-
Notifications
You must be signed in to change notification settings - Fork 763
[Bug] LSPatch blocks isolated process such as Chrome #190
Comments
At the beginning, I tried with my own module ChromeXt, the codes in the module worked fine but the browser cannot load pages. Later I found the problem had nothing to with module, even empty module couldn't work. It seems that LSPacth blocks loading APKs. To reproduce it quickly java -jar jar-v0.5.1-373-debug.jar bromite_arm64.apk -d -v --force && adb install ./bromite_arm64-373-lspatched.apk && adb logcat -s AndroidRuntime |
Here is some information useful for you to find out the problems, compare the following two logs by LSPosed and LSPacth. By LSPosed:
and continues with other normal logs. By LSPatch:
|
From the log we know that if (isIsolated()) {
XposedHelpers.setObjectField(appLoadedApk, "mClassLoader",
new PathClassLoader(appInfo.sourceDir, appLoadedApk.getClassLoader()));
}
XposedHelpers.setObjectField(mBoundApplication, "info", appLoadedApk);
if (isIsolated()) {
return null;
} And, of course, remove the return logic at the beginning of the But it still fails, and this time the classloader path becomes empty:
I conjecture that isolated process has no access to The problem remains to be solved, i.e., how to restore the original classLoader for an isolated process. |
From the source of chromium <service android:name="org.chromium.content.app.SandboxedProcessService{{ i }}"
android:process=":sandboxed_process{{ i }}"
android:permission="{{ manifest_package }}.permission.CHILD_SERVICE"
android:isolatedProcess="true"
android:exported="{{sandboxed_service_exported|default(false)}}"
{% if (i == 0) %}
android:useAppZygote="true"
{% endif %}
{% if (sandboxed_service_exported|default(false)) == 'true' %}
android:externalService="true"
tools:ignore="ExportedService"
android:visibleToInstantApps="true"
{% endif %} />
{% endfor %} and the explanation of android:isolatedProcess
there is no way to access to the extraced APK for an isolated process. I tried to extract it into
It seems that |
A solution would be redesignig the LSPatch mechanism using APK bundles instead of including orginal APK (and module APKs) into assets. We can load the orginal APK and various modules as splits as well, using methods such as This requires a new design of LSPatch, I think it will solve the problem here and remove the needs to do things like switchClassLoaders. |
The solution you mentioned is technically possible by putting the original apk's dexes to patched apk or split apk and disabling signature bypass on isolated process. |
This comment was marked as off-topic.
This comment was marked as off-topic.
I have done an experiment to test the possibility of changing a given apk to be a split one. I think it is not hard for you devs to adapt this method into LSPatch. |
I have tested LSPatch using split APKs to solve this problem. I will submit a pull-request soon after making my code consistent. |
Solve issue LSPosed#190. For isolated process, it is impossible to extract original APK from assets.
Solve issue LSPosed#190. For isolated process, it is impossible to extract original APK from assets.
Solve issue LSPosed#190. For isolated process, it is impossible to extract original APK from assets.
After the pull-request, the module is basically working but the brower is runing very slow.
|
The problem is solved by my pull-request #198 , just need to wait for its merge. |
Steps to reproduce/复现步骤
Expected behaviour/预期行为
bromite should function normally since nothing is done in the module
Actual behaviour/实际行为
Bromite cannot load URL
Xposed Module List/Xposed 模块列表
An empty module
LSPatch version/LSPatch 版本
jar-v0.5.1-373-debug
Android version/Android 版本
13
Shizuku version/Shizuku 版本
N/A
Version requirement/版本要求
Apk file/Apk 文件
No response
Logs/日志
adb logcat -s AndroidRuntime:V
The text was updated successfully, but these errors were encountered: