{\n let path = Path::new(defs::METAMODULE_DIR);\n\n // Check if symlink exists and resolve it\n if path.is_symlink()\n && let Ok(target) = std::fs::read_link(path)\n {\n // If target is relative, resolve it\n let resolved = if target.is_absolute() {\n target\n } else {\n path.parent()?.join(target)\n };\n\n if resolved.exists() && resolved.is_dir() {\n return Some(resolved);\n }\n warn!(\n \"Metamodule symlink points to non-existent path: {}\",\n resolved.display()\n );\n }\n\n // Fallback: search for metamodule=1 in modules directory\n let mut result = None;\n let _ = crate::module::foreach_module(All, |module_path| {\n if let Ok(props) = crate::module::read_module_prop(module_path)\n && is_metamodule(&props)\n {\n info!(\n \"Found metamodule in modules directory: {}\",\n module_path.display()\n );\n result = Some(module_path.to_path_buf());\n }\n Ok(())\n });\n\n result\n}\n\n/// Check if metamodule exists\npub fn has_metamodule() -> bool {\n get_metamodule_path().is_some()\n}\n\n/// Check if it's safe to install a regular module\n/// Returns Ok(()) if safe, Err(is_disabled) if blocked\n/// - Err(true) means metamodule is disabled\n/// - Err(false) means metamodule is in other unstable state\npub fn check_install_safety() -> Result<(), bool> {\n // No metamodule → safe\n let Some(metamodule_path) = get_metamodule_path() else {\n return Ok(());\n };\n\n // No metainstall.sh → safe (uses default installer)\n // The staged update directory may contain the latest scripts, so check both locations\n let has_metainstall = metamodule_path\n .join(defs::METAMODULE_METAINSTALL_SCRIPT)\n .exists()\n || metamodule_path.file_name().is_some_and(|module_id| {\n Path::new(defs::MODULE_UPDATE_DIR)\n .join(module_id)\n .join(defs::METAMODULE_METAINSTALL_SCRIPT)\n .exists()\n });\n if !has_metainstall {\n return Ok(());\n }\n\n // Check for marker files\n let has_update = metamodule_path.join(defs::UPDATE_FILE_NAME).exists();\n let has_remove = metamodule_path.join(defs::REMOVE_FILE_NAME).exists();\n let has_disable = metamodule_path.join(defs::DISABLE_FILE_NAME).exists();\n\n // Stable state (no markers) → safe\n if !has_update && !has_remove && !has_disable {\n return Ok(());\n }\n\n // Return true if disabled, false for other unstable states\n Err(has_disable && !has_update && !has_remove)\n}\n\n/// Create or update the metamodule symlink\n/// Points /data/adb/metamodule -> /data/adb/modules/{module_id}\npub fn ensure_symlink(module_path: P) -> Result<()>\nwhere\n P: AsRef,\n{\n // METAMODULE_DIR might have trailing slash, so we need to trim it\n let symlink_path = Path::new(defs::METAMODULE_DIR.trim_end_matches('/'));\n let module_path = module_path.as_ref();\n\n info!(\n \"Creating metamodule symlink: {} -> {}\",\n symlink_path.display(),\n module_path.display()\n );\n\n // Remove existing symlink if it exists\n if symlink_path.exists() || symlink_path.is_symlink() {\n info!(\"Removing old metamodule symlink/path\");\n if symlink_path.is_symlink() {\n std::fs::remove_file(symlink_path).with_context(|| \"Failed to remove old symlink\")?;\n } else {\n // Could be a directory, remove it\n std::fs::remove_dir_all(symlink_path)\n .with_context(|| \"Failed to remove old directory\")?;\n }\n }\n\n // Create symlink\n #[cfg(unix)]\n std::os::unix::fs::symlink(module_path, symlink_path)\n .with_context(|| format!(\"Failed to create symlink to {}\", module_path.display()))?;\n\n info!(\"Metamodule symlink created successfully\");\n Ok(())\n}\n\n/// Remove the metamodule symlink\npub fn remove_symlink() -> Result<()> {\n let symlink_path = Path::new(defs::METAMODULE_DIR.trim_end_matches('/'));\n\n if symlink_path.is_symlink() {\n std::fs::remove_file(symlink_path)\n .with_context(|| \"Failed to remove metamodule symlink\")?;\n info!(\"Metamodule symlink removed\");\n }\n\n Ok(())\n}\n\n/// Get the install script content, using metainstall.sh from metamodule if available\n/// Returns the script content to be executed\npub fn get_install_script(\n is_metamodule: bool,\n installer_content: &str,\n install_module_script: &str,\n) -> Result {\n // Check if there's a metamodule with metainstall.sh\n // Only apply this logic for regular modules (not when installing metamodule itself)\n let install_script = if is_metamodule {\n info!(\"Installing metamodule, using default installer\");\n install_module_script.to_string()\n } else if let Some(metamodule_path) = get_metamodule_path() {\n if metamodule_path.join(defs::DISABLE_FILE_NAME).exists() {\n info!(\"Metamodule is disabled, using default installer\");\n install_module_script.to_string()\n } else {\n let metainstall_path = metamodule_path.join(defs::METAMODULE_METAINSTALL_SCRIPT);\n\n if metainstall_path.exists() {\n info!(\"Using metainstall.sh from metamodule\");\n let metamodule_content = std::fs::read_to_string(&metainstall_path)\n .with_context(|| \"Failed to read metamodule metainstall.sh\")?;\n format!(\"{installer_content}\\n{metamodule_content}\\nexit 0\\n\")\n } else {\n info!(\"Metamodule exists but has no metainstall.sh, using default installer\");\n install_module_script.to_string()\n }\n }\n } else {\n info!(\"No metamodule found, using default installer\");\n install_module_script.to_string()\n };\n\n Ok(install_script)\n}\n\n/// Check if metamodule script exists and is ready to execute\n/// Returns None if metamodule doesn't exist, is disabled, or script is missing\n/// Returns Some(script_path) if script is ready to execute\nfn check_metamodule_script(script_name: &str) -> Option {\n // Check if metamodule exists\n let metamodule_path = get_metamodule_path()?;\n\n // Check if metamodule is disabled\n if metamodule_path.join(defs::DISABLE_FILE_NAME).exists() {\n info!(\"Metamodule is disabled, skipping {script_name}\");\n return None;\n }\n\n // Check if script exists\n let script_path = metamodule_path.join(script_name);\n if !script_path.exists() {\n return None;\n }\n\n Some(script_path)\n}\n\n/// Execute metamodule's metauninstall.sh for a specific module\npub fn exec_metauninstall_script(module_id: &str) -> Result<()> {\n let Some(metauninstall_path) = check_metamodule_script(defs::METAMODULE_METAUNINSTALL_SCRIPT)\n else {\n return Ok(());\n };\n\n info!(\"Executing metamodule metauninstall.sh for module: {module_id}\",);\n\n let result = Command::new(assets::BUSYBOX_PATH)\n .args([\"sh\", metauninstall_path.to_str().unwrap()])\n .current_dir(metauninstall_path.parent().unwrap())\n .envs(crate::module::get_common_script_envs())\n .env(\"MODULE_ID\", module_id)\n .status()?;\n\n ensure!(\n result.success(),\n \"Metamodule metauninstall.sh failed for module {module_id}: {:?}\",\n result\n );\n\n info!(\"Metamodule metauninstall.sh executed successfully for {module_id}\",);\n Ok(())\n}\n\n/// Execute metamodule mount script\npub fn exec_mount_script(module_dir: &str) -> Result<()> {\n let Some(mount_script) = check_metamodule_script(defs::METAMODULE_MOUNT_SCRIPT) else {\n return Ok(());\n };\n\n info!(\"Executing mount script for metamodule\");\n\n let result = Command::new(assets::BUSYBOX_PATH)\n .args([\"sh\", mount_script.to_str().unwrap()])\n .envs(crate::module::get_common_script_envs())\n .env(\"MODULE_DIR\", module_dir)\n .status()?;\n\n ensure!(\n result.success(),\n \"Metamodule mount script failed with status: {:?}\",\n result\n );\n\n info!(\"Metamodule mount script executed successfully\");\n Ok(())\n}\n\n/// Execute metamodule script for a specific stage\npub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {\n let Some(script_path) = check_metamodule_script(&format!(\"{stage}.sh\")) else {\n return Ok(());\n };\n\n info!(\"Executing metamodule {stage}.sh\");\n crate::module::exec_script(&script_path, block)?;\n info!(\"Metamodule {stage}.sh executed successfully\");\n Ok(())\n}\n"
},
{
"path": "apd/src/module.rs",
"content": "#[cfg(unix)]\nuse std::os::unix::{prelude::PermissionsExt, process::CommandExt};\nuse std::{\n collections::HashMap,\n env::var as env_var,\n fs::{self, remove_dir_all},\n io::Cursor,\n path::{Path, PathBuf},\n process::Command,\n str::FromStr,\n};\n\nuse crate::lua;\nuse anyhow::{Context, Result, anyhow, bail, ensure};\nuse const_format::concatcp;\nuse is_executable::is_executable;\nuse java_properties::PropertiesIter;\nuse log::{info, warn};\nuse zip_extensions::zip_extract_file_to_memory;\n\n#[allow(clippy::wildcard_imports)]\nuse crate::utils::*;\nuse crate::{\n assets,\n defs::{self, MODULE_DIR, MODULE_UPDATE_DIR},\n metamodule, restorecon,\n};\n\nconst INSTALLER_CONTENT: &str = include_str!(\"./installer.sh\");\nconst INSTALL_MODULE_SCRIPT: &str = concatcp!(\n INSTALLER_CONTENT,\n \"\\n\",\n \"install_module\",\n \"\\n\",\n \"exit 0\",\n \"\\n\"\n);\n\n#[derive(PartialEq, Eq)]\npub enum ModuleType {\n All,\n Active,\n Updated,\n}\n\nfn exec_install_script(module_file: &str, is_metamodule: bool) -> Result<()> {\n let realpath = std::fs::canonicalize(module_file)\n .with_context(|| format!(\"realpath: {module_file} failed\"))?;\n\n // Get install script from metamodule module\n let install_script =\n metamodule::get_install_script(is_metamodule, INSTALLER_CONTENT, INSTALL_MODULE_SCRIPT)?;\n\n let result = Command::new(assets::BUSYBOX_PATH)\n .args([\"sh\", \"-c\", &install_script])\n .envs(get_common_script_envs())\n .env(\"OUTFD\", \"1\")\n .env(\"ZIPFILE\", realpath)\n .status()?;\n ensure!(result.success(), \"Failed to install module script\");\n Ok(())\n}\n\npub fn handle_updated_modules() -> Result<()> {\n let modules_root = Path::new(MODULE_DIR);\n foreach_module(ModuleType::Updated, |updated_module| {\n if !updated_module.is_dir() {\n return Ok(());\n }\n\n if let Some(name) = updated_module.file_name() {\n let module_dir = modules_root.join(name);\n let mut disabled = false;\n let mut removed = false;\n if module_dir.exists() {\n // If the old module is disabled, we need to also disable the new one\n disabled = module_dir.join(defs::DISABLE_FILE_NAME).exists();\n removed = module_dir.join(defs::REMOVE_FILE_NAME).exists();\n remove_dir_all(&module_dir)?;\n }\n std::fs::rename(updated_module, &module_dir)?;\n if removed {\n let path = module_dir.join(defs::REMOVE_FILE_NAME);\n if let Err(e) = ensure_file_exists(&path) {\n warn!(\"Failed to create {}: {e}\", path.display());\n }\n } else if disabled {\n let path = module_dir.join(defs::DISABLE_FILE_NAME);\n if let Err(e) = ensure_file_exists(&path) {\n warn!(\"Failed to create {}: {e}\", path.display());\n }\n }\n }\n Ok(())\n })?;\n Ok(())\n}\n\n/// Get common environment variables for script execution\npub fn get_common_script_envs() -> Vec<(&'static str, String)> {\n vec![\n (\"ASH_STANDALONE\", \"1\".to_string()),\n (\"APATCH\", \"true\".to_string()),\n (\"APATCH_VER\", defs::VERSION_NAME.to_string()),\n (\"APATCH_VER_CODE\", defs::VERSION_CODE.to_string()),\n (\n \"PATH\",\n format!(\n \"{}:{}\",\n env_var(\"PATH\").unwrap_or_default(),\n defs::BINARY_DIR.trim_end_matches('/')\n ),\n ),\n ]\n}\n\n// because we use something like A-B update\n// we need to update the module state after the boot_completed\n// if someone(such as the module) install a module before the boot_completed\n// then it may cause some problems, just forbid it\nfn ensure_boot_completed() -> Result<()> {\n // ensure getprop sys.boot_completed == 1\n if getprop(\"sys.boot_completed\").as_deref() != Some(\"1\") {\n bail!(\"Android is Booting!\");\n }\n Ok(())\n}\n\nfn mark_update() -> Result<()> {\n ensure_file_exists(concatcp!(defs::WORKING_DIR, defs::UPDATE_FILE_NAME))\n}\n\nfn mark_module_state(module: &str, flag_file: &str, create_or_delete: bool) -> Result<()> {\n let module_state_file = Path::new(defs::MODULE_DIR).join(module).join(flag_file);\n if create_or_delete {\n ensure_file_exists(module_state_file)\n } else {\n if module_state_file.exists() {\n fs::remove_file(module_state_file)?;\n }\n Ok(())\n }\n}\npub fn foreach_module(\n module_type: ModuleType,\n mut f: impl FnMut(&Path) -> Result<()>,\n) -> Result<()> {\n let modules_dir = Path::new(match module_type {\n ModuleType::Updated => MODULE_UPDATE_DIR,\n _ => defs::MODULE_DIR,\n });\n let dir = std::fs::read_dir(modules_dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n if !path.is_dir() {\n warn!(\"{} is not a directory, skip\", path.display());\n continue;\n }\n\n if module_type == ModuleType::Active && path.join(defs::DISABLE_FILE_NAME).exists() {\n info!(\"{} is disabled, skip\", path.display());\n continue;\n }\n if module_type == ModuleType::Active && path.join(defs::REMOVE_FILE_NAME).exists() {\n warn!(\"{} is removed, skip\", path.display());\n continue;\n }\n\n f(&path)?;\n }\n\n Ok(())\n}\n\nfn foreach_active_module(f: impl FnMut(&Path) -> Result<()>) -> Result<()> {\n foreach_module(ModuleType::Active, f)\n}\n\npub fn load_sepolicy_rule() -> Result<()> {\n foreach_active_module(|path| {\n let rule_file = path.join(\"sepolicy.rule\");\n if !rule_file.exists() {\n return Ok(());\n }\n\n info!(\"load policy: {}\", &rule_file.display());\n Command::new(assets::MAGISKPOLICY_PATH)\n .arg(\"--live\")\n .arg(\"--apply\")\n .arg(&rule_file)\n .status()\n .with_context(|| format!(\"Failed to exec {}\", rule_file.display()))?;\n Ok(())\n })?;\n\n Ok(())\n}\n\npub fn exec_script>(path: T, wait: bool) -> Result<()> {\n info!(\"exec {}\", path.as_ref().display());\n\n let mut command = &mut Command::new(assets::BUSYBOX_PATH);\n #[cfg(unix)]\n {\n command = command.process_group(0);\n command = unsafe {\n command.pre_exec(|| {\n // ignore the error?\n switch_cgroups();\n Ok(())\n })\n };\n }\n command = command\n .current_dir(path.as_ref().parent().unwrap())\n .arg(\"sh\")\n .arg(path.as_ref())\n .env(\"ASH_STANDALONE\", \"1\")\n .env(\"APATCH\", \"true\")\n .env(\"APATCH_VER\", defs::VERSION_NAME)\n .env(\"APATCH_VER_CODE\", defs::VERSION_CODE)\n .env(\n \"PATH\",\n format!(\n \"{}:{}\",\n env_var(\"PATH\")?,\n defs::BINARY_DIR.trim_end_matches('/')\n ),\n );\n\n let result = if wait {\n command.status().map(|_| ())\n } else {\n command.spawn().map(|_| ())\n };\n result.map_err(|err| anyhow!(\"Failed to exec {}: {}\", path.as_ref().display(), err))\n}\n\npub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {\n foreach_active_module(|module| {\n let script_path = module.join(format!(\"{stage}.sh\"));\n if !script_path.exists() {\n return Ok(());\n }\n\n exec_script(&script_path, block)\n })?;\n Ok(())\n}\n\npub fn exec_common_scripts(dir: &str, wait: bool) -> Result<()> {\n let script_dir = Path::new(defs::ADB_DIR).join(dir);\n if !script_dir.exists() {\n info!(\"{} not exists, skip\", script_dir.display());\n return Ok(());\n }\n\n let dir = fs::read_dir(&script_dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n\n if !is_executable(&path) {\n warn!(\"{} is not executable, skip\", path.display());\n continue;\n }\n\n exec_script(path, wait)?;\n }\n\n Ok(())\n}\n\npub fn load_system_prop() -> Result<()> {\n foreach_active_module(|module| {\n let system_prop = module.join(\"system.prop\");\n if !system_prop.exists() {\n return Ok(());\n }\n info!(\"load {} system.prop\", module.display());\n\n // resetprop -n --file system.prop\n Command::new(assets::RESETPROP_PATH)\n .arg(\"-n\")\n .arg(\"--file\")\n .arg(&system_prop)\n .status()\n .with_context(|| format!(\"Failed to exec {}\", system_prop.display()))?;\n\n Ok(())\n })?;\n\n Ok(())\n}\n\npub fn prune_modules() -> Result<()> {\n foreach_module(ModuleType::All, |module| {\n fs::remove_file(module.join(defs::UPDATE_FILE_NAME)).ok();\n if !module.join(defs::REMOVE_FILE_NAME).exists() {\n return Ok(());\n }\n\n info!(\"remove module: {}\", module.display());\n\n // Execute metamodule's metauninstall.sh first\n let module_id = module.file_name().and_then(|n| n.to_str()).unwrap_or(\"\");\n\n // Check if this is a metamodule\n let is_metamodule = read_module_prop(module)\n .map(|props| metamodule::is_metamodule(&props))\n .unwrap_or(false);\n\n if is_metamodule {\n info!(\"Removing metamodule symlink\");\n if let Err(e) = metamodule::remove_symlink() {\n warn!(\"Failed to remove metamodule symlink: {e}\");\n }\n } else if let Err(e) = metamodule::exec_metauninstall_script(module_id) {\n warn!(\"Failed to exec metamodule uninstall for {module_id}: {e}\",);\n }\n\n // Then execute module's own uninstall.sh\n let uninstaller = module.join(\"uninstall.sh\");\n if uninstaller.exists()\n && let Err(e) = exec_script(uninstaller, true)\n {\n warn!(\"Failed to exec uninstaller: {e}\");\n }\n\n // Finally remove the module directory\n if let Err(e) = remove_dir_all(module) {\n warn!(\"Failed to remove {}: {e}\", module.display());\n }\n\n Ok(())\n })?;\n\n // collect remaining modules, if none, clean up metamodule record\n let remaining_modules: Vec<_> = std::fs::read_dir(defs::MODULE_DIR)?\n .filter_map(std::result::Result::ok)\n .filter(|entry| entry.path().join(\"module.prop\").exists())\n .collect();\n\n if remaining_modules.is_empty() {\n info!(\"no remaining modules.\");\n }\n\n Ok(())\n}\n\nfn _install_module(zip: &str) -> Result<()> {\n ensure_boot_completed()?;\n\n // print banner\n println!(include_str!(\"banner\"));\n\n assets::ensure_binaries().with_context(|| \"binary missing\")?;\n\n // first check if workding dir is usable\n ensure_dir_exists(defs::WORKING_DIR).with_context(|| \"Failed to create working dir\")?;\n ensure_dir_exists(defs::BINARY_DIR).with_context(|| \"Failed to create bin dir\")?;\n\n // read the module_id from zip\n let mut buffer: Vec = Vec::new();\n let entry_path = PathBuf::from_str(\"module.prop\")?;\n let zip_path = PathBuf::from_str(zip)?;\n let zip_path = zip_path.canonicalize()?;\n zip_extract_file_to_memory(&zip_path, &entry_path, &mut buffer)?;\n let mut module_prop = HashMap::new();\n PropertiesIter::new_with_encoding(Cursor::new(buffer), encoding_rs::UTF_8).read_into(\n |k, v| {\n module_prop.insert(k, v);\n },\n )?;\n info!(\"module prop: {:?}\", module_prop);\n\n let Some(module_id) = module_prop.get(\"id\") else {\n bail!(\"module id not found in module.prop!\");\n };\n let module_id = module_id.trim();\n\n // Check if this module is a metamodule\n let is_metamodule = metamodule::is_metamodule(&module_prop);\n\n // Check if module needs mounting (has system/ dir and no skip_mount file)\n let needs_mount = {\n let zip_file = fs::File::open(&zip_path)?;\n let archive = zip::ZipArchive::new(zip_file)?;\n let has_system = archive.file_names().any(|name| name.starts_with(\"system/\"));\n let has_skip_mount = archive.file_names().any(|name| name == \"skip_mount\");\n has_system && !has_skip_mount\n };\n\n // Check if it's safe to install regular module\n if !is_metamodule && needs_mount && let Err(is_disabled) = metamodule::check_install_safety() {\n println!(\"\\n❌ Installation Blocked\");\n println!(\"┌────────────────────────────────\");\n println!(\"│ A metamodule with custom installer is active\");\n println!(\"│\");\n if is_disabled {\n println!(\"│ Current state: Disabled\");\n println!(\"│ Action required: Re-enable or uninstall it, then reboot\");\n } else {\n println!(\"│ Current state: Pending changes\");\n println!(\"│ Action required: Reboot to apply changes first\");\n }\n println!(\"└─────────────────────────────────\\n\");\n bail!(\"Metamodule installation blocked\");\n }\n\n let modules_dir = Path::new(defs::MODULE_DIR);\n let modules_update_dir = Path::new(defs::MODULE_UPDATE_DIR);\n if !Path::new(modules_dir).exists() {\n fs::create_dir(modules_dir).expect(\"Failed to create modules folder\");\n let permissions = fs::Permissions::from_mode(0o700);\n fs::set_permissions(modules_dir, permissions).expect(\"Failed to set permissions\");\n }\n\n if is_metamodule {\n info!(\"Installing metamodule: {module_id}\");\n\n // Check if there's already a metamodule installed\n if metamodule::has_metamodule()\n && let Some(existing_path) = metamodule::get_metamodule_path()\n {\n let existing_id = read_module_prop(&existing_path)\n .ok()\n .and_then(|m| m.get(\"id\").cloned())\n .unwrap_or_else(|| \"unknown\".to_string());\n\n if existing_id != module_id {\n println!(\"\\n❌ Installation Failed\");\n println!(\"┌────────────────────────────────\");\n println!(\"│ A metamodule is already installed\");\n println!(\"│ Current metamodule: {existing_id}\");\n println!(\"│\");\n println!(\"│ Only one metamodule can be active at a time.\");\n println!(\"│\");\n println!(\"│ To install this metamodule:\");\n println!(\"│ 1. Uninstall the current metamodule\");\n println!(\"│ 2. Reboot your device\");\n println!(\"│ 3. Install the new metamodule\");\n println!(\"└─────────────────────────────────\\n\");\n bail!(\"Cannot install multiple metamodules\");\n }\n }\n }\n\n let module_dir = format!(\"{}{}\", modules_dir.display(), module_id);\n let _module_update_dir = format!(\"{}{}\", modules_update_dir.display(), module_id);\n info!(\"module dir: {}\", module_dir);\n if !Path::new(&module_dir.clone()).exists() {\n fs::create_dir(&module_dir.clone()).expect(\"Failed to create module folder\");\n let permissions = fs::Permissions::from_mode(0o700);\n fs::set_permissions(module_dir.clone(), permissions).expect(\"Failed to set permissions\");\n }\n // unzip the image and move it to modules_update/ dir\n let file = fs::File::open(zip)?;\n let mut archive = zip::ZipArchive::new(file)?;\n archive.extract(&_module_update_dir)?;\n\n println!(\"- Running module installer\");\n exec_install_script(zip, is_metamodule)?;\n\n // set permission and selinux context for $MOD/system\n let module_system_dir = PathBuf::from(module_dir.clone()).join(\"system\");\n if module_system_dir.exists() {\n #[cfg(unix)]\n fs::set_permissions(&module_system_dir, fs::Permissions::from_mode(0o755))?;\n restorecon::restore_syscon(&module_system_dir)?;\n }\n\n // Create symlink for metamodule\n if is_metamodule {\n println!(\"- Creating metamodule symlink\");\n metamodule::ensure_symlink(&module_dir)?;\n }\n\n mark_update()?;\n Ok(())\n}\n\npub fn install_module(zip: &str) -> Result<()> {\n let result = _install_module(zip);\n result\n}\n\npub fn _uninstall_module(id: &str, update_dir: &str) -> Result<()> {\n let dir = Path::new(update_dir);\n ensure!(dir.exists(), \"No module installed\");\n\n // iterate the modules_update dir, find the module to be removed\n let dir = fs::read_dir(dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n let module_prop = path.join(\"module.prop\");\n if !module_prop.exists() {\n continue;\n }\n let content = fs::read(module_prop)?;\n let mut module_id: String = String::new();\n PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8).read_into(\n |k, v| {\n if k.eq(\"id\") {\n module_id = v;\n }\n },\n )?;\n if module_id.eq(id) {\n let remove_file = path.join(defs::REMOVE_FILE_NAME);\n fs::File::create(remove_file).with_context(|| \"Failed to create remove file.\")?;\n break;\n }\n }\n\n // santity check\n let target_module_path = format!(\"{update_dir}/{id}\");\n let target_module = Path::new(&target_module_path);\n if target_module.exists() {\n let remove_file = target_module.join(defs::REMOVE_FILE_NAME);\n if !remove_file.exists() {\n fs::File::create(remove_file).with_context(|| \"Failed to create remove file.\")?;\n }\n }\n\n let _ = mark_module_state(id, defs::REMOVE_FILE_NAME, true);\n Ok(())\n}\npub fn uninstall_module(id: &str) -> Result<()> {\n _uninstall_module(id, defs::MODULE_DIR)?;\n mark_update()?;\n Ok(())\n}\n\n/// Read module.prop from the given module path and return as a HashMap\npub fn read_module_prop(module_path: &Path) -> Result> {\n let module_prop = module_path.join(\"module.prop\");\n ensure!(\n module_prop.exists(),\n \"module.prop not found in {}\",\n module_path.display()\n );\n\n let content = std::fs::read(&module_prop)\n .with_context(|| format!(\"Failed to read module.prop: {}\", module_prop.display()))?;\n\n let mut prop_map: HashMap = HashMap::new();\n PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8)\n .read_into(|k, v| {\n prop_map.insert(k, v);\n })\n .with_context(|| format!(\"Failed to parse module.prop: {}\", module_prop.display()))?;\n\n Ok(prop_map)\n}\n\npub fn run_action(id: &str) -> Result<()> {\n let action_script_path = format!(\"/data/adb/modules/{}/action.sh\", id);\n if Path::new(&action_script_path).exists() {\n let _ = exec_script(&action_script_path, true);\n } else {\n //if no action.sh, try to run lua action\n lua::run_lua(&id, \"action\", false, true).map_err(|e| anyhow::anyhow!(\"{}\", e))?;\n }\n Ok(())\n}\n\nfn _change_module_state(module_dir: &str, mid: &str, enable: bool) -> Result<()> {\n let src_module_path = format!(\"{module_dir}/{mid}\");\n let src_module = Path::new(&src_module_path);\n ensure!(src_module.exists(), \"module: {} not found!\", mid);\n\n let disable_path = src_module.join(defs::DISABLE_FILE_NAME);\n if enable {\n if disable_path.exists() {\n fs::remove_file(&disable_path).with_context(|| {\n format!(\"Failed to remove disable file: {}\", &disable_path.display())\n })?;\n }\n } else {\n ensure_file_exists(disable_path)?;\n }\n\n let _ = mark_module_state(mid, defs::DISABLE_FILE_NAME, !enable);\n\n Ok(())\n}\n\npub fn _enable_module(id: &str, update_dir: &Path) -> Result<()> {\n if let Some(module_dir_str) = update_dir.to_str() {\n _change_module_state(module_dir_str, id, true)\n } else {\n info!(\"Enable module failed: Invalid path\");\n Err(anyhow::anyhow!(\"Invalid module directory\"))\n }\n}\n\npub fn enable_module(id: &str) -> Result<()> {\n let update_dir = Path::new(defs::MODULE_DIR);\n _enable_module(id, update_dir)?;\n Ok(())\n}\n\npub fn _disable_module(id: &str, update_dir: &Path) -> Result<()> {\n if let Some(module_dir_str) = update_dir.to_str() {\n _change_module_state(module_dir_str, id, false)\n } else {\n info!(\"Disable module failed: Invalid path\");\n Err(anyhow::anyhow!(\"Invalid module directory\"))\n }\n}\n\npub fn disable_module(id: &str) -> Result<()> {\n let module_dir = Path::new(defs::MODULE_DIR);\n _disable_module(id, module_dir)?;\n\n Ok(())\n}\n\npub fn _disable_all_modules(dir: &str) -> Result<()> {\n let dir = fs::read_dir(dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n let disable_flag = path.join(defs::DISABLE_FILE_NAME);\n if let Err(e) = ensure_file_exists(disable_flag) {\n warn!(\"Failed to disable module: {}: {}\", path.display(), e);\n }\n }\n Ok(())\n}\n\npub fn disable_all_modules() -> Result<()> {\n // Skip disabling modules since boot completed\n if getprop(\"sys.boot_completed\").as_deref() == Some(\"1\") {\n info!(\"System boot completed, no need to disable all modules\");\n return Ok(());\n }\n mark_update()?;\n _disable_all_modules(defs::MODULE_DIR)?;\n Ok(())\n}\n\nfn _list_modules(path: &str) -> Vec> {\n // first check enabled modules\n let dir = fs::read_dir(path);\n let Ok(dir) = dir else {\n return Vec::new();\n };\n\n let mut modules: Vec> = Vec::new();\n\n for entry in dir.flatten() {\n let path = entry.path();\n info!(\"path: {}\", path.display());\n let module_prop = path.join(\"module.prop\");\n if !module_prop.exists() {\n continue;\n }\n let content = fs::read(&module_prop);\n let Ok(content) = content else {\n warn!(\"Failed to read file: {}\", module_prop.display());\n continue;\n };\n let mut module_prop_map: HashMap = HashMap::new();\n let encoding = encoding_rs::UTF_8;\n let result =\n PropertiesIter::new_with_encoding(Cursor::new(content), encoding).read_into(|k, v| {\n module_prop_map.insert(k, v);\n });\n\n if !module_prop_map.contains_key(\"id\") || module_prop_map[\"id\"].is_empty() {\n match entry.file_name().to_str() {\n Some(id) => {\n info!(\"Use dir name as module id: {}\", id);\n module_prop_map.insert(\"id\".to_owned(), id.to_owned());\n }\n _ => {\n info!(\"Failed to get module id: {:?}\", module_prop);\n continue;\n }\n }\n }\n\n // Add enabled, update, remove flags\n let enabled = !path.join(defs::DISABLE_FILE_NAME).exists();\n let update = path.join(defs::UPDATE_FILE_NAME).exists();\n let remove = path.join(defs::REMOVE_FILE_NAME).exists();\n let web = path.join(defs::MODULE_WEB_DIR).exists();\n let id = module_prop_map.get(\"id\").map(|s| s.as_str()).unwrap_or(\"\");\n let id_lua_file = format!(\"{}.lua\", id);\n let action = path.join(defs::MODULE_ACTION_SH).exists() || path.join(&id_lua_file).exists();\n\n module_prop_map.insert(\"enabled\".to_owned(), enabled.to_string());\n module_prop_map.insert(\"update\".to_owned(), update.to_string());\n module_prop_map.insert(\"remove\".to_owned(), remove.to_string());\n module_prop_map.insert(\"web\".to_owned(), web.to_string());\n module_prop_map.insert(\"action\".to_owned(), action.to_string());\n\n if result.is_err() {\n warn!(\"Failed to parse module.prop: {}\", module_prop.display());\n continue;\n }\n modules.push(module_prop_map);\n }\n\n modules\n}\n\npub fn list_modules() -> Result<()> {\n let modules = _list_modules(defs::MODULE_DIR);\n println!(\"{}\", serde_json::to_string_pretty(&modules)?);\n Ok(())\n}\n"
},
{
"path": "apd/src/package.rs",
"content": "use std::{\n fs::File,\n io::{self, BufRead},\n path::Path,\n thread,\n time::Duration,\n};\n\nuse log::{info, warn};\nuse serde::{Deserialize, Serialize};\n\n#[derive(Deserialize, Serialize, Clone)]\npub struct PackageConfig {\n pub pkg: String,\n pub exclude: i32,\n pub allow: i32,\n pub uid: i32,\n pub to_uid: i32,\n pub sctx: String,\n}\n\npub fn read_ap_package_config() -> Vec {\n let max_retry = 5;\n for _ in 0..max_retry {\n let file = match File::open(\"/data/adb/ap/package_config\") {\n Ok(file) => file,\n Err(e) => {\n warn!(\"Error opening file: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n };\n\n let mut reader = csv::Reader::from_reader(file);\n let mut package_configs = Vec::new();\n let mut success = true;\n\n for record in reader.deserialize() {\n match record {\n Ok(config) => package_configs.push(config),\n Err(e) => {\n warn!(\"Error deserializing record: {}\", e);\n success = false;\n break;\n }\n }\n }\n\n if success {\n return package_configs;\n }\n thread::sleep(Duration::from_secs(1));\n }\n Vec::new()\n}\n\npub fn write_ap_package_config(package_configs: &[PackageConfig]) -> io::Result<()> {\n let max_retry = 5;\n for _ in 0..max_retry {\n let temp_path = \"/data/adb/ap/package_config.tmp\";\n let file = match File::create(temp_path) {\n Ok(file) => file,\n Err(e) => {\n warn!(\"Error creating temp file: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n };\n\n let mut writer = csv::Writer::from_writer(file);\n let mut success = true;\n\n for config in package_configs {\n if let Err(e) = writer.serialize(config) {\n warn!(\"Error serializing record: {}\", e);\n success = false;\n break;\n }\n }\n\n if !success {\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n\n if let Err(e) = writer.flush() {\n warn!(\"Error flushing writer: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n\n if let Err(e) = std::fs::rename(temp_path, \"/data/adb/ap/package_config\") {\n warn!(\"Error renaming temp file: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n return Ok(());\n }\n Err(io::Error::new(\n io::ErrorKind::Other,\n \"Failed after max retries\",\n ))\n}\n\nfn read_lines(filename: P) -> io::Result>>\nwhere\n P: AsRef,\n{\n File::open(filename).map(|file| io::BufReader::new(file).lines())\n}\n\npub fn synchronize_package_uid() -> io::Result<()> {\n info!(\"[synchronize_package_uid] Start synchronizing root list with system packages...\");\n\n let max_retry = 5;\n for _ in 0..max_retry {\n match read_lines(\"/data/system/packages.list\") {\n Ok(lines) => {\n let lines: Vec<_> = lines.filter_map(|line| line.ok()).collect();\n\n let mut package_configs = read_ap_package_config();\n\n let system_packages: Vec = lines\n .iter()\n .filter_map(|line| line.split_whitespace().next())\n .map(|pkg| pkg.to_string())\n .collect();\n\n let original_len = package_configs.len();\n package_configs.retain(|config| system_packages.contains(&config.pkg));\n let removed_count = original_len - package_configs.len();\n\n if removed_count > 0 {\n info!(\n \"Removed {} uninstalled package configurations\",\n removed_count\n );\n }\n\n let mut updated = false;\n\n for line in &lines {\n let words: Vec<&str> = line.split_whitespace().collect();\n if words.len() >= 2 {\n let pkg_name = words[0];\n if let Ok(uid) = words[1].parse::() {\n for config in package_configs\n .iter_mut()\n .filter(|config| config.pkg == pkg_name)\n {\n if config.uid % 100000 != uid % 100000 {\n let new_uid = config.uid / 100000 * 100000 + uid % 100000;\n info!(\n \"Updating uid for package {}: {} -> {}\",\n pkg_name, config.uid, new_uid\n );\n config.uid = new_uid;\n updated = true;\n }\n }\n } else {\n warn!(\"Error parsing uid: {}\", words[1]);\n }\n }\n }\n\n if updated || removed_count > 0 {\n write_ap_package_config(&package_configs)?;\n }\n return Ok(());\n }\n Err(e) => {\n warn!(\"Error reading packages.list: {}\", e);\n thread::sleep(Duration::from_secs(1));\n }\n }\n }\n Err(io::Error::new(\n io::ErrorKind::Other,\n \"Failed after max retries\",\n ))\n}\n"
},
{
"path": "apd/src/pty.rs",
"content": "use std::{\n ffi::c_int,\n fs::File,\n io::{Read, Write, stderr, stdin, stdout},\n mem::MaybeUninit,\n os::fd::{AsFd, AsRawFd, OwnedFd, RawFd},\n process::exit,\n ptr::null_mut,\n sync::Mutex,\n thread,\n};\n\nuse anyhow::{Ok, Result, bail};\nuse libc::{\n __errno, EINTR, SIG_BLOCK, SIG_UNBLOCK, SIGWINCH, TIOCGWINSZ, TIOCSWINSZ, fork,\n pthread_sigmask, sigaddset, sigemptyset, sigset_t, sigwait, waitpid, winsize,\n};\nuse rustix::{\n fs::{Mode, OFlags, open},\n io::dup,\n ioctl::{Getter, Opcode, ioctl, opcode},\n process::setsid,\n pty::{grantpt, unlockpt},\n stdio::{dup2_stderr, dup2_stdin, dup2_stdout},\n termios::{OptionalActions, Termios, isatty, tcgetattr, tcsetattr},\n};\n\nuse crate::{defs::PTS_NAME, utils::get_tmp_path};\n\n// https://github.com/topjohnwu/Magisk/blob/5627053b7481618adfdf8fa3569b48275589915b/native/src/core/su/pts.cpp\n\nfn get_pty_num(fd: F) -> Result {\n // TIOCGPTN: Get the PTY number\n const TIOCGPTN: Opcode = opcode::read::(b'T', 0x30);\n Ok(unsafe {\n let tiocgptn = Getter::::new();\n ioctl(fd, tiocgptn)?\n })\n}\n\nstatic OLD_STDIN: Mutex> = Mutex::new(None);\n\nfn watch_sigwinch_async(slave: RawFd) {\n let mut winch = MaybeUninit::::uninit();\n unsafe {\n sigemptyset(winch.as_mut_ptr());\n sigaddset(winch.as_mut_ptr(), SIGWINCH);\n pthread_sigmask(SIG_BLOCK, winch.as_mut_ptr(), null_mut());\n }\n\n thread::spawn(move || unsafe {\n let mut winch = MaybeUninit::::uninit();\n sigemptyset(winch.as_mut_ptr());\n sigaddset(winch.as_mut_ptr(), SIGWINCH);\n pthread_sigmask(SIG_UNBLOCK, winch.as_mut_ptr(), null_mut());\n let mut sig: c_int = 0;\n loop {\n let mut w = MaybeUninit::::uninit();\n if libc::ioctl(1, TIOCGWINSZ, w.as_mut_ptr()) < 0 {\n continue;\n }\n libc::ioctl(slave, TIOCSWINSZ, w.as_mut_ptr());\n if sigwait(winch.as_mut_ptr(), &mut sig) != 0 {\n break;\n }\n }\n });\n}\n\nfn set_stdin_raw() -> rustix::io::Result<()> {\n let mut termios = tcgetattr(stdin())?;\n\n let mut guard = OLD_STDIN.lock().unwrap();\n *guard = Some(termios.clone());\n drop(guard);\n\n termios.make_raw();\n tcsetattr(stdin(), OptionalActions::Flush, &termios)\n}\n\nfn restore_stdin() -> Result<()> {\n let mut guard = OLD_STDIN.lock().unwrap();\n\n if let Some(original_termios) = guard.take() {\n tcsetattr(stdin(), OptionalActions::Flush, &original_termios)?;\n }\n\n Ok(())\n}\n\nfn pump(mut from: R, mut to: W) {\n let mut buf = [0u8; 4096];\n loop {\n match from.read(&mut buf) {\n Result::Ok(len) => {\n if len == 0 {\n return;\n }\n if to.write_all(&buf[0..len]).is_err() {\n return;\n }\n if to.flush().is_err() {\n return;\n }\n }\n Err(_) => {\n return;\n }\n }\n }\n}\n\nfn pump_stdin_async(mut ptmx: File) {\n let _ = set_stdin_raw();\n\n thread::spawn(move || {\n let mut stdin = stdin();\n pump(&mut stdin, &mut ptmx);\n });\n}\n\nfn pump_stdout_blocking(mut ptmx: File) {\n let mut stdout = stdout();\n pump(&mut ptmx, &mut stdout);\n\n let _ = restore_stdin();\n}\n\nfn create_transfer(ptmx: OwnedFd) -> Result<()> {\n let pid = unsafe { fork() };\n match pid {\n d if d < 0 => bail!(\"fork\"),\n 0 => return Ok(()),\n _ => {}\n }\n\n let ptmx_r = ptmx;\n let ptmx_w = dup(&ptmx_r)?;\n\n let ptmx_r = File::from(ptmx_r);\n let ptmx_w = File::from(ptmx_w);\n\n watch_sigwinch_async(ptmx_w.as_raw_fd());\n pump_stdin_async(ptmx_r);\n pump_stdout_blocking(ptmx_w);\n\n let mut status: c_int = -1;\n\n unsafe {\n loop {\n if waitpid(pid, &mut status, 0) == -1 && *__errno() != EINTR {\n continue;\n }\n break;\n }\n }\n\n exit(status)\n}\n\npub fn prepare_pty() -> Result<()> {\n let tty_in = isatty(stdin());\n let tty_out = isatty(stdout());\n let tty_err = isatty(stderr());\n if !tty_in && !tty_out && !tty_err {\n return Ok(());\n }\n\n let mut pts_path = format!(\"{}/{}\", get_tmp_path(), PTS_NAME);\n if !std::path::Path::new(&pts_path).exists() {\n pts_path = \"/dev/pts\".to_string();\n }\n let ptmx_path = format!(\"{}/ptmx\", pts_path);\n let ptmx_fd = open(ptmx_path, OFlags::RDWR, Mode::empty())?;\n grantpt(&ptmx_fd)?;\n unlockpt(&ptmx_fd)?;\n let pty_num = get_pty_num(&ptmx_fd)?;\n create_transfer(ptmx_fd)?;\n setsid()?;\n let pty_fd = open(format!(\"{pts_path}/{pty_num}\"), OFlags::RDWR, Mode::empty())?;\n if tty_in {\n dup2_stdin(&pty_fd)?;\n }\n if tty_out {\n dup2_stdout(&pty_fd)?;\n }\n if tty_err {\n dup2_stderr(&pty_fd)?;\n }\n Ok(())\n}\n"
},
{
"path": "apd/src/restorecon.rs",
"content": "use std::path::Path;\n\nuse anyhow::Result;\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\nuse anyhow::{Context, Ok};\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\nuse extattr::{Flags as XattrFlags, lsetxattr};\nuse jwalk::{Parallelism::Serial, WalkDir};\n\nuse crate::defs;\n\npub const SYSTEM_CON: &str = \"u:object_r:system_file:s0\";\npub const ADB_CON: &str = \"u:object_r:adb_data_file:s0\";\npub const UNLABEL_CON: &str = \"u:object_r:unlabeled:s0\";\n\nconst SELINUX_XATTR: &str = \"security.selinux\";\n\npub fn lsetfilecon>(path: P, con: &str) -> Result<()> {\n #[cfg(any(target_os = \"linux\", target_os = \"android\"))]\n lsetxattr(&path, SELINUX_XATTR, con, XattrFlags::empty()).with_context(|| {\n format!(\n \"Failed to change SELinux context for {}\",\n path.as_ref().display()\n )\n })?;\n Ok(())\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn lgetfilecon>(path: P) -> Result {\n let con = extattr::lgetxattr(&path, SELINUX_XATTR).with_context(|| {\n format!(\n \"Failed to get SELinux context for {}\",\n path.as_ref().display()\n )\n })?;\n let con = String::from_utf8_lossy(&con);\n Ok(con.to_string())\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn setsyscon>(path: P) -> Result<()> {\n lsetfilecon(path, SYSTEM_CON)\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn setsyscon>(path: P) -> Result<()> {\n unimplemented!()\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn lgetfilecon>(path: P) -> Result {\n unimplemented!()\n}\n\npub fn restore_syscon>(dir: P) -> Result<()> {\n for dir_entry in WalkDir::new(dir).parallelism(Serial) {\n if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {\n setsyscon(&path)?;\n }\n }\n Ok(())\n}\n\nfn restore_syscon_if_unlabeled>(dir: P) -> Result<()> {\n for dir_entry in WalkDir::new(dir).parallelism(Serial) {\n if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {\n if let Result::Ok(con) = lgetfilecon(&path) {\n if con == UNLABEL_CON || con.is_empty() {\n lsetfilecon(&path, SYSTEM_CON)?;\n }\n }\n }\n }\n Ok(())\n}\n\npub fn restorecon() -> Result<()> {\n lsetfilecon(defs::DAEMON_PATH, ADB_CON)?;\n restore_syscon_if_unlabeled(defs::MODULE_DIR)?;\n Ok(())\n}\n"
},
{
"path": "apd/src/sepolicy.rs",
"content": "use std::{ffi, path::Path, vec};\n\nuse anyhow::{Result, bail};\nuse derive_new::new;\nuse nom::{\n AsChar, IResult, Parser,\n branch::alt,\n bytes::complete::{tag, take_while, take_while_m_n, take_while1},\n character::complete::{space0, space1},\n combinator::map,\n};\n\ntype SeObject<'a> = Vec<&'a str>;\n\nfn is_sepolicy_char(c: char) -> bool {\n c.is_alphanum() || c == '_' || c == '-'\n}\n\nfn parse_single_word(input: &str) -> IResult<&str, &str> {\n take_while1(is_sepolicy_char).parse(input)\n}\n\nfn parse_bracket_objs(input: &str) -> IResult<&str, SeObject<'_>> {\n let (input, (_, words, _)) = (\n tag(\"{\"),\n take_while_m_n(1, 100, |c: char| is_sepolicy_char(c) || c.is_whitespace()),\n tag(\"}\"),\n )\n .parse(input)?;\n Ok((input, words.split_whitespace().collect()))\n}\n\nfn parse_single_obj(input: &str) -> IResult<&str, SeObject<'_>> {\n let (input, word) = take_while1(is_sepolicy_char).parse(input)?;\n Ok((input, vec![word]))\n}\n\nfn parse_star(input: &str) -> IResult<&str, SeObject<'_>> {\n let (input, _) = tag(\"*\").parse(input)?;\n Ok((input, vec![\"*\"]))\n}\n\n// 1. a single sepolicy word\n// 2. { obj1 obj2 obj3 ...}\n// 3. *\nfn parse_seobj(input: &str) -> IResult<&str, SeObject<'_>> {\n let (input, strs) = alt((parse_single_obj, parse_bracket_objs, parse_star)).parse(input)?;\n Ok((input, strs))\n}\n\nfn parse_seobj_no_star(input: &str) -> IResult<&str, SeObject<'_>> {\n let (input, strs) = alt((parse_single_obj, parse_bracket_objs)).parse(input)?;\n Ok((input, strs))\n}\n\ntrait SeObjectParser<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self>\n where\n Self: Sized;\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct NormalPerm<'a> {\n op: &'a str,\n source: SeObject<'a>,\n target: SeObject<'a>,\n class: SeObject<'a>,\n perm: SeObject<'a>,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct XPerm<'a> {\n op: &'a str,\n source: SeObject<'a>,\n target: SeObject<'a>,\n class: SeObject<'a>,\n operation: &'a str,\n perm_set: &'a str,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct TypeState<'a> {\n op: &'a str,\n stype: SeObject<'a>,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct TypeAttr<'a> {\n stype: SeObject<'a>,\n sattr: SeObject<'a>,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct Type<'a> {\n name: &'a str,\n attrs: SeObject<'a>,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct Attr<'a> {\n name: &'a str,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct TypeTransition<'a> {\n source: &'a str,\n target: &'a str,\n class: &'a str,\n default_type: &'a str,\n object_name: Option<&'a str>,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct TypeChange<'a> {\n op: &'a str,\n source: &'a str,\n target: &'a str,\n class: &'a str,\n default_type: &'a str,\n}\n\n#[derive(Debug, PartialEq, Eq, new)]\nstruct GenFsCon<'a> {\n fs_name: &'a str,\n partial_path: &'a str,\n fs_context: &'a str,\n}\n\n#[derive(Debug)]\nenum PolicyStatement<'a> {\n // \"allow *source_type *target_type *class *perm_set\"\n // \"deny *source_type *target_type *class *perm_set\"\n // \"auditallow *source_type *target_type *class *perm_set\"\n // \"dontaudit *source_type *target_type *class *perm_set\"\n NormalPerm(NormalPerm<'a>),\n\n // \"allowxperm *source_type *target_type *class operation xperm_set\"\n // \"auditallowxperm *source_type *target_type *class operation xperm_set\"\n // \"dontauditxperm *source_type *target_type *class operation xperm_set\"\n XPerm(XPerm<'a>),\n\n // \"permissive ^type\"\n // \"enforce ^type\"\n TypeState(TypeState<'a>),\n\n // \"type type_name ^(attribute)\"\n Type(Type<'a>),\n\n // \"typeattribute ^type ^attribute\"\n TypeAttr(TypeAttr<'a>),\n\n // \"attribute ^attribute\"\n Attr(Attr<'a>),\n\n // \"type_transition source_type target_type class default_type (object_name)\"\n TypeTransition(TypeTransition<'a>),\n\n // \"type_change source_type target_type class default_type\"\n // \"type_member source_type target_type class default_type\"\n TypeChange(TypeChange<'a>),\n\n // \"genfscon fs_name partial_path fs_context\"\n GenFsCon(GenFsCon<'a>),\n}\n\nimpl<'a> SeObjectParser<'a> for NormalPerm<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, op) = alt((\n tag(\"allow\"),\n tag(\"deny\"),\n tag(\"auditallow\"),\n tag(\"dontaudit\"),\n ))\n .parse(input)?;\n\n let (input, _) = space0(input)?;\n let (input, source) = parse_seobj(input)?;\n let (input, _) = space0(input)?;\n let (input, target) = parse_seobj(input)?;\n let (input, _) = space0(input)?;\n let (input, class) = parse_seobj(input)?;\n let (input, _) = space0(input)?;\n let (input, perm) = parse_seobj(input)?;\n Ok((input, NormalPerm::new(op, source, target, class, perm)))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for XPerm<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, op) = alt((\n tag(\"allowxperm\"),\n tag(\"auditallowxperm\"),\n tag(\"dontauditxperm\"),\n ))\n .parse(input)?;\n\n let (input, _) = space0(input)?;\n let (input, source) = parse_seobj(input)?;\n let (input, _) = space0(input)?;\n let (input, target) = parse_seobj(input)?;\n let (input, _) = space0(input)?;\n let (input, class) = parse_seobj(input)?;\n let (input, _) = space0(input)?;\n let (input, operation) = parse_single_word(input)?;\n let (input, _) = space0(input)?;\n let (input, perm_set) = parse_single_word(input)?;\n\n Ok((\n input,\n XPerm::new(op, source, target, class, operation, perm_set),\n ))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for TypeState<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, op) = alt((tag(\"permissive\"), tag(\"enforce\"))).parse(input)?;\n\n let (input, _) = space1(input)?;\n let (input, stype) = parse_seobj_no_star(input)?;\n\n Ok((input, TypeState::new(op, stype)))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for Type<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, _) = tag(\"type\")(input)?;\n let (input, _) = space1(input)?;\n let (input, name) = parse_single_word(input)?;\n\n if input.is_empty() {\n return Ok((input, Type::new(name, vec![\"domain\"]))); // default to domain\n }\n\n let (input, _) = space1(input)?;\n let (input, attrs) = parse_seobj_no_star(input)?;\n\n Ok((input, Type::new(name, attrs)))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for TypeAttr<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, _) = alt((tag(\"typeattribute\"), tag(\"attradd\"))).parse(input)?;\n let (input, _) = space1(input)?;\n let (input, stype) = parse_seobj_no_star(input)?;\n let (input, _) = space1(input)?;\n let (input, attr) = parse_seobj_no_star(input)?;\n\n Ok((input, TypeAttr::new(stype, attr)))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for Attr<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, _) = tag(\"attribute\")(input)?;\n let (input, _) = space1(input)?;\n let (input, attr) = parse_single_word(input)?;\n\n Ok((input, Attr::new(attr)))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for TypeTransition<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, _) = alt((tag(\"type_transition\"), tag(\"name_transition\"))).parse(input)?;\n let (input, _) = space1(input)?;\n let (input, source) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, target) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, class) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, default) = parse_single_word(input)?;\n\n if input.is_empty() {\n return Ok((\n input,\n TypeTransition::new(source, target, class, default, None),\n ));\n }\n\n let (input, _) = space1(input)?;\n let (input, object) = parse_single_word(input)?;\n\n Ok((\n input,\n TypeTransition::new(source, target, class, default, Some(object)),\n ))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for TypeChange<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, op) = alt((tag(\"type_change\"), tag(\"type_member\"))).parse(input)?;\n let (input, _) = space1(input)?;\n let (input, source) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, target) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, class) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, default) = parse_single_word(input)?;\n\n Ok((input, TypeChange::new(op, source, target, class, default)))\n }\n}\n\nimpl<'a> SeObjectParser<'a> for GenFsCon<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self>\n where\n Self: Sized,\n {\n let (input, _) = tag(\"genfscon\")(input)?;\n let (input, _) = space1(input)?;\n let (input, fs) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, path) = parse_single_word(input)?;\n let (input, _) = space1(input)?;\n let (input, context) = parse_single_word(input)?;\n Ok((input, GenFsCon::new(fs, path, context)))\n }\n}\n\nimpl<'a> PolicyStatement<'a> {\n fn parse(input: &'a str) -> IResult<&'a str, Self> {\n let (input, _) = space0(input)?;\n let (input, statement) = alt((\n map(NormalPerm::parse, PolicyStatement::NormalPerm),\n map(XPerm::parse, PolicyStatement::XPerm),\n map(TypeState::parse, PolicyStatement::TypeState),\n map(Type::parse, PolicyStatement::Type),\n map(TypeAttr::parse, PolicyStatement::TypeAttr),\n map(Attr::parse, PolicyStatement::Attr),\n map(TypeTransition::parse, PolicyStatement::TypeTransition),\n map(TypeChange::parse, PolicyStatement::TypeChange),\n map(GenFsCon::parse, PolicyStatement::GenFsCon),\n ))\n .parse(input)?;\n let (input, _) = space0(input)?;\n let (input, _) = take_while(|c| c == ';')(input)?;\n let (input, _) = space0(input)?;\n Ok((input, statement))\n }\n}\n\nfn parse_sepolicy<'a, 'b>(input: &'b str, strict: bool) -> Result>>\nwhere\n 'b: 'a,\n{\n let mut statements = vec![];\n\n for line in input.split(['\\n', ';']) {\n let trimmed_line = line.trim();\n if trimmed_line.is_empty() || trimmed_line.starts_with('#') {\n continue;\n }\n if let Ok((_, statement)) = PolicyStatement::parse(trimmed_line) {\n statements.push(statement);\n } else if strict {\n bail!(\"Failed to parse policy statement: {}\", line)\n }\n }\n Ok(statements)\n}\n\nconst SEPOLICY_MAX_LEN: usize = 128;\n\nconst CMD_NORMAL_PERM: u32 = 1;\nconst CMD_XPERM: u32 = 2;\nconst CMD_TYPE_STATE: u32 = 3;\nconst CMD_TYPE: u32 = 4;\nconst CMD_TYPE_ATTR: u32 = 5;\nconst CMD_ATTR: u32 = 6;\nconst CMD_TYPE_TRANSITION: u32 = 7;\nconst CMD_TYPE_CHANGE: u32 = 8;\nconst CMD_GENFSCON: u32 = 9;\n\n#[derive(Debug, Default)]\nenum PolicyObject {\n All, // for \"*\", stand for all objects, and is NULL in ffi\n One([u8; SEPOLICY_MAX_LEN]),\n #[default]\n None,\n}\n\nimpl TryFrom<&str> for PolicyObject {\n type Error = anyhow::Error;\n fn try_from(s: &str) -> Result {\n anyhow::ensure!(s.len() <= SEPOLICY_MAX_LEN, \"policy object too long\");\n if s == \"*\" {\n return Ok(PolicyObject::All);\n }\n let mut buf = [0u8; SEPOLICY_MAX_LEN];\n buf[..s.len()].copy_from_slice(s.as_bytes());\n Ok(PolicyObject::One(buf))\n }\n}\n\n/// atomic statement, such as: allow domain1 domain2:file1 read;\n/// normal statement would be expanded to atomic statement, for example:\n/// allow domain1 domain2:file1 { read write }; would be expanded to two atomic statement\n/// allow domain1 domain2:file1 read;allow domain1 domain2:file1 write;\n#[allow(clippy::too_many_arguments)]\n#[derive(Debug, new)]\nstruct AtomicStatement {\n cmd: u32,\n subcmd: u32,\n sepol1: PolicyObject,\n sepol2: PolicyObject,\n sepol3: PolicyObject,\n sepol4: PolicyObject,\n sepol5: PolicyObject,\n sepol6: PolicyObject,\n sepol7: PolicyObject,\n}\n\nimpl<'a> TryFrom<&'a NormalPerm<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a NormalPerm<'a>) -> Result {\n let mut result = vec![];\n let subcmd = match perm.op {\n \"allow\" => 1,\n \"deny\" => 2,\n \"auditallow\" => 3,\n \"dontaudit\" => 4,\n _ => 0,\n };\n for &s in &perm.source {\n for &t in &perm.target {\n for &c in &perm.class {\n for &p in &perm.perm {\n result.push(AtomicStatement {\n cmd: CMD_NORMAL_PERM,\n subcmd,\n sepol1: s.try_into()?,\n sepol2: t.try_into()?,\n sepol3: c.try_into()?,\n sepol4: p.try_into()?,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n }\n }\n }\n }\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a XPerm<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a XPerm<'a>) -> Result {\n let mut result = vec![];\n let subcmd = match perm.op {\n \"allowxperm\" => 1,\n \"auditallowxperm\" => 2,\n \"dontauditxperm\" => 3,\n _ => 0,\n };\n for &s in &perm.source {\n for &t in &perm.target {\n for &c in &perm.class {\n result.push(AtomicStatement {\n cmd: CMD_XPERM,\n subcmd,\n sepol1: s.try_into()?,\n sepol2: t.try_into()?,\n sepol3: c.try_into()?,\n sepol4: perm.operation.try_into()?,\n sepol5: perm.perm_set.try_into()?,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n }\n }\n }\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a TypeState<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a TypeState<'a>) -> Result {\n let mut result = vec![];\n let subcmd = match perm.op {\n \"permissive\" => 1,\n \"enforcing\" => 2,\n _ => 0,\n };\n for &t in &perm.stype {\n result.push(AtomicStatement {\n cmd: CMD_TYPE_STATE,\n subcmd,\n sepol1: t.try_into()?,\n sepol2: PolicyObject::None,\n sepol3: PolicyObject::None,\n sepol4: PolicyObject::None,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n }\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a Type<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a Type<'a>) -> Result {\n let mut result = vec![];\n for &attr in &perm.attrs {\n result.push(AtomicStatement {\n cmd: CMD_TYPE,\n subcmd: 0,\n sepol1: perm.name.try_into()?,\n sepol2: attr.try_into()?,\n sepol3: PolicyObject::None,\n sepol4: PolicyObject::None,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n }\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a TypeAttr<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a TypeAttr<'a>) -> Result {\n let mut result = vec![];\n for &t in &perm.stype {\n for &attr in &perm.sattr {\n result.push(AtomicStatement {\n cmd: CMD_TYPE_ATTR,\n subcmd: 0,\n sepol1: t.try_into()?,\n sepol2: attr.try_into()?,\n sepol3: PolicyObject::None,\n sepol4: PolicyObject::None,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n }\n }\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a Attr<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a Attr<'a>) -> Result {\n let result = vec![AtomicStatement {\n cmd: CMD_ATTR,\n subcmd: 0,\n sepol1: perm.name.try_into()?,\n sepol2: PolicyObject::None,\n sepol3: PolicyObject::None,\n sepol4: PolicyObject::None,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n }];\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a TypeTransition<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a TypeTransition<'a>) -> Result {\n let mut result = vec![];\n let obj = match perm.object_name {\n Some(obj) => obj.try_into()?,\n None => PolicyObject::None,\n };\n result.push(AtomicStatement {\n cmd: CMD_TYPE_TRANSITION,\n subcmd: 0,\n sepol1: perm.source.try_into()?,\n sepol2: perm.target.try_into()?,\n sepol3: perm.class.try_into()?,\n sepol4: perm.default_type.try_into()?,\n sepol5: obj,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a TypeChange<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a TypeChange<'a>) -> Result {\n let mut result = vec![];\n let subcmd = match perm.op {\n \"type_change\" => 1,\n \"type_member\" => 2,\n _ => 0,\n };\n result.push(AtomicStatement {\n cmd: CMD_TYPE_CHANGE,\n subcmd,\n sepol1: perm.source.try_into()?,\n sepol2: perm.target.try_into()?,\n sepol3: perm.class.try_into()?,\n sepol4: perm.default_type.try_into()?,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n });\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a GenFsCon<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(perm: &'a GenFsCon<'a>) -> Result {\n let result = vec![AtomicStatement {\n cmd: CMD_GENFSCON,\n subcmd: 0,\n sepol1: perm.fs_name.try_into()?,\n sepol2: perm.partial_path.try_into()?,\n sepol3: perm.fs_context.try_into()?,\n sepol4: PolicyObject::None,\n sepol5: PolicyObject::None,\n sepol6: PolicyObject::None,\n sepol7: PolicyObject::None,\n }];\n Ok(result)\n }\n}\n\nimpl<'a> TryFrom<&'a PolicyStatement<'a>> for Vec {\n type Error = anyhow::Error;\n fn try_from(value: &'a PolicyStatement) -> Result {\n match value {\n PolicyStatement::NormalPerm(perm) => perm.try_into(),\n PolicyStatement::XPerm(perm) => perm.try_into(),\n PolicyStatement::TypeState(perm) => perm.try_into(),\n PolicyStatement::Type(perm) => perm.try_into(),\n PolicyStatement::TypeAttr(perm) => perm.try_into(),\n PolicyStatement::Attr(perm) => perm.try_into(),\n PolicyStatement::TypeTransition(perm) => perm.try_into(),\n PolicyStatement::TypeChange(perm) => perm.try_into(),\n PolicyStatement::GenFsCon(perm) => perm.try_into(),\n }\n }\n}\n\n////////////////////////////////////////////////////////////////\n/// for C FFI to call kernel interface\n///////////////////////////////////////////////////////////////\n\n#[derive(Debug)]\n#[repr(C)]\nstruct FfiPolicy {\n cmd: u32,\n subcmd: u32,\n sepol1: *const ffi::c_char,\n sepol2: *const ffi::c_char,\n sepol3: *const ffi::c_char,\n sepol4: *const ffi::c_char,\n sepol5: *const ffi::c_char,\n sepol6: *const ffi::c_char,\n sepol7: *const ffi::c_char,\n}\n\nfn to_c_ptr(pol: &PolicyObject) -> *const ffi::c_char {\n match pol {\n PolicyObject::None | PolicyObject::All => std::ptr::null(),\n PolicyObject::One(s) => s.as_ptr().cast::(),\n }\n}\n\nimpl From for FfiPolicy {\n fn from(policy: AtomicStatement) -> FfiPolicy {\n FfiPolicy {\n cmd: policy.cmd,\n subcmd: policy.subcmd,\n sepol1: to_c_ptr(&policy.sepol1),\n sepol2: to_c_ptr(&policy.sepol2),\n sepol3: to_c_ptr(&policy.sepol3),\n sepol4: to_c_ptr(&policy.sepol4),\n sepol5: to_c_ptr(&policy.sepol5),\n sepol6: to_c_ptr(&policy.sepol6),\n sepol7: to_c_ptr(&policy.sepol7),\n }\n }\n}\n\npub fn check_rule(policy: &str) -> Result<()> {\n let path = Path::new(policy);\n let policy = if path.exists() {\n std::fs::read_to_string(path)?\n } else {\n policy.to_string()\n };\n parse_sepolicy(policy.trim(), true)?;\n Ok(())\n}\n"
},
{
"path": "apd/src/supercall.rs",
"content": "use std::{\n ffi::{CStr, CString},\n fmt::Write,\n fs::File,\n io::{self, Read},\n process,\n process::exit,\n ptr,\n sync::{Arc, Mutex},\n};\n\nuse errno::errno;\nuse libc::{EINVAL, c_int, c_long, c_void, execv, fork, pid_t, setenv, syscall, uid_t, wait};\nuse log::{error, info, warn};\n\nuse crate::package::{read_ap_package_config, synchronize_package_uid};\n\nconst MAJOR: c_long = 0;\nconst MINOR: c_long = 11;\nconst PATCH: c_long = 1;\n\nconst KSTORAGE_EXCLUDE_LIST_GROUP: i32 = 1;\n\nconst __NR_SUPERCALL: c_long = 45;\nconst SUPERCALL_KLOG: c_long = 0x1004;\nconst SUPERCALL_KERNELPATCH_VER: c_long = 0x1008;\nconst SUPERCALL_KERNEL_VER: c_long = 0x1009;\nconst SUPERCALL_SU: c_long = 0x1010;\nconst SUPERCALL_KSTORAGE_WRITE: c_long = 0x1041;\nconst SUPERCALL_SU_GRANT_UID: c_long = 0x1100;\nconst SUPERCALL_SU_REVOKE_UID: c_long = 0x1101;\nconst SUPERCALL_SU_NUMS: c_long = 0x1102;\nconst SUPERCALL_SU_LIST: c_long = 0x1103;\nconst SUPERCALL_SU_RESET_PATH: c_long = 0x1111;\nconst SUPERCALL_SU_GET_SAFEMODE: c_long = 0x1112;\n\nconst SUPERCALL_SCONTEXT_LEN: usize = 0x60;\n\n#[repr(C)]\nstruct SuProfile {\n uid: i32,\n to_uid: i32,\n scontext: [u8; SUPERCALL_SCONTEXT_LEN],\n}\n\nfn ver_and_cmd(cmd: c_long) -> c_long {\n let version_code: u32 = ((MAJOR << 16) + (MINOR << 8) + PATCH).try_into().unwrap();\n ((version_code as c_long) << 32) | (0x1158 << 16) | (cmd & 0xFFFF)\n}\n\nfn sc_su_revoke_uid(key: &CStr, uid: uid_t) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_REVOKE_UID),\n uid,\n ) as c_long\n }\n}\n\nfn sc_su_grant_uid(key: &CStr, profile: &SuProfile) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_GRANT_UID),\n profile,\n ) as c_long\n }\n}\n\nfn sc_kstorage_write(\n key: &CStr,\n gid: i32,\n did: i64,\n data: *mut c_void,\n offset: i32,\n dlen: i32,\n) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KSTORAGE_WRITE),\n gid as c_long,\n did as c_long,\n data,\n (((offset as i64) << 32) | (dlen as i64)) as c_long,\n ) as c_long\n }\n}\n\nfn sc_set_ap_mod_exclude(key: &CStr, uid: i64, exclude: i32) -> c_long {\n sc_kstorage_write(\n key,\n KSTORAGE_EXCLUDE_LIST_GROUP,\n uid,\n &exclude as *const i32 as *mut c_void,\n 0,\n size_of::() as i32,\n )\n}\n\npub fn sc_su_get_safemode(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n warn!(\"[sc_su_get_safemode] null superkey, tell apd we are not in safemode!\");\n return 0;\n }\n\n let key_ptr = key.as_ptr();\n if key_ptr.is_null() {\n warn!(\"[sc_su_get_safemode] superkey pointer is null!\");\n return 0;\n }\n\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key_ptr,\n ver_and_cmd(SUPERCALL_SU_GET_SAFEMODE),\n ) as c_long\n }\n}\n\nfn sc_su(key: &CStr, profile: &SuProfile) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU),\n profile,\n ) as c_long\n }\n}\n\nfn sc_su_reset_path(key: &CStr, path: &CStr) -> c_long {\n if key.to_bytes().is_empty() || path.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_RESET_PATH),\n path.as_ptr(),\n ) as c_long\n }\n}\n\nfn sc_kp_ver(key: &CStr) -> Result {\n if key.to_bytes().is_empty() {\n return Err(-EINVAL);\n }\n let ret = unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KERNELPATCH_VER),\n )\n };\n Ok(ret as u32)\n}\n\nfn sc_k_ver(key: &CStr) -> Result {\n if key.to_bytes().is_empty() {\n return Err(-EINVAL);\n }\n let ret = unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KERNEL_VER),\n )\n };\n Ok(ret as u32)\n}\n\nfn sc_klog(key: &CStr, msg: &CStr) -> c_long {\n if key.to_bytes().is_empty() || msg.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KLOG),\n msg.as_ptr(),\n ) as c_long\n }\n}\n\nfn sc_su_uid_nums(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe { syscall(__NR_SUPERCALL, key.as_ptr(), ver_and_cmd(SUPERCALL_SU_NUMS)) as c_long }\n}\n\nfn sc_su_allow_uids(key: &CStr, buf: &mut [uid_t]) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n if buf.is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_LIST),\n buf.as_mut_ptr(),\n buf.len() as i32,\n ) as c_long\n }\n}\n\nfn read_file_to_string(path: &str) -> io::Result {\n let mut file = File::open(path)?;\n let mut content = String::new();\n file.read_to_string(&mut content)?;\n Ok(content)\n}\n\nfn convert_string_to_u8_array(s: &str) -> [u8; SUPERCALL_SCONTEXT_LEN] {\n let mut u8_array = [0u8; SUPERCALL_SCONTEXT_LEN];\n let bytes = s.as_bytes();\n let len = usize::min(SUPERCALL_SCONTEXT_LEN, bytes.len());\n u8_array[..len].copy_from_slice(&bytes[..len]);\n u8_array\n}\n\nfn convert_superkey(s: &Option) -> Option {\n s.as_ref().and_then(|s| CString::new(s.clone()).ok())\n}\n\npub fn refresh_ap_package_list(skey: &CStr, mutex: &Arc>) {\n let _lock = mutex.lock().unwrap();\n\n let num = sc_su_uid_nums(skey);\n if num < 0 {\n error!(\"[refresh_su_list] Error getting number of UIDs: {}\", num);\n return;\n }\n let num = num as usize;\n let mut uids = vec![0 as uid_t; num];\n let n = sc_su_allow_uids(skey, &mut uids);\n if n < 0 {\n error!(\"[refresh_su_list] Error getting su list\");\n return;\n }\n for uid in &uids {\n if *uid == 0 || *uid == 2000 {\n warn!(\n \"[refresh_ap_package_list] Skip revoking critical uid: {}\",\n uid\n );\n continue;\n }\n info!(\n \"[refresh_ap_package_list] Revoking {} root permission...\",\n uid\n );\n let rc = sc_su_revoke_uid(skey, *uid);\n if rc != 0 {\n error!(\"[refresh_ap_package_list] Error revoking UID: {}\", rc);\n }\n }\n\n if let Err(e) = synchronize_package_uid() {\n error!(\"Failed to synchronize package UIDs: {}\", e);\n }\n\n let package_configs = read_ap_package_config();\n for config in package_configs {\n if config.allow == 1 && config.exclude == 0 {\n let profile = SuProfile {\n uid: config.uid,\n to_uid: config.to_uid,\n scontext: convert_string_to_u8_array(&config.sctx),\n };\n let result = sc_su_grant_uid(skey, &profile);\n info!(\n \"[refresh_ap_package_list] Loading {}: result = {}\",\n config.pkg, result\n );\n }\n if config.allow == 0 && config.exclude == 1 {\n let result = sc_set_ap_mod_exclude(skey, config.uid as i64, 1);\n info!(\n \"[refresh_ap_package_list] Loading exclude {}: result = {}\",\n config.pkg, result\n );\n }\n }\n}\n\npub fn privilege_apd_profile(superkey: &Option) {\n let key = convert_superkey(superkey);\n\n let all_allow_ctx = \"u:r:magisk:s0\";\n let profile = SuProfile {\n uid: process::id().try_into().expect(\"PID conversion failed\"),\n to_uid: 0,\n scontext: convert_string_to_u8_array(all_allow_ctx),\n };\n if let Some(ref key) = key {\n let result = sc_su(key, &profile);\n info!(\"[privilege_apd_profile] result = {}\", result);\n }\n}\n\npub fn init_load_package_uid_config(superkey: &Option) {\n let package_configs = read_ap_package_config();\n let key = convert_superkey(superkey);\n\n for config in package_configs {\n if config.allow == 1 && config.exclude == 0 {\n match key {\n Some(ref key) => {\n let profile = SuProfile {\n uid: config.uid,\n to_uid: config.to_uid,\n scontext: convert_string_to_u8_array(&config.sctx),\n };\n let result = sc_su_grant_uid(key, &profile);\n info!(\"Processed {}: result = {}\", config.pkg, result);\n }\n _ => {\n warn!(\"Superkey is None, skipping config: {}\", config.pkg);\n }\n }\n }\n if config.allow == 0 && config.exclude == 1 {\n match key {\n Some(ref key) => {\n let result = sc_set_ap_mod_exclude(key, config.uid as i64, 1);\n info!(\"Processed exclude {}: result = {}\", config.pkg, result);\n }\n _ => {\n warn!(\"Superkey is None, skipping config: {}\", config.pkg);\n }\n }\n }\n }\n}\n\npub fn init_load_su_path(superkey: &Option) {\n let su_path_file = \"/data/adb/ap/su_path\";\n\n match read_file_to_string(su_path_file) {\n Ok(su_path) => {\n let superkey_cstr = convert_superkey(superkey);\n\n match superkey_cstr {\n Some(superkey_cstr) => match CString::new(su_path.trim()) {\n Ok(su_path_cstr) => {\n let result = sc_su_reset_path(&superkey_cstr, &su_path_cstr);\n if result == 0 {\n info!(\"suPath load successfully\");\n } else {\n warn!(\"Failed to load su path, error code: {}\", result);\n }\n }\n Err(e) => {\n warn!(\"Failed to convert su_path: {}\", e);\n }\n },\n _ => {\n warn!(\"Superkey is None, skipping...\");\n }\n }\n }\n Err(e) => {\n warn!(\"Failed to read su_path file: {}\", e);\n }\n }\n}\n\nfn set_env_var(key: &str, value: &str) {\n let key_c = CString::new(key).expect(\"CString::new failed\");\n let value_c = CString::new(value).expect(\"CString::new failed\");\n unsafe {\n setenv(key_c.as_ptr(), value_c.as_ptr(), 1);\n }\n}\n\nfn log_kernel(key: &CStr, _fmt: &str, args: std::fmt::Arguments) -> c_long {\n let mut buf = String::with_capacity(1024);\n write!(&mut buf, \"{}\", args).expect(\"Error formatting string\");\n\n let c_buf = CString::new(buf).expect(\"CString::new failed\");\n sc_klog(key, &c_buf)\n}\n\n#[macro_export]\nmacro_rules! log_kernel {\n ($key:expr_2021, $fmt:expr_2021, $($arg:tt)*) => (\n log_kernel($key, $fmt, std::format_args!($fmt, $($arg)*))\n )\n}\n\npub fn fork_for_result(exec: &str, argv: &[&str], key: &Option) {\n let mut cmd = String::new();\n for arg in argv {\n cmd.push_str(arg);\n cmd.push(' ');\n }\n\n let superkey_cstr = convert_superkey(key);\n\n match superkey_cstr {\n Some(superkey_cstr) => {\n unsafe {\n let pid: pid_t = fork();\n if pid < 0 {\n log_kernel!(\n &superkey_cstr,\n \"{} fork {} error: {}\\n\",\n libc::getpid(),\n exec,\n -1\n );\n } else if pid == 0 {\n set_env_var(\"KERNELPATCH\", \"true\");\n let kpver = format!(\"{:x}\", sc_kp_ver(&superkey_cstr).unwrap_or(0));\n set_env_var(\"KERNELPATCH_VERSION\", kpver.as_str());\n let kver = format!(\"{:x}\", sc_k_ver(&superkey_cstr).unwrap_or(0));\n set_env_var(\"KERNEL_VERSION\", kver.as_str());\n\n let c_exec = CString::new(exec).expect(\"CString::new failed\");\n let c_argv: Vec =\n argv.iter().map(|&arg| CString::new(arg).unwrap()).collect();\n let mut c_argv_ptrs: Vec<*const libc::c_char> =\n c_argv.iter().map(|arg| arg.as_ptr()).collect();\n c_argv_ptrs.push(ptr::null());\n\n execv(c_exec.as_ptr(), c_argv_ptrs.as_ptr());\n\n log_kernel!(\n &superkey_cstr,\n \"{} exec {} error: {}\\n\",\n libc::getpid(),\n cmd,\n CStr::from_ptr(libc::strerror(errno().0))\n .to_string_lossy()\n .into_owned()\n );\n exit(1); // execv only returns on error\n } else {\n let mut status: c_int = 0;\n wait(&mut status);\n log_kernel!(\n &superkey_cstr,\n \"{} wait {} status: 0x{}\\n\",\n libc::getpid(),\n cmd,\n status\n );\n }\n }\n }\n _ => {\n warn!(\"[fork_for_result] SuperKey convert failed!\");\n }\n }\n}\n"
},
{
"path": "apd/src/utils.rs",
"content": "#[allow(unused_imports)]\nuse std::fs::{Permissions, set_permissions};\n#[cfg(unix)]\nuse std::os::unix::prelude::PermissionsExt;\nuse std::{\n ffi::CString,\n fs::{File, OpenOptions, create_dir_all, metadata},\n io::{ErrorKind::AlreadyExists, Write},\n path::Path,\n process::{Command, Stdio},\n};\n\nuse anyhow::{Context, Error, Ok, Result, bail};\nuse log::{info, warn};\n\nuse crate::{defs, supercall::sc_su_get_safemode};\n\npub fn ensure_file_exists>(file: T) -> Result<()> {\n match File::options().write(true).create_new(true).open(&file) {\n Result::Ok(_) => Ok(()),\n Err(err) => {\n if err.kind() == AlreadyExists && file.as_ref().is_file() {\n Ok(())\n } else {\n Err(Error::from(err))\n .with_context(|| format!(\"{} is not a regular file\", file.as_ref().display()))\n }\n }\n }\n}\n\npub fn ensure_dir_exists>(dir: T) -> Result<()> {\n let result = create_dir_all(&dir).map_err(Error::from);\n if dir.as_ref().is_dir() {\n result\n } else if result.is_ok() {\n bail!(\"{} is not a regular directory\", dir.as_ref().display())\n } else {\n result\n }\n}\n\n// todo: ensure\npub fn ensure_binary>(path: T) -> Result<()> {\n set_permissions(&path, Permissions::from_mode(0o755))?;\n Ok(())\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn getprop(prop: &str) -> Option {\n android_properties::getprop(prop).value()\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn getprop(_prop: &str) -> Option {\n unimplemented!()\n}\npub fn run_command(\n command: &str,\n args: &[&str],\n stdout: Option,\n) -> Result {\n let mut command_builder = Command::new(command);\n command_builder.args(args);\n if let Some(out) = stdout {\n command_builder.stdout(out);\n }\n let child = command_builder.spawn()?;\n Ok(child)\n}\npub fn is_safe_mode(superkey: Option) -> bool {\n let safemode = getprop(\"persist.sys.safemode\")\n .filter(|prop| prop == \"1\")\n .is_some()\n || getprop(\"ro.sys.safemode\")\n .filter(|prop| prop == \"1\")\n .is_some();\n info!(\"safemode: {}\", safemode);\n if safemode {\n return true;\n }\n let safemode = superkey\n .as_ref()\n .and_then(|key_str| CString::new(key_str.as_str()).ok())\n .map_or_else(\n || {\n warn!(\"[is_safe_mode] No valid superkey provided, assuming safemode as false.\");\n false\n },\n |cstr| sc_su_get_safemode(&cstr) == 1,\n );\n info!(\"kernel_safemode: {}\", safemode);\n safemode\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn switch_mnt_ns(pid: i32) -> Result<()> {\n use std::os::fd::AsRawFd;\n\n use anyhow::ensure;\n let path = format!(\"/proc/{pid}/ns/mnt\");\n let fd = File::open(path)?;\n let current_dir = std::env::current_dir();\n let ret = unsafe { libc::setns(fd.as_raw_fd(), libc::CLONE_NEWNS) };\n if let Result::Ok(current_dir) = current_dir {\n let _ = std::env::set_current_dir(current_dir);\n }\n ensure!(ret == 0, \"switch mnt ns failed\");\n Ok(())\n}\n\nfn switch_cgroup(grp: &str, pid: u32) {\n let path = Path::new(grp).join(\"cgroup.procs\");\n if !path.exists() {\n return;\n }\n\n let fp = OpenOptions::new().append(true).open(path);\n if let Result::Ok(mut fp) = fp {\n let _ = write!(fp, \"{pid}\");\n }\n}\n\npub fn switch_cgroups() {\n let pid = std::process::id();\n switch_cgroup(\"/acct\", pid);\n switch_cgroup(\"/dev/cg2_bpf\", pid);\n switch_cgroup(\"/sys/fs/cgroup\", pid);\n\n if getprop(\"ro.config.per_app_memcg\")\n .filter(|prop| prop == \"false\")\n .is_none()\n {\n switch_cgroup(\"/dev/memcg/apps\", pid);\n }\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn umask(mask: u32) {\n unsafe { libc::umask(mask) };\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn umask(_mask: u32) {\n unimplemented!(\"umask is not supported on this platform\")\n}\n\npub fn has_magisk() -> bool {\n which::which(\"magisk\").is_ok()\n}\npub fn get_tmp_path() -> &'static str {\n if metadata(defs::TEMP_DIR_LEGACY).is_ok() {\n return defs::TEMP_DIR_LEGACY;\n }\n if metadata(defs::TEMP_DIR).is_ok() {\n return defs::TEMP_DIR;\n }\n \"\"\n}\n"
},
{
"path": "app/.gitignore",
"content": "/build\n/release/\n"
},
{
"path": "app/build.gradle.kts",
"content": "@file:Suppress(\"UnstableApiUsage\")\n\nimport com.android.build.gradle.tasks.PackageAndroidArtifact\nimport org.jetbrains.kotlin.gradle.dsl.JvmTarget\nimport java.net.URI\n\nplugins {\n alias(libs.plugins.agp.app)\n alias(libs.plugins.kotlin.compose.compiler)\n alias(libs.plugins.ksp)\n alias(libs.plugins.lsplugin.apksign)\n alias(libs.plugins.lsplugin.resopt)\n id(\"kotlin-parcelize\")\n}\n\nval androidCompileSdkVersion: Int by rootProject.extra\nval androidCompileNdkVersion: String by rootProject.extra\nval androidBuildToolsVersion: String by rootProject.extra\nval androidMinSdkVersion: Int by rootProject.extra\nval androidTargetSdkVersion: Int by rootProject.extra\nval androidSourceCompatibility: JavaVersion by rootProject.extra\nval androidTargetCompatibility: JavaVersion by rootProject.extra\nval managerVersionCode: Int by rootProject.extra\nval managerVersionName: String by rootProject.extra\nval branchName: String by rootProject.extra\nval kernelPatchVersion: String by rootProject.extra\n\napksign {\n storeFileProperty = \"KEYSTORE_FILE\"\n storePasswordProperty = \"KEYSTORE_PASSWORD\"\n keyAliasProperty = \"KEY_ALIAS\"\n keyPasswordProperty = \"KEY_PASSWORD\"\n}\n\nval ccache = System.getenv(\"PATH\")?.split(File.pathSeparator)\n ?.map { File(it, \"ccache\") }?.firstOrNull { it.exists() }?.absolutePath\n\nval baseFlags = listOf(\n \"-Wall\", \"-Qunused-arguments\", \"-fno-rtti\", \"-fvisibility=hidden\",\n \"-fvisibility-inlines-hidden\", \"-fno-exceptions\", \"-fno-stack-protector\",\n \"-fomit-frame-pointer\", \"-Wno-builtin-macro-redefined\", \"-Wno-unused-value\",\n \"-D__FILE__=__FILE_NAME__\",\n \"-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON\", \"-Wno-unused\", \"-Wno-unused-parameter\",\n \"-Wno-unused-command-line-argument\", \"-Wno-incompatible-function-pointer-types\",\n \"-U_FORTIFY_SOURCE\", \"-D_FORTIFY_SOURCE=0\"\n)\n\nval baseArgs = mutableListOf(\n \"-DANDROID_STL=none\", \"-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON\",\n \"-DCMAKE_CXX_STANDARD=23\", \"-DCMAKE_C_STANDARD=23\",\n \"-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON\", \"-DCMAKE_VISIBILITY_INLINES_HIDDEN=ON\",\n \"-DCMAKE_CXX_VISIBILITY_PRESET=hidden\", \"-DCMAKE_C_VISIBILITY_PRESET=hidden\"\n).apply { if (ccache != null) add(\"-DANDROID_CCACHE=$ccache\") }\n\nandroid {\n namespace = \"me.bmax.apatch\"\n\n buildTypes {\n debug {\n isDebuggable = true\n isMinifyEnabled = false\n isShrinkResources = false\n proguardFiles(\n getDefaultProguardFile(\"proguard-android-optimize.txt\"),\n \"proguard-rules.pro\"\n )\n externalNativeBuild {\n cmake {\n arguments += listOf(\"-DCMAKE_CXX_FLAGS_DEBUG=-Og\", \"-DCMAKE_C_FLAGS_DEBUG=-Og\")\n }\n }\n }\n release {\n isMinifyEnabled = true\n isShrinkResources = true\n isDebuggable = false\n multiDexEnabled = true\n vcsInfo.include = false\n proguardFiles(\n getDefaultProguardFile(\"proguard-android-optimize.txt\"),\n \"proguard-rules.pro\"\n )\n externalNativeBuild {\n cmake {\n val relFlags = listOf(\n \"-flto\", \"-ffunction-sections\", \"-fdata-sections\", \"-Wl,--gc-sections\",\n \"-fno-unwind-tables\", \"-fno-asynchronous-unwind-tables\", \"-Wl,--exclude-libs,ALL\",\n \"-Ofast\", \"-fmerge-all-constants\", \"-flto=full\", \"-ffat-lto-objects\",\n \"-fno-semantic-interposition\", \"-fno-threadsafe-statics\"\n )\n cppFlags += relFlags\n cFlags += relFlags\n arguments += listOf(\"-DCMAKE_BUILD_TYPE=Release\", \"-DCMAKE_CXX_FLAGS_RELEASE=-O3 -DNDEBUG\", \"-DCMAKE_C_FLAGS_RELEASE=-O3 -DNDEBUG\")\n }\n }\n }\n }\n\n dependenciesInfo.includeInApk = false\n\n buildFeatures {\n aidl = true\n buildConfig = true\n compose = true\n prefab = true\n }\n\n defaultConfig {\n minSdk = androidMinSdkVersion\n targetSdk = androidTargetSdkVersion\n versionCode = managerVersionCode\n versionName = managerVersionName\n ndk.abiFilters.addAll(arrayOf(\"arm64-v8a\"))\n externalNativeBuild {\n cmake {\n cppFlags += baseFlags + \"-std=c++2b\"\n cFlags += baseFlags + \"-std=c2x\"\n arguments += baseArgs\n abiFilters(\"arm64-v8a\")\n }\n }\n buildConfigField(\"String\", \"buildKPV\", \"\\\"$kernelPatchVersion\\\"\")\n base.archivesName = \"APatch_${managerVersionCode}_${managerVersionName}_${branchName}\"\n }\n\n compileOptions {\n sourceCompatibility = JavaVersion.VERSION_21\n targetCompatibility = JavaVersion.VERSION_21\n }\n\n packaging {\n jniLibs {\n useLegacyPackaging = true\n }\n resources {\n excludes += \"**\"\n merges += \"META-INF/com/google/android/**\"\n }\n }\n\n externalNativeBuild {\n cmake {\n version = \"3.28.0+\"\n path(\"src/main/cpp/CMakeLists.txt\")\n }\n }\n\n androidResources {\n generateLocaleConfig = true\n }\n\n compileSdk = androidCompileSdkVersion\n ndkVersion = androidCompileNdkVersion\n buildToolsVersion = androidBuildToolsVersion\n\n lint {\n abortOnError = false\n checkReleaseBuilds = false\n }\n\n android.sourceSets.named(\"main\") {\n kotlin.directories += \"build/generated/ksp/$name/kotlin\"\n jniLibs.directories += \"libs\"\n }\n}\n\n// https://stackoverflow.com/a/77745844\ntasks.withType {\n doFirst { appMetadata.asFile.orNull?.writeText(\"\") }\n}\n\njava {\n toolchain {\n languageVersion = JavaLanguageVersion.of(21)\n }\n}\n\nkotlin {\n jvmToolchain(21)\n compilerOptions {\n jvmTarget = JvmTarget.JVM_21\n }\n}\n\nfun registerDownloadTask(\n taskName: String, srcUrl: String, destPath: String, project: Project\n) {\n project.tasks.register(taskName) {\n val destFile = File(destPath)\n\n doLast {\n if (!destFile.exists() || isFileUpdated(srcUrl, destFile)) {\n println(\" - Downloading $srcUrl to ${destFile.absolutePath}\")\n downloadFile(srcUrl, destFile)\n println(\" - Download completed.\")\n } else {\n println(\" - File is up-to-date, skipping download.\")\n }\n }\n }\n}\n\nfun isFileUpdated(url: String, localFile: File): Boolean {\n val connection = URI.create(url).toURL().openConnection()\n val remoteLastModified = connection.getHeaderFieldDate(\"Last-Modified\", 0L)\n return remoteLastModified > localFile.lastModified()\n}\n\nfun downloadFile(url: String, destFile: File) {\n URI.create(url).toURL().openStream().use { input ->\n destFile.outputStream().use { output ->\n input.copyTo(output)\n }\n }\n}\n\nregisterDownloadTask(\n taskName = \"downloadKpimg\",\n srcUrl = \"https://github.com/bmax121/KernelPatch/releases/download/$kernelPatchVersion/kpimg-android\",\n destPath = \"${project.projectDir}/src/main/assets/kpimg\",\n project = project\n)\n\nregisterDownloadTask(\n taskName = \"downloadKptools\",\n srcUrl = \"https://github.com/bmax121/KernelPatch/releases/download/$kernelPatchVersion/kptools-android\",\n destPath = \"${project.projectDir}/libs/arm64-v8a/libkptools.so\",\n project = project\n)\n\n// Compat kp version less than 0.10.7\n// TODO: Remove in future\nregisterDownloadTask(\n taskName = \"downloadCompatKpatch\",\n srcUrl = \"https://github.com/bmax121/KernelPatch/releases/download/0.10.7/kpatch-android\",\n destPath = \"${project.projectDir}/libs/arm64-v8a/libkpatch.so\",\n project = project\n)\n\ntasks.register(\"mergeScripts\") {\n into(\"${project.projectDir}/src/main/resources/META-INF/com/google/android\")\n from(rootProject.file(\"${project.rootDir}/scripts/update_binary.sh\")) {\n rename { \"update-binary\" }\n }\n from(rootProject.file(\"${project.rootDir}/scripts/update_script.sh\")) {\n rename { \"updater-script\" }\n }\n}\n\ntasks.getByName(\"preBuild\").dependsOn(\n \"downloadKpimg\",\n \"downloadKptools\",\n \"downloadCompatKpatch\",\n \"mergeScripts\",\n)\n\n// https://github.com/bbqsrc/cargo-ndk\n// cargo ndk -t arm64-v8a build --release\ntasks.register(\"cargoBuild\") {\n executable(\"cargo\")\n args(\"ndk\", \"-t\", \"arm64-v8a\", \"build\", \"--release\")\n workingDir(\"${project.rootDir}/apd\")\n}\n\ntasks.register(\"buildApd\") {\n dependsOn(\"cargoBuild\")\n from(\"${project.rootDir}/apd/target/aarch64-linux-android/release/apd\")\n into(\"${project.projectDir}/libs/arm64-v8a\")\n rename(\"apd\", \"libapd.so\")\n}\n\ntasks.configureEach {\n if (name == \"mergeDebugJniLibFolders\" || name == \"mergeReleaseJniLibFolders\") {\n dependsOn(\"buildApd\")\n }\n}\n\ntasks.register(\"cargoClean\") {\n executable(\"cargo\")\n args(\"clean\")\n workingDir(\"${project.rootDir}/apd\")\n}\n\ntasks.register(\"apdClean\") {\n dependsOn(\"cargoClean\")\n delete(file(\"${project.projectDir}/libs/arm64-v8a/libapd.so\"))\n}\n\ntasks.clean {\n dependsOn(\"apdClean\")\n}\n\nksp {\n arg(\"compose-destinations.defaultTransitions\", \"none\")\n}\n\ndependencies {\n implementation(libs.androidx.appcompat)\n implementation(libs.androidx.activity.compose)\n implementation(libs.androidx.core.splashscreen)\n implementation(libs.androidx.webkit)\n\n implementation(platform(libs.androidx.compose.bom))\n implementation(libs.androidx.compose.material.icons.extended)\n implementation(libs.androidx.compose.material3)\n implementation(libs.androidx.compose.ui)\n implementation(libs.androidx.compose.ui.tooling.preview)\n implementation(libs.androidx.compose.runtime.livedata)\n\n debugImplementation(libs.androidx.compose.ui.test.manifest)\n debugImplementation(libs.androidx.compose.ui.tooling)\n\n implementation(libs.androidx.lifecycle.runtime.compose)\n implementation(libs.androidx.lifecycle.runtime.ktx)\n implementation(libs.androidx.lifecycle.viewmodel.compose)\n\n implementation(libs.compose.destinations.core)\n ksp(libs.compose.destinations.ksp)\n\n implementation(libs.com.github.topjohnwu.libsu.core)\n implementation(libs.com.github.topjohnwu.libsu.service)\n implementation(libs.com.github.topjohnwu.libsu.nio)\n implementation(libs.com.github.topjohnwu.libsu.io)\n\n implementation(libs.dev.rikka.rikkax.parcelablelist)\n\n implementation(libs.io.coil.kt.coil.compose)\n\n implementation(libs.kotlinx.coroutines.core)\n\n implementation(libs.me.zhanghai.android.appiconloader.coil)\n\n implementation(libs.sheet.compose.dialogs.core)\n implementation(libs.sheet.compose.dialogs.list)\n implementation(libs.sheet.compose.dialogs.input)\n\n implementation(libs.markdown)\n\n implementation(libs.ini4j)\n\n compileOnly(libs.cxx)\n}\n"
},
{
"path": "app/libs/arm64-v8a/.gitignore",
"content": "libkptools.so\nlibapjni.so\nlibkpatch.so\nlibapd.so"
},
{
"path": "app/proguard-rules.pro",
"content": "-dontwarn org.bouncycastle.jsse.BCSSLParameters\n-dontwarn org.bouncycastle.jsse.BCSSLSocket\n-dontwarn org.bouncycastle.jsse.provider.BouncyCastleJsseProvider\n-dontwarn org.conscrypt.Conscrypt$Version\n-dontwarn org.conscrypt.Conscrypt\n-dontwarn org.conscrypt.ConscryptHostnameVerifier\n-dontwarn org.openjsse.javax.net.ssl.SSLParameters\n-dontwarn org.openjsse.javax.net.ssl.SSLSocket\n-dontwarn org.openjsse.net.ssl.OpenJSSE\n-dontwarn java.beans.Introspector\n-dontwarn java.beans.VetoableChangeListener\n-dontwarn java.beans.VetoableChangeSupport\n-dontwarn java.beans.BeanInfo\n-dontwarn java.beans.IntrospectionException\n-dontwarn java.beans.PropertyDescriptor\n\n# Keep ini4j Service Provider Interface\n-keep,allowobfuscation,allowoptimization class org.ini4j.spi.** { *; }\n\n# Kotlin\n-assumenosideeffects class kotlin.jvm.internal.Intrinsics {\n public static void check*(...);\n public static void throw*(...);\n}\n\n-repackageclasses\n-allowaccessmodification\n-overloadaggressively\n-renamesourcefileattribute SourceFile\n"
},
{
"path": "app/src/main/AndroidManifest.xml",
"content": "\n\n\n \n \n \n \n\n \n\n \n \n \n \n \n \n\n \n\n \n\n \n \n \n\n \n \n \n\n \n\n\n"
},
{
"path": "app/src/main/aidl/me/bmax/apatch/IAPRootService.aidl",
"content": "// IAPRootService.aidl\npackage me.bmax.apatch;\n\nimport android.content.pm.PackageInfo;\nimport rikka.parcelablelist.ParcelableListSlice;\n\ninterface IAPRootService {\n ParcelableListSlice getPackages(int flags);\n}"
},
{
"path": "app/src/main/assets/.gitignore",
"content": "kpimg\n*.kpm"
},
{
"path": "app/src/main/assets/InstallAP.sh",
"content": "#!/bin/sh\n# By SakuraKyuo\n\nOUTFD=/proc/self/fd/$2\n\nfunction ui_print() {\n echo -e \"ui_print $1\\nui_print\" >> $OUTFD\n}\n\nfunction ui_printfile() {\n while IFS='' read -r line || $BB [[ -n \"$line\" ]]; do\n ui_print \"$line\";\n done < $1;\n}\n\nfunction kernelFlagsErr(){\n\tui_print \"- Installation has Aborted!\"\n\tui_print \"- APatch requires CONFIG_KALLSYMS to be Enabled.\"\n\tui_print \"- But your kernel seems NOT enabled it.\"\n\texit\n}\n\nfunction apatchNote(){\n\tui_print \"- APatch Patch Done\"\n\tui_print \"- APatch Key is: Ap$skey\"\n\tui_print \"- We do have saved Origin Boot image to /data\"\n\tui_print \"- If you encounter bootloop, reboot into Recovery and flash it\"\n\texit\n}\n\nfunction failed(){\n\tui_printfile /dev/tmp/install/log\n\tui_print \"- APatch Patch Failed.\"\n\tui_print \"- Please feedback to the developer with the screenshots.\"\n\texit\n}\n\nfunction boot_execute_ab(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tif [[ ! $(./lib/arm64-v8a/libkptools.so -i ./kernel -f | grep CONFIG_KALLSYMS=y) ]]; then\n\t\tkernelFlagsErr\n\tfi\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -p --image kernel-origin --skey \"Ap$skey\" --kpimg ./assets/kpimg --out ./kernel 2>&1 | tee /dev/tmp/install/log\n\tif [[ ! $(cat /dev/tmp/install/log | grep \"patch done\") ]]; then\n\t\tfailed\n\tfi\n\tui_printfile /dev/tmp/install/log\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot\n\tmv boot.img /data/boot.img\n\tapatchNote\n}\n\nfunction boot_execute(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tif [[ ! $(./lib/arm64-v8a/libkptools.so -i ./kernel -f | grep CONFIG_KALLSYMS=y) ]]; then\n\t\tkernelFlagsErr\n\tfi\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -p --image kernel-origin --skey \"Ap$skey\" --kpimg ./assets/kpimg --out ./kernel 2>&1 | tee /dev/tmp/install/log\n\tif [[ ! $(cat /dev/tmp/install/log | grep \"patch done\") ]]; then\n\t\tfailed\n\tfi\n\tui_printfile /dev/tmp/install/log\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot\n\tmv boot.img /data/boot.img\n\tapatchNote\n}\n\nfunction main(){\n\ncd /dev/tmp/install\n\nchmod a+x ./assets/kpimg\nchmod a+x ./lib/arm64-v8a/libkptools.so\n\nslot=$(getprop ro.boot.slot_suffix)\n\nskey=$(cat /proc/sys/kernel/random/uuid | cut -d \\- -f1)\n\nif [[ ! \"$slot\" == \"\" ]]; then\n\n\tui_print \"\"\n\tui_print \"- You are using A/B device.\"\n\n\t# Script author\n\tui_print \"- Install Script by SakuraKyuo\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot$slot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute_ab\n\tfi\n\nelse\n\n\tui_print \"You are using A Only device.\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute\n\tfi\n\nfi\n\n}\n\nmain\n"
},
{
"path": "app/src/main/assets/UninstallAP.sh",
"content": "#!/bin/sh\n# By SakuraKyuo\n\nOUTFD=/proc/self/fd/$2\n\nfunction ui_print() {\n echo -e \"ui_print $1\\nui_print\" >> $OUTFD\n}\n\nfunction ui_printfile() {\n while IFS='' read -r line || $BB [[ -n \"$line\" ]]; do\n ui_print \"$line\";\n done < $1;\n}\n\nfunction apatchNote(){\n\tui_print \"- APatch Unpatch Done\"\n\texit\n}\n\nfunction failed(){\n\tui_print \"- APatch Unpatch Failed.\"\n\tui_print \"- Please feedback to the developer with the screenshots.\"\n\texit\n}\n\nfunction boot_execute_ab(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -u --image kernel-origin --out ./kernel\n\tif [[ ! \"$?\" == 0 ]]; then\n\t\tfailed\n\tfi\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot\n\tapatchNote\n}\n\nfunction boot_execute(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -u --image kernel-origin --out ./kernel\n\tif [[ ! \"$?\" == 0 ]]; then\n\t\tfailed\n\tfi\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot\n\tapatchNote\n}\n\nfunction main(){\n\ncd /dev/tmp/install\n\nchmod a+x ./lib/arm64-v8a/libkptools.so\n\n\nslot=$(getprop ro.boot.slot_suffix)\n\nif [[ ! \"$slot\" == \"\" ]]; then\n\n\tui_print \"\"\n\tui_print \"- You are using A/B device.\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot$slot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute_ab\n\tfi\n\nelse\n\n\tui_print \"You are using A Only device.\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute\n\tfi\n\nfi\n\n}\n\nmain"
},
{
"path": "app/src/main/assets/boot_extract.sh",
"content": "#!/system/bin/sh\n\nARCH=$(getprop ro.product.cpu.abi)\n\nIS_INSTALL_NEXT_SLOT=$1\n\n# Load utility functions\n. ./util_functions.sh\n\nif [ \"$IS_INSTALL_NEXT_SLOT\" = \"true\" ]; then\n get_next_slot\nelse\n get_current_slot\nfi\n\nfind_boot_image\n\n[ -e \"$BOOTIMAGE\" ] || { >&2 echo \"- can't find boot.img!\"; exit 1; }\n\ntrue\n"
},
{
"path": "app/src/main/assets/boot_patch.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# APatch Boot Image Patcher\n#######################################################################################\n#\n# Usage: boot_patch.sh [ARGS_PASS_TO_KPTOOLS]\n#\n# This script should be placed in a directory with the following files:\n#\n# File name Type Description\n#\n# boot_patch.sh script A script to patch boot image for APatch.\n# (this file) The script will use files in its same\n# directory to complete the patching process.\n# bootimg binary The target boot image\n# kpimg binary KernelPatch core Image\n# kptools executable The KernelPatch tools binary to inject kpimg to kernel Image\n#\n#######################################################################################\n\nARCH=$(getprop ro.product.cpu.abi)\n\n# Load utility functions\n. ./util_functions.sh\n\necho \"****************************\"\necho \" APatch Boot Image Patcher\"\necho \"****************************\"\n\nSUPERKEY=\"$1\"\nBOOTIMAGE=$2\nFLASH_TO_DEVICE=$3\nshift 2\n\n[ -z \"$SUPERKEY\" ] && { >&2 echo \"- SuperKey empty!\"; exit 1; }\n[ -e \"$BOOTIMAGE\" ] || { >&2 echo \"- $BOOTIMAGE does not exist!\"; exit 1; }\n\n# Check for dependencies\n\ncommand -v ./kptools >/dev/null 2>&1 || { >&2 echo \"- Command kptools not found!\"; exit 1; }\n\nif [ ! -f kernel ]; then\necho \"- Unpacking boot image\"\n\nset -x\n./kptools unpack \"$BOOTIMAGE\" \"$@\"\npatch_rc=$?\nset +x\n if [ $patch_rc -ne 0 ]; then\n >&2 echo \"- Unpack error: $patch_rc\"\n exit $?\n fi\nfi\n\nif [ ! $(./kptools -i kernel -f | grep CONFIG_KALLSYMS=y) ]; then\n\techo \"- Patcher has Aborted!\"\n\techo \"- APatch requires CONFIG_KALLSYMS to be Enabled.\"\n\techo \"- But your kernel seems NOT enabled it.\"\n\texit 0\nfi\n\nif [ $(./kptools -i kernel -l | grep patched=false) ]; then\n\techo \"- Backing boot.img \"\n cp \"$BOOTIMAGE\" \"ori.img\" >/dev/null 2>&1\nfi\n\nmv kernel kernel.ori\n\necho \"- Patching kernel\"\n\nset -x\n./kptools -p -i kernel.ori -S \"$SUPERKEY\" -k kpimg -o kernel \"$@\"\npatch_rc=$?\nset +x\n\nif [ $patch_rc -ne 0 ]; then\n >&2 echo \"- Patch kernel error: $patch_rc\"\n exit $?\nfi\n\necho \"- Repacking boot image\"\n./kptools repack \"$BOOTIMAGE\"\n\nif [ ! $(./kptools -i kernel.ori -f | grep CONFIG_KALLSYMS_ALL=y) ]; then\n\techo \"- Detected CONFIG_KALLSYMS_ALL is not set!\"\n\techo \"- APatch has patched but maybe your device won't boot.\"\n\techo \"- Make sure you have original boot image backup.\"\nfi\n\nif [ $? -ne 0 ]; then\n >&2 echo \"- Repack error: $?\"\n exit $?\nfi\n\nif [ \"$FLASH_TO_DEVICE\" = \"true\" ]; then\n # flash\n if [ -b \"$BOOTIMAGE\" ] || [ -c \"$BOOTIMAGE\" ] && [ -f \"new-boot.img\" ]; then\n echo \"- Flashing new boot image\"\n flash_image new-boot.img \"$BOOTIMAGE\"\n if [ $? -ne 0 ]; then\n >&2 echo \"- Flash error: $?\"\n exit $?\n fi\n fi\n\n echo \"- Successfully Flashed!\"\nelse\n echo \"- Successfully Patched!\"\nfi\n\n"
},
{
"path": "app/src/main/assets/boot_unpatch.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# APatch Boot Image Unpatcher\n#######################################################################################\n\nARCH=$(getprop ro.product.cpu.abi)\n\n# Load utility functions\n. ./util_functions.sh\n\necho \"****************************\"\necho \" APatch Boot Image Unpatcher\"\necho \"****************************\"\n\nBOOTIMAGE=$1\n\n[ -e \"$BOOTIMAGE\" ] || { echo \"- $BOOTIMAGE does not exist!\"; exit 1; }\n\necho \"- Target image: $BOOTIMAGE\"\n\n # Check for dependencies\n\ncommand -v ./kptools >/dev/null 2>&1 || { echo \"- Command kptools not found!\"; exit 1; }\n\nif [ ! -f kernel ]; then\necho \"- Unpacking boot image\"\n\nset -x\n./kptools unpack \"$BOOTIMAGE\" \"$@\"\npatch_rc=$?\nif [ $patch_rc -ne 0 ]; then\n >&2 echo \"- Unpack error: $patch_rc\"\n exit $patch_rc\n fi\nfi\n\nif [ ! $(./kptools -i kernel -l | grep patched=false) ]; then\n\techo \"- kernel has been patched \"\n if [ -f \"new-boot.img\" ]; then\n echo \"- found backup boot.img ,use it for recovery\"\n else\n mv kernel kernel.ori\n echo \"- Unpatching kernel\"\n ./kptools -u --image kernel.ori --out kernel \"$@\"\n if [ $? -ne 0 ]; then\n >&2 echo \"- Unpatch error: $?\"\n exit $?\n fi\n echo \"- Repacking boot image\"\n ./kptools repack \"$BOOTIMAGE\"\n if [ $? -ne 0 ]; then\n >&2 echo \"- Repack error: $?\"\n exit $?\n fi\n fi\n\nelse\n echo \"- no need unpatch\"\n exit 0\nfi\n\n\n\nif [ -f \"new-boot.img\" ]; then\n echo \"- Flashing boot image\"\n flash_image new-boot.img \"$BOOTIMAGE\"\n\n if [ $? -ne 0 ]; then\n >&2 echo \"- Flash error: $?\"\n exit $?\n fi\nfi\n\necho \"- Flash successful\"\n\n# Reset any error code\ntrue\n"
},
{
"path": "app/src/main/assets/util_functions.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# Helper Functions (credits to topjohnwu)\n#######################################################################################\nAPATCH_VER='0.10.4'\nAPATCH_VER_CODE=164\n\nui_print() {\n if $BOOTMODE; then\n echo \"$1\"\n else\n echo -e \"ui_print $1\\nui_print\" >> /proc/self/fd/$OUTFD\n fi\n}\n\ntoupper() {\n echo \"$@\" | tr '[:lower:]' '[:upper:]'\n}\n\ngrep_cmdline() {\n local REGEX=\"s/^$1=//p\"\n { echo $(cat /proc/cmdline)$(sed -e 's/[^\"]//g' -e 's/\"\"//g' /proc/cmdline) | xargs -n 1; \\\n sed -e 's/ = /=/g' -e 's/, /,/g' -e 's/\"//g' /proc/bootconfig; \\\n } 2>/dev/null | sed -n \"$REGEX\"\n}\n\ngrep_prop() {\n local REGEX=\"s/^$1=//p\"\n shift\n local FILES=$@\n [ -z \"$FILES\" ] && FILES='/system/build.prop'\n cat $FILES 2>/dev/null | dos2unix | sed -n \"$REGEX\" | head -n 1\n}\n\ngetvar() {\n local VARNAME=$1\n local VALUE\n local PROPPATH='/data/.magisk /cache/.magisk'\n [ ! -z $MAGISKTMP ] && PROPPATH=\"$MAGISKTMP/.magisk/config $PROPPATH\"\n VALUE=$(grep_prop $VARNAME $PROPPATH)\n [ ! -z $VALUE ] && eval $VARNAME=\\$VALUE\n}\n\nis_mounted() {\n grep -q \" $(readlink -f $1) \" /proc/mounts 2>/dev/null\n return $?\n}\nabort() {\n ui_print \"$1\"\n $BOOTMODE || recovery_cleanup\n [ ! -z $MODPATH ] && rm -rf $MODPATH\n rm -rf $TMPDIR\n exit 1\n}\nset_nvbase() {\n NVBASE=\"$1\"\n MAGISKBIN=\"$1/magisk\"\n}\n\nprint_title() {\n local len line1len line2len bar\n line1len=$(echo -n $1 | wc -c)\n line2len=$(echo -n $2 | wc -c)\n len=$line2len\n [ $line1len -gt $line2len ] && len=$line1len\n len=$((len + 2))\n bar=$(printf \"%${len}s\" | tr ' ' '*')\n ui_print \"$bar\"\n ui_print \" $1 \"\n [ \"$2\" ] && ui_print \" $2 \"\n ui_print \"$bar\"\n}\nsetup_flashable() {\n ensure_bb\n $BOOTMODE && return\n if [ -z $OUTFD ] || readlink /proc/$$/fd/$OUTFD | grep -q /tmp; then\n # We will have to manually find out OUTFD\n for FD in $(ls /proc/$$/fd); do\n if readlink /proc/$$/fd/$FD | grep -q pipe; then\n if ps | grep -v grep | grep -qE \" 3 $FD |status_fd=$FD\"; then\n OUTFD=$FD\n break\n fi\n fi\n done\n fi\n recovery_actions\n}\n\nensure_bb() {\n if set -o | grep -q standalone; then\n # We are definitely in busybox ash\n set -o standalone\n return\n fi\n\n # Find our busybox binary\n local bb\n if [ -f $TMPDIR/busybox ]; then\n bb=$TMPDIR/busybox\n elif [ -f $MAGISKBIN/busybox ]; then\n bb=$MAGISKBIN/busybox\n else\n abort \"! Cannot find BusyBox\"\n fi\n chmod 755 $bb\n\n # Busybox could be a script, make sure /system/bin/sh exists\n if [ ! -f /system/bin/sh ]; then\n umount -l /system 2>/dev/null\n mkdir -p /system/bin\n ln -s $(command -v sh) /system/bin/sh\n fi\n\n export ASH_STANDALONE=1\n\n # Find our current arguments\n # Run in busybox environment to ensure consistent results\n # /proc//cmdline shall be
![\"logo\"](\"https://images.weserv.nl/?url=https://raw.githubusercontent.com/bmax121/APatch/main/app/src/main/ic_launcher-playstore.png&mask=circle\")
\n\n![\"Get](\"https://fdroid.gitlab.io/artwork/badge/get-it-on.png\"\n){kind=icon}
](https://f-droid.org/packages/me.bmax.apatch/)\n\nOr download the latest APK from the [Releases Section](https://github.com/bmax121/APatch/releases/latest).\n\n## Supported Versions\n\n- Only supports the ARM64 architecture.\n- Only supports Android kernel versions 3.18 - 6.12\n\nSupport for Samsung devices with security protection: Planned\n\n## Requirement\n\nKernel configs:\n\n- `CONFIG_KALLSYMS=y` and `CONFIG_KALLSYMS_ALL=y`\n\n- `CONFIG_KALLSYMS=y` and `CONFIG_KALLSYMS_ALL=n`: Initial support\n\n## Security Alert\n\nThe **SuperKey** has higher privileges than root access. \nWeak or compromised keys can lead to unauthorized control of your device. \nIt is critical to use robust keys and safeguard them from exposure to maintain the security of your device.\n\n## Translation\n\nTo help translate APatch or improve existing translations, please use [Weblate](https://hosted.weblate.org/engage/apatch/). PR of APatch translation is no longer accepted, because it will conflict with Weblate.\n\n