Google Photos ReVanced does not restore the active GmsCore account on startup

[Epikaigle]

Describe the bug

ReVanced patched Google Photos does not automatically restore the already-added GmsCore account when the app starts.

The Google account is still present in ReVanced GmsCore and is not actually signed out. However, every time Google Photos ReVanced is opened, it starts in local mode with no active account/profile picture shown.

When I tap the profile icon in the top-right corner, my existing GmsCore account is already listed. Selecting it immediately restores the account and the app works normally. No password, browser login, 2FA, or new authentication is required.

After closing or force-stopping Google Photos ReVanced and opening it again, the same issue happens again: the account is available in the list but is not automatically selected/restored.

This looks like an issue with restoring the active/default account at app startup, rather than a real logout.

To Reproduce

1. Install ReVanced GmsCore.
2. Add a Google account to ReVanced GmsCore.
3. Patch Google Photos using ReVanced Manager with GmsCore support enabled.
4. Open Google Photos ReVanced.
5. Notice that it opens in local mode without an active Google account.
6. Tap the profile icon in the top-right corner.
7. Select the already-added GmsCore account.
8. Google Photos starts working normally with the account.
9. Close or force-stop Google Photos ReVanced.
10. Open it again.
11. The app opens in local mode again and requires manually selecting the same existing account.

Expected behavior

Google Photos ReVanced should automatically open with the previously selected GmsCore account already active, without requiring manual account selection after every app restart.

Actual behavior

Google Photos ReVanced opens in local mode with no active account shown.

The account is still available in GmsCore and can be selected manually, but it is not restored automatically when the app launches.

System

• Device: Google Pixel 7 Pro
• Android version: Android 17
• ROM: Stock ROM
• Root: No / non-root
• Patched package name: app.revanced.android.photos

Additional information

YouTube ReVanced works correctly with the exact same ReVanced GmsCore installation and automatically opens with the account already active.

The issue appears specific to Google Photos ReVanced.

The account is not actually removed or logged out from GmsCore. It remains visible in the account list and can be reused immediately by selecting it manually.

[rkkaahyap9-a11y]

Yes शनि, 4 जुल॰ 2026, 8:52 pm को Épikaigle ***@***.***> ने लिखा:

…

*Epikaigle* created an issue (ReVanced/GmsCore#373) <#373> Describe the bug Revanced patched Google photos don't open directly to logged in google account. First it opens to local mode without account mode. When pressed to account and login it opens normally with account . To Reproduce Steps to reproduce the behavior: I patched google photos with revanced manager and logged in my google account in GmsCore. 1. Go to 'Revanced google photos' 2. See error Expected behavior Revanced google photos should directly open to logged in mode. System Android Version : 17 Stock Rom : Pixel 7 Pro Non-Root Additional Revanced Youtube is working perfectly. It opens directly into logged in behaviour. — Reply to this email directly, view it on GitHub <#373?email_source=notifications&email_token=CFT4CSHSRIGXVLOFYZL7DBT5DEOJZA5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NBYGA4TKMRTGMZTHJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CFT4CSAC2SWY5ZOOLWPXZC35DEOJZAVCNFSNUABFKJSXA33TNF2G64TZHM3DKNZUGM3DANZWHNEXG43VMU5TIOBQHE2TEMZTGMZ2C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CFT4CSCY2SHBXJRLWQNXI735DEOJZA5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NBYGA4TKMRTGMZTHJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/CFT4CSB32VLF4VTSKXYAJ3T5DEOJZA5CNFSL4Z3JMQ5C6L3HNF2C22DVMIXUS43TOVSS6NBYGA4TKMRTGMZTHJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[zappybiby]

I was able to reproduce the bug with GmsCore 0.3.13.3.250932-user (pre-release 776a8fb) and app.revanced.android.photos 7.82.0.937646388 + com.google.android.apps.photos 7.8.0.697873850 built with revanced-patcher-22.1.0-dev.1 and revanced-patches-v6.1.1-dev.3

The cause of this bug is due to callerHasGooglePackagePermission() spoofing the caller package name before checking package permissions.

• When stock Photos is installed side-by-side, GmsCore builds ExtendedPackageInfo for the spoofed package com.google.android.apps.photos

• That makes the permission check use the installed stock Photos package info instead of the patched caller’s spoof metadata.

This issue appears to be specific to ReVanced and not upstream microG related.

---

I tested adding a spoofed-identity permission check for the Photos ACCOUNT/OWNER/APP_CERT/etc. permissions in PackageUtils, and it appears to fix the bug.

hacky proof of concept fix

diff --git a/play-services-base/core/src/main/java/org/microg/gms/common/PackageUtils.java b/play-services-base/core/src/main/java/org/microg/gms/common/PackageUtils.java
index 9ae26b1..86edcb2 100644
--- a/play-services-base/core/src/main/java/org/microg/gms/common/PackageUtils.java
+++ b/play-services-base/core/src/main/java/org/microg/gms/common/PackageUtils.java
@@ -76,11 +76,15 @@ public class PackageUtils {
     }
 
     public static boolean callerHasGooglePackagePermission(@NonNull Context context, GooglePackagePermission permission) {
+        PackageManager packageManager = context.getPackageManager();
         for (String packageCandidate : getCallingPackageCandidates(context)) {
             String packageName = PackageSpoofUtils.spoofPackageName(
-                    context.getPackageManager(),
+                    packageManager,
                     packageCandidate
             );
+            if (!packageCandidate.equals(packageName) && hasSpoofedGooglePackagePermission(packageManager, packageCandidate, permission)) {
+                return true;
+            }
 
             // See https://github.com/ReVanced/GmsCore/issues/10.
             ExtendedPackageInfo extendedPackageInfo = new ExtendedPackageInfo(context, packageName);
@@ -98,6 +102,25 @@ public class PackageUtils {
         return false;
     }
 
+    private static boolean hasSpoofedGooglePackagePermission(@NonNull PackageManager packageManager, @NonNull String packageName, GooglePackagePermission permission) {
+        if (!GOOGLE_APP_KEY.equals(PackageSpoofUtils.spoofStringSignature(packageManager, packageName, null))) {
+            return false;
+        }
+
+        switch (permission) {
+            case ACCOUNT:
+            case APP_CERT:
+            case AUTH:
+            case OWNER:
+            case PEOPLE:
+            case REPORTING:
+            case SAFETYNET:
+                return true;
+            default:
+                return false;
+        }
+    }
+
     public static void checkPackageUid(@NonNull Context context, @NonNull String packageName, int callingUid) {
         getAndCheckPackage(context, packageName, callingUid, 0);
     }

right now, revanced metadata is SHA-1 while the generic Google app cert is SHA-256. If we give KnownGooglePackages a SHA-1 alias for that cert, that should be the better fix.

[Epikaigle]

Thanks for digging into this and finding the cause, that makes a lot of sense.

I also noticed another symptom that may be related: Google account profile pictures do not show in patched Photos. GmsCore displays the avatars normally, but in Google Photos ReVanced the accounts only show the default letter/icon.

So it does look like Photos is only receiving part of the account information.

[oSumAtrIX]

Basically GmsCore has a whitelist of packages it trusts BUT it seems GmsCore has added a feature where calling apps can request GmsCore to trust it. I talked to the upstream devs and they mentioned the purpose is for apps like alternative play stores like Aurora to be able to pretend to be PlayStore when GmsCore is installed instead of GMS. ReVanced patches apps using the GmsCore support patch could use this exact feature which also makes us not having to disable the whitelist which is insecure. However last time I tried to get it working and launch the activity, it didn't work/GmsCore just appeared to work and I left it as is. Perhaps some guidance from upstream would be useful. I checked Aurora's code too but from what I saw the implementation looked identical. The intended behavior is for apps to request GmsCore, GmsCore would then show a dialog to the user asking to trust the app, then GmsCore would whitelist the package signature and grant access to the account.

On a related note, on our patches repo someone opened a similar PR patching a GMS class in the GmsCore support patch to make Maps work/not crash anymore: https://gitlab.com/ReVanced/revanced-patches/-/merge_requests/6956#note_3515146847

PS: Thanks for the donation @zappybiby next to your code contribution!! (Feel free to ping us on our discord to get the contributor and donator role :))