2.0.4 #17

NubleX · 2026-02-28T00:46:58Z

NubleX
Feb 28, 2026
Maintainer

ID-Spoofer v2.0.4: Android Persona + macOS Native + Windows Native

Context

Branch dev.2.0.3 shipped the TUI redesign + network recon. Branch dev.2.0.4 (off dev.2.0.3) delivers:

Android persona — A new network persona that makes the machine look like an Android phone on the wire. Android runs the Linux kernel so the TCP options order is identical, but the fingerprint parameters differ (ECN=0, WScale=8 vs desktop Linux's ECN=2/WScale=7, mobile-tuned buffers, android-XXXXXXXX DHCP hostname).
Phase 5 (macOS native) — Wire real macOS implementations: ifconfig for MAC spoofing, sysctl net.inet.ip.ttl for TTL, scutil for hostname (already done). Expose via platform_darwin.go + mac_darwin.go + netident_darwin.go.
Phase 6 (Windows native) — Wire real Windows implementations: registry (Tcpip\Parameters) for TTL/TCP flags, registry (NetworkAddress key) for MAC, wmic for hostname (already done). Expose via platform_windows.go + mac_windows.go + netident_windows.go.

Part 1: Android Persona

1A. `internal/netident/netident.go` — Add constant + factory

Add PersonaAndroid PersonaType = "android" to the const block.

Add AndroidPersona(hostname string) Persona:

// p0f: *:64:0:*:65535,8:mss,sackOK,ts,nop,ws:df,id+:0
// Key diffs from desktop Linux: ECN=0, WScale=8, mobile buffer tuning.
func AndroidPersona(hostname string) Persona {
    return Persona{
        Type:             PersonaAndroid,
        Hostname:         hostname,
        TTL:              64,
        TCPTimestamps:    1,
        TCPWindowScaling: 1,
        TCPSACK:          1,
        TCPECN:           0,   // disabled by default in Android ROMs
        TCPRFC1337:       0,
        MSS:              1460,
        WScale:           8,   // typical Android WiFi (vs Linux 7)
        RmemDefault:      87380,
        RmemMax:          6291456,  // 6MB — mobile optimised
        WmemDefault:      87380,
        WmemMax:          6291456,
        DHCPVendorClass:  "",
        SuppressMDNS:     false,
    }
}

1B. `internal/netident/pktrewrite_linux.go` — Wire Android to existing TCP options

Two changes:

personaWScale() — add explicit Android case:

case PersonaAndroid:
    return 8

buildTCPOptions() — add Android to the Linux branch (same kernel, same options order):

case PersonaLinux, PersonaAndroid:
    tsVal, tsEcr, found := extractTimestamp(origOpts)
    ...
    return linuxTCPOptions(mss, wscale, tsVal, tsEcr)

1C. `internal/hostname/generate.go` — Add `GenerateRandomAndroid()`

Android devices announce hostnames like android-a3f9kl2d7b8e1c4f (hex suffix). Add:

var androidPrefixes = []string{"android", "samsung", "pixel", "oneplus", "xiaomi"}

func GenerateRandomAndroid() string {
    prefix := pick(androidPrefixes)
    suffix := randomHex(16)  // 16-char lowercase hex
    return fmt.Sprintf("%s-%s", prefix, suffix)
}

Add a randomHex(n int) string helper using crypto/rand.

1D. `internal/spoofer/spoofer.go` — Add Android to the persona switch

In applyNetIdent() around line 181, add before default:

case netident.PersonaAndroid:
    dhcpHostname = hostname.GenerateRandomAndroid()
    persona = netident.AndroidPersona(dhcpHostname)

1E. `cmd/idspoof/apply.go` — Update `parsePersonaType()` + flag help

Add case "android": return netident.PersonaAndroid before default.

Update flag help string: "Network persona to project (windows, macos, ios, linux, android)".

Update Long description of applyCmd.

1F. `cmd/idspoof/tui_identity.go` — Add Android radio button

Add to identityItems slice after the iOS item:

{
    label:     "Android 12+ (Phone/Tablet)",
    opKey:     "persona-android",
    group:     "persona",
    descTitle: "Android Persona",
    description: "Projects an Android 12+ network identity...",
},

Add to buildOpts() switch:

case "persona-android":
    opts.NetIdent = true
    opts.PersonaType = netident.PersonaAndroid

Part 2: Phase 5 — macOS Native

2A. `internal/mac/mac_darwin.go` — New file (`//go:build darwin`)

//go:build darwin

package mac

import (
    "fmt"
    "net"
    "os/exec"
    "strings"
)

type darwinSpoofer struct{}

func NewLinuxSpoofer() Spoofer  { return &darwinSpoofer{} }
func NewDarwinSpoofer() Spoofer { return &darwinSpoofer{} }

// ListInterfaces parses `ifconfig -a` for physical interfaces.
// Skips lo0, utun*, gif*, stf*, bridge*, etc.
func (s *darwinSpoofer) ListInterfaces() ([]InterfaceMAC, error) {
    out, err := exec.Command("ifconfig", "-a").Output()
    // parse lines: "en0: flags=..." then "\tether aa:bb:cc:dd:ee:ff"
    // collect en*, em*, wlan* type interfaces with a valid ether line
}

// Apply brings each interface down, sets ether via ifconfig, brings back up.
func (s *darwinSpoofer) Apply(origIfaces []InterfaceMAC) ([]InterfaceMAC, error) {
    var applied []InterfaceMAC
    for _, iface := range origIfaces {
        newMAC := GenerateRandom()
        // ifconfig <iface> ether <mac>
        if err := exec.Command("ifconfig", iface.Name, "ether", newMAC).Run(); err != nil {
            // rollback already-applied, return error
        }
        applied = append(applied, InterfaceMAC{Name: iface.Name, MAC: newMAC})
    }
    return applied, nil
}

func (s *darwinSpoofer) Restore(ifaces []InterfaceMAC) error {
    for _, iface := range ifaces {
        exec.Command("ifconfig", iface.Name, "ether", iface.MAC).Run()
    }
    return nil
}

func (s *darwinSpoofer) Verify(iface string, expected net.HardwareAddr) error {
    out, _ := exec.Command("ifconfig", iface).Output()
    // grep "ether" line
}

2B. `internal/netident/netident_darwin.go` — New file (`//go:build darwin`)

Implements netident.Spoofer for macOS. Scope: sysctl TTL + DHCP hostname via networksetup. No iptables, no NFQUEUE (not available on macOS).

//go:build darwin

package netident

import (
    "os/exec"
    "strconv"
    "strings"
)

type darwinSpoofer struct{}

func NewLinuxSpoofer() Spoofer  { return &darwinSpoofer{} }
func NewDarwinSpoofer() Spoofer { return &darwinSpoofer{} }

// Current reads net.inet.ip.ttl. Other TCP params are not writable on macOS.
func (s *darwinSpoofer) Current() (*Snapshot, error) {
    ttl := macSysctlGet("net.inet.ip.ttl")  // from fingerprint_darwin.go helper
    return &Snapshot{TTL: ttl, TCPTimestamps: -1, ...}, nil
}

// Apply sets TTL via sysctl + announces DHCP hostname via networksetup.
// No iptables/NFQUEUE on macOS — partial apply (TTL only).
func (s *darwinSpoofer) Apply(p Persona) error {
    // 1. sysctl: only TTL is writable on macOS without SIP bypass
    macSysctlSet("net.inet.ip.ttl", p.TTL)

    // 2. DHCP hostname: try networksetup for each service
    services := listNetworkServices()  // networksetup -listallnetworkservices
    for _, svc := range services {
        exec.Command("networksetup", "-setcomputername", p.Hostname).Run()
    }
    return nil
}

func (s *darwinSpoofer) Restore(snap *Snapshot) error {
    if snap.TTL > 0 {
        macSysctlSet("net.inet.ip.ttl", snap.TTL)
    }
    return nil
}

The helpers macSysctlGet / macSysctlSet already exist in fingerprint_darwin.go — reuse them (they're package-level unexported functions within the same fingerprint package, but netident_darwin.go is in the netident package so needs its own copies or a shared helper). Solution: inline the sysctl calls directly in netident_darwin.go since they're one-liners.

2C. `internal/platform/platform_darwin.go` — New file (`//go:build darwin`)

//go:build darwin

package platform

import (
    "github.com/NubleX/idspoof/internal/mac"
    "github.com/NubleX/idspoof/internal/netident"
    "github.com/NubleX/idspoof/internal/sysinfo"
)

type darwinPlatform struct{}

func newDarwinPlatform() (Platform, error) {
    return &darwinPlatform{}, nil
}

func (d *darwinPlatform) Name() string                     { return "darwin" }
func (d *darwinPlatform) MACSpoofer() mac.Spoofer          { return mac.NewDarwinSpoofer() }
func (d *darwinPlatform) NetIdentSpoofer() netident.Spoofer { return netident.NewDarwinSpoofer() }
func (d *darwinPlatform) SystemInfoSpoofer() sysinfo.Spoofer { return sysinfo.NewStubSpoofer() }

2D. Update `internal/platform/platform_other.go`

Change build tag from //go:build !linux to //go:build !linux && !darwin && !windows.
Remove newDarwinPlatform() and newWindowsPlatform() stub functions (they'll be in their own files).
Keep newLinuxPlatform() panic (still relevant for the "other" stub).

Also add a stub newWindowsPlatform() returning error for the !linux && !darwin && !windows case.

Part 3: Phase 6 — Windows Native

3A. `internal/mac/mac_windows.go` — New file (`//go:build windows`)

Uses the Windows registry to set NetworkAddress on the adapter class key.

//go:build windows

package mac

import (
    "fmt"
    "net"
    "os/exec"
    "golang.org/x/sys/windows/registry"
)

const adapterClassKey = `SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}`

type windowsSpoofer struct{}

func NewLinuxSpoofer() Spoofer   { return &windowsSpoofer{} }
func NewWindowsSpoofer() Spoofer { return &windowsSpoofer{} }

// ListInterfaces uses `netsh interface show interface` to enumerate adapters.
func (s *windowsSpoofer) ListInterfaces() ([]InterfaceMAC, error) {
    // exec "netsh interface show interface" or PowerShell Get-NetAdapter
    // parse output to get Name + current MAC via "ipconfig /all"
}

// Apply sets NetworkAddress registry key then disables/enables adapter.
func (s *windowsSpoofer) Apply(origIfaces []InterfaceMAC) ([]InterfaceMAC, error) {
    for _, iface := range origIfaces {
        newMAC := GenerateRandom()
        if err := setWindowsMAC(iface.Name, newMAC); err != nil {
            continue // non-fatal, best effort
        }
    }
}

// setWindowsMAC writes NetworkAddress to HKLM registry and bounces adapter.
func setWindowsMAC(ifaceName, mac string) error {
    // 1. Find adapter subkey index (enumerate {4D36E972...}\0001, 0002...)
    // 2. Write "NetworkAddress" = mac (without colons) as REG_SZ
    // 3. Disable + re-enable adapter: netsh interface set interface <name> disabled/enabled
}

3B. `internal/netident/netident_windows.go` — New file (`//go:build windows`)

Wraps fingerprint_windows.go's registry logic (which already exists) into the Spoofer interface.

//go:build windows

package netident

// windowsSpoofer applies Tcpip\Parameters via the registry.
// Builds on fingerprint_windows.go approach (same package, can call helpers).

const tcpipParamsKey = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters`

func NewLinuxSpoofer() Spoofer   { return &windowsSpoofer{} }
func NewWindowsSpoofer() Spoofer { return &windowsSpoofer{} }

func (s *windowsSpoofer) Current() (*Snapshot, error) {
    ttl := winRegGetDWORD(tcpipParamsKey, "DefaultTTL")
    tcp1323 := winRegGetDWORD(tcpipParamsKey, "Tcp1323Opts")
    timestamps := tcp1323 & 0x1      // bit 0
    winscale   := (tcp1323 >> 1) & 0x1 // bit 1
    return &Snapshot{TTL: ttl, TCPTimestamps: int(timestamps), TCPWindowScaling: int(winscale)}, nil
}

func (s *windowsSpoofer) Apply(p Persona) error {
    winRegSetDWORD(tcpipParamsKey, "DefaultTTL", uint32(p.TTL))
    var tcp1323 uint32
    if p.TCPTimestamps == 1 { tcp1323 |= 0x1 }
    if p.TCPWindowScaling == 1 { tcp1323 |= 0x2 }
    winRegSetDWORD(tcpipParamsKey, "Tcp1323Opts", tcp1323)
    return nil  // changes take effect after network restart
}

func (s *windowsSpoofer) Restore(snap *Snapshot) error {
    // reapply original values
}

The winRegGetDWORD / winRegSetDWORD helpers: these exist conceptually in fingerprint_windows.go but are in the fingerprint package. netident_windows.go is in netident package — implement its own small registry helpers using golang.org/x/sys/windows/registry.

3C. `internal/platform/platform_windows.go` — New file (`//go:build windows`)

//go:build windows

package platform

type windowsPlatform struct{}

func newWindowsPlatform() (Platform, error) {
    return &windowsPlatform{}, nil
}

func (w *windowsPlatform) Name() string                     { return "windows" }
func (w *windowsPlatform) MACSpoofer() mac.Spoofer          { return mac.NewWindowsSpoofer() }
func (w *windowsPlatform) NetIdentSpoofer() netident.Spoofer { return netident.NewWindowsSpoofer() }
func (w *windowsPlatform) SystemInfoSpoofer() sysinfo.Spoofer { return sysinfo.NewStubSpoofer() }

Critical Files

File	Change
`internal/netident/netident.go`	Add `PersonaAndroid` const + `AndroidPersona()` factory
`internal/netident/pktrewrite_linux.go`	Add Android to `personaWScale()` + `buildTCPOptions()`
`internal/hostname/generate.go`	Add `GenerateRandomAndroid()` + `randomHex()` helper
`internal/spoofer/spoofer.go`	Add Android case in `applyNetIdent()` switch
`cmd/idspoof/apply.go`	Add "android" to `parsePersonaType()` + update help text
`cmd/idspoof/tui_identity.go`	Add Android radio item + `buildOpts()` case
`internal/mac/mac_darwin.go`	New — darwinSpoofer using `ifconfig`
`internal/netident/netident_darwin.go`	New — darwinSpoofer (sysctl TTL + networksetup DHCP)
`internal/platform/platform_darwin.go`	New — darwinPlatform wiring
`internal/platform/platform_other.go`	Update build tag to `!linux && !darwin && !windows`
`internal/mac/mac_windows.go`	New — windowsSpoofer using registry NetworkAddress
`internal/netident/netident_windows.go`	New — windowsSpoofer using Tcpip\Parameters registry
`internal/platform/platform_windows.go`	New — windowsPlatform wiring

Build Order

git checkout -b dev.2.0.4
Android persona (netident.go → pktrewrite_linux.go → generate.go → spoofer.go → apply.go → tui_identity.go)
Phase 5 macOS (mac_darwin.go → netident_darwin.go → platform_darwin.go → update platform_other.go)
Phase 6 Windows (mac_windows.go → netident_windows.go → platform_windows.go)
Build + vet + test

Verification

export PATH="$HOME/.go/bin:$PATH" && cd idspoof

# Tests
go test -race ./...

# Cross-compile all 5 targets
make build-all

# Verify Android persona compile-time
grep -r "PersonaAndroid" internal/ cmd/

# Verify macOS builds
GOOS=darwin GOARCH=amd64 go build ./...

# Verify Windows builds
GOOS=windows GOARCH=amd64 go build ./...

# Runtime test (on Linux)
sudo ./bin/idspoof apply --persona android --dry-run
sudo ./bin/idspoof apply --persona android --netident  # live apply

Navigation Menu

2.0.4 #17

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

2.0.4 #17

Uh oh!

NubleX Feb 28, 2026 Maintainer

ID-Spoofer v2.0.4: Android Persona + macOS Native + Windows Native

Context

Part 1: Android Persona

1A. internal/netident/netident.go — Add constant + factory

1B. internal/netident/pktrewrite_linux.go — Wire Android to existing TCP options

1C. internal/hostname/generate.go — Add GenerateRandomAndroid()

1D. internal/spoofer/spoofer.go — Add Android to the persona switch

1E. cmd/idspoof/apply.go — Update parsePersonaType() + flag help

1F. cmd/idspoof/tui_identity.go — Add Android radio button

Part 2: Phase 5 — macOS Native

2A. internal/mac/mac_darwin.go — New file (//go:build darwin)

2B. internal/netident/netident_darwin.go — New file (//go:build darwin)

2C. internal/platform/platform_darwin.go — New file (//go:build darwin)

2D. Update internal/platform/platform_other.go

Part 3: Phase 6 — Windows Native

3A. internal/mac/mac_windows.go — New file (//go:build windows)

3B. internal/netident/netident_windows.go — New file (//go:build windows)

3C. internal/platform/platform_windows.go — New file (//go:build windows)

Critical Files

Build Order

Verification

Replies: 0 comments

NubleX
Feb 28, 2026
Maintainer

1A. `internal/netident/netident.go` — Add constant + factory

1B. `internal/netident/pktrewrite_linux.go` — Wire Android to existing TCP options

1C. `internal/hostname/generate.go` — Add `GenerateRandomAndroid()`

1D. `internal/spoofer/spoofer.go` — Add Android to the persona switch

1E. `cmd/idspoof/apply.go` — Update `parsePersonaType()` + flag help

1F. `cmd/idspoof/tui_identity.go` — Add Android radio button

2A. `internal/mac/mac_darwin.go` — New file (`//go:build darwin`)

2B. `internal/netident/netident_darwin.go` — New file (`//go:build darwin`)

2C. `internal/platform/platform_darwin.go` — New file (`//go:build darwin`)

2D. Update `internal/platform/platform_other.go`

3A. `internal/mac/mac_windows.go` — New file (`//go:build windows`)

3B. `internal/netident/netident_windows.go` — New file (`//go:build windows`)

3C. `internal/platform/platform_windows.go` — New file (`//go:build windows`)