Database Develop

Starting a service with same permissions as hooked package

Simple question. I want to start my own service from my package with the same permissions as the package i am hooking. Does anybody know how i could do this? I know if i use android:sharedUserId="android.uid.systemui" in the manifest, but it prevents it based off of signature mismatch. Could i use xposed to grant my app the sharedUserId?

Simple question. I want to start my own service from my package with the same permissions as the package i am hooking.
Click to expand...
Click to collapse
I don't think that is possible. I haven't worked with services yet, but as far as I understood, you have to declare them in your manifest (in contrast to BroadcastReceivers, which can also be registered at runtime). Theoretically again, you could try to modify the manifest parsing and try to inject additional entries there.
elesbb said:
Could i use xposed to grant my app the sharedUserId?
Click to expand...
Click to collapse
Theoretically, I think yes, you could hook the package manager to ignore the signature mismatch etc. But I think it will be quite fragile.
What do you want to achieve with this?

rovo89 said:
I don't think that is possible. I haven't worked with services yet, but as far as I understood, you have to declare them in your manifest (in contrast to BroadcastReceivers, which can also be registered at runtime). Theoretically again, you could try to modify the manifest parsing and try to inject additional entries there.
Theoretically, I think yes, you could hook the package manager to ignore the signature mismatch etc. But I think it will be quite fragile.
What do you want to achieve with this?
Click to expand...
Click to collapse
I hate how Samsung removed widgets from the lockscreen. So i figured i'll create my own lockscreen and have it loaded by the system. I might just skip the whole service thing (which would make my lockscreen easier to write by having classes that extend things like FrameLayout as the stock lockscreen does) but i found where the lockscreen is actually shown. i may just inflate my own xml of the lockscreen using xposed resources and then adding it with windowmanager. Then the inflated view will follow the same permissions as the stock lockscreen and allow me to handle key presses and still preserve the security behind it.
Thanks rovo for the reply!

@rovo89
If i am inflating my own view inside a hooked method, how can i get the ids of my layout? I tried XModuleResources myRes; myRes.getIdentifier() but it returned null.

Be careful, Resources.getIdentifier() expects the arguments in a different order than Xposed, like getIdentifier("mystring", "string", "my.package.name").
Apart from that, simply use R.layout.my_layout.

Give system service permission to external storage

Hi,
I'm studying how PackageManagerService works, and i noticed that if an application was downloaded to /data/app i can access the file and open inputstream .
but if APK was downloaded to SD card, i can't access the file from PackageManagerService.
is there something i can do?
I want to be able to read the APK before it get installed...
Thanks,

pi.publicSourceDir = apk file path

pyler said:
pi.publicSourceDir = apk file path
Click to expand...
Click to collapse
not sure i follow you.
I'm in the packageManagerService context, i don't have PackageInfo (the application is still not installed)

You could hook PermissionGranter and give the process extra permissions, or see where the system is actually parsing the APK's manifest before installing it.

GermainZ said:
You could hook PermissionGranter and give the process extra permissions, or see where the system is actually parsing the APK's manifest before installing it.
Click to expand...
Click to collapse
Thanks, what I don't understand is, if i give my xposed module permissions to read external storage, why does it still can't read it?

shnapsi said:
Thanks, what I don't understand is, if i give my xposed module permissions to read external storage, why does it still can't read it?
Click to expand...
Click to collapse
They're different processes.
http://forum.xda-developers.com/showpost.php?p=55332926&postcount=9
http://forum.xda-developers.com/showpost.php?p=55186575&postcount=2

GermainZ said:
They're different processes.
http://forum.xda-developers.com/showpost.php?p=55332926&postcount=9
http://forum.xda-developers.com/showpost.php?p=55186575&postcount=2
Click to expand...
Click to collapse
So just to make sure I understand, I can create a service and run it from the hooked method and it should work?
if so, i have another question
How can i stop the original method from running until a point i allow it to continue?
Thanks GermainZ !

shnapsi said:
So just to make sure I understand, I can create a service and run it from the hooked method and it should work?
Click to expand...
Click to collapse
I don't understand how you read that from my reply, to be honest. Here's what I meant:
Hooked code *is not* run as your app. The hooked code is run as the hooked app.
If the hooked app can't do X, then the hooked code can't do X either.
Your app's permissions do not affect the hooked code in any way, only normal (not hooked) code.
shnapsi said:
How can i stop the original method from running until a point i allow it to continue?
Click to expand...
Click to collapse
Using the normal ways you'd normally use if it weren't an Xposed module, in the beforeHookedMethod hook. I'm not familiar with the exact methods, you can look that up. Just be aware that blocking it for too long will cause an ANR.

"Tracer" module

hi all.
Is there a module that can trace everything about a process?
i want to know everything about an app, since the start(such as every method invoked, every file that it tries to open or it tries to run). Is there a xposed module that can do this? Or something else that can log me the whole life of an application run?

me too!

how to modify android.os.Build's static field?

Hi, I'm just use Xposed to dev a simple project.
I'm trying to modify device info by using Xposed. When I hook TelephonyManager.getDeviceId, return the value that just what I set.
But I can't find out how to modify the fields in andoid.os.Build. They are FINAL fields and Xposed can just hook on methods but not fields.
I get a way to set the fields using XposedHelpers.setStaticObjectField. It can ONLY modify ONCE when the target apk has not started. When the target apk( such as device info viewer ) started, I have to reboot or force close the apk because of the handleLoadPackage method can not reinvoke.
Waiting online for any solution. Thanks very much.

joetony said:
Hi, I'm just use Xposed to dev a simple project.
I'm trying to modify device info by using Xposed. When I hook TelephonyManager.getDeviceId, return the value that just what I set.
But I can't find out how to modify the fields in andoid.os.Build. They are FINAL fields and Xposed can just hook on methods but not fields.
I get a way to set the fields using XposedHelpers.setStaticObjectField. It can ONLY modify ONCE when the target apk has not started. When the target apk( such as device info viewer ) started, I have to reboot or force close the apk because of the handleLoadPackage method can not reinvoke.
Waiting online for any solution. Thanks very much.
Click to expand...
Click to collapse
I don't know which final field you are trying to change, but most of them get their values from getString(), getStringList() or getLong() methods.
You need to hook in these methods, read their "property" parameter ( param.args[0] ) to see if it is the one you want to change, and finally change the method result ( param.setResult() ).

Hello. Is there a solution to change the fields like Build.MODEL on the fly? Any examples not worked. Thanks.

Some fields can't be replaced, am I right?

Code is poetry:
https://github.com/M66B/XPrivacy/blob/master/src/biz/bokhorst/xprivacy/XPrivacy.java#L159

Your code is amazing

M66B said:
Code is poetry:
https://github.com/M66B/XPrivacy/blob/master/src/biz/bokhorst/xprivacy/XPrivacy.java#L159
Click to expand...
Click to collapse
It's worked only in own application with this code. In other apps it's not worked. I need to make changes to apply to all applications.
PS: Sorry for my bad English.

ifynk said:
It's worked only in own application with this code. In other apps it's not worked. I need to make changes to apply to all applications.
PS: Sorry for my bad English.
Click to expand...
Click to collapse
You can do this only when the Java VM is being initialized in handle load package.

M66B said:
You can do this only when the Java VM is being initialized in handle load package.
Click to expand...
Click to collapse
Thanks. How i can restart package for new init for handle load?

ifynk said:
Thanks. How i can restart package for new init for handle load?
Click to expand...
Click to collapse
There is no need for restarts, just set a new value in the Xposed handleLoadPackage callback for the applications you want to modify values.
Note that changing Build properties for Android might result in a bootloop.
Edit: if you don't known about handleLoadPackage , you need to do some studying ...

This all can be simplified by XposedHelpers.setStaticObjectField(clazz, name, value)

M66B said:
Edit: if you don't known about handleLoadPackage , you need to do some studying ...
Click to expand...
Click to collapse
Were i can read about handleLoadPackage? Thanks.

how to make exposed changes permanent???

please any one know .how to make xposed changes permanent??
that is it remains there ..... even we uninstall xposed...

AS far as my understanding goes, xposed redirects specific function calls at runtime to other functions with the intend to run different code than the app would normally do. That said, redirecting those calls can not work without xposed framework or without the xposed modules as no changes are made to the apps directly.
Correct me if I'm wrong.

You are absolutely no wrong, however if we decompile the apk that is being modded via some specific module and we change the code of the redirected functions to the one included within module and recompile the apk, we should get an apk working exactly the same as if it was hooked via xposed+module.
Please note that a lot of modules has been originally created basing on reverse idea: first someone made a mod by changing the java/smali code of some apks, then someone wrote a module making same changes but via xposed, on-the-fly.
In my opinion such an automated tool to recompile the apks and change their code basing on the code included in a xposed module IS possible.
No one made it yet, tho...

Definitely not possible. You cannot simply redirect code from one app to another. With xposed, you are always running within app that's being modded.

esgie said:
You are absolutely no wrong, however if we decompile the apk that is being modded via some specific module and we change the code of the redirected functions to the one included within module and recompile the apk, we should get an apk working exactly the same as if it was hooked via xposed+module.
Please note that a lot of modules has been originally created basing on reverse idea: first someone made a mod by changing the java/smali code of some apks, then someone wrote a module making same changes but via xposed, on-the-fly.
In my opinion such an automated tool to recompile the apks and change their code basing on the code included in a xposed module IS possible.
No one made it yet, tho...
Click to expand...
Click to collapse
Im with this guy, and if you read on xposed... yes its code being "injected" into the stock apk ...
What xposed does is creates side files (ran by zygote)
They get copied to /system/bin as app_process(xposed)
Or app_process(origional)
These files act as Init.d scripting... to inject this code...
I assume they make both these copies for reverting back to stock (disable the module)
It IS possible to make these changes permanent and re-compile the apk...
However ... de-coding the module ... to find out what is getting injected where... THATS where im at so far ...
Arter 97 has proven this possible with adaway as a standalone apk in conjuction with his youtube apk... im assuming hes using code to call upon the adaway apk files , and still using it like xposed... but merely without xposed..
If anyone with more experience could point us on how to track down how to find exactly WHAT code is being injected and where... it would be EXTREMELY helpful to many people not wanting to run 3rd party applications to get their desired functions...
Anyone feel free to chime in