,
replace: bool,
skip: bool,
}
impl Node {
fn collect_module_files(&mut self, module_dir: P) -> Result
where
P: AsRef,
{
let dir = module_dir.as_ref();
let mut has_file = false;
for entry in dir.read_dir()?.flatten() {
let name = entry.file_name().to_string_lossy().to_string();
let node = match self.children.entry(name.clone()) {
Entry::Occupied(o) => Some(o.into_mut()),
Entry::Vacant(v) => Self::new_module(&name, &entry).map(|it| v.insert(it)),
};
if let Some(node) = node {
has_file |= if node.file_type == NodeFileType::Directory {
node.collect_module_files(dir.join(&node.name))? || node.replace
} else {
true
}
}
}
Ok(has_file)
}
fn dir_is_replace(path: P) -> bool
where
P: AsRef,
{
if let Ok(v) = lgetxattr(&path, REPLACE_DIR_XATTR)
&& String::from_utf8_lossy(&v) == "y"
{
return true;
}
path.as_ref().join(REPLACE_DIR_FILE_NAME).exists()
}
fn new_root(name: T) -> Self {
Node {
name: name.to_string(),
file_type: Directory,
children: Default::default(),
module_path: None,
replace: false,
skip: false,
}
}
fn new_module(name: &S, entry: &DirEntry) -> Option
where
S: ToString,
{
if let Ok(metadata) = entry.metadata() {
let path = entry.path();
let file_type = if metadata.file_type().is_char_device() && metadata.rdev() == 0 {
NodeFileType::Whiteout
} else {
NodeFileType::from_file_type(metadata.file_type())
};
let replace = file_type == NodeFileType::Directory && Self::dir_is_replace(&path);
if replace {
log::debug!("{} need replace", path.display());
}
return Some(Self {
name: name.to_string(),
file_type,
children: HashMap::default(),
module_path: Some(path),
replace,
skip: false,
});
}
None
}
}
fn collect_module_files() -> Result> {
let mut root = Node::new_root("");
let mut system = Node::new_root("system");
let module_root = Path::new(MODULE_DIR);
let mut has_file = false;
log::debug!("begin collect module files: {}", module_root.display());
for entry in module_root.read_dir()?.flatten() {
if !entry.file_type()?.is_dir() {
continue;
}
let id = entry.file_name().to_str().unwrap().to_string();
log::debug!("processing new module: {id}");
let prop = entry.path().join("module.prop");
if !prop.exists() {
log::debug!("skipped module {id}, because not found module.prop");
continue;
}
if entry.path().join(DISABLE_FILE_NAME).exists()
|| entry.path().join(REMOVE_FILE_NAME).exists()
|| entry.path().join(SKIP_MOUNT_FILE_NAME).exists()
{
log::debug!("skipped module {id}, due to disable/remove/skip_mount");
continue;
}
let mod_system = entry.path().join("system");
if !mod_system.is_dir() {
continue;
}
log::debug!("collecting {}", entry.path().display());
has_file |= system.collect_module_files(mod_system)?;
}
if has_file {
const BUILTIN_PARTITIONS: [(&str, bool); 5] = [
("vendor", true),
("system_ext", true),
("product", true),
("odm", false),
("oem", false),
];
for (partition, require_symlink) in BUILTIN_PARTITIONS {
let path_of_root = Path::new("/").join(partition);
let path_of_system = Path::new("/system").join(partition);
if path_of_root.is_dir() && (!require_symlink || path_of_system.is_symlink()) {
let name = partition.to_string();
if let Some(node) = system.children.remove(&name) {
root.children.insert(name, node);
}
}
}
root.children.insert("system".to_string(), system);
Ok(Some(root))
} else {
Ok(None)
}
}
fn clone_symlink, Dst: AsRef>(src: Src, dst: Dst) -> Result<()> {
let src_symlink = read_link(src.as_ref())?;
symlink(&src_symlink, dst.as_ref())?;
lsetfilecon(dst.as_ref(), lgetfilecon(src.as_ref())?.as_str())?;
log::debug!(
"clone symlink {} -> {}({})",
dst.as_ref().display(),
dst.as_ref().display(),
src_symlink.display()
);
Ok(())
}
fn mount_mirror, WP: AsRef>(
path: P,
work_dir_path: WP,
entry: &DirEntry,
) -> Result<()> {
let path = path.as_ref().join(entry.file_name());
let work_dir_path = work_dir_path.as_ref().join(entry.file_name());
let file_type = entry.file_type()?;
if file_type.is_file() {
log::debug!(
"mount mirror file {} -> {}",
path.display(),
work_dir_path.display()
);
fs::File::create(&work_dir_path)?;
mount_bind(&path, &work_dir_path)?;
} else if file_type.is_dir() {
log::debug!(
"mount mirror dir {} -> {}",
path.display(),
work_dir_path.display()
);
create_dir(&work_dir_path)?;
let metadata = entry.metadata()?;
chmod(&work_dir_path, Mode::from_raw_mode(metadata.mode()))?;
chown(
&work_dir_path,
Some(Uid::from_raw(metadata.uid())),
Some(Gid::from_raw(metadata.gid())),
)?;
lsetfilecon(&work_dir_path, lgetfilecon(&path)?.as_str())?;
for entry in read_dir(&path)?.flatten() {
mount_mirror(&path, &work_dir_path, &entry)?;
}
} else if file_type.is_symlink() {
log::debug!(
"create mirror symlink {} -> {}",
path.display(),
work_dir_path.display()
);
clone_symlink(&path, &work_dir_path)?;
}
Ok(())
}
fn should_create_tmpfs(path: &Path, current: &mut Node, has_tmpfs: bool) -> bool {
if has_tmpfs {
return false;
}
if current.replace && current.module_path.is_some() {
return true;
}
for (name, node) in &mut current.children {
let real_path = path.join(name);
if node.file_type.needs_tmpfs_vs_real(&real_path) {
if current.module_path.is_none() {
log::error!("cannot create tmpfs on {}, ignore: {name}", path.display());
node.skip = true;
continue;
}
return true;
}
}
false
}
fn prepare_tmpfs_skeleton(
path: &Path,
work_dir_path: &Path,
module_path: Option<&PathBuf>,
) -> Result<()> {
log::debug!(
"creating tmpfs skeleton for {} at {}",
path.display(),
work_dir_path.display()
);
create_dir_all(work_dir_path)?;
let source: &Path = if path.exists() {
path
} else if let Some(mp) = module_path {
mp
} else {
bail!("cannot mount root dir {}!", path.display());
};
let metadata = source.metadata()?;
chmod(work_dir_path, Mode::from_raw_mode(metadata.mode()))?;
chown(
work_dir_path,
Some(Uid::from_raw(metadata.uid())),
Some(Gid::from_raw(metadata.gid())),
)?;
lsetfilecon(work_dir_path, lgetfilecon(source)?.as_str())?;
Ok(())
}
fn handle_mount_result(result: Result<()>, path: &Path, name: &str, has_tmpfs: bool) -> Result<()> {
if let Err(e) = result {
if has_tmpfs {
return Err(e);
}
log::error!("mount child {}/{} failed: {}", path.display(), name, e);
}
Ok(())
}
fn process_existing_entries(
path: &Path,
work_dir_path: &Path,
children: &mut HashMap,
has_tmpfs: bool,
) -> Result<()> {
for entry in path.read_dir()?.flatten() {
let name = entry.file_name().to_string_lossy().to_string();
let result = if let Some(node) = children.remove(&name) {
if node.skip {
continue;
}
do_magic_mount(path, work_dir_path, node, has_tmpfs)
.with_context(|| format!("magic mount {}/{name}", path.display()))
} else if has_tmpfs {
mount_mirror(path, work_dir_path, &entry)
.with_context(|| format!("mount mirror {}/{name}", path.display()))
} else {
Ok(())
};
handle_mount_result(result, path, &name, has_tmpfs)?;
}
Ok(())
}
fn process_remaining_children(
path: &Path,
work_dir_path: &Path,
children: HashMap,
has_tmpfs: bool,
) -> Result<()> {
for (name, node) in children {
if node.skip {
continue;
}
let result = do_magic_mount(path, work_dir_path, node, has_tmpfs)
.with_context(|| format!("magic mount {}/{name}", path.display()));
handle_mount_result(result, path, &name, has_tmpfs)?;
}
Ok(())
}
fn move_tmpfs_to_target(work_dir_path: &Path, target: &Path) -> Result<()> {
log::debug!(
"moving tmpfs {} -> {}",
work_dir_path.display(),
target.display()
);
mount_move(work_dir_path, target).context("move self")?;
mount_change(target, MountPropagationFlags::PRIVATE).context("make self private")?;
Ok(())
}
fn do_magic_mount, WP: AsRef>(
path: P,
work_dir_path: WP,
mut current: Node,
has_tmpfs: bool,
) -> Result<()> {
let path = path.as_ref().join(¤t.name);
let work_dir_path = work_dir_path.as_ref().join(¤t.name);
match current.file_type {
RegularFile => {
let target_path = if has_tmpfs {
fs::File::create(&work_dir_path)?;
&work_dir_path
} else {
&path
};
if let Some(module_path) = ¤t.module_path {
log::debug!(
"mount module file {} -> {}",
module_path.display(),
work_dir_path.display()
);
mount_bind(module_path, target_path)?;
} else {
bail!("cannot mount root file {}!", path.display());
}
}
Symlink => {
if let Some(module_path) = ¤t.module_path {
log::debug!(
"create module symlink {} -> {}",
module_path.display(),
work_dir_path.display()
);
clone_symlink(module_path, &work_dir_path)?;
} else {
bail!("cannot mount root symlink {}!", path.display());
}
}
Directory => {
let create_tmpfs = should_create_tmpfs(&path, &mut current, has_tmpfs);
let has_tmpfs = has_tmpfs || create_tmpfs;
if has_tmpfs {
prepare_tmpfs_skeleton(&path, &work_dir_path, current.module_path.as_ref())?;
}
if create_tmpfs {
log::debug!(
"creating tmpfs for {} at {}",
path.display(),
work_dir_path.display()
);
mount_bind(&work_dir_path, &work_dir_path).context("bind self")?;
}
if path.exists() && !current.replace {
process_existing_entries(
&path,
&work_dir_path,
&mut current.children,
has_tmpfs,
)?;
}
if current.replace {
if current.module_path.is_none() {
bail!("dir {} is declared as replaced but it is root!", path.display());
}
log::debug!("dir {} is replaced", path.display());
}
process_remaining_children(&path, &work_dir_path, current.children, has_tmpfs)?;
if create_tmpfs {
move_tmpfs_to_target(&work_dir_path, &path)?;
}
}
Whiteout => {
log::debug!("file {} is removed", path.display());
}
}
Ok(())
}
pub fn magic_mount() -> Result<()> {
if let Some(root) = collect_module_files()? {
log::debug!("collected: {:#?}", root);
let tmp_dir = PathBuf::from(AP_MAGIC_MOUNT_SOURCE);
ensure_dir_exists(&tmp_dir)?;
mount("tmpfs", &tmp_dir, "tmpfs", MountFlags::empty(), None).context("mount tmp")?;
mount_change(&tmp_dir, MountPropagationFlags::PRIVATE).context("make tmp private")?;
let result = do_magic_mount("/", &tmp_dir, root, false);
if let Err(e) = unmount(&tmp_dir, UnmountFlags::DETACH) {
log::error!("failed to unmount tmp {}", e);
}
fs::remove_dir(tmp_dir).ok();
result
} else {
log::info!("no modules to mount, skipping!");
Ok(())
}
}
================================================
FILE: apd/src/main.rs
================================================
mod apd;
mod assets;
mod cli;
mod defs;
mod event;
mod lua;
mod magic_mount;
mod metamodule;
mod module;
mod module_config;
mod package;
#[cfg(any(target_os = "linux", target_os = "android"))]
mod pty;
mod resetprop;
mod restorecon;
mod sepolicy;
mod supercall;
mod utils;
fn main() -> anyhow::Result<()> {
cli::run()
}
================================================
FILE: apd/src/metamodule.rs
================================================
//! Metamodule management
//!
//! This module handles all metamodule-related functionality.
//! Metamodules are special modules that manage how regular modules are mounted
//! and provide hooks for module installation/uninstallation.
use std::{
collections::HashMap,
path::{Path, PathBuf},
process::Command,
};
use anyhow::{Context, Result, ensure};
use log::{info, warn};
use crate::{assets, defs, module::ModuleType::All};
/// Determine whether the provided module properties mark it as a metamodule
pub fn is_metamodule(props: &HashMap) -> bool {
props.get("metamodule").is_some_and(|s| {
let trimmed = s.trim();
trimmed == "1" || trimmed.eq_ignore_ascii_case("true")
})
}
/// Get metamodule path if it exists
/// The metamodule is stored in /data/adb/modules/{id} with a symlink at /data/adb/metamodule
pub fn get_metamodule_path() -> Option {
let path = Path::new(defs::METAMODULE_DIR);
// Check if symlink exists and resolve it
if path.is_symlink()
&& let Ok(target) = std::fs::read_link(path)
{
// If target is relative, resolve it
let resolved = if target.is_absolute() {
target
} else {
path.parent()?.join(target)
};
if resolved.exists() && resolved.is_dir() {
return Some(resolved);
}
warn!(
"Metamodule symlink points to non-existent path: {}",
resolved.display()
);
}
// Fallback: search for metamodule=1 in modules directory
let mut result = None;
let _ = crate::module::foreach_module(All, |module_path| {
if let Ok(props) = crate::module::read_module_prop(module_path)
&& is_metamodule(&props)
{
info!(
"Found metamodule in modules directory: {}",
module_path.display()
);
result = Some(module_path.to_path_buf());
}
Ok(())
});
result
}
/// Check if metamodule exists
pub fn has_metamodule() -> bool {
get_metamodule_path().is_some()
}
/// Check if it's safe to install a regular module
/// Returns Ok(()) if safe, Err(is_disabled) if blocked
/// - Err(true) means metamodule is disabled
/// - Err(false) means metamodule is in other unstable state
pub fn check_install_safety() -> Result<(), bool> {
// No metamodule → safe
let Some(metamodule_path) = get_metamodule_path() else {
return Ok(());
};
// No metainstall.sh → safe (uses default installer)
// The staged update directory may contain the latest scripts, so check both locations
let has_metainstall = metamodule_path
.join(defs::METAMODULE_METAINSTALL_SCRIPT)
.exists()
|| metamodule_path.file_name().is_some_and(|module_id| {
Path::new(defs::MODULE_UPDATE_DIR)
.join(module_id)
.join(defs::METAMODULE_METAINSTALL_SCRIPT)
.exists()
});
if !has_metainstall {
return Ok(());
}
// Check for marker files
let has_update = metamodule_path.join(defs::UPDATE_FILE_NAME).exists();
let has_remove = metamodule_path.join(defs::REMOVE_FILE_NAME).exists();
let has_disable = metamodule_path.join(defs::DISABLE_FILE_NAME).exists();
// Stable state (no markers) → safe
if !has_update && !has_remove && !has_disable {
return Ok(());
}
// Return true if disabled, false for other unstable states
Err(has_disable && !has_update && !has_remove)
}
/// Create or update the metamodule symlink
/// Points /data/adb/metamodule -> /data/adb/modules/{module_id}
pub fn ensure_symlink(module_path: P) -> Result<()>
where
P: AsRef,
{
// METAMODULE_DIR might have trailing slash, so we need to trim it
let symlink_path = Path::new(defs::METAMODULE_DIR.trim_end_matches('/'));
let module_path = module_path.as_ref();
info!(
"Creating metamodule symlink: {} -> {}",
symlink_path.display(),
module_path.display()
);
// Remove existing symlink if it exists
if symlink_path.exists() || symlink_path.is_symlink() {
info!("Removing old metamodule symlink/path");
if symlink_path.is_symlink() {
std::fs::remove_file(symlink_path).with_context(|| "Failed to remove old symlink")?;
} else {
// Could be a directory, remove it
std::fs::remove_dir_all(symlink_path)
.with_context(|| "Failed to remove old directory")?;
}
}
// Create symlink
#[cfg(unix)]
std::os::unix::fs::symlink(module_path, symlink_path)
.with_context(|| format!("Failed to create symlink to {}", module_path.display()))?;
info!("Metamodule symlink created successfully");
Ok(())
}
/// Remove the metamodule symlink
pub fn remove_symlink() -> Result<()> {
let symlink_path = Path::new(defs::METAMODULE_DIR.trim_end_matches('/'));
if symlink_path.is_symlink() {
std::fs::remove_file(symlink_path)
.with_context(|| "Failed to remove metamodule symlink")?;
info!("Metamodule symlink removed");
}
Ok(())
}
/// Get the install script content, using metainstall.sh from metamodule if available
/// Returns the script content to be executed
pub fn get_install_script(
is_metamodule: bool,
installer_content: &str,
install_module_script: &str,
) -> Result {
// Check if there's a metamodule with metainstall.sh
// Only apply this logic for regular modules (not when installing metamodule itself)
let install_script = if is_metamodule {
info!("Installing metamodule, using default installer");
install_module_script.to_string()
} else if let Some(metamodule_path) = get_metamodule_path() {
if metamodule_path.join(defs::DISABLE_FILE_NAME).exists() {
info!("Metamodule is disabled, using default installer");
install_module_script.to_string()
} else {
let metainstall_path = metamodule_path.join(defs::METAMODULE_METAINSTALL_SCRIPT);
if metainstall_path.exists() {
info!("Using metainstall.sh from metamodule");
let metamodule_content = std::fs::read_to_string(&metainstall_path)
.with_context(|| "Failed to read metamodule metainstall.sh")?;
format!("{installer_content}\n{metamodule_content}\nexit 0\n")
} else {
info!("Metamodule exists but has no metainstall.sh, using default installer");
install_module_script.to_string()
}
}
} else {
info!("No metamodule found, using default installer");
install_module_script.to_string()
};
Ok(install_script)
}
/// Check if metamodule script exists and is ready to execute
/// Returns None if metamodule doesn't exist, is disabled, or script is missing
/// Returns Some(script_path) if script is ready to execute
fn check_metamodule_script(script_name: &str) -> Option {
// Check if metamodule exists
let metamodule_path = get_metamodule_path()?;
// Check if metamodule is disabled
if metamodule_path.join(defs::DISABLE_FILE_NAME).exists() {
info!("Metamodule is disabled, skipping {script_name}");
return None;
}
// Check if script exists
let script_path = metamodule_path.join(script_name);
if !script_path.exists() {
return None;
}
Some(script_path)
}
/// Execute metamodule's metauninstall.sh for a specific module
pub fn exec_metauninstall_script(module_id: &str) -> Result<()> {
let Some(metauninstall_path) = check_metamodule_script(defs::METAMODULE_METAUNINSTALL_SCRIPT)
else {
return Ok(());
};
info!("Executing metamodule metauninstall.sh for module: {module_id}",);
let result = Command::new(assets::BUSYBOX_PATH)
.args(["sh", metauninstall_path.to_str().unwrap()])
.current_dir(metauninstall_path.parent().unwrap())
.envs(crate::module::get_common_script_envs())
.env("MODULE_ID", module_id)
.status()?;
ensure!(
result.success(),
"Metamodule metauninstall.sh failed for module {module_id}: {:?}",
result
);
info!("Metamodule metauninstall.sh executed successfully for {module_id}",);
Ok(())
}
/// Execute metamodule mount script
pub fn exec_mount_script(module_dir: &str) -> Result<()> {
let Some(mount_script) = check_metamodule_script(defs::METAMODULE_MOUNT_SCRIPT) else {
return Ok(());
};
info!("Executing mount script for metamodule");
let result = Command::new(assets::BUSYBOX_PATH)
.args(["sh", mount_script.to_str().unwrap()])
.envs(crate::module::get_common_script_envs())
.env("MODULE_DIR", module_dir)
.status()?;
ensure!(
result.success(),
"Metamodule mount script failed with status: {:?}",
result
);
info!("Metamodule mount script executed successfully");
Ok(())
}
/// Execute metamodule script for a specific stage
pub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {
let Some(script_path) = check_metamodule_script(&format!("{stage}.sh")) else {
return Ok(());
};
info!("Executing metamodule {stage}.sh");
crate::module::exec_script(&script_path, block)?;
info!("Metamodule {stage}.sh executed successfully");
Ok(())
}
================================================
FILE: apd/src/module.rs
================================================
use crate::sepolicy::get_policy_main;
use crate::{lua, module_config};
use anyhow::{Context, Result, anyhow, bail, ensure};
use const_format::concatcp;
use is_executable::is_executable;
use java_properties::PropertiesIter;
use log::{debug, info, warn};
#[cfg(unix)]
use std::os::unix::{prelude::PermissionsExt, process::CommandExt};
use std::{
collections::HashMap,
env::var as env_var,
fs::{self, remove_dir_all},
io::Cursor,
path::{Path, PathBuf, Component},
process::Command,
str::FromStr,
};
use zip_extensions::zip_extract_file_to_memory;
#[allow(clippy::wildcard_imports)]
use crate::utils::*;
use crate::{
assets,
defs::{self, MODULE_DIR, MODULE_UPDATE_DIR},
metamodule, restorecon,
};
const INSTALLER_CONTENT: &str = include_str!("./installer.sh");
const INSTALL_MODULE_SCRIPT: &str = concatcp!(
INSTALLER_CONTENT,
"\n",
"install_module",
"\n",
"exit 0",
"\n"
);
#[derive(PartialEq, Eq)]
pub enum ModuleType {
All,
Active,
Updated,
}
fn exec_install_script(module_file: &str, is_metamodule: bool) -> Result<()> {
let realpath = std::fs::canonicalize(module_file)
.with_context(|| format!("realpath: {module_file} failed"))?;
// Get install script from metamodule module
let install_script =
metamodule::get_install_script(is_metamodule, INSTALLER_CONTENT, INSTALL_MODULE_SCRIPT)?;
let result = Command::new(assets::BUSYBOX_PATH)
.args(["sh", "-c", &install_script])
.envs(get_common_script_envs())
.env("OUTFD", "1")
.env("ZIPFILE", realpath)
.status()?;
ensure!(result.success(), "Failed to install module script");
Ok(())
}
pub fn handle_updated_modules() -> Result<()> {
let modules_root = Path::new(MODULE_DIR);
foreach_module(ModuleType::Updated, |updated_module| {
if !updated_module.is_dir() {
return Ok(());
}
if let Some(name) = updated_module.file_name() {
let module_dir = modules_root.join(name);
let mut disabled = false;
let mut removed = false;
if module_dir.exists() {
// If the old module is disabled, we need to also disable the new one
disabled = module_dir.join(defs::DISABLE_FILE_NAME).exists();
removed = module_dir.join(defs::REMOVE_FILE_NAME).exists();
remove_dir_all(&module_dir)?;
}
std::fs::rename(updated_module, &module_dir)?;
if removed {
let path = module_dir.join(defs::REMOVE_FILE_NAME);
if let Err(e) = ensure_file_exists(&path) {
warn!("Failed to create {}: {e}", path.display());
}
} else if disabled {
let path = module_dir.join(defs::DISABLE_FILE_NAME);
if let Err(e) = ensure_file_exists(&path) {
warn!("Failed to create {}: {e}", path.display());
}
}
}
Ok(())
})?;
Ok(())
}
/// Get common environment variables for script execution
pub fn get_common_script_envs() -> Vec<(&'static str, String)> {
vec![
("ASH_STANDALONE", "1".to_string()),
("APATCH", "true".to_string()),
("APATCH_VER", defs::VERSION_NAME.to_string()),
("APATCH_VER_CODE", defs::VERSION_CODE.to_string()),
(
"PATH",
format!(
"/data/adb:{}:{}",
defs::BINARY_DIR.trim_end_matches('/'),
env_var("PATH").unwrap_or_default()
),
),
]
}
// because we use something like A-B update
// we need to update the module state after the boot_completed
// if someone(such as the module) install a module before the boot_completed
// then it may cause some problems, just forbid it
fn ensure_boot_completed() -> Result<()> {
// ensure getprop sys.boot_completed == 1
if getprop("sys.boot_completed").as_deref() != Some("1") {
bail!("Android is Booting!");
}
Ok(())
}
fn mark_update() -> Result<()> {
ensure_file_exists(concatcp!(defs::WORKING_DIR, defs::UPDATE_FILE_NAME))
}
fn mark_module_state(module: &str, flag_file: &str, create_or_delete: bool) -> Result<()> {
let module_state_file = Path::new(defs::MODULE_DIR).join(module).join(flag_file);
if create_or_delete {
ensure_file_exists(module_state_file)
} else {
if module_state_file.exists() {
fs::remove_file(module_state_file)?;
}
Ok(())
}
}
pub fn foreach_module(
module_type: ModuleType,
mut f: impl FnMut(&Path) -> Result<()>,
) -> Result<()> {
let modules_dir = Path::new(match module_type {
ModuleType::Updated => MODULE_UPDATE_DIR,
_ => defs::MODULE_DIR,
});
let dir = std::fs::read_dir(modules_dir)?;
for entry in dir.flatten() {
let path = entry.path();
if !path.is_dir() {
warn!("{} is not a directory, skip", path.display());
continue;
}
if module_type == ModuleType::Active && path.join(defs::DISABLE_FILE_NAME).exists() {
info!("{} is disabled, skip", path.display());
continue;
}
if module_type == ModuleType::Active && path.join(defs::REMOVE_FILE_NAME).exists() {
warn!("{} is removed, skip", path.display());
continue;
}
f(&path)?;
}
Ok(())
}
fn foreach_active_module(f: impl FnMut(&Path) -> Result<()>) -> Result<()> {
foreach_module(ModuleType::Active, f)
}
pub fn load_sepolicy_rule() -> Result<()> {
foreach_active_module(|path| {
let rule_file = path.join("sepolicy.rule");
if !rule_file.exists() {
return Ok(());
}
info!("load policy: {}", &rule_file.display());
let mut _sepol = get_policy_main(&[
"magiskpolicy".to_string(),
"--live".to_string(),
"--apply".to_string(),
rule_file.display().to_string(),
])?;
Ok(())
})?;
Ok(())
}
pub fn exec_script>(path: T, wait: bool) -> Result<()> {
info!("exec {}", path.as_ref().display());
let is_module_script = path.as_ref().starts_with(defs::MODULE_DIR);
// Extract module_id from path if it matches /data/adb/modules/{id}/...
let module_id = if is_module_script {
path.as_ref()
.strip_prefix(defs::MODULE_DIR)
.ok()
.and_then(|p| p.components().next())
.and_then(|c| c.as_os_str().to_str())
.map(ToString::to_string)
} else {
None
};
if is_module_script && module_id.is_none() {
debug!(
"Failed to extract module_id from script path '{}'. Script will run without AP_MODULE environment variable.",
path.as_ref().display()
);
}
let is_elf = fs::read(path.as_ref())
.ok()
.and_then(|bytes| bytes.get(..4).map(|b| b.to_vec()))
.map_or(false, |magic| magic == [0x7f, b'E', b'L', b'F']);
let mut command = Command::new(if is_elf {
path.as_ref().as_os_str().to_owned()
} else {
assets::BUSYBOX_PATH.into()
});
#[cfg(unix)]
{
command.process_group(0);
unsafe {
command.pre_exec(|| {
switch_cgroups();
Ok(())
});
}
}
command
.current_dir(path.as_ref().parent().unwrap())
.env("APATCH", "true")
.env("APATCH_VER", defs::VERSION_NAME)
.env("APATCH_VER_CODE", defs::VERSION_CODE)
.env(
"PATH",
format!(
"{}:{}",
env_var("PATH")?,
defs::BINARY_DIR.trim_end_matches('/')
),
);
if !is_elf {
command
.arg("sh")
.arg(path.as_ref())
.env("ASH_STANDALONE", "1");
}
if let Some(id) = module_id {
command.env("AP_MODULE", id);
}
let result = if wait {
command.status().map(|_| ())
} else {
command.spawn().map(|_| ())
};
result.map_err(|err| anyhow!("Failed to exec {}: {}", path.as_ref().display(), err))
}
pub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {
foreach_active_module(|module| {
let script_path = module.join(format!("{stage}.sh"));
if !script_path.exists() {
return Ok(());
}
exec_script(&script_path, block)
})?;
Ok(())
}
pub fn exec_common_scripts(dir: &str, wait: bool) -> Result<()> {
let script_dir = Path::new(defs::ADB_DIR).join(dir);
if !script_dir.exists() {
info!("{} not exists, skip", script_dir.display());
return Ok(());
}
let dir = fs::read_dir(&script_dir)?;
for entry in dir.flatten() {
let path = entry.path();
if !is_executable(&path) {
warn!("{} is not executable, skip", path.display());
continue;
}
exec_script(path, wait)?;
}
Ok(())
}
pub fn load_system_prop() -> Result<()> {
foreach_active_module(|module| {
let system_prop = module.join("system.prop");
if !system_prop.exists() {
return Ok(());
}
info!("load {} system.prop", module.display());
crate::resetprop::load_system_prop_file(&system_prop)?;
Ok(())
})?;
Ok(())
}
pub fn prune_modules() -> Result<()> {
foreach_module(ModuleType::All, |module| {
fs::remove_file(module.join(defs::UPDATE_FILE_NAME)).ok();
if !module.join(defs::REMOVE_FILE_NAME).exists() {
return Ok(());
}
info!("remove module: {}", module.display());
// Execute metamodule's metauninstall.sh first
let module_id = module.file_name().and_then(|n| n.to_str()).unwrap_or("");
// Check if this is a metamodule
let is_metamodule = read_module_prop(module)
.map(|props| metamodule::is_metamodule(&props))
.unwrap_or(false);
if is_metamodule {
info!("Removing metamodule symlink");
if let Err(e) = metamodule::remove_symlink() {
warn!("Failed to remove metamodule symlink: {e}");
}
} else if let Err(e) = metamodule::exec_metauninstall_script(module_id) {
warn!("Failed to exec metamodule uninstall for {module_id}: {e}",);
}
// Then execute module's own uninstall.sh
let uninstaller = module.join("uninstall.sh");
if uninstaller.exists()
&& let Err(e) = exec_script(uninstaller, true)
{
warn!("Failed to exec uninstaller: {e}");
}
// Clear module configs before removing module directory
if let Err(e) = module_config::clear_module_configs(module_id) {
warn!("Failed to clear configs for {module_id}: {e}");
}
// Finally remove the module directory
if let Err(e) = remove_dir_all(module) {
warn!("Failed to remove {}: {e}", module.display());
}
Ok(())
})?;
// collect remaining modules, if none, clean up metamodule record
let remaining_modules: Vec<_> = std::fs::read_dir(defs::MODULE_DIR)?
.filter_map(std::result::Result::ok)
.filter(|entry| entry.path().join("module.prop").exists())
.collect();
if remaining_modules.is_empty() {
info!("no remaining modules.");
}
Ok(())
}
fn _install_module(zip: &str) -> Result<()> {
ensure_boot_completed()?;
// print banner
println!(include_str!("banner"));
assets::ensure_binaries().with_context(|| "binary missing")?;
// first check if workding dir is usable
ensure_dir_exists(defs::WORKING_DIR).with_context(|| "Failed to create working dir")?;
ensure_dir_exists(defs::BINARY_DIR).with_context(|| "Failed to create bin dir")?;
// read the module_id from zip
let mut buffer: Vec = Vec::new();
let entry_path = PathBuf::from_str("module.prop")?;
let zip_path = PathBuf::from_str(zip)?;
let zip_path = zip_path.canonicalize()?;
zip_extract_file_to_memory(&zip_path, &entry_path, &mut buffer)?;
let mut module_prop = HashMap::new();
PropertiesIter::new_with_encoding(Cursor::new(buffer), encoding_rs::UTF_8).read_into(
|k, v| {
module_prop.insert(k, v);
},
)?;
info!("module prop: {:?}", module_prop);
let Some(module_id) = module_prop.get("id") else {
bail!("module id not found in module.prop!");
};
let module_id = module_id.trim();
// Check if this module is a metamodule
let is_metamodule = metamodule::is_metamodule(&module_prop);
// Check if it's safe to install regular module
if !is_metamodule && let Err(is_disabled) = metamodule::check_install_safety() {
println!("\n❌ Installation Blocked");
println!("┌────────────────────────────────");
println!("│ A metamodule with custom installer is active");
println!("│");
if is_disabled {
println!("│ Current state: Disabled");
println!("│ Action required: Re-enable or uninstall it, then reboot");
} else {
println!("│ Current state: Pending changes");
println!("│ Action required: Reboot to apply changes first");
}
println!("└─────────────────────────────────\n");
bail!("Metamodule installation blocked");
}
let modules_dir = Path::new(defs::MODULE_DIR);
let modules_update_dir = Path::new(defs::MODULE_UPDATE_DIR);
if !Path::new(modules_dir).exists() {
fs::create_dir(modules_dir).expect("Failed to create modules folder");
let permissions = fs::Permissions::from_mode(0o700);
fs::set_permissions(modules_dir, permissions).expect("Failed to set permissions");
}
if is_metamodule {
info!("Installing metamodule: {module_id}");
// Check if there's already a metamodule installed
if metamodule::has_metamodule()
&& let Some(existing_path) = metamodule::get_metamodule_path()
{
let existing_id = read_module_prop(&existing_path)
.ok()
.and_then(|m| m.get("id").cloned())
.unwrap_or_else(|| "unknown".to_string());
if existing_id != module_id {
println!("\n❌ Installation Failed");
println!("┌────────────────────────────────");
println!("│ A metamodule is already installed");
println!("│ Current metamodule: {existing_id}");
println!("│");
println!("│ Only one metamodule can be active at a time.");
println!("│");
println!("│ To install this metamodule:");
println!("│ 1. Uninstall the current metamodule");
println!("│ 2. Reboot your device");
println!("│ 3. Install the new metamodule");
println!("└─────────────────────────────────\n");
bail!("Cannot install multiple metamodules");
}
}
}
let module_dir = format!("{}{}", modules_dir.display(), module_id);
let _module_update_dir = format!("{}{}", modules_update_dir.display(), module_id);
info!("module dir: {}", module_dir);
if !Path::new(&module_dir.clone()).exists() {
fs::create_dir(&module_dir.clone()).expect("Failed to create module folder");
let permissions = fs::Permissions::from_mode(0o700);
fs::set_permissions(module_dir.clone(), permissions).expect("Failed to set permissions");
}
// unzip the image and move it to modules_update/ dir
let file = fs::File::open(zip)?;
let mut archive = zip::ZipArchive::new(file)?;
archive.extract(&_module_update_dir)?;
// Set SELinux context for module root directory and special files
// This is critical for .img files that need to be loop-mounted
#[cfg(unix)]
{
let module_update_path = Path::new(&_module_update_dir);
if module_update_path.exists() {
// Set adb_data_file context for the module root directory
restorecon::lsetfilecon(&_module_update_dir, restorecon::ADB_CON)?;
// Process special files like .img that need proper permissions for mounting
if let Ok(entries) = fs::read_dir(&_module_update_dir) {
for entry in entries.flatten() {
let path = entry.path();
if let Some(extension) = path.extension() {
if extension == "img" {
// Set proper permissions for image files (readable by all)
fs::set_permissions(&path, fs::Permissions::from_mode(0o644))?;
// Set SELinux context to allow loop mounting
restorecon::lsetfilecon(&path, restorecon::ADB_CON)?;
info!("Set permissions and SELinux context for: {:?}", path);
}
}
}
}
}
}
println!("- Running module installer");
exec_install_script(zip, is_metamodule)?;
// set permission and selinux context for $MOD/system
let module_system_dir = PathBuf::from(module_dir.clone()).join("system");
if module_system_dir.exists() {
#[cfg(unix)]
fs::set_permissions(&module_system_dir, fs::Permissions::from_mode(0o755))?;
restorecon::restore_syscon(&module_system_dir)?;
}
// Create symlink for metamodule
if is_metamodule {
println!("- Creating metamodule symlink");
metamodule::ensure_symlink(&module_dir)?;
}
mark_update()?;
Ok(())
}
pub fn install_module(zip: &str) -> Result<()> {
let result = _install_module(zip);
result
}
pub fn _uninstall_module(id: &str, update_dir: &str) -> Result<()> {
let dir = Path::new(update_dir);
ensure!(dir.exists(), "No module installed");
// iterate the modules_update dir, find the module to be removed
let dir = fs::read_dir(dir)?;
for entry in dir.flatten() {
let path = entry.path();
let module_prop = path.join("module.prop");
if !module_prop.exists() {
continue;
}
let content = fs::read(module_prop)?;
let mut module_id: String = String::new();
PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8).read_into(
|k, v| {
if k.eq("id") {
module_id = v;
}
},
)?;
if module_id.eq(id) {
let remove_file = path.join(defs::REMOVE_FILE_NAME);
fs::File::create(remove_file).with_context(|| "Failed to create remove file.")?;
break;
}
}
// santity check
let target_module_path = format!("{update_dir}/{id}");
let target_module = Path::new(&target_module_path);
if target_module.exists() {
let remove_file = target_module.join(defs::REMOVE_FILE_NAME);
if !remove_file.exists() {
fs::File::create(remove_file).with_context(|| "Failed to create remove file.")?;
}
}
let _ = mark_module_state(id, defs::REMOVE_FILE_NAME, true);
Ok(())
}
pub fn uninstall_module(id: &str) -> Result<()> {
_uninstall_module(id, defs::MODULE_DIR)?;
mark_update()?;
Ok(())
}
pub fn undo_uninstall_module(id: &str) -> Result<()> {
let module_path = Path::new(defs::MODULE_DIR).join(id);
ensure!(module_path.exists(), "Module {id} not found");
// Remove the remove mark
let remove_file = module_path.join(defs::REMOVE_FILE_NAME);
if remove_file.exists() {
fs::remove_file(&remove_file)
.with_context(|| format!("Failed to delete remove file for module '{id}'"))?;
info!("Removed the remove mark for module {id}");
}
Ok(())
}
/// Read module.prop from the given module path and return as a HashMap
pub fn read_module_prop(module_path: &Path) -> Result> {
let module_prop = module_path.join("module.prop");
ensure!(
module_prop.exists(),
"module.prop not found in {}",
module_path.display()
);
let content = std::fs::read(&module_prop)
.with_context(|| format!("Failed to read module.prop: {}", module_prop.display()))?;
let mut prop_map: HashMap = HashMap::new();
PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8)
.read_into(|k, v| {
prop_map.insert(k, v);
})
.with_context(|| format!("Failed to parse module.prop: {}", module_prop.display()))?;
Ok(prop_map)
}
pub fn run_action(id: &str) -> Result<()> {
let action_script_path = format!("/data/adb/modules/{}/action.sh", id);
if Path::new(&action_script_path).exists() {
let _ = exec_script(&action_script_path, true);
} else {
//if no action.sh, try to run lua action
lua::run_lua(&id, "action", false, true).map_err(|e| anyhow::anyhow!("{}", e))?;
}
Ok(())
}
fn _change_module_state(module_dir: &str, mid: &str, enable: bool) -> Result<()> {
let src_module_path = format!("{module_dir}/{mid}");
let src_module = Path::new(&src_module_path);
ensure!(src_module.exists(), "module: {} not found!", mid);
let disable_path = src_module.join(defs::DISABLE_FILE_NAME);
if enable {
if disable_path.exists() {
fs::remove_file(&disable_path).with_context(|| {
format!("Failed to remove disable file: {}", &disable_path.display())
})?;
}
} else {
ensure_file_exists(disable_path)?;
}
let _ = mark_module_state(mid, defs::DISABLE_FILE_NAME, !enable);
Ok(())
}
pub fn _enable_module(id: &str, update_dir: &Path) -> Result<()> {
if let Some(module_dir_str) = update_dir.to_str() {
_change_module_state(module_dir_str, id, true)
} else {
info!("Enable module failed: Invalid path");
Err(anyhow::anyhow!("Invalid module directory"))
}
}
pub fn enable_module(id: &str) -> Result<()> {
let update_dir = Path::new(defs::MODULE_DIR);
_enable_module(id, update_dir)?;
Ok(())
}
pub fn _disable_module(id: &str, update_dir: &Path) -> Result<()> {
if let Some(module_dir_str) = update_dir.to_str() {
_change_module_state(module_dir_str, id, false)
} else {
info!("Disable module failed: Invalid path");
Err(anyhow::anyhow!("Invalid module directory"))
}
}
pub fn disable_module(id: &str) -> Result<()> {
let module_dir = Path::new(defs::MODULE_DIR);
_disable_module(id, module_dir)?;
Ok(())
}
pub fn _disable_all_modules(dir: &str) -> Result<()> {
let dir = fs::read_dir(dir)?;
for entry in dir.flatten() {
let path = entry.path();
let disable_flag = path.join(defs::DISABLE_FILE_NAME);
if let Err(e) = ensure_file_exists(disable_flag) {
warn!("Failed to disable module: {}: {}", path.display(), e);
}
}
Ok(())
}
pub fn disable_all_modules() -> Result<()> {
// Skip disabling modules since boot completed
if getprop("sys.boot_completed").as_deref() == Some("1") {
info!("System boot completed, no need to disable all modules");
return Ok(());
}
mark_update()?;
_disable_all_modules(defs::MODULE_DIR)?;
Ok(())
}
// Resolve a module icon path to an absolute on-disk path
fn resolve_module_icon_path(
module_prop_map: &mut HashMap,
key: &str,
module_path: &Path,
) {
let module_id = module_prop_map.get("id").map(|s| s.as_str()).unwrap_or("");
if let Some(icon_value) = module_prop_map.get(key).map(|v| v.trim()).filter(|v| !v.is_empty()) {
let path = Path::new(icon_value);
if path.is_absolute() || path.components().any(|c| matches!(c, Component::ParentDir)) {
log::warn!("Rejected {} (invalid path) for module {}: {}", key, module_id, icon_value);
return;
}
let candidate = module_path.join(path);
if candidate.exists() && candidate.is_file() {
if let Some(full_path) = candidate.to_str() {
module_prop_map.insert(key.to_string(), full_path.to_string());
}
} else {
log::debug!("{} not found for module {}: {}", key, module_id, candidate.display());
}
}
}
fn _list_modules(path: &str) -> Vec> {
// Load all module configs once to minimize I/O overhead
let all_configs = match module_config::get_all_module_configs() {
Ok(configs) => configs,
Err(e) => {
warn!("Failed to load module configs: {e}");
HashMap::new()
}
};
// first check enabled modules
let dir = fs::read_dir(path);
let Ok(dir) = dir else {
return Vec::new();
};
let mut modules: Vec> = Vec::new();
for entry in dir.flatten() {
let path = entry.path();
info!("path: {}", path.display());
let module_prop = path.join("module.prop");
if !module_prop.exists() {
continue;
}
let content = fs::read(&module_prop);
let Ok(content) = content else {
warn!("Failed to read file: {}", module_prop.display());
continue;
};
let mut module_prop_map: HashMap = HashMap::new();
let encoding = encoding_rs::UTF_8;
if PropertiesIter::new_with_encoding(Cursor::new(content), encoding)
.read_into(|k, v| {
module_prop_map.insert(k, v);
})
.is_err()
{
warn!("Failed to parse module.prop: {}", module_prop.display());
continue;
}
if !module_prop_map.contains_key("id") || module_prop_map["id"].is_empty() {
match entry.file_name().to_str() {
Some(id) => {
info!("Use dir name as module id: {}", id);
module_prop_map.insert("id".to_owned(), id.to_owned());
}
_ => {
info!("Failed to get module id: {:?}", module_prop);
continue;
}
}
}
// Add enabled, update, remove flags
let enabled = !path.join(defs::DISABLE_FILE_NAME).exists();
let update = path.join(defs::UPDATE_FILE_NAME).exists();
let remove = path.join(defs::REMOVE_FILE_NAME).exists();
let web = path.join(defs::MODULE_WEB_DIR).exists();
let id = module_prop_map.get("id").map(|s| s.as_str()).unwrap_or("");
let id_lua_file = format!("{}.lua", id);
let action = path.join(defs::MODULE_ACTION_SH).exists() || path.join(&id_lua_file).exists();
module_prop_map.insert("enabled".to_owned(), enabled.to_string());
module_prop_map.insert("update".to_owned(), update.to_string());
module_prop_map.insert("remove".to_owned(), remove.to_string());
module_prop_map.insert("web".to_owned(), web.to_string());
module_prop_map.insert("action".to_owned(), action.to_string());
// Resolve and validate module icon paths for action and webui icons
resolve_module_icon_path(&mut module_prop_map, "actionIcon", &path);
resolve_module_icon_path(&mut module_prop_map, "webuiIcon", &path);
// Apply module config overrides and extract managed features
if let Some(module_id) = module_prop_map.get("id")
&& let Some(config) = all_configs.get(module_id.as_str())
{
// Apply override.description
if let Some(desc) = config.get("override.description") {
module_prop_map.insert("description".to_owned(), desc.clone());
}
}
modules.push(module_prop_map);
}
modules
}
pub fn list_modules() -> Result<()> {
let modules = _list_modules(defs::MODULE_DIR);
println!("{}", serde_json::to_string_pretty(&modules)?);
Ok(())
}
================================================
FILE: apd/src/module_config.rs
================================================
use std::{
collections::HashMap,
fs::{self, File},
io::{Read, Write},
path::{Path, PathBuf},
};
use anyhow::{Context, Result, bail};
use log::{debug, warn};
use crate::{defs, utils::ensure_dir_exists};
#[allow(clippy::unreadable_literal)]
const MODULE_CONFIG_MAGIC: u32 = 0x4150544D; // "APTM"
const MODULE_CONFIG_VERSION: u32 = 1;
// Validation limits
pub const MAX_CONFIG_KEY_LEN: usize = 256;
pub const MAX_CONFIG_VALUE_LEN: usize = 1024 * 1024; // 1MB
pub const MAX_CONFIG_COUNT: usize = 32;
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ConfigType {
Persist,
Temp,
}
impl ConfigType {
const fn filename(self) -> &'static str {
match self {
Self::Persist => defs::PERSIST_CONFIG_NAME,
Self::Temp => defs::TEMP_CONFIG_NAME,
}
}
}
/// Validate config key
/// Uses the same validation rules as module_id: ^[a-zA-Z][a-zA-Z0-9._-]+$
/// - Must start with a letter (a-zA-Z)
/// - Followed by one or more alphanumeric, dot, underscore, or hyphen characters
/// - Minimum length: 2 characters
pub fn validate_config_key(key: &str) -> Result<()> {
if key.is_empty() {
bail!("Config key cannot be empty");
}
if key.len() > MAX_CONFIG_KEY_LEN {
bail!(
"Config key too long: {} bytes (max: {MAX_CONFIG_KEY_LEN})",
key.len(),
);
}
// Use same pattern as module_id for consistency
let re = regex_lite::Regex::new(r"^[a-zA-Z][a-zA-Z0-9._-]+$")?;
if !re.is_match(key) {
bail!("Invalid config key: '{key}'. Must match /^[a-zA-Z][a-zA-Z0-9._-]+$/");
}
Ok(())
}
/// Validate config value
/// Only enforces maximum length - no character restrictions
/// Values are stored in binary format with length prefix, so any UTF-8 data is safe
pub fn validate_config_value(value: &str) -> Result<()> {
if value.len() > MAX_CONFIG_VALUE_LEN {
bail!(
"Config value too long: {} bytes (max: {})",
value.len(),
MAX_CONFIG_VALUE_LEN
);
}
// No character restrictions - binary storage format handles all UTF-8 safely
Ok(())
}
/// Validate config count
fn validate_config_count(config: &HashMap) -> Result<()> {
if config.len() > MAX_CONFIG_COUNT {
bail!(
"Too many config entries: {} (max: {MAX_CONFIG_COUNT})",
config.len(),
);
}
Ok(())
}
/// Get the config directory path for a module
fn get_config_dir(module_id: &str) -> PathBuf {
Path::new(defs::MODULE_CONFIG_DIR).join(module_id)
}
/// Get the config file path for a module
fn get_config_path(module_id: &str, config_type: ConfigType) -> PathBuf {
get_config_dir(module_id).join(config_type.filename())
}
/// Ensure the config directory exists
fn ensure_config_dir(module_id: &str) -> Result {
let dir = get_config_dir(module_id);
ensure_dir_exists(&dir)?;
Ok(dir)
}
/// Load config from binary file
pub fn load_config(module_id: &str, config_type: ConfigType) -> Result> {
let config_path = get_config_path(module_id, config_type);
if !config_path.exists() {
debug!("Config file not found: {}", config_path.display());
return Ok(HashMap::new());
}
let mut file = File::open(&config_path)
.with_context(|| format!("Failed to open config file: {}", config_path.display()))?;
// Read magic
let mut magic_buf = [0u8; 4];
file.read_exact(&mut magic_buf)
.with_context(|| "Failed to read magic")?;
let magic = u32::from_le_bytes(magic_buf);
if magic != MODULE_CONFIG_MAGIC {
bail!("Invalid config magic: expected 0x{MODULE_CONFIG_MAGIC:08x}, got 0x{magic:08x}");
}
// Read version
let mut version_buf = [0u8; 4];
file.read_exact(&mut version_buf)
.with_context(|| "Failed to read version")?;
let version = u32::from_le_bytes(version_buf);
if version != MODULE_CONFIG_VERSION {
bail!("Unsupported config version: expected {MODULE_CONFIG_VERSION}, got {version}");
}
// Read count
let mut count_buf = [0u8; 4];
file.read_exact(&mut count_buf)
.with_context(|| "Failed to read count")?;
let count = u32::from_le_bytes(count_buf);
// Read entries
let mut config = HashMap::new();
for i in 0..count {
// Read key length
let mut key_len_buf = [0u8; 4];
file.read_exact(&mut key_len_buf)
.with_context(|| format!("Failed to read key length for entry {i}"))?;
let key_len = u32::from_le_bytes(key_len_buf) as usize;
// Read key data
let mut key_buf = vec![0u8; key_len];
file.read_exact(&mut key_buf)
.with_context(|| format!("Failed to read key data for entry {i}"))?;
let key = String::from_utf8(key_buf)
.with_context(|| format!("Invalid UTF-8 in key for entry {i}"))?;
// Read value length
let mut value_len_buf = [0u8; 4];
file.read_exact(&mut value_len_buf)
.with_context(|| format!("Failed to read value length for entry {i}"))?;
let value_len = u32::from_le_bytes(value_len_buf) as usize;
// Read value data
let mut value_buf = vec![0u8; value_len];
file.read_exact(&mut value_buf)
.with_context(|| format!("Failed to read value data for entry {i}"))?;
let value = String::from_utf8(value_buf)
.with_context(|| format!("Invalid UTF-8 in value for entry {i}"))?;
config.insert(key, value);
}
debug!(
"Loaded {} entries from {}",
config.len(),
config_path.display()
);
Ok(config)
}
/// Save config to binary file
pub fn save_config(
module_id: &str,
config_type: ConfigType,
config: &HashMap,
) -> Result<()> {
// Validate config count
validate_config_count(config)?;
// Validate all keys and values
for (key, value) in config {
validate_config_key(key).with_context(|| format!("Invalid config key: '{key}'"))?;
validate_config_value(value)
.with_context(|| format!("Invalid config value for key '{key}'"))?;
}
ensure_config_dir(module_id)?;
let config_path = get_config_path(module_id, config_type);
let temp_path = config_path.with_extension("tmp");
// Write to temporary file first
let mut file = File::create(&temp_path)
.with_context(|| format!("Failed to create temp config file: {}", temp_path.display()))?;
// Write magic
file.write_all(&MODULE_CONFIG_MAGIC.to_le_bytes())
.with_context(|| "Failed to write magic")?;
// Write version
file.write_all(&MODULE_CONFIG_VERSION.to_le_bytes())
.with_context(|| "Failed to write version")?;
// Write count
let count = config.len() as u32;
file.write_all(&count.to_le_bytes())
.with_context(|| "Failed to write count")?;
// Write entries
for (key, value) in config {
// Write key length
let key_bytes = key.as_bytes();
let key_len = key_bytes.len() as u32;
file.write_all(&key_len.to_le_bytes())
.with_context(|| format!("Failed to write key length for '{key}'"))?;
// Write key data
file.write_all(key_bytes)
.with_context(|| format!("Failed to write key data for '{key}'"))?;
// Write value length
let value_bytes = value.as_bytes();
let value_len = value_bytes.len() as u32;
file.write_all(&value_len.to_le_bytes())
.with_context(|| format!("Failed to write value length for '{key}'"))?;
// Write value data
file.write_all(value_bytes)
.with_context(|| format!("Failed to write value data for '{key}'"))?;
}
file.sync_all()
.with_context(|| "Failed to sync config file")?;
// Atomic rename
fs::rename(&temp_path, &config_path).with_context(|| {
format!(
"Failed to rename config file: {} -> {}",
temp_path.display(),
config_path.display()
)
})?;
debug!(
"Saved {} entries to {}",
config.len(),
config_path.display()
);
Ok(())
}
/// Get a single config value
#[allow(dead_code)]
pub fn get_config_value(
module_id: &str,
key: &str,
config_type: ConfigType,
) -> Result> {
let config = load_config(module_id, config_type)?;
Ok(config.get(key).cloned())
}
/// Set a single config value
pub fn set_config_value(
module_id: &str,
key: &str,
value: &str,
config_type: ConfigType,
) -> Result<()> {
// Validate input early for better error messages
validate_config_key(key)?;
validate_config_value(value)?;
let mut config = load_config(module_id, config_type)?;
config.insert(key.to_string(), value.to_string());
// Note: save_config will also validate, but this provides earlier feedback
save_config(module_id, config_type, &config)?;
Ok(())
}
/// Delete a single config value
pub fn delete_config_value(module_id: &str, key: &str, config_type: ConfigType) -> Result<()> {
let mut config = load_config(module_id, config_type)?;
if config.remove(key).is_none() {
bail!("Key '{key}' not found in config");
}
save_config(module_id, config_type, &config)?;
Ok(())
}
/// Clear all config values
pub fn clear_config(module_id: &str, config_type: ConfigType) -> Result<()> {
let config_path = get_config_path(module_id, config_type);
if config_path.exists() {
fs::remove_file(&config_path)
.with_context(|| format!("Failed to remove config file: {}", config_path.display()))?;
debug!("Cleared config: {}", config_path.display());
}
Ok(())
}
/// Merge persist and temp configs (temp takes priority)
pub fn merge_configs(module_id: &str) -> Result> {
let mut merged = match load_config(module_id, ConfigType::Persist) {
Ok(config) => config,
Err(e) => {
warn!("Failed to load persist config for module '{module_id}': {e}");
HashMap::new()
}
};
let temp = match load_config(module_id, ConfigType::Temp) {
Ok(config) => config,
Err(e) => {
warn!("Failed to load temp config for module '{module_id}': {e}");
HashMap::new()
}
};
// Temp config overrides persist config
for (key, value) in temp {
merged.insert(key, value);
}
Ok(merged)
}
/// Get all module configs (for iteration)
/// Loads all configs in a single pass to minimize I/O overhead
pub fn get_all_module_configs() -> Result>> {
let config_root = Path::new(defs::MODULE_CONFIG_DIR);
if !config_root.exists() {
return Ok(HashMap::new());
}
let mut all_configs = HashMap::new();
for entry in fs::read_dir(config_root)
.with_context(|| format!("Failed to read config directory: {}", config_root.display()))?
{
let entry = entry?;
let path = entry.path();
if !path.is_dir() {
continue;
}
if let Some(module_id) = path.file_name().and_then(|n| n.to_str()) {
match merge_configs(module_id) {
Ok(config) => {
if !config.is_empty() {
all_configs.insert(module_id.to_string(), config);
}
}
Err(e) => {
warn!("Failed to load config for module '{module_id}': {e}");
// Continue processing other modules
}
}
}
}
Ok(all_configs)
}
/// Clear all temporary configs (called during post-fs-data)
pub fn clear_all_temp_configs() -> Result<()> {
let config_root = Path::new(defs::MODULE_CONFIG_DIR);
if !config_root.exists() {
debug!("Config directory does not exist, nothing to clear");
return Ok(());
}
let mut cleared_count = 0;
for entry in fs::read_dir(config_root)
.with_context(|| format!("Failed to read config directory: {}", config_root.display()))?
{
let entry = entry?;
let path = entry.path();
if !path.is_dir() {
continue;
}
let temp_config = path.join(defs::TEMP_CONFIG_NAME);
if temp_config.exists() {
match fs::remove_file(&temp_config) {
Ok(()) => {
debug!("Cleared temp config: {}", temp_config.display());
cleared_count += 1;
}
Err(e) => {
warn!("Failed to clear temp config {}: {e}", temp_config.display());
}
}
}
}
if cleared_count > 0 {
debug!("Cleared {cleared_count} temp config file(s)");
}
Ok(())
}
/// Clear all configs for a module (called during uninstall)
pub fn clear_module_configs(module_id: &str) -> Result<()> {
let config_dir = get_config_dir(module_id);
if config_dir.exists() {
fs::remove_dir_all(&config_dir).with_context(|| {
format!(
"Failed to remove config directory: {}",
config_dir.display()
)
})?;
debug!("Cleared all configs for module: {module_id}");
}
Ok(())
}
================================================
FILE: apd/src/package.rs
================================================
use std::{
collections::{HashMap, HashSet},
fs::File,
io::{self, BufRead},
path::Path,
process::Command,
thread,
time::Duration,
};
use log::{info, warn};
use serde::{Deserialize, Serialize};
use crate::defs;
const DEFAULT_SCONTEXT: &str = "u:r:untrusted_app:s0";
const MAGISK_SCONTEXT: &str = "u:r:magisk:s0";
#[derive(Deserialize, Serialize, Clone)]
pub struct PackageConfig {
pub pkg: String,
pub exclude: i32,
pub allow: i32,
pub uid: i32,
pub to_uid: i32,
pub sctx: String,
}
fn read_known_user_packages() -> HashSet {
std::fs::read_to_string(defs::AUTO_EXCLUDE_KNOWN_PACKAGES_FILE)
.map(|content| {
content
.lines()
.map(str::trim)
.filter(|line| !line.is_empty())
.map(ToOwned::to_owned)
.collect()
})
.unwrap_or_default()
}
fn write_known_user_packages(packages: &HashSet) -> io::Result<()> {
let mut sorted_packages: Vec<_> = packages.iter().cloned().collect();
sorted_packages.sort();
let mut content = sorted_packages.join("\n");
if !content.is_empty() {
content.push('\n');
}
std::fs::write(defs::AUTO_EXCLUDE_KNOWN_PACKAGES_FILE, content)
}
fn list_user_packages() -> HashSet {
let commands: [(&str, &[&str]); 2] = [
("cmd", &["package", "list", "packages", "-3"]),
("pm", &["list", "packages", "-3"]),
];
for (program, args) in commands {
let output = match Command::new(program).args(args).output() {
Ok(output) if output.status.success() => output,
Ok(output) => {
warn!("User package query {} {:?} failed: {:?}", program, args, output.status.code());
continue;
}
Err(e) => {
warn!("User package query {} {:?} failed: {}", program, args, e);
continue;
}
};
return String::from_utf8_lossy(&output.stdout)
.lines()
.filter_map(|line| line.strip_prefix("package:"))
.map(str::trim)
.filter(|pkg| !pkg.is_empty())
.map(ToOwned::to_owned)
.collect();
}
HashSet::new()
}
pub fn sync_auto_exclude_new_apps(
package_configs: &mut Vec,
uid_map: &HashMap,
mode: i32,
) -> io::Result {
let current_user_packages = list_user_packages();
if current_user_packages.is_empty() {
return Ok(false);
}
let known_user_packages = read_known_user_packages();
let known_initialized = Path::new(defs::AUTO_EXCLUDE_KNOWN_PACKAGES_FILE).exists();
let mut changed = false;
if mode != 0 && known_initialized {
let new_packages: Vec<_> = current_user_packages
.difference(&known_user_packages)
.cloned()
.collect();
for pkg in new_packages {
let Some(&uid) = uid_map.get(&pkg) else {
warn!("[auto_exclude] Missing uid for package {}, skip", pkg);
continue;
};
let exists = package_configs.iter().any(|config| config.pkg == pkg || config.uid == uid);
if exists {
continue;
}
let (allow, exclude, sctx, mode_name) = match mode {
1 => (1, 0, MAGISK_SCONTEXT.to_string(), "root"),
2 => (0, 1, DEFAULT_SCONTEXT.to_string(), "exclude"),
_ => continue,
};
info!(
"[new_app_profile] New package detected, apply {} by default: {} ({})",
mode_name, pkg, uid
);
package_configs.push(PackageConfig {
pkg,
exclude,
allow,
uid,
to_uid: 0,
sctx,
});
changed = true;
}
}
write_known_user_packages(¤t_user_packages)?;
Ok(changed || !known_initialized)
}
pub fn read_ap_package_config() -> Vec {
let max_retry = 5;
for _ in 0..max_retry {
let file = match File::open("/data/adb/ap/package_config") {
Ok(file) => file,
Err(e) => {
warn!("Error opening file: {}", e);
thread::sleep(Duration::from_secs(1));
continue;
}
};
let mut reader = csv::Reader::from_reader(file);
let mut package_configs = Vec::new();
let mut success = true;
for record in reader.deserialize() {
match record {
Ok(config) => package_configs.push(config),
Err(e) => {
warn!("Error deserializing record: {}", e);
success = false;
break;
}
}
}
if success {
return package_configs;
}
thread::sleep(Duration::from_secs(1));
}
Vec::new()
}
pub fn write_ap_package_config(package_configs: &[PackageConfig]) -> io::Result<()> {
let max_retry = 5;
for _ in 0..max_retry {
let temp_path = "/data/adb/ap/package_config.tmp";
let file = match File::create(temp_path) {
Ok(file) => file,
Err(e) => {
warn!("Error creating temp file: {}", e);
thread::sleep(Duration::from_secs(1));
continue;
}
};
let mut writer = csv::Writer::from_writer(file);
let mut success = true;
for config in package_configs {
if let Err(e) = writer.serialize(config) {
warn!("Error serializing record: {}", e);
success = false;
break;
}
}
if !success {
thread::sleep(Duration::from_secs(1));
continue;
}
if let Err(e) = writer.flush() {
warn!("Error flushing writer: {}", e);
thread::sleep(Duration::from_secs(1));
continue;
}
if let Err(e) = std::fs::rename(temp_path, "/data/adb/ap/package_config") {
warn!("Error renaming temp file: {}", e);
thread::sleep(Duration::from_secs(1));
continue;
}
return Ok(());
}
Err(io::Error::new(
io::ErrorKind::Other,
"Failed after max retries",
))
}
fn read_lines(filename: P) -> io::Result>>
where
P: AsRef,
{
File::open(filename).map(|file| io::BufReader::new(file).lines())
}
pub fn synchronize_package_uid() -> io::Result<()> {
info!("[synchronize_package_uid] Start synchronizing root list with system packages...");
let max_retry = 5;
for _ in 0..max_retry {
match read_lines("/data/system/packages.list") {
Ok(lines) => {
let lines: Vec<_> = lines.filter_map(|line| line.ok()).collect();
let mut package_configs = read_ap_package_config();
let uid_map: HashMap = lines
.iter()
.filter_map(|line| {
let words: Vec<&str> = line.split_whitespace().collect();
if words.len() < 2 {
return None;
}
words[1]
.parse::()
.ok()
.map(|uid| (words[0].to_string(), uid))
})
.collect();
let system_packages: Vec = lines
.iter()
.filter_map(|line| line.split_whitespace().next())
.map(|pkg| pkg.to_string())
.collect();
let original_len = package_configs.len();
package_configs.retain(|config| system_packages.contains(&config.pkg));
let removed_count = original_len - package_configs.len();
if removed_count > 0 {
info!(
"Removed {} uninstalled package configurations",
removed_count
);
}
let mut updated = false;
let new_app_profile_mode = crate::supercall::get_new_app_profile_mode();
if sync_auto_exclude_new_apps(&mut package_configs, &uid_map, new_app_profile_mode)? {
updated = true;
}
for line in &lines {
let words: Vec<&str> = line.split_whitespace().collect();
if words.len() >= 2 {
let pkg_name = words[0];
if let Ok(uid) = words[1].parse::() {
if let Some(config) = package_configs
.iter_mut()
.find(|config| config.pkg == pkg_name)
{
if config.uid % 100000 != uid % 100000 {
let uid = config.uid / 100000 * 100000 + uid % 100000;
info!(
"Updating uid for package {}: {} -> {}",
pkg_name, config.uid, uid
);
config.uid = uid;
updated = true;
}
}
} else {
warn!("Error parsing uid: {}", words[1]);
}
}
}
if updated || removed_count > 0 {
write_ap_package_config(&package_configs)?;
}
return Ok(());
}
Err(e) => {
warn!("Error reading packages.list: {}", e);
thread::sleep(Duration::from_secs(1));
}
}
}
Err(io::Error::new(
io::ErrorKind::Other,
"Failed after max retries",
))
}
================================================
FILE: apd/src/pty.rs
================================================
use std::{
ffi::c_int,
fs::File,
io::{Read, Write, stderr, stdin, stdout},
mem::MaybeUninit,
os::fd::{AsFd, AsRawFd, OwnedFd, RawFd},
process::exit,
ptr::null_mut,
sync::Mutex,
thread,
};
use anyhow::{Ok, Result, bail};
use libc::{
EINTR, SIG_BLOCK, SIG_UNBLOCK, SIGWINCH, TIOCGWINSZ, TIOCSWINSZ, fork,
pthread_sigmask, sigaddset, sigemptyset, sigset_t, sigwait, waitpid, winsize,
};
use rustix::{
fs::{Mode, OFlags, open},
io::dup,
ioctl::{Getter, Opcode, ioctl, opcode},
process::setsid,
pty::{grantpt, unlockpt},
stdio::{dup2_stderr, dup2_stdin, dup2_stdout},
termios::{OptionalActions, Termios, isatty, tcgetattr, tcsetattr},
};
use crate::{defs::PTS_NAME, utils::get_tmp_path};
// https://github.com/topjohnwu/Magisk/blob/5627053b7481618adfdf8fa3569b48275589915b/native/src/core/su/pts.cpp
fn get_pty_num(fd: F) -> Result {
// TIOCGPTN: Get the PTY number
const TIOCGPTN: Opcode = opcode::read::(b'T', 0x30);
Ok(unsafe {
let tiocgptn = Getter::::new();
ioctl(fd, tiocgptn)?
})
}
static OLD_STDIN: Mutex> = Mutex::new(None);
fn watch_sigwinch_async(slave: RawFd) {
let mut winch = MaybeUninit::::uninit();
unsafe {
sigemptyset(winch.as_mut_ptr());
sigaddset(winch.as_mut_ptr(), SIGWINCH);
pthread_sigmask(SIG_BLOCK, winch.as_mut_ptr(), null_mut());
}
thread::spawn(move || unsafe {
let mut winch = MaybeUninit::::uninit();
sigemptyset(winch.as_mut_ptr());
sigaddset(winch.as_mut_ptr(), SIGWINCH);
pthread_sigmask(SIG_UNBLOCK, winch.as_mut_ptr(), null_mut());
let mut sig: c_int = 0;
loop {
let mut w = MaybeUninit::::uninit();
if libc::ioctl(1, TIOCGWINSZ, w.as_mut_ptr()) < 0 {
continue;
}
libc::ioctl(slave, TIOCSWINSZ, w.as_mut_ptr());
if sigwait(winch.as_mut_ptr(), &mut sig) != 0 {
break;
}
}
});
}
fn set_stdin_raw() -> rustix::io::Result<()> {
let mut termios = tcgetattr(stdin())?;
let mut guard = OLD_STDIN.lock().unwrap();
*guard = Some(termios.clone());
drop(guard);
termios.make_raw();
tcsetattr(stdin(), OptionalActions::Flush, &termios)
}
fn restore_stdin() -> Result<()> {
let mut guard = OLD_STDIN.lock().unwrap();
if let Some(original_termios) = guard.take() {
tcsetattr(stdin(), OptionalActions::Flush, &original_termios)?;
}
Ok(())
}
fn pump(mut from: R, mut to: W) {
let mut buf = [0u8; 4096];
loop {
match from.read(&mut buf) {
Result::Ok(len) => {
if len == 0 {
return;
}
if to.write_all(&buf[0..len]).is_err() {
return;
}
if to.flush().is_err() {
return;
}
}
Err(_) => {
return;
}
}
}
}
fn pump_stdin_async(mut ptmx: File) {
let _ = set_stdin_raw();
thread::spawn(move || {
let mut stdin = stdin();
pump(&mut stdin, &mut ptmx);
});
}
fn pump_stdout_blocking(mut ptmx: File) {
let mut stdout = stdout();
pump(&mut ptmx, &mut stdout);
let _ = restore_stdin();
}
fn create_transfer(ptmx: OwnedFd) -> Result<()> {
let pid = unsafe { fork() };
match pid {
d if d < 0 => bail!("fork"),
0 => return Ok(()),
_ => {}
}
let ptmx_r = ptmx;
let ptmx_w = dup(&ptmx_r)?;
let ptmx_r = File::from(ptmx_r);
let ptmx_w = File::from(ptmx_w);
watch_sigwinch_async(ptmx_w.as_raw_fd());
pump_stdin_async(ptmx_r);
pump_stdout_blocking(ptmx_w);
let mut status: c_int = -1;
unsafe {
loop {
if waitpid(pid, &mut status, 0) == -1 && std::io::Error::last_os_error().raw_os_error() != Some(EINTR) {
continue;
}
break;
}
}
exit(status)
}
pub fn prepare_pty() -> Result<()> {
let tty_in = isatty(stdin());
let tty_out = isatty(stdout());
let tty_err = isatty(stderr());
if !tty_in && !tty_out && !tty_err {
return Ok(());
}
let mut pts_path = format!("{}/{}", get_tmp_path(), PTS_NAME);
if !std::path::Path::new(&pts_path).exists() {
pts_path = "/dev/pts".to_string();
}
let ptmx_path = format!("{}/ptmx", pts_path);
let ptmx_fd = open(ptmx_path, OFlags::RDWR, Mode::empty())?;
grantpt(&ptmx_fd)?;
unlockpt(&ptmx_fd)?;
let pty_num = get_pty_num(&ptmx_fd)?;
create_transfer(ptmx_fd)?;
setsid()?;
let pty_fd = open(format!("{pts_path}/{pty_num}"), OFlags::RDWR, Mode::empty())?;
if tty_in {
dup2_stdin(&pty_fd)?;
}
if tty_out {
dup2_stdout(&pty_fd)?;
}
if tty_err {
dup2_stderr(&pty_fd)?;
}
Ok(())
}
================================================
FILE: apd/src/resetprop.rs
================================================
use anyhow::{bail, Context, Result};
use clap::error::ErrorKind;
use clap::Parser;
use log::info;
use prop_rs_android::resetprop::ResetProp;
use prop_rs_android::sys_prop;
use std::fmt;
use std::fs::File;
use std::io::{BufRead, BufReader};
use std::path::Path;
use std::time::Duration;
#[derive(Debug)]
pub struct WaitTimeoutError {
name: String,
}
impl fmt::Display for WaitTimeoutError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
write!(f, "timeout waiting for {}", self.name)
}
}
impl std::error::Error for WaitTimeoutError {}
/// Magisk-compatible Android system property tool.
#[derive(Debug, clap::Args)]
#[allow(clippy::struct_excessive_bools)]
pub struct Args {
/// Skip property_service (force direct mmap operation).
#[arg(short = 'n', long = "skip-svc")]
skip_svc: bool,
/// Also operate on persistent property storage (persist.* files).
#[arg(short = 'p', long = "persistent")]
persistent: bool,
/// Only read persistent properties from storage.
#[arg(short = 'P')]
persist_only: bool,
/// Delete the named property.
#[arg(short = 'd', long = "delete")]
delete: bool,
/// Verbose output.
#[arg(short = 'v', long = "verbose")]
verbose: bool,
/// Wait for a property to exist or match a value.
#[arg(short = 'w', long = "wait")]
wait: bool,
/// Timeout in seconds for --wait (default: wait forever).
#[arg(long = "timeout")]
timeout: Option,
/// Load and set properties from FILE.
#[arg(short = 'f', long = "file")]
file: Option,
/// Compact property area memory (reclaim holes left by deleted properties).
/// Optionally pass a SELinux context name to compact only that area.
#[arg(short = 'c', long = "compact")]
compact: bool,
/// Show SELinux context when listing properties.
#[arg(short = 'Z')]
show_context: bool,
/// Property name.
name: Option,
/// Property value (for set or wait-for-value).
value: Option,
}
#[derive(Parser)]
#[command(
name = "resetprop",
version,
about = "Magisk-compatible system property tool",
disable_help_subcommand = true
)]
struct ResetPropParser {
#[command(flatten)]
arg: Args,
}
pub fn resetprop_main(args: &[String]) -> ! {
if let Err(err) = run_from_args(args) {
let code = if err.downcast_ref::().is_some() {
2
} else {
1
};
eprintln!("resetprop: {err:#}");
std::process::exit(code);
}
std::process::exit(0);
}
/// Entry point for resetprop multicall.
///
/// `args` should include argv[0] (the program name).
fn run_from_args(args: &[String]) -> Result<()> {
let parser = match ResetPropParser::try_parse_from(args) {
Ok(cli) => cli,
Err(err) => {
if matches!(
err.kind(),
ErrorKind::DisplayHelp | ErrorKind::DisplayVersion
) {
err.print()?;
return Ok(());
}
return Err(anyhow::anyhow!("{err}"));
}
};
execute(&parser.arg)
}
/// Execute resetprop logic
/// Subcommand will direct call that, skip run_from_args
pub fn execute(cli: &Args) -> Result<()> {
sys_prop::init().context("Failed to initialize system property API")?;
let rp = ResetProp {
skip_svc: cli.skip_svc,
persistent: cli.persistent,
persist_only: cli.persist_only,
verbose: cli.verbose,
show_context: cli.show_context,
};
// Validate: at most one special mode
let special_modes = u8::from(cli.wait)
+ u8::from(cli.delete)
+ u8::from(cli.compact)
+ u8::from(cli.file.is_some());
if special_modes > 1 {
bail!("multiple operation modes detected");
}
// -w: wait mode
if cli.wait {
let name = cli
.name
.as_deref()
.context("--wait requires a property name")?;
let timeout = cli.timeout.map(Duration::from_secs_f64);
let ok = rp
.wait(name, cli.value.as_deref(), timeout)
.context("wait failed")?;
if !ok {
return Err(WaitTimeoutError {
name: name.to_owned(),
}
.into());
}
return Ok(());
}
// -c: compact property area memory
// When a positional argument is given, treat it as a SELinux context name.
if cli.compact {
let context = cli.name.as_deref();
let compacted = sys_prop::compact(context).context("compact failed")?;
if !compacted {
bail!("nothing to compact");
}
return Ok(());
}
// -f: load from file
if let Some(path) = &cli.file {
let file = File::open(path).with_context(|| format!("Failed to open {path}"))?;
let reader = BufReader::new(file);
rp.load_props(reader.lines())
.context("Failed to load properties from file")?;
return Ok(());
}
// -d: delete
if cli.delete {
let name = cli
.name
.as_deref()
.context("--delete requires a property name")?;
let deleted = rp.delete(name).context("delete failed")?;
if !deleted {
bail!("{name} not found");
}
return Ok(());
}
match (&cli.name, &cli.value) {
// resetprop name value (set)
(Some(name), Some(value)) => {
rp.set(name, value)
.with_context(|| format!("Failed to set {name}"))?;
}
// resetprop name (get)
(Some(name), None) => match rp.get(name) {
Some(val) => println!("{val}"),
None => bail!("{name} not found"),
},
// resetprop (list all)
(None, None) => {
let props = rp.list_all().context("Failed to list properties")?;
for (name, value) in &props {
println!("[{name}]: [{value}]");
}
}
// resetprop — invalid
(None, Some(_)) => {
bail!("property name is required");
}
}
Ok(())
}
/// Load system.prop file using internal resetprop API.
///
/// Equivalent to `resetprop -n --file `.
#[allow(dead_code)]
pub fn load_system_prop_file(path: &Path) -> Result<()> {
sys_prop::init().context("Failed to initialize system property API")?;
let rp = ResetProp {
skip_svc: true,
persistent: false,
persist_only: false,
verbose: false,
show_context: false,
};
let file = File::open(path).with_context(|| format!("Failed to open {}", path.display()))?;
let reader = BufReader::new(file);
rp.load_props(reader.lines())
.with_context(|| format!("Failed to load properties from {}", path.display()))?;
info!("Loaded system.prop from {}", path.display());
Ok(())
}
================================================
FILE: apd/src/restorecon.rs
================================================
use std::path::Path;
use anyhow::Result;
#[cfg(any(target_os = "linux", target_os = "android"))]
use anyhow::{Context, Ok};
#[cfg(any(target_os = "linux", target_os = "android"))]
use extattr::{Flags as XattrFlags, lsetxattr};
use jwalk::{Parallelism::Serial, WalkDir};
use crate::defs;
pub const SYSTEM_CON: &str = "u:object_r:system_file:s0";
pub const ADB_CON: &str = "u:object_r:adb_data_file:s0";
pub const UNLABEL_CON: &str = "u:object_r:unlabeled:s0";
const SELINUX_XATTR: &str = "security.selinux";
pub fn lsetfilecon>(path: P, con: &str) -> Result<()> {
#[cfg(any(target_os = "linux", target_os = "android"))]
lsetxattr(&path, SELINUX_XATTR, con, XattrFlags::empty()).with_context(|| {
format!(
"Failed to change SELinux context for {}",
path.as_ref().display()
)
})?;
Ok(())
}
#[cfg(any(target_os = "linux", target_os = "android"))]
pub fn lgetfilecon>(path: P) -> Result {
let con = extattr::lgetxattr(&path, SELINUX_XATTR).with_context(|| {
format!(
"Failed to get SELinux context for {}",
path.as_ref().display()
)
})?;
let con = String::from_utf8_lossy(&con);
Ok(con.to_string())
}
#[cfg(any(target_os = "linux", target_os = "android"))]
pub fn setsyscon>(path: P) -> Result<()> {
lsetfilecon(path, SYSTEM_CON)
}
#[cfg(not(any(target_os = "linux", target_os = "android")))]
pub fn setsyscon>(path: P) -> Result<()> {
unimplemented!()
}
#[cfg(not(any(target_os = "linux", target_os = "android")))]
pub fn lgetfilecon>(path: P) -> Result {
unimplemented!()
}
pub fn restore_syscon>(dir: P) -> Result<()> {
for dir_entry in WalkDir::new(dir).parallelism(Serial) {
if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {
setsyscon(&path)?;
}
}
Ok(())
}
fn restore_syscon_if_unlabeled>(dir: P) -> Result<()> {
for dir_entry in WalkDir::new(dir).parallelism(Serial) {
if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {
if let Result::Ok(con) = lgetfilecon(&path) {
if con == UNLABEL_CON || con.is_empty() {
lsetfilecon(&path, SYSTEM_CON)?;
}
}
}
}
Ok(())
}
pub fn restorecon() -> Result<()> {
lsetfilecon(defs::DAEMON_PATH, ADB_CON)?;
restore_syscon_if_unlabeled(defs::MODULE_DIR)?;
Ok(())
}
================================================
FILE: apd/src/sepolicy.rs
================================================
use anyhow::{Context, Result, bail};
use clap::Parser;
use policy::{SePolicy, format_statement_help};
use std::io::{self, Write};
use std::path::PathBuf;
/// Write adapter for formatting
struct WriteAdapter(T);
impl std::fmt::Write for WriteAdapter {
fn write_str(&mut self, s: &str) -> std::fmt::Result {
self.0.write_all(s.as_bytes()).map_err(|_| std::fmt::Error)
}
}
/// MagiskPolicy - SELinux Policy Patch Tool
#[derive(Debug, clap::Args)]
#[allow(clippy::struct_excessive_bools)]
pub struct Args {
/// Load monolithic sepolicy from FILE
#[arg(long = "load", value_name = "FILE")]
load: Option,
/// Load from precompiled sepolicy or compile split cil policies
#[arg(long = "load-split")]
load_split: bool,
/// Compile split cil policies
#[arg(long = "compile-split")]
compile_split: bool,
/// Dump monolithic sepolicy to FILE
#[arg(long = "save", value_name = "FILE")]
save: Option,
/// Immediately load sepolicy into the kernel
#[arg(long = "live")]
live: bool,
/// Apply built-in Magisk sepolicy rules
#[arg(long = "magisk")]
magisk: bool,
/// Apply rules from FILE, read and parsed line by line as policy statements
#[arg(long = "apply", value_name = "FILE")]
apply: Vec,
/// Print all rules in the loaded sepolicy
#[arg(long = "print-rules")]
print_rules: bool,
/// Policy statements to apply
#[arg(required = false)]
policies: Vec,
}
#[derive(Parser)]
#[command(
name = "magiskpolicy",
version,
about = "SELinux Policy Patch Tool",
disable_help_subcommand = true
)]
struct MagiskPolicyParser {
#[command(flatten)]
arg: Args,
}
pub fn policy_main(args: &[String]) -> ! {
if let Err(err) = run_from_args(args) {
eprintln!("magiskpolicy: {err:#}");
std::process::exit(1);
}
std::process::exit(0);
}
/// Entry point for magiskpolicy multicall.
///
/// `args` should include argv[0] (the program name).
fn run_from_args(args: &[String]) -> Result<()> {
let parser = match MagiskPolicyParser::try_parse_from(args) {
Ok(cli) => cli,
Err(err) => {
if err.kind() == clap::error::ErrorKind::DisplayHelp {
print_usage(args.first().map(|s| s.as_str()).unwrap_or("magiskpolicy"));
return Ok(());
}
if err.kind() == clap::error::ErrorKind::DisplayVersion {
err.print()?;
return Ok(());
}
return Err(anyhow::anyhow!("{err}"));
}
};
execute(&parser.arg)
}
pub fn get_policy_main(args: &[String]) -> Result {
let parser = MagiskPolicyParser::try_parse_from(args)?;
let cli = parser.arg;
// Validate mutually exclusive options
let load_count = cli.load.iter().count() + cli.compile_split as usize + cli.load_split as usize;
if load_count > 1 {
bail!("Multiple load source supplied");
}
// Load policy
let mut sepol = if let Some(ref file) = cli.load {
SePolicy::from_file(file)
.with_context(|| format!("Cannot load policy from {}", file.display()))?
} else if cli.load_split {
SePolicy::from_split().context("Cannot load split policy")?
} else if cli.compile_split {
SePolicy::compile_split().context("Cannot compile split policy")?
} else {
SePolicy::from_file("/sys/fs/selinux/policy").context("Cannot load live policy")?
};
execute_next(&cli, &mut sepol)?;
Ok(sepol)
}
/// Execute magiskpolicy logic
/// Subcommand will direct call that, skip run_from_args
pub fn execute(cli: &Args) -> Result<()> {
// Validate mutually exclusive options
let load_count = cli.load.iter().count() + cli.compile_split as usize + cli.load_split as usize;
if load_count > 1 {
bail!("Multiple load source supplied");
}
// Load policy
let mut sepol = if let Some(ref file) = cli.load {
SePolicy::from_file(file)
.with_context(|| format!("Cannot load policy from {}", file.display()))?
} else if cli.load_split {
SePolicy::from_split().context("Cannot load split policy")?
} else if cli.compile_split {
SePolicy::compile_split().context("Cannot compile split policy")?
} else {
SePolicy::from_file("/sys/fs/selinux/policy").context("Cannot load live policy")?
};
execute_next(cli, &mut sepol)?;
Ok(())
}
fn execute_next(cli: &Args, sepol: &mut SePolicy) -> Result<()> {
if cli.print_rules {
if cli.magisk
|| !cli.apply.is_empty()
|| !cli.policies.is_empty()
|| cli.live
|| cli.save.is_some()
{
bail!("Cannot print rules with other options");
}
sepol.print_rules();
return Ok(());
}
if cli.magisk {
sepol.magisk_rules();
}
for file in &cli.apply {
sepol
.load_rule_file(file)
.with_context(|| format!("Cannot load rule file {}", file.display()))?;
}
for statement in &cli.policies {
sepol.load_rules(statement);
}
if cli.live {
sepol
.to_file("/sys/fs/selinux/load")
.context("Cannot apply policy")?;
}
if let Some(ref file) = cli.save {
sepol
.to_file(file)
.with_context(|| format!("Cannot dump policy to {}", file.display()))?;
}
Ok(())
}
/// Print usage information
fn print_usage(cmd: &str) {
eprintln!(
r#"MagiskPolicy - SELinux Policy Patch Tool
Usage: {cmd} [--options...] [policy statements...]
Options:
--help show help message for policy statements
--load FILE load monolithic sepolicy from FILE
--load-split load from precompiled sepolicy or compile
split cil policies
--compile-split compile split cil policies
--save FILE dump monolithic sepolicy to FILE
--live immediately load sepolicy into the kernel
--magisk apply built-in Magisk sepolicy rules
--apply FILE apply rules from FILE, read and parsed
line by line as policy statements
(multiple --apply are allowed)
--print-rules print all rules in the loaded sepolicy
If neither --load, --load-split, nor --compile-split is specified,
it will load from current live policies (/sys/fs/selinux/policy)
"#
);
let _ = format_statement_help(&mut WriteAdapter(io::stderr()));
eprintln!();
}
================================================
FILE: apd/src/supercall.rs
================================================
use std::{
ffi::{CStr, CString},
fs::File,
io::{self, Read},
process,
sync::{Arc, Mutex},
};
use libc::{c_long, c_void, syscall, uid_t, EINVAL};
use log::{error, info, warn};
use crate::package::{read_ap_package_config, synchronize_package_uid};
const MAJOR: c_long = 0;
const MINOR: c_long = 13;
const PATCH: c_long = 1;
const KSTORAGE_EXCLUDE_LIST_GROUP: i32 = 1;
const KSTORAGE_AUTO_EXCLUDE_GROUP: i32 = 3;
const __NR_SUPERCALL: c_long = 45;
const SUPERCALL_SU: c_long = 0x1010;
const SUPERCALL_KSTORAGE_WRITE: c_long = 0x1041;
const SUPERCALL_KSTORAGE_READ: c_long = 0x1042;
const SUPERCALL_SU_GRANT_UID: c_long = 0x1100;
const SUPERCALL_SU_REVOKE_UID: c_long = 0x1101;
const SUPERCALL_SU_NUMS: c_long = 0x1102;
const SUPERCALL_SU_LIST: c_long = 0x1103;
const SUPERCALL_SU_RESET_PATH: c_long = 0x1111;
const SUPERCALL_SU_GET_SAFEMODE: c_long = 0x1112;
const SUPERCALL_KPM_LOAD: c_long = 0x1020;
const SUPERCALL_UTS_SET: c_long = 0x1050;
const SUPERCALL_UTS_RESET: c_long = 0x1051;
const SUPERCALL_PATHHIDE_ENABLE: c_long = 0x1064;
const SUPERCALL_PATHHIDE_ADD: c_long = 0x1060;
const SUPERCALL_PATHHIDE_CLEAR: c_long = 0x1063;
const SUPERCALL_PATHHIDE_UID_MODE: c_long = 0x106A;
const SUPERCALL_PATHHIDE_UID_ADD: c_long = 0x1066;
const SUPERCALL_PATHHIDE_UID_CLEAR: c_long = 0x1069;
const SUPERCALL_PATHHIDE_FILTER_SYSTEM: c_long = 0x106B;
const SUPERCALL_NETISOLATE_ENABLE: c_long = 0x1070;
const SUPERCALL_NETISOLATE_UID_ADD: c_long = 0x1072;
const SUPERCALL_NETISOLATE_UID_REMOVE: c_long = 0x1073;
const SUPERCALL_NETISOLATE_UID_LIST: c_long = 0x1074;
const SUPERCALL_NETISOLATE_UID_CLEAR: c_long = 0x1075;
const SUPERCALL_SCONTEXT_LEN: usize = 0x60;
#[repr(C)]
struct SuProfile {
uid: i32,
to_uid: i32,
scontext: [u8; SUPERCALL_SCONTEXT_LEN],
}
fn ver_and_cmd(cmd: c_long) -> c_long {
let version_code: u32 = ((MAJOR << 16) + (MINOR << 8) + PATCH).try_into().unwrap();
((version_code as c_long) << 32) | (0x1158 << 16) | (cmd & 0xFFFF)
}
fn sc_su_revoke_uid(key: &CStr, uid: uid_t) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_SU_REVOKE_UID),
uid,
) as c_long
}
}
fn sc_su_grant_uid(key: &CStr, profile: &SuProfile) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_SU_GRANT_UID),
profile,
) as c_long
}
}
fn sc_kstorage_write(
key: &CStr,
gid: i32,
did: i64,
data: *mut c_void,
offset: i32,
dlen: i32,
) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_KSTORAGE_WRITE),
gid as c_long,
did as c_long,
data,
(((offset as i64) << 32) | (dlen as i64)) as c_long,
) as c_long
}
}
fn sc_kstorage_read(
key: &CStr,
gid: i32,
did: i64,
out_data: *mut c_void,
offset: i32,
dlen: i32,
) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_KSTORAGE_READ),
gid as c_long,
did as c_long,
out_data,
(((offset as i64) << 32) | (dlen as i64)) as c_long,
) as c_long
}
}
fn sc_set_ap_mod_exclude(key: &CStr, uid: i64, exclude: i32) -> c_long {
sc_kstorage_write(
key,
KSTORAGE_EXCLUDE_LIST_GROUP,
uid,
&exclude as *const i32 as *mut c_void,
0,
size_of::() as i32,
)
}
pub fn get_new_app_profile_mode() -> i32 {
let key = CStr::from_bytes_with_nul(b"su\0").expect("auto exclude key init failed");
let mut enabled = 0_i32;
let rc = sc_kstorage_read(
key,
KSTORAGE_AUTO_EXCLUDE_GROUP,
0,
&mut enabled as *mut i32 as *mut c_void,
0,
size_of::() as i32,
);
if rc < 0 {
return 0;
}
enabled
}
pub fn sc_su_get_safemode(key: &CStr) -> c_long {
if key.to_bytes().is_empty() {
warn!("[sc_su_get_safemode] null superkey, tell apd we are not in safemode!");
return 0;
}
let key_ptr = key.as_ptr();
if key_ptr.is_null() {
warn!("[sc_su_get_safemode] superkey pointer is null!");
return 0;
}
unsafe {
syscall(
__NR_SUPERCALL,
key_ptr,
ver_and_cmd(SUPERCALL_SU_GET_SAFEMODE),
) as c_long
}
}
fn sc_su(key: &CStr, profile: &SuProfile) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_SU),
profile,
) as c_long
}
}
fn sc_su_reset_path(key: &CStr, path: &CStr) -> c_long {
if key.to_bytes().is_empty() || path.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_SU_RESET_PATH),
path.as_ptr(),
) as c_long
}
}
fn sc_kpm_load(key: &CStr, path: &CStr, args: &CStr) -> c_long {
if key.to_bytes().is_empty() || path.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_KPM_LOAD),
path.as_ptr(),
args.as_ptr(),
std::ptr::null::(),
) as c_long
}
}
fn sc_su_uid_nums(key: &CStr) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe { syscall(__NR_SUPERCALL, key.as_ptr(), ver_and_cmd(SUPERCALL_SU_NUMS)) as c_long }
}
fn sc_su_allow_uids(key: &CStr, buf: &mut [uid_t]) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
if buf.is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_SU_LIST),
buf.as_mut_ptr(),
buf.len() as i32,
) as c_long
}
}
fn read_file_to_string(path: &str) -> io::Result {
let mut file = File::open(path)?;
let mut content = String::new();
file.read_to_string(&mut content)?;
Ok(content)
}
fn convert_string_to_u8_array(s: &str) -> [u8; SUPERCALL_SCONTEXT_LEN] {
let mut u8_array = [0u8; SUPERCALL_SCONTEXT_LEN];
let bytes = s.as_bytes();
let len = usize::min(SUPERCALL_SCONTEXT_LEN, bytes.len());
u8_array[..len].copy_from_slice(&bytes[..len]);
u8_array
}
fn convert_superkey(s: &Option) -> Option {
s.as_ref().and_then(|s| CString::new(s.clone()).ok())
}
pub fn refresh_ap_package_list(skey: &CStr, mutex: &Arc>) {
let _lock = mutex.lock().unwrap();
if let Err(e) = synchronize_package_uid() {
error!("Failed to synchronize package UIDs: {}", e);
}
let package_configs = read_ap_package_config();
let num = sc_su_uid_nums(skey);
if num < 0 {
error!("[refresh_su_list] Error getting number of UIDs: {}", num);
return;
}
let num = num as usize;
let mut uids = vec![0 as uid_t; num];
let n = sc_su_allow_uids(skey, &mut uids);
if n < 0 {
error!("[refresh_su_list] Error getting su list");
return;
}
let granted_uids: std::collections::HashSet = package_configs
.iter()
.filter(|c| c.allow == 1 && c.exclude == 0)
.map(|c| c.uid as uid_t)
.collect();
for uid in &uids {
if *uid == 0 || *uid == 2000 {
continue;
}
if granted_uids.contains(uid) {
continue;
}
info!(
"[refresh_ap_package_list] Revoking {} root permission...",
uid
);
let rc = sc_su_revoke_uid(skey, *uid);
if rc != 0 {
error!("[refresh_ap_package_list] Error revoking UID: {}", rc);
}
}
for config in &package_configs {
if config.allow == 1 && config.exclude == 0 {
let profile = SuProfile {
uid: config.uid,
to_uid: config.to_uid,
scontext: convert_string_to_u8_array(&config.sctx),
};
let result = sc_su_grant_uid(skey, &profile);
info!(
"[refresh_ap_package_list] Loading {}: result = {}",
config.pkg, result
);
}
if config.allow == 0 && config.exclude == 1 {
let result = sc_set_ap_mod_exclude(skey, config.uid as i64, 1);
info!(
"[refresh_ap_package_list] Loading exclude {}: result = {}",
config.pkg, result
);
}
}
}
pub fn privilege_apd_profile(superkey: &Option) {
let key = convert_superkey(superkey);
let all_allow_ctx = "u:r:magisk:s0";
let profile = SuProfile {
uid: process::id().try_into().expect("PID conversion failed"),
to_uid: 0,
scontext: convert_string_to_u8_array(all_allow_ctx),
};
if let Some(ref key) = key {
let result = sc_su(key, &profile);
info!("[privilege_apd_profile] result = {}", result);
}
}
pub fn init_load_su_path(superkey: &Option) {
let su_path_file = "/data/adb/ap/su_path";
match read_file_to_string(su_path_file) {
Ok(su_path) => {
let superkey_cstr = convert_superkey(superkey);
match superkey_cstr {
Some(superkey_cstr) => match CString::new(su_path.trim()) {
Ok(su_path_cstr) => {
let result = sc_su_reset_path(&superkey_cstr, &su_path_cstr);
if result == 0 {
info!("suPath load successfully");
} else {
warn!("Failed to load su path, error code: {}", result);
}
}
Err(e) => {
warn!("Failed to convert su_path: {}", e);
}
},
_ => {
warn!("Superkey is None, skipping...");
}
}
}
Err(e) => {
warn!("Failed to read su_path file: {}", e);
}
}
}
pub fn autoload_kpm_modules(superkey: &Option, event_filter: &str) {
use serde::Deserialize;
#[derive(Deserialize, Default)]
struct KpmAutoLoadEntry {
path: String,
#[serde(default = "default_event")]
event: String,
#[serde(default)]
args: String,
}
fn default_event() -> String {
"service".to_string()
}
#[derive(Deserialize, Default)]
struct KpmAutoLoadConfig {
enabled: bool,
#[serde(default, rename = "kpmEntries")]
kpm_entries: Vec,
}
let config_path = crate::defs::KPM_AUTOLOAD_CONFIG;
let content = match std::fs::read_to_string(config_path) {
Ok(c) => c,
Err(e) => {
info!("[kpm_autoload] config not found or unreadable ({}): {}", config_path, e);
return;
}
};
let config: KpmAutoLoadConfig = match serde_json::from_str(&content) {
Ok(c) => c,
Err(e) => {
warn!("[kpm_autoload] failed to parse config: {}", e);
return;
}
};
if !config.enabled || config.kpm_entries.is_empty() {
info!("[kpm_autoload] disabled or no entries configured, skipping");
return;
}
let key = convert_superkey(superkey);
let key = match key {
Some(k) => k,
None => {
warn!("[kpm_autoload] no superkey available");
return;
}
};
const MAX_KPM_MODULES: usize = 64;
if config.kpm_entries.len() > MAX_KPM_MODULES {
warn!(
"[kpm_autoload] too many entries ({}), truncating to {}",
config.kpm_entries.len(),
MAX_KPM_MODULES
);
}
let mut success = 0u32;
let mut fail = 0u32;
for entry in config.kpm_entries.iter().take(MAX_KPM_MODULES) {
if entry.event != event_filter {
info!("[kpm_autoload] skipping '{}' (event='{}', expected='{}')", entry.path, entry.event, event_filter);
continue;
}
let path_str = &entry.path;
if !std::path::Path::new(path_str).exists() {
warn!("[kpm_autoload] file not found: {}", path_str);
fail += 1;
continue;
}
let canonical = match std::fs::canonicalize(path_str) {
Ok(p) => p,
Err(e) => {
warn!("[kpm_autoload] cannot canonicalize '{}': {}", path_str, e);
fail += 1;
continue;
}
};
let allowed_dir = std::path::Path::new(crate::defs::FP_KPMS_AUTOLOAD_DIR);
if !canonical.starts_with(allowed_dir) {
warn!(
"[kpm_autoload] path '{}' outside allowed directory '{}', skipping",
path_str,
crate::defs::FP_KPMS_AUTOLOAD_DIR
);
fail += 1;
continue;
}
let path_cstr = match CString::new(canonical.to_string_lossy().into_owned()) {
Ok(c) => c,
Err(e) => {
warn!("[kpm_autoload] invalid canonical path: {}", e);
fail += 1;
continue;
}
};
let args_cstr = match CString::new(entry.args.clone()) {
Ok(c) => c,
Err(e) => {
warn!("[kpm_autoload] invalid args for '{}': {}", path_str, e);
fail += 1;
continue;
}
};
info!("[kpm_autoload] loading '{}' with event='{}' args='{}'", path_str, entry.event, entry.args);
let rc = sc_kpm_load(&key, &path_cstr, &args_cstr);
if rc == 0 {
success += 1;
info!("[kpm_autoload] loaded: {}", path_str);
} else {
fail += 1;
warn!("[kpm_autoload] failed to load '{}', rc={}", path_str, rc);
}
}
info!("[kpm_autoload] done: success={}, fail={}", success, fail);
}
fn sc_pathhide_enable(key: &CStr, enable: bool) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_ENABLE),
if enable { 1i64 } else { 0i64 },
) as c_long
}
}
fn sc_pathhide_add(key: &CStr, path: &CStr) -> c_long {
if key.to_bytes().is_empty() || path.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_ADD),
path.as_ptr(),
) as c_long
}
}
fn sc_pathhide_clear(key: &CStr) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_CLEAR),
) as c_long
}
}
fn sc_pathhide_uid_mode(key: &CStr, enable: bool) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_UID_MODE),
if enable { 1i64 } else { 0i64 },
) as c_long
}
}
fn sc_pathhide_filter_system(key: &CStr, enable: bool) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_FILTER_SYSTEM),
if enable { 1i64 } else { 0i64 },
) as c_long
}
}
fn sc_pathhide_uid_add(key: &CStr, uid: i32) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_UID_ADD),
uid,
) as c_long
}
}
fn sc_pathhide_uid_clear(key: &CStr) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_PATHHIDE_UID_CLEAR),
) as c_long
}
}
fn sc_netisolate_enable(key: &CStr, enable: bool) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_NETISOLATE_ENABLE),
if enable { 1i64 } else { 0i64 },
) as c_long
}
}
fn sc_netisolate_uid_add(key: &CStr, uid: i32) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_NETISOLATE_UID_ADD),
uid,
) as c_long
}
}
fn sc_netisolate_uid_clear(key: &CStr) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_NETISOLATE_UID_CLEAR),
) as c_long
}
}
pub fn apply_netisolate(superkey: &Option) {
if !std::path::Path::new(crate::defs::NETISOLATE_ENABLE_FILE).exists() {
info!("[netisolate] disabled, skipping");
return;
}
let key = convert_superkey(superkey);
let key = match key {
Some(k) => k,
None => {
warn!("[netisolate] no superkey available");
return;
}
};
// Step 1: Clear and populate UID blocklist (netisolate not yet enabled)
match std::fs::read_to_string(crate::defs::NETISOLATE_UIDS_FILE) {
Ok(uids) => {
sc_netisolate_uid_clear(&key);
let mut count = 0u32;
for uid_str in uids.lines() {
let uid_str = uid_str.trim();
if uid_str.is_empty() {
continue;
}
match uid_str.parse::() {
Ok(uid) => {
let rc = sc_netisolate_uid_add(&key, uid);
if rc < 0 {
warn!("[netisolate] add uid {} failed: {}", uid, rc);
} else {
count += 1;
}
}
Err(_) => {
warn!("[netisolate] invalid uid: '{}'", uid_str);
}
}
}
info!("[netisolate] {} uids restored", count);
}
Err(_) => {
info!("[netisolate] no uids file");
}
}
// Step 2: Enable netisolate LAST
let rc = sc_netisolate_enable(&key, true);
if rc < 0 {
warn!("[netisolate] enable failed: {}", rc);
return;
}
info!("[netisolate] auto-apply completed");
}
pub fn apply_pathhide(superkey: &Option) {
if !std::path::Path::new(crate::defs::PATHHIDE_ENABLE_FILE).exists() {
info!("[pathhide] disabled, skipping");
return;
}
let key = convert_superkey(superkey);
let key = match key {
Some(k) => k,
None => {
warn!("[pathhide] no superkey available");
return;
}
};
// Step 1: Clear and populate blocklist (pathhide not yet enabled, hooks are no-ops)
match std::fs::read_to_string(crate::defs::PATHHIDE_PATHS_FILE) {
Ok(paths) => {
sc_pathhide_clear(&key);
let mut count = 0u32;
for path in paths.lines() {
let path = path.trim();
if path.is_empty() {
continue;
}
match CString::new(path) {
Ok(path_cstr) => {
let rc = sc_pathhide_add(&key, &path_cstr);
if rc < 0 {
warn!("[pathhide] add path '{}' failed: {}", path, rc);
} else {
count += 1;
}
}
Err(e) => {
warn!("[pathhide] invalid path '{}': {}", path, e);
}
}
}
info!("[pathhide] {} paths restored", count);
}
Err(_) => {
info!("[pathhide] no paths file, clearing blocklist");
sc_pathhide_clear(&key);
}
}
// Step 2: Configure UID whitelist BEFORE enabling (so filters are ready)
if std::path::Path::new(crate::defs::PATHHIDE_UID_MODE_FILE).exists() {
match std::fs::read_to_string(crate::defs::PATHHIDE_UIDS_FILE) {
Ok(uids) => {
sc_pathhide_uid_clear(&key);
let mut count = 0u32;
for uid_str in uids.lines() {
let uid_str = uid_str.trim();
if uid_str.is_empty() {
continue;
}
match uid_str.parse::() {
Ok(uid) => {
let rc = sc_pathhide_uid_add(&key, uid);
if rc < 0 {
warn!("[pathhide] add uid {} failed: {}", uid, rc);
} else {
count += 1;
}
}
Err(_) => {
warn!("[pathhide] invalid uid: '{}'", uid_str);
}
}
}
info!("[pathhide] {} uids restored", count);
}
Err(_) => {
info!("[pathhide] no uids file");
}
}
let rc = sc_pathhide_uid_mode(&key, true);
if rc < 0 {
warn!("[pathhide] uid mode enable failed: {}", rc);
}
}
// Step 2.5: Configure filter_system (allow hiding from system/root UIDs)
if std::path::Path::new(crate::defs::PATHHIDE_FILTER_SYSTEM_FILE).exists() {
let rc = sc_pathhide_filter_system(&key, true);
if rc < 0 {
warn!("[pathhide] filter_system enable failed: {}", rc);
}
}
// Step 3: Enable pathhide LAST (all config is now in place)
let rc = sc_pathhide_enable(&key, true);
if rc < 0 {
warn!("[pathhide] enable failed: {}", rc);
return;
}
info!("[pathhide] auto-apply completed");
}
fn sc_uts_set(key: &CStr, release: Option<&CStr>, version: Option<&CStr>) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
let release_ptr = match release {
Some(r) => r.as_ptr(),
None => std::ptr::null(),
};
let version_ptr = match version {
Some(v) => v.as_ptr(),
None => std::ptr::null(),
};
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_UTS_SET),
release_ptr,
version_ptr,
) as c_long
}
}
fn sc_uts_reset(key: &CStr) -> c_long {
if key.to_bytes().is_empty() {
return (-EINVAL).into();
}
unsafe {
syscall(
__NR_SUPERCALL,
key.as_ptr(),
ver_and_cmd(SUPERCALL_UTS_RESET),
) as c_long
}
}
pub fn apply_uts_spoof(superkey: &Option) {
use std::path::Path;
const MAX_BOOT_RETRIES: u32 = 3;
if !Path::new(crate::defs::UTS_SPOOF_ENABLE_FILE).exists() {
info!("[uts_spoof] disabled, skipping");
return;
}
let config_content = match std::fs::read_to_string(crate::defs::UTS_SPOOF_CONFIG_FILE) {
Ok(c) => c,
Err(e) => {
warn!("[uts_spoof] failed to read config: {}", e);
return;
}
};
let config: serde_json::Value = match serde_json::from_str(&config_content) {
Ok(v) => v,
Err(e) => {
warn!("[uts_spoof] failed to parse config: {}", e);
return;
}
};
let release = config.get("release").and_then(|v| v.as_str()).unwrap_or("");
let version = config.get("version").and_then(|v| v.as_str()).unwrap_or("");
let key = convert_superkey(superkey);
let key = match key {
Some(k) => k,
None => {
warn!("[uts_spoof] no superkey available");
return;
}
};
let _ = sc_uts_reset(&key);
let retries = match std::fs::read_to_string(crate::defs::UTS_SPOOF_BOOT_PENDING) {
Ok(s) => s.trim().parse::().unwrap_or(0),
Err(_) => 0,
};
if retries >= MAX_BOOT_RETRIES {
warn!(
"[uts_spoof] boot pending retries ({}) >= max ({}), skipping spoof to prevent bootloop",
retries, MAX_BOOT_RETRIES
);
let _ = std::fs::remove_file(crate::defs::UTS_SPOOF_BOOT_PENDING);
return;
}
if let Err(e) = std::fs::write(crate::defs::UTS_SPOOF_BOOT_PENDING, (retries + 1).to_string()) {
warn!("[uts_spoof] failed to write boot pending flag: {}", e);
}
// Only set if we have values to spoof
let release_cstr = if !release.is_empty() {
match CString::new(release) {
Ok(c) => Some(c),
Err(e) => {
warn!("[uts_spoof] invalid release string: {}", e);
None
}
}
} else {
None
};
let version_cstr = if !version.is_empty() {
match CString::new(version) {
Ok(c) => Some(c),
Err(e) => {
warn!("[uts_spoof] invalid version string: {}", e);
None
}
}
} else {
None
};
if release_cstr.is_some() || version_cstr.is_some() {
let rc = sc_uts_set(
&key,
release_cstr.as_deref(),
version_cstr.as_deref(),
);
if rc == 0 {
info!("[uts_spoof] applied: release='{}' version='{}'", release, version);
} else {
warn!("[uts_spoof] set failed: {}", rc);
}
} else {
info!("[uts_spoof] config has empty values, skipping set");
}
}
================================================
FILE: apd/src/utils.rs
================================================
#[allow(unused_imports)]
use std::fs::{Permissions, set_permissions};
#[cfg(unix)]
use std::os::unix::prelude::PermissionsExt;
use std::{
ffi::CString,
fs::{File, OpenOptions, create_dir_all, metadata},
io::{ErrorKind::AlreadyExists, Write},
path::Path,
process::{Command, Stdio},
};
use anyhow::{Context, Error, Ok, Result, bail};
use log::{info, warn};
use crate::{defs, supercall::sc_su_get_safemode};
pub fn ensure_file_exists>(file: T) -> Result<()> {
match File::options().write(true).create_new(true).open(&file) {
Result::Ok(_) => Ok(()),
Err(err) => {
if err.kind() == AlreadyExists && file.as_ref().is_file() {
Ok(())
} else {
Err(Error::from(err))
.with_context(|| format!("{} is not a regular file", file.as_ref().display()))
}
}
}
}
pub fn ensure_dir_exists>(dir: T) -> Result<()> {
let result = create_dir_all(&dir).map_err(Error::from);
if dir.as_ref().is_dir() {
result
} else if result.is_ok() {
bail!("{} is not a regular directory", dir.as_ref().display())
} else {
result
}
}
pub fn ensure_dir_with_perms(dir: &Path, parent: &Path, mode: u32) -> Result<()> {
if dir.exists() {
return Ok(());
}
create_dir_all(dir)
.with_context(|| format!("Failed to create {} directory", dir.display()))?;
let permissions = Permissions::from_mode(mode);
set_permissions(parent, permissions.clone())
.with_context(|| format!("Failed to set permissions for {}", parent.display()))?;
set_permissions(dir, permissions)
.with_context(|| format!("Failed to set permissions for {}", dir.display()))?;
info!("Created directory: {}", dir.display());
Ok(())
}
// todo: ensure
pub fn ensure_binary>(path: T) -> Result<()> {
set_permissions(&path, Permissions::from_mode(0o755))?;
Ok(())
}
pub fn get_work_dir() -> &'static str {
defs::WORKING_DIR
}
#[cfg(any(target_os = "linux", target_os = "android"))]
pub fn getprop(prop: &str) -> Option {
android_properties::getprop(prop).value()
}
#[cfg(not(any(target_os = "linux", target_os = "android")))]
pub fn getprop(_prop: &str) -> Option {
unimplemented!()
}
pub fn run_command(
command: &str,
args: &[&str],
stdout: Option,
) -> Result {
let mut command_builder = Command::new(command);
command_builder.args(args);
if let Some(out) = stdout {
command_builder.stdout(out);
}
let child = command_builder.spawn()?;
Ok(child)
}
pub fn is_safe_mode(superkey: Option) -> bool {
let safemode = getprop("persist.sys.safemode")
.filter(|prop| prop == "1")
.is_some()
|| getprop("ro.sys.safemode")
.filter(|prop| prop == "1")
.is_some();
info!("safemode: {}", safemode);
if safemode {
return true;
}
let safemode = superkey
.as_ref()
.and_then(|key_str| CString::new(key_str.as_str()).ok())
.map_or_else(
|| {
warn!("[is_safe_mode] No valid superkey provided, assuming safemode as false.");
false
},
|cstr| sc_su_get_safemode(&cstr) == 1,
);
info!("kernel_safemode: {}", safemode);
safemode
}
#[cfg(any(target_os = "linux", target_os = "android"))]
pub fn switch_mnt_ns(pid: i32) -> Result<()> {
use std::os::fd::AsRawFd;
use anyhow::ensure;
let path = format!("/proc/{pid}/ns/mnt");
let fd = File::open(path)?;
let current_dir = std::env::current_dir();
let ret = unsafe { libc::setns(fd.as_raw_fd(), libc::CLONE_NEWNS) };
if let Result::Ok(current_dir) = current_dir {
let _ = std::env::set_current_dir(current_dir);
}
ensure!(ret == 0, "switch mnt ns failed");
Ok(())
}
fn switch_cgroup(grp: &str, pid: u32) {
let path = Path::new(grp).join("cgroup.procs");
if !path.exists() {
return;
}
let fp = OpenOptions::new().append(true).open(path);
if let Result::Ok(mut fp) = fp {
let _ = write!(fp, "{pid}");
}
}
pub fn switch_cgroups() {
let pid = std::process::id();
switch_cgroup("/acct", pid);
switch_cgroup("/dev/cg2_bpf", pid);
switch_cgroup("/sys/fs/cgroup", pid);
if getprop("ro.config.per_app_memcg")
.filter(|prop| prop == "false")
.is_none()
{
switch_cgroup("/dev/memcg/apps", pid);
}
}
#[cfg(any(target_os = "linux", target_os = "android"))]
pub fn umask(mask: u32) {
unsafe { libc::umask(mask) };
}
#[cfg(not(any(target_os = "linux", target_os = "android")))]
pub fn umask(_mask: u32) {
unimplemented!("umask is not supported on this platform")
}
pub fn has_magisk() -> bool {
which::which("magisk").is_ok()
}
pub fn get_tmp_path() -> &'static str {
if metadata(defs::TEMP_DIR_LEGACY).is_ok() {
return defs::TEMP_DIR_LEGACY;
}
if metadata(defs::TEMP_DIR).is_ok() {
return defs::TEMP_DIR;
}
""
}
================================================
FILE: app/.gitignore
================================================
/build
/release/
*.jks
*.keystore
keystore.properties
================================================
FILE: app/build.gradle.kts
================================================
@file:Suppress("UnstableApiUsage")
import com.android.build.gradle.tasks.PackageAndroidArtifact
import org.jetbrains.kotlin.gradle.dsl.JvmTarget
import java.net.URI
import java.util.Properties
import java.io.File
import java.io.FileInputStream
plugins {
alias(libs.plugins.agp.app)
alias(libs.plugins.kotlin)
alias(libs.plugins.kotlin.compose.compiler)
alias(libs.plugins.ksp)
alias(libs.plugins.lsplugin.apksign)
alias(libs.plugins.lsplugin.resopt)
alias(libs.plugins.lsplugin.cmaker)
id("kotlin-parcelize")
}
val androidCompileSdkVersion: Int by rootProject.extra
val androidCompileNdkVersion: String by rootProject.extra
val androidBuildToolsVersion: String by rootProject.extra
val androidMinSdkVersion: Int by rootProject.extra
val androidTargetSdkVersion: Int by rootProject.extra
val androidSourceCompatibility: JavaVersion by rootProject.extra
val androidTargetCompatibility: JavaVersion by rootProject.extra
val managerVersionCode: Int by rootProject.extra
val managerVersionName: String by rootProject.extra
val branchName: String by rootProject.extra
val kernelPatchVersion: String by rootProject.extra
// Load keystore properties
val keystoreProperties = Properties()
val keystorePropertiesFile = rootProject.file("keystore.properties")
if (keystorePropertiesFile.exists()) {
keystoreProperties.load(FileInputStream(keystorePropertiesFile))
}
// Load local properties
val localProperties = Properties()
val localPropertiesFile = rootProject.file("local.properties")
if (localPropertiesFile.exists()) {
localProperties.load(FileInputStream(localPropertiesFile))
}
apksign {
storeFileProperty = "KEYSTORE_FILE"
storePasswordProperty = "KEYSTORE_PASSWORD"
keyAliasProperty = "KEY_ALIAS"
keyPasswordProperty = "KEY_PASSWORD"
}
val ccache = System.getenv("PATH")?.split(File.pathSeparator)
?.map { File(it, "ccache") }?.firstOrNull { it.exists() }?.absolutePath
val baseFlags = listOf(
"-Wall", "-Qunused-arguments", "-fno-rtti", "-fvisibility=hidden",
"-fvisibility-inlines-hidden", "-fno-exceptions", "-fno-stack-protector",
"-fomit-frame-pointer", "-Wno-builtin-macro-redefined", "-Wno-unused-value",
"-D__FILE__=__FILE_NAME__",
"-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON", "-Wno-unused", "-Wno-unused-parameter",
"-Wno-unused-command-line-argument", "-Wno-incompatible-function-pointer-types",
"-U_FORTIFY_SOURCE", "-D_FORTIFY_SOURCE=0"
)
val baseArgs = mutableListOf(
"-DANDROID_STL=none", "-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON",
"-DCMAKE_CXX_STANDARD=23", "-DCMAKE_C_STANDARD=23",
"-DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON", "-DCMAKE_VISIBILITY_INLINES_HIDDEN=ON",
"-DCMAKE_CXX_VISIBILITY_PRESET=hidden", "-DCMAKE_C_VISIBILITY_PRESET=hidden"
).apply { if (ccache != null) add("-DANDROID_CCACHE=$ccache") }
android {
namespace = "me.bmax.apatch"
signingConfigs {
create("release") {
storeFile = file(keystoreProperties.getProperty("KEYSTORE_FILE") ?: "debug.keystore")
storePassword = keystoreProperties.getProperty("KEYSTORE_PASSWORD") ?: "android"
keyAlias = keystoreProperties.getProperty("KEY_ALIAS") ?: "androiddebugkey"
keyPassword = keystoreProperties.getProperty("KEY_PASSWORD") ?: "android"
enableV1Signing = true
enableV2Signing = true
enableV3Signing = true
enableV4Signing = true
}
}
buildTypes {
debug {
isDebuggable = true
isMinifyEnabled = false
isShrinkResources = false
proguardFiles(
getDefaultProguardFile("proguard-android-optimize.txt"),
"proguard-rules.pro"
)
externalNativeBuild {
cmake {
arguments += listOf("-DCMAKE_CXX_FLAGS_DEBUG=-Og", "-DCMAKE_C_FLAGS_DEBUG=-Og")
}
}
}
release {
isMinifyEnabled = true
isShrinkResources = true
isDebuggable = false
multiDexEnabled = true
vcsInfo.include = false
if (keystorePropertiesFile.exists()) {
signingConfig = signingConfigs.getByName("release")
}
proguardFiles(
getDefaultProguardFile("proguard-android-optimize.txt"),
"proguard-rules.pro"
)
externalNativeBuild {
cmake {
val relFlags = listOf(
"-flto", "-ffunction-sections", "-fdata-sections", "-Wl,--gc-sections",
"-fno-unwind-tables", "-fno-asynchronous-unwind-tables", "-Wl,--exclude-libs,ALL",
"-Ofast", "-fmerge-all-constants", "-flto=full", "-ffat-lto-objects",
"-fno-semantic-interposition", "-fno-threadsafe-statics"
)
cppFlags += relFlags
cFlags += relFlags
arguments += listOf("-DCMAKE_BUILD_TYPE=Release", "-DCMAKE_CXX_FLAGS_RELEASE=-O3 -DNDEBUG", "-DCMAKE_C_FLAGS_RELEASE=-O3 -DNDEBUG")
}
}
}
}
dependenciesInfo.includeInApk = false
buildFeatures {
aidl = true
buildConfig = true
compose = true
prefab = true
}
defaultConfig {
applicationId = "me.yuki.folk"
minSdk = androidMinSdkVersion
targetSdk = androidTargetSdkVersion
versionCode = managerVersionCode
versionName = managerVersionName
buildConfigField("String", "buildKPV", "\"$kernelPatchVersion\"")
buildConfigField("boolean", "DEBUG_FAKE_ROOT", localProperties.getProperty("debug.fake_root", "false"))
base.archivesName = "FolkPatch_${managerVersionCode}_${managerVersionName}_on_${branchName}"
ndk.abiFilters.addAll(arrayOf("arm64-v8a"))
externalNativeBuild {
cmake {
cppFlags += baseFlags + "-std=c++2b"
cFlags += baseFlags + "-std=c2x"
arguments += baseArgs
// Pass Token and Signature Hash to CMake
val authProps = Properties()
val authFile = rootProject.file("auth.properties")
if (authFile.exists()) {
authProps.load(FileInputStream(authFile))
}
val token = authProps.getProperty("api.token", "")
val signatureHash = authProps.getProperty("app.signature.hash", "")
// Pass to C++ compiler directly via flags
// Only add flags if values are non-empty to avoid compiler errors
if (token.isNotEmpty()) {
cppFlags += "-DAPI_TOKEN=\"$token\""
}
if (signatureHash.isNotEmpty()) {
cppFlags += "-DAPP_SIGNATURE_HASH=\"$signatureHash\""
}
cppFlags += "-DAPP_PACKAGE_NAME=\"$applicationId\""
abiFilters("arm64-v8a")
}
}
}
compileOptions {
sourceCompatibility = JavaVersion.VERSION_21
targetCompatibility = JavaVersion.VERSION_21
}
packaging {
jniLibs {
useLegacyPackaging = true
}
resources {
excludes += "**"
merges += "META-INF/com/google/android/**"
}
}
externalNativeBuild {
cmake {
version = "3.28.0+"
path("src/main/cpp/CMakeLists.txt")
}
}
androidResources {
generateLocaleConfig = true
}
compileSdk = androidCompileSdkVersion
ndkVersion = androidCompileNdkVersion
buildToolsVersion = androidBuildToolsVersion
lint {
abortOnError = false
checkReleaseBuilds = false
}
android.sourceSets.named("main") {
kotlin.directories += "build/generated/ksp/$name/kotlin"
jniLibs.directories += "libs"
}
}
// https://stackoverflow.com/a/77745844
tasks.withType {
doFirst { appMetadata.asFile.orNull?.writeText("") }
}
java {
toolchain {
languageVersion = JavaLanguageVersion.of(21)
}
}
kotlin {
jvmToolchain(21)
compilerOptions {
jvmTarget = JvmTarget.JVM_21
}
}
fun registerDownloadTask(
taskName: String, srcUrl: String, destPath: String, project: Project, version: String? = null
) {
project.tasks.register(taskName) {
val destFile = File(destPath)
val versionFile = File("$destPath.version")
doLast {
var forceDownload = false
if (version != null) {
if (!versionFile.exists() || versionFile.readText().trim() != version) {
forceDownload = true
}
}
if (!destFile.exists() || forceDownload || isFileUpdated(srcUrl, destFile)) {
println(" - Downloading $srcUrl to ${destFile.absolutePath}")
downloadFile(srcUrl, destFile)
if (version != null) {
versionFile.writeText(version)
}
println(" - Download completed.")
} else {
println(" - File is up-to-date, skipping download.")
}
}
}
}
fun isFileUpdated(url: String, localFile: File): Boolean {
val connection = URI.create(url).toURL().openConnection()
val remoteLastModified = connection.getHeaderFieldDate("Last-Modified", 0L)
return remoteLastModified > localFile.lastModified()
}
fun downloadFile(url: String, destFile: File) {
URI.create(url).toURL().openStream().use { input ->
destFile.outputStream().use { output ->
input.copyTo(output)
}
}
}
registerDownloadTask(
taskName = "downloadKpimg",
srcUrl = "https://github.com/LyraVoid/KernelPatch/releases/download/$kernelPatchVersion/kpimg-android",
destPath = "${project.projectDir}/src/main/assets/kpimg",
project = project,
version = kernelPatchVersion
)
registerDownloadTask(
taskName = "downloadKptools",
srcUrl = "https://github.com/LyraVoid/KernelPatch/releases/download/$kernelPatchVersion/kptools-android",
destPath = "${project.projectDir}/libs/arm64-v8a/libkptools.so",
project = project,
version = kernelPatchVersion
)
// Compat kp version less than 0.10.7
// TODO: Remove in future
registerDownloadTask(
taskName = "downloadCompatKpatch",
srcUrl = "https://github.com/bmax121/KernelPatch/releases/download/0.10.7/kpatch-android",
destPath = "${project.projectDir}/libs/arm64-v8a/libkpatch.so",
project = project,
version = "0.10.7"
)
tasks.register("mergeScripts") {
into("${project.projectDir}/src/main/resources/META-INF/com/google/android")
from(rootProject.file("${project.rootDir}/scripts/update_binary.sh")) {
rename { "update-binary" }
}
from(rootProject.file("${project.rootDir}/scripts/update_script.sh")) {
rename { "updater-script" }
}
}
// Build fpd (FolkPatch service binary) for arm64
tasks.register("buildFpd") {
executable("cargo")
args("ndk", "-t", "arm64-v8a", "build", "--release")
workingDir("${project.rootDir}/fpd")
doFirst {
println("Building fpd for arm64...")
}
doLast {
val fpdBinary = file("${project.rootDir}/fpd/target/aarch64-linux-android/release/fpd")
val serviceDir = file("src/main/assets/Service")
serviceDir.mkdirs()
fpdBinary.copyTo(file("${serviceDir}/fpd"), overwrite = true)
println("fpd binary built and copied to Service/fpd")
}
}
tasks.getByName("preBuild").dependsOn(
"downloadKpimg",
"downloadKptools",
"downloadCompatKpatch",
"mergeScripts",
"buildFpd",
)
// https://github.com/bbqsrc/cargo-ndk
// cargo ndk -t arm64-v8a build --release
tasks.register("cargoBuild") {
executable("cargo")
args("ndk", "-t", "arm64-v8a", "build", "--release")
workingDir("${project.rootDir}/apd")
environment("APATCH_VERSION_CODE", "${managerVersionCode}")
environment("APATCH_VERSION_NAME", "${managerVersionCode}-Matsuzaka-yuki")
}
tasks.register("buildApd") {
dependsOn("cargoBuild")
from("${project.rootDir}/apd/target/aarch64-linux-android/release/apd")
into("${project.projectDir}/libs/arm64-v8a")
rename("apd", "libapd.so")
}
tasks.configureEach {
if (name == "mergeDebugJniLibFolders" || name == "mergeReleaseJniLibFolders") {
dependsOn("buildApd")
}
}
tasks.register("cargoClean") {
executable("cargo")
args("clean")
workingDir("${project.rootDir}/apd")
}
tasks.register("apdClean") {
dependsOn("cargoClean")
delete(file("${project.projectDir}/libs/arm64-v8a/libapd.so"))
}
tasks.clean {
dependsOn("apdClean")
}
ksp {
arg("compose-destinations.defaultTransitions", "none")
}
dependencies {
implementation(libs.androidx.appcompat)
implementation(libs.androidx.activity.compose)
implementation(libs.androidx.core.splashscreen)
implementation(libs.androidx.webkit)
implementation(libs.androidx.biometric)
implementation(platform(libs.androidx.compose.bom))
implementation(libs.androidx.compose.material.icons.extended)
implementation(libs.androidx.compose.material)
implementation(libs.androidx.compose.material3)
implementation("androidx.compose.material3:material3-android:1.5.0-alpha17")
implementation(libs.androidx.compose.ui)
implementation(libs.androidx.compose.ui.tooling.preview)
implementation(libs.androidx.compose.runtime.livedata)
debugImplementation(libs.androidx.compose.ui.test.manifest)
debugImplementation(libs.androidx.compose.ui.tooling)
implementation(libs.androidx.lifecycle.runtime.compose)
implementation(libs.androidx.lifecycle.runtime.ktx)
implementation(libs.androidx.lifecycle.viewmodel.compose)
implementation("androidx.lifecycle:lifecycle-process:2.8.7")
implementation(libs.compose.destinations.core)
ksp(libs.compose.destinations.ksp)
implementation(libs.com.github.topjohnwu.libsu.core)
implementation(libs.com.github.topjohnwu.libsu.service)
implementation(libs.com.github.topjohnwu.libsu.nio)
implementation(libs.com.github.topjohnwu.libsu.io)
implementation(libs.dev.rikka.rikkax.parcelablelist)
implementation(libs.io.coil.kt.coil.compose)
implementation(libs.io.coil.kt.coil.gif)
implementation(libs.kotlinx.coroutines.core)
implementation(libs.me.zhanghai.android.appiconloader.coil)
implementation(libs.sheet.compose.dialogs.core)
implementation(libs.sheet.compose.dialogs.list)
implementation(libs.sheet.compose.dialogs.input)
implementation(libs.markdown)
implementation(libs.ini4j)
implementation(libs.google.code.gson)
implementation(libs.liquid)
compileOnly(libs.cxx)
}
================================================
FILE: app/libs/arm64-v8a/.gitignore
================================================
libkptools.so
libapjni.so
libkpatch.so
libapd.so
================================================
FILE: app/libs/arm64-v8a/libkpatch.so.version
================================================
0.10.7
================================================
FILE: app/libs/arm64-v8a/libkptools.so.version
================================================
0.13.1
================================================
FILE: app/proguard-rules.pro
================================================
-dontwarn org.bouncycastle.jsse.BCSSLParameters
-dontwarn org.bouncycastle.jsse.BCSSLSocket
-dontwarn org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
-dontwarn org.conscrypt.Conscrypt$Version
-dontwarn org.conscrypt.Conscrypt
-dontwarn org.conscrypt.ConscryptHostnameVerifier
-dontwarn org.openjsse.javax.net.ssl.SSLParameters
-dontwarn org.openjsse.javax.net.ssl.SSLSocket
-dontwarn org.openjsse.net.ssl.OpenJSSE
-dontwarn java.beans.Introspector
-dontwarn java.beans.VetoableChangeListener
-dontwarn java.beans.VetoableChangeSupport
-dontwarn java.beans.BeanInfo
-dontwarn java.beans.IntrospectionException
-dontwarn java.beans.PropertyDescriptor
# Keep ini4j Service Provider Interface
-keep,allowobfuscation,allowoptimization class org.ini4j.spi.** { *; }
# Keep native methods and JNI classes
-keep class me.bmax.apatch.Natives {
*;
}
-keepclasseswithmembernames class * {
native ;
}
-keep class me.bmax.apatch.Natives$Profile { *; }
-keep class me.bmax.apatch.Natives$KPMCtlRes { *; }
# Keep RootServices
-keep class me.bmax.apatch.services.RootServices { *; }
# Keep AIDL interfaces
-keep class me.bmax.apatch.IAPRootService { *; }
-keep class me.bmax.apatch.IAPRootService$Stub { *; }
-keep class rikka.parcelablelist.ParcelableListSlice { *; }
# Keep ScriptInfo for Gson serialization in release
-keep class me.bmax.apatch.data.ScriptInfo { *; }
-keepclassmembers class me.bmax.apatch.data.ScriptInfo { *; }
# Gson
-keepattributes Signature
-keepattributes *Annotation*
-keep class sun.misc.Unsafe { *; }
-keep class com.google.gson.** { *; }
-keep class * extends com.google.gson.reflect.TypeToken
# Kotlin
-assumenosideeffects class kotlin.jvm.internal.Intrinsics {
public static void check*(...);
public static void throw*(...);
}
# Keep Umount configuration classes
-keep class me.bmax.apatch.ui.component.UmountConfig { *; }
-keep class me.bmax.apatch.ui.component.UmountConfigManager { *; }
-keep class me.bmax.apatch.ui.screen.UmountConfigScreen { *; }
-keepclassmembers class me.bmax.apatch.ui.component.UmountConfigManager {
public static *;
}
-keepclassmembers class me.bmax.apatch.ui.component.UmountConfig {
public (boolean, java.lang.String);
}
# Keep Umount destination
-keep class me.bmax.apatch.ui.screen.destinations.UmountConfigScreenDestination { *; }
-repackageclasses
-allowaccessmodification
-overloadaggressively
-renamesourcefileattribute SourceFile
================================================
FILE: app/src/main/AndroidManifest.xml
================================================
================================================
FILE: app/src/main/aidl/me/bmax/apatch/IAPRootService.aidl
================================================
// IAPRootService.aidl
package me.bmax.apatch;
import android.content.pm.PackageInfo;
import rikka.parcelablelist.ParcelableListSlice;
interface IAPRootService {
ParcelableListSlice getPackages(int flags);
}
================================================
FILE: app/src/main/assets/.gitignore
================================================
kpimg
*.kpm
================================================
FILE: app/src/main/assets/InstallAP.sh
================================================
#!/bin/sh
# By SakuraKyuo
OUTFD=/proc/self/fd/$2
function ui_print() {
echo -e "ui_print $1\nui_print" >> $OUTFD
}
function ui_printfile() {
while IFS='' read -r line || $BB [[ -n "$line" ]]; do
ui_print "$line";
done < $1;
}
function kernelFlagsErr(){
ui_print "- Installation has Aborted!"
ui_print "- APatch requires CONFIG_KALLSYMS to be Enabled."
ui_print "- But your kernel seems NOT enabled it."
exit
}
function apatchNote(){
ui_print "- APatch Patch Done"
ui_print "- APatch Key is: Ap$skey"
ui_print "- We do have saved Origin Boot image to /data"
ui_print "- If you encounter bootloop, reboot into Recovery and flash it"
exit
}
function failed(){
ui_printfile /dev/tmp/install/log
ui_print "- APatch Patch Failed."
ui_print "- Please feedback to the developer with the screenshots."
exit
}
function boot_execute_ab(){
./lib/arm64-v8a/libkptools.so unpack boot.img
if [[ ! $(./lib/arm64-v8a/libkptools.so -i ./kernel -f | grep CONFIG_KALLSYMS=y) ]]; then
kernelFlagsErr
fi
mv kernel kernel-origin
./lib/arm64-v8a/libkptools.so -p --image kernel-origin --skey "Ap$skey" --kpimg ./assets/kpimg --out ./kernel 2>&1 | tee /dev/tmp/install/log
if [[ ! $(cat /dev/tmp/install/log | grep "patch done") ]]; then
failed
fi
ui_printfile /dev/tmp/install/log
./lib/arm64-v8a/libkptools.so repack boot.img
dd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot
mv boot.img /data/boot.img
apatchNote
}
function boot_execute(){
./lib/arm64-v8a/libkptools.so unpack boot.img
if [[ ! $(./lib/arm64-v8a/libkptools.so -i ./kernel -f | grep CONFIG_KALLSYMS=y) ]]; then
kernelFlagsErr
fi
mv kernel kernel-origin
./lib/arm64-v8a/libkptools.so -p --image kernel-origin --skey "Ap$skey" --kpimg ./assets/kpimg --out ./kernel 2>&1 | tee /dev/tmp/install/log
if [[ ! $(cat /dev/tmp/install/log | grep "patch done") ]]; then
failed
fi
ui_printfile /dev/tmp/install/log
./lib/arm64-v8a/libkptools.so repack boot.img
dd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot
mv boot.img /data/boot.img
apatchNote
}
function main(){
cd /dev/tmp/install
chmod a+x ./assets/kpimg
chmod a+x ./lib/arm64-v8a/libkptools.so
slot=$(getprop ro.boot.slot_suffix)
skey=$(cat /proc/sys/kernel/random/uuid | cut -d \- -f1)
if [[ ! "$slot" == "" ]]; then
ui_print ""
ui_print "- You are using A/B device."
# Script author
ui_print "- Install Script by SakuraKyuo"
# Get kernel
ui_print ""
dd if=/dev/block/by-name/boot$slot of=/dev/tmp/install/boot.img
if [[ "$?" == 0 ]]; then
ui_print "- Detected boot partition."
boot_execute_ab
fi
else
ui_print "You are using A Only device."
# Get kernel
ui_print ""
dd if=/dev/block/by-name/boot of=/dev/tmp/install/boot.img
if [[ "$?" == 0 ]]; then
ui_print "- Detected boot partition."
boot_execute
fi
fi
}
main
================================================
FILE: app/src/main/assets/UninstallAP.sh
================================================
#!/bin/sh
# By SakuraKyuo
OUTFD=/proc/self/fd/$2
function ui_print() {
echo -e "ui_print $1\nui_print" >> $OUTFD
}
function ui_printfile() {
while IFS='' read -r line || $BB [[ -n "$line" ]]; do
ui_print "$line";
done < $1;
}
function apatchNote(){
ui_print "- APatch Unpatch Done"
exit
}
function failed(){
ui_print "- APatch Unpatch Failed."
ui_print "- Please feedback to the developer with the screenshots."
exit
}
function boot_execute_ab(){
./lib/arm64-v8a/libkptools.so unpack boot.img
mv kernel kernel-origin
./lib/arm64-v8a/libkptools.so -u --image kernel-origin --out ./kernel
if [[ ! "$?" == 0 ]]; then
failed
fi
./lib/arm64-v8a/libkptools.so repack boot.img
dd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot$slot
apatchNote
}
function boot_execute(){
./lib/arm64-v8a/libkptools.so unpack boot.img
mv kernel kernel-origin
./lib/arm64-v8a/libkptools.so -u --image kernel-origin --out ./kernel
if [[ ! "$?" == 0 ]]; then
failed
fi
./lib/arm64-v8a/libkptools.so repack boot.img
dd if=/dev/tmp/install/new-boot.img of=/dev/block/by-name/boot
apatchNote
}
function main(){
cd /dev/tmp/install
chmod a+x ./lib/arm64-v8a/libkptools.so
slot=$(getprop ro.boot.slot_suffix)
if [[ ! "$slot" == "" ]]; then
ui_print ""
ui_print "- You are using A/B device."
# Get kernel
ui_print ""
dd if=/dev/block/by-name/boot$slot of=/dev/tmp/install/boot.img
if [[ "$?" == 0 ]]; then
ui_print "- Detected boot partition."
boot_execute_ab
fi
else
ui_print "You are using A Only device."
# Get kernel
ui_print ""
dd if=/dev/block/by-name/boot of=/dev/tmp/install/boot.img
if [[ "$?" == 0 ]]; then
ui_print "- Detected boot partition."
boot_execute
fi
fi
}
main
================================================
FILE: app/src/main/assets/boot_extract.sh
================================================
#!/system/bin/sh
ARCH=$(getprop ro.product.cpu.abi)
IS_INSTALL_NEXT_SLOT=$1
# Load utility functions
. ./util_functions.sh
if [ "$IS_INSTALL_NEXT_SLOT" = "true" ]; then
get_next_slot
else
get_current_slot
fi
find_boot_image
[ -e "$BOOTIMAGE" ] || { >&2 echo "- can't find boot.img!"; exit 1; }
true
================================================
FILE: app/src/main/assets/boot_flash.sh
================================================
#!/system/bin/sh
#######################################################################################
# APatch Boot Image Flasher
#######################################################################################
ARCH=$(getprop ro.product.cpu.abi)
# Load utility functions
. ./util_functions.sh
echo "****************************"
echo " FolkPatch Boot Image Flasher"
echo "****************************"
BOOTIMAGE=$1
SOURCE_IMAGE=$2
[ -e "$SOURCE_IMAGE" ] || { echo "- $SOURCE_IMAGE does not exist!"; exit 1; }
echo "- Target image: $BOOTIMAGE"
echo "- Source image: $SOURCE_IMAGE"
echo "- Flashing boot image"
flash_image "$SOURCE_IMAGE" "$BOOTIMAGE"
if [ $? -ne 0 ]; then
>&2 echo "- Flash error: $?"
exit $?
fi
echo "- Flash successful"
================================================
FILE: app/src/main/assets/boot_patch.sh
================================================
#!/system/bin/sh
#######################################################################################
# APatch Boot Image Patcher
#######################################################################################
#
# Usage: boot_patch.sh [ARGS_PASS_TO_KPTOOLS]
#
# This script should be placed in a directory with the following files:
#
# File name Type Description
#
# boot_patch.sh script A script to patch boot image for APatch.
# (this file) The script will use files in its same
# directory to complete the patching process.
# bootimg binary The target boot image
# kpimg binary KernelPatch core Image
# kptools executable The KernelPatch tools binary to inject kpimg to kernel Image
#
#######################################################################################
ARCH=$(getprop ro.product.cpu.abi)
# Load utility functions
. ./util_functions.sh
echo "****************************"
echo " FolkPatch Boot Image Patcher"
echo "****************************"
SUPERKEY="$1"
BOOTIMAGE=$2
FLASH_TO_DEVICE=$3
shift 2
[ -z "$SUPERKEY" ] && { >&2 echo "- SuperKey empty!"; exit 1; }
[ -e "$BOOTIMAGE" ] || { >&2 echo "- $BOOTIMAGE does not exist!"; exit 1; }
# Check for dependencies
command -v ./kptools >/dev/null 2>&1 || { >&2 echo "- Command kptools not found!"; exit 1; }
if [ ! -f kernel ]; then
echo "- Unpacking boot image"
set -x
./kptools unpack "$BOOTIMAGE" "$@"
patch_rc=$?
set +x
if [ $patch_rc -ne 0 ]; then
>&2 echo "- Unpack error: $patch_rc"
exit $?
fi
fi
if [ ! $(./kptools -i kernel -f | grep CONFIG_KALLSYMS=y) ]; then
echo "- Patcher has Aborted!"
echo "- APatch requires CONFIG_KALLSYMS to be Enabled."
echo "- But your kernel seems NOT enabled it."
exit 0
fi
if [ $(./kptools -i kernel -l | grep patched=false) ]; then
echo "- Backing boot.img "
cp "$BOOTIMAGE" "ori.img" >/dev/null 2>&1
fi
mv kernel kernel.ori
echo "- Patching kernel"
set -x
./kptools -p -i kernel.ori -S "$SUPERKEY" -k kpimg -o kernel "$@"
patch_rc=$?
set +x
if [ $patch_rc -ne 0 ]; then
>&2 echo "- Patch kernel error: $patch_rc"
exit $?
fi
echo "- Repacking boot image"
./kptools repack "$BOOTIMAGE"
if [ ! $(./kptools -i kernel.ori -f | grep CONFIG_KALLSYMS_ALL=y) ]; then
echo "- Detected CONFIG_KALLSYMS_ALL is not set!"
echo "- APatch has patched but maybe your device won't boot."
echo "- Make sure you have original boot image backup."
fi
if [ $? -ne 0 ]; then
>&2 echo "- Repack error: $?"
exit $?
fi
if [ "$FLASH_TO_DEVICE" = "true" ]; then
# flash
if [ -b "$BOOTIMAGE" ] || [ -c "$BOOTIMAGE" ] && [ -f "new-boot.img" ]; then
echo "- Flashing new boot image"
flash_image new-boot.img "$BOOTIMAGE"
if [ $? -ne 0 ]; then
>&2 echo "- Flash error: $?"
exit $?
fi
fi
echo "- Successfully Flashed!"
else
echo "- Successfully Patched!"
fi
================================================
FILE: app/src/main/assets/boot_unpatch.sh
================================================
#!/system/bin/sh
#######################################################################################
# APatch Boot Image Unpatcher
#######################################################################################
ARCH=$(getprop ro.product.cpu.abi)
# Load utility functions
. ./util_functions.sh
echo "****************************"
echo " FolkPatch Boot Image Unpatcher"
echo "****************************"
BOOTIMAGE=$1
[ -e "$BOOTIMAGE" ] || { echo "- $BOOTIMAGE does not exist!"; exit 1; }
echo "- Target image: $BOOTIMAGE"
# Check for dependencies
command -v ./kptools >/dev/null 2>&1 || { echo "- Command kptools not found!"; exit 1; }
if [ ! -f kernel ]; then
echo "- Unpacking boot image"
set -x
./kptools unpack "$BOOTIMAGE" "$@"
patch_rc=$?
if [ $patch_rc -ne 0 ]; then
>&2 echo "- Unpack error: $patch_rc"
exit $patch_rc
fi
fi
if [ ! $(./kptools -i kernel -l | grep patched=false) ]; then
echo "- kernel has been patched "
if [ -f "new-boot.img" ]; then
echo "- found backup boot.img ,use it for recovery"
else
mv kernel kernel.ori
echo "- Unpatching kernel"
./kptools -u --image kernel.ori --out kernel "$@"
if [ $? -ne 0 ]; then
>&2 echo "- Unpatch error: $?"
exit $?
fi
echo "- Repacking boot image"
./kptools repack "$BOOTIMAGE"
if [ $? -ne 0 ]; then
>&2 echo "- Repack error: $?"
exit $?
fi
fi
else
echo "- no need unpatch"
exit 0
fi
if [ -f "new-boot.img" ]; then
echo "- Flashing boot image"
flash_image new-boot.img "$BOOTIMAGE"
if [ $? -ne 0 ]; then
>&2 echo "- Flash error: $?"
exit $?
fi
fi
echo "- Flash successful"
# Reset any error code
true
================================================
FILE: app/src/main/assets/kpimg.version
================================================
0.13.1
================================================
FILE: app/src/main/assets/util_functions.sh
================================================
#!/system/bin/sh
#######################################################################################
# Helper Functions (credits to topjohnwu)
#######################################################################################
APATCH_VER='0.10.4'
APATCH_VER_CODE=12146
ui_print() {
if $BOOTMODE; then
echo "$1"
else
echo -e "ui_print $1\nui_print" >> /proc/self/fd/$OUTFD
fi
}
toupper() {
echo "$@" | tr '[:lower:]' '[:upper:]'
}
grep_cmdline() {
local REGEX="s/^$1=//p"
{ echo $(cat /proc/cmdline)$(sed -e 's/[^"]//g' -e 's/""//g' /proc/cmdline) | xargs -n 1; \
sed -e 's/ = /=/g' -e 's/, /,/g' -e 's/"//g' /proc/bootconfig; \
} 2>/dev/null | sed -n "$REGEX"
}
grep_prop() {
local REGEX="s/^$1=//p"
shift
local FILES=$@
[ -z "$FILES" ] && FILES='/system/build.prop'
cat $FILES 2>/dev/null | dos2unix | sed -n "$REGEX" | head -n 1
}
getvar() {
local VARNAME=$1
local VALUE
local PROPPATH='/data/.magisk /cache/.magisk'
[ ! -z $MAGISKTMP ] && PROPPATH="$MAGISKTMP/.magisk/config $PROPPATH"
VALUE=$(grep_prop $VARNAME $PROPPATH)
[ ! -z $VALUE ] && eval $VARNAME=\$VALUE
}
is_mounted() {
grep -q " $(readlink -f $1) " /proc/mounts 2>/dev/null
return $?
}
abort() {
ui_print "$1"
$BOOTMODE || recovery_cleanup
[ ! -z $MODPATH ] && rm -rf $MODPATH
rm -rf $TMPDIR
exit 1
}
set_nvbase() {
NVBASE="$1"
MAGISKBIN="$1/magisk"
}
print_title() {
local len line1len line2len bar
line1len=$(echo -n $1 | wc -c)
line2len=$(echo -n $2 | wc -c)
len=$line2len
[ $line1len -gt $line2len ] && len=$line1len
len=$((len + 2))
bar=$(printf "%${len}s" | tr ' ' '*')
ui_print "$bar"
ui_print " $1 "
[ "$2" ] && ui_print " $2 "
ui_print "$bar"
}
setup_flashable() {
ensure_bb
$BOOTMODE && return
if [ -z $OUTFD ] || readlink /proc/$$/fd/$OUTFD | grep -q /tmp; then
# We will have to manually find out OUTFD
for FD in $(ls /proc/$$/fd); do
if readlink /proc/$$/fd/$FD | grep -q pipe; then
if ps | grep -v grep | grep -qE " 3 $FD |status_fd=$FD"; then
OUTFD=$FD
break
fi
fi
done
fi
recovery_actions
}
ensure_bb() {
if set -o | grep -q standalone; then
# We are definitely in busybox ash
set -o standalone
return
fi
# Find our busybox binary
local bb
if [ -f $TMPDIR/busybox ]; then
bb=$TMPDIR/busybox
elif [ -f $MAGISKBIN/busybox ]; then
bb=$MAGISKBIN/busybox
else
abort "! Cannot find BusyBox"
fi
chmod 755 $bb
# Busybox could be a script, make sure /system/bin/sh exists
if [ ! -f /system/bin/sh ]; then
umount -l /system 2>/dev/null
mkdir -p /system/bin
ln -s $(command -v sh) /system/bin/sh
fi
export ASH_STANDALONE=1
# Find our current arguments
# Run in busybox environment to ensure consistent results
# /proc//cmdline shall be
[](https://github.com/LyraVoid/FolkPatch/releases/latest)
[](https://t.me/FolkPatch)
[](/LICENSE)
