Related
Hi,
I am developing a module for which I have hooked android.app.DownloadManager.enqueue callback. The code is like this -
Code:
Unhook hook = findAndHookMethod(android.app.DownloadManager.class,
"enqueue",
"android.app.DownloadManager.Request",
new XC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
log("After enqueue.");
}
});
This code is invoked from initZygote. It was working perfectly fine in Jellybean 4.1.2 on my older Xperia J. However, the callback is not invoked in Xperia Z running Kitkat 4.4.2 ROM. The callback does get attached successfully since the "hook" value is not null. I have tried moving the invoke into handlePackageLoad when the "android" package is loaded, but still no luck.
Any suggestions?
Anyone?
Have you made sure that the enque() method is actually called? You can easily test this with the Xposed Installer, just download any module. It also uses this method. Make sure you place the hook in initZygote(), otherwise it won't be active in the installer process.
rovo89 said:
Have you made sure that the enque() method is actually called? You can easily test this with the Xposed Installer, just download any module. It also uses this method. Make sure you place the hook in initZygote(), otherwise it won't be active in the installer process.
Click to expand...
Click to collapse
Hi @rovo89, yes I did put this call in initZygote. I took the clue from XposedBridge code which hooks up android.app package methods in there. Also, I found this issue when I installed my app on Xperia Z Kitkat ROM and found it not working when the various ways to invoke enqueue did not call the hooks. I typically use Chrome/AOSP browsers to download an image to SD card to test this. In Jellybean (on my earlier Xperia J), the hooks get invoked as expected. Its just that in Kitkat, even though the "hookMethod" returns a Unhook reference, the hooks are never called.
Interestingly, this is only affecting the DownloadManager class method hooks. I have also hooked methods in downloadprovider class and it gets called alright. This is really a very confusing situation .
Is it possible for you to give this a try please? The code snippet I pasted should be good enough, otherwise I can rig up a sample. Thanks!
You're hooking the wrong method, then. Look for the method that actually gets called for DownloadManager (check its source, make a test app, possibly use Xposed Method Finder, etc).
GermainZ said:
You're hooking the wrong method, then. Look for the method that actually gets called for DownloadManager (check its source, make a test app, possibly use Xposed Method Finder, etc).
Click to expand...
Click to collapse
Thanks for pointing me to the tool. Although based on the source code from KK/JB trunks, I am pretty confident that any app using DM must use enqueue, its still worth to be sure. I will upload a sample app here to help understand and debug this issue.
ie5x said:
Thanks for pointing me to the tool. Although based on the source code from KK/JB trunks, I am pretty confident that any app using DM must use enqueue, its still worth to be sure. I will upload a sample app here to help understand and debug this issue.
Click to expand...
Click to collapse
Turned out both Chrome and AOSP browser on Kitkat weren't using DownloadManager enqueue :silly:. They natively handle downloads and only use DM for reporting downloaded files in its queue. This was unexpected because these apps used DM in Jellybean. A custom test app calling enqueue successfully invoked the callbacks. Thanks for your help!
This thread can be closed.
ie5x said:
Turned out both Chrome and AOSP browser on Kitkat weren't using DownloadManager enqueue :silly:. They natively handle downloads and only use DM for reporting downloaded files in its queue. This was unexpected because these apps used DM in Jellybean. A custom test app calling enqueue successfully invoked the callbacks. Thanks for your help!
This thread can be closed.
Click to expand...
Click to collapse
That's why I suggested trying it with Xposed Installer, because I know for sure that it uses DM.enqueue(). Just tried it and it worked fine.
rovo89 said:
That's why I suggested trying it with Xposed Installer, because I know for sure that it uses DM.enqueue(). Just tried it and it worked fine.
Click to expand...
Click to collapse
I was being too sure for my own good. Went through a lot of code for Chrome and AOSP browsers and up to Jelly Bean my hooks were working damn fine. Couldn't doubt that the behavior would be different for Kitkat. Well, lessons learned the hard way are the hardest to forget .
Thanks again @rovo89 for helping me out.
After upgrade to Lollipop sdk, I found the project can not build, will cause the aapt.exe stop working.(ADT-boundle , win7-64bit)
after a long day debuging, I found the problem is the Assert/xposed_init file, delete this file and everything is ok.
I don't known why ? Anyone have same problems?
I want to try 5.0 SDK too but now as I know this.. I will wait. I hope rovo89 has fix for library.
Deleting any file or anything other won't make it work. Android 5.0 Lollipop is running ART as its official runtime and does therefore not work with xposed.
But at least bring material theme to app for older devices for now.
pyler said:
But at least bring material theme to app for older devices for now.
Click to expand...
Click to collapse
It already exists, right here on xda: http://bit.ly/1vO3hnU
TheHawk002 said:
It already exists, right here on xda: http://bit.ly/1vO3hnU
Click to expand...
Click to collapse
I ment bring material theme to our xposed module apps
pyler said:
I ment bring material theme to our xposed module apps
Click to expand...
Click to collapse
Oh okey, sorry, that does exist too though Google launched a way to update old app to material design, running 4.x>=, perhaps I'm right this time
https://chris.banes.me/2014/10/17/appcompat-v21/
goodevh said:
After upgrade to Lollipop sdk, I found the project can not build, will cause the aapt.exe stop working.(ADT-boundle , win7-64bit)
after a long day debuging, I found the problem is the Assert/xposed_init file, delete this file and everything is ok.
I don't known why ? Anyone have same problems?
Click to expand...
Click to collapse
I had this issue too after updating the SDK to 21. For most (except 1!?!) project i could "fix" it by deleting bin and gen folders.
In my experience, Google updates contain everytime errors preventing compiling...
The early bird catches the bug
FYI, I had similar issues. It's not related to Xposed, it's a bug in aapt on Windows: https://code.google.com/p/android/issues/detail?id=77629
They say it's fixed with version 21.0.2 of the build tools. I restarted Eclipse and removed my "bin" and "gen" folders, then it worked indeed.
Great, the last project could now also be built [emoji7]
Hi,
I have an apk which has debuggable flag set as 'False'. Without modifying the apk is it possible to make the application debuggable using xposed framework.
Since all the application calls from Zygote process, is it possible to add 'enable-debugger' flag when we call that particular application?
Use Xinstaller module.
In Xinstaller, go to Misc. Tick 'Debugging apps'.
Wow, somebody found and uses this feature I thought nobody used it.
Thumbs up!
It's a life saver!
Damo2k said:
It's a life saver!
Click to expand...
Click to collapse
Wow thats cool, let me try it out. I am using Xposed installer 2.6.1 and cannot find the misc option. Do we have this feature in the new version?
becandid5 said:
Wow thats cool, let me try it out. I am using Xposed installer 2.6.1 and cannot find the misc option. Do we have this feature in the new version?
Click to expand...
Click to collapse
My mistake, I found the module you were talking about -
com.pyler.xinstaller
UPDATE: Not even 24 hours and it fails SafetyNet now. I'm currently working on another solution.
Hi all. Long time lurker, first time developer. I created a modified version of the Xposed Framework that doesn't cause you to fail SafetyNet, even while it's enabled and active. Instructions:
Remove any existing Xposed versions
Get your phone in a state where it passes SafetyNet without Xposed (install a custom kernel to hide an unlocked bootloader, hide root with RootSwitch, etc.)
Install the Xposed Installer app if you don't already have it
Go to https://github.com/josephcsible/Xposed/releases/tag/v86a and download xposed-v86a-safetynet-josephcsible-sdk23-arm.zip
Flash xposed-v86a-safetynet-josephcsible-sdk23-arm.zip from recovery
Wipe cache and dalvik
Reboot
You should now have Xposed installed and enabled, with all of your modules working, without failing SafetyNet. Notes:
Do not turn off Xposed with RootSwitch with this build. It will probably break things because of differences in how app_process sits, and the entire point of this build is that you don't need to do this.
The only build I made was for ARM and Marshmallow, because that's all I have to test on
The official uninstaller won't work right with this version, so use my version of the uninstaller instead
This passes SafetyNet as of November 2nd. It probably won't for very long.
Technical details:
I made this build by compiling my own app_process, then editing it into the stock installer zip. I didn't recompile anything else or use the tools to make the zip.
app_process32 is now a regular file instead of a symlink to app_process32_xposed.
XposedBridge.jar is now called YqptfeBridge.jar (since SafetyNet checks the classpath for a file called XposedBridge.jar)
I obfuscated many of the strings in the app_process binary with a simple Caesar cipher. The source for this is in the GitHub with the download link.
Enjoy it while it lasts!
Great work, thanks! Though I think the method is kind of dirty.
Yeah, but I'm not overly concerned since I expect at best a few weeks before it gets patched and I have to redo it all anyway.
aviraxp said:
Great work, thanks! Though I think the method is kind of dirty.
Click to expand...
Click to collapse
You mean that it's not good to install it ?
MrMikeTyson said:
You mean that it's not good to install it ?
Click to expand...
Click to collapse
He means in terms of code quality and maintainability from developers' standpoints. It's perfectly fine from the users' ends.
josephcsible said:
He means in terms of code quality and maintainability from developers' standpoints. It's perfectly fine from the users' ends.
Click to expand...
Click to collapse
Ah ! Okay !! What about safetynet not passing ? See screenshots... What can i do please ?
MrMikeTyson said:
Ah ! Okay !! What about safetynet not passing ? See screenshots... What can i do please ?
Click to expand...
Click to collapse
It no longer passes for me either. I can't believe Google fixed it so fast. I'm working on another release now.
josephcsible said:
It no longer passes for me either. I can't believe Google fixed it so fast. I'm working on another release now.
Click to expand...
Click to collapse
Okay, i'll wait it and good luck for your work
Status update: My app_process is still not detected at all. It's now detecting something that's happening in Java (XposedBridge).
josephcsible said:
Status update: My app_process is still not detected at all. It's now detecting something that's happening in Java (XposedBridge).
Click to expand...
Click to collapse
So it means you cannot just rename the method/class, if I am right?
aviraxp said:
So it means you cannot just rename the method/class, if I am right?
Click to expand...
Click to collapse
I tried stubbing out the main method in XposedBridge to just call the real main method, and that made it pass. That leads me to conclude that it's a behavior thing and not a name thing.
So this version of xposed is passing?
Barfelonous said:
So this version of xposed is passing?
Click to expand...
Click to collapse
REREAD THE OP Please
josephcsible said:
UPDATE: Not even 24 hours and it fails SafetyNet now. I'm currently working on another solution.
Click to expand...
Click to collapse
: (
Any news on this?
meiser said:
Any news on this?
Click to expand...
Click to collapse
I haven't had time to work on it since my last update. I expect to have more time in June.
Hi is there an other way to use Xposed modules while passing safatynet check ? Its usefull on POGO !
Regards, Devilo !
As we all know, Xposed needs modify system image because we need to replace the app_process and ART runtime.
In some case, This is a bit troublesome. So i wrote an App named VirtualXposed to use xposed without modify system, you can install it like a normal APP, no need root or system privilege.
VirtualXposed is like a virtual environment, in this virtual world, all app are running with the same UID, so all app running in it are under control. then we can load xposed module for any process within it. The only thing we need to do is to Implement a Java Method hook module to support Xposed runtime.
To be honest, VirtualXposed is forked from VirtualApp, just likes docker on Android platform. And the Java method hook module——epic, is a dynamic java aop method hook framework, just like dexposed.
You can refer the code on github: https://github.com/android-hacker/VirtualXposed
It's my first time here. All the things I need to learn from you
I'm not entirely sure why no one has replied to this yet. This is pretty huge, ainnit? This would allow Xposed to pass SafetyNet.
rnadomuc said:
I'm not entirely sure why no one has replied to this yet. This is pretty huge, ainnit? This would allow Xposed to pass SafetyNet.
Click to expand...
Click to collapse
Not just that but it can also run on unrooted phones which is even more of a break through.
Virustotal picks up malware
https://www.virustotal.com/fr/file/...8f04f8531ac8d2ea9e601e2e/analysis/1520829060/
I was about to try it but I'm reconsidering after seen the previous post...
I am sure that VirtualXposed is harmless, it is open source, the source code won't deceive you, you can refer the source code at: https://github.com/android-hacker/VirtualXposed (I am sorry that i can not post outside links now, xda's rule says that i must post 10 posts)
I don't know why it was misjudged as a virus, may be it is too powerful ? or it can inject code to other process without root?
Anyway, I am investiging this problem.
i hope it can bypass all those detection by other program like games. let's see what it will it become when it matures. tnx
This is very intriguing. I pinged GermainZ to see what he thinks.
ssvdude said:
Virustotal picks up malware
https://www.virustotal.com/fr/file/...8f04f8531ac8d2ea9e601e2e/analysis/1520829060/
Click to expand...
Click to collapse
Have you checked every file on xda and what are the results?
It does require a ton of permissions tho, so smart to be cautious.
---
plisskenn said:
Have you checked every file on xda and what are the results?
It does require a ton of permissions tho, so smart to be cautious.
Click to expand...
Click to collapse
it would need those permissions for the cloned apps to work properly
plisskenn said:
Have you checked every file on xda and what are the results?
It does require a ton of permissions tho, so smart to be cautious.
Click to expand...
Click to collapse
I don't quite understand you're trying to imply. Of course I haven't. I'm sure there are false positive for other applications on xda. That doesn't mean this is one. This an unknown developer (no offense), with sparse any info in the first post, not alot of testimonials Further more this almost seems to good to be true, hence why I'm wary. That said if this works great, that's fantastic and I'm impressed. I'm glad it's open source too. No need to get snarky about it.
weishu said:
As we all know, Xposed needs modify system image because we need to replace the app_process and ART runtime.
In some case, This is a bit troublesome. So i wrote an App named VirtualXposed to use xposed without modify system, you can install it like a normal APP, no need root or system privilege.
VirtualXposed is like a virtual environment, in this virtual world, all app are running with the same UID, so all app running in it are under control. then we can load xposed module for any process within it. The only thing we need to do is to Implement a Java Method hook module to support Xposed runtime.
To be honest, VirtualXposed is forked from VirtualApp, just likes docker on Android platform. And the Java method hook module——epic, is a dynamic java aop method hook framework, just like dexposed.
You can refer the code on github: https://github.com/android-hacker/VirtualXposed
It's my first time here. All the things I need to learn from you
Click to expand...
Click to collapse
Hi all,
Is anyone testing VirtualXposed with the Xposed module XPrivacyLua ?
Thanks in advance for your answers.
iwanttoknow said:
Hi all,
Is anyone testing VirtualXposed with the Xposed module XPrivacyLua ?
Thanks in advance for your answers.
Click to expand...
Click to collapse
Apparently not there was an issue raised on the Github about it (under issues section)
link below
https://github.com/android-hacker/VirtualXposed
( sorry can not post direct links at the moment)
This could be a breakthrough and stumbling onto it today, being able to hide the system modifications for other apps to work such as banking or snapchat.. anyway as far as this hook having a virus such as McAffe , ive read :
"inherit from VirtualApp asLody/VirtualApp string #460, the code has some hardcode string such as "base-1.apk", "base.odex"; i simply use base64 to encode these thrings and it was resolved."
Guys, XPL will not work on VirtualXposed because it stores auf with the settings app which can not be accessed by VX. The only way around this would be a fork of XPL that changes this behavior specifically for VX. But nobody is doing that as of now.
as I see in Github where it is downloaded virtualxpose has little module support
Sent from my ZTE K88 using XDA Labs
---------- Post added at 10:54 PM ---------- Previous post was at 10:51 PM ----------
We hope that over time they will add more modules
Sent from my ZTE K88 using XDA Labs
Have you tested it on Oreo? Apps won't open on my s9+
gpgorbosjr said:
Have you tested it on Oreo? Apps won't open on my s9+
Click to expand...
Click to collapse
Yeah, I have s8+ and I'm only getting "Opening (App name).." message endlessly.
vAlcatraz said:
Yeah, I have s8+ and I'm only getting "Opening (App name).." message endlessly.
Click to expand...
Click to collapse
On Oreo right? I was looking at the Virtual App GitHub and I think something has to be changed in the way it works for Oreo support but I don't know how to inpliment it I hope the dev does.
Android 8.0 fix
Edit: that may not be a fix for our issue lol. I'm not a dev so I'm just guessing but I really think it's an Oreo caused issue.