Database Develop

Avira Antivirus incompatible with xposed

Hey
I used xposed for long time now and Avira also and I never had any problems with but unfortunately yesterday I installed xposed on the new PA build and now Avira gets FC and it shows me a notification where it says that there is an error. I will attach the full logcat and also the one which is filtered to only show avira specific errors.
Thanks in advance.
Filtered:
https://mega.co.nz/#!GI5FVT6Q!JOSb1KlE9SneYr2aZKpH4MLN6iQJgYbrJ4MY1AwXeO8
Not filtered:
https://mega.co.nz/#!WQ5CVIra!OEK6CzStC_CMmKtvLY-_6gLI5FBTZxZPzEKoJ4XC-jY

taaeem said:
Hey
I used xposed for long time now and Avira also and I never had any problems with but unfortunately yesterday I installed xposed on the new PA build and now Avira gets FC and it shows me a notification where it says that there is an error. I will attach the full logcat and also the one which is filtered to only show avira specific errors.
Thanks in advance.
Filtered:
https://mega.co.nz/#!GI5FVT6Q!JOSb1KlE9SneYr2aZKpH4MLN6iQJgYbrJ4MY1AwXeO8
Not filtered:
https://mega.co.nz/#!WQ5CVIra!OEK6CzStC_CMmKtvLY-_6gLI5FBTZxZPzEKoJ4XC-jY
Click to expand...
Click to collapse
It seems that we have the same problem.
http://forum.xda-developers.com/xposed/wifi-protector-app-doesnt-4-4-xposed-t2809833

Esperos said:
It seems that we have the same problem.
http://forum.xda-developers.com/xposed/wifi-protector-app-doesnt-4-4-xposed-t2809833
Click to expand...
Click to collapse
Seems to be the same issue. It worked for the last couple months without problems but now it keeps crashing.

taaeem said:
Seems to be the same issue. It worked for the last couple months without problems but now it keeps crashing.
Click to expand...
Click to collapse
So its something in cm maybe, like the bug with the settings app and themes, where the settings restored to the stock look if xposed was installed. Lets find a rom with build date before Jully then, until it gets fixed..

Esperos said:
So its something in cm maybe, like the bug with the settings app and themes, where the settings restored to the stock look if xposed was installed. Lets find a rom with build date before Jully then, until it gets fixed..
Click to expand...
Click to collapse
Yep good idea by the way I am not using CM I use PA, which was released a week ago I think.

taaeem said:
Yep good idea by the way I am not using CM I use PA, which was released a week ago I think.
Click to expand...
Click to collapse
I dont know if you notice it but both apps have the same crash reporting framework, ACRA, can you check in your logcat if there is any other app that use it? Maybe there is the problem, and if yes, we have good chances to fix it...

Esperos said:
I dont know if you notice it but both apps have the same crash reporting framework, ACRA, can you check in your logcat if there is any other app that use it? Maybe there is the problem, and if yes, we have good chances to fix it...
Click to expand...
Click to collapse
For now I didn't found anything but there is an issue open at the github from ACRA https://github.com/ACRA/acra/issues/161 maybe someone answer it and we can fix it.

taaeem said:
For now I didn't found anything but there is an issue open at the github from ACRA https://github.com/ACRA/acra/issues/161 maybe someone answer it and we can fix it.
Click to expand...
Click to collapse
I can confirm that this cause the bug, after disable "advenced crash report" on the setting of wifi protector, everything is ok.. Its funny, a crash reporting tool, cause crashes...

Esperos said:
I can confirm that this cause the bug, after disable "advenced crash report" on the setting of wifi protector, everything is ok.. Its funny, a crash reporting tool, cause crashes...
Click to expand...
Click to collapse
That's funny sadly I can't disable ACRA in Avira so for now I need to disable xposed or use another Antivirus software. Maybe @rovo89 could look into the error and hopefully he is able to fix that.

taaeem said:
That's funny sadly I can't disable ACRA in Avira so for now I need to disable xposed or use another Antivirus software. Maybe @rovo89 could look into the error and hopefully he is able to fix that.
Click to expand...
Click to collapse
Can you upload the folder of avira under /data/data? Maybe there is an .xml with settings and has an option also for ACRA..

Esperos said:
Can you upload the folder of avira under /data/data? Maybe there is an .xml with settings and has an option also for ACRA..
Click to expand...
Click to collapse
I looked into it myself but no xml with ACRA related stuff. The only thing I found is a folder named files and there all ACRA stuff is stored there. But unfortunately there are a few logs that doesn't help and a file called ACRA-INSTALLATION but there is only an ID I think. So nothing helpful it seems that I have to change my Antivirus until this is fixed.

It's indeed ironic...ACRA crashes during initialization, then crashes again while trying to report its own crash.
I have decompiled Wifi Protector and found out that it's using a very old version of ACRA. Have a look at this issue: https://code.google.com/p/acra/issues/detail?id=138
It was fixed in October 2012 and prevented crashes that could occur if one of the fields in the Configuration is null.
If this has started to happen recently (on or after Jun 30), it's likely the same root cause described here: http://forum.xda-developers.com/xposed/cm11-themes-issue-caused-xposed-t2803025
(but again, the main bug is in the old version of ACRA)

[Question] Xposed module to fix security holes like stagefright possible ?

Maybe this is a stupid question, but I'm not a developer...
Would it be possible to write a Xposed module to fix security holes in Android system like the stagefright bug?
Since many phones will never get an (official) update that fixes security holes, this would probably be very interesting for many users.
Would that be possible? Would it make sense?

It would make sense and it is possible. I'm also waiting for that.
There should be a general module for these patches. Such a module makes more sense than any classic AV.
BTW: It seems to be already patched by Cyanogenmod:
https://plus.google.com/+CyanogenMod/posts/7iuX21Tz7n8

Xposed can't modify native/C++ code so nobody can fix it via Xposed.

I see. But it should be possible to overwrite the .so libs with root privileges. Or is there more that has to be replaced? Are these libs device dependent (Samsung, HTC, etc.) or just android version and processor (32/64 bit) dependent?

JensL76 said:
I see. But it should be possible to overwrite the .so libs with root privileges. Or is there more that has to be replaced? Are these libs device dependent (Samsung, HTC, etc.) or just android version and processor (32/64 bit) dependent?
Click to expand...
Click to collapse
Simple cut, paste, reboot if you have the patched files. Not sure what an Xposed module would be expected to do.

You need to have patched lib for your processor architecture

Patched stagefright libs (G920F)
pyler said:
You need to have patched lib for your processor architecture
Click to expand...
Click to collapse
Hmmm, I have extracted /system/lib64/libstagefright* libSEF4MP4.so /system/lib/libstagefright* libSEF4MP4.so from SGS6 (G920FXXU2B0G8) OTA update (build date Jul21, based on Android 5.1.1).
Does anyone know
(1) whether those contain the fixes
(2) whether those can be installed on 5.0.2 (G920FXXU1AOE3) without causing a bootloop

KGarloff said:
(build date Jul21, based on Android 5.1.1)
Click to expand...
Click to collapse
1. This topic doesn't belong here so the thread should be dropped.
2. The vulnerability was first publicly revealed on Jul. 27.

Wakamatsu said:
1. This topic doesn't belong here so the thread should be dropped.
Click to expand...
Click to collapse
Who are you to decide what belongs or not? Quite a few messaging apps isolated the exploit already. While we can't expect xposed modules to fix the problem. It is quite possible to make it safer via sandboxing etc.
Wakamatsu said:
2. The vulnerability was first publicly revealed on Jul. 27.
Click to expand...
Click to collapse
Which means Google, and most certainly Samsung have been notified weeks if not months prior to the public revelation. So your reaponse means absolutely nothing.

levizx said:
Who are you to decide what belongs or not? Quite a few messaging apps isolated the exploit already. While we can't expect xposed modules to fix the problem. It is quite possible to make it safer via sandboxing etc.
Click to expand...
Click to collapse
Which is why it doesn't belong in the Xposed subforum. Any solution posted here is missing the people that can be helped.
KGarloff said:
Hmmm, I have extracted /system/lib64/libstagefright* libSEF4MP4.so /system/lib/libstagefright* libSEF4MP4.so from SGS6 (G920FXXU2B0G8) OTA update (build date Jul21, based on Android 5.1.1).
Does anyone know
(1) whether those contain the fixes
(2) whether those can be installed on 5.0.2 (G920FXXU1AOE3) without causing a bootloop
Click to expand...
Click to collapse
Look for a patch labelled G920PVPU2BOGA.

pyler said:
Xposed can't modify native/C++ code so nobody can fix it via Xposed.
Click to expand...
Click to collapse
Thanks for the quick reply.
I thought Xposed could hook into system calls. Wouldn't it be possible to hook into the vulnerable functions and monitor for malicious content beeing sent? And if found, modify it?
(Or do I have a wrong understanding of the inner workings of Xposed? )

Wakamatsu said:
Which is why it doesn't belong in the Xposed subforum. Any solution posted here is missing the people that can be helped.
.
Click to expand...
Click to collapse
I failed to see why. Xposed modules CAN function to block system calls. While it cannot fix stagefright itself, it CAN stop the exploit from reaching stagefright in the first place therefore "fix the security holes".
So again. WHY ON EARTH would you say it doesn't belong here?
random_n00b said:
Thanks for the quick reply.
I thought Xposed could hook into system calls. Wouldn't it be possible to hook into the vulnerable functions and monitor for malicious content beeing sent? And if found, modify it?
(Or do I have a wrong understanding of the inner workings of Xposed? )
Click to expand...
Click to collapse
It is possible to block the video from MMS altogether. I'm not sure it can modify it.

levizx said:
So again. WHY ON EARTH would you say it doesn't belong here?
Click to expand...
Click to collapse
The guy I quoted is asking about extracting libs from an Samsung S6 factory update and transplanting it to his existing ROM. So I ask you, what does that have to do with Xposed? And how does it serve users to have to look so far afield for a possible solution specific to one device?

random_n00b said:
Thanks for the quick reply.
I thought Xposed could hook into system calls. Wouldn't it be possible to hook into the vulnerable functions and monitor for malicious content beeing sent? And if found, modify it?
(Or do I have a wrong understanding of the inner workings of Xposed? )
Click to expand...
Click to collapse
Eh, I would just try manually building the ROM to patch it.

I want to learn how to patch stagefright in android rom .pls can anayone give me a tutorial pls.
Ive search google but no luck

Xposed 2.6.1 armeabi-v7a compatibility issues (libdvm doesn't exist)

I recently bought a Prestigio Muze D3 phone and, to my big surprise, Xposed doesn't seem to work with it. When trying to install error is shown:
Xposed is not (yet) compatible with Android SDK version 21 or your processor architecture (armeabi-v7a). Cannot link executable: could not load library "libdvm.so" needed by "/data/data/de.robv.android.xposed.installer/cache/app_process";
caused by library "libdvm.so" not found
Android 5.0.1
After this message I've decided to go on a hunt to find libdvm (which is, to my knowledge, located in /System/lib). After going through folder again and again in Rar, it seems that libdvm is missing. So, does this mean I'm completely screwed and there will be no Xposed for me, or there's fix for this issue?
P. S. It's not critical, but I'd love to know what the hell libdvm is for. Just for educational purposes.

First things first... why are you using a KK version of Xposed on a LP rom?

Wakamatsu said:
First things first... why are you using a KK version of Xposed on a LP rom?
Click to expand...
Click to collapse
On Xposed repo it said 4.0.3 and higher so I thought... I guess I am stupid. Especially now, when I've found this account I completely forgot about -_-
So, knowing that I have ARM v7-a and android 5.0.1, this means I grab arm SDK 21 version, right?
P. S. I'm really sorry for all this trouble, it's just that Xposed was extremely easy to install on my tablet and now, all of a sudden I'm in this ocean of FAQs and articles, different versions for each CPU etc.
And now I feel like a complete moron, because FAQ actually addresses this issue.

I've got the same problem
Samsung GT-P3100
Cyanogenmod 11 nightly (4.4.4.)
sdk 19

crismar2 said:
I've got the same problem
Samsung GT-P3100
Cyanogenmod 11 nightly (4.4.4.)
sdk 19
Click to expand...
Click to collapse
No, you have a completely different problem. http://forum.xda-developers.com/showthread.php?t=3249895
Look harder next time; try using the search function.

Android N (SDK 24) Support

Has anyone attempted to flash the SDK 23 version of xposed on top of the Android N Preview?

Firerouge said:
Has anyone attempted to flash the SDK 23 version of xposed on top of the Android N Preview?
Click to expand...
Click to collapse
If you are brave enough: backup your current device and give it a try.
EDIT: in my opinion it is rather meaningless to ask for Android N support yet, as there are at least seven month until a "final" release will hit the market. If the current Xposed version doesn't work, there will be no need to create some workarounds, as the current version is more or less a preview of a preview and there are lots of code-base changes to be expected. I guess it will take some more month until a valid support will be established.

I'm brave enough. Also foolish, because the only superuser I have been able to achieve won't let me r/w to system, so I can't install modules. And even if I could, odds are that all but the simplest modules would fail.
Regardless, it didn't boot.

jfpbookworm said:
I'm brave enough. Also foolish, because the only superuser I have been able to achieve won't let me r/w to system, so I can't install modules. And even if I could, odds are that all but the simplest modules would fail.
Regardless, it didn't boot.
Click to expand...
Click to collapse
The new android has many Gravitybox stuff, so I can live without Xposed I think...

so?

Tried last night.
The XPosed SDK23 checks for proper API Level upon installation - and refuses to install if you're different.
TL;DR: If you're not on MM, the MM installer won't work.

I modified the zip script
and removed the api check. The resulting system dies at dex (compiling apps, including systemui). However there are websites claiming the Universal Systemless Xposed Installer will work on Nougat if you first flash Magisk and use the Material Design Xposed Installer (not to be confused with Materialized module) and phh's Superuser apps in place of Official Xposed Installer and SuperSU! I am about to give it a try on a Nexus 6!

FoxysWorkplace said:
and removed the api check. The resulting system dies at dex (compiling apps, including systemui). However there are websites claiming the Universal Systemless Xposed Installer will work on Nougat if you first flash Magisk and use the Material Design Xposed Installer (not to be confused with Materialized module) and phh's Superuser apps in place of Official Xposed Installer and SuperSU! I am about to give it a try on a Nexus 6!
Click to expand...
Click to collapse
Any luck?

Guys... That would never work. If it did, what's the point of SDK versions?
Just like when Marshmallow was released, SDK22 would NOT work whatsoever on 6.0. same if you go back another version using the previous version of Xposed.
Don't try to install it, as it just bricks. That's why the API checker is there.
Sent from my Nexus 6P using Tapatalk

It was worth a shot
tarroyo said:
Any luck?
Click to expand...
Click to collapse
Sadly those websites are bogus clickbait to generate ad views. (Apparently) I can confirm that flashing Magisk on Android N causes the bootstrap to fail without even flashing Xposed yet. I even tried playing with the install flags. Sorry everyone I'll continue to investigate other solutions.
To those who said it is stupid and pointless to try what I did: Tinkering and breaking the rules of common sense are how many advancements have been discovered. Your posts are negative and unconstructive, nearly a violation of XDA rules. Please try not to be so abusive for the sake of the community.

Curiousn00b said:
Guys... That would never work. If it did, what's the point of SDK versions?
Just like when Marshmallow was released, SDK22 would NOT work whatsoever on 6.0. same if you go back another version using the previous version of Xposed.
Don't try to install it, as it just bricks. That's why the API checker is there.
Sent from my Nexus 6P using Tapatalk
Click to expand...
Click to collapse
Without bricks, we wouldn't have houses...

Just flashed Nougat on my N7 and now I miss Xposed.

CappyT said:
Without bricks, we wouldn't have houses...
Click to expand...
Click to collapse
False. You have houses made of other things. ;D
FoxysWorkplace said:
Sadly those websites are bogus clickbait to generate ad views. (Apparently) I can confirm that flashing Magisk on Android N causes the bootstrap to fail without even flashing Xposed yet. I even tried playing with the install flags. Sorry everyone I'll continue to investigate other solutions.
To those who said it is stupid and pointless to try what I did: Tinkering and breaking the rules of common sense are how many advancements have been discovered. Your posts are negative and unconstructive, nearly a violation of XDA rules. Please try not to be so abusive for the sake of the community.
Click to expand...
Click to collapse
But honestly, you're just bricking your device by flashing the wrong SDK version. If you want to begin porting it instead of messing with the install script to the Xposed for the wrong version of Android, maybe contact RomRacer. He ported Xposed to 5.0/5.1 before Rovo released an official version, so he can help you out maybe, but you need permission from Rovo to release a working version.
Good luck.
Sent from my Nexus 6P using Tapatalk

@rovo89
Will there be any chance that Xposed supports Android Nougat?

wuerg said:
@rovo89
Will there be any chance that Xposed supports Android Nougat?
Click to expand...
Click to collapse
Unfortunately, Android Nougat will be the only Android version that will not support Xposed. This is due to the fact that Nougat is a delicious, but creamy thing, that glues together all command lines when melted.
*sarcasm turned off
There will be support for Android Nougat, be patient like everyone else. If any news arise, rovo89 will make an official statement.

wuerg said:
@rovo89
Will there be any chance that Xposed supports Android Nougat?
Click to expand...
Click to collapse
We are a good 6-8 months away from an Official stable release, N is still in the early beta stages. He will work on getting it working when he feels that Google is done changing code around.
Sent from my SCH-R220

mattzeller said:
N is still in the early beta stages.
Click to expand...
Click to collapse
I thought final N version was released a few days ago?!

Taobaibai said:
I thought final N version was released a few days ago?!
Click to expand...
Click to collapse
Only if you have Nexus 6P, Nexus 5X,*Nexus 6, Nexus 9, and Google Pixel C. So he'll be able to start working to see if he can even make it work. He he stated he was waiting for it to be finished before he starts. It took several months for him to get it working with Lollipop.
The 6-9 months was my estimates on the non Nexus devices
Sent from my SCH-R220

Taobaibai said:
I thought final N version was released a few days ago?!
Click to expand...
Click to collapse
Final? Is O next? Haha

Bad news for my Nexus 9. So I have to downgrade to Marshmallow. Android w/o Xposed is not impossible for me.

[UNOFFICIAL][2016-Nov-02]Xposed build that passes SafetyNet while enabled and active

UPDATE: Not even 24 hours and it fails SafetyNet now. I'm currently working on another solution.
Hi all. Long time lurker, first time developer. I created a modified version of the Xposed Framework that doesn't cause you to fail SafetyNet, even while it's enabled and active. Instructions:
Remove any existing Xposed versions
Get your phone in a state where it passes SafetyNet without Xposed (install a custom kernel to hide an unlocked bootloader, hide root with RootSwitch, etc.)
Install the Xposed Installer app if you don't already have it
Go to https://github.com/josephcsible/Xposed/releases/tag/v86a and download xposed-v86a-safetynet-josephcsible-sdk23-arm.zip
Flash xposed-v86a-safetynet-josephcsible-sdk23-arm.zip from recovery
Wipe cache and dalvik
Reboot
You should now have Xposed installed and enabled, with all of your modules working, without failing SafetyNet. Notes:
Do not turn off Xposed with RootSwitch with this build. It will probably break things because of differences in how app_process sits, and the entire point of this build is that you don't need to do this.
The only build I made was for ARM and Marshmallow, because that's all I have to test on
The official uninstaller won't work right with this version, so use my version of the uninstaller instead
This passes SafetyNet as of November 2nd. It probably won't for very long.
Technical details:
I made this build by compiling my own app_process, then editing it into the stock installer zip. I didn't recompile anything else or use the tools to make the zip.
app_process32 is now a regular file instead of a symlink to app_process32_xposed.
XposedBridge.jar is now called YqptfeBridge.jar (since SafetyNet checks the classpath for a file called XposedBridge.jar)
I obfuscated many of the strings in the app_process binary with a simple Caesar cipher. The source for this is in the GitHub with the download link.
Enjoy it while it lasts!

Great work, thanks! Though I think the method is kind of dirty.

Yeah, but I'm not overly concerned since I expect at best a few weeks before it gets patched and I have to redo it all anyway.

aviraxp said:
Great work, thanks! Though I think the method is kind of dirty.
Click to expand...
Click to collapse
You mean that it's not good to install it ?

MrMikeTyson said:
You mean that it's not good to install it ?
Click to expand...
Click to collapse
He means in terms of code quality and maintainability from developers' standpoints. It's perfectly fine from the users' ends.

josephcsible said:
He means in terms of code quality and maintainability from developers' standpoints. It's perfectly fine from the users' ends.
Click to expand...
Click to collapse
Ah ! Okay !! What about safetynet not passing ? See screenshots... What can i do please ?

MrMikeTyson said:
Ah ! Okay !! What about safetynet not passing ? See screenshots... What can i do please ?
Click to expand...
Click to collapse
It no longer passes for me either. I can't believe Google fixed it so fast. I'm working on another release now.

josephcsible said:
It no longer passes for me either. I can't believe Google fixed it so fast. I'm working on another release now.
Click to expand...
Click to collapse
Okay, i'll wait it and good luck for your work

Status update: My app_process is still not detected at all. It's now detecting something that's happening in Java (XposedBridge).

josephcsible said:
Status update: My app_process is still not detected at all. It's now detecting something that's happening in Java (XposedBridge).
Click to expand...
Click to collapse
So it means you cannot just rename the method/class, if I am right?

aviraxp said:
So it means you cannot just rename the method/class, if I am right?
Click to expand...
Click to collapse
I tried stubbing out the main method in XposedBridge to just call the real main method, and that made it pass. That leads me to conclude that it's a behavior thing and not a name thing.

So this version of xposed is passing?

Barfelonous said:
So this version of xposed is passing?
Click to expand...
Click to collapse
REREAD THE OP Please
josephcsible said:
UPDATE: Not even 24 hours and it fails SafetyNet now. I'm currently working on another solution.
Click to expand...
Click to collapse

: (

Any news on this?

meiser said:
Any news on this?
Click to expand...
Click to collapse
I haven't had time to work on it since my last update. I expect to have more time in June.

Hi is there an other way to use Xposed modules while passing safatynet check ? Its usefull on POGO !
Regards, Devilo !