fix: resolve multiple issues and crashes on recent Android versions

nawaf · nawaf · commit f571b4567cbf · 2026-06-16T21:29:47.000+03:00
- Fix AbstractMethodError in IServiceConnection (JingMatrix#741) - Fix SystemUI crash on Android 15 via MediaRouter2Hooker (JingMatrix#755) - Fix Zygisk Next crash on Android 16 by forcing DB init (JingMatrix#731) - Bypass GrapheneOS DCL protection for manager and settings (JingMatrix#711) - Fix manager crash on EMUI/HarmonyOS due to pre-warmed shell process (JingMatrix#748) - Update PluginEntry.kt to fully support API 101 and 102
diff --git a/build.gradle.kts b/build.gradle.kts
@@ -64,6 +64,7 @@ val versionNameProvider by extra(providers.of(GitLatestTagValueSource::class.jav
 val injectedPackageName by extra("com.android.shell")
 val injectedPackageUid by extra(2000)
 val defaultManagerPackageName by extra("org.lsposed.manager")
+val grapheneSettingsPackageName by extra("com.android.settings")
 
 val androidTargetSdkVersion by extra(36)
 val androidMinSdkVersion by extra(27)
diff --git a/daemon/build.gradle.kts b/daemon/build.gradle.kts
@@ -4,6 +4,7 @@ import java.io.PrintStream
 import java.util.UUID
 
 val defaultManagerPackageName: String by rootProject.extra
+val grapheneSettingsPackageName: String by rootProject.extra
 val injectedPackageName: String by rootProject.extra
 val injectedPackageUid: Int by rootProject.extra
 val versionCodeProvider: Provider<String> by rootProject.extra
@@ -22,6 +23,11 @@ android {
         "DEFAULT_MANAGER_PACKAGE_NAME",
         """"$defaultManagerPackageName"""",
     )
+    buildConfigField(
+        "String",
+        "GRAPHENE_SETTINGS_PACKAGE_NAME",
+        """"$grapheneSettingsPackageName"""",
+    )
     buildConfigField("String", "FRAMEWORK_NAME", """"${rootProject.name}"""")
     buildConfigField("String", "MANAGER_INJECTED_PKG_NAME", """"$injectedPackageName"""")
     buildConfigField("int", "MANAGER_INJECTED_UID", """$injectedPackageUid""")
diff --git a/daemon/src/main/kotlin/org/matrix/vector/daemon/VectorDaemon.kt b/daemon/src/main/kotlin/org/matrix/vector/daemon/VectorDaemon.kt
@@ -97,6 +97,11 @@ object VectorDaemon {
 
     applyNotificationWorkaround()
 
+    // Force open the database as root (EUID 0) so the connection is cached
+    // before dropping privileges. This prevents SQLiteCantOpenDatabaseException
+    // when accessing the DB as system (EUID 1000) on restricted environments.
+    runCatching { ConfigCache.dbHelper.writableDatabase }
+
     // Setup IPC channel for applications by injecting DaemonService binder
     sendToBridge(VectorService.asBinder(), false, systemServerMaxRetry)
 
diff --git a/daemon/src/main/kotlin/org/matrix/vector/daemon/VectorService.kt b/daemon/src/main/kotlin/org/matrix/vector/daemon/VectorService.kt
@@ -67,7 +67,7 @@ object VectorService : IDaemonService.Stub() {
     if (ApplicationService.hasRegister(uid, pid)) return null
 
     val scope = ProcessScope(processName, uid)
-    if (!ManagerService.tryRegisterManagerProcess(pid, uid, processName) &&
+    if (processName != BuildConfig.GRAPHENE_SETTINGS_PACKAGE_NAME && !ManagerService.tryRegisterManagerProcess(pid, uid, processName) &&
         ConfigCache.shouldSkipProcess(scope)) {
       Log.d(TAG, "Skipped $processName/$uid")
       return null
diff --git a/daemon/src/main/kotlin/org/matrix/vector/daemon/data/FileSystem.kt b/daemon/src/main/kotlin/org/matrix/vector/daemon/data/FileSystem.kt
@@ -58,12 +58,17 @@ object FileSystem {
 
   init {
     runCatching {
-          Files.createDirectories(basePath)
-          Os.chmod(basePath.toString(), "700".toInt(8))
-          SELinux.setFileContext(basePath.toString(), "u:object_r:system_file:s0")
-          Files.createDirectories(configDirPath)
-        }
-        .onFailure { Log.e(TAG, "Failed to initialize directories", it) }
+      Files.createDirectories(basePath)
+      Os.chmod(basePath.toString(), "700".toInt(8))
+    }.onFailure { Log.e(TAG, "Failed to initialize basePath", it) }
+
+    runCatching {
+      SELinux.setFileContext(basePath.toString(), "u:object_r:system_file:s0")
+    }.onFailure { Log.e(TAG, "Failed to set SELinux context for basePath", it) }
+
+    runCatching {
+      Files.createDirectories(configDirPath)
+    }.onFailure { Log.e(TAG, "Failed to initialize configDirPath", it) }
   }
 
   fun setupCli(): String {
diff --git a/daemon/src/main/kotlin/org/matrix/vector/daemon/ipc/ManagerService.kt b/daemon/src/main/kotlin/org/matrix/vector/daemon/ipc/ManagerService.kt
@@ -55,6 +55,13 @@ object ManagerService : ILSPManagerService.Stub() {
     private val connection =
         object : android.app.IServiceConnection.Stub() {
           override fun connected(name: ComponentName?, service: IBinder?, dead: Boolean) {}
+
+          override fun connected(
+              name: ComponentName?,
+              service: IBinder?,
+              session: android.app.IBinderSession?,
+              dead: Boolean
+          ) {}
         }
 
     init {
diff --git a/daemon/src/main/kotlin/org/matrix/vector/daemon/ipc/SystemServerService.kt b/daemon/src/main/kotlin/org/matrix/vector/daemon/ipc/SystemServerService.kt
@@ -45,6 +45,11 @@ object SystemServerService : ILSPSystemServerService.Stub(), IBinder.DeathRecipi
             proxyServiceName = serviceName
           }
           .onFailure { Log.e(TAG, "Failed to register IServiceCallback", it) }
+    } else {
+      runCatching {
+        ServiceManager.addService(serviceName, this)
+        proxyServiceName = serviceName
+      }.onFailure { Log.e(TAG, "Failed to register proxy service", it) }
     }
   }
 
diff --git a/hiddenapi/stubs/src/main/java/android/app/IBinderSession.java b/hiddenapi/stubs/src/main/java/android/app/IBinderSession.java
@@ -0,0 +1,6 @@
+package android.app;
+
+import android.os.IInterface;
+
+public interface IBinderSession extends IInterface {
+}
diff --git a/hiddenapi/stubs/src/main/java/android/app/IServiceConnection.java b/hiddenapi/stubs/src/main/java/android/app/IServiceConnection.java
@@ -8,6 +8,8 @@
 public interface IServiceConnection extends IInterface {
     void connected(ComponentName name, IBinder service, boolean dead);
 
+    void connected(ComponentName name, IBinder service, IBinderSession session, boolean dead);
+
     abstract class Stub extends Binder implements IServiceConnection {
 
         public static IServiceConnection asInterface(IBinder obj) {
diff --git a/xposed/src/main/kotlin/org/matrix/vector/impl/core/VectorStartup.kt b/xposed/src/main/kotlin/org/matrix/vector/impl/core/VectorStartup.kt
@@ -58,6 +58,16 @@ object VectorStartup {
             VectorHookBuilder(it).intercept(LoadedApkCtorHooker)
         }
 
+        // Workaround for Android 15 SystemUI MediaRouter2 crash (Issue #755)
+        if (Build.VERSION.SDK_INT >= 35) {
+            try {
+                val mediaRouterClass = Class.forName("android.media.MediaRouter2")
+                mediaRouterClass.declaredMethods
+                    .filter { it.name == "loadSystemRoutes" }
+                    .forEach { VectorHookBuilder(it).intercept(MediaRouter2Hooker) }
+            } catch (ignored: Throwable) {}
+        }
+
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
             loadedApkClass.declaredMethods
                 .filter { it.name == "createAppFactory" }
diff --git a/xposed/src/main/kotlin/org/matrix/vector/impl/hookers/MediaRouter2Hooker.kt b/xposed/src/main/kotlin/org/matrix/vector/impl/hookers/MediaRouter2Hooker.kt
@@ -0,0 +1,22 @@
+package org.matrix.vector.impl.hookers
+
+import io.github.libxposed.api.XposedInterface
+import org.lsposed.lspd.util.Utils
+
+/**
+ * Suppresses the Android 15 strictness crash in MediaRouter2.
+ * Fixes Issue #755 where SystemUI crashes due to delayed AudioService initialization.
+ */
+object MediaRouter2Hooker : XposedInterface.Hooker {
+    override fun intercept(chain: XposedInterface.Chain): Any? {
+        try {
+            return chain.proceed()
+        } catch (e: RuntimeException) {
+            if (e.message?.contains("currentSystemRoutes") == true) {
+                Utils.logW("Suppressed Android 15 MediaRouter2 crash (Issue #755)")
+                return null
+            }
+            throw e
+        }
+    }
+}
diff --git a/zygisk/build.gradle.kts b/zygisk/build.gradle.kts
@@ -15,6 +15,7 @@ val versionNameProvider: Provider<String> by rootProject.extra
 val injectedPackageName: String by rootProject.extra
 val injectedPackageUid: Int by rootProject.extra
 val defaultManagerPackageName: String by rootProject.extra
+val grapheneSettingsPackageName: String by rootProject.extra
 
 android {
     namespace = "org.matrix.vector"
@@ -24,12 +25,14 @@ android {
         buildConfigField("int", "HostPackageUid", "${injectedPackageUid}")
         buildConfigField("String", "InjectedPackageName", """"${injectedPackageName}"""")
         buildConfigField("String", "ManagerPackageName", """"${defaultManagerPackageName}"""")
+        buildConfigField("String", "GrapheneSettingsPackageName", """"${grapheneSettingsPackageName}"""")
 
         val flags =
             listOf(
                 "-DINJECTED_PACKAGE_NAME='\"${injectedPackageName}\"'",
                 "-DINJECTED_PACKAGE_UID=${injectedPackageUid}",
                 "-DMANAGER_PACKAGE_NAME='\"${defaultManagerPackageName}\"'",
+                "-DGRAPHENE_SETTINGS_PACKAGE_NAME='\"${grapheneSettingsPackageName}\"'",
             )
 
         externalNativeBuild {
diff --git a/zygisk/src/main/kotlin/org/matrix/vector/ParasiticManagerHooker.kt b/zygisk/src/main/kotlin/org/matrix/vector/ParasiticManagerHooker.kt
@@ -20,6 +20,7 @@ import de.robv.android.xposed.XposedHelpers
 import hidden.HiddenApiBridge
 import java.io.FileInputStream
 import java.io.FileOutputStream
+import java.lang.ref.WeakReference
 import java.lang.reflect.Method
 import java.util.concurrent.ConcurrentHashMap
 import org.lsposed.lspd.ILSPManagerService
@@ -33,6 +34,7 @@ object ParasiticManagerHooker {
 
     private var managerPkgInfo: PackageInfo? = null
     private var managerFd: Int = -1
+    private var dexInjected = false
 
     // Manually track Activity states since the system is unaware of our spoofed activities
     private val states = ConcurrentHashMap<String, Bundle>()
@@ -144,8 +146,31 @@ object ParasiticManagerHooker {
             .onFailure { Utils.logW("Could not send binder to LSPosed Manager", it) }
     }
 
+    /** Injects the manager APK's DEX path into the given ClassLoader. */
+    private fun injectDexPath(classLoader: ClassLoader, dexPath: String): Boolean {
+        return runCatching {
+            val pathList = XposedHelpers.getObjectField(classLoader, "pathList")
+            val dexPaths = XposedHelpers.callMethod(pathList, "getDexPaths") as List<*>
+            if (!dexPaths.contains(dexPath)) {
+                Utils.logW("Manager APK not found in ClassLoader, adding manually: $dexPath")
+                XposedHelpers.callMethod(classLoader, "addDexPath", dexPath)
+                logD("DEX added successfully via addDexPath")
+            } else {
+                logD("DEX already present in ClassLoader")
+            }
+            true
+        }.onFailure {
+            logE("Failed to inject DEX path: $dexPath", it)
+        }.getOrDefault(false)
+    }
+
     private fun hookForManager(managerService: ILSPManagerService) {
-        // Hook 1: Swap ApplicationInfo during host binding
+        // Hook 1: Swap ApplicationInfo during host binding, and evict any cached
+        // LoadedApk so the system creates a fresh one with our parasitic info.
+        // Without the cache eviction, devices that pre-warm the shell process
+        // (e.g. EMUI/HarmonyOS) would reuse a stale LoadedApk whose
+        // mApplicationInfo still points to the stock shell APK, causing
+        // makeApplication() to fall back to android.app.Application.
         XposedHelpers.findAndHookMethod(
             ActivityThread::class.java,
             "handleBindApplication",
@@ -157,36 +182,49 @@ object ParasiticManagerHooker {
                     val hostAppInfo =
                         XposedHelpers.getObjectField(bindData, "appInfo") as ApplicationInfo
                     val parasiticInfo = getManagerPkgInfo(hostAppInfo)?.applicationInfo
+
+                    // Evict any pre-cached LoadedApk for the host package so the
+                    // fresh LoadedApk is constructed with our parasitic ApplicationInfo.
+                    val at = ActivityThread.currentActivityThread()
+                    for (fieldName in arrayOf("mPackages", "mResourcePackages")) {
+                        runCatching {
+                            @Suppress("UNCHECKED_CAST")
+                            val map = XposedHelpers.getObjectField(at, fieldName)
+                                as? ArrayMap<String, WeakReference<*>> ?: return@runCatching
+                            map.remove(hostAppInfo.packageName)
+                        }
+                    }
+
                     XposedHelpers.setObjectField(bindData, "appInfo", parasiticInfo)
                 }
             },
         )
 
-        // Hook 2: Inject APK path into the ClassLoader
+        // Hook 2: Inject APK path into the ClassLoader.
+        // We check by package name rather than object reference identity, because on some
+        // devices (e.g. Huawei EMUI/HarmonyOS) the LoadedApk can be pre-cached by the
+        // system before our handleBindApplication hook runs, so mApplicationInfo won't be
+        // the same object as our parasitic ApplicationInfo.
         var classLoaderUnhook: XC_MethodHook.Unhook? = null
         val classLoaderHook =
             object : XC_MethodHook() {
                 override fun afterHookedMethod(param: MethodHookParam<*>) {
+                    if (dexInjected) return
                     val pkgInfo = getManagerPkgInfo(null) ?: return
                     val mAppInfo =
                         XposedHelpers.getObjectField(param.thisObject, "mApplicationInfo")
+                            as? ApplicationInfo ?: return
 
-                    val managerAppInfo = pkgInfo.applicationInfo!!
-
-                    if (mAppInfo == managerAppInfo) {
-                        val dexPath = managerAppInfo.sourceDir
-                        val pathClassLoader = param.result as ClassLoader
+                    if (mAppInfo.packageName != BuildConfig.InjectedPackageName) return
 
-                        logD("Injecting DEX into LoadedApk ClassLoader: $pathClassLoader")
-                        val pathList = XposedHelpers.getObjectField(pathClassLoader, "pathList")
-                        val dexPaths = XposedHelpers.callMethod(pathList, "getDexPaths") as List<*>
+                    val dexPath = pkgInfo.applicationInfo!!.sourceDir
+                    val pathClassLoader = param.result as ClassLoader
 
-                        if (!dexPaths.contains(dexPath)) {
-                            Utils.logW("Manager APK not found in ClassLoader, adding manually...")
-                            XposedHelpers.callMethod(pathClassLoader, "addDexPath", dexPath)
-                        }
+                    logD("Injecting DEX into LoadedApk ClassLoader: $pathClassLoader")
+                    if (injectDexPath(pathClassLoader, dexPath)) {
                         sendBinderToManager(pathClassLoader, managerService.asBinder())
-                        classLoaderUnhook!!.unhook() // Only need to inject once
+                        dexInjected = true
+                        classLoaderUnhook!!.unhook()
                     }
                 }
             }
@@ -441,6 +479,50 @@ object ParasiticManagerHooker {
         }
     }
 
+    @JvmStatic
+    fun patchGrapheneDCLRestriction() {
+        try {
+            // Force GrapheneOS to allow changing the restriction on Dynamic Code Loading, and
+            // force-disable it for the settings app and the shell
+            XposedBridge.hookAllMethods(
+                XposedHelpers.findClass(
+                    "android.ext.settings.app.AswRestrictMemoryDynCodeLoading",
+                    this.javaClass.classLoader
+                ),
+                "getImmutableValue",
+                object : XC_MethodReplacement() {
+                    override fun replaceHookedMethod(param: MethodHookParam<*>?): Any? {
+                        val appInfo = param?.args[2] as? ApplicationInfo?
+
+                        // Settings has to always be allowed so that it can be patched as well.
+                        // The parasitic host package is also allowed so that the manager functions correctly.
+                        if (appInfo != null && listOf(
+                                BuildConfig.GrapheneSettingsPackageName,
+                                BuildConfig.InjectedPackageName
+                            ).contains(appInfo.packageName)
+                        ) {
+                            return false
+                        }
+
+                        // All system apps are configurable (null)
+                        if (appInfo != null && (appInfo.flags and ApplicationInfo.FLAG_SYSTEM) != 0) {
+                            return null
+                        }
+
+                        // Defer to original implementation for other apps
+                        return XposedBridge.invokeOriginalMethod(
+                            param?.method, param?.thisObject, param?.args
+                        )
+                    }
+                }
+            )
+        } catch (_: XposedHelpers.ClassNotFoundError) {
+            // Ignore, assuming we are not on GrapheneOS
+        } catch (e: Exception) {
+            Utils.logE("Unknown error patching Graphene DCL", e)
+        }
+    }
+
     /** Entry point. Checks if the current process should host the parasitic manager. */
     @JvmStatic
     fun start(): Boolean {
diff --git a/zygisk/src/main/kotlin/org/matrix/vector/core/Main.kt b/zygisk/src/main/kotlin/org/matrix/vector/core/Main.kt
@@ -35,6 +35,10 @@ object Main {
             ParasiticManagerSystemHooker.start()
         }
 
+        if (isSystem || niceName == BuildConfig.GrapheneSettingsPackageName) {
+            ParasiticManagerHooker.patchGrapheneDCLRestriction()
+        }
+
         // Initialize Xposed bridge components
         val appService = ILSPApplicationService.Stub.asInterface(binder)
         Startup.initXposed(isSystem, niceName, appDir, appService)

Original file line number	Diff line number	Diff line change
`@@ -45,6 +45,11 @@ object SystemServerService : ILSPSystemServerService.Stub(), IBinder.DeathRecipi`
`45`	`45`	`proxyServiceName = serviceName`
`46`	`46`	`}`
`47`	`47`	`.onFailure { Log.e(TAG, "Failed to register IServiceCallback", it) }`
	`48`	`+ } else {`
	`49`	`+ runCatching {`
	`50`	`+ ServiceManager.addService(serviceName, this)`
	`51`	`+ proxyServiceName = serviceName`
	`52`	`+ }.onFailure { Log.e(TAG, "Failed to register proxy service", it) }`
`48`	`53`	`}`
`49`	`54`	`}`
`50`	`55`