🧩 Chiggi Morphe Patches

Third-party Morphe patches for SonyLIV, Nutrilio, Threads, Arrow Puzzle, CrazyGames, JioHotstar (TV), Vi Movies and TV (TV) and JioTV+ (TV).

A set of patches that modify these apps at the bytecode/resource level, applied with Morphe (a fork of ReVanced). These patches are an independent project and are not affiliated with Sony, SonyLIV, Nutrilio, Meta, Threads, Instagram, ReVanced, or the Morphe project.

All patches are verified to resolve and apply against com.sonyliv 6.23.1 using morphe-cli. Runtime behaviour should still be confirmed on a device.

• Ads on live content — "Remove video ads" disables the client-side (Google IMA) ad path. SonyLIV also uses server-side ad insertion (AWS MediaTailor / VisualOn SSAI) for some live streams; ads stitched into the video server-side cannot be removed by a client patch and may still appear on live content.
• CleverTap is intentionally not disabled. It is dependency-injected and drives in-app overlays / native-display UI, so disabling it would crash parts of the app. "Disable analytics" here covers AppsFlyer and the Firebase stack only.

• Version — pinned to 1.20.2. A null ("any") version is rejected by Morphe Manager (it makes the whole source fail to load), and Nutrilio is R8-obfuscated, so the two bytecode patches (Unlock Plus, Add food search bar) only verifiably resolve on 1.20.2. They are hardened (Unlock Plus anchors on a stable backend string instead of the obfuscated method name; the search bar resolves resource ids by name at runtime) to tolerate minor drift, but a different version may need re-fingerprinting.
• Add food search bar is the most update-fragile patch (it hooks the obfuscated form adapter) and is off by default so it can never block the other patches.
• Local backup & restore reuses Nutrilio's own backup engine, so the file it produces keeps the .nutrilio extension (it is a ZIP internally) — keep that extension or restore won't recognise it. This is a local file backup; Google Drive auto-backup is separate and needs Google Sign-In, which does not work on a re-signed/renamed build (the OAuth client is bound to the original signature and package), so Drive backup is effectively unavailable on the patched app.

• Version — pinned to 434.0.0.41.74. Threads is built from the heavily R8-obfuscated Instagram codebase, whose class/method names shift on nearly every Meta release; the Hide ads hooks are anchored on stable named classes but a different version may still need re-fingerprinting.
• Account / integrity risk — Threads is a Meta account app. Re-signing and renaming the package can trip Play Integrity / Meta app-attestation, which may cause feed-refresh failures, forced logout, or account action. Test on a secondary account first. If login breaks, disable Change package name.
• Analytics — Threads uses Meta's own telemetry (analytics2 / OneFabric), not Firebase, so there is no manifest flag to flip; only the AD_ID permission is removed.
• Scope — Hide ads forces the global isAd predicate false, so it also suppresses ad treatment on non-feed surfaces (e.g. reels). Server-side fetching of ads is unchanged; the patch only refuses to surface them.

• Unity game — gameplay is native (IL2CPP), but ads + analytics run on the Android/DEX side via the Easybrain SDK, which is where these patches apply.
• Removing all ads removes rewarded ads too — watch-to-earn rewards (coins/hints) no longer work, by design.
• Native anti-tamper — the game ships libsigner.so / libpglarmor.so; a re-signed + renamed package may trip a native integrity check. If the app crashes or closes on launch, disable Change package name (and test the unrenamed build).
• Version — pinned to 1.7.0. The ad/analytics JNI facades (AdsPlugin/AnalyticsPlugin) keep stable names, but the central analytics collector is obfuscated and may need re-fingerprinting on updates.

• Play Automatic Integrity Protection (PairIP) — CrazyGames ships with Google Play's PairIP licensing guard, which redirects any non-Play / re-signed install to the store. Bypass Play license check is required and on by default; without it the patched app won't open. This build has no PairIP code-virtualization (VMRunner), so neutering the license check is safe.
• Capacitor WebView app — most of CrazyGames is the remote Next.js portal (app.crazygames.com) rendered in a WebView. These patches only touch the native ad/telemetry shell.
• In-page web video ads remain — the pre/mid-roll ads shown inside a game come from CrazyGames' servers as web content, not the native ad SDK, so they are not in the app bytecode and cannot be removed here. "Remove ads" kills the native interstitial/banner/rewarded layer only.
• Auto-reward is client-side — the rewarded bypass fires the reward listener event the web grants on. If CrazyGames adds server-side reward verification, the reward simply won't be granted (no crash).
• Package kept — the package is not renamed, so Google/Facebook/Apple sign-in keeps working. The patched app installs over / conflicts with the Play Store version rather than alongside it.
• Native anti-tamper — the app ships ByteDance Pangle's libpglarmor.so / libsigner.so; a re-signed APK may trip a native integrity check (best case Pangle silently no-fills, worst case a launch crash — untested).
• Version — pinned to 1.6.7. The AdMob/Sentry plugin classes and method names are stable, but the Capacitor helper classes (PluginCall/JSObject/resolve) are R8-obfuscated, so the injected bytecode is version-specific.

Android TV build (in.startv.hotstar, leanback), supplied as the .apkm split bundle.

• ⚠️ Account-ban risk — JioHotstar does server-side fraud analysis. Re-signing + VPN + these client patches got a real account locked 24h for "suspicious activity" (NM-4290) because the attestation blob was sending IsTampered=true. The Spoof device attestation patch fixes that client-sent signal, but the server still sees your VPN exit IP and an already-flagged account stays on their radar. Do not run this on an account you cannot afford to lose — test on a throwaway Jio number first. For a real/paid subscription, use the official app.
• VPN bypass is novel — it is not in any public reference set; the block is client-enforced off a server verdict, so neutering the client store defeats it. If JioHotstar adds pure server-side IP playback enforcement in future, this could stop working.
• Flagged VPN exit IP — if the security error or a lock appears, the specific VPN server's IP is likely blocklisted; switching to a different (ideally residential/dedicated) India IP clears it. Multiple apps breaking at once on the same VPN = flagged IP, not a patch fault.
• Corner brand watermark cannot be removed — it is forensic/stream-baked (server-side), not a client render.
• Signature bypass not needed / not ported — the re-signed build already plays, and the reference getSignFromJNI tamper hook does not exist in this version.
• Ad approach credited to Paresh-Maheshwari (GPL-3.0) for the premium/screenshot/mirroring/codecs/HDR hooks.

Android TV build (com.vimtv, YuppTV OTT). No anti-tamper/VPN — clean re-sign.

Android TV build (com.jio.media.jiotvplus, PatchWall UI). No anti-tamper/VPN — clean re-sign.

• No premium patch — JioTV+ has no client paywall flag (the isPremium field is ad-request telemetry). Content is server-entitlement + Widevine gated, so there is nothing client-side to unlock.

These patches are distributed as a .mpp bundle for Morphe Manager.

• In Morphe Manager → Patch bundles → Add → Enter URL, paste the raw patches-bundle.json URL (this is the source URL the Manager expects — not the repository URL): https://raw.githubusercontent.com/durgesh0505/chiggi_morphe_patches/refs/heads/main/patches-bundle.json
• Or download the bundle directly: patches-1.15.1.mpp

Patch the SonyLIV Android TV APK or the Nutrilio bundle with Morphe, then sideload the result onto your device (both ship as split APKs; Morphe handles merging and signing).

scripts/repatch_sonyliv.sh patches a SonyLIV Android TV .apkm with this patch set (merging splits into one universal APK), applies the app-name / package-name options, and signs it with a keystore:

./scripts/repatch_sonyliv.sh path/to/sonyliv.apkm
# or run with no argument to pick the .apkm interactively

Override the defaults with environment variables, e.g. APP_NAME="My LIV" PACKAGE_NAME=com.sonyliv.custom KEYSTORE=./my.keystore ./scripts/repatch_sonyliv.sh app.apkm.

scripts/repatch_nutrilio.sh does the same for the Nutrilio split bundle (accepts the .zip download, copies it to .apks, enables the rename + food-search-bar patches, and signs):

./scripts/repatch_nutrilio.sh net.nutrilio.zip
# defaults: APP_NAME="Nutrilio Morphe" PACKAGE_NAME=net.nutrilio.morphe SEARCH_BAR=1

Both scripts use a locally built bundle if present, otherwise download the latest release. Requires JDK 17+, the Android SDK, and morphe-cli.

Requirements: JDK 17+ and the Android SDK (compileSdk 36).

A GitHub Personal Access Token with the read:packages scope is required to resolve morphe-patcher from the Morphe GitHub Packages registry. Add it to ~/.gradle/gradle.properties:

gpr.user=YOUR_GITHUB_USERNAME
gpr.key=YOUR_GITHUB_TOKEN

Then build the patch bundle:

./gradlew buildAndroid
# Output: patches/build/libs/patches-<version>.mpp

List or apply the patches with morphe-cli:

java -jar morphe-cli.jar list-patches --patches=patches/build/libs/patches-1.15.1.mpp -v
java -jar morphe-cli.jar patch -p patches/build/libs/patches-1.15.1.mpp -o out.apk base.apk

Licensed under the GNU General Public License v3.0, with the additional GPL Section 7 terms described in NOTICE. These patches are based on the prior work of Morphe and ReVanced; the NOTICE file is preserved as required. This project uses its own identity and is not associated with the Morphe project name.