Starting a service with same permissions as hooked package - Xposed General

Simple question. I want to start my own service from my package with the same permissions as the package i am hooking. Does anybody know how i could do this? I know if i use android:sharedUserId="android.uid.systemui" in the manifest, but it prevents it based off of signature mismatch. Could i use xposed to grant my app the sharedUserId?

Simple question. I want to start my own service from my package with the same permissions as the package i am hooking.
Click to expand...
Click to collapse
I don't think that is possible. I haven't worked with services yet, but as far as I understood, you have to declare them in your manifest (in contrast to BroadcastReceivers, which can also be registered at runtime). Theoretically again, you could try to modify the manifest parsing and try to inject additional entries there.
elesbb said:
Could i use xposed to grant my app the sharedUserId?
Click to expand...
Click to collapse
Theoretically, I think yes, you could hook the package manager to ignore the signature mismatch etc. But I think it will be quite fragile.
What do you want to achieve with this?

rovo89 said:
I don't think that is possible. I haven't worked with services yet, but as far as I understood, you have to declare them in your manifest (in contrast to BroadcastReceivers, which can also be registered at runtime). Theoretically again, you could try to modify the manifest parsing and try to inject additional entries there.
Theoretically, I think yes, you could hook the package manager to ignore the signature mismatch etc. But I think it will be quite fragile.
What do you want to achieve with this?
Click to expand...
Click to collapse
I hate how Samsung removed widgets from the lockscreen. So i figured i'll create my own lockscreen and have it loaded by the system. I might just skip the whole service thing (which would make my lockscreen easier to write by having classes that extend things like FrameLayout as the stock lockscreen does) but i found where the lockscreen is actually shown. i may just inflate my own xml of the lockscreen using xposed resources and then adding it with windowmanager. Then the inflated view will follow the same permissions as the stock lockscreen and allow me to handle key presses and still preserve the security behind it.
Thanks rovo for the reply!

@rovo89
If i am inflating my own view inside a hooked method, how can i get the ids of my layout? I tried XModuleResources myRes; myRes.getIdentifier() but it returned null.

Be careful, Resources.getIdentifier() expects the arguments in a different order than Xposed, like getIdentifier("mystring", "string", "my.package.name").
Apart from that, simply use R.layout.my_layout.

Related

Give system service permission to external storage

Hi,
I'm studying how PackageManagerService works, and i noticed that if an application was downloaded to /data/app i can access the file and open inputstream .
but if APK was downloaded to SD card, i can't access the file from PackageManagerService.
is there something i can do?
I want to be able to read the APK before it get installed...
Thanks,
pi.publicSourceDir = apk file path
pyler said:
pi.publicSourceDir = apk file path
Click to expand...
Click to collapse
not sure i follow you.
I'm in the packageManagerService context, i don't have PackageInfo (the application is still not installed)
You could hook PermissionGranter and give the process extra permissions, or see where the system is actually parsing the APK's manifest before installing it.
GermainZ said:
You could hook PermissionGranter and give the process extra permissions, or see where the system is actually parsing the APK's manifest before installing it.
Click to expand...
Click to collapse
Thanks, what I don't understand is, if i give my xposed module permissions to read external storage, why does it still can't read it?
shnapsi said:
Thanks, what I don't understand is, if i give my xposed module permissions to read external storage, why does it still can't read it?
Click to expand...
Click to collapse
They're different processes.
http://forum.xda-developers.com/showpost.php?p=55332926&postcount=9
http://forum.xda-developers.com/showpost.php?p=55186575&postcount=2
GermainZ said:
They're different processes.
http://forum.xda-developers.com/showpost.php?p=55332926&postcount=9
http://forum.xda-developers.com/showpost.php?p=55186575&postcount=2
Click to expand...
Click to collapse
So just to make sure I understand, I can create a service and run it from the hooked method and it should work?
if so, i have another question
How can i stop the original method from running until a point i allow it to continue?
Thanks GermainZ !
shnapsi said:
So just to make sure I understand, I can create a service and run it from the hooked method and it should work?
Click to expand...
Click to collapse
I don't understand how you read that from my reply, to be honest. Here's what I meant:
Hooked code *is not* run as your app. The hooked code is run as the hooked app.
If the hooked app can't do X, then the hooked code can't do X either.
Your app's permissions do not affect the hooked code in any way, only normal (not hooked) code.
shnapsi said:
How can i stop the original method from running until a point i allow it to continue?
Click to expand...
Click to collapse
Using the normal ways you'd normally use if it weren't an Xposed module, in the beforeHookedMethod hook. I'm not familiar with the exact methods, you can look that up. Just be aware that blocking it for too long will cause an ANR.

how to modify android.os.Build's static field?

Hi, I'm just use Xposed to dev a simple project.
I'm trying to modify device info by using Xposed. When I hook TelephonyManager.getDeviceId, return the value that just what I set.
But I can't find out how to modify the fields in andoid.os.Build. They are FINAL fields and Xposed can just hook on methods but not fields.
I get a way to set the fields using XposedHelpers.setStaticObjectField. It can ONLY modify ONCE when the target apk has not started. When the target apk( such as device info viewer ) started, I have to reboot or force close the apk because of the handleLoadPackage method can not reinvoke.
Waiting online for any solution. Thanks very much.
joetony said:
Hi, I'm just use Xposed to dev a simple project.
I'm trying to modify device info by using Xposed. When I hook TelephonyManager.getDeviceId, return the value that just what I set.
But I can't find out how to modify the fields in andoid.os.Build. They are FINAL fields and Xposed can just hook on methods but not fields.
I get a way to set the fields using XposedHelpers.setStaticObjectField. It can ONLY modify ONCE when the target apk has not started. When the target apk( such as device info viewer ) started, I have to reboot or force close the apk because of the handleLoadPackage method can not reinvoke.
Waiting online for any solution. Thanks very much.
Click to expand...
Click to collapse
I don't know which final field you are trying to change, but most of them get their values from getString(), getStringList() or getLong() methods.
You need to hook in these methods, read their "property" parameter ( param.args[0] ) to see if it is the one you want to change, and finally change the method result ( param.setResult() ).
Hello. Is there a solution to change the fields like Build.MODEL on the fly? Any examples not worked. Thanks.
Some fields can't be replaced, am I right?
Code is poetry:
https://github.com/M66B/XPrivacy/blob/master/src/biz/bokhorst/xprivacy/XPrivacy.java#L159
Your code is amazing
M66B said:
Code is poetry:
https://github.com/M66B/XPrivacy/blob/master/src/biz/bokhorst/xprivacy/XPrivacy.java#L159
Click to expand...
Click to collapse
It's worked only in own application with this code. In other apps it's not worked. I need to make changes to apply to all applications.
PS: Sorry for my bad English.
ifynk said:
It's worked only in own application with this code. In other apps it's not worked. I need to make changes to apply to all applications.
PS: Sorry for my bad English.
Click to expand...
Click to collapse
You can do this only when the Java VM is being initialized in handle load package.
M66B said:
You can do this only when the Java VM is being initialized in handle load package.
Click to expand...
Click to collapse
Thanks. How i can restart package for new init for handle load?
ifynk said:
Thanks. How i can restart package for new init for handle load?
Click to expand...
Click to collapse
There is no need for restarts, just set a new value in the Xposed handleLoadPackage callback for the applications you want to modify values.
Note that changing Build properties for Android might result in a bootloop.
Edit: if you don't known about handleLoadPackage , you need to do some studying ...
This all can be simplified by XposedHelpers.setStaticObjectField(clazz, name, value)
M66B said:
Edit: if you don't known about handleLoadPackage , you need to do some studying ...
Click to expand...
Click to collapse
Were i can read about handleLoadPackage? Thanks.

how to make exposed changes permanent???

please any one know .how to make xposed changes permanent??
that is it remains there ..... even we uninstall xposed...
AS far as my understanding goes, xposed redirects specific function calls at runtime to other functions with the intend to run different code than the app would normally do. That said, redirecting those calls can not work without xposed framework or without the xposed modules as no changes are made to the apps directly.
Correct me if I'm wrong.
You are absolutely no wrong, however if we decompile the apk that is being modded via some specific module and we change the code of the redirected functions to the one included within module and recompile the apk, we should get an apk working exactly the same as if it was hooked via xposed+module.
Please note that a lot of modules has been originally created basing on reverse idea: first someone made a mod by changing the java/smali code of some apks, then someone wrote a module making same changes but via xposed, on-the-fly.
In my opinion such an automated tool to recompile the apks and change their code basing on the code included in a xposed module IS possible.
No one made it yet, tho...
Definitely not possible. You cannot simply redirect code from one app to another. With xposed, you are always running within app that's being modded.
esgie said:
You are absolutely no wrong, however if we decompile the apk that is being modded via some specific module and we change the code of the redirected functions to the one included within module and recompile the apk, we should get an apk working exactly the same as if it was hooked via xposed+module.
Please note that a lot of modules has been originally created basing on reverse idea: first someone made a mod by changing the java/smali code of some apks, then someone wrote a module making same changes but via xposed, on-the-fly.
In my opinion such an automated tool to recompile the apks and change their code basing on the code included in a xposed module IS possible.
No one made it yet, tho...
Click to expand...
Click to collapse
Im with this guy, and if you read on xposed... yes its code being "injected" into the stock apk ...
What xposed does is creates side files (ran by zygote)
They get copied to /system/bin as app_process(xposed)
Or app_process(origional)
These files act as Init.d scripting... to inject this code...
I assume they make both these copies for reverting back to stock (disable the module)
It IS possible to make these changes permanent and re-compile the apk...
However ... de-coding the module ... to find out what is getting injected where... THATS where im at so far ...
Arter 97 has proven this possible with adaway as a standalone apk in conjuction with his youtube apk... im assuming hes using code to call upon the adaway apk files , and still using it like xposed... but merely without xposed..
If anyone with more experience could point us on how to track down how to find exactly WHAT code is being injected and where... it would be EXTREMELY helpful to many people not wanting to run 3rd party applications to get their desired functions...
Anyone feel free to chime in

lockscreen disabler for magisk

I'm looking for a module to be created, or if I could do it not sure. Something to do the same as "lockscreen disabler" did in Xposed. Willing to donate. App in question for exchange email is "Email MOTOEMAIL.00.05.0072". Currently running XT1254, 6.0.1, stock rom. Thank you.
Shtiff1 said:
I'm looking for a module to be created, or if I could do it not sure. Something to do the same as "lockscreen disabler" did in Xposed. Willing to donate. App in question for exchange email is "Email MOTOEMAIL.00.05.0072". Currently running XT1254, 6.0.1, stock rom. Thank you.
Click to expand...
Click to collapse
maybe it is enough if you download the module-template edit config.sh and module.prop to an ID if your choice and in config.sh also the REPLACE part with /system/app or priv-app/Lockscreen/ ?
something like this maybe? but here ends my know-how
Shtiff1 said:
I'm looking for a module to be created, or if I could do it not sure. Something to do the same as "lockscreen disabler" did in Xposed. Willing to donate. App in question for exchange email is "Email MOTOEMAIL.00.05.0072". Currently running XT1254, 6.0.1, stock rom. Thank you.
Click to expand...
Click to collapse
First, that's not a donation you're talking about, it's a bounty.
Second, if it can't be done without Xposed, it can't be done with Magisk. So don't hold your breath.
wiQbold said:
maybe it is enough if you download the module-template edit config.sh and module.prop to an ID if your choice and in config.sh also the REPLACE part with /system/app or priv-app/Lockscreen/ ?
Click to expand...
Click to collapse
What? I don't think you understand what the REPLACE part of the config.sh file does.
During installation, that little entry puts a file called "replace" in each folder listed, in the module folder structure. Every time Magisk mounts a module and finds that file it will completely wipe (systemlessly, of course) the corresponding folder in /system.
If you want to replace a file on your device with one you've edited, all you have to do is to put that file in the module zip, under the same folder structure it can be found on your device. After that Magisk's Magic Mount will do it's thing...
Didgeridoohan said:
First, that's not a donation you're talking about, it's a bounty.
Second, if it can't be done without Xposed, it can't be done with Magisk. So don't hold your breath.
What? I don't think you understand what the REPLACE part of the config.sh file does.
During installation, that little entry puts a file called "replace" in each folder listed, in the module folder structure. Every time Magisk mounts a module and finds that file it will completely wipe (systemlessly, of course) the corresponding folder in /system.
If you want to replace a file on your device with one you've edited, all you have to do is to put that file in the module zip, under the same folder structure it can be found on your device. After that Magisk's Magic Mount will do it's thing...
Click to expand...
Click to collapse
right. my consideration was to wipe the lockscreen folder in system to disable it
wiQbold said:
right. my consideration was to wipe the lockscreen folder in system to disable it
Click to expand...
Click to collapse
Ok. In that case I believe you haven't quite understood the request...
Didgeridoohan said:
Ok. In that case I believe you haven't quite understood the request...
Click to expand...
Click to collapse
that could be true. do not have any device older then nougat and can t try the xposed-module.
thought it disable only the lockscreen.
wiQbold said:
that could be true. do not have any device older then nougat and can t try the xposed-module.
thought it disable only the lockscreen.
Click to expand...
Click to collapse
From what I can tell it disables the lockscreen while tricking apps that require a lockscreen into thinking it's enabled.
Easy-ish with Xposed, impossible with Magisk unless you manually edit the app in question to not detect the lockscreen state and then use a Magisk module to mount it to your device.
Didgeridoohan said:
From what I can tell it disables the lockscreen while tricking apps that require a lockscreen into thinking it's enabled.
Easy-ish with Xposed, impossible with Magisk unless you manually edit the app in question to not detect the lockscreen state and then use a Magisk module to mount it to your device.
Click to expand...
Click to collapse
That is correct. When i opened phone before it just had swipe up to open. Now I have to enter lock code every time. I haven't done anything with adb before, always do everything from the phone. I've seen the apk "exchangenopin" but I can't try it, cause I can't download the apk anywhere. Those from other thread seem to go to ad sites. I figured that it wouldn't of been that difficult because the exchangenopin "supposedly" works w/o Xposed. That's why I was hoping for a module. I found something to replace my "insert custom text" module from Xposed, now just need something to replace for lockscreen. Lol. Liking Magisk though.
I experienced the same problem with my realme 5i smartphone, I tried to install the latest Magisk via the OrangeFox recovery because I had never rooted my smartphone before. but I have installed pixel 5 archipelago project. In this case, after installing magisk and successfully entering the lockscreen, here the problem occurs because I can't enter the lockscreen PIN and can't do anything, I can't even turn off my phone. But here I found a solution, namely using a google account and trying to wipe data via the Google Play application, namely find my devices and then delete it there and it worked for me

Create module that executes code if another app is started or run forever in background?

Hello!
I'm currently playing around with Java and Xposed development and I have created a simple Android app that creates a .txt file in a folder.
What I would like to do is create a Xposed module that can automatically detect when I create said .txt file, I have 2 ideas on how I could achieve that but I'm not sure what might be the best:
Idea #1:
Create some sort of background service that will always be runnning and check if there are any or new files in said folder or maybe use the FileObserver method.
Idea #2:
Hook into the app and run a function inside my Xposed module that checks with regular interval if there are any files in the folder.
I have never really done any Java or Xposed development before so all this is quite new, but I would love to know what would be the best aproach or if anyone has some better suggestions!
Thank you all!
I don't see a xposed requirement here. File change observation is easily done by automation apps like Tasker(event->file->file modified), doesn't need xposed for it. Xposed framework better used for modifications to system or apps.
As per second requirement of performing user actions on a app, you can use Xposed edge(xposed plugin) inject gestures / AutoInput(tasker plugin)

Categories

Resources