,\n replace: bool,\n skip: bool,\n}\n\nimpl Node {\n fn collect_module_files(&mut self, module_dir: P) -> Result\n where\n P: AsRef,\n {\n let dir = module_dir.as_ref();\n let mut has_file = false;\n for entry in dir.read_dir()?.flatten() {\n let name = entry.file_name().to_string_lossy().to_string();\n\n let node = match self.children.entry(name.clone()) {\n Entry::Occupied(o) => Some(o.into_mut()),\n Entry::Vacant(v) => Self::new_module(&name, &entry).map(|it| v.insert(it)),\n };\n\n if let Some(node) = node {\n has_file |= if node.file_type == NodeFileType::Directory {\n node.collect_module_files(dir.join(&node.name))? || node.replace\n } else {\n true\n }\n }\n }\n\n Ok(has_file)\n }\n\n fn dir_is_replace(path: P) -> bool\n where\n P: AsRef,\n {\n if let Ok(v) = lgetxattr(&path, REPLACE_DIR_XATTR)\n && String::from_utf8_lossy(&v) == \"y\"\n {\n return true;\n }\n\n path.as_ref().join(REPLACE_DIR_FILE_NAME).exists()\n }\n\n fn new_root(name: T) -> Self {\n Node {\n name: name.to_string(),\n file_type: Directory,\n children: Default::default(),\n module_path: None,\n replace: false,\n skip: false,\n }\n }\n\n fn new_module(name: &S, entry: &DirEntry) -> Option\n where\n S: ToString,\n {\n if let Ok(metadata) = entry.metadata() {\n let path = entry.path();\n let file_type = if metadata.file_type().is_char_device() && metadata.rdev() == 0 {\n NodeFileType::Whiteout\n } else {\n NodeFileType::from_file_type(metadata.file_type())\n };\n let replace = file_type == NodeFileType::Directory && Self::dir_is_replace(&path);\n if replace {\n log::debug!(\"{} need replace\", path.display());\n }\n return Some(Self {\n name: name.to_string(),\n file_type,\n children: HashMap::default(),\n module_path: Some(path),\n replace,\n skip: false,\n });\n }\n\n None\n }\n}\n\nfn collect_module_files() -> Result> {\n let mut root = Node::new_root(\"\");\n let mut system = Node::new_root(\"system\");\n let module_root = Path::new(MODULE_DIR);\n let mut has_file = false;\n\n log::debug!(\"begin collect module files: {}\", module_root.display());\n\n for entry in module_root.read_dir()?.flatten() {\n if !entry.file_type()?.is_dir() {\n continue;\n }\n\n let id = entry.file_name().to_str().unwrap().to_string();\n log::debug!(\"processing new module: {id}\");\n\n let prop = entry.path().join(\"module.prop\");\n if !prop.exists() {\n log::debug!(\"skipped module {id}, because not found module.prop\");\n continue;\n }\n\n if entry.path().join(DISABLE_FILE_NAME).exists()\n || entry.path().join(REMOVE_FILE_NAME).exists()\n || entry.path().join(SKIP_MOUNT_FILE_NAME).exists()\n {\n log::debug!(\"skipped module {id}, due to disable/remove/skip_mount\");\n continue;\n }\n\n let mod_system = entry.path().join(\"system\");\n\n if !mod_system.is_dir() {\n continue;\n }\n\n log::debug!(\"collecting {}\", entry.path().display());\n\n has_file |= system.collect_module_files(mod_system)?;\n }\n\n if has_file {\n const BUILTIN_PARTITIONS: [(&str, bool); 5] = [\n (\"vendor\", true),\n (\"system_ext\", true),\n (\"product\", true),\n (\"odm\", false),\n (\"oem\", false),\n ];\n\n for (partition, require_symlink) in BUILTIN_PARTITIONS {\n let path_of_root = Path::new(\"/\").join(partition);\n let path_of_system = Path::new(\"/system\").join(partition);\n if path_of_root.is_dir() && (!require_symlink || path_of_system.is_symlink()) {\n let name = partition.to_string();\n if let Some(node) = system.children.remove(&name) {\n root.children.insert(name, node);\n }\n }\n }\n\n root.children.insert(\"system\".to_string(), system);\n Ok(Some(root))\n } else {\n Ok(None)\n }\n}\n\nfn clone_symlink, Dst: AsRef>(src: Src, dst: Dst) -> Result<()> {\n let src_symlink = read_link(src.as_ref())?;\n symlink(&src_symlink, dst.as_ref())?;\n lsetfilecon(dst.as_ref(), lgetfilecon(src.as_ref())?.as_str())?;\n log::debug!(\n \"clone symlink {} -> {}({})\",\n dst.as_ref().display(),\n dst.as_ref().display(),\n src_symlink.display()\n );\n Ok(())\n}\n\nfn mount_mirror, WP: AsRef>(\n path: P,\n work_dir_path: WP,\n entry: &DirEntry,\n) -> Result<()> {\n let path = path.as_ref().join(entry.file_name());\n let work_dir_path = work_dir_path.as_ref().join(entry.file_name());\n let file_type = entry.file_type()?;\n\n if file_type.is_file() {\n log::debug!(\n \"mount mirror file {} -> {}\",\n path.display(),\n work_dir_path.display()\n );\n fs::File::create(&work_dir_path)?;\n mount_bind(&path, &work_dir_path)?;\n } else if file_type.is_dir() {\n log::debug!(\n \"mount mirror dir {} -> {}\",\n path.display(),\n work_dir_path.display()\n );\n create_dir(&work_dir_path)?;\n let metadata = entry.metadata()?;\n chmod(&work_dir_path, Mode::from_raw_mode(metadata.mode()))?;\n chown(\n &work_dir_path,\n Some(Uid::from_raw(metadata.uid())),\n Some(Gid::from_raw(metadata.gid())),\n )?;\n lsetfilecon(&work_dir_path, lgetfilecon(&path)?.as_str())?;\n for entry in read_dir(&path)?.flatten() {\n mount_mirror(&path, &work_dir_path, &entry)?;\n }\n } else if file_type.is_symlink() {\n log::debug!(\n \"create mirror symlink {} -> {}\",\n path.display(),\n work_dir_path.display()\n );\n clone_symlink(&path, &work_dir_path)?;\n }\n\n Ok(())\n}\n\nfn should_create_tmpfs(path: &Path, current: &mut Node, has_tmpfs: bool) -> bool {\n if has_tmpfs {\n return false;\n }\n if current.replace && current.module_path.is_some() {\n return true;\n }\n for (name, node) in &mut current.children {\n let real_path = path.join(name);\n if node.file_type.needs_tmpfs_vs_real(&real_path) {\n if current.module_path.is_none() {\n log::error!(\"cannot create tmpfs on {}, ignore: {name}\", path.display());\n node.skip = true;\n continue;\n }\n return true;\n }\n }\n false\n}\n\nfn prepare_tmpfs_skeleton(\n path: &Path,\n work_dir_path: &Path,\n module_path: Option<&PathBuf>,\n) -> Result<()> {\n log::debug!(\n \"creating tmpfs skeleton for {} at {}\",\n path.display(),\n work_dir_path.display()\n );\n create_dir_all(work_dir_path)?;\n let source: &Path = if path.exists() {\n path\n } else if let Some(mp) = module_path {\n mp\n } else {\n bail!(\"cannot mount root dir {}!\", path.display());\n };\n let metadata = source.metadata()?;\n chmod(work_dir_path, Mode::from_raw_mode(metadata.mode()))?;\n chown(\n work_dir_path,\n Some(Uid::from_raw(metadata.uid())),\n Some(Gid::from_raw(metadata.gid())),\n )?;\n lsetfilecon(work_dir_path, lgetfilecon(source)?.as_str())?;\n Ok(())\n}\n\nfn handle_mount_result(result: Result<()>, path: &Path, name: &str, has_tmpfs: bool) -> Result<()> {\n if let Err(e) = result {\n if has_tmpfs {\n return Err(e);\n }\n log::error!(\"mount child {}/{} failed: {}\", path.display(), name, e);\n }\n Ok(())\n}\n\nfn process_existing_entries(\n path: &Path,\n work_dir_path: &Path,\n children: &mut HashMap,\n has_tmpfs: bool,\n) -> Result<()> {\n for entry in path.read_dir()?.flatten() {\n let name = entry.file_name().to_string_lossy().to_string();\n let result = if let Some(node) = children.remove(&name) {\n if node.skip {\n continue;\n }\n do_magic_mount(path, work_dir_path, node, has_tmpfs)\n .with_context(|| format!(\"magic mount {}/{name}\", path.display()))\n } else if has_tmpfs {\n mount_mirror(path, work_dir_path, &entry)\n .with_context(|| format!(\"mount mirror {}/{name}\", path.display()))\n } else {\n Ok(())\n };\n handle_mount_result(result, path, &name, has_tmpfs)?;\n }\n Ok(())\n}\n\nfn process_remaining_children(\n path: &Path,\n work_dir_path: &Path,\n children: HashMap,\n has_tmpfs: bool,\n) -> Result<()> {\n for (name, node) in children {\n if node.skip {\n continue;\n }\n let result = do_magic_mount(path, work_dir_path, node, has_tmpfs)\n .with_context(|| format!(\"magic mount {}/{name}\", path.display()));\n handle_mount_result(result, path, &name, has_tmpfs)?;\n }\n Ok(())\n}\n\nfn move_tmpfs_to_target(work_dir_path: &Path, target: &Path) -> Result<()> {\n log::debug!(\n \"moving tmpfs {} -> {}\",\n work_dir_path.display(),\n target.display()\n );\n mount_move(work_dir_path, target).context(\"move self\")?;\n mount_change(target, MountPropagationFlags::PRIVATE).context(\"make self private\")?;\n Ok(())\n}\n\nfn do_magic_mount, WP: AsRef>(\n path: P,\n work_dir_path: WP,\n mut current: Node,\n has_tmpfs: bool,\n) -> Result<()> {\n let path = path.as_ref().join(¤t.name);\n let work_dir_path = work_dir_path.as_ref().join(¤t.name);\n match current.file_type {\n RegularFile => {\n let target_path = if has_tmpfs {\n fs::File::create(&work_dir_path)?;\n &work_dir_path\n } else {\n &path\n };\n if let Some(module_path) = ¤t.module_path {\n log::debug!(\n \"mount module file {} -> {}\",\n module_path.display(),\n work_dir_path.display()\n );\n mount_bind(module_path, target_path)?;\n } else {\n bail!(\"cannot mount root file {}!\", path.display());\n }\n }\n Symlink => {\n if let Some(module_path) = ¤t.module_path {\n log::debug!(\n \"create module symlink {} -> {}\",\n module_path.display(),\n work_dir_path.display()\n );\n clone_symlink(module_path, &work_dir_path)?;\n } else {\n bail!(\"cannot mount root symlink {}!\", path.display());\n }\n }\n Directory => {\n let create_tmpfs = should_create_tmpfs(&path, &mut current, has_tmpfs);\n let has_tmpfs = has_tmpfs || create_tmpfs;\n\n if has_tmpfs {\n prepare_tmpfs_skeleton(&path, &work_dir_path, current.module_path.as_ref())?;\n }\n if create_tmpfs {\n log::debug!(\n \"creating tmpfs for {} at {}\",\n path.display(),\n work_dir_path.display()\n );\n mount_bind(&work_dir_path, &work_dir_path).context(\"bind self\")?;\n }\n if path.exists() && !current.replace {\n process_existing_entries(\n &path,\n &work_dir_path,\n &mut current.children,\n has_tmpfs,\n )?;\n }\n if current.replace {\n if current.module_path.is_none() {\n bail!(\"dir {} is declared as replaced but it is root!\", path.display());\n }\n log::debug!(\"dir {} is replaced\", path.display());\n }\n process_remaining_children(&path, &work_dir_path, current.children, has_tmpfs)?;\n if create_tmpfs {\n move_tmpfs_to_target(&work_dir_path, &path)?;\n }\n }\n Whiteout => {\n log::debug!(\"file {} is removed\", path.display());\n }\n }\n Ok(())\n}\n\npub fn magic_mount() -> Result<()> {\n if let Some(root) = collect_module_files()? {\n log::debug!(\"collected: {:#?}\", root);\n let tmp_dir = PathBuf::from(AP_MAGIC_MOUNT_SOURCE);\n ensure_dir_exists(&tmp_dir)?;\n mount(\"tmpfs\", &tmp_dir, \"tmpfs\", MountFlags::empty(), None).context(\"mount tmp\")?;\n mount_change(&tmp_dir, MountPropagationFlags::PRIVATE).context(\"make tmp private\")?;\n let result = do_magic_mount(\"/\", &tmp_dir, root, false);\n if let Err(e) = unmount(&tmp_dir, UnmountFlags::DETACH) {\n log::error!(\"failed to unmount tmp {}\", e);\n }\n fs::remove_dir(tmp_dir).ok();\n result\n } else {\n log::info!(\"no modules to mount, skipping!\");\n Ok(())\n }\n}\n"
},
{
"path": "apd/src/main.rs",
"content": "mod apd;\nmod assets;\nmod cli;\nmod defs;\nmod event;\nmod lua;\nmod magic_mount;\nmod metamodule;\nmod module;\nmod module_config;\nmod package;\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\nmod pty;\nmod resetprop;\nmod restorecon;\nmod sepolicy;\nmod supercall;\nmod utils;\nfn main() -> anyhow::Result<()> {\n cli::run()\n}\n"
},
{
"path": "apd/src/metamodule.rs",
"content": "//! Metamodule management\n//!\n//! This module handles all metamodule-related functionality.\n//! Metamodules are special modules that manage how regular modules are mounted\n//! and provide hooks for module installation/uninstallation.\n\nuse std::{\n collections::HashMap,\n path::{Path, PathBuf},\n process::Command,\n};\n\nuse anyhow::{Context, Result, ensure};\nuse log::{info, warn};\n\nuse crate::{assets, defs, module::ModuleType::All};\n\n/// Determine whether the provided module properties mark it as a metamodule\npub fn is_metamodule(props: &HashMap) -> bool {\n props.get(\"metamodule\").is_some_and(|s| {\n let trimmed = s.trim();\n trimmed == \"1\" || trimmed.eq_ignore_ascii_case(\"true\")\n })\n}\n\n/// Get metamodule path if it exists\n/// The metamodule is stored in /data/adb/modules/{id} with a symlink at /data/adb/metamodule\npub fn get_metamodule_path() -> Option {\n let path = Path::new(defs::METAMODULE_DIR);\n\n // Check if symlink exists and resolve it\n if path.is_symlink()\n && let Ok(target) = std::fs::read_link(path)\n {\n // If target is relative, resolve it\n let resolved = if target.is_absolute() {\n target\n } else {\n path.parent()?.join(target)\n };\n\n if resolved.exists() && resolved.is_dir() {\n return Some(resolved);\n }\n warn!(\n \"Metamodule symlink points to non-existent path: {}\",\n resolved.display()\n );\n }\n\n // Fallback: search for metamodule=1 in modules directory\n let mut result = None;\n let _ = crate::module::foreach_module(All, |module_path| {\n if let Ok(props) = crate::module::read_module_prop(module_path)\n && is_metamodule(&props)\n {\n info!(\n \"Found metamodule in modules directory: {}\",\n module_path.display()\n );\n result = Some(module_path.to_path_buf());\n }\n Ok(())\n });\n\n result\n}\n\n/// Check if metamodule exists\npub fn has_metamodule() -> bool {\n get_metamodule_path().is_some()\n}\n\n/// Check if it's safe to install a regular module\n/// Returns Ok(()) if safe, Err(is_disabled) if blocked\n/// - Err(true) means metamodule is disabled\n/// - Err(false) means metamodule is in other unstable state\npub fn check_install_safety() -> Result<(), bool> {\n // No metamodule → safe\n let Some(metamodule_path) = get_metamodule_path() else {\n return Ok(());\n };\n\n // No metainstall.sh → safe (uses default installer)\n // The staged update directory may contain the latest scripts, so check both locations\n let has_metainstall = metamodule_path\n .join(defs::METAMODULE_METAINSTALL_SCRIPT)\n .exists()\n || metamodule_path.file_name().is_some_and(|module_id| {\n Path::new(defs::MODULE_UPDATE_DIR)\n .join(module_id)\n .join(defs::METAMODULE_METAINSTALL_SCRIPT)\n .exists()\n });\n if !has_metainstall {\n return Ok(());\n }\n\n // Check for marker files\n let has_update = metamodule_path.join(defs::UPDATE_FILE_NAME).exists();\n let has_remove = metamodule_path.join(defs::REMOVE_FILE_NAME).exists();\n let has_disable = metamodule_path.join(defs::DISABLE_FILE_NAME).exists();\n\n // Stable state (no markers) → safe\n if !has_update && !has_remove && !has_disable {\n return Ok(());\n }\n\n // Return true if disabled, false for other unstable states\n Err(has_disable && !has_update && !has_remove)\n}\n\n/// Create or update the metamodule symlink\n/// Points /data/adb/metamodule -> /data/adb/modules/{module_id}\npub fn ensure_symlink(module_path: P) -> Result<()>\nwhere\n P: AsRef,\n{\n // METAMODULE_DIR might have trailing slash, so we need to trim it\n let symlink_path = Path::new(defs::METAMODULE_DIR.trim_end_matches('/'));\n let module_path = module_path.as_ref();\n\n info!(\n \"Creating metamodule symlink: {} -> {}\",\n symlink_path.display(),\n module_path.display()\n );\n\n // Remove existing symlink if it exists\n if symlink_path.exists() || symlink_path.is_symlink() {\n info!(\"Removing old metamodule symlink/path\");\n if symlink_path.is_symlink() {\n std::fs::remove_file(symlink_path).with_context(|| \"Failed to remove old symlink\")?;\n } else {\n // Could be a directory, remove it\n std::fs::remove_dir_all(symlink_path)\n .with_context(|| \"Failed to remove old directory\")?;\n }\n }\n\n // Create symlink\n #[cfg(unix)]\n std::os::unix::fs::symlink(module_path, symlink_path)\n .with_context(|| format!(\"Failed to create symlink to {}\", module_path.display()))?;\n\n info!(\"Metamodule symlink created successfully\");\n Ok(())\n}\n\n/// Remove the metamodule symlink\npub fn remove_symlink() -> Result<()> {\n let symlink_path = Path::new(defs::METAMODULE_DIR.trim_end_matches('/'));\n\n if symlink_path.is_symlink() {\n std::fs::remove_file(symlink_path)\n .with_context(|| \"Failed to remove metamodule symlink\")?;\n info!(\"Metamodule symlink removed\");\n }\n\n Ok(())\n}\n\n/// Get the install script content, using metainstall.sh from metamodule if available\n/// Returns the script content to be executed\npub fn get_install_script(\n is_metamodule: bool,\n installer_content: &str,\n install_module_script: &str,\n) -> Result {\n // Check if there's a metamodule with metainstall.sh\n // Only apply this logic for regular modules (not when installing metamodule itself)\n let install_script = if is_metamodule {\n info!(\"Installing metamodule, using default installer\");\n install_module_script.to_string()\n } else if let Some(metamodule_path) = get_metamodule_path() {\n if metamodule_path.join(defs::DISABLE_FILE_NAME).exists() {\n info!(\"Metamodule is disabled, using default installer\");\n install_module_script.to_string()\n } else {\n let metainstall_path = metamodule_path.join(defs::METAMODULE_METAINSTALL_SCRIPT);\n\n if metainstall_path.exists() {\n info!(\"Using metainstall.sh from metamodule\");\n let metamodule_content = std::fs::read_to_string(&metainstall_path)\n .with_context(|| \"Failed to read metamodule metainstall.sh\")?;\n format!(\"{installer_content}\\n{metamodule_content}\\nexit 0\\n\")\n } else {\n info!(\"Metamodule exists but has no metainstall.sh, using default installer\");\n install_module_script.to_string()\n }\n }\n } else {\n info!(\"No metamodule found, using default installer\");\n install_module_script.to_string()\n };\n\n Ok(install_script)\n}\n\n/// Check if metamodule script exists and is ready to execute\n/// Returns None if metamodule doesn't exist, is disabled, or script is missing\n/// Returns Some(script_path) if script is ready to execute\nfn check_metamodule_script(script_name: &str) -> Option {\n // Check if metamodule exists\n let metamodule_path = get_metamodule_path()?;\n\n // Check if metamodule is disabled\n if metamodule_path.join(defs::DISABLE_FILE_NAME).exists() {\n info!(\"Metamodule is disabled, skipping {script_name}\");\n return None;\n }\n\n // Check if script exists\n let script_path = metamodule_path.join(script_name);\n if !script_path.exists() {\n return None;\n }\n\n Some(script_path)\n}\n\n/// Execute metamodule's metauninstall.sh for a specific module\npub fn exec_metauninstall_script(module_id: &str) -> Result<()> {\n let Some(metauninstall_path) = check_metamodule_script(defs::METAMODULE_METAUNINSTALL_SCRIPT)\n else {\n return Ok(());\n };\n\n info!(\"Executing metamodule metauninstall.sh for module: {module_id}\",);\n\n let result = Command::new(assets::BUSYBOX_PATH)\n .args([\"sh\", metauninstall_path.to_str().unwrap()])\n .current_dir(metauninstall_path.parent().unwrap())\n .envs(crate::module::get_common_script_envs())\n .env(\"MODULE_ID\", module_id)\n .status()?;\n\n ensure!(\n result.success(),\n \"Metamodule metauninstall.sh failed for module {module_id}: {:?}\",\n result\n );\n\n info!(\"Metamodule metauninstall.sh executed successfully for {module_id}\",);\n Ok(())\n}\n\n/// Execute metamodule mount script\npub fn exec_mount_script(module_dir: &str) -> Result<()> {\n let Some(mount_script) = check_metamodule_script(defs::METAMODULE_MOUNT_SCRIPT) else {\n return Ok(());\n };\n\n info!(\"Executing mount script for metamodule\");\n\n let result = Command::new(assets::BUSYBOX_PATH)\n .args([\"sh\", mount_script.to_str().unwrap()])\n .envs(crate::module::get_common_script_envs())\n .env(\"MODULE_DIR\", module_dir)\n .status()?;\n\n ensure!(\n result.success(),\n \"Metamodule mount script failed with status: {:?}\",\n result\n );\n\n info!(\"Metamodule mount script executed successfully\");\n Ok(())\n}\n\n/// Execute metamodule script for a specific stage\npub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {\n let Some(script_path) = check_metamodule_script(&format!(\"{stage}.sh\")) else {\n return Ok(());\n };\n\n info!(\"Executing metamodule {stage}.sh\");\n crate::module::exec_script(&script_path, block)?;\n info!(\"Metamodule {stage}.sh executed successfully\");\n Ok(())\n}\n"
},
{
"path": "apd/src/module.rs",
"content": "use crate::sepolicy::get_policy_main;\nuse crate::{lua, module_config};\nuse anyhow::{Context, Result, anyhow, bail, ensure};\nuse const_format::concatcp;\nuse is_executable::is_executable;\nuse java_properties::PropertiesIter;\nuse log::{debug, info, warn};\n#[cfg(unix)]\nuse std::os::unix::{prelude::PermissionsExt, process::CommandExt};\nuse std::{\n collections::HashMap,\n env::var as env_var,\n fs::{self, remove_dir_all},\n io::Cursor,\n path::{Path, PathBuf, Component},\n process::Command,\n str::FromStr,\n};\nuse zip_extensions::zip_extract_file_to_memory;\n\n#[allow(clippy::wildcard_imports)]\nuse crate::utils::*;\nuse crate::{\n assets,\n defs::{self, MODULE_DIR, MODULE_UPDATE_DIR},\n metamodule, restorecon,\n};\n\nconst INSTALLER_CONTENT: &str = include_str!(\"./installer.sh\");\nconst INSTALL_MODULE_SCRIPT: &str = concatcp!(\n INSTALLER_CONTENT,\n \"\\n\",\n \"install_module\",\n \"\\n\",\n \"exit 0\",\n \"\\n\"\n);\n\n#[derive(PartialEq, Eq)]\npub enum ModuleType {\n All,\n Active,\n Updated,\n}\n\nfn exec_install_script(module_file: &str, is_metamodule: bool) -> Result<()> {\n let realpath = std::fs::canonicalize(module_file)\n .with_context(|| format!(\"realpath: {module_file} failed\"))?;\n\n // Get install script from metamodule module\n let install_script =\n metamodule::get_install_script(is_metamodule, INSTALLER_CONTENT, INSTALL_MODULE_SCRIPT)?;\n\n let result = Command::new(assets::BUSYBOX_PATH)\n .args([\"sh\", \"-c\", &install_script])\n .envs(get_common_script_envs())\n .env(\"OUTFD\", \"1\")\n .env(\"ZIPFILE\", realpath)\n .status()?;\n ensure!(result.success(), \"Failed to install module script\");\n Ok(())\n}\n\npub fn handle_updated_modules() -> Result<()> {\n let modules_root = Path::new(MODULE_DIR);\n foreach_module(ModuleType::Updated, |updated_module| {\n if !updated_module.is_dir() {\n return Ok(());\n }\n\n if let Some(name) = updated_module.file_name() {\n let module_dir = modules_root.join(name);\n let mut disabled = false;\n let mut removed = false;\n if module_dir.exists() {\n // If the old module is disabled, we need to also disable the new one\n disabled = module_dir.join(defs::DISABLE_FILE_NAME).exists();\n removed = module_dir.join(defs::REMOVE_FILE_NAME).exists();\n remove_dir_all(&module_dir)?;\n }\n std::fs::rename(updated_module, &module_dir)?;\n if removed {\n let path = module_dir.join(defs::REMOVE_FILE_NAME);\n if let Err(e) = ensure_file_exists(&path) {\n warn!(\"Failed to create {}: {e}\", path.display());\n }\n } else if disabled {\n let path = module_dir.join(defs::DISABLE_FILE_NAME);\n if let Err(e) = ensure_file_exists(&path) {\n warn!(\"Failed to create {}: {e}\", path.display());\n }\n }\n }\n Ok(())\n })?;\n Ok(())\n}\n\n/// Get common environment variables for script execution\npub fn get_common_script_envs() -> Vec<(&'static str, String)> {\n vec![\n (\"ASH_STANDALONE\", \"1\".to_string()),\n (\"APATCH\", \"true\".to_string()),\n (\"APATCH_VER\", defs::VERSION_NAME.to_string()),\n (\"APATCH_VER_CODE\", defs::VERSION_CODE.to_string()),\n (\n \"PATH\",\n format!(\n \"/data/adb:{}:{}\",\n defs::BINARY_DIR.trim_end_matches('/'),\n env_var(\"PATH\").unwrap_or_default()\n ),\n ),\n ]\n}\n\n// because we use something like A-B update\n// we need to update the module state after the boot_completed\n// if someone(such as the module) install a module before the boot_completed\n// then it may cause some problems, just forbid it\nfn ensure_boot_completed() -> Result<()> {\n // ensure getprop sys.boot_completed == 1\n if getprop(\"sys.boot_completed\").as_deref() != Some(\"1\") {\n bail!(\"Android is Booting!\");\n }\n Ok(())\n}\n\nfn mark_update() -> Result<()> {\n ensure_file_exists(concatcp!(defs::WORKING_DIR, defs::UPDATE_FILE_NAME))\n}\n\nfn mark_module_state(module: &str, flag_file: &str, create_or_delete: bool) -> Result<()> {\n let module_state_file = Path::new(defs::MODULE_DIR).join(module).join(flag_file);\n if create_or_delete {\n ensure_file_exists(module_state_file)\n } else {\n if module_state_file.exists() {\n fs::remove_file(module_state_file)?;\n }\n Ok(())\n }\n}\npub fn foreach_module(\n module_type: ModuleType,\n mut f: impl FnMut(&Path) -> Result<()>,\n) -> Result<()> {\n let modules_dir = Path::new(match module_type {\n ModuleType::Updated => MODULE_UPDATE_DIR,\n _ => defs::MODULE_DIR,\n });\n let dir = std::fs::read_dir(modules_dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n if !path.is_dir() {\n warn!(\"{} is not a directory, skip\", path.display());\n continue;\n }\n\n if module_type == ModuleType::Active && path.join(defs::DISABLE_FILE_NAME).exists() {\n info!(\"{} is disabled, skip\", path.display());\n continue;\n }\n if module_type == ModuleType::Active && path.join(defs::REMOVE_FILE_NAME).exists() {\n warn!(\"{} is removed, skip\", path.display());\n continue;\n }\n\n f(&path)?;\n }\n\n Ok(())\n}\n\nfn foreach_active_module(f: impl FnMut(&Path) -> Result<()>) -> Result<()> {\n foreach_module(ModuleType::Active, f)\n}\n\npub fn load_sepolicy_rule() -> Result<()> {\n foreach_active_module(|path| {\n let rule_file = path.join(\"sepolicy.rule\");\n if !rule_file.exists() {\n return Ok(());\n }\n\n info!(\"load policy: {}\", &rule_file.display());\n let mut _sepol = get_policy_main(&[\n \"magiskpolicy\".to_string(),\n \"--live\".to_string(),\n \"--apply\".to_string(),\n rule_file.display().to_string(),\n ])?;\n\n Ok(())\n })?;\n\n Ok(())\n}\n\npub fn exec_script>(path: T, wait: bool) -> Result<()> {\n info!(\"exec {}\", path.as_ref().display());\n\n let is_module_script = path.as_ref().starts_with(defs::MODULE_DIR);\n // Extract module_id from path if it matches /data/adb/modules/{id}/...\n let module_id = if is_module_script {\n path.as_ref()\n .strip_prefix(defs::MODULE_DIR)\n .ok()\n .and_then(|p| p.components().next())\n .and_then(|c| c.as_os_str().to_str())\n .map(ToString::to_string)\n } else {\n None\n };\n\n if is_module_script && module_id.is_none() {\n debug!(\n \"Failed to extract module_id from script path '{}'. Script will run without AP_MODULE environment variable.\",\n path.as_ref().display()\n );\n }\n\n let is_elf = fs::read(path.as_ref())\n .ok()\n .and_then(|bytes| bytes.get(..4).map(|b| b.to_vec()))\n .map_or(false, |magic| magic == [0x7f, b'E', b'L', b'F']);\n\n let mut command = Command::new(if is_elf {\n path.as_ref().as_os_str().to_owned()\n } else {\n assets::BUSYBOX_PATH.into()\n });\n #[cfg(unix)]\n {\n command.process_group(0);\n unsafe {\n command.pre_exec(|| {\n switch_cgroups();\n Ok(())\n });\n }\n }\n command\n .current_dir(path.as_ref().parent().unwrap())\n .env(\"APATCH\", \"true\")\n .env(\"APATCH_VER\", defs::VERSION_NAME)\n .env(\"APATCH_VER_CODE\", defs::VERSION_CODE)\n .env(\n \"PATH\",\n format!(\n \"{}:{}\",\n env_var(\"PATH\")?,\n defs::BINARY_DIR.trim_end_matches('/')\n ),\n );\n if !is_elf {\n command\n .arg(\"sh\")\n .arg(path.as_ref())\n .env(\"ASH_STANDALONE\", \"1\");\n }\n if let Some(id) = module_id {\n command.env(\"AP_MODULE\", id);\n }\n\n let result = if wait {\n command.status().map(|_| ())\n } else {\n command.spawn().map(|_| ())\n };\n result.map_err(|err| anyhow!(\"Failed to exec {}: {}\", path.as_ref().display(), err))\n}\n\npub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {\n foreach_active_module(|module| {\n let script_path = module.join(format!(\"{stage}.sh\"));\n if !script_path.exists() {\n return Ok(());\n }\n\n exec_script(&script_path, block)\n })?;\n Ok(())\n}\n\npub fn exec_common_scripts(dir: &str, wait: bool) -> Result<()> {\n let script_dir = Path::new(defs::ADB_DIR).join(dir);\n if !script_dir.exists() {\n info!(\"{} not exists, skip\", script_dir.display());\n return Ok(());\n }\n\n let dir = fs::read_dir(&script_dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n\n if !is_executable(&path) {\n warn!(\"{} is not executable, skip\", path.display());\n continue;\n }\n\n exec_script(path, wait)?;\n }\n\n Ok(())\n}\n\npub fn load_system_prop() -> Result<()> {\n foreach_active_module(|module| {\n let system_prop = module.join(\"system.prop\");\n if !system_prop.exists() {\n return Ok(());\n }\n info!(\"load {} system.prop\", module.display());\n\n crate::resetprop::load_system_prop_file(&system_prop)?;\n\n Ok(())\n })?;\n\n Ok(())\n}\n\npub fn prune_modules() -> Result<()> {\n foreach_module(ModuleType::All, |module| {\n fs::remove_file(module.join(defs::UPDATE_FILE_NAME)).ok();\n if !module.join(defs::REMOVE_FILE_NAME).exists() {\n return Ok(());\n }\n\n info!(\"remove module: {}\", module.display());\n\n // Execute metamodule's metauninstall.sh first\n let module_id = module.file_name().and_then(|n| n.to_str()).unwrap_or(\"\");\n\n // Check if this is a metamodule\n let is_metamodule = read_module_prop(module)\n .map(|props| metamodule::is_metamodule(&props))\n .unwrap_or(false);\n\n if is_metamodule {\n info!(\"Removing metamodule symlink\");\n if let Err(e) = metamodule::remove_symlink() {\n warn!(\"Failed to remove metamodule symlink: {e}\");\n }\n } else if let Err(e) = metamodule::exec_metauninstall_script(module_id) {\n warn!(\"Failed to exec metamodule uninstall for {module_id}: {e}\",);\n }\n\n // Then execute module's own uninstall.sh\n let uninstaller = module.join(\"uninstall.sh\");\n if uninstaller.exists()\n && let Err(e) = exec_script(uninstaller, true)\n {\n warn!(\"Failed to exec uninstaller: {e}\");\n }\n\n // Clear module configs before removing module directory\n if let Err(e) = module_config::clear_module_configs(module_id) {\n warn!(\"Failed to clear configs for {module_id}: {e}\");\n }\n\n // Finally remove the module directory\n if let Err(e) = remove_dir_all(module) {\n warn!(\"Failed to remove {}: {e}\", module.display());\n }\n\n Ok(())\n })?;\n\n // collect remaining modules, if none, clean up metamodule record\n let remaining_modules: Vec<_> = std::fs::read_dir(defs::MODULE_DIR)?\n .filter_map(std::result::Result::ok)\n .filter(|entry| entry.path().join(\"module.prop\").exists())\n .collect();\n\n if remaining_modules.is_empty() {\n info!(\"no remaining modules.\");\n }\n\n Ok(())\n}\n\nfn _install_module(zip: &str) -> Result<()> {\n ensure_boot_completed()?;\n\n // print banner\n println!(include_str!(\"banner\"));\n\n assets::ensure_binaries().with_context(|| \"binary missing\")?;\n\n // first check if workding dir is usable\n ensure_dir_exists(defs::WORKING_DIR).with_context(|| \"Failed to create working dir\")?;\n ensure_dir_exists(defs::BINARY_DIR).with_context(|| \"Failed to create bin dir\")?;\n\n // read the module_id from zip\n let mut buffer: Vec = Vec::new();\n let entry_path = PathBuf::from_str(\"module.prop\")?;\n let zip_path = PathBuf::from_str(zip)?;\n let zip_path = zip_path.canonicalize()?;\n zip_extract_file_to_memory(&zip_path, &entry_path, &mut buffer)?;\n let mut module_prop = HashMap::new();\n PropertiesIter::new_with_encoding(Cursor::new(buffer), encoding_rs::UTF_8).read_into(\n |k, v| {\n module_prop.insert(k, v);\n },\n )?;\n info!(\"module prop: {:?}\", module_prop);\n\n let Some(module_id) = module_prop.get(\"id\") else {\n bail!(\"module id not found in module.prop!\");\n };\n let module_id = module_id.trim();\n\n // Check if this module is a metamodule\n let is_metamodule = metamodule::is_metamodule(&module_prop);\n\n // Check if it's safe to install regular module\n if !is_metamodule && let Err(is_disabled) = metamodule::check_install_safety() {\n println!(\"\\n❌ Installation Blocked\");\n println!(\"┌────────────────────────────────\");\n println!(\"│ A metamodule with custom installer is active\");\n println!(\"│\");\n if is_disabled {\n println!(\"│ Current state: Disabled\");\n println!(\"│ Action required: Re-enable or uninstall it, then reboot\");\n } else {\n println!(\"│ Current state: Pending changes\");\n println!(\"│ Action required: Reboot to apply changes first\");\n }\n println!(\"└─────────────────────────────────\\n\");\n bail!(\"Metamodule installation blocked\");\n }\n\n let modules_dir = Path::new(defs::MODULE_DIR);\n let modules_update_dir = Path::new(defs::MODULE_UPDATE_DIR);\n if !Path::new(modules_dir).exists() {\n fs::create_dir(modules_dir).expect(\"Failed to create modules folder\");\n let permissions = fs::Permissions::from_mode(0o700);\n fs::set_permissions(modules_dir, permissions).expect(\"Failed to set permissions\");\n }\n\n if is_metamodule {\n info!(\"Installing metamodule: {module_id}\");\n\n // Check if there's already a metamodule installed\n if metamodule::has_metamodule()\n && let Some(existing_path) = metamodule::get_metamodule_path()\n {\n let existing_id = read_module_prop(&existing_path)\n .ok()\n .and_then(|m| m.get(\"id\").cloned())\n .unwrap_or_else(|| \"unknown\".to_string());\n\n if existing_id != module_id {\n println!(\"\\n❌ Installation Failed\");\n println!(\"┌────────────────────────────────\");\n println!(\"│ A metamodule is already installed\");\n println!(\"│ Current metamodule: {existing_id}\");\n println!(\"│\");\n println!(\"│ Only one metamodule can be active at a time.\");\n println!(\"│\");\n println!(\"│ To install this metamodule:\");\n println!(\"│ 1. Uninstall the current metamodule\");\n println!(\"│ 2. Reboot your device\");\n println!(\"│ 3. Install the new metamodule\");\n println!(\"└─────────────────────────────────\\n\");\n bail!(\"Cannot install multiple metamodules\");\n }\n }\n }\n\n let module_dir = format!(\"{}{}\", modules_dir.display(), module_id);\n let _module_update_dir = format!(\"{}{}\", modules_update_dir.display(), module_id);\n info!(\"module dir: {}\", module_dir);\n if !Path::new(&module_dir.clone()).exists() {\n fs::create_dir(&module_dir.clone()).expect(\"Failed to create module folder\");\n let permissions = fs::Permissions::from_mode(0o700);\n fs::set_permissions(module_dir.clone(), permissions).expect(\"Failed to set permissions\");\n }\n // unzip the image and move it to modules_update/ dir\n let file = fs::File::open(zip)?;\n let mut archive = zip::ZipArchive::new(file)?;\n archive.extract(&_module_update_dir)?;\n \n // Set SELinux context for module root directory and special files\n // This is critical for .img files that need to be loop-mounted\n #[cfg(unix)]\n {\n let module_update_path = Path::new(&_module_update_dir);\n if module_update_path.exists() {\n // Set adb_data_file context for the module root directory\n restorecon::lsetfilecon(&_module_update_dir, restorecon::ADB_CON)?;\n \n // Process special files like .img that need proper permissions for mounting\n if let Ok(entries) = fs::read_dir(&_module_update_dir) {\n for entry in entries.flatten() {\n let path = entry.path();\n if let Some(extension) = path.extension() {\n if extension == \"img\" {\n // Set proper permissions for image files (readable by all)\n fs::set_permissions(&path, fs::Permissions::from_mode(0o644))?;\n // Set SELinux context to allow loop mounting\n restorecon::lsetfilecon(&path, restorecon::ADB_CON)?;\n info!(\"Set permissions and SELinux context for: {:?}\", path);\n }\n }\n }\n }\n }\n }\n\n println!(\"- Running module installer\");\n exec_install_script(zip, is_metamodule)?;\n\n // set permission and selinux context for $MOD/system\n let module_system_dir = PathBuf::from(module_dir.clone()).join(\"system\");\n if module_system_dir.exists() {\n #[cfg(unix)]\n fs::set_permissions(&module_system_dir, fs::Permissions::from_mode(0o755))?;\n restorecon::restore_syscon(&module_system_dir)?;\n }\n\n // Create symlink for metamodule\n if is_metamodule {\n println!(\"- Creating metamodule symlink\");\n metamodule::ensure_symlink(&module_dir)?;\n }\n\n mark_update()?;\n Ok(())\n}\n\npub fn install_module(zip: &str) -> Result<()> {\n let result = _install_module(zip);\n result\n}\n\npub fn _uninstall_module(id: &str, update_dir: &str) -> Result<()> {\n let dir = Path::new(update_dir);\n ensure!(dir.exists(), \"No module installed\");\n\n // iterate the modules_update dir, find the module to be removed\n let dir = fs::read_dir(dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n let module_prop = path.join(\"module.prop\");\n if !module_prop.exists() {\n continue;\n }\n let content = fs::read(module_prop)?;\n let mut module_id: String = String::new();\n PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8).read_into(\n |k, v| {\n if k.eq(\"id\") {\n module_id = v;\n }\n },\n )?;\n if module_id.eq(id) {\n let remove_file = path.join(defs::REMOVE_FILE_NAME);\n fs::File::create(remove_file).with_context(|| \"Failed to create remove file.\")?;\n break;\n }\n }\n\n // santity check\n let target_module_path = format!(\"{update_dir}/{id}\");\n let target_module = Path::new(&target_module_path);\n if target_module.exists() {\n let remove_file = target_module.join(defs::REMOVE_FILE_NAME);\n if !remove_file.exists() {\n fs::File::create(remove_file).with_context(|| \"Failed to create remove file.\")?;\n }\n }\n\n let _ = mark_module_state(id, defs::REMOVE_FILE_NAME, true);\n Ok(())\n}\npub fn uninstall_module(id: &str) -> Result<()> {\n _uninstall_module(id, defs::MODULE_DIR)?;\n mark_update()?;\n Ok(())\n}\n\npub fn undo_uninstall_module(id: &str) -> Result<()> {\n let module_path = Path::new(defs::MODULE_DIR).join(id);\n ensure!(module_path.exists(), \"Module {id} not found\");\n\n // Remove the remove mark\n let remove_file = module_path.join(defs::REMOVE_FILE_NAME);\n if remove_file.exists() {\n fs::remove_file(&remove_file)\n .with_context(|| format!(\"Failed to delete remove file for module '{id}'\"))?;\n info!(\"Removed the remove mark for module {id}\");\n }\n\n Ok(())\n}\n\n/// Read module.prop from the given module path and return as a HashMap\npub fn read_module_prop(module_path: &Path) -> Result> {\n let module_prop = module_path.join(\"module.prop\");\n ensure!(\n module_prop.exists(),\n \"module.prop not found in {}\",\n module_path.display()\n );\n\n let content = std::fs::read(&module_prop)\n .with_context(|| format!(\"Failed to read module.prop: {}\", module_prop.display()))?;\n\n let mut prop_map: HashMap = HashMap::new();\n PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8)\n .read_into(|k, v| {\n prop_map.insert(k, v);\n })\n .with_context(|| format!(\"Failed to parse module.prop: {}\", module_prop.display()))?;\n\n Ok(prop_map)\n}\n\npub fn run_action(id: &str) -> Result<()> {\n let action_script_path = format!(\"/data/adb/modules/{}/action.sh\", id);\n if Path::new(&action_script_path).exists() {\n let _ = exec_script(&action_script_path, true);\n } else {\n //if no action.sh, try to run lua action\n lua::run_lua(&id, \"action\", false, true).map_err(|e| anyhow::anyhow!(\"{}\", e))?;\n }\n Ok(())\n}\n\nfn _change_module_state(module_dir: &str, mid: &str, enable: bool) -> Result<()> {\n let src_module_path = format!(\"{module_dir}/{mid}\");\n let src_module = Path::new(&src_module_path);\n ensure!(src_module.exists(), \"module: {} not found!\", mid);\n\n let disable_path = src_module.join(defs::DISABLE_FILE_NAME);\n if enable {\n if disable_path.exists() {\n fs::remove_file(&disable_path).with_context(|| {\n format!(\"Failed to remove disable file: {}\", &disable_path.display())\n })?;\n }\n } else {\n ensure_file_exists(disable_path)?;\n }\n\n let _ = mark_module_state(mid, defs::DISABLE_FILE_NAME, !enable);\n\n Ok(())\n}\n\npub fn _enable_module(id: &str, update_dir: &Path) -> Result<()> {\n if let Some(module_dir_str) = update_dir.to_str() {\n _change_module_state(module_dir_str, id, true)\n } else {\n info!(\"Enable module failed: Invalid path\");\n Err(anyhow::anyhow!(\"Invalid module directory\"))\n }\n}\n\npub fn enable_module(id: &str) -> Result<()> {\n let update_dir = Path::new(defs::MODULE_DIR);\n _enable_module(id, update_dir)?;\n Ok(())\n}\n\npub fn _disable_module(id: &str, update_dir: &Path) -> Result<()> {\n if let Some(module_dir_str) = update_dir.to_str() {\n _change_module_state(module_dir_str, id, false)\n } else {\n info!(\"Disable module failed: Invalid path\");\n Err(anyhow::anyhow!(\"Invalid module directory\"))\n }\n}\n\npub fn disable_module(id: &str) -> Result<()> {\n let module_dir = Path::new(defs::MODULE_DIR);\n _disable_module(id, module_dir)?;\n\n Ok(())\n}\n\npub fn _disable_all_modules(dir: &str) -> Result<()> {\n let dir = fs::read_dir(dir)?;\n for entry in dir.flatten() {\n let path = entry.path();\n let disable_flag = path.join(defs::DISABLE_FILE_NAME);\n if let Err(e) = ensure_file_exists(disable_flag) {\n warn!(\"Failed to disable module: {}: {}\", path.display(), e);\n }\n }\n Ok(())\n}\n\npub fn disable_all_modules() -> Result<()> {\n // Skip disabling modules since boot completed\n if getprop(\"sys.boot_completed\").as_deref() == Some(\"1\") {\n info!(\"System boot completed, no need to disable all modules\");\n return Ok(());\n }\n mark_update()?;\n _disable_all_modules(defs::MODULE_DIR)?;\n Ok(())\n}\n\n// Resolve a module icon path to an absolute on-disk path\nfn resolve_module_icon_path(\n module_prop_map: &mut HashMap,\n key: &str,\n module_path: &Path,\n) {\n let module_id = module_prop_map.get(\"id\").map(|s| s.as_str()).unwrap_or(\"\");\n\n if let Some(icon_value) = module_prop_map.get(key).map(|v| v.trim()).filter(|v| !v.is_empty()) {\n let path = Path::new(icon_value);\n\n if path.is_absolute() || path.components().any(|c| matches!(c, Component::ParentDir)) {\n log::warn!(\"Rejected {} (invalid path) for module {}: {}\", key, module_id, icon_value);\n return;\n }\n\n let candidate = module_path.join(path);\n\n if candidate.exists() && candidate.is_file() {\n if let Some(full_path) = candidate.to_str() {\n module_prop_map.insert(key.to_string(), full_path.to_string());\n }\n } else {\n log::debug!(\"{} not found for module {}: {}\", key, module_id, candidate.display());\n }\n }\n}\n\nfn _list_modules(path: &str) -> Vec> {\n // Load all module configs once to minimize I/O overhead\n let all_configs = match module_config::get_all_module_configs() {\n Ok(configs) => configs,\n Err(e) => {\n warn!(\"Failed to load module configs: {e}\");\n HashMap::new()\n }\n };\n\n // first check enabled modules\n let dir = fs::read_dir(path);\n let Ok(dir) = dir else {\n return Vec::new();\n };\n\n let mut modules: Vec> = Vec::new();\n\n for entry in dir.flatten() {\n let path = entry.path();\n info!(\"path: {}\", path.display());\n let module_prop = path.join(\"module.prop\");\n if !module_prop.exists() {\n continue;\n }\n let content = fs::read(&module_prop);\n let Ok(content) = content else {\n warn!(\"Failed to read file: {}\", module_prop.display());\n continue;\n };\n let mut module_prop_map: HashMap = HashMap::new();\n let encoding = encoding_rs::UTF_8;\n\n if PropertiesIter::new_with_encoding(Cursor::new(content), encoding)\n .read_into(|k, v| {\n module_prop_map.insert(k, v);\n })\n .is_err()\n {\n warn!(\"Failed to parse module.prop: {}\", module_prop.display());\n continue;\n }\n\n if !module_prop_map.contains_key(\"id\") || module_prop_map[\"id\"].is_empty() {\n match entry.file_name().to_str() {\n Some(id) => {\n info!(\"Use dir name as module id: {}\", id);\n module_prop_map.insert(\"id\".to_owned(), id.to_owned());\n }\n _ => {\n info!(\"Failed to get module id: {:?}\", module_prop);\n continue;\n }\n }\n }\n\n // Add enabled, update, remove flags\n let enabled = !path.join(defs::DISABLE_FILE_NAME).exists();\n let update = path.join(defs::UPDATE_FILE_NAME).exists();\n let remove = path.join(defs::REMOVE_FILE_NAME).exists();\n let web = path.join(defs::MODULE_WEB_DIR).exists();\n let id = module_prop_map.get(\"id\").map(|s| s.as_str()).unwrap_or(\"\");\n let id_lua_file = format!(\"{}.lua\", id);\n let action = path.join(defs::MODULE_ACTION_SH).exists() || path.join(&id_lua_file).exists();\n\n module_prop_map.insert(\"enabled\".to_owned(), enabled.to_string());\n module_prop_map.insert(\"update\".to_owned(), update.to_string());\n module_prop_map.insert(\"remove\".to_owned(), remove.to_string());\n module_prop_map.insert(\"web\".to_owned(), web.to_string());\n module_prop_map.insert(\"action\".to_owned(), action.to_string());\n\n // Resolve and validate module icon paths for action and webui icons\n resolve_module_icon_path(&mut module_prop_map, \"actionIcon\", &path);\n resolve_module_icon_path(&mut module_prop_map, \"webuiIcon\", &path);\n\n // Apply module config overrides and extract managed features\n if let Some(module_id) = module_prop_map.get(\"id\")\n && let Some(config) = all_configs.get(module_id.as_str())\n {\n // Apply override.description\n if let Some(desc) = config.get(\"override.description\") {\n module_prop_map.insert(\"description\".to_owned(), desc.clone());\n }\n }\n\n modules.push(module_prop_map);\n }\n\n modules\n}\n\npub fn list_modules() -> Result<()> {\n let modules = _list_modules(defs::MODULE_DIR);\n println!(\"{}\", serde_json::to_string_pretty(&modules)?);\n Ok(())\n}\n"
},
{
"path": "apd/src/module_config.rs",
"content": "use std::{\n collections::HashMap,\n fs::{self, File},\n io::{Read, Write},\n path::{Path, PathBuf},\n};\n\nuse anyhow::{Context, Result, bail};\nuse log::{debug, warn};\n\nuse crate::{defs, utils::ensure_dir_exists};\n\n#[allow(clippy::unreadable_literal)]\nconst MODULE_CONFIG_MAGIC: u32 = 0x4150544D; // \"APTM\"\nconst MODULE_CONFIG_VERSION: u32 = 1;\n\n// Validation limits\npub const MAX_CONFIG_KEY_LEN: usize = 256;\npub const MAX_CONFIG_VALUE_LEN: usize = 1024 * 1024; // 1MB\npub const MAX_CONFIG_COUNT: usize = 32;\n\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum ConfigType {\n Persist,\n Temp,\n}\n\nimpl ConfigType {\n const fn filename(self) -> &'static str {\n match self {\n Self::Persist => defs::PERSIST_CONFIG_NAME,\n Self::Temp => defs::TEMP_CONFIG_NAME,\n }\n }\n}\n\n/// Validate config key\n/// Uses the same validation rules as module_id: ^[a-zA-Z][a-zA-Z0-9._-]+$\n/// - Must start with a letter (a-zA-Z)\n/// - Followed by one or more alphanumeric, dot, underscore, or hyphen characters\n/// - Minimum length: 2 characters\npub fn validate_config_key(key: &str) -> Result<()> {\n if key.is_empty() {\n bail!(\"Config key cannot be empty\");\n }\n\n if key.len() > MAX_CONFIG_KEY_LEN {\n bail!(\n \"Config key too long: {} bytes (max: {MAX_CONFIG_KEY_LEN})\",\n key.len(),\n );\n }\n\n // Use same pattern as module_id for consistency\n let re = regex_lite::Regex::new(r\"^[a-zA-Z][a-zA-Z0-9._-]+$\")?;\n if !re.is_match(key) {\n bail!(\"Invalid config key: '{key}'. Must match /^[a-zA-Z][a-zA-Z0-9._-]+$/\");\n }\n\n Ok(())\n}\n\n/// Validate config value\n/// Only enforces maximum length - no character restrictions\n/// Values are stored in binary format with length prefix, so any UTF-8 data is safe\npub fn validate_config_value(value: &str) -> Result<()> {\n if value.len() > MAX_CONFIG_VALUE_LEN {\n bail!(\n \"Config value too long: {} bytes (max: {})\",\n value.len(),\n MAX_CONFIG_VALUE_LEN\n );\n }\n\n // No character restrictions - binary storage format handles all UTF-8 safely\n Ok(())\n}\n\n/// Validate config count\nfn validate_config_count(config: &HashMap) -> Result<()> {\n if config.len() > MAX_CONFIG_COUNT {\n bail!(\n \"Too many config entries: {} (max: {MAX_CONFIG_COUNT})\",\n config.len(),\n );\n }\n Ok(())\n}\n\n/// Get the config directory path for a module\nfn get_config_dir(module_id: &str) -> PathBuf {\n Path::new(defs::MODULE_CONFIG_DIR).join(module_id)\n}\n\n/// Get the config file path for a module\nfn get_config_path(module_id: &str, config_type: ConfigType) -> PathBuf {\n get_config_dir(module_id).join(config_type.filename())\n}\n\n/// Ensure the config directory exists\nfn ensure_config_dir(module_id: &str) -> Result {\n let dir = get_config_dir(module_id);\n ensure_dir_exists(&dir)?;\n Ok(dir)\n}\n\n/// Load config from binary file\npub fn load_config(module_id: &str, config_type: ConfigType) -> Result> {\n let config_path = get_config_path(module_id, config_type);\n\n if !config_path.exists() {\n debug!(\"Config file not found: {}\", config_path.display());\n return Ok(HashMap::new());\n }\n\n let mut file = File::open(&config_path)\n .with_context(|| format!(\"Failed to open config file: {}\", config_path.display()))?;\n\n // Read magic\n let mut magic_buf = [0u8; 4];\n file.read_exact(&mut magic_buf)\n .with_context(|| \"Failed to read magic\")?;\n let magic = u32::from_le_bytes(magic_buf);\n\n if magic != MODULE_CONFIG_MAGIC {\n bail!(\"Invalid config magic: expected 0x{MODULE_CONFIG_MAGIC:08x}, got 0x{magic:08x}\");\n }\n\n // Read version\n let mut version_buf = [0u8; 4];\n file.read_exact(&mut version_buf)\n .with_context(|| \"Failed to read version\")?;\n let version = u32::from_le_bytes(version_buf);\n\n if version != MODULE_CONFIG_VERSION {\n bail!(\"Unsupported config version: expected {MODULE_CONFIG_VERSION}, got {version}\");\n }\n\n // Read count\n let mut count_buf = [0u8; 4];\n file.read_exact(&mut count_buf)\n .with_context(|| \"Failed to read count\")?;\n let count = u32::from_le_bytes(count_buf);\n\n // Read entries\n let mut config = HashMap::new();\n for i in 0..count {\n // Read key length\n let mut key_len_buf = [0u8; 4];\n file.read_exact(&mut key_len_buf)\n .with_context(|| format!(\"Failed to read key length for entry {i}\"))?;\n let key_len = u32::from_le_bytes(key_len_buf) as usize;\n\n // Read key data\n let mut key_buf = vec![0u8; key_len];\n file.read_exact(&mut key_buf)\n .with_context(|| format!(\"Failed to read key data for entry {i}\"))?;\n let key = String::from_utf8(key_buf)\n .with_context(|| format!(\"Invalid UTF-8 in key for entry {i}\"))?;\n\n // Read value length\n let mut value_len_buf = [0u8; 4];\n file.read_exact(&mut value_len_buf)\n .with_context(|| format!(\"Failed to read value length for entry {i}\"))?;\n let value_len = u32::from_le_bytes(value_len_buf) as usize;\n\n // Read value data\n let mut value_buf = vec![0u8; value_len];\n file.read_exact(&mut value_buf)\n .with_context(|| format!(\"Failed to read value data for entry {i}\"))?;\n let value = String::from_utf8(value_buf)\n .with_context(|| format!(\"Invalid UTF-8 in value for entry {i}\"))?;\n\n config.insert(key, value);\n }\n\n debug!(\n \"Loaded {} entries from {}\",\n config.len(),\n config_path.display()\n );\n Ok(config)\n}\n\n/// Save config to binary file\npub fn save_config(\n module_id: &str,\n config_type: ConfigType,\n config: &HashMap,\n) -> Result<()> {\n // Validate config count\n validate_config_count(config)?;\n\n // Validate all keys and values\n for (key, value) in config {\n validate_config_key(key).with_context(|| format!(\"Invalid config key: '{key}'\"))?;\n validate_config_value(value)\n .with_context(|| format!(\"Invalid config value for key '{key}'\"))?;\n }\n\n ensure_config_dir(module_id)?;\n\n let config_path = get_config_path(module_id, config_type);\n let temp_path = config_path.with_extension(\"tmp\");\n\n // Write to temporary file first\n let mut file = File::create(&temp_path)\n .with_context(|| format!(\"Failed to create temp config file: {}\", temp_path.display()))?;\n\n // Write magic\n file.write_all(&MODULE_CONFIG_MAGIC.to_le_bytes())\n .with_context(|| \"Failed to write magic\")?;\n\n // Write version\n file.write_all(&MODULE_CONFIG_VERSION.to_le_bytes())\n .with_context(|| \"Failed to write version\")?;\n\n // Write count\n let count = config.len() as u32;\n file.write_all(&count.to_le_bytes())\n .with_context(|| \"Failed to write count\")?;\n\n // Write entries\n for (key, value) in config {\n // Write key length\n let key_bytes = key.as_bytes();\n let key_len = key_bytes.len() as u32;\n file.write_all(&key_len.to_le_bytes())\n .with_context(|| format!(\"Failed to write key length for '{key}'\"))?;\n\n // Write key data\n file.write_all(key_bytes)\n .with_context(|| format!(\"Failed to write key data for '{key}'\"))?;\n\n // Write value length\n let value_bytes = value.as_bytes();\n let value_len = value_bytes.len() as u32;\n file.write_all(&value_len.to_le_bytes())\n .with_context(|| format!(\"Failed to write value length for '{key}'\"))?;\n\n // Write value data\n file.write_all(value_bytes)\n .with_context(|| format!(\"Failed to write value data for '{key}'\"))?;\n }\n\n file.sync_all()\n .with_context(|| \"Failed to sync config file\")?;\n\n // Atomic rename\n fs::rename(&temp_path, &config_path).with_context(|| {\n format!(\n \"Failed to rename config file: {} -> {}\",\n temp_path.display(),\n config_path.display()\n )\n })?;\n\n debug!(\n \"Saved {} entries to {}\",\n config.len(),\n config_path.display()\n );\n Ok(())\n}\n\n/// Get a single config value\n#[allow(dead_code)]\npub fn get_config_value(\n module_id: &str,\n key: &str,\n config_type: ConfigType,\n) -> Result> {\n let config = load_config(module_id, config_type)?;\n Ok(config.get(key).cloned())\n}\n\n/// Set a single config value\npub fn set_config_value(\n module_id: &str,\n key: &str,\n value: &str,\n config_type: ConfigType,\n) -> Result<()> {\n // Validate input early for better error messages\n validate_config_key(key)?;\n validate_config_value(value)?;\n\n let mut config = load_config(module_id, config_type)?;\n config.insert(key.to_string(), value.to_string());\n\n // Note: save_config will also validate, but this provides earlier feedback\n save_config(module_id, config_type, &config)?;\n Ok(())\n}\n\n/// Delete a single config value\npub fn delete_config_value(module_id: &str, key: &str, config_type: ConfigType) -> Result<()> {\n let mut config = load_config(module_id, config_type)?;\n\n if config.remove(key).is_none() {\n bail!(\"Key '{key}' not found in config\");\n }\n\n save_config(module_id, config_type, &config)?;\n Ok(())\n}\n\n/// Clear all config values\npub fn clear_config(module_id: &str, config_type: ConfigType) -> Result<()> {\n let config_path = get_config_path(module_id, config_type);\n\n if config_path.exists() {\n fs::remove_file(&config_path)\n .with_context(|| format!(\"Failed to remove config file: {}\", config_path.display()))?;\n debug!(\"Cleared config: {}\", config_path.display());\n }\n\n Ok(())\n}\n\n/// Merge persist and temp configs (temp takes priority)\npub fn merge_configs(module_id: &str) -> Result> {\n let mut merged = match load_config(module_id, ConfigType::Persist) {\n Ok(config) => config,\n Err(e) => {\n warn!(\"Failed to load persist config for module '{module_id}': {e}\");\n HashMap::new()\n }\n };\n\n let temp = match load_config(module_id, ConfigType::Temp) {\n Ok(config) => config,\n Err(e) => {\n warn!(\"Failed to load temp config for module '{module_id}': {e}\");\n HashMap::new()\n }\n };\n\n // Temp config overrides persist config\n for (key, value) in temp {\n merged.insert(key, value);\n }\n\n Ok(merged)\n}\n\n/// Get all module configs (for iteration)\n/// Loads all configs in a single pass to minimize I/O overhead\npub fn get_all_module_configs() -> Result>> {\n let config_root = Path::new(defs::MODULE_CONFIG_DIR);\n\n if !config_root.exists() {\n return Ok(HashMap::new());\n }\n\n let mut all_configs = HashMap::new();\n\n for entry in fs::read_dir(config_root)\n .with_context(|| format!(\"Failed to read config directory: {}\", config_root.display()))?\n {\n let entry = entry?;\n let path = entry.path();\n\n if !path.is_dir() {\n continue;\n }\n\n if let Some(module_id) = path.file_name().and_then(|n| n.to_str()) {\n match merge_configs(module_id) {\n Ok(config) => {\n if !config.is_empty() {\n all_configs.insert(module_id.to_string(), config);\n }\n }\n Err(e) => {\n warn!(\"Failed to load config for module '{module_id}': {e}\");\n // Continue processing other modules\n }\n }\n }\n }\n\n Ok(all_configs)\n}\n\n/// Clear all temporary configs (called during post-fs-data)\npub fn clear_all_temp_configs() -> Result<()> {\n let config_root = Path::new(defs::MODULE_CONFIG_DIR);\n\n if !config_root.exists() {\n debug!(\"Config directory does not exist, nothing to clear\");\n return Ok(());\n }\n\n let mut cleared_count = 0;\n\n for entry in fs::read_dir(config_root)\n .with_context(|| format!(\"Failed to read config directory: {}\", config_root.display()))?\n {\n let entry = entry?;\n let path = entry.path();\n\n if !path.is_dir() {\n continue;\n }\n\n let temp_config = path.join(defs::TEMP_CONFIG_NAME);\n if temp_config.exists() {\n match fs::remove_file(&temp_config) {\n Ok(()) => {\n debug!(\"Cleared temp config: {}\", temp_config.display());\n cleared_count += 1;\n }\n Err(e) => {\n warn!(\"Failed to clear temp config {}: {e}\", temp_config.display());\n }\n }\n }\n }\n\n if cleared_count > 0 {\n debug!(\"Cleared {cleared_count} temp config file(s)\");\n }\n\n Ok(())\n}\n\n/// Clear all configs for a module (called during uninstall)\npub fn clear_module_configs(module_id: &str) -> Result<()> {\n let config_dir = get_config_dir(module_id);\n\n if config_dir.exists() {\n fs::remove_dir_all(&config_dir).with_context(|| {\n format!(\n \"Failed to remove config directory: {}\",\n config_dir.display()\n )\n })?;\n debug!(\"Cleared all configs for module: {module_id}\");\n }\n\n Ok(())\n}\n"
},
{
"path": "apd/src/package.rs",
"content": "use std::{\n collections::{HashMap, HashSet},\n fs::File,\n io::{self, BufRead},\n path::Path,\n process::Command,\n thread,\n time::Duration,\n};\n\nuse log::{info, warn};\nuse serde::{Deserialize, Serialize};\n\nuse crate::defs;\n\nconst DEFAULT_SCONTEXT: &str = \"u:r:untrusted_app:s0\";\nconst MAGISK_SCONTEXT: &str = \"u:r:magisk:s0\";\n\n#[derive(Deserialize, Serialize, Clone)]\npub struct PackageConfig {\n pub pkg: String,\n pub exclude: i32,\n pub allow: i32,\n pub uid: i32,\n pub to_uid: i32,\n pub sctx: String,\n}\n\nfn read_known_user_packages() -> HashSet {\n std::fs::read_to_string(defs::AUTO_EXCLUDE_KNOWN_PACKAGES_FILE)\n .map(|content| {\n content\n .lines()\n .map(str::trim)\n .filter(|line| !line.is_empty())\n .map(ToOwned::to_owned)\n .collect()\n })\n .unwrap_or_default()\n}\n\nfn write_known_user_packages(packages: &HashSet) -> io::Result<()> {\n let mut sorted_packages: Vec<_> = packages.iter().cloned().collect();\n sorted_packages.sort();\n let mut content = sorted_packages.join(\"\\n\");\n if !content.is_empty() {\n content.push('\\n');\n }\n std::fs::write(defs::AUTO_EXCLUDE_KNOWN_PACKAGES_FILE, content)\n}\n\nfn list_user_packages() -> HashSet {\n let commands: [(&str, &[&str]); 2] = [\n (\"cmd\", &[\"package\", \"list\", \"packages\", \"-3\"]),\n (\"pm\", &[\"list\", \"packages\", \"-3\"]),\n ];\n\n for (program, args) in commands {\n let output = match Command::new(program).args(args).output() {\n Ok(output) if output.status.success() => output,\n Ok(output) => {\n warn!(\"User package query {} {:?} failed: {:?}\", program, args, output.status.code());\n continue;\n }\n Err(e) => {\n warn!(\"User package query {} {:?} failed: {}\", program, args, e);\n continue;\n }\n };\n\n return String::from_utf8_lossy(&output.stdout)\n .lines()\n .filter_map(|line| line.strip_prefix(\"package:\"))\n .map(str::trim)\n .filter(|pkg| !pkg.is_empty())\n .map(ToOwned::to_owned)\n .collect();\n }\n\n HashSet::new()\n}\n\npub fn sync_auto_exclude_new_apps(\n package_configs: &mut Vec,\n uid_map: &HashMap,\n mode: i32,\n) -> io::Result {\n let current_user_packages = list_user_packages();\n if current_user_packages.is_empty() {\n return Ok(false);\n }\n\n let known_user_packages = read_known_user_packages();\n let known_initialized = Path::new(defs::AUTO_EXCLUDE_KNOWN_PACKAGES_FILE).exists();\n let mut changed = false;\n\n if mode != 0 && known_initialized {\n let new_packages: Vec<_> = current_user_packages\n .difference(&known_user_packages)\n .cloned()\n .collect();\n\n for pkg in new_packages {\n let Some(&uid) = uid_map.get(&pkg) else {\n warn!(\"[auto_exclude] Missing uid for package {}, skip\", pkg);\n continue;\n };\n\n let exists = package_configs.iter().any(|config| config.pkg == pkg || config.uid == uid);\n if exists {\n continue;\n }\n\n let (allow, exclude, sctx, mode_name) = match mode {\n 1 => (1, 0, MAGISK_SCONTEXT.to_string(), \"root\"),\n 2 => (0, 1, DEFAULT_SCONTEXT.to_string(), \"exclude\"),\n _ => continue,\n };\n\n info!(\n \"[new_app_profile] New package detected, apply {} by default: {} ({})\",\n mode_name, pkg, uid\n );\n package_configs.push(PackageConfig {\n pkg,\n exclude,\n allow,\n uid,\n to_uid: 0,\n sctx,\n });\n changed = true;\n }\n }\n\n write_known_user_packages(¤t_user_packages)?;\n Ok(changed || !known_initialized)\n}\n\npub fn read_ap_package_config() -> Vec {\n let max_retry = 5;\n for _ in 0..max_retry {\n let file = match File::open(\"/data/adb/ap/package_config\") {\n Ok(file) => file,\n Err(e) => {\n warn!(\"Error opening file: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n };\n\n let mut reader = csv::Reader::from_reader(file);\n let mut package_configs = Vec::new();\n let mut success = true;\n\n for record in reader.deserialize() {\n match record {\n Ok(config) => package_configs.push(config),\n Err(e) => {\n warn!(\"Error deserializing record: {}\", e);\n success = false;\n break;\n }\n }\n }\n\n if success {\n return package_configs;\n }\n thread::sleep(Duration::from_secs(1));\n }\n Vec::new()\n}\n\npub fn write_ap_package_config(package_configs: &[PackageConfig]) -> io::Result<()> {\n let max_retry = 5;\n for _ in 0..max_retry {\n let temp_path = \"/data/adb/ap/package_config.tmp\";\n let file = match File::create(temp_path) {\n Ok(file) => file,\n Err(e) => {\n warn!(\"Error creating temp file: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n };\n\n let mut writer = csv::Writer::from_writer(file);\n let mut success = true;\n\n for config in package_configs {\n if let Err(e) = writer.serialize(config) {\n warn!(\"Error serializing record: {}\", e);\n success = false;\n break;\n }\n }\n\n if !success {\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n\n if let Err(e) = writer.flush() {\n warn!(\"Error flushing writer: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n\n if let Err(e) = std::fs::rename(temp_path, \"/data/adb/ap/package_config\") {\n warn!(\"Error renaming temp file: {}\", e);\n thread::sleep(Duration::from_secs(1));\n continue;\n }\n return Ok(());\n }\n Err(io::Error::new(\n io::ErrorKind::Other,\n \"Failed after max retries\",\n ))\n}\n\nfn read_lines(filename: P) -> io::Result>>\nwhere\n P: AsRef,\n{\n File::open(filename).map(|file| io::BufReader::new(file).lines())\n}\n\npub fn synchronize_package_uid() -> io::Result<()> {\n info!(\"[synchronize_package_uid] Start synchronizing root list with system packages...\");\n\n let max_retry = 5;\n for _ in 0..max_retry {\n match read_lines(\"/data/system/packages.list\") {\n Ok(lines) => {\n let lines: Vec<_> = lines.filter_map(|line| line.ok()).collect();\n\n let mut package_configs = read_ap_package_config();\n let uid_map: HashMap = lines\n .iter()\n .filter_map(|line| {\n let words: Vec<&str> = line.split_whitespace().collect();\n if words.len() < 2 {\n return None;\n }\n words[1]\n .parse::()\n .ok()\n .map(|uid| (words[0].to_string(), uid))\n })\n .collect();\n\n let system_packages: Vec = lines\n .iter()\n .filter_map(|line| line.split_whitespace().next())\n .map(|pkg| pkg.to_string())\n .collect();\n\n let original_len = package_configs.len();\n package_configs.retain(|config| system_packages.contains(&config.pkg));\n let removed_count = original_len - package_configs.len();\n\n if removed_count > 0 {\n info!(\n \"Removed {} uninstalled package configurations\",\n removed_count\n );\n }\n\n let mut updated = false;\n\n let new_app_profile_mode = crate::supercall::get_new_app_profile_mode();\n if sync_auto_exclude_new_apps(&mut package_configs, &uid_map, new_app_profile_mode)? {\n updated = true;\n }\n\n for line in &lines {\n let words: Vec<&str> = line.split_whitespace().collect();\n if words.len() >= 2 {\n let pkg_name = words[0];\n if let Ok(uid) = words[1].parse::() {\n if let Some(config) = package_configs\n .iter_mut()\n .find(|config| config.pkg == pkg_name)\n {\n if config.uid % 100000 != uid % 100000 {\n let uid = config.uid / 100000 * 100000 + uid % 100000;\n info!(\n \"Updating uid for package {}: {} -> {}\",\n pkg_name, config.uid, uid\n );\n config.uid = uid;\n updated = true;\n }\n }\n } else {\n warn!(\"Error parsing uid: {}\", words[1]);\n }\n }\n }\n\n if updated || removed_count > 0 {\n write_ap_package_config(&package_configs)?;\n }\n return Ok(());\n }\n Err(e) => {\n warn!(\"Error reading packages.list: {}\", e);\n thread::sleep(Duration::from_secs(1));\n }\n }\n }\n Err(io::Error::new(\n io::ErrorKind::Other,\n \"Failed after max retries\",\n ))\n}\n"
},
{
"path": "apd/src/pty.rs",
"content": "use std::{\n ffi::c_int,\n fs::File,\n io::{Read, Write, stderr, stdin, stdout},\n mem::MaybeUninit,\n os::fd::{AsFd, AsRawFd, OwnedFd, RawFd},\n process::exit,\n ptr::null_mut,\n sync::Mutex,\n thread,\n};\n\nuse anyhow::{Ok, Result, bail};\nuse libc::{\n EINTR, SIG_BLOCK, SIG_UNBLOCK, SIGWINCH, TIOCGWINSZ, TIOCSWINSZ, fork,\n pthread_sigmask, sigaddset, sigemptyset, sigset_t, sigwait, waitpid, winsize,\n};\nuse rustix::{\n fs::{Mode, OFlags, open},\n io::dup,\n ioctl::{Getter, Opcode, ioctl, opcode},\n process::setsid,\n pty::{grantpt, unlockpt},\n stdio::{dup2_stderr, dup2_stdin, dup2_stdout},\n termios::{OptionalActions, Termios, isatty, tcgetattr, tcsetattr},\n};\n\nuse crate::{defs::PTS_NAME, utils::get_tmp_path};\n\n// https://github.com/topjohnwu/Magisk/blob/5627053b7481618adfdf8fa3569b48275589915b/native/src/core/su/pts.cpp\n\nfn get_pty_num(fd: F) -> Result {\n // TIOCGPTN: Get the PTY number\n const TIOCGPTN: Opcode = opcode::read::(b'T', 0x30);\n Ok(unsafe {\n let tiocgptn = Getter::::new();\n ioctl(fd, tiocgptn)?\n })\n}\n\nstatic OLD_STDIN: Mutex> = Mutex::new(None);\n\nfn watch_sigwinch_async(slave: RawFd) {\n let mut winch = MaybeUninit::::uninit();\n unsafe {\n sigemptyset(winch.as_mut_ptr());\n sigaddset(winch.as_mut_ptr(), SIGWINCH);\n pthread_sigmask(SIG_BLOCK, winch.as_mut_ptr(), null_mut());\n }\n\n thread::spawn(move || unsafe {\n let mut winch = MaybeUninit::::uninit();\n sigemptyset(winch.as_mut_ptr());\n sigaddset(winch.as_mut_ptr(), SIGWINCH);\n pthread_sigmask(SIG_UNBLOCK, winch.as_mut_ptr(), null_mut());\n let mut sig: c_int = 0;\n loop {\n let mut w = MaybeUninit::::uninit();\n if libc::ioctl(1, TIOCGWINSZ, w.as_mut_ptr()) < 0 {\n continue;\n }\n libc::ioctl(slave, TIOCSWINSZ, w.as_mut_ptr());\n if sigwait(winch.as_mut_ptr(), &mut sig) != 0 {\n break;\n }\n }\n });\n}\n\nfn set_stdin_raw() -> rustix::io::Result<()> {\n let mut termios = tcgetattr(stdin())?;\n\n let mut guard = OLD_STDIN.lock().unwrap();\n *guard = Some(termios.clone());\n drop(guard);\n\n termios.make_raw();\n tcsetattr(stdin(), OptionalActions::Flush, &termios)\n}\n\nfn restore_stdin() -> Result<()> {\n let mut guard = OLD_STDIN.lock().unwrap();\n\n if let Some(original_termios) = guard.take() {\n tcsetattr(stdin(), OptionalActions::Flush, &original_termios)?;\n }\n\n Ok(())\n}\n\nfn pump(mut from: R, mut to: W) {\n let mut buf = [0u8; 4096];\n loop {\n match from.read(&mut buf) {\n Result::Ok(len) => {\n if len == 0 {\n return;\n }\n if to.write_all(&buf[0..len]).is_err() {\n return;\n }\n if to.flush().is_err() {\n return;\n }\n }\n Err(_) => {\n return;\n }\n }\n }\n}\n\nfn pump_stdin_async(mut ptmx: File) {\n let _ = set_stdin_raw();\n\n thread::spawn(move || {\n let mut stdin = stdin();\n pump(&mut stdin, &mut ptmx);\n });\n}\n\nfn pump_stdout_blocking(mut ptmx: File) {\n let mut stdout = stdout();\n pump(&mut ptmx, &mut stdout);\n\n let _ = restore_stdin();\n}\n\nfn create_transfer(ptmx: OwnedFd) -> Result<()> {\n let pid = unsafe { fork() };\n match pid {\n d if d < 0 => bail!(\"fork\"),\n 0 => return Ok(()),\n _ => {}\n }\n\n let ptmx_r = ptmx;\n let ptmx_w = dup(&ptmx_r)?;\n\n let ptmx_r = File::from(ptmx_r);\n let ptmx_w = File::from(ptmx_w);\n\n watch_sigwinch_async(ptmx_w.as_raw_fd());\n pump_stdin_async(ptmx_r);\n pump_stdout_blocking(ptmx_w);\n\n let mut status: c_int = -1;\n\n unsafe {\n loop {\n if waitpid(pid, &mut status, 0) == -1 && std::io::Error::last_os_error().raw_os_error() != Some(EINTR) {\n continue;\n }\n break;\n }\n }\n\n exit(status)\n}\n\npub fn prepare_pty() -> Result<()> {\n let tty_in = isatty(stdin());\n let tty_out = isatty(stdout());\n let tty_err = isatty(stderr());\n if !tty_in && !tty_out && !tty_err {\n return Ok(());\n }\n\n let mut pts_path = format!(\"{}/{}\", get_tmp_path(), PTS_NAME);\n if !std::path::Path::new(&pts_path).exists() {\n pts_path = \"/dev/pts\".to_string();\n }\n let ptmx_path = format!(\"{}/ptmx\", pts_path);\n let ptmx_fd = open(ptmx_path, OFlags::RDWR, Mode::empty())?;\n grantpt(&ptmx_fd)?;\n unlockpt(&ptmx_fd)?;\n let pty_num = get_pty_num(&ptmx_fd)?;\n create_transfer(ptmx_fd)?;\n setsid()?;\n let pty_fd = open(format!(\"{pts_path}/{pty_num}\"), OFlags::RDWR, Mode::empty())?;\n if tty_in {\n dup2_stdin(&pty_fd)?;\n }\n if tty_out {\n dup2_stdout(&pty_fd)?;\n }\n if tty_err {\n dup2_stderr(&pty_fd)?;\n }\n Ok(())\n}\n"
},
{
"path": "apd/src/resetprop.rs",
"content": "use anyhow::{bail, Context, Result};\nuse clap::error::ErrorKind;\nuse clap::Parser;\nuse log::info;\nuse prop_rs_android::resetprop::ResetProp;\nuse prop_rs_android::sys_prop;\nuse std::fmt;\nuse std::fs::File;\nuse std::io::{BufRead, BufReader};\nuse std::path::Path;\nuse std::time::Duration;\n\n#[derive(Debug)]\npub struct WaitTimeoutError {\n name: String,\n}\n\nimpl fmt::Display for WaitTimeoutError {\n fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n write!(f, \"timeout waiting for {}\", self.name)\n }\n}\n\nimpl std::error::Error for WaitTimeoutError {}\n\n/// Magisk-compatible Android system property tool.\n#[derive(Debug, clap::Args)]\n#[allow(clippy::struct_excessive_bools)]\npub struct Args {\n /// Skip property_service (force direct mmap operation).\n #[arg(short = 'n', long = \"skip-svc\")]\n skip_svc: bool,\n\n /// Also operate on persistent property storage (persist.* files).\n #[arg(short = 'p', long = \"persistent\")]\n persistent: bool,\n\n /// Only read persistent properties from storage.\n #[arg(short = 'P')]\n persist_only: bool,\n\n /// Delete the named property.\n #[arg(short = 'd', long = \"delete\")]\n delete: bool,\n\n /// Verbose output.\n #[arg(short = 'v', long = \"verbose\")]\n verbose: bool,\n\n /// Wait for a property to exist or match a value.\n #[arg(short = 'w', long = \"wait\")]\n wait: bool,\n\n /// Timeout in seconds for --wait (default: wait forever).\n #[arg(long = \"timeout\")]\n timeout: Option,\n\n /// Load and set properties from FILE.\n #[arg(short = 'f', long = \"file\")]\n file: Option,\n\n /// Compact property area memory (reclaim holes left by deleted properties).\n /// Optionally pass a SELinux context name to compact only that area.\n #[arg(short = 'c', long = \"compact\")]\n compact: bool,\n\n /// Show SELinux context when listing properties.\n #[arg(short = 'Z')]\n show_context: bool,\n\n /// Property name.\n name: Option,\n\n /// Property value (for set or wait-for-value).\n value: Option,\n}\n#[derive(Parser)]\n#[command(\n name = \"resetprop\",\n version,\n about = \"Magisk-compatible system property tool\",\n disable_help_subcommand = true\n)]\nstruct ResetPropParser {\n #[command(flatten)]\n arg: Args,\n}\n\npub fn resetprop_main(args: &[String]) -> ! {\n if let Err(err) = run_from_args(args) {\n let code = if err.downcast_ref::().is_some() {\n 2\n } else {\n 1\n };\n eprintln!(\"resetprop: {err:#}\");\n std::process::exit(code);\n }\n std::process::exit(0);\n}\n\n/// Entry point for resetprop multicall.\n///\n/// `args` should include argv[0] (the program name).\nfn run_from_args(args: &[String]) -> Result<()> {\n let parser = match ResetPropParser::try_parse_from(args) {\n Ok(cli) => cli,\n Err(err) => {\n if matches!(\n err.kind(),\n ErrorKind::DisplayHelp | ErrorKind::DisplayVersion\n ) {\n err.print()?;\n return Ok(());\n }\n return Err(anyhow::anyhow!(\"{err}\"));\n }\n };\n execute(&parser.arg)\n}\n/// Execute resetprop logic\n/// Subcommand will direct call that, skip run_from_args\npub fn execute(cli: &Args) -> Result<()> {\n sys_prop::init().context(\"Failed to initialize system property API\")?;\n\n let rp = ResetProp {\n skip_svc: cli.skip_svc,\n persistent: cli.persistent,\n persist_only: cli.persist_only,\n verbose: cli.verbose,\n show_context: cli.show_context,\n };\n\n // Validate: at most one special mode\n let special_modes = u8::from(cli.wait)\n + u8::from(cli.delete)\n + u8::from(cli.compact)\n + u8::from(cli.file.is_some());\n if special_modes > 1 {\n bail!(\"multiple operation modes detected\");\n }\n\n // -w: wait mode\n if cli.wait {\n let name = cli\n .name\n .as_deref()\n .context(\"--wait requires a property name\")?;\n let timeout = cli.timeout.map(Duration::from_secs_f64);\n let ok = rp\n .wait(name, cli.value.as_deref(), timeout)\n .context(\"wait failed\")?;\n if !ok {\n return Err(WaitTimeoutError {\n name: name.to_owned(),\n }\n .into());\n }\n return Ok(());\n }\n\n // -c: compact property area memory\n // When a positional argument is given, treat it as a SELinux context name.\n if cli.compact {\n let context = cli.name.as_deref();\n let compacted = sys_prop::compact(context).context(\"compact failed\")?;\n if !compacted {\n bail!(\"nothing to compact\");\n }\n return Ok(());\n }\n\n // -f: load from file\n if let Some(path) = &cli.file {\n let file = File::open(path).with_context(|| format!(\"Failed to open {path}\"))?;\n let reader = BufReader::new(file);\n rp.load_props(reader.lines())\n .context(\"Failed to load properties from file\")?;\n return Ok(());\n }\n\n // -d: delete\n if cli.delete {\n let name = cli\n .name\n .as_deref()\n .context(\"--delete requires a property name\")?;\n let deleted = rp.delete(name).context(\"delete failed\")?;\n if !deleted {\n bail!(\"{name} not found\");\n }\n return Ok(());\n }\n\n match (&cli.name, &cli.value) {\n // resetprop name value (set)\n (Some(name), Some(value)) => {\n rp.set(name, value)\n .with_context(|| format!(\"Failed to set {name}\"))?;\n }\n\n // resetprop name (get)\n (Some(name), None) => match rp.get(name) {\n Some(val) => println!(\"{val}\"),\n None => bail!(\"{name} not found\"),\n },\n\n // resetprop (list all)\n (None, None) => {\n let props = rp.list_all().context(\"Failed to list properties\")?;\n for (name, value) in &props {\n println!(\"[{name}]: [{value}]\");\n }\n }\n\n // resetprop — invalid\n (None, Some(_)) => {\n bail!(\"property name is required\");\n }\n }\n\n Ok(())\n}\n\n/// Load system.prop file using internal resetprop API.\n///\n/// Equivalent to `resetprop -n --file `.\n#[allow(dead_code)]\npub fn load_system_prop_file(path: &Path) -> Result<()> {\n sys_prop::init().context(\"Failed to initialize system property API\")?;\n\n let rp = ResetProp {\n skip_svc: true,\n persistent: false,\n persist_only: false,\n verbose: false,\n show_context: false,\n };\n\n let file = File::open(path).with_context(|| format!(\"Failed to open {}\", path.display()))?;\n let reader = BufReader::new(file);\n rp.load_props(reader.lines())\n .with_context(|| format!(\"Failed to load properties from {}\", path.display()))?;\n\n info!(\"Loaded system.prop from {}\", path.display());\n Ok(())\n}\n"
},
{
"path": "apd/src/restorecon.rs",
"content": "use std::path::Path;\n\nuse anyhow::Result;\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\nuse anyhow::{Context, Ok};\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\nuse extattr::{Flags as XattrFlags, lsetxattr};\nuse jwalk::{Parallelism::Serial, WalkDir};\n\nuse crate::defs;\n\npub const SYSTEM_CON: &str = \"u:object_r:system_file:s0\";\npub const ADB_CON: &str = \"u:object_r:adb_data_file:s0\";\npub const UNLABEL_CON: &str = \"u:object_r:unlabeled:s0\";\n\nconst SELINUX_XATTR: &str = \"security.selinux\";\n\npub fn lsetfilecon>(path: P, con: &str) -> Result<()> {\n #[cfg(any(target_os = \"linux\", target_os = \"android\"))]\n lsetxattr(&path, SELINUX_XATTR, con, XattrFlags::empty()).with_context(|| {\n format!(\n \"Failed to change SELinux context for {}\",\n path.as_ref().display()\n )\n })?;\n Ok(())\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn lgetfilecon>(path: P) -> Result {\n let con = extattr::lgetxattr(&path, SELINUX_XATTR).with_context(|| {\n format!(\n \"Failed to get SELinux context for {}\",\n path.as_ref().display()\n )\n })?;\n let con = String::from_utf8_lossy(&con);\n Ok(con.to_string())\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn setsyscon>(path: P) -> Result<()> {\n lsetfilecon(path, SYSTEM_CON)\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn setsyscon>(path: P) -> Result<()> {\n unimplemented!()\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn lgetfilecon>(path: P) -> Result {\n unimplemented!()\n}\n\npub fn restore_syscon>(dir: P) -> Result<()> {\n for dir_entry in WalkDir::new(dir).parallelism(Serial) {\n if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {\n setsyscon(&path)?;\n }\n }\n Ok(())\n}\n\nfn restore_syscon_if_unlabeled>(dir: P) -> Result<()> {\n for dir_entry in WalkDir::new(dir).parallelism(Serial) {\n if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {\n if let Result::Ok(con) = lgetfilecon(&path) {\n if con == UNLABEL_CON || con.is_empty() {\n lsetfilecon(&path, SYSTEM_CON)?;\n }\n }\n }\n }\n Ok(())\n}\n\npub fn restorecon() -> Result<()> {\n lsetfilecon(defs::DAEMON_PATH, ADB_CON)?;\n restore_syscon_if_unlabeled(defs::MODULE_DIR)?;\n Ok(())\n}\n"
},
{
"path": "apd/src/sepolicy.rs",
"content": "use anyhow::{Context, Result, bail};\nuse clap::Parser;\nuse policy::{SePolicy, format_statement_help};\nuse std::io::{self, Write};\nuse std::path::PathBuf;\n\n/// Write adapter for formatting\nstruct WriteAdapter(T);\n\nimpl std::fmt::Write for WriteAdapter {\n fn write_str(&mut self, s: &str) -> std::fmt::Result {\n self.0.write_all(s.as_bytes()).map_err(|_| std::fmt::Error)\n }\n}\n\n/// MagiskPolicy - SELinux Policy Patch Tool\n#[derive(Debug, clap::Args)]\n#[allow(clippy::struct_excessive_bools)]\npub struct Args {\n /// Load monolithic sepolicy from FILE\n #[arg(long = \"load\", value_name = \"FILE\")]\n load: Option,\n\n /// Load from precompiled sepolicy or compile split cil policies\n #[arg(long = \"load-split\")]\n load_split: bool,\n\n /// Compile split cil policies\n #[arg(long = \"compile-split\")]\n compile_split: bool,\n\n /// Dump monolithic sepolicy to FILE\n #[arg(long = \"save\", value_name = \"FILE\")]\n save: Option,\n\n /// Immediately load sepolicy into the kernel\n #[arg(long = \"live\")]\n live: bool,\n\n /// Apply built-in Magisk sepolicy rules\n #[arg(long = \"magisk\")]\n magisk: bool,\n\n /// Apply rules from FILE, read and parsed line by line as policy statements\n #[arg(long = \"apply\", value_name = \"FILE\")]\n apply: Vec,\n\n /// Print all rules in the loaded sepolicy\n #[arg(long = \"print-rules\")]\n print_rules: bool,\n\n /// Policy statements to apply\n #[arg(required = false)]\n policies: Vec,\n}\n\n#[derive(Parser)]\n#[command(\n name = \"magiskpolicy\",\n version,\n about = \"SELinux Policy Patch Tool\",\n disable_help_subcommand = true\n)]\nstruct MagiskPolicyParser {\n #[command(flatten)]\n arg: Args,\n}\n\npub fn policy_main(args: &[String]) -> ! {\n if let Err(err) = run_from_args(args) {\n eprintln!(\"magiskpolicy: {err:#}\");\n std::process::exit(1);\n }\n std::process::exit(0);\n}\n\n/// Entry point for magiskpolicy multicall.\n///\n/// `args` should include argv[0] (the program name).\nfn run_from_args(args: &[String]) -> Result<()> {\n let parser = match MagiskPolicyParser::try_parse_from(args) {\n Ok(cli) => cli,\n Err(err) => {\n if err.kind() == clap::error::ErrorKind::DisplayHelp {\n print_usage(args.first().map(|s| s.as_str()).unwrap_or(\"magiskpolicy\"));\n return Ok(());\n }\n if err.kind() == clap::error::ErrorKind::DisplayVersion {\n err.print()?;\n return Ok(());\n }\n return Err(anyhow::anyhow!(\"{err}\"));\n }\n };\n execute(&parser.arg)\n}\n\npub fn get_policy_main(args: &[String]) -> Result {\n let parser = MagiskPolicyParser::try_parse_from(args)?;\n let cli = parser.arg;\n\n // Validate mutually exclusive options\n let load_count = cli.load.iter().count() + cli.compile_split as usize + cli.load_split as usize;\n if load_count > 1 {\n bail!(\"Multiple load source supplied\");\n }\n\n // Load policy\n let mut sepol = if let Some(ref file) = cli.load {\n SePolicy::from_file(file)\n .with_context(|| format!(\"Cannot load policy from {}\", file.display()))?\n } else if cli.load_split {\n SePolicy::from_split().context(\"Cannot load split policy\")?\n } else if cli.compile_split {\n SePolicy::compile_split().context(\"Cannot compile split policy\")?\n } else {\n SePolicy::from_file(\"/sys/fs/selinux/policy\").context(\"Cannot load live policy\")?\n };\n execute_next(&cli, &mut sepol)?;\n Ok(sepol)\n}\n\n/// Execute magiskpolicy logic\n/// Subcommand will direct call that, skip run_from_args\npub fn execute(cli: &Args) -> Result<()> {\n // Validate mutually exclusive options\n let load_count = cli.load.iter().count() + cli.compile_split as usize + cli.load_split as usize;\n if load_count > 1 {\n bail!(\"Multiple load source supplied\");\n }\n\n // Load policy\n let mut sepol = if let Some(ref file) = cli.load {\n SePolicy::from_file(file)\n .with_context(|| format!(\"Cannot load policy from {}\", file.display()))?\n } else if cli.load_split {\n SePolicy::from_split().context(\"Cannot load split policy\")?\n } else if cli.compile_split {\n SePolicy::compile_split().context(\"Cannot compile split policy\")?\n } else {\n SePolicy::from_file(\"/sys/fs/selinux/policy\").context(\"Cannot load live policy\")?\n };\n\n execute_next(cli, &mut sepol)?;\n Ok(())\n}\n\nfn execute_next(cli: &Args, sepol: &mut SePolicy) -> Result<()> {\n if cli.print_rules {\n if cli.magisk\n || !cli.apply.is_empty()\n || !cli.policies.is_empty()\n || cli.live\n || cli.save.is_some()\n {\n bail!(\"Cannot print rules with other options\");\n }\n sepol.print_rules();\n return Ok(());\n }\n\n if cli.magisk {\n sepol.magisk_rules();\n }\n\n for file in &cli.apply {\n sepol\n .load_rule_file(file)\n .with_context(|| format!(\"Cannot load rule file {}\", file.display()))?;\n }\n\n for statement in &cli.policies {\n sepol.load_rules(statement);\n }\n\n if cli.live {\n sepol\n .to_file(\"/sys/fs/selinux/load\")\n .context(\"Cannot apply policy\")?;\n }\n\n if let Some(ref file) = cli.save {\n sepol\n .to_file(file)\n .with_context(|| format!(\"Cannot dump policy to {}\", file.display()))?;\n }\n Ok(())\n}\n\n/// Print usage information\nfn print_usage(cmd: &str) {\n eprintln!(\n r#\"MagiskPolicy - SELinux Policy Patch Tool\n\nUsage: {cmd} [--options...] [policy statements...]\n\nOptions:\n --help show help message for policy statements\n --load FILE load monolithic sepolicy from FILE\n --load-split load from precompiled sepolicy or compile\n split cil policies\n --compile-split compile split cil policies\n --save FILE dump monolithic sepolicy to FILE\n --live immediately load sepolicy into the kernel\n --magisk apply built-in Magisk sepolicy rules\n --apply FILE apply rules from FILE, read and parsed\n line by line as policy statements\n (multiple --apply are allowed)\n --print-rules print all rules in the loaded sepolicy\n\nIf neither --load, --load-split, nor --compile-split is specified,\nit will load from current live policies (/sys/fs/selinux/policy)\n\"#\n );\n\n let _ = format_statement_help(&mut WriteAdapter(io::stderr()));\n eprintln!();\n}\n"
},
{
"path": "apd/src/supercall.rs",
"content": "use std::{\n ffi::{CStr, CString},\n fs::File,\n io::{self, Read},\n process,\n sync::{Arc, Mutex},\n};\n\nuse libc::{c_long, c_void, syscall, uid_t, EINVAL};\nuse log::{error, info, warn};\n\nuse crate::package::{read_ap_package_config, synchronize_package_uid};\n\nconst MAJOR: c_long = 0;\nconst MINOR: c_long = 13;\nconst PATCH: c_long = 1;\n\nconst KSTORAGE_EXCLUDE_LIST_GROUP: i32 = 1;\nconst KSTORAGE_AUTO_EXCLUDE_GROUP: i32 = 3;\n\nconst __NR_SUPERCALL: c_long = 45;\nconst SUPERCALL_SU: c_long = 0x1010;\nconst SUPERCALL_KSTORAGE_WRITE: c_long = 0x1041;\nconst SUPERCALL_KSTORAGE_READ: c_long = 0x1042;\nconst SUPERCALL_SU_GRANT_UID: c_long = 0x1100;\nconst SUPERCALL_SU_REVOKE_UID: c_long = 0x1101;\nconst SUPERCALL_SU_NUMS: c_long = 0x1102;\nconst SUPERCALL_SU_LIST: c_long = 0x1103;\nconst SUPERCALL_SU_RESET_PATH: c_long = 0x1111;\nconst SUPERCALL_SU_GET_SAFEMODE: c_long = 0x1112;\n\nconst SUPERCALL_KPM_LOAD: c_long = 0x1020;\n\nconst SUPERCALL_UTS_SET: c_long = 0x1050;\nconst SUPERCALL_UTS_RESET: c_long = 0x1051;\n\nconst SUPERCALL_PATHHIDE_ENABLE: c_long = 0x1064;\nconst SUPERCALL_PATHHIDE_ADD: c_long = 0x1060;\nconst SUPERCALL_PATHHIDE_CLEAR: c_long = 0x1063;\nconst SUPERCALL_PATHHIDE_UID_MODE: c_long = 0x106A;\nconst SUPERCALL_PATHHIDE_UID_ADD: c_long = 0x1066;\nconst SUPERCALL_PATHHIDE_UID_CLEAR: c_long = 0x1069;\nconst SUPERCALL_PATHHIDE_FILTER_SYSTEM: c_long = 0x106B;\n\nconst SUPERCALL_NETISOLATE_ENABLE: c_long = 0x1070;\nconst SUPERCALL_NETISOLATE_UID_ADD: c_long = 0x1072;\nconst SUPERCALL_NETISOLATE_UID_REMOVE: c_long = 0x1073;\nconst SUPERCALL_NETISOLATE_UID_LIST: c_long = 0x1074;\nconst SUPERCALL_NETISOLATE_UID_CLEAR: c_long = 0x1075;\n\nconst SUPERCALL_SCONTEXT_LEN: usize = 0x60;\n\n#[repr(C)]\nstruct SuProfile {\n uid: i32,\n to_uid: i32,\n scontext: [u8; SUPERCALL_SCONTEXT_LEN],\n}\n\nfn ver_and_cmd(cmd: c_long) -> c_long {\n let version_code: u32 = ((MAJOR << 16) + (MINOR << 8) + PATCH).try_into().unwrap();\n ((version_code as c_long) << 32) | (0x1158 << 16) | (cmd & 0xFFFF)\n}\n\nfn sc_su_revoke_uid(key: &CStr, uid: uid_t) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_REVOKE_UID),\n uid,\n ) as c_long\n }\n}\n\nfn sc_su_grant_uid(key: &CStr, profile: &SuProfile) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_GRANT_UID),\n profile,\n ) as c_long\n }\n}\n\nfn sc_kstorage_write(\n key: &CStr,\n gid: i32,\n did: i64,\n data: *mut c_void,\n offset: i32,\n dlen: i32,\n) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KSTORAGE_WRITE),\n gid as c_long,\n did as c_long,\n data,\n (((offset as i64) << 32) | (dlen as i64)) as c_long,\n ) as c_long\n }\n}\n\nfn sc_kstorage_read(\n key: &CStr,\n gid: i32,\n did: i64,\n out_data: *mut c_void,\n offset: i32,\n dlen: i32,\n) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KSTORAGE_READ),\n gid as c_long,\n did as c_long,\n out_data,\n (((offset as i64) << 32) | (dlen as i64)) as c_long,\n ) as c_long\n }\n}\n\nfn sc_set_ap_mod_exclude(key: &CStr, uid: i64, exclude: i32) -> c_long {\n sc_kstorage_write(\n key,\n KSTORAGE_EXCLUDE_LIST_GROUP,\n uid,\n &exclude as *const i32 as *mut c_void,\n 0,\n size_of::() as i32,\n )\n}\n\npub fn get_new_app_profile_mode() -> i32 {\n let key = CStr::from_bytes_with_nul(b\"su\\0\").expect(\"auto exclude key init failed\");\n let mut enabled = 0_i32;\n let rc = sc_kstorage_read(\n key,\n KSTORAGE_AUTO_EXCLUDE_GROUP,\n 0,\n &mut enabled as *mut i32 as *mut c_void,\n 0,\n size_of::() as i32,\n );\n if rc < 0 {\n return 0;\n }\n enabled\n}\n\npub fn sc_su_get_safemode(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n warn!(\"[sc_su_get_safemode] null superkey, tell apd we are not in safemode!\");\n return 0;\n }\n\n let key_ptr = key.as_ptr();\n if key_ptr.is_null() {\n warn!(\"[sc_su_get_safemode] superkey pointer is null!\");\n return 0;\n }\n\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key_ptr,\n ver_and_cmd(SUPERCALL_SU_GET_SAFEMODE),\n ) as c_long\n }\n}\n\nfn sc_su(key: &CStr, profile: &SuProfile) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU),\n profile,\n ) as c_long\n }\n}\n\nfn sc_su_reset_path(key: &CStr, path: &CStr) -> c_long {\n if key.to_bytes().is_empty() || path.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_RESET_PATH),\n path.as_ptr(),\n ) as c_long\n }\n}\n\nfn sc_kpm_load(key: &CStr, path: &CStr, args: &CStr) -> c_long {\n if key.to_bytes().is_empty() || path.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_KPM_LOAD),\n path.as_ptr(),\n args.as_ptr(),\n std::ptr::null::(),\n ) as c_long\n }\n}\n\nfn sc_su_uid_nums(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe { syscall(__NR_SUPERCALL, key.as_ptr(), ver_and_cmd(SUPERCALL_SU_NUMS)) as c_long }\n}\n\nfn sc_su_allow_uids(key: &CStr, buf: &mut [uid_t]) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n if buf.is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_SU_LIST),\n buf.as_mut_ptr(),\n buf.len() as i32,\n ) as c_long\n }\n}\n\nfn read_file_to_string(path: &str) -> io::Result {\n let mut file = File::open(path)?;\n let mut content = String::new();\n file.read_to_string(&mut content)?;\n Ok(content)\n}\n\nfn convert_string_to_u8_array(s: &str) -> [u8; SUPERCALL_SCONTEXT_LEN] {\n let mut u8_array = [0u8; SUPERCALL_SCONTEXT_LEN];\n let bytes = s.as_bytes();\n let len = usize::min(SUPERCALL_SCONTEXT_LEN, bytes.len());\n u8_array[..len].copy_from_slice(&bytes[..len]);\n u8_array\n}\n\nfn convert_superkey(s: &Option) -> Option {\n s.as_ref().and_then(|s| CString::new(s.clone()).ok())\n}\n\npub fn refresh_ap_package_list(skey: &CStr, mutex: &Arc>) {\n let _lock = mutex.lock().unwrap();\n\n if let Err(e) = synchronize_package_uid() {\n error!(\"Failed to synchronize package UIDs: {}\", e);\n }\n\n let package_configs = read_ap_package_config();\n\n let num = sc_su_uid_nums(skey);\n if num < 0 {\n error!(\"[refresh_su_list] Error getting number of UIDs: {}\", num);\n return;\n }\n let num = num as usize;\n let mut uids = vec![0 as uid_t; num];\n let n = sc_su_allow_uids(skey, &mut uids);\n if n < 0 {\n error!(\"[refresh_su_list] Error getting su list\");\n return;\n }\n\n let granted_uids: std::collections::HashSet = package_configs\n .iter()\n .filter(|c| c.allow == 1 && c.exclude == 0)\n .map(|c| c.uid as uid_t)\n .collect();\n\n for uid in &uids {\n if *uid == 0 || *uid == 2000 {\n continue;\n }\n if granted_uids.contains(uid) {\n continue;\n }\n info!(\n \"[refresh_ap_package_list] Revoking {} root permission...\",\n uid\n );\n let rc = sc_su_revoke_uid(skey, *uid);\n if rc != 0 {\n error!(\"[refresh_ap_package_list] Error revoking UID: {}\", rc);\n }\n }\n\n for config in &package_configs {\n if config.allow == 1 && config.exclude == 0 {\n let profile = SuProfile {\n uid: config.uid,\n to_uid: config.to_uid,\n scontext: convert_string_to_u8_array(&config.sctx),\n };\n let result = sc_su_grant_uid(skey, &profile);\n info!(\n \"[refresh_ap_package_list] Loading {}: result = {}\",\n config.pkg, result\n );\n }\n if config.allow == 0 && config.exclude == 1 {\n let result = sc_set_ap_mod_exclude(skey, config.uid as i64, 1);\n info!(\n \"[refresh_ap_package_list] Loading exclude {}: result = {}\",\n config.pkg, result\n );\n }\n }\n}\n\npub fn privilege_apd_profile(superkey: &Option) {\n let key = convert_superkey(superkey);\n\n let all_allow_ctx = \"u:r:magisk:s0\";\n let profile = SuProfile {\n uid: process::id().try_into().expect(\"PID conversion failed\"),\n to_uid: 0,\n scontext: convert_string_to_u8_array(all_allow_ctx),\n };\n if let Some(ref key) = key {\n let result = sc_su(key, &profile);\n info!(\"[privilege_apd_profile] result = {}\", result);\n }\n}\n\npub fn init_load_su_path(superkey: &Option) {\n let su_path_file = \"/data/adb/ap/su_path\";\n\n match read_file_to_string(su_path_file) {\n Ok(su_path) => {\n let superkey_cstr = convert_superkey(superkey);\n\n match superkey_cstr {\n Some(superkey_cstr) => match CString::new(su_path.trim()) {\n Ok(su_path_cstr) => {\n let result = sc_su_reset_path(&superkey_cstr, &su_path_cstr);\n if result == 0 {\n info!(\"suPath load successfully\");\n } else {\n warn!(\"Failed to load su path, error code: {}\", result);\n }\n }\n Err(e) => {\n warn!(\"Failed to convert su_path: {}\", e);\n }\n },\n _ => {\n warn!(\"Superkey is None, skipping...\");\n }\n }\n }\n Err(e) => {\n warn!(\"Failed to read su_path file: {}\", e);\n }\n }\n}\npub fn autoload_kpm_modules(superkey: &Option, event_filter: &str) {\n use serde::Deserialize;\n\n #[derive(Deserialize, Default)]\n struct KpmAutoLoadEntry {\n path: String,\n #[serde(default = \"default_event\")]\n event: String,\n #[serde(default)]\n args: String,\n }\n\n fn default_event() -> String {\n \"service\".to_string()\n }\n\n #[derive(Deserialize, Default)]\n struct KpmAutoLoadConfig {\n enabled: bool,\n #[serde(default, rename = \"kpmEntries\")]\n kpm_entries: Vec,\n }\n\n let config_path = crate::defs::KPM_AUTOLOAD_CONFIG;\n let content = match std::fs::read_to_string(config_path) {\n Ok(c) => c,\n Err(e) => {\n info!(\"[kpm_autoload] config not found or unreadable ({}): {}\", config_path, e);\n return;\n }\n };\n\n let config: KpmAutoLoadConfig = match serde_json::from_str(&content) {\n Ok(c) => c,\n Err(e) => {\n warn!(\"[kpm_autoload] failed to parse config: {}\", e);\n return;\n }\n };\n\n if !config.enabled || config.kpm_entries.is_empty() {\n info!(\"[kpm_autoload] disabled or no entries configured, skipping\");\n return;\n }\n\n let key = convert_superkey(superkey);\n let key = match key {\n Some(k) => k,\n None => {\n warn!(\"[kpm_autoload] no superkey available\");\n return;\n }\n };\n\n const MAX_KPM_MODULES: usize = 64;\n\n if config.kpm_entries.len() > MAX_KPM_MODULES {\n warn!(\n \"[kpm_autoload] too many entries ({}), truncating to {}\",\n config.kpm_entries.len(),\n MAX_KPM_MODULES\n );\n }\n\n let mut success = 0u32;\n let mut fail = 0u32;\n for entry in config.kpm_entries.iter().take(MAX_KPM_MODULES) {\n if entry.event != event_filter {\n info!(\"[kpm_autoload] skipping '{}' (event='{}', expected='{}')\", entry.path, entry.event, event_filter);\n continue;\n }\n\n let path_str = &entry.path;\n\n if !std::path::Path::new(path_str).exists() {\n warn!(\"[kpm_autoload] file not found: {}\", path_str);\n fail += 1;\n continue;\n }\n\n let canonical = match std::fs::canonicalize(path_str) {\n Ok(p) => p,\n Err(e) => {\n warn!(\"[kpm_autoload] cannot canonicalize '{}': {}\", path_str, e);\n fail += 1;\n continue;\n }\n };\n\n let allowed_dir = std::path::Path::new(crate::defs::FP_KPMS_AUTOLOAD_DIR);\n if !canonical.starts_with(allowed_dir) {\n warn!(\n \"[kpm_autoload] path '{}' outside allowed directory '{}', skipping\",\n path_str,\n crate::defs::FP_KPMS_AUTOLOAD_DIR\n );\n fail += 1;\n continue;\n }\n\n let path_cstr = match CString::new(canonical.to_string_lossy().into_owned()) {\n Ok(c) => c,\n Err(e) => {\n warn!(\"[kpm_autoload] invalid canonical path: {}\", e);\n fail += 1;\n continue;\n }\n };\n let args_cstr = match CString::new(entry.args.clone()) {\n Ok(c) => c,\n Err(e) => {\n warn!(\"[kpm_autoload] invalid args for '{}': {}\", path_str, e);\n fail += 1;\n continue;\n }\n };\n info!(\"[kpm_autoload] loading '{}' with event='{}' args='{}'\", path_str, entry.event, entry.args);\n let rc = sc_kpm_load(&key, &path_cstr, &args_cstr);\n if rc == 0 {\n success += 1;\n info!(\"[kpm_autoload] loaded: {}\", path_str);\n } else {\n fail += 1;\n warn!(\"[kpm_autoload] failed to load '{}', rc={}\", path_str, rc);\n }\n }\n info!(\"[kpm_autoload] done: success={}, fail={}\", success, fail);\n}\n\nfn sc_pathhide_enable(key: &CStr, enable: bool) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_ENABLE),\n if enable { 1i64 } else { 0i64 },\n ) as c_long\n }\n}\n\nfn sc_pathhide_add(key: &CStr, path: &CStr) -> c_long {\n if key.to_bytes().is_empty() || path.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_ADD),\n path.as_ptr(),\n ) as c_long\n }\n}\n\nfn sc_pathhide_clear(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_CLEAR),\n ) as c_long\n }\n}\n\nfn sc_pathhide_uid_mode(key: &CStr, enable: bool) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_UID_MODE),\n if enable { 1i64 } else { 0i64 },\n ) as c_long\n }\n}\n\nfn sc_pathhide_filter_system(key: &CStr, enable: bool) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_FILTER_SYSTEM),\n if enable { 1i64 } else { 0i64 },\n ) as c_long\n }\n}\n\nfn sc_pathhide_uid_add(key: &CStr, uid: i32) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_UID_ADD),\n uid,\n ) as c_long\n }\n}\n\nfn sc_pathhide_uid_clear(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_PATHHIDE_UID_CLEAR),\n ) as c_long\n }\n}\n\nfn sc_netisolate_enable(key: &CStr, enable: bool) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_NETISOLATE_ENABLE),\n if enable { 1i64 } else { 0i64 },\n ) as c_long\n }\n}\n\nfn sc_netisolate_uid_add(key: &CStr, uid: i32) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_NETISOLATE_UID_ADD),\n uid,\n ) as c_long\n }\n}\n\nfn sc_netisolate_uid_clear(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_NETISOLATE_UID_CLEAR),\n ) as c_long\n }\n}\n\npub fn apply_netisolate(superkey: &Option) {\n if !std::path::Path::new(crate::defs::NETISOLATE_ENABLE_FILE).exists() {\n info!(\"[netisolate] disabled, skipping\");\n return;\n }\n\n let key = convert_superkey(superkey);\n let key = match key {\n Some(k) => k,\n None => {\n warn!(\"[netisolate] no superkey available\");\n return;\n }\n };\n\n // Step 1: Clear and populate UID blocklist (netisolate not yet enabled)\n match std::fs::read_to_string(crate::defs::NETISOLATE_UIDS_FILE) {\n Ok(uids) => {\n sc_netisolate_uid_clear(&key);\n let mut count = 0u32;\n for uid_str in uids.lines() {\n let uid_str = uid_str.trim();\n if uid_str.is_empty() {\n continue;\n }\n match uid_str.parse::() {\n Ok(uid) => {\n let rc = sc_netisolate_uid_add(&key, uid);\n if rc < 0 {\n warn!(\"[netisolate] add uid {} failed: {}\", uid, rc);\n } else {\n count += 1;\n }\n }\n Err(_) => {\n warn!(\"[netisolate] invalid uid: '{}'\", uid_str);\n }\n }\n }\n info!(\"[netisolate] {} uids restored\", count);\n }\n Err(_) => {\n info!(\"[netisolate] no uids file\");\n }\n }\n\n // Step 2: Enable netisolate LAST\n let rc = sc_netisolate_enable(&key, true);\n if rc < 0 {\n warn!(\"[netisolate] enable failed: {}\", rc);\n return;\n }\n\n info!(\"[netisolate] auto-apply completed\");\n}\n\npub fn apply_pathhide(superkey: &Option) {\n if !std::path::Path::new(crate::defs::PATHHIDE_ENABLE_FILE).exists() {\n info!(\"[pathhide] disabled, skipping\");\n return;\n }\n\n let key = convert_superkey(superkey);\n let key = match key {\n Some(k) => k,\n None => {\n warn!(\"[pathhide] no superkey available\");\n return;\n }\n };\n\n // Step 1: Clear and populate blocklist (pathhide not yet enabled, hooks are no-ops)\n match std::fs::read_to_string(crate::defs::PATHHIDE_PATHS_FILE) {\n Ok(paths) => {\n sc_pathhide_clear(&key);\n let mut count = 0u32;\n for path in paths.lines() {\n let path = path.trim();\n if path.is_empty() {\n continue;\n }\n match CString::new(path) {\n Ok(path_cstr) => {\n let rc = sc_pathhide_add(&key, &path_cstr);\n if rc < 0 {\n warn!(\"[pathhide] add path '{}' failed: {}\", path, rc);\n } else {\n count += 1;\n }\n }\n Err(e) => {\n warn!(\"[pathhide] invalid path '{}': {}\", path, e);\n }\n }\n }\n info!(\"[pathhide] {} paths restored\", count);\n }\n Err(_) => {\n info!(\"[pathhide] no paths file, clearing blocklist\");\n sc_pathhide_clear(&key);\n }\n }\n\n // Step 2: Configure UID whitelist BEFORE enabling (so filters are ready)\n if std::path::Path::new(crate::defs::PATHHIDE_UID_MODE_FILE).exists() {\n match std::fs::read_to_string(crate::defs::PATHHIDE_UIDS_FILE) {\n Ok(uids) => {\n sc_pathhide_uid_clear(&key);\n let mut count = 0u32;\n for uid_str in uids.lines() {\n let uid_str = uid_str.trim();\n if uid_str.is_empty() {\n continue;\n }\n match uid_str.parse::() {\n Ok(uid) => {\n let rc = sc_pathhide_uid_add(&key, uid);\n if rc < 0 {\n warn!(\"[pathhide] add uid {} failed: {}\", uid, rc);\n } else {\n count += 1;\n }\n }\n Err(_) => {\n warn!(\"[pathhide] invalid uid: '{}'\", uid_str);\n }\n }\n }\n info!(\"[pathhide] {} uids restored\", count);\n }\n Err(_) => {\n info!(\"[pathhide] no uids file\");\n }\n }\n\n let rc = sc_pathhide_uid_mode(&key, true);\n if rc < 0 {\n warn!(\"[pathhide] uid mode enable failed: {}\", rc);\n }\n }\n\n // Step 2.5: Configure filter_system (allow hiding from system/root UIDs)\n if std::path::Path::new(crate::defs::PATHHIDE_FILTER_SYSTEM_FILE).exists() {\n let rc = sc_pathhide_filter_system(&key, true);\n if rc < 0 {\n warn!(\"[pathhide] filter_system enable failed: {}\", rc);\n }\n }\n\n // Step 3: Enable pathhide LAST (all config is now in place)\n let rc = sc_pathhide_enable(&key, true);\n if rc < 0 {\n warn!(\"[pathhide] enable failed: {}\", rc);\n return;\n }\n\n info!(\"[pathhide] auto-apply completed\");\n}\n\nfn sc_uts_set(key: &CStr, release: Option<&CStr>, version: Option<&CStr>) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n let release_ptr = match release {\n Some(r) => r.as_ptr(),\n None => std::ptr::null(),\n };\n let version_ptr = match version {\n Some(v) => v.as_ptr(),\n None => std::ptr::null(),\n };\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_UTS_SET),\n release_ptr,\n version_ptr,\n ) as c_long\n }\n}\n\nfn sc_uts_reset(key: &CStr) -> c_long {\n if key.to_bytes().is_empty() {\n return (-EINVAL).into();\n }\n unsafe {\n syscall(\n __NR_SUPERCALL,\n key.as_ptr(),\n ver_and_cmd(SUPERCALL_UTS_RESET),\n ) as c_long\n }\n}\n\npub fn apply_uts_spoof(superkey: &Option) {\n use std::path::Path;\n\n const MAX_BOOT_RETRIES: u32 = 3;\n\n if !Path::new(crate::defs::UTS_SPOOF_ENABLE_FILE).exists() {\n info!(\"[uts_spoof] disabled, skipping\");\n return;\n }\n\n let config_content = match std::fs::read_to_string(crate::defs::UTS_SPOOF_CONFIG_FILE) {\n Ok(c) => c,\n Err(e) => {\n warn!(\"[uts_spoof] failed to read config: {}\", e);\n return;\n }\n };\n\n let config: serde_json::Value = match serde_json::from_str(&config_content) {\n Ok(v) => v,\n Err(e) => {\n warn!(\"[uts_spoof] failed to parse config: {}\", e);\n return;\n }\n };\n\n let release = config.get(\"release\").and_then(|v| v.as_str()).unwrap_or(\"\");\n let version = config.get(\"version\").and_then(|v| v.as_str()).unwrap_or(\"\");\n\n let key = convert_superkey(superkey);\n let key = match key {\n Some(k) => k,\n None => {\n warn!(\"[uts_spoof] no superkey available\");\n return;\n }\n };\n\n let _ = sc_uts_reset(&key);\n\n let retries = match std::fs::read_to_string(crate::defs::UTS_SPOOF_BOOT_PENDING) {\n Ok(s) => s.trim().parse::().unwrap_or(0),\n Err(_) => 0,\n };\n\n if retries >= MAX_BOOT_RETRIES {\n warn!(\n \"[uts_spoof] boot pending retries ({}) >= max ({}), skipping spoof to prevent bootloop\",\n retries, MAX_BOOT_RETRIES\n );\n let _ = std::fs::remove_file(crate::defs::UTS_SPOOF_BOOT_PENDING);\n return;\n }\n\n if let Err(e) = std::fs::write(crate::defs::UTS_SPOOF_BOOT_PENDING, (retries + 1).to_string()) {\n warn!(\"[uts_spoof] failed to write boot pending flag: {}\", e);\n }\n\n // Only set if we have values to spoof\n let release_cstr = if !release.is_empty() {\n match CString::new(release) {\n Ok(c) => Some(c),\n Err(e) => {\n warn!(\"[uts_spoof] invalid release string: {}\", e);\n None\n }\n }\n } else {\n None\n };\n let version_cstr = if !version.is_empty() {\n match CString::new(version) {\n Ok(c) => Some(c),\n Err(e) => {\n warn!(\"[uts_spoof] invalid version string: {}\", e);\n None\n }\n }\n } else {\n None\n };\n\n if release_cstr.is_some() || version_cstr.is_some() {\n let rc = sc_uts_set(\n &key,\n release_cstr.as_deref(),\n version_cstr.as_deref(),\n );\n if rc == 0 {\n info!(\"[uts_spoof] applied: release='{}' version='{}'\", release, version);\n } else {\n warn!(\"[uts_spoof] set failed: {}\", rc);\n }\n } else {\n info!(\"[uts_spoof] config has empty values, skipping set\");\n }\n}\n"
},
{
"path": "apd/src/utils.rs",
"content": "#[allow(unused_imports)]\nuse std::fs::{Permissions, set_permissions};\n#[cfg(unix)]\nuse std::os::unix::prelude::PermissionsExt;\nuse std::{\n ffi::CString,\n fs::{File, OpenOptions, create_dir_all, metadata},\n io::{ErrorKind::AlreadyExists, Write},\n path::Path,\n process::{Command, Stdio},\n};\n\nuse anyhow::{Context, Error, Ok, Result, bail};\nuse log::{info, warn};\n\nuse crate::{defs, supercall::sc_su_get_safemode};\n\npub fn ensure_file_exists>(file: T) -> Result<()> {\n match File::options().write(true).create_new(true).open(&file) {\n Result::Ok(_) => Ok(()),\n Err(err) => {\n if err.kind() == AlreadyExists && file.as_ref().is_file() {\n Ok(())\n } else {\n Err(Error::from(err))\n .with_context(|| format!(\"{} is not a regular file\", file.as_ref().display()))\n }\n }\n }\n}\n\npub fn ensure_dir_exists>(dir: T) -> Result<()> {\n let result = create_dir_all(&dir).map_err(Error::from);\n if dir.as_ref().is_dir() {\n result\n } else if result.is_ok() {\n bail!(\"{} is not a regular directory\", dir.as_ref().display())\n } else {\n result\n }\n}\n\npub fn ensure_dir_with_perms(dir: &Path, parent: &Path, mode: u32) -> Result<()> {\n if dir.exists() {\n return Ok(());\n }\n create_dir_all(dir)\n .with_context(|| format!(\"Failed to create {} directory\", dir.display()))?;\n let permissions = Permissions::from_mode(mode);\n set_permissions(parent, permissions.clone())\n .with_context(|| format!(\"Failed to set permissions for {}\", parent.display()))?;\n set_permissions(dir, permissions)\n .with_context(|| format!(\"Failed to set permissions for {}\", dir.display()))?;\n info!(\"Created directory: {}\", dir.display());\n Ok(())\n}\n\n// todo: ensure\npub fn ensure_binary>(path: T) -> Result<()> {\n set_permissions(&path, Permissions::from_mode(0o755))?;\n Ok(())\n}\n\npub fn get_work_dir() -> &'static str {\n defs::WORKING_DIR\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn getprop(prop: &str) -> Option {\n android_properties::getprop(prop).value()\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn getprop(_prop: &str) -> Option {\n unimplemented!()\n}\npub fn run_command(\n command: &str,\n args: &[&str],\n stdout: Option,\n) -> Result {\n let mut command_builder = Command::new(command);\n command_builder.args(args);\n if let Some(out) = stdout {\n command_builder.stdout(out);\n }\n let child = command_builder.spawn()?;\n Ok(child)\n}\npub fn is_safe_mode(superkey: Option) -> bool {\n let safemode = getprop(\"persist.sys.safemode\")\n .filter(|prop| prop == \"1\")\n .is_some()\n || getprop(\"ro.sys.safemode\")\n .filter(|prop| prop == \"1\")\n .is_some();\n info!(\"safemode: {}\", safemode);\n if safemode {\n return true;\n }\n let safemode = superkey\n .as_ref()\n .and_then(|key_str| CString::new(key_str.as_str()).ok())\n .map_or_else(\n || {\n warn!(\"[is_safe_mode] No valid superkey provided, assuming safemode as false.\");\n false\n },\n |cstr| sc_su_get_safemode(&cstr) == 1,\n );\n info!(\"kernel_safemode: {}\", safemode);\n safemode\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn switch_mnt_ns(pid: i32) -> Result<()> {\n use std::os::fd::AsRawFd;\n\n use anyhow::ensure;\n let path = format!(\"/proc/{pid}/ns/mnt\");\n let fd = File::open(path)?;\n let current_dir = std::env::current_dir();\n let ret = unsafe { libc::setns(fd.as_raw_fd(), libc::CLONE_NEWNS) };\n if let Result::Ok(current_dir) = current_dir {\n let _ = std::env::set_current_dir(current_dir);\n }\n ensure!(ret == 0, \"switch mnt ns failed\");\n Ok(())\n}\n\nfn switch_cgroup(grp: &str, pid: u32) {\n let path = Path::new(grp).join(\"cgroup.procs\");\n if !path.exists() {\n return;\n }\n\n let fp = OpenOptions::new().append(true).open(path);\n if let Result::Ok(mut fp) = fp {\n let _ = write!(fp, \"{pid}\");\n }\n}\n\npub fn switch_cgroups() {\n let pid = std::process::id();\n switch_cgroup(\"/acct\", pid);\n switch_cgroup(\"/dev/cg2_bpf\", pid);\n switch_cgroup(\"/sys/fs/cgroup\", pid);\n\n if getprop(\"ro.config.per_app_memcg\")\n .filter(|prop| prop == \"false\")\n .is_none()\n {\n switch_cgroup(\"/dev/memcg/apps\", pid);\n }\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"android\"))]\npub fn umask(mask: u32) {\n unsafe { libc::umask(mask) };\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"android\")))]\npub fn umask(_mask: u32) {\n unimplemented!(\"umask is not supported on this platform\")\n}\n\npub fn has_magisk() -> bool {\n which::which(\"magisk\").is_ok()\n}\npub fn get_tmp_path() -> &'static str {\n if metadata(defs::TEMP_DIR_LEGACY).is_ok() {\n return defs::TEMP_DIR_LEGACY;\n }\n if metadata(defs::TEMP_DIR).is_ok() {\n return defs::TEMP_DIR;\n }\n \"\"\n}\n"
},
{
"path": "app/.gitignore",
"content": "/build\n/release/\n*.jks\n*.keystore\nkeystore.properties\n"
},
{
"path": "app/build.gradle.kts",
"content": "@file:Suppress(\"UnstableApiUsage\")\n\nimport com.android.build.gradle.tasks.PackageAndroidArtifact\nimport org.jetbrains.kotlin.gradle.dsl.JvmTarget\nimport java.net.URI\nimport java.util.Properties\nimport java.io.File\nimport java.io.FileInputStream\n\nplugins {\n alias(libs.plugins.agp.app)\n alias(libs.plugins.kotlin)\n alias(libs.plugins.kotlin.compose.compiler)\n alias(libs.plugins.ksp)\n alias(libs.plugins.lsplugin.apksign)\n alias(libs.plugins.lsplugin.resopt)\n alias(libs.plugins.lsplugin.cmaker)\n id(\"kotlin-parcelize\")\n}\n\nval androidCompileSdkVersion: Int by rootProject.extra\nval androidCompileNdkVersion: String by rootProject.extra\nval androidBuildToolsVersion: String by rootProject.extra\nval androidMinSdkVersion: Int by rootProject.extra\nval androidTargetSdkVersion: Int by rootProject.extra\nval androidSourceCompatibility: JavaVersion by rootProject.extra\nval androidTargetCompatibility: JavaVersion by rootProject.extra\nval managerVersionCode: Int by rootProject.extra\nval managerVersionName: String by rootProject.extra\nval branchName: String by rootProject.extra\nval kernelPatchVersion: String by rootProject.extra\n\n// Load keystore properties\nval keystoreProperties = Properties()\nval keystorePropertiesFile = rootProject.file(\"keystore.properties\")\nif (keystorePropertiesFile.exists()) {\n keystoreProperties.load(FileInputStream(keystorePropertiesFile))\n}\n\n// Load local properties\nval localProperties = Properties()\nval localPropertiesFile = rootProject.file(\"local.properties\")\nif (localPropertiesFile.exists()) {\n localProperties.load(FileInputStream(localPropertiesFile))\n}\n\napksign {\n storeFileProperty = \"KEYSTORE_FILE\"\n storePasswordProperty = \"KEYSTORE_PASSWORD\"\n keyAliasProperty = \"KEY_ALIAS\"\n keyPasswordProperty = \"KEY_PASSWORD\"\n}\n\nval ccache = System.getenv(\"PATH\")?.split(File.pathSeparator)\n ?.map { File(it, \"ccache\") }?.firstOrNull { it.exists() }?.absolutePath\n\nval baseFlags = listOf(\n \"-Wall\", \"-Qunused-arguments\", \"-fno-rtti\", \"-fvisibility=hidden\",\n \"-fvisibility-inlines-hidden\", \"-fno-exceptions\", \"-fno-stack-protector\",\n \"-fomit-frame-pointer\", \"-Wno-builtin-macro-redefined\", \"-Wno-unused-value\",\n \"-D__FILE__=__FILE_NAME__\",\n \"-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON\", \"-Wno-unused\", \"-Wno-unused-parameter\",\n \"-Wno-unused-command-line-argument\", \"-Wno-incompatible-function-pointer-types\",\n \"-U_FORTIFY_SOURCE\", \"-D_FORTIFY_SOURCE=0\"\n)\n\nval baseArgs = mutableListOf(\n \"-DANDROID_STL=none\", \"-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON\",\n \"-DCMAKE_CXX_STANDARD=23\", \"-DCMAKE_C_STANDARD=23\",\n \"-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON\", \"-DCMAKE_VISIBILITY_INLINES_HIDDEN=ON\",\n \"-DCMAKE_CXX_VISIBILITY_PRESET=hidden\", \"-DCMAKE_C_VISIBILITY_PRESET=hidden\"\n).apply { if (ccache != null) add(\"-DANDROID_CCACHE=$ccache\") }\n\nandroid {\n namespace = \"me.bmax.apatch\"\n signingConfigs {\n create(\"release\") {\n storeFile = file(keystoreProperties.getProperty(\"KEYSTORE_FILE\") ?: \"debug.keystore\")\n storePassword = keystoreProperties.getProperty(\"KEYSTORE_PASSWORD\") ?: \"android\"\n keyAlias = keystoreProperties.getProperty(\"KEY_ALIAS\") ?: \"androiddebugkey\"\n keyPassword = keystoreProperties.getProperty(\"KEY_PASSWORD\") ?: \"android\"\n enableV1Signing = true\n enableV2Signing = true\n enableV3Signing = true\n enableV4Signing = true\n }\n }\n\n buildTypes {\n debug {\n isDebuggable = true\n isMinifyEnabled = false\n isShrinkResources = false\n proguardFiles(\n getDefaultProguardFile(\"proguard-android-optimize.txt\"),\n \"proguard-rules.pro\"\n )\n externalNativeBuild {\n cmake {\n arguments += listOf(\"-DCMAKE_CXX_FLAGS_DEBUG=-Og\", \"-DCMAKE_C_FLAGS_DEBUG=-Og\")\n }\n }\n }\n release {\n isMinifyEnabled = true\n isShrinkResources = true\n isDebuggable = false\n multiDexEnabled = true\n vcsInfo.include = false\n if (keystorePropertiesFile.exists()) {\n signingConfig = signingConfigs.getByName(\"release\")\n }\n proguardFiles(\n getDefaultProguardFile(\"proguard-android-optimize.txt\"),\n \"proguard-rules.pro\"\n )\n externalNativeBuild {\n cmake {\n val relFlags = listOf(\n \"-flto\", \"-ffunction-sections\", \"-fdata-sections\", \"-Wl,--gc-sections\",\n \"-fno-unwind-tables\", \"-fno-asynchronous-unwind-tables\", \"-Wl,--exclude-libs,ALL\",\n \"-Ofast\", \"-fmerge-all-constants\", \"-flto=full\", \"-ffat-lto-objects\",\n \"-fno-semantic-interposition\", \"-fno-threadsafe-statics\"\n )\n cppFlags += relFlags\n cFlags += relFlags\n arguments += listOf(\"-DCMAKE_BUILD_TYPE=Release\", \"-DCMAKE_CXX_FLAGS_RELEASE=-O3 -DNDEBUG\", \"-DCMAKE_C_FLAGS_RELEASE=-O3 -DNDEBUG\")\n }\n }\n }\n }\n\n dependenciesInfo.includeInApk = false\n\n buildFeatures {\n aidl = true\n buildConfig = true\n compose = true\n prefab = true\n }\n\n defaultConfig {\n applicationId = \"me.yuki.folk\"\n minSdk = androidMinSdkVersion\n targetSdk = androidTargetSdkVersion\n versionCode = managerVersionCode\n versionName = managerVersionName\n buildConfigField(\"String\", \"buildKPV\", \"\\\"$kernelPatchVersion\\\"\")\n buildConfigField(\"boolean\", \"DEBUG_FAKE_ROOT\", localProperties.getProperty(\"debug.fake_root\", \"false\"))\n\n base.archivesName = \"FolkPatch_${managerVersionCode}_${managerVersionName}_on_${branchName}\"\n\n ndk.abiFilters.addAll(arrayOf(\"arm64-v8a\"))\n externalNativeBuild {\n cmake {\n cppFlags += baseFlags + \"-std=c++2b\"\n cFlags += baseFlags + \"-std=c2x\"\n arguments += baseArgs\n \n // Pass Token and Signature Hash to CMake\n val authProps = Properties()\n val authFile = rootProject.file(\"auth.properties\")\n if (authFile.exists()) {\n authProps.load(FileInputStream(authFile))\n }\n val token = authProps.getProperty(\"api.token\", \"\")\n val signatureHash = authProps.getProperty(\"app.signature.hash\", \"\")\n\n // Pass to C++ compiler directly via flags\n // Only add flags if values are non-empty to avoid compiler errors\n if (token.isNotEmpty()) {\n cppFlags += \"-DAPI_TOKEN=\\\"$token\\\"\"\n }\n if (signatureHash.isNotEmpty()) {\n cppFlags += \"-DAPP_SIGNATURE_HASH=\\\"$signatureHash\\\"\"\n }\n cppFlags += \"-DAPP_PACKAGE_NAME=\\\"$applicationId\\\"\"\n \n abiFilters(\"arm64-v8a\")\n }\n }\n \n }\n\n compileOptions {\n sourceCompatibility = JavaVersion.VERSION_21\n targetCompatibility = JavaVersion.VERSION_21\n }\n\n packaging {\n jniLibs {\n useLegacyPackaging = true\n }\n resources {\n excludes += \"**\"\n merges += \"META-INF/com/google/android/**\"\n }\n }\n\n externalNativeBuild {\n cmake {\n version = \"3.28.0+\"\n path(\"src/main/cpp/CMakeLists.txt\")\n }\n }\n\n androidResources {\n generateLocaleConfig = true\n }\n\n compileSdk = androidCompileSdkVersion\n ndkVersion = androidCompileNdkVersion\n buildToolsVersion = androidBuildToolsVersion\n\n lint {\n abortOnError = false\n checkReleaseBuilds = false\n }\n\n android.sourceSets.named(\"main\") {\n kotlin.directories += \"build/generated/ksp/$name/kotlin\"\n jniLibs.directories += \"libs\"\n }\n}\n\n// https://stackoverflow.com/a/77745844\ntasks.withType {\n doFirst { appMetadata.asFile.orNull?.writeText(\"\") }\n}\n\njava {\n toolchain {\n languageVersion = JavaLanguageVersion.of(21)\n }\n}\n\nkotlin {\n jvmToolchain(21)\n compilerOptions {\n jvmTarget = JvmTarget.JVM_21\n }\n}\n\nfun registerDownloadTask(\n taskName: String, srcUrl: String, destPath: String, project: Project, version: String? = null\n) {\n project.tasks.register(taskName) {\n val destFile = File(destPath)\n val versionFile = File(\"$destPath.version\")\n\n doLast {\n var forceDownload = false\n if (version != null) {\n if (!versionFile.exists() || versionFile.readText().trim() != version) {\n forceDownload = true\n }\n }\n\n if (!destFile.exists() || forceDownload || isFileUpdated(srcUrl, destFile)) {\n println(\" - Downloading $srcUrl to ${destFile.absolutePath}\")\n downloadFile(srcUrl, destFile)\n if (version != null) {\n versionFile.writeText(version)\n }\n println(\" - Download completed.\")\n } else {\n println(\" - File is up-to-date, skipping download.\")\n }\n }\n }\n}\n\nfun isFileUpdated(url: String, localFile: File): Boolean {\n val connection = URI.create(url).toURL().openConnection()\n val remoteLastModified = connection.getHeaderFieldDate(\"Last-Modified\", 0L)\n return remoteLastModified > localFile.lastModified()\n}\n\nfun downloadFile(url: String, destFile: File) {\n URI.create(url).toURL().openStream().use { input ->\n destFile.outputStream().use { output ->\n input.copyTo(output)\n }\n }\n}\n\nregisterDownloadTask(\n taskName = \"downloadKpimg\",\n srcUrl = \"https://github.com/LyraVoid/KernelPatch/releases/download/$kernelPatchVersion/kpimg-android\",\n destPath = \"${project.projectDir}/src/main/assets/kpimg\",\n project = project,\n version = kernelPatchVersion\n)\n\nregisterDownloadTask(\n taskName = \"downloadKptools\",\n srcUrl = \"https://github.com/LyraVoid/KernelPatch/releases/download/$kernelPatchVersion/kptools-android\",\n destPath = \"${project.projectDir}/libs/arm64-v8a/libkptools.so\",\n project = project,\n version = kernelPatchVersion\n)\n\n// Compat kp version less than 0.10.7\n// TODO: Remove in future\nregisterDownloadTask(\n taskName = \"downloadCompatKpatch\",\n srcUrl = \"https://github.com/bmax121/KernelPatch/releases/download/0.10.7/kpatch-android\",\n destPath = \"${project.projectDir}/libs/arm64-v8a/libkpatch.so\",\n project = project,\n version = \"0.10.7\"\n)\n\ntasks.register(\"mergeScripts\") {\n into(\"${project.projectDir}/src/main/resources/META-INF/com/google/android\")\n from(rootProject.file(\"${project.rootDir}/scripts/update_binary.sh\")) {\n rename { \"update-binary\" }\n }\n from(rootProject.file(\"${project.rootDir}/scripts/update_script.sh\")) {\n rename { \"updater-script\" }\n }\n}\n\n// Build fpd (FolkPatch service binary) for arm64\ntasks.register(\"buildFpd\") {\n executable(\"cargo\")\n args(\"ndk\", \"-t\", \"arm64-v8a\", \"build\", \"--release\")\n workingDir(\"${project.rootDir}/fpd\")\n doFirst {\n println(\"Building fpd for arm64...\")\n }\n doLast {\n val fpdBinary = file(\"${project.rootDir}/fpd/target/aarch64-linux-android/release/fpd\")\n val serviceDir = file(\"src/main/assets/Service\")\n serviceDir.mkdirs()\n fpdBinary.copyTo(file(\"${serviceDir}/fpd\"), overwrite = true)\n println(\"fpd binary built and copied to Service/fpd\")\n }\n}\n\ntasks.getByName(\"preBuild\").dependsOn(\n \"downloadKpimg\",\n \"downloadKptools\",\n \"downloadCompatKpatch\",\n \"mergeScripts\",\n \"buildFpd\",\n)\n\n// https://github.com/bbqsrc/cargo-ndk\n// cargo ndk -t arm64-v8a build --release\ntasks.register(\"cargoBuild\") {\n executable(\"cargo\")\n args(\"ndk\", \"-t\", \"arm64-v8a\", \"build\", \"--release\")\n workingDir(\"${project.rootDir}/apd\")\n environment(\"APATCH_VERSION_CODE\", \"${managerVersionCode}\")\n environment(\"APATCH_VERSION_NAME\", \"${managerVersionCode}-Matsuzaka-yuki\")\n}\n\ntasks.register(\"buildApd\") {\n dependsOn(\"cargoBuild\")\n from(\"${project.rootDir}/apd/target/aarch64-linux-android/release/apd\")\n into(\"${project.projectDir}/libs/arm64-v8a\")\n rename(\"apd\", \"libapd.so\")\n}\n\ntasks.configureEach {\n if (name == \"mergeDebugJniLibFolders\" || name == \"mergeReleaseJniLibFolders\") {\n dependsOn(\"buildApd\")\n }\n}\n\ntasks.register(\"cargoClean\") {\n executable(\"cargo\")\n args(\"clean\")\n workingDir(\"${project.rootDir}/apd\")\n}\n\ntasks.register(\"apdClean\") {\n dependsOn(\"cargoClean\")\n delete(file(\"${project.projectDir}/libs/arm64-v8a/libapd.so\"))\n}\n\ntasks.clean {\n dependsOn(\"apdClean\")\n}\n\nksp {\n arg(\"compose-destinations.defaultTransitions\", \"none\")\n}\n\ndependencies {\n implementation(libs.androidx.appcompat)\n implementation(libs.androidx.activity.compose)\n implementation(libs.androidx.core.splashscreen)\n implementation(libs.androidx.webkit)\n implementation(libs.androidx.biometric)\n\n implementation(platform(libs.androidx.compose.bom))\n implementation(libs.androidx.compose.material.icons.extended)\n implementation(libs.androidx.compose.material)\n implementation(libs.androidx.compose.material3)\n\n implementation(\"androidx.compose.material3:material3-android:1.5.0-alpha17\")\n implementation(libs.androidx.compose.ui)\n implementation(libs.androidx.compose.ui.tooling.preview)\n implementation(libs.androidx.compose.runtime.livedata)\n\n debugImplementation(libs.androidx.compose.ui.test.manifest)\n debugImplementation(libs.androidx.compose.ui.tooling)\n\n implementation(libs.androidx.lifecycle.runtime.compose)\n implementation(libs.androidx.lifecycle.runtime.ktx)\n implementation(libs.androidx.lifecycle.viewmodel.compose)\n implementation(\"androidx.lifecycle:lifecycle-process:2.8.7\")\n\n implementation(libs.compose.destinations.core)\n ksp(libs.compose.destinations.ksp)\n\n implementation(libs.com.github.topjohnwu.libsu.core)\n implementation(libs.com.github.topjohnwu.libsu.service)\n implementation(libs.com.github.topjohnwu.libsu.nio)\n implementation(libs.com.github.topjohnwu.libsu.io)\n\n implementation(libs.dev.rikka.rikkax.parcelablelist)\n\n implementation(libs.io.coil.kt.coil.compose)\n implementation(libs.io.coil.kt.coil.gif)\n\n implementation(libs.kotlinx.coroutines.core)\n\n implementation(libs.me.zhanghai.android.appiconloader.coil)\n\n implementation(libs.sheet.compose.dialogs.core)\n implementation(libs.sheet.compose.dialogs.list)\n implementation(libs.sheet.compose.dialogs.input)\n\n implementation(libs.markdown)\n\n implementation(libs.ini4j)\n\n implementation(libs.google.code.gson)\n\n implementation(libs.liquid)\n\n compileOnly(libs.cxx)\n}\n"
},
{
"path": "app/libs/arm64-v8a/.gitignore",
"content": "libkptools.so\nlibapjni.so\nlibkpatch.so\nlibapd.so"
},
{
"path": "app/libs/arm64-v8a/libkpatch.so.version",
"content": "0.10.7"
},
{
"path": "app/libs/arm64-v8a/libkptools.so.version",
"content": "0.13.1"
},
{
"path": "app/proguard-rules.pro",
"content": "-dontwarn org.bouncycastle.jsse.BCSSLParameters\n-dontwarn org.bouncycastle.jsse.BCSSLSocket\n-dontwarn org.bouncycastle.jsse.provider.BouncyCastleJsseProvider\n-dontwarn org.conscrypt.Conscrypt$Version\n-dontwarn org.conscrypt.Conscrypt\n-dontwarn org.conscrypt.ConscryptHostnameVerifier\n-dontwarn org.openjsse.javax.net.ssl.SSLParameters\n-dontwarn org.openjsse.javax.net.ssl.SSLSocket\n-dontwarn org.openjsse.net.ssl.OpenJSSE\n-dontwarn java.beans.Introspector\n-dontwarn java.beans.VetoableChangeListener\n-dontwarn java.beans.VetoableChangeSupport\n-dontwarn java.beans.BeanInfo\n-dontwarn java.beans.IntrospectionException\n-dontwarn java.beans.PropertyDescriptor\n\n# Keep ini4j Service Provider Interface\n-keep,allowobfuscation,allowoptimization class org.ini4j.spi.** { *; }\n\n# Keep native methods and JNI classes\n-keep class me.bmax.apatch.Natives {\n *;\n}\n\n-keepclasseswithmembernames class * {\n native ;\n}\n\n-keep class me.bmax.apatch.Natives$Profile { *; }\n-keep class me.bmax.apatch.Natives$KPMCtlRes { *; }\n\n# Keep RootServices\n-keep class me.bmax.apatch.services.RootServices { *; }\n\n# Keep AIDL interfaces\n-keep class me.bmax.apatch.IAPRootService { *; }\n-keep class me.bmax.apatch.IAPRootService$Stub { *; }\n-keep class rikka.parcelablelist.ParcelableListSlice { *; }\n# Keep ScriptInfo for Gson serialization in release\n-keep class me.bmax.apatch.data.ScriptInfo { *; }\n-keepclassmembers class me.bmax.apatch.data.ScriptInfo { *; }\n\n# Gson\n-keepattributes Signature\n-keepattributes *Annotation*\n-keep class sun.misc.Unsafe { *; }\n-keep class com.google.gson.** { *; }\n-keep class * extends com.google.gson.reflect.TypeToken\n\n# Kotlin\n-assumenosideeffects class kotlin.jvm.internal.Intrinsics {\n public static void check*(...);\n public static void throw*(...);\n}\n\n# Keep Umount configuration classes\n-keep class me.bmax.apatch.ui.component.UmountConfig { *; }\n-keep class me.bmax.apatch.ui.component.UmountConfigManager { *; }\n-keep class me.bmax.apatch.ui.screen.UmountConfigScreen { *; }\n\n-keepclassmembers class me.bmax.apatch.ui.component.UmountConfigManager {\n public static *;\n}\n\n-keepclassmembers class me.bmax.apatch.ui.component.UmountConfig {\n public (boolean, java.lang.String);\n}\n\n# Keep Umount destination\n-keep class me.bmax.apatch.ui.screen.destinations.UmountConfigScreenDestination { *; }\n\n-repackageclasses\n-allowaccessmodification\n-overloadaggressively\n-renamesourcefileattribute SourceFile\n"
},
{
"path": "app/src/main/AndroidManifest.xml",
"content": "\n\n\n \n \n \n \n \n \n \n \n\n \n\n \n\n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n\n \n \n \n \n \n \n\n \n \n \n \n \n \n\n \n \n \n \n \n \n\n \n\n \n\n \n \n \n\n \n\n \n \n \n\n \n\n\n"
},
{
"path": "app/src/main/aidl/me/bmax/apatch/IAPRootService.aidl",
"content": "// IAPRootService.aidl\npackage me.bmax.apatch;\n\nimport android.content.pm.PackageInfo;\nimport rikka.parcelablelist.ParcelableListSlice;\n\ninterface IAPRootService {\n ParcelableListSlice getPackages(int flags);\n}"
},
{
"path": "app/src/main/assets/.gitignore",
"content": "kpimg\n*.kpm"
},
{
"path": "app/src/main/assets/InstallAP.sh",
"content": "#!/bin/sh\n# By SakuraKyuo\n\nOUTFD=/proc/self/fd/$2\n\nfunction ui_print() {\n echo -e \"ui_print $1\\nui_print\" >> $OUTFD\n}\n\nfunction ui_printfile() {\n while IFS='' read -r line || $BB [[ -n \"$line\" ]]; do\n ui_print \"$line\";\n done < $1;\n}\n\nfunction kernelFlagsErr(){\n\tui_print \"- Installation has Aborted!\"\n\tui_print \"- APatch requires CONFIG_KALLSYMS to be Enabled.\"\n\tui_print \"- But your kernel seems NOT enabled it.\"\n\texit\n}\n\nfunction apatchNote(){\n\tui_print \"- APatch Patch Done\"\n\tui_print \"- APatch Key is: Ap$skey\"\n\tui_print \"- We do have saved Origin Boot image to /data\"\n\tui_print \"- If you encounter bootloop, reboot into Recovery and flash it\"\n\texit\n}\n\nfunction failed(){\n\tui_printfile /dev/tmp/install/log\n\tui_print \"- APatch Patch Failed.\"\n\tui_print \"- Please feedback to the developer with the screenshots.\"\n\texit\n}\n\nfunction boot_execute_ab(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tif [[ ! $(./lib/arm64-v8a/libkptools.so -i ./kernel -f | grep CONFIG_KALLSYMS=y) ]]; then\n\t\tkernelFlagsErr\n\tfi\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -p --image kernel-origin --skey \"Ap$skey\" --kpimg ./assets/kpimg --out ./kernel 2>&1 | tee /dev/tmp/install/log\n\tif [[ ! $(cat /dev/tmp/install/log | grep \"patch done\") ]]; then\n\t\tfailed\n\tfi\n\tui_printfile /dev/tmp/install/log\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot\n\tmv boot.img /data/boot.img\n\tapatchNote\n}\n\nfunction boot_execute(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tif [[ ! $(./lib/arm64-v8a/libkptools.so -i ./kernel -f | grep CONFIG_KALLSYMS=y) ]]; then\n\t\tkernelFlagsErr\n\tfi\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -p --image kernel-origin --skey \"Ap$skey\" --kpimg ./assets/kpimg --out ./kernel 2>&1 | tee /dev/tmp/install/log\n\tif [[ ! $(cat /dev/tmp/install/log | grep \"patch done\") ]]; then\n\t\tfailed\n\tfi\n\tui_printfile /dev/tmp/install/log\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot\n\tmv boot.img /data/boot.img\n\tapatchNote\n}\n\nfunction main(){\n\ncd /dev/tmp/install\n\nchmod a+x ./assets/kpimg\nchmod a+x ./lib/arm64-v8a/libkptools.so\n\nslot=$(getprop ro.boot.slot_suffix)\n\nskey=$(cat /proc/sys/kernel/random/uuid | cut -d \\- -f1)\n\nif [[ ! \"$slot\" == \"\" ]]; then\n\n\tui_print \"\"\n\tui_print \"- You are using A/B device.\"\n\n\t# Script author\n\tui_print \"- Install Script by SakuraKyuo\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot$slot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute_ab\n\tfi\n\nelse\n\n\tui_print \"You are using A Only device.\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute\n\tfi\n\nfi\n\n}\n\nmain\n"
},
{
"path": "app/src/main/assets/UninstallAP.sh",
"content": "#!/bin/sh\n# By SakuraKyuo\n\nOUTFD=/proc/self/fd/$2\n\nfunction ui_print() {\n echo -e \"ui_print $1\\nui_print\" >> $OUTFD\n}\n\nfunction ui_printfile() {\n while IFS='' read -r line || $BB [[ -n \"$line\" ]]; do\n ui_print \"$line\";\n done < $1;\n}\n\nfunction apatchNote(){\n\tui_print \"- APatch Unpatch Done\"\n\texit\n}\n\nfunction failed(){\n\tui_print \"- APatch Unpatch Failed.\"\n\tui_print \"- Please feedback to the developer with the screenshots.\"\n\texit\n}\n\nfunction boot_execute_ab(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -u --image kernel-origin --out ./kernel\n\tif [[ ! \"$?\" == 0 ]]; then\n\t\tfailed\n\tfi\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot\n\tapatchNote\n}\n\nfunction boot_execute(){\n\t./lib/arm64-v8a/libkptools.so unpack boot.img\n\tmv kernel kernel-origin\n\t./lib/arm64-v8a/libkptools.so -u --image kernel-origin --out ./kernel\n\tif [[ ! \"$?\" == 0 ]]; then\n\t\tfailed\n\tfi\n\t./lib/arm64-v8a/libkptools.so repack boot.img\n\tdd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot\n\tapatchNote\n}\n\nfunction main(){\n\ncd /dev/tmp/install\n\nchmod a+x ./lib/arm64-v8a/libkptools.so\n\n\nslot=$(getprop ro.boot.slot_suffix)\n\nif [[ ! \"$slot\" == \"\" ]]; then\n\n\tui_print \"\"\n\tui_print \"- You are using A/B device.\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot$slot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute_ab\n\tfi\n\nelse\n\n\tui_print \"You are using A Only device.\"\n\n\t# Get kernel\n\tui_print \"\"\n\tdd if=/dev/block/by-name/boot of=/dev/tmp/install/boot.img\n\tif [[ \"$?\" == 0 ]]; then\n\t\tui_print \"- Detected boot partition.\"\n\t\tboot_execute\n\tfi\n\nfi\n\n}\n\nmain"
},
{
"path": "app/src/main/assets/boot_extract.sh",
"content": "#!/system/bin/sh\n\nARCH=$(getprop ro.product.cpu.abi)\n\nIS_INSTALL_NEXT_SLOT=$1\n\n# Load utility functions\n. ./util_functions.sh\n\nif [ \"$IS_INSTALL_NEXT_SLOT\" = \"true\" ]; then\n get_next_slot\nelse\n get_current_slot\nfi\n\nfind_boot_image\n\n[ -e \"$BOOTIMAGE\" ] || { >&2 echo \"- can't find boot.img!\"; exit 1; }\n\ntrue\n"
},
{
"path": "app/src/main/assets/boot_flash.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# APatch Boot Image Flasher\n#######################################################################################\n\nARCH=$(getprop ro.product.cpu.abi)\n\n# Load utility functions\n. ./util_functions.sh\n\necho \"****************************\"\necho \" FolkPatch Boot Image Flasher\"\necho \"****************************\"\n\nBOOTIMAGE=$1\nSOURCE_IMAGE=$2\n\n[ -e \"$SOURCE_IMAGE\" ] || { echo \"- $SOURCE_IMAGE does not exist!\"; exit 1; }\n\necho \"- Target image: $BOOTIMAGE\"\necho \"- Source image: $SOURCE_IMAGE\"\n\necho \"- Flashing boot image\"\nflash_image \"$SOURCE_IMAGE\" \"$BOOTIMAGE\"\n\nif [ $? -ne 0 ]; then\n >&2 echo \"- Flash error: $?\"\n exit $?\nfi\n\necho \"- Flash successful\"\n"
},
{
"path": "app/src/main/assets/boot_patch.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# APatch Boot Image Patcher\n#######################################################################################\n#\n# Usage: boot_patch.sh [ARGS_PASS_TO_KPTOOLS]\n#\n# This script should be placed in a directory with the following files:\n#\n# File name Type Description\n#\n# boot_patch.sh script A script to patch boot image for APatch.\n# (this file) The script will use files in its same\n# directory to complete the patching process.\n# bootimg binary The target boot image\n# kpimg binary KernelPatch core Image\n# kptools executable The KernelPatch tools binary to inject kpimg to kernel Image\n#\n#######################################################################################\n\nARCH=$(getprop ro.product.cpu.abi)\n\n# Load utility functions\n. ./util_functions.sh\n\necho \"****************************\"\necho \" FolkPatch Boot Image Patcher\"\necho \"****************************\"\n\nSUPERKEY=\"$1\"\nBOOTIMAGE=$2\nFLASH_TO_DEVICE=$3\nshift 2\n\n[ -z \"$SUPERKEY\" ] && { >&2 echo \"- SuperKey empty!\"; exit 1; }\n[ -e \"$BOOTIMAGE\" ] || { >&2 echo \"- $BOOTIMAGE does not exist!\"; exit 1; }\n\n# Check for dependencies\n\ncommand -v ./kptools >/dev/null 2>&1 || { >&2 echo \"- Command kptools not found!\"; exit 1; }\n\nif [ ! -f kernel ]; then\necho \"- Unpacking boot image\"\n\nset -x\n./kptools unpack \"$BOOTIMAGE\" \"$@\"\npatch_rc=$?\nset +x\n if [ $patch_rc -ne 0 ]; then\n >&2 echo \"- Unpack error: $patch_rc\"\n exit $?\n fi\nfi\n\nif [ ! $(./kptools -i kernel -f | grep CONFIG_KALLSYMS=y) ]; then\n\techo \"- Patcher has Aborted!\"\n\techo \"- APatch requires CONFIG_KALLSYMS to be Enabled.\"\n\techo \"- But your kernel seems NOT enabled it.\"\n\texit 0\nfi\n\nif [ $(./kptools -i kernel -l | grep patched=false) ]; then\n\techo \"- Backing boot.img \"\n cp \"$BOOTIMAGE\" \"ori.img\" >/dev/null 2>&1\nfi\n\nmv kernel kernel.ori\n\necho \"- Patching kernel\"\n\nset -x\n./kptools -p -i kernel.ori -S \"$SUPERKEY\" -k kpimg -o kernel \"$@\"\npatch_rc=$?\nset +x\n\nif [ $patch_rc -ne 0 ]; then\n >&2 echo \"- Patch kernel error: $patch_rc\"\n exit $?\nfi\n\necho \"- Repacking boot image\"\n./kptools repack \"$BOOTIMAGE\"\n\nif [ ! $(./kptools -i kernel.ori -f | grep CONFIG_KALLSYMS_ALL=y) ]; then\n\techo \"- Detected CONFIG_KALLSYMS_ALL is not set!\"\n\techo \"- APatch has patched but maybe your device won't boot.\"\n\techo \"- Make sure you have original boot image backup.\"\nfi\n\nif [ $? -ne 0 ]; then\n >&2 echo \"- Repack error: $?\"\n exit $?\nfi\n\nif [ \"$FLASH_TO_DEVICE\" = \"true\" ]; then\n # flash\n if [ -b \"$BOOTIMAGE\" ] || [ -c \"$BOOTIMAGE\" ] && [ -f \"new-boot.img\" ]; then\n echo \"- Flashing new boot image\"\n flash_image new-boot.img \"$BOOTIMAGE\"\n if [ $? -ne 0 ]; then\n >&2 echo \"- Flash error: $?\"\n exit $?\n fi\n fi\n\n echo \"- Successfully Flashed!\"\nelse\n echo \"- Successfully Patched!\"\nfi\n\n"
},
{
"path": "app/src/main/assets/boot_unpatch.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# APatch Boot Image Unpatcher\n#######################################################################################\n\nARCH=$(getprop ro.product.cpu.abi)\n\n# Load utility functions\n. ./util_functions.sh\n\necho \"****************************\"\necho \" FolkPatch Boot Image Unpatcher\"\necho \"****************************\"\n\nBOOTIMAGE=$1\n\n[ -e \"$BOOTIMAGE\" ] || { echo \"- $BOOTIMAGE does not exist!\"; exit 1; }\n\necho \"- Target image: $BOOTIMAGE\"\n\n # Check for dependencies\n\ncommand -v ./kptools >/dev/null 2>&1 || { echo \"- Command kptools not found!\"; exit 1; }\n\nif [ ! -f kernel ]; then\necho \"- Unpacking boot image\"\n\nset -x\n./kptools unpack \"$BOOTIMAGE\" \"$@\"\npatch_rc=$?\nif [ $patch_rc -ne 0 ]; then\n >&2 echo \"- Unpack error: $patch_rc\"\n exit $patch_rc\n fi\nfi\n\nif [ ! $(./kptools -i kernel -l | grep patched=false) ]; then\n\techo \"- kernel has been patched \"\n if [ -f \"new-boot.img\" ]; then\n echo \"- found backup boot.img ,use it for recovery\"\n else\n mv kernel kernel.ori\n echo \"- Unpatching kernel\"\n ./kptools -u --image kernel.ori --out kernel \"$@\"\n if [ $? -ne 0 ]; then\n >&2 echo \"- Unpatch error: $?\"\n exit $?\n fi\n echo \"- Repacking boot image\"\n ./kptools repack \"$BOOTIMAGE\"\n if [ $? -ne 0 ]; then\n >&2 echo \"- Repack error: $?\"\n exit $?\n fi\n fi\n\nelse\n echo \"- no need unpatch\"\n exit 0\nfi\n\n\n\nif [ -f \"new-boot.img\" ]; then\n echo \"- Flashing boot image\"\n flash_image new-boot.img \"$BOOTIMAGE\"\n\n if [ $? -ne 0 ]; then\n >&2 echo \"- Flash error: $?\"\n exit $?\n fi\nfi\n\necho \"- Flash successful\"\n\n# Reset any error code\ntrue\n"
},
{
"path": "app/src/main/assets/kpimg.version",
"content": "0.13.1"
},
{
"path": "app/src/main/assets/util_functions.sh",
"content": "#!/system/bin/sh\n#######################################################################################\n# Helper Functions (credits to topjohnwu)\n#######################################################################################\nAPATCH_VER='0.10.4'\nAPATCH_VER_CODE=12146\n\nui_print() {\n if $BOOTMODE; then\n echo \"$1\"\n else\n echo -e \"ui_print $1\\nui_print\" >> /proc/self/fd/$OUTFD\n fi\n}\n\ntoupper() {\n echo \"$@\" | tr '[:lower:]' '[:upper:]'\n}\n\ngrep_cmdline() {\n local REGEX=\"s/^$1=//p\"\n { echo $(cat /proc/cmdline)$(sed -e 's/[^\"]//g' -e 's/\"\"//g' /proc/cmdline) | xargs -n 1; \\\n sed -e 's/ = /=/g' -e 's/, /,/g' -e 's/\"//g' /proc/bootconfig; \\\n } 2>/dev/null | sed -n \"$REGEX\"\n}\n\ngrep_prop() {\n local REGEX=\"s/^$1=//p\"\n shift\n local FILES=$@\n [ -z \"$FILES\" ] && FILES='/system/build.prop'\n cat $FILES 2>/dev/null | dos2unix | sed -n \"$REGEX\" | head -n 1\n}\n\ngetvar() {\n local VARNAME=$1\n local VALUE\n local PROPPATH='/data/.magisk /cache/.magisk'\n [ ! -z $MAGISKTMP ] && PROPPATH=\"$MAGISKTMP/.magisk/config $PROPPATH\"\n VALUE=$(grep_prop $VARNAME $PROPPATH)\n [ ! -z $VALUE ] && eval $VARNAME=\\$VALUE\n}\n\nis_mounted() {\n grep -q \" $(readlink -f $1) \" /proc/mounts 2>/dev/null\n return $?\n}\nabort() {\n ui_print \"$1\"\n $BOOTMODE || recovery_cleanup\n [ ! -z $MODPATH ] && rm -rf $MODPATH\n rm -rf $TMPDIR\n exit 1\n}\nset_nvbase() {\n NVBASE=\"$1\"\n MAGISKBIN=\"$1/magisk\"\n}\n\nprint_title() {\n local len line1len line2len bar\n line1len=$(echo -n $1 | wc -c)\n line2len=$(echo -n $2 | wc -c)\n len=$line2len\n [ $line1len -gt $line2len ] && len=$line1len\n len=$((len + 2))\n bar=$(printf \"%${len}s\" | tr ' ' '*')\n ui_print \"$bar\"\n ui_print \" $1 \"\n [ \"$2\" ] && ui_print \" $2 \"\n ui_print \"$bar\"\n}\nsetup_flashable() {\n ensure_bb\n $BOOTMODE && return\n if [ -z $OUTFD ] || readlink /proc/$$/fd/$OUTFD | grep -q /tmp; then\n # We will have to manually find out OUTFD\n for FD in $(ls /proc/$$/fd); do\n if readlink /proc/$$/fd/$FD | grep -q pipe; then\n if ps | grep -v grep | grep -qE \" 3 $FD |status_fd=$FD\"; then\n OUTFD=$FD\n break\n fi\n fi\n done\n fi\n recovery_actions\n}\n\nensure_bb() {\n if set -o | grep -q standalone; then\n # We are definitely in busybox ash\n set -o standalone\n return\n fi\n\n # Find our busybox binary\n local bb\n if [ -f $TMPDIR/busybox ]; then\n bb=$TMPDIR/busybox\n elif [ -f $MAGISKBIN/busybox ]; then\n bb=$MAGISKBIN/busybox\n else\n abort \"! Cannot find BusyBox\"\n fi\n chmod 755 $bb\n\n # Busybox could be a script, make sure /system/bin/sh exists\n if [ ! -f /system/bin/sh ]; then\n umount -l /system 2>/dev/null\n mkdir -p /system/bin\n ln -s $(command -v sh) /system/bin/sh\n fi\n\n export ASH_STANDALONE=1\n\n # Find our current arguments\n # Run in busybox environment to ensure consistent results\n # /proc//cmdline shall be
\n\n[](https://github.com/LyraVoid/FolkPatch/releases/latest)\n[](https://t.me/FolkPatch)\n[](/LICENSE)\n\n![\"\"](\"docs/1.png\")
![\"\"](\"docs/2.png\")
![\"\"](\"docs/3.png\")
![\"\"](\"docs/4.png\")
![\"\"](\"docs/5.png\")
![\"\"](\"docs/6.png\")