Not working on Android 13/Tiramisu (API 33)

[vegedreamgagnoa]

Tried LSPlant to hook android.app.Activity#getSystemService as a sample, the hook result returns true, but the callback has never been called. Why? trying to deoptimize not work. It works on Android 6 ~ 12 though.

[yujincheng08]

Have you tried to invoke android.app.Activity#getSystemService by reflection?

[vegedreamgagnoa]

If I am not mistaken it requires the object/instance of android.app.Activity, isn't it? Which usually we don't have access to that (we only have access to the Activity we defined). It's quite an hassle especially if we don't have access to the owner object.
Looking at the source, I am still not understand how this is different to/surpasses Pine or Whale - where with both frameworks I can easily hook that method.

[yujincheng08]

What I mean is just for testing...

[vegedreamgagnoa]

Oh, sorry - yeah, it works if I tried to invoke the backup using reflection.

[yujincheng08]

Not the backup.

What I mean is:
Hook, invoke the original method by reflection and see if the hook is invoked.

[vegedreamgagnoa]

Nope, not working - only works for Activity that I have defined, as I said.

[yujincheng08]

So reflection (on your own activity) can trigger hook, right?

[vegedreamgagnoa]

Yes! :)

[vegedreamgagnoa]

I am still trying to figure out why it's not working only for Tiramisu...

[yujincheng08]

Ok, then it's the inline problem. Tiramisu has increased its inline threshold so it's not surprising.
See LSPosed/LSPosed@ef1439a, systemMain is also inlined...

As the document has said, you should deoptimize the caller to make it work. Note that it's not deoptimizing the getSystemService but the method which invokes getSystemService.

For example, there's a piece of code like this:

class X {
fun A() {
xxActivity.getSystemService("activity")
}
}

You should deoptmize(X::A) rather than deoptmize(Activity::getSystemService)

[vegedreamgagnoa]

Cool, thanks for the hint. Can you also suggest how to find the caller of the method at runtime?

[yujincheng08]

Cool, thanks for the hint. Can you also suggest how to find the caller of the method at runtime?

It's possible but slow. I recommend you to hard code the callers. But if you are interesting, you can take a look at our experimental API for it at:

https://github.com/LSPosed/DexBuilder/blob/master/include/dex_helper.h

It can search all methods that invoke a specific method.

And a JVM binding is here: https://github.com/yujincheng08/BiliRoaming/blob/master/app/src/main/jni/biliroaming.cc

These APIs are still for experimental usage. We will publish it when it matures.

[vegedreamgagnoa]

This is working: https://github.com/LSPosed/LSPosed/blob/master/core/src/main/cpp/external/yahfa/src/HookMain.cpp

[yujincheng08]

are you hooking a normal app? LSPosed has disabled inline systemwisely so it may work.