android-hacker · xiaofanqingzjj · Oct 24, 2024
diff --git a/VirtualApp/app/src/aosp/java/io/virtualapp/delegate/MyVirtualInitializer.java b/VirtualApp/app/src/aosp/java/io/virtualapp/delegate/MyVirtualInitializer.java
@@ -3,6 +3,9 @@
 import android.app.Application;
 
 import com.lody.virtual.client.core.VirtualCore;
+import com.lody.virtual.client.hook.proxies.view.AutoFillManagerStub;
+import com.lody.virtual.helper.compat.BuildCompat;
+import com.lody.virtual.helper.utils.VLog;
 import com.microsoft.appcenter.AppCenter;
 import com.microsoft.appcenter.analytics.Analytics;
 import com.microsoft.appcenter.crashes.Crashes;
@@ -12,6 +15,9 @@
  * @date 2019/2/25.
  */
 public class MyVirtualInitializer extends BaseVirtualInitializer {
+
+    static final String TAG = "MyVirtualInitializer";
+
     public MyVirtualInitializer(Application application, VirtualCore core) {
         super(application, core);
     }
@@ -34,5 +40,21 @@ public void onVirtualProcess() {
 
         // Override
         virtualCore.setCrashHandler(new MyCrashHandler());
+
+
+        if (BuildCompat.isOreo()) {
+            // Android 13以上的版本在attachBaseContext里注入这个对象会报错，所以挪到这里来
+            try {
+                new AutoFillManagerStub().inject();
+            } catch (Throwable e) {
+                VLog.w(TAG, "AutoFillManagerStub inject error",e );
+            }
+        }
+
+    }
+
+    @Override
+    public void onChildProcess() {
+        super.onChildProcess();
     }
 }
diff --git a/VirtualApp/lib/src/main/java/android/app/ClientTransactionHandler.java b/VirtualApp/lib/src/main/java/android/app/ClientTransactionHandler.java
@@ -172,6 +172,11 @@ public abstract void handleAttachSplashScreenView(ActivityThread.ActivityClientR
     /** Perform activity launch. */
     public abstract Activity handleLaunchActivity(ActivityThread.ActivityClientRecord r,
             PendingTransactionActions pendingActions, Intent customIntent);
+
+    // Android 13
+    public abstract Activity handleLaunchActivity( ActivityThread.ActivityClientRecord r,
+              PendingTransactionActions pendingActions, int deviceId, Intent customIntent);
+
     /** Perform activity start. */
     public abstract void handleStartActivity(ActivityThread.ActivityClientRecord r,
             PendingTransactionActions pendingActions);
@@ -184,6 +189,10 @@ public abstract void handleStartActivity(ActivityThread.ActivityClientRecord r,
     // Android 11
     public abstract void handleStartActivity(IBinder binder,
                                              PendingTransactionActions pendingActions);
+
+    // Android 14
+    public abstract LoadedApk getPackageInfoNoCheck(ApplicationInfo ai);
+
     /** Get package info. */
     public abstract LoadedApk getPackageInfoNoCheck(ApplicationInfo ai,
                                                     CompatibilityInfo compatInfo);

diff --git a/VirtualApp/lib/src/main/java/android/app/TransactionHandlerProxy.java b/VirtualApp/lib/src/main/java/android/app/TransactionHandlerProxy.java
@@ -9,6 +9,7 @@
 import android.content.pm.ApplicationInfo;
 import android.content.res.CompatibilityInfo;
 import android.content.res.Configuration;
+import android.os.Build;
 import android.os.IBinder;
 import android.os.Parcelable;
 import android.util.Log;
@@ -49,6 +50,11 @@ TransactionExecutor getTransactionExecutor() {
         return originalHandler.getTransactionExecutor();
     }
 
+    /** Get package info. */
+    public  LoadedApk getPackageInfoNoCheck(ApplicationInfo ai) {
+        return originalHandler.getPackageInfoNoCheck(ai);
+    }
+
     @Override
     void sendMessage(int what, Object obj) {
         originalHandler.sendMessage(what, obj);
@@ -194,8 +200,16 @@ public void handleWindowVisibility(IBinder token, boolean show) {
         originalHandler.handleWindowVisibility(token, show);
     }
 
+
+    public Activity handleLaunchActivity( ActivityThread.ActivityClientRecord r,
+                                                   PendingTransactionActions pendingActions,  Intent customIntent) {
+        return handleLaunchActivity(r, pendingActions, 0, customIntent);
+    }
+
+
+    // Android 13
     @Override
-    public Activity handleLaunchActivity(ActivityClientRecord r, PendingTransactionActions pendingActions, Intent customIntent) {
+    public Activity handleLaunchActivity(ActivityClientRecord r, PendingTransactionActions pendingActions, int deviceId, Intent customIntent) {
 
         Intent stubIntent = mirror.android.app.ActivityThread.ActivityClientRecord.intent.get(r);
         StubActivityRecord saveInstance = new StubActivityRecord(stubIntent);
@@ -216,13 +230,13 @@ public Activity handleLaunchActivity(ActivityClientRecord r, PendingTransactionA
             VActivityManager.get().processRestarted(info.packageName, info.processName, saveInstance.userId);
             // getH().sendMessageAtFrontOfQueue(Message.obtain(msg));
             Log.i(TAG, "restart process, return");
-            return handleLaunchActivity(r, pendingActions, customIntent);
+            return handleLaunchActivity(r, pendingActions, deviceId, customIntent);
         }
         if (!VClientImpl.get().isBound()) {
             VClientImpl.get().bindApplicationForActivity(info.packageName, info.processName, intent);
             // getH().sendMessageAtFrontOfQueue(Message.obtain(msg));
             Log.i(TAG, "rebound application, return");
-            return handleLaunchActivity(r, pendingActions, customIntent);
+            return handleLaunchActivity(r, pendingActions, deviceId, customIntent);
         }
         int taskId = IActivityManager.getTaskForActivity.call(
                 ActivityManagerNative.getDefault.call(),
@@ -240,7 +254,12 @@ public Activity handleLaunchActivity(ActivityClientRecord r, PendingTransactionA
         mirror.android.app.ActivityThread.ActivityClientRecord.intent.set(r, intent);
         mirror.android.app.ActivityThread.ActivityClientRecord.activityInfo.set(r, info);
 
-        return originalHandler.handleLaunchActivity(r, pendingActions, customIntent);
+        if (Build.VERSION.SDK_INT >= 34) {
+            return originalHandler.handleLaunchActivity(r, pendingActions, deviceId, customIntent);
+        } else {
+            return originalHandler.handleLaunchActivity(r, pendingActions, customIntent);
+        }
+
     }
 
     @Override

diff --git a/VirtualApp/lib/src/main/java/android/content/pm/SigningDetails.java b/VirtualApp/lib/src/main/java/android/content/pm/SigningDetails.java
@@ -0,0 +1,4 @@
+package android.content.pm;
+
+public class SigningDetails {
+}
diff --git a/VirtualApp/lib/src/main/java/android/os/UserHandle.java b/VirtualApp/lib/src/main/java/android/os/UserHandle.java
@@ -0,0 +1,4 @@
+package android.os;
+
+public class UserHandle {
+}
diff --git a/VirtualApp/lib/src/main/java/android/os/storage/StorageVolume.java b/VirtualApp/lib/src/main/java/android/os/storage/StorageVolume.java
@@ -0,0 +1,4 @@
+package android.os.storage;
+
+public class StorageVolume {
+}
diff --git a/VirtualApp/lib/src/main/java/com/lody/virtual/client/VClientImpl.java b/VirtualApp/lib/src/main/java/com/lody/virtual/client/VClientImpl.java
@@ -255,19 +255,23 @@ private void bindApplicationNoCheck(String packageName, String processName, Cond
                 null
         );
         AppBindData data = new AppBindData();
+
         InstalledAppInfo info = VirtualCore.get().getInstalledAppInfo(packageName, 0);
         if (info == null) {
             new Exception("App not exist!").printStackTrace();
             Process.killProcess(0);
             System.exit(0);
         }
+        VLog.d(TAG, "bindApplicationNoCheck getInstalledAppInfo:" + info);
         data.appInfo = VPackageManager.get().getApplicationInfo(packageName, 0, getUserId(vuid));
         data.processName = processName;
         data.appInfo.processName = processName;
         data.providers = VPackageManager.get().queryContentProviders(processName, getVUid(), PackageManager.GET_META_DATA);
         VLog.i(TAG, String.format("Binding application %s, (%s)", data.appInfo.packageName, data.processName));
         mBoundApplication = data;
+
         VirtualRuntime.setupRuntime(data.processName, data.appInfo);
+
         int targetSdkVersion = data.appInfo.targetSdkVersion;
         if (targetSdkVersion < Build.VERSION_CODES.GINGERBREAD) {
             StrictMode.ThreadPolicy newPolicy = new StrictMode.ThreadPolicy.Builder(StrictMode.getThreadPolicy()).permitNetwork().build();
@@ -282,22 +286,23 @@ private void bindApplicationNoCheck(String packageName, String processName, Cond
         NativeEngine.launchEngine();
         Object mainThread = VirtualCore.mainThread();
         NativeEngine.startDexOverride();
-        Context context = createPackageContext(data.appInfo.packageName);
+
+        Context appContext = createPackageContext(data.appInfo.packageName);
         try {
             // anti-virus, fuck ESET-NOD32: a variant of Android/AdDisplay.AdLock.AL potentially unwanted
             // we can make direct call... use reflect to bypass.
             // System.setProperty("java.io.tmpdir", context.getCacheDir().getAbsolutePath());
             System.class.getDeclaredMethod("setProperty", String.class, String.class)
-                    .invoke(null, "java.io.tmpdir", context.getCacheDir().getAbsolutePath());
+                    .invoke(null, "java.io.tmpdir", appContext.getCacheDir().getAbsolutePath());
         } catch (Throwable ignored) {
             VLog.e(TAG, "set tmp dir error:", ignored);
         }
 
         File codeCacheDir;
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-            codeCacheDir = context.getCodeCacheDir();
+            codeCacheDir = appContext.getCodeCacheDir();
         } else {
-            codeCacheDir = context.getCacheDir();
+            codeCacheDir = appContext.getCacheDir();
         }
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
             if (HardwareRenderer.setupDiskCache != null) {
@@ -318,7 +323,8 @@ private void bindApplicationNoCheck(String packageName, String processName, Cond
             }
         }
         Object boundApp = fixBoundApp(mBoundApplication);
-        mBoundApplication.info = ContextImpl.mPackageInfo.get(context);
+        mBoundApplication.info = ContextImpl.mPackageInfo.get(appContext);
+
         mirror.android.app.ActivityThread.AppBindData.info.set(boundApp, data.info);
         VMRuntime.setTargetSdkVersion.call(VMRuntime.getRuntime.call(), data.appInfo.targetSdkVersion);
 
@@ -336,23 +342,37 @@ private void bindApplicationNoCheck(String packageName, String processName, Cond
         boolean enableXposed = VirtualCore.get().isXposedEnabled();
         if (enableXposed) {
             VLog.i(TAG, "Xposed is enabled.");
-            ClassLoader originClassLoader = context.getClassLoader();
-            ExposedBridge.initOnce(context, data.appInfo, originClassLoader);
-            List<InstalledAppInfo> modules = VirtualCore.get().getInstalledApps(0);
-            for (InstalledAppInfo module : modules) {
-                ExposedBridge.loadModule(module.apkPath, module.getOdexFile().getParent(), module.libPath,
-                        data.appInfo, originClassLoader);
+
+            // 内部报错：java.lang.ClassNotFoundException: Didn't find class "androidx.core.app.CoreComponentFactory" on path: DexPathList[[zip file "/data/user/0/io.va.exposed64/virtual/data/app/com.laolaiwangtech/base.apk"],nativeLibraryDirectories=[/data/user/0/io.va.exposed64/virtual/data/app/com.laolaiwangtech/lib, /data/user/0/io.va.exposed64/virtual/data/app/com.laolaiwangtech/base.apk!/lib/arm64-v8a, /system/lib64, /product_h/lib64, /system_ext/lib64]]
+
+            ClassLoader originClassLoader = null;
+            try {
+                originClassLoader = appContext.getClassLoader();
+            } catch (Exception e) {
+                VLog.w(TAG, "appContext.getClassLoader() error", e);
+            }
+            if (originClassLoader !=null) {
+                ExposedBridge.initOnce(appContext, data.appInfo, originClassLoader);
+
+                List<InstalledAppInfo> modules = VirtualCore.get().getInstalledApps(0);
+                for (InstalledAppInfo module : modules) {
+                    ExposedBridge.loadModule(module.apkPath, module.getOdexFile().getParent(), module.libPath,
+                            data.appInfo, originClassLoader);
+                }
             }
         } else {
             VLog.w(TAG, "Xposed is disable..");
         }
 
+
+
         ClassLoader cl = LoadedApk.getClassLoader.call(data.info);
         if (BuildCompat.isS()) {
             ClassLoader parent = cl.getParent();
             Reflect.on(cl).set("parent", new DelegateLastClassLoader("/system/framework/android.test.base.jar", parent));
         }
 
+
         if (Build.VERSION.SDK_INT >= 30)
             ApplicationConfig.setDefaultInstance.call(new Object[] { null });
         mInitialApplication = LoadedApk.makeApplication.call(data.info, false, null);
@@ -509,7 +529,7 @@ private void setupVirtualStorage(ApplicationInfo info, int userId) {
         }
 
         HashSet<String> storageRoots = getMountPoints();
-        storageRoots.add(Environment.getExternalStorageDirectory().getAbsolutePath());
+        storageRoots.add(VEnvironment.getExternalStorageDirectory().getAbsolutePath());
 
         Set<String> whiteList = new HashSet<>();
         whiteList.add(Environment.DIRECTORY_PODCASTS);
@@ -531,7 +551,7 @@ private void setupVirtualStorage(ApplicationInfo info, int userId) {
 
         // ensure virtual storage white directory exists.
         for (String whiteDir : whiteList) {
-            File originalDir = new File(Environment.getExternalStorageDirectory(), whiteDir);
+            File originalDir = new File(VEnvironment.getExternalStorageDirectory(), whiteDir);
             File virtualDir = new File(vsDir, whiteDir);
             if (!originalDir.exists()) {
                 continue;

diff --git a/VirtualApp/lib/src/main/java/com/lody/virtual/client/core/InvocationStubManager.java b/VirtualApp/lib/src/main/java/com/lody/virtual/client/core/InvocationStubManager.java
@@ -1,5 +1,13 @@
 package com.lody.virtual.client.core;
 
+import static android.os.Build.VERSION_CODES.JELLY_BEAN_MR1;
+import static android.os.Build.VERSION_CODES.JELLY_BEAN_MR2;
+import static android.os.Build.VERSION_CODES.KITKAT;
+import static android.os.Build.VERSION_CODES.LOLLIPOP;
+import static android.os.Build.VERSION_CODES.LOLLIPOP_MR1;
+import static android.os.Build.VERSION_CODES.M;
+import static android.os.Build.VERSION_CODES.N;
+
 import android.os.Build;
 
 import com.lody.virtual.client.hook.base.MethodInvocationProxy;
@@ -62,14 +70,6 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import static android.os.Build.VERSION_CODES.JELLY_BEAN_MR1;
-import static android.os.Build.VERSION_CODES.JELLY_BEAN_MR2;
-import static android.os.Build.VERSION_CODES.KITKAT;
-import static android.os.Build.VERSION_CODES.LOLLIPOP;
-import static android.os.Build.VERSION_CODES.LOLLIPOP_MR1;
-import static android.os.Build.VERSION_CODES.M;
-import static android.os.Build.VERSION_CODES.N;
-
 /**
  * @author Lody
  *
@@ -111,6 +111,7 @@ public void init() throws Throwable {
 		injectInternal();
 		sInit = true;
 
+
 	}
 
 	private void injectInternal() throws Throwable {
@@ -192,9 +193,12 @@ private void injectInternal() throws Throwable {
 
                 addInjector(new BatteryStatsStub());
             }
-            if (BuildCompat.isOreo()) {
-				addInjector(new AutoFillManagerStub());
-			}
+
+			// After Android 13, this will throw java.lang.NullPointerException: Attempt to invoke virtual method 'android.content.ContentResolver android.app.Application.getContentResolver()' on a null object reference
+			// move in application onCreate
+//            if (BuildCompat.isOreo()) {
+//				addInjector(new AutoFillManagerStub());
+//			}
             if (BuildCompat.isQ()) {
             	addInjector(new ActivityTaskManagerStub());
 

diff --git a/VirtualApp/lib/src/main/java/com/lody/virtual/client/env/SpecialComponentList.java b/VirtualApp/lib/src/main/java/com/lody/virtual/client/env/SpecialComponentList.java
@@ -7,6 +7,7 @@
 import android.os.Build;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -124,9 +125,18 @@ public static void addBlackAction(String action) {
         ACTION_BLACK_LIST.add(action);
     }
 
+    private static List<String> toList(Object actionsObj) {
+        List<String> actions = new ArrayList<>();
+        if (actionsObj instanceof Collection) {
+            actions.addAll((Collection<String>) actionsObj);
+        }
+        return  actions;
+    }
+
     public static void protectIntentFilter(IntentFilter filter) {
         if (filter != null) {
-            List<String> actions = mirror.android.content.IntentFilter.mActions.get(filter);
+            // 13以后这里返回的是set, 做个兼容
+            List<String> actions = toList(mirror.android.content.IntentFilter.mActions.get(filter));
             ListIterator<String> iterator = actions.listIterator();
             while (iterator.hasNext()) {
                 String action = iterator.next();