├── hideapi ├── consumer-rules.pro ├── src │ └── main │ │ ├── AndroidManifest.xml │ │ └── java │ │ └── android │ │ └── os │ │ ├── IServiceManager.java │ │ └── ServiceManager.java ├── build.gradle.kts └── proguard-rules.pro ├── library ├── src │ └── main │ │ ├── AndroidManifest.xml │ │ └── java │ │ └── com │ │ └── github │ │ └── kr328 │ │ └── magic │ │ ├── action │ │ ├── Action.java │ │ └── VoidAction.java │ │ ├── aidl │ │ ├── ServerProxyFactory.java │ │ ├── TransactProxy.java │ │ └── ServerProxy.java │ │ ├── util │ │ ├── StackUtils.java │ │ ├── ClassLoaderUtils.java │ │ └── BinderUtils.java │ │ └── services │ │ └── ServiceManagerProxy.java ├── proguard-rules.pro ├── build.gradle.kts └── consumer-rules.pro ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── .gitignore ├── settings.gradle.kts ├── LICENSE ├── gradle.properties ├── gradlew.bat └── gradlew /hideapi/consumer-rules.pro: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /hideapi/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /library/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kr328/MagicLibrary/HEAD/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /hideapi/src/main/java/android/os/IServiceManager.java: -------------------------------------------------------------------------------- 1 | package android.os; 2 | 3 | public interface IServiceManager { 4 | 5 | } 6 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | .idea/ 4 | .DS_Store 5 | build/ 6 | /captures 7 | .externalNativeBuild 8 | .cxx 9 | local.properties 10 | -------------------------------------------------------------------------------- /hideapi/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("com.android.library") 3 | } 4 | 5 | android { 6 | namespace = "com.github.kr328.magic.hideapi" 7 | } 8 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/action/Action.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.action; 2 | 3 | public interface Action { 4 | R run() throws T; 5 | } 6 | 7 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/action/VoidAction.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.action; 2 | 3 | public interface VoidAction { 4 | void run() throws T; 5 | } 6 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip 4 | networkTimeout=10000 5 | validateDistributionUrl=true 6 | zipStoreBase=GRADLE_USER_HOME 7 | zipStorePath=wrapper/dists 8 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/aidl/ServerProxyFactory.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.aidl; 2 | 3 | import android.os.Binder; 4 | import android.os.IInterface; 5 | 6 | import androidx.annotation.NonNull; 7 | 8 | public interface ServerProxyFactory { 9 | @NonNull 10 | Binder create(@NonNull O original, @NonNull R replaced); 11 | } 12 | -------------------------------------------------------------------------------- /hideapi/src/main/java/android/os/ServiceManager.java: -------------------------------------------------------------------------------- 1 | package android.os; 2 | 3 | public final class ServiceManager { 4 | private static IServiceManager sServiceManager; 5 | 6 | private static IServiceManager getIServiceManager() { 7 | throw new IllegalArgumentException("Stub!"); 8 | } 9 | 10 | public static IBinder getService(final String name) { 11 | throw new IllegalArgumentException("Stub!"); 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/aidl/TransactProxy.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.aidl; 2 | 3 | import androidx.annotation.Nullable; 4 | 5 | import java.lang.annotation.ElementType; 6 | import java.lang.annotation.Retention; 7 | import java.lang.annotation.RetentionPolicy; 8 | import java.lang.annotation.Target; 9 | 10 | @Retention(RetentionPolicy.RUNTIME) 11 | @Target(ElementType.METHOD) 12 | public @interface TransactProxy { 13 | @Nullable 14 | int[] value() default {}; 15 | } 16 | -------------------------------------------------------------------------------- /settings.gradle.kts: -------------------------------------------------------------------------------- 1 | rootProject.name = "MagicLibrary" 2 | 3 | include(":library") 4 | include(":hideapi") 5 | 6 | pluginManagement { 7 | repositories { 8 | mavenCentral() 9 | google() 10 | maven(url = "https://maven.kr328.app/releases") 11 | mavenLocal() 12 | } 13 | } 14 | 15 | dependencyResolutionManagement { 16 | repositories { 17 | mavenCentral() 18 | google() 19 | maven(url = "https://maven.kr328.app/releases") 20 | mavenLocal() 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/util/StackUtils.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.util; 2 | 3 | import androidx.annotation.NonNull; 4 | 5 | public final class StackUtils { 6 | public static boolean isStacktraceContains(@NonNull final String name) { 7 | for (final StackTraceElement frame : Thread.currentThread().getStackTrace()) { 8 | if (frame.getMethodName().contains(name)) { 9 | return true; 10 | } 11 | } 12 | 13 | return false; 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /hideapi/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle.kts. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile -------------------------------------------------------------------------------- /library/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle.kts. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile -------------------------------------------------------------------------------- /library/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("com.android.library") 3 | `maven-publish` 4 | } 5 | 6 | android { 7 | namespace = "com.github.kr328.magic" 8 | 9 | defaultConfig { 10 | consumerProguardFiles("consumer-rules.pro") 11 | } 12 | 13 | publishing { 14 | multipleVariants("all") { 15 | withSourcesJar() 16 | includeBuildTypeValues("debug", "release") 17 | } 18 | } 19 | } 20 | 21 | afterEvaluate { 22 | publishing { 23 | publications { 24 | create(project.name, MavenPublication::class) { 25 | artifactId = project.name 26 | 27 | from(components["all"]) 28 | } 29 | } 30 | } 31 | } 32 | 33 | dependencies { 34 | compileOnly(project(":hideapi")) 35 | 36 | compileOnly("androidx.annotation:annotation:1.7.0") 37 | } 38 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/util/ClassLoaderUtils.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.util; 2 | 3 | import android.annotation.SuppressLint; 4 | 5 | import androidx.annotation.NonNull; 6 | import androidx.annotation.Nullable; 7 | 8 | import java.lang.reflect.Field; 9 | 10 | public final class ClassLoaderUtils { 11 | @SuppressWarnings("JavaReflectionMemberAccess") 12 | @SuppressLint("DiscouragedPrivateApi") 13 | @Nullable 14 | public static ClassLoader replaceParentClassLoader(@NonNull final ClassLoader target, @Nullable final ClassLoader newParent) throws ReflectiveOperationException { 15 | final Field field = ClassLoader.class.getDeclaredField("parent"); 16 | field.setAccessible(true); 17 | 18 | final ClassLoader oldParent = (ClassLoader) field.get(target); 19 | field.set(target, newParent); 20 | 21 | return oldParent; 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/util/BinderUtils.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.util; 2 | 3 | import android.os.Binder; 4 | 5 | import androidx.annotation.NonNull; 6 | 7 | import com.github.kr328.magic.action.Action; 8 | import com.github.kr328.magic.action.VoidAction; 9 | 10 | public final class BinderUtils { 11 | public static R withEvaluated(@NonNull final Action action) throws T { 12 | final long token = Binder.clearCallingIdentity(); 13 | 14 | try { 15 | return action.run(); 16 | } finally { 17 | Binder.restoreCallingIdentity(token); 18 | } 19 | } 20 | 21 | public static void withEvaluated(@NonNull final VoidAction action) throws T { 22 | withEvaluated(() -> { 23 | action.run(); 24 | 25 | return null; 26 | }); 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /library/consumer-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle.kts. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile 22 | 23 | -dontwarn android.os.IServiceManager 24 | -dontwarn android.os.ServiceManager 25 | 26 | -keepclassmembers class * { 27 | @com.github.kr328.magic.aidl.TransactProxy *; 28 | } 29 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 Kr328 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /gradle.properties: -------------------------------------------------------------------------------- 1 | # Project-wide Gradle settings. 2 | # IDE (e.g. Android Studio) users: 3 | # Gradle settings configured through the IDE *will override* 4 | # any settings specified in this file. 5 | # For more details on how to configure your build environment visit 6 | # http://www.gradle.org/docs/current/userguide/build_environment.html 7 | # Specifies the JVM arguments used for the daemon process. 8 | # The setting is particularly useful for tweaking memory settings. 9 | org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 10 | # When configured, Gradle will run in incubating parallel mode. 11 | # This option should only be used with decoupled projects. More details, visit 12 | # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects 13 | # org.gradle.parallel=true 14 | # AndroidX package structure to make it clearer which packages are bundled with the 15 | # Android operating system, and which are packaged with your app"s APK 16 | # https://developer.android.com/topic/libraries/support-library/androidx-rn 17 | android.useAndroidX=true 18 | # Automatically convert third-party libraries to use AndroidX 19 | android.enableJetifier=true -------------------------------------------------------------------------------- /gradlew.bat: -------------------------------------------------------------------------------- 1 | @rem 2 | @rem Copyright 2015 the original author or authors. 3 | @rem 4 | @rem Licensed under the Apache License, Version 2.0 (the "License"); 5 | @rem you may not use this file except in compliance with the License. 6 | @rem You may obtain a copy of the License at 7 | @rem 8 | @rem https://www.apache.org/licenses/LICENSE-2.0 9 | @rem 10 | @rem Unless required by applicable law or agreed to in writing, software 11 | @rem distributed under the License is distributed on an "AS IS" BASIS, 12 | @rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | @rem See the License for the specific language governing permissions and 14 | @rem limitations under the License. 15 | @rem 16 | 17 | @if "%DEBUG%"=="" @echo off 18 | @rem ########################################################################## 19 | @rem 20 | @rem Gradle startup script for Windows 21 | @rem 22 | @rem ########################################################################## 23 | 24 | @rem Set local scope for the variables with windows NT shell 25 | if "%OS%"=="Windows_NT" setlocal 26 | 27 | set DIRNAME=%~dp0 28 | if "%DIRNAME%"=="" set DIRNAME=. 29 | @rem This is normally unused 30 | set APP_BASE_NAME=%~n0 31 | set APP_HOME=%DIRNAME% 32 | 33 | @rem Resolve any "." and ".." in APP_HOME to make it shorter. 34 | for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi 35 | 36 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 37 | set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" 38 | 39 | @rem Find java.exe 40 | if defined JAVA_HOME goto findJavaFromJavaHome 41 | 42 | set JAVA_EXE=java.exe 43 | %JAVA_EXE% -version >NUL 2>&1 44 | if %ERRORLEVEL% equ 0 goto execute 45 | 46 | echo. 47 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 48 | echo. 49 | echo Please set the JAVA_HOME variable in your environment to match the 50 | echo location of your Java installation. 51 | 52 | goto fail 53 | 54 | :findJavaFromJavaHome 55 | set JAVA_HOME=%JAVA_HOME:"=% 56 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 57 | 58 | if exist "%JAVA_EXE%" goto execute 59 | 60 | echo. 61 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 62 | echo. 63 | echo Please set the JAVA_HOME variable in your environment to match the 64 | echo location of your Java installation. 65 | 66 | goto fail 67 | 68 | :execute 69 | @rem Setup the command line 70 | 71 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 72 | 73 | 74 | @rem Execute Gradle 75 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* 76 | 77 | :end 78 | @rem End local scope for the variables with windows NT shell 79 | if %ERRORLEVEL% equ 0 goto mainEnd 80 | 81 | :fail 82 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 83 | rem the _cmd.exe /c_ return code! 84 | set EXIT_CODE=%ERRORLEVEL% 85 | if %EXIT_CODE% equ 0 set EXIT_CODE=1 86 | if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE% 87 | exit /b %EXIT_CODE% 88 | 89 | :mainEnd 90 | if "%OS%"=="Windows_NT" endlocal 91 | 92 | :omega 93 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/aidl/ServerProxy.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.aidl; 2 | 3 | import android.os.Binder; 4 | import android.os.IBinder; 5 | import android.os.IInterface; 6 | import android.os.Parcel; 7 | import android.os.RemoteException; 8 | import android.util.Log; 9 | 10 | import androidx.annotation.NonNull; 11 | import androidx.annotation.Nullable; 12 | 13 | import java.lang.reflect.Field; 14 | import java.lang.reflect.Method; 15 | import java.util.Arrays; 16 | import java.util.HashSet; 17 | import java.util.Set; 18 | import java.util.stream.Collectors; 19 | 20 | public final class ServerProxy { 21 | private static final String TAG = "ServerProxy"; 22 | 23 | @NonNull 24 | public static ServerProxyFactory mustCreateFactory( 25 | @NonNull final Class original, 26 | @NonNull final Class replace, 27 | final boolean strict 28 | ) { 29 | try { 30 | return createFactory(original, replace, strict); 31 | } catch (final ReflectiveOperationException e) { 32 | Log.e(TAG, "Create factory of " + replace + " failed", e); 33 | 34 | throw new RuntimeException(e); 35 | } 36 | } 37 | 38 | @NonNull 39 | public static ServerProxyFactory createFactory( 40 | @NonNull final Class original, 41 | @NonNull final Class replace, 42 | final boolean strict 43 | ) throws ReflectiveOperationException { 44 | ClassLoader classLoader = original.getClassLoader(); 45 | if (classLoader == null) { 46 | classLoader = ClassLoader.getSystemClassLoader(); 47 | } 48 | 49 | Log.d(TAG, "Create factory of " + replace); 50 | 51 | final Class stub = classLoader.loadClass(original.getName() + "$Stub"); 52 | 53 | final Set transactCodes = new HashSet<>(); 54 | 55 | for (final Method method : replace.getMethods()) { 56 | final TransactProxy proxy = method.getAnnotation(TransactProxy.class); 57 | if (proxy == null) { 58 | continue; 59 | } 60 | 61 | Log.d(TAG, "Method " + method + " mark as @TransactProxy"); 62 | 63 | if (proxy.value() != null && proxy.value().length > 0) { 64 | transactCodes.addAll(Arrays.stream(proxy.value()).boxed().collect(Collectors.toList())); 65 | } 66 | 67 | try { 68 | original.getMethod(method.getName(), method.getParameterTypes()); 69 | } catch (final ReflectiveOperationException e) { 70 | Log.w(TAG, "Transact code of " + method + " not found.", e); 71 | 72 | if (strict) { 73 | throw e; 74 | } 75 | 76 | continue; 77 | } 78 | 79 | final Field code = stub.getDeclaredField("TRANSACTION_" + method.getName()); 80 | code.setAccessible(true); 81 | final int codeValue = code.getInt(original); 82 | 83 | Log.d(TAG, "Transact code of " + method.getName() + " is " + codeValue); 84 | transactCodes.add(codeValue); 85 | } 86 | 87 | return (o, r) -> new Binder() { 88 | final IBinder delegate = r.asBinder(); 89 | final IBinder fallback = o.asBinder(); 90 | 91 | @Override 92 | protected boolean onTransact(final int code, @NonNull final Parcel data, @Nullable final Parcel reply, final int flags) throws RemoteException { 93 | if (transactCodes.contains(code)) { 94 | return delegate.transact(code, data, reply, flags); 95 | } 96 | 97 | return fallback.transact(code, data, reply, flags); 98 | } 99 | 100 | @Override 101 | public void linkToDeath(@NonNull final DeathRecipient recipient, final int flags) { 102 | try { 103 | delegate.linkToDeath(recipient, flags); 104 | } catch (final RemoteException e) { 105 | throw new RuntimeException(e); 106 | } 107 | } 108 | 109 | @Override 110 | public boolean unlinkToDeath(@NonNull final DeathRecipient recipient, final int flags) { 111 | return delegate.unlinkToDeath(recipient, flags); 112 | } 113 | 114 | @Override 115 | public void attachInterface(@Nullable final IInterface owner, @Nullable final String descriptor) { 116 | // ignore 117 | } 118 | 119 | @Nullable 120 | @Override 121 | public IInterface queryLocalInterface(@NonNull final String descriptor) { 122 | return null; 123 | } 124 | 125 | @Nullable 126 | @Override 127 | public String getInterfaceDescriptor() { 128 | try { 129 | return fallback.getInterfaceDescriptor(); 130 | } catch (final RemoteException e) { 131 | throw new RuntimeException(e); 132 | } 133 | } 134 | 135 | @Override 136 | public boolean pingBinder() { 137 | return fallback.pingBinder(); 138 | } 139 | 140 | @Override 141 | public boolean isBinderAlive() { 142 | return fallback.isBinderAlive(); 143 | } 144 | }; 145 | } 146 | } 147 | -------------------------------------------------------------------------------- /library/src/main/java/com/github/kr328/magic/services/ServiceManagerProxy.java: -------------------------------------------------------------------------------- 1 | package com.github.kr328.magic.services; 2 | 3 | import android.annotation.SuppressLint; 4 | import android.os.Binder; 5 | import android.os.IBinder; 6 | import android.os.IServiceManager; 7 | import android.os.ServiceManager; 8 | import android.util.Log; 9 | 10 | import androidx.annotation.NonNull; 11 | import androidx.annotation.Nullable; 12 | 13 | import java.lang.reflect.Field; 14 | import java.lang.reflect.InvocationHandler; 15 | import java.lang.reflect.InvocationTargetException; 16 | import java.lang.reflect.Method; 17 | import java.lang.reflect.Proxy; 18 | import java.util.Arrays; 19 | import java.util.function.BiFunction; 20 | 21 | @SuppressLint("DiscouragedPrivateApi") 22 | public class ServiceManagerProxy { 23 | private static final String TAG = "ServiceManagerProxy"; 24 | 25 | @Nullable 26 | private final BiFunction addServiceFilter; 27 | @Nullable 28 | private final BiFunction getServiceFilter; 29 | private boolean installed = false; 30 | 31 | private ServiceManagerProxy( 32 | @Nullable final BiFunction addServiceFilter, 33 | @Nullable final BiFunction getServiceFilter 34 | ) { 35 | this.addServiceFilter = addServiceFilter; 36 | this.getServiceFilter = getServiceFilter; 37 | } 38 | 39 | public static void install(@NonNull final Interceptor interceptor) throws ReflectiveOperationException { 40 | final Method mGetIServiceManager = ServiceManager.class.getDeclaredMethod("getIServiceManager"); 41 | final Field fSServiceManager = ServiceManager.class.getDeclaredField("sServiceManager"); 42 | 43 | mGetIServiceManager.setAccessible(true); 44 | fSServiceManager.setAccessible(true); 45 | 46 | final Object original = mGetIServiceManager.invoke(null); 47 | final InvocationHandler handler = (proxy, method, args) -> { 48 | if ("getService".equals(method.getName())) { 49 | if (args != null && 50 | args.length >= 1 && 51 | args[0] instanceof String && 52 | method.getReturnType().isAssignableFrom(IBinder.class) 53 | ) { 54 | try { 55 | return interceptor.getService( 56 | (String) args[0], 57 | (IBinder) method.invoke(original, args) 58 | ); 59 | } catch (final InvocationTargetException e) { 60 | throw e.getTargetException(); 61 | } catch (final Throwable throwable) { 62 | Log.e(TAG, "Handler: getService", throwable); 63 | } 64 | } 65 | } else if ("addService".equals(method.getName())) { 66 | if (args != null && 67 | args.length >= 2 && 68 | args[0] instanceof String && 69 | args[1] instanceof Binder 70 | ) { 71 | try { 72 | final Object[] newArgs = Arrays.copyOf(args, args.length); 73 | 74 | newArgs[1] = interceptor.addService((String) newArgs[0], (Binder) newArgs[1]); 75 | 76 | return method.invoke(original, newArgs); 77 | } catch (final InvocationTargetException e) { 78 | throw e.getTargetException(); 79 | } catch (final Throwable throwable) { 80 | Log.e(TAG, "Handler: addService", throwable); 81 | } 82 | } 83 | } 84 | 85 | try { 86 | return method.invoke(original, args); 87 | } catch (final InvocationTargetException e) { 88 | throw e.getTargetException(); 89 | } 90 | }; 91 | final Object proxy = Proxy.newProxyInstance( 92 | ServiceManagerProxy.class.getClassLoader(), 93 | new Class[]{IServiceManager.class}, 94 | handler 95 | ); 96 | 97 | fSServiceManager.set(null, proxy); 98 | } 99 | 100 | @NonNull 101 | private static ClassLoader getClassLoader() { 102 | final ClassLoader self = ServiceManagerProxy.class.getClassLoader(); 103 | if (self != null) { 104 | return self; 105 | } 106 | 107 | return ClassLoader.getSystemClassLoader(); 108 | } 109 | 110 | public synchronized void install() throws ReflectiveOperationException { 111 | if (installed) { 112 | return; 113 | } 114 | 115 | install(new Interceptor() { 116 | @Override 117 | @Nullable 118 | public IBinder getService(@NonNull final String name, final IBinder service) { 119 | if (getServiceFilter != null) { 120 | return getServiceFilter.apply(name, service); 121 | } 122 | 123 | return service; 124 | } 125 | 126 | @Override 127 | @Nullable 128 | public Binder addService(@NonNull final String name, final Binder service) { 129 | if (addServiceFilter != null) { 130 | return addServiceFilter.apply(name, service); 131 | } 132 | 133 | return service; 134 | } 135 | }); 136 | 137 | installed = true; 138 | } 139 | 140 | public synchronized void uninstall() throws ReflectiveOperationException { 141 | if (!installed) { 142 | return; 143 | } 144 | 145 | getClassLoader().loadClass("android.os.ServiceManager") 146 | .getDeclaredField("sServiceManager") 147 | .set(null, null); 148 | 149 | installed = false; 150 | } 151 | 152 | public abstract static class Interceptor { 153 | @Nullable 154 | public IBinder getService(@NonNull final String name, @Nullable final IBinder service) { 155 | return service; 156 | } 157 | 158 | @Nullable 159 | public Binder addService(@NonNull final String name, @Nullable final Binder service) { 160 | return service; 161 | } 162 | } 163 | 164 | public static final class Builder { 165 | @Nullable 166 | private BiFunction addServiceFilter; 167 | @Nullable 168 | private BiFunction getServiceFilter; 169 | 170 | @NonNull 171 | public Builder setAddServiceFilter(@Nullable final BiFunction func) { 172 | this.addServiceFilter = func; 173 | return this; 174 | } 175 | 176 | @NonNull 177 | public Builder setGetServiceFilter(@Nullable final BiFunction func) { 178 | this.getServiceFilter = func; 179 | return this; 180 | } 181 | 182 | @NonNull 183 | public ServiceManagerProxy build() { 184 | BiFunction add = addServiceFilter; 185 | BiFunction get = getServiceFilter; 186 | 187 | if (add == null) { 188 | add = (name, service) -> service; 189 | } 190 | 191 | if (get == null) { 192 | get = (name, service) -> service; 193 | } 194 | 195 | return new ServiceManagerProxy(add, get); 196 | } 197 | } 198 | } 199 | -------------------------------------------------------------------------------- /gradlew: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # 4 | # Copyright © 2015-2021 the original authors. 5 | # 6 | # Licensed under the Apache License, Version 2.0 (the "License"); 7 | # you may not use this file except in compliance with the License. 8 | # You may obtain a copy of the License at 9 | # 10 | # https://www.apache.org/licenses/LICENSE-2.0 11 | # 12 | # Unless required by applicable law or agreed to in writing, software 13 | # distributed under the License is distributed on an "AS IS" BASIS, 14 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 | # See the License for the specific language governing permissions and 16 | # limitations under the License. 17 | # 18 | 19 | ############################################################################## 20 | # 21 | # Gradle start up script for POSIX generated by Gradle. 22 | # 23 | # Important for running: 24 | # 25 | # (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is 26 | # noncompliant, but you have some other compliant shell such as ksh or 27 | # bash, then to run this script, type that shell name before the whole 28 | # command line, like: 29 | # 30 | # ksh Gradle 31 | # 32 | # Busybox and similar reduced shells will NOT work, because this script 33 | # requires all of these POSIX shell features: 34 | # * functions; 35 | # * expansions «$var», «${var}», «${var:-default}», «${var+SET}», 36 | # «${var#prefix}», «${var%suffix}», and «$( cmd )»; 37 | # * compound commands having a testable exit status, especially «case»; 38 | # * various built-in commands including «command», «set», and «ulimit». 39 | # 40 | # Important for patching: 41 | # 42 | # (2) This script targets any POSIX shell, so it avoids extensions provided 43 | # by Bash, Ksh, etc; in particular arrays are avoided. 44 | # 45 | # The "traditional" practice of packing multiple parameters into a 46 | # space-separated string is a well documented source of bugs and security 47 | # problems, so this is (mostly) avoided, by progressively accumulating 48 | # options in "$@", and eventually passing that to Java. 49 | # 50 | # Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS, 51 | # and GRADLE_OPTS) rely on word-splitting, this is performed explicitly; 52 | # see the in-line comments for details. 53 | # 54 | # There are tweaks for specific operating systems such as AIX, CygWin, 55 | # Darwin, MinGW, and NonStop. 56 | # 57 | # (3) This script is generated from the Groovy template 58 | # https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt 59 | # within the Gradle project. 60 | # 61 | # You can find Gradle at https://github.com/gradle/gradle/. 62 | # 63 | ############################################################################## 64 | 65 | # Attempt to set APP_HOME 66 | 67 | # Resolve links: $0 may be a link 68 | app_path=$0 69 | 70 | # Need this for daisy-chained symlinks. 71 | while 72 | APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path 73 | [ -h "$app_path" ] 74 | do 75 | ls=$( ls -ld "$app_path" ) 76 | link=${ls#*' -> '} 77 | case $link in #( 78 | /*) app_path=$link ;; #( 79 | *) app_path=$APP_HOME$link ;; 80 | esac 81 | done 82 | 83 | # This is normally unused 84 | # shellcheck disable=SC2034 85 | APP_BASE_NAME=${0##*/} 86 | # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036) 87 | APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit 88 | 89 | # Use the maximum available, or set MAX_FD != -1 to use that value. 90 | MAX_FD=maximum 91 | 92 | warn () { 93 | echo "$*" 94 | } >&2 95 | 96 | die () { 97 | echo 98 | echo "$*" 99 | echo 100 | exit 1 101 | } >&2 102 | 103 | # OS specific support (must be 'true' or 'false'). 104 | cygwin=false 105 | msys=false 106 | darwin=false 107 | nonstop=false 108 | case "$( uname )" in #( 109 | CYGWIN* ) cygwin=true ;; #( 110 | Darwin* ) darwin=true ;; #( 111 | MSYS* | MINGW* ) msys=true ;; #( 112 | NONSTOP* ) nonstop=true ;; 113 | esac 114 | 115 | CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar 116 | 117 | 118 | # Determine the Java command to use to start the JVM. 119 | if [ -n "$JAVA_HOME" ] ; then 120 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 121 | # IBM's JDK on AIX uses strange locations for the executables 122 | JAVACMD=$JAVA_HOME/jre/sh/java 123 | else 124 | JAVACMD=$JAVA_HOME/bin/java 125 | fi 126 | if [ ! -x "$JAVACMD" ] ; then 127 | die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME 128 | 129 | Please set the JAVA_HOME variable in your environment to match the 130 | location of your Java installation." 131 | fi 132 | else 133 | JAVACMD=java 134 | if ! command -v java >/dev/null 2>&1 135 | then 136 | die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 137 | 138 | Please set the JAVA_HOME variable in your environment to match the 139 | location of your Java installation." 140 | fi 141 | fi 142 | 143 | # Increase the maximum file descriptors if we can. 144 | if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then 145 | case $MAX_FD in #( 146 | max*) 147 | # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked. 148 | # shellcheck disable=SC3045 149 | MAX_FD=$( ulimit -H -n ) || 150 | warn "Could not query maximum file descriptor limit" 151 | esac 152 | case $MAX_FD in #( 153 | '' | soft) :;; #( 154 | *) 155 | # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked. 156 | # shellcheck disable=SC3045 157 | ulimit -n "$MAX_FD" || 158 | warn "Could not set maximum file descriptor limit to $MAX_FD" 159 | esac 160 | fi 161 | 162 | # Collect all arguments for the java command, stacking in reverse order: 163 | # * args from the command line 164 | # * the main class name 165 | # * -classpath 166 | # * -D...appname settings 167 | # * --module-path (only if needed) 168 | # * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. 169 | 170 | # For Cygwin or MSYS, switch paths to Windows format before running java 171 | if "$cygwin" || "$msys" ; then 172 | APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) 173 | CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) 174 | 175 | JAVACMD=$( cygpath --unix "$JAVACMD" ) 176 | 177 | # Now convert the arguments - kludge to limit ourselves to /bin/sh 178 | for arg do 179 | if 180 | case $arg in #( 181 | -*) false ;; # don't mess with options #( 182 | /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath 183 | [ -e "$t" ] ;; #( 184 | *) false ;; 185 | esac 186 | then 187 | arg=$( cygpath --path --ignore --mixed "$arg" ) 188 | fi 189 | # Roll the args list around exactly as many times as the number of 190 | # args, so each arg winds up back in the position where it started, but 191 | # possibly modified. 192 | # 193 | # NB: a `for` loop captures its iteration list before it begins, so 194 | # changing the positional parameters here affects neither the number of 195 | # iterations, nor the values presented in `arg`. 196 | shift # remove old arg 197 | set -- "$@" "$arg" # push replacement arg 198 | done 199 | fi 200 | 201 | 202 | # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 203 | DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' 204 | 205 | # Collect all arguments for the java command; 206 | # * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of 207 | # shell script including quotes and variable substitutions, so put them in 208 | # double quotes to make sure that they get re-expanded; and 209 | # * put everything else in single quotes, so that it's not re-expanded. 210 | 211 | set -- \ 212 | "-Dorg.gradle.appname=$APP_BASE_NAME" \ 213 | -classpath "$CLASSPATH" \ 214 | org.gradle.wrapper.GradleWrapperMain \ 215 | "$@" 216 | 217 | # Stop when "xargs" is not available. 218 | if ! command -v xargs >/dev/null 2>&1 219 | then 220 | die "xargs is not available" 221 | fi 222 | 223 | # Use "xargs" to parse quoted args. 224 | # 225 | # With -n1 it outputs one arg per line, with the quotes and backslashes removed. 226 | # 227 | # In Bash we could simply go: 228 | # 229 | # readarray ARGS < <( xargs -n1 <<<"$var" ) && 230 | # set -- "${ARGS[@]}" "$@" 231 | # 232 | # but POSIX shell has neither arrays nor command substitution, so instead we 233 | # post-process each arg (as a line of input to sed) to backslash-escape any 234 | # character that might be a shell metacharacter, then use eval to reverse 235 | # that process (while maintaining the separation between arguments), and wrap 236 | # the whole thing up as a single "set" statement. 237 | # 238 | # This will of course break if any of these variables contains a newline or 239 | # an unmatched quote. 240 | # 241 | 242 | eval "set -- $( 243 | printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | 244 | xargs -n1 | 245 | sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | 246 | tr '\n' ' ' 247 | )" '"$@"' 248 | 249 | exec "$JAVACMD" "$@" 250 | --------------------------------------------------------------------------------