from Phone Manager 17.1.6: AiDetectStatistics static methods, AiVoiceDetectDCSUtils.m/n, and the shared TrackApi.E sink filtered by appId 20092 and event-name prefixes such as anti_fraud* and ai_detect* [citation:6][citation:7][citation:8].

Quick Start

1. Install the prebuilt APK from release/AntiFraudBlock-2.0.apk.
2. Enable the module in LSPosed and check only Phone Manager (com.coloros.phonemanager) in scope.
3. Force-stop and reopen Phone Manager.

Command-line alternative [citation:10][citation:11]:

adb install -r AntiFraudBlock-2.0.apk
/data/adb/modules/zygisk_lsposed/lspctl scope list com.eta.afb
# expected: 0  com.coloros.phonemanager
adb shell am force-stop com.coloros.phonemanager
logcat -s AntiFraudBlock:*

Expected log lines include module loaded, attach com.coloros.phonemanager, counts of silenced methods, and TrackApi.E -> 1 sink hooked. The bundled selftest.sh checks assembly, interception, and local functionality; --active also opens the anti-fraud page to generate real events [citation:15][citation:16].

To temporarily disable all injection, create /data/local/tmp/afb.disable, force-stop Phone Manager, and delete the file to restore the hooks [citation:13][citation:14].

Constraints

• Only tested on RMX5200 / ColorOS 16 / Phone Manager 17.1.6. Different ColorOS versions may rename classes, in which case hooks fail and no interception occurs; it should not crash [citation:26].
• The module only filters Phone Manager's own reporting. Third-party apps using other channels are out of scope, and the shared TrackApi.E sink keeps events from other appIds [citation:26].
• Future Phone Manager versions using native reporting or a different SDK would need new reverse engineering; the Java-layer hooks would stop intercepting.
• The release APK uses a formal signing key not in the repo, so it cannot be installed over a locally rebuilt debug-signed APK; uninstall first and re-select scope in LSPosed [citation:21][citation:22][citation:23].
• Requires a rooted device with LSPosed and scoped access to Phone Manager.

Building

./build.sh produces a development APK under out/. Release builds need signing variables (AFB_KS, AFB_KS_PASS, AFB_KS_ALIAS, AFB_KS_KEYPASS); without AFB_KS the release build refuses to run to avoid overwriting the formal package with a debug certificate [citation:19][citation:21][citation:22]. Build dependencies are javac(11+), aapt2, d8, zipalign, apksigner, and android.jar platform 34; the libxposed API 102 artifact is fetched from Maven Central [citation:20].

HotRepo's take

The project entered HotRepo's new-project list on 2026-11-05 under the Java list, with 6 stars and 2 forks gained in a roughly one-hour window, reaching 115 stars total. The README is unusually specific: it names the APK version, dex classes, hooked methods, event names, and expected log output, which makes the scope narrow and verifiable rather than a generic tweak. Whether it holds depends on the exact ColorOS version—so the version boundary matters more than the star count.

Project source and documentation