Skip to content

Commit 34a1213

Browse files
authored
fix permission signature check bypass on android 16 (#129)
1 parent ad3f49d commit 34a1213

1 file changed

Lines changed: 13 additions & 1 deletion

File tree

app/src/main/java/toolkit/coderstory/CorePatchForR.java

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,19 @@ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
262262
hookAllMethods(keySetManagerClass, "shouldCheckUpgradeKeySetLocked", new XC_MethodHook() {
263263
@Override
264264
protected void afterHookedMethod(MethodHookParam param) {
265-
if (prefs.getBoolean("digestCreak", true) && Arrays.stream(Thread.currentThread().getStackTrace()).anyMatch((o) -> "preparePackageLI".equals(o.getMethodName()))) {
265+
// 检查权限定义的签名的时候,如果定义包名相同,会使用 KeySetManagerService ,
266+
// 我们利用这一点让它通过检查,也就是同包不同签名权限可覆盖
267+
// R-Sv2: PackageManagerService#preparePackageLI
268+
// https://cs.android.com/android/platform/superproject/+/android-11.0.0_r21:frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java;l=17188;drc=960ffca13a519b0fb9e0942665577c62f97d0eea
269+
// T-V: InstallPackageHelper#preparePackageLI
270+
// https://cs.android.com/android/platform/superproject/+/android-14.0.0_r2:frameworks/base/services/core/java/com/android/server/pm/InstallPackageHelper.java;l=1097;drc=5ea7e53c3a787e25af86b0f31933ddd68ae3514e
271+
// 16: InstallPackageHelper#preparePackage
272+
// https://cs.android.com/android/platform/superproject/+/android-16.0.0_r2:frameworks/base/services/core/java/com/android/server/pm/InstallPackageHelper.java;l=1459;drc=d14620262929e39a409b55d11cb542c1d1c4d2f6
273+
if (prefs.getBoolean("digestCreak", true) &&
274+
Arrays.stream(Thread.currentThread().getStackTrace())
275+
.anyMatch((o) -> o.getMethodName().startsWith("preparePackage")
276+
)
277+
) {
266278
shouldBypass.set(true);
267279
param.setResult(true);
268280
} else {

0 commit comments

Comments
 (0)