Next level camera management.

CameraControl lets you manage access to your cameras depending on which side of the phone they face.

Why? Because I hate it when Snapchat opens up and forces me to see my own depression. But completely disabling all the cameras for Snapchat would render the whole app useless.

This was developed and tested on LineageOS 17.1, but should work on any android >= 8.1.

1. Install the module on a system with a running XPosed framework
2. Activate the module and select apps you want to limit camera access to.

• Route 1:
  • Go back to the module list
  • Long press on CameraControl and select App Info
  • On the bottom, click on Advanced
  • Click on Additional settings in the app
• Route 2:
  • Go into device settings
  • Click on apps
  • Somehow tell the device to show all apps
  • Select CameraControl
  • On the bottom, click Advanced
  • Click on Additional settings in the app
• Route 3:
  • Open up an ADB shell
  • Run command am start-activity com.programminghoch10.cameracontrol/.SettingsActivity

Now configure away!

Small intel: The configure activity is not accessible from the launcher, because LSPosed does not let modules hide their own launcher icons by default anymore. Defining a settings activity is an easy way to provide an accessible configuration interface, without forcing yet another launcher icon into the list. One does not have to open the menu often anyways.

Change your mobile data icons! For example you can change the 3G/4G icons into 5G!

This module enables you to replace any of the mobile data icons with any other mobile data icon.

Any AOSP near ROM should be compatible. Just try it out and see if it works.

Read more about compatiblity here.

1. Install the module on a system with a running XPosed framework with API version >=93.
2. Activate the resource hooks within your XPosed framework manager.
3. Activate the module. The package SystemUI should automatically be selected.
4. Restart your phone.
5. You are now ready to use the module. You will need to open the Configuration screen to set it all up, as the module won't do anything yet.

I don't like it when every XPosed module adds yet another app icon to the launcher. This is why this modules settings are hidden within the App-Info screen.

Here is how to open the settings:

• Route 1:
  • Go to the module list within your XPosed manager
  • Long press on CameraControl and select App Info
  • On the bottom, click on Advanced
  • Click on Additional settings in the app
• Route 2:
  • Go into device settings
  • Click on apps
  • Somehow tell the device to show all apps
  • Select CameraControl
  • On the bottom, click on Advanced
  • Click on Additional settings in the app
• Route 3:
  • Open up an ADB shell
  • Run command am start-activity com.programminghoch10.mobileiconchanger/.SettingsActivity

I don't want to keep 4 different places up to date.

If you want to read more about why this module exists or additional info about the configuration interface or you just want to see some screenshots first head over to the GitHub Repo.

An Xposed Module to Enable FLAG_SECURE, disabling screenshots and recording absolutely everywhere.

This will give you the absolute privacy, as absolutely nothing is able to record or screenshot anything.

This is the exact opposite of Disable-FLAG_SECURE by VarunS2002.

• Android 8.0+ (Oreo/SDK 26)

• XPosed framework installed properly like EdXposed or LSPosed

• EdXposed:
  • Normal Mode:
    • Enable the module and reboot
  • White List / Activation Scope Mode:
    • Enable the module
    • Select Android System
    • Select the target app in which you want to disable screenshots
    • Reboot
  • Black List Mode:
    • Enable the module
    • Do not select Android System
    • Do not select the target app in which you want to disable screenshots
    • Reboot
• LSPosed:
  • Enable the module
  • Select System Framework
  • Select the target app in which you want to disable screenshots
  • Reboot

• This app does prevent apps from detecting that you've taken a screenshot or recorded it like Snapchat or Instagram, because you literally cannot take screenshots anymore. This disables it in all apps you select. So you can't screenshot your girlfriend's nudes. (But that probably does not matter since you're reading this anyway)

• Xposed Implementations Tested on:

  • EdXposed
  • LSPosed

• If you haven't noticed yet, this is a parody of Disable-FLAG_SECURE by VarunS2002. Thank you and all other contributors for your work.

XPosed Module to turn the WiFi icon upside down.

This is an modified version of the legendary module UpsideWifi by rye761.

This module needs the resource hooks enabled.

ROOT REQUIRED

XPOSED FRAMEWORK REQUIRED

IF You dont know What is XPOSED FRAMEWORK then do not try this application (it wont work). To Know more about Xposed Read Here. http://forum.xda-developers.com/xposed/

• Although this app has been tested on several devices, there arealways chance something can go wrong. It is always recommended to have a backup of your ROM and other important data before trying this app.

This is Xposed Module For Changing (MASKING) the various IDs in the Phone. Change means when an application access these parameters this appwill replace original value with user provided value. Original values are always intact in device.

Freemium: The Freemium membership provides essential features to enhance your privacy control on Android. With Freemium, you can protect your IMEI, hardware serial, Bluetooth MAC, Wi-Fi MAC, mobile number, advertising ID, and Wi-Fi SSID. It's a great starting point for securing your information.

Silver (Lifetime): Upgrade to the Silver membership and make a one-time payment to unlock advanced features. The Silver membership provides lifetime access to all the functionalities available in the Freemium plan, along with additional features. With Silver, you gain access to country information, SIM operator details, SIM MCC/MNC, SIM subscriber information, SIM card serial, Google Service Framework (GSF), and the ability to spoof Google accounts (Gmail). Silver expands your privacy control capabilities for a lifetime.

Premium (Subscription): Subscribe to the Premium membership and unlock everything provided in the Freemium and Lifetime plans. Additionally, as a Premium member, you gain access to upcoming features mentioned in the table above. With Premium, you stay up-to-date with the latest developments and enjoy comprehensive privacy control options. Premium membership is available through a subscription.

Alpha (Subscription): The Alpha membership encompasses all the features provided in the Freemium, Lifetime, and Premium plans. On top of that, Alpha offers advanced features that are still under development. These exclusive features are not available in the other plans and enable you to experience cutting-edge privacy control on your Android device. Alpha membership is available through a subscription.

Please note that the availability of certain features may vary depending on the membership level.

(Note: Pricing plans are based on monthly per-device subscriptions. Prices and features are subject to change as Geergit is still under development.)

There are multiple methods to request feature

1. You can open feature request issue to this repository.
2. Submit this Google Form: https://forms.gle/X8sX6PcSi9bRbK1YA
3. Telegram Group
4. XDA Thread

1. For changes to take effect close all running applications alsoswipe / clear apps from recent list. No need to reboot.

Steps to enable app in Xposed Framework (LSPosed Recommended).

• Install app
• Go to xposed module
• Enable module in xposed framework
• Select target/victim apps in module's scope incase of LSPosed
• Restart phone
• Open the app

• And you can start using it by changing settings.

• Don't use this app for any illegal purpose or cheat any program this module is just for better privacy.

Credits:

@DE - For inspiring me for this module. @Lsposed Team - For their efforts. @VD171 - for his app VDInfo which will help to check spoof values.

"THE SOFTWARE IS PROVIDED ON AN AS-IS AND AS-AVAILABLE BASIS. YOU AGREE THAT YOUR USE OF THE SOFTWARE AND OUR SERVICES WILL BE AT YOUR SOLE RISK. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, IN CONNECTION WITH THE SOFTWARE AND YOUR USE THEREOF, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. IN NO EVENT WILL AUTHOR BE LIABLE FOR ANY DAMAGES CAUSED BY USING THIS PRODUCT"

仅适用于MIUI，在移动网络面板或快捷开关中添加 5G 开关

For MIUI only, add 5G switch in the network panel or qs tile.

1. 无后台服务
2. 无图标，无配置，即装即用

1. 在Xposed管理器(LSPosed, EdXposed...)中激活模块 (推荐使用LSP)
2. 作用域勾选 系统界面(com.android.systemui)、电话服务(com.android.phone)
3. 重启手机

❗电话服务为可选作用域，其作用于老版本的 MIUI(12) 自动打开 5G 的 SA 服务，无此需求可不勾选

• 文件以 -tile 结尾的为磁贴开关
• 文件以 -panel 结尾的为面板开关

LSPosed 仓库

蓝奏云 密码:miui

  磁贴开关


  面板开关

请先检查模块是否正常激活，并且作用域是否勾选。如果排查后仍有错误，请提交issue。或联系酷安@buffcow

模块使用 Yuki Hook API 构建

Ironbridge Api is used to interact with the Ironbridge Xposed module.

• Connect to the public bridge, send and receive content
• ~~Connect to the custom bridge, send and receive content~~ (TODO)

// Java
Ironbridge bridge = IronBridge.getPublicBridge();
// attention: bridge may be null if the public bridge is not available
// always check if bridge is null after calling getPublicBridge()
if (bridge != null) {
    // do something
}

// Kotlin
val bridge = IronBridge.getPublicBridge()
// attention: bridge may be null if the public bridge is not available
// always check if bridge is null after calling getPublicBridge()
bridge?.let {
    // do something
}

// Java
bridge.sendBoolean(
        "main", // the channel
        "a boolean value", // the key
        true // the value
        );
// ......

// Kotlin
bridge.sendBoolean(
        "main", // the channel
        "a boolean value", // the key
        true // the value
        )
// ......

• String

• int

• long

• float

• double

• boolean

• List

• String

• Integer

• Long

• Float

• Double

• Boolean

• Array

• int

• long

• float

• double

• boolean

• Parcelable (Make sure all clients have the same class)

• Serializable (Make sure all clients have the same class)

• IBinder

// Java
ironbridge.addListener(new BridgeListener.Stub() {
    @Override
    public void onReceivedString(String key, String value) {
        // do something
    }

    // ......

    @Override
    public String getChannel() {
        // return the channel name that the channel you want to listen
        return "main";
    }
});

// Kotlin
bridge?.addListener(object: BridgeListener.Stub() {
    override fun onReceivedString(key: String?, value: String?) {
        // do something
    }

    // ......

    override fun getChannel(): String {
        // return the channel name that the channel you want to listen
        return "main"
    }
})

Need Xposed
Automatic approve for app to access device logs (Android 13+)

How it works
it hook com.android.server.logcat.LogcatManagerService and call onAccessApprovedForClient on every request
Note: No activity will be started and the timer limit will not be bypassed.

Logcat TAG: DisableLogsRequest
see: LogcatManagerService.java and LogAccessDialogActivity.java

USE AT YOUR OWN RISK
Need Xposed
Bypass ARA,ARF limit in AccessControlEnforcer and grant FullAccess.

How it works
It hooks com.android.se.security.AccessControlEnforcer.readSecurityProfile, disables mUseArf and mUseAra, and grants mFullAccess.
Note: You may need to kill com.android.se by running su -c killall com.android.se in adb shell to activate it.

Logcat TAG: OMAPI-Bypass
see: AccessControlEnforcer.java

杜比大喇叭β 3.X会有以下改变： - 编译版本提高至29并采用AndroidX API - 模块被嵌入到网易云音乐的设置中 - 由于Android R对可执行文件的进一步限制，摒弃了2.X手动选择脚本与Node的方式 - 当前版本以稳定为主，杜比大喇叭β将能无缝适配最新版网易云音乐，如有问题请提交issue - 因本人不使用太极，所以不保证太极等非root框架可以顺利运行，欢迎Fork适配

快帮我点小星星呀，我要好多好多的小星星！

GitHub Release

杜比大喇叭β版 访问密码：brdb

网易云音乐模块内嵌版（无需安装模块，适合不想用太极等框架的非root用户）

• 尽可能保证不因模块造成crash（改版网易云往往经过二次混淆，将得不到适配）
• 部分美化功能的添加
• 更稳定的代理方式

nondanee/UnblockNeteaseMusic

Unblock Netease Music 维护小组

bin456789/Unblock163MusicClient-Xposed

Flysky12138/UnblockNeteaseMusic-Android

The MIT License

移除 MIUI 对应用的性能限制，以最高帧率运行应用

本模块旨在用各种方式提升系统运行应用的性能。 目前支持的功能： - 对指定应用解除 MIUI 系统 "电量与性能" 应用云控限制屏幕刷新率。对于 DC 调光和高刷新率不兼容的情况，支持强行锁定 “DC+高刷” 或低亮度时自动切换到支持 DC 的刷新率

"电量与性能" 应用会根据前台应用情况，限制应用的运行帧数。比如王者荣耀等游戏会被限制 60 刷新率，导致游戏最高只能达到 60 帧

• 屏蔽或修改 MIUI 系统 "Joyose" 应用的云控性能限制，屏蔽其广告和跟踪请求

  "Joyose" 应用会拉取云控规则，调整应用的性能。比如在手机温度较高时降低游戏帧数

1. 安装 MIUIPerfSaver.apk [MIUI 性能救星]
2. 在 LSPosed 管理器中启用模块
3. 首次启用模块、更新模块版本时，需要强制停止 "性能与电量" / "Joyose" 应用一次
4. 首次启用需清空 "Joyose" 全部数据
5. 在 MIUI 性能救星 模块自己的设置中
6. 刷新率：可修改全局刷新率，或锁定单个应用的刷新率。这里的改动立即生效，重启也仍然生效，无需强制停止任何应用
7. Joyose：选择云控规则处理方式，默认完全屏蔽，可选仅删除或修改云控规则内容，切换规则后需清除 Joyose 数据

请在 https://github.com/test01wrk/MIUIPerfSaver/issues 创建 issue，并提供 LSPosed 管理器中的详细日志

应用列表界面的 UI 和基础逻辑，改自 XAppDebug 项目

• MIUI 开发版、测试版系统上可能失效，目前只适配正式版系统
• DC 高刷不兼容的设备强制同时开启 DC + 高刷后，可能出现屏幕颜色偏色、部分刷新率下 DC 无效等情况

Remove MIUI\'s performance limit, run app at maximum FPS

UI from XAppDebug, thanks~

Hook specific process/apps/games to spoof your device as different model/device to unlock hidden features and options. Check list of support - Supported Lists

• Device spoofing for enhanced gaming experiences.
• Display refreshrate spoofing to unlock higher framerate options. ( To test this spoof install any app from the Debug Lists and check display specifications )
• Compatibility with a wide range of popular gaming applications.
• Easy installation and no extra configuration.

The following is the current list of devices that Process Hook will spoof your device into for supported games and apps. Click on the device names to view the corresponding profile in the code:

• ROG_PHONE_8
• SAMSUNG_S24_ULTRA
• BLACKSHARK_5_PRO
• REALME_GT6_5G
• ONEPLUS_12
• VIVO_IQOO_11_PRO
• POCO_F6_PRO
• MI_14_PRO

• Getting Started
• Usage
• License
• Contributing

To get started with Process Hook, follow these steps:

1. Ensure that your Android device is rooted.

2. Install the Xposed/Lsposed Framework on your device.

3. Download the Process Hook module from the releases section of this repository.

4. Install the downloaded apk :

5. Open Xposed/Lsposed Manager.
6. Go to the "Modules" section.
7. Search "Process Hook" and enable the module.
8. The supported process/apps/games are auto added to the scope.
9. Force Stop the added game manually to take effect.

Once you've installed and activated the Process Hook module, it will automatically spoof your device information for supported process/apps/games. There's no additional configuration required. Simply force stop and open the process/apps/games you want to run and enjoy the benefits of device spoofing.

You can untick the game you don't want to spoof for the module scope. Force stop and relaunch is required.

Note: Keep in mind that device spoofing may violate the terms of service for some games or apps.

Report any suggestions/issues with games here

Click to expand the list of supported apps

• Aida64
• Device Info
• Device Info HW

Click to expand the list of supported games

• Apex Legends Mobile
• Asphalt 9: Legends
• Battlegrounds Mobile India
• Black Desert Mobile
• Call Of Duty: Mobile VN
• Call of Duty: Mobile
• Call of Duty®: Mobile - Garena
• Clash of Clans
• Cyber Hunter
• Dead by Daylight: Mobile
• EA SPORTS FC™ Mobile Soccer
• Farlight 84
• Fortnite Portal
• Fortnite
• Free Fire MAX
• Free Fire
• Genshin Impact
• Honor of Kings
• Honor of Kings
• LMHT: Tốc Chiến
• League of Legends
• Mobile Legends: Bang Bang VNG
• Mobile Legends: Mi
• Mobile Legends
• Need for Speed: No Limits
• PUBG MOBILE：絕地求生M
• PUBG Mobile Beta
• PUBG Mobile VN
• PUBG Mobile
• PUBG Mobile: Lite
• PUBG: Exhilarating Battlefield
• Shadowgun Legends: Online FPS
• Tower of Fantasy
• World of Tanks: Blitz
• 《英雄聯盟：激鬥峽谷》
• 검은사막 모바일
• 콜 오브 듀티: 모바일

This project is licensed under the MIT License - see the LICENSE file for details.

一个用于Hook小米系统的工具

Cemiuiler 中文  |  EN

让 MIUI 再次伟大 ！

本项目源码

Android 11 ~ 13 的 MIUI 12.5 ~ 14

不支持 修改较多的第三方 MIUI Rom、修改较多的系统软件，以及部分国外 MIUI Rom，

目前 Cemiuiler 是基于 Android 13 的 MIUI 14 的手机端设备进行适配，覆盖不是很完整，需要不断测试和改进，

对于 Android 11 的设备，已尽力做好支持，在 1.3.130 版本发布后，主线分支将不再支持 Android 11，但依旧会提供老版本功能维护与移植。

点击展开折叠的内容

与 LSPosed 中推荐的作用域相同

您可以在这里为 Cemiuiler 项目贡献翻译。

Cemiuiler 使用了以下开源项目的部分或全部内容，感谢这些项目的开发者提供的大力支持（排名顺序不分先后）。

• 「AndroidHiddenApiBypass」 by LSPosed
• 「AntiAntiDefraud」 by MinaMichita
• 「Auto NFC」 by GSWXXN
• 「BypassSignCheck」 by Weverses
• 「CorePatch」 by LSPosed
• 「CustoMIUIzer」 by MonwF
• 「CustoMIUIzerMod」 by liyafe1997
• 「DexKit」 by LuckyPray
• 「Disable app link verify」 by tehcneko
• 「DisableFlagSecure」 by LSPosed
• 「DisableLogRequest」 by QueallyTech
• 「EzXHelper」 by KyuubiRan
• 「FixMiuiMediaControlPanel」 by qqlittleice
• 「HideMiuiClipboardDialog」 by zerorooot
• 「MaxFreeForm」 by YifePlayte
• 「Miui Feature」 by MoralNorm
• 「MiuiHomeR」 by qqlittleice
• 「MIUI IME Unlock」 by RC1844
• 「MIUI QOL」 by chsbuffer
• 「Miui XXL」 by Wine-Network
• 「Miui XXL」 by YuKongA
• 「MIUI 通知修复」 by tehcneko
• 「ModemPro」 by Weverse
• 「NoStorageRestrict」 by DanGLES3
• 「Portal Hook」 by Haocen2004
• 「RemoveMiuiSystemSelfProtection」 by gfbjngjibn
• 「SettingsDontThroughTheList」 by weixiansen574
• 「StarVoyager」 by hosizoraru
• 「WINI」 by ouhoukyo
• 「WOMMO」 by YifePlayte
• 「Woobox For MIUI」 by hosizoraru
• 「Woobox For MIUI」 by Simplicity-Team
• 「XposedBridge」 by rovo89
• 「.xlDownload」 by Kr328

HyperCeiler

让 HyperOS 再次伟大 ！

本项目源码

Android 14-15 的 HyperOS

请在 LSPosed 中启用 HyperCeiler， 然后在 HyperCeiler 应用内启用对应的功能，重启作用域 (需要 Root 权限)；

本模块不支持 修改较多的第三方 Xiaomi HyperOS ROM、修改较多的系统软件，以及部分国际 Xiaomi HyperOS ROM；

目前 HyperCeiler 是基于 Android 15 的 Xiaomi HyperOS 2.0 的手机端设备进行适配，覆盖不是很完整，需要不断测试和改进

在提交反馈前请注意是否已有相同反馈，避免给开发者造成困扰。花相同精力看相同反馈是一件很浪费时间的事情

HyperCeiler 已停止维护 Android 11-13 的 MIUI ROM 和 Android 13 的 HyperOS1.0 ROM

• Android 11-12 的 MIUI ROM 请使用 此版本
• Android 13 的 MIUI ROM 和 HyperOS1.0 ROM 请使用 此版本

您可以在这里为 HyperCeiler 项目贡献翻译。

Vojazento

MIUI & HyperOS 系统应用切换到国际版本标识

-- 让我们携起手来，一起出发。

本项目源码

An Android Xposed module to remove sponsored messages of Telegram.

Also allows you to copy or save messages when "Restrict saving content" is enabled. Forwarding messages is still not working due to server limitation.

• Official org.telegram.messenger
• Official org.telegram.messenger.web
• Official org.telegram.messenger.beta
• NekoX nekox.messenger
• Nanogram com.cool2645.nekolite
• Plus Messenger org.telegram.plus
• iMe Messenger com.iMe.android
• BGram org.telegram.BifToGram
• Catogram ua.itaysonlab.messenger
• Forkgram org.forkclient.messenger
• Forkgram org.forkclient.messenger.beta
• aka org.aka.messenger
• TurboTel Pro ellipi.messenger
• Catogram X org.nift4.catox
• OwlGram it.owlgram.android

This project is licensed under the GNU General Public Licence, version 3.

知乎去广告Xposed模块

• 广告
• 去启动页广告
• 去信息流广告
• 去回答列表广告
• 去评论广告
• 去分享广告
• 去回答底部广告
• 去搜索广告
• 其他
• 过滤视频
• 过滤文章
• 去信息流会员推荐
• 去回答圈子
• 去商品推荐
• 去相关搜索
• 去关键字搜索
• 直接打开外部链接
• 禁止切换色彩模式
• 显示卡片类别
• 状态栏沉浸
• 禁止进入全屏模式
• 解锁第三方登录
• 界面净化
• 移除直播按钮
• 不显示小红点
• 隐藏会员卡片
• 隐藏热点通知
• 精简文章页面
• 隐藏置顶热门
• 隐藏混合卡片
• 导航栏
• 隐藏会员按钮
• 隐藏视频按钮
• 隐藏关注按钮
• 隐藏发布按钮
• 隐藏发现按钮
• 禁用活动主题
• 隐藏导航栏突起
• 左右划
• 左右划切换回答
• 移除下一个回答按钮
• 自定义过滤
• 注入JS脚本
• 清理临时文件

Github Wiki

Github Release

Xposed Repo

蓝奏云 密码:1hax

This project is licensed under the GNU General Public Licence, version 3.

## SSL KiLLER An advanced XPosed module to bypass multiple ssl pinning implementations.

• Bypass multiple SSL pinning methods using XPosed framework API.

• XPosed Framework running on your device (LSposed).
• Root access (optional to auto-run apps).

If you encounter any issues or have questions about SSL KiLLER, join our Telegram Channel or submit an issue on GitHub.

Loved SSL KiLLER? Consider starring the repo to support the project! Contributions are welcome. Please open a pull request or an issue to discuss proposed changes or additions.

?️ Made with fun by Simo ??

TGɾαɱHσσƙʂ: An XPosed module to unlock premium features in multiple Telegram clients for free.

• Unlocks local Telegram premium features for free.
• Enables screenshot in private chats/groups/channels.
• Copy and save media from private chats/groups/channels.
• More features soon ?.

• XPosed Framework running on device (LSposed).
• Installed Telegram client.
• For non-root users u can use VphoneGaga/VMos virtual machines with root/magisk options.

If you encounter any issues or have questions about TGɾαɱHσσƙʂ, join our Telegram Channel or submit an issue on GitHub.

Loved TGɾαɱHσσƙʂ? Consider starring the repo to support the project! Contributions are welcome. Please open a pull request or an issue to discuss proposed changes or additions.

TGɾαɱHσσƙʂ is released under the MIT License. See the LICENSE file for further details.

?️ Made with fun by Simo ??

为小米平板提供一些增强功能
Provide some enhancements to Mi Pad

• 关闭Magic Pointer / No Magic Pointer
• 恢复ESC键功能 / Restore ESC function
• 去除触控笔蓝牙限制 / Remove stylus bluetooth restriction
• 去除随手写蓝牙限制 / Remove Scribe bluetooth restriction
• 忽略触控笔按键手势 / Ignore stylus buttons gesture
• 交换手势所需的手指数量 / Swap the number of fingers required for gestures
• 修复“屏蔽三指、四指手势”功能 / Fix "Don't respond to three- and four-finger gestures" function
• 禁用固定屏幕方向 / Disable fixed orientation
• 竖屏时上下分屏 / Split screen top and bottom on portrait

CwithW/MiuiPadMeta

Simplicity-Team/WooBoxForMIUI

ranLee1/jpinyin

577fkj/blockmiui

KyuubiRan/EzXHelper

GNU General Public License v3.0

爱发电 / AFDIAN

This module allows you to add any app (but not System apps) to the list of the supported applications by the "App Cloner" feature of OnePlus phones with OxygenOS. The module is compatible with Android 12 and 13, it has been tested on the following devices:

• OnePlus 9 Pro

but it should also work on other OnePlus models.

1. Install the module
2. Add com.oplus.multiapp to its scope
3. Open the app and select the app(s) you want to add to the App Cloner list
4. Go to Settings > Apps > App Cloner and check the list*

*Sometimes it may be necessary to force close the Settings app or restart the phone.

The apps that have been cloned will remain active even if the module is disabled!

If you encounter any issues and you want to help me solve them contact me privately on Twitter or Telegram.

• Even if the app is successfully cloned, it won't show as "active" (On) in App Cloner so you won't be able to remove it from there, this will be fixed in a future update.

Also let me know if the module works on another OnePlus model besides the ones mentioned above :-)

[Android 14+] Xposed module to kill foreground app on "Back" button long-press.

GravityBox is a module which primary goal is to provide the users of devices running vanilla or close to vanilla Android

with a tweak box that turns their stock ROM into a custom ROM packed with additional features and tweaks;

without the need of flashing a custom ROM. Most of the preferences can be changed on-the-fly without rebooting.

THIS VERSION IS FOR OREO ROMs - For Lollipop, use GravityBox [LP] - For KitKat, use GravityBox [KK] - For JellyBean, use GravityBox [JB] - For Marshmallow, use GravityBox [MM] - For Nougat, use GravityBox [N]

• QuickSettings tile management with additional tiles
• Pie Controls
• Expanded desktop with semi-immersive and immersive modes
• Lockscreen tweaks
• Statusbar tweaks
• Navigation bar tweaks
• Power tweaks
• Display tweaks
• Media tweaks
• Phone tweaks
• Hardware key actions
• Launcher tweaks
• Screen recording
• Smart radio
• Notification control (per-app notification LED/sounds/vibrations)
• Fingerprint Launcher
• Advanced tuning of Framework and System UI parameters

... and many more

• Supports AOSP devices running vanilla Android Oreo 8.0/8.1
• Supports OnePlus 3T running official OOS 5.0.1
• DOES NOT support devices running ROMs vastly modified by device manufacturers (HTC Sense, LG, Samsung Touchwiz, MIUI, LeWa, Xperia, ...)
• SHOULD NOT be used with custom ROMs like Lineage, AOSPA, or any other derivative - it makes no sense since the most of the features are already in the ROM (may cause conflicts and unexpected behavior)

GravityBox requires EdXposed v0.4 or later with resource hooking support

1. Those who supported development via PayPal donation can use their PayPal transaction ID to unlock premium features. Currently there are two premium features: 1) Backup/restore of GB settings 2) Ultimate notification control

2. If you contributed to the project by providing translations, code fragments, or by any other way. You can apply for a free transaction ID by contacting me via PM @ forum.xda-developers.com

3. Be aware that there's a system that can identify potential transaction ID abuse. E.g. when one ID is being used by more users. Such IDs will get blocked automatically. This can also happen when you previously exposed your ID in public forum and other users took advantage of it. If this is the case, contact me via PM so I can issue new, special ID. In case you own more devices, you can use one transaction ID on up to 10 of them.

4. If you are using your own custom builds of GB for personal use, you will get hash mismatch upon verifying your ID as verification system accepts requests only from official releases of GB. If you want to be able to verify IDs with your custom build, contact me via PM so I can setup a special hash for your build. If you are using a custom build that you provide for broader group of users (e.g. in a custom ROM), It is necessary to ask for new hash everytime your new custom version is released for public use. These rules are based on mutual trust so please, do not violate them.

Donation is also possible by purchasing GravityBox Unlocker from the Play Store

GravityBox is a module which primary goal is to provide the users of devices running vanilla or close to vanilla Android

with a tweak box that turns their stock ROM into a custom ROM packed with additional features and tweaks;

without the need of flashing a custom ROM. Most of the preferences can be changed on-the-fly without rebooting.

This module utilizes EdXposed Framework which is still in early development stage and may contain bugs or might not be fully compatible with system of your Android device. I take no responsibility for any issues arising from using GravityBox with EdXposed and strongly recommend creating a full backup of your device before activating the module.

THIS VERSION IS FOR ANDROID 10 (Q) ROMs - For Lollipop, use GravityBox [LP] - For KitKat, use GravityBox [KK] - For JellyBean, use GravityBox [JB] - For Marshmallow, use GravityBox [MM] - For Nougat, use GravityBox [N] - For Oreo, use GravityBox [O] - For Pie, use GravityBox [P]

• QuickSettings tile management with additional tiles
• Pie Controls
• Expanded desktop with semi-immersive and immersive modes
• Lockscreen tweaks
• Statusbar tweaks
• Navigation bar tweaks
• Power tweaks
• Display tweaks
• Media tweaks
• Phone tweaks
• Hardware key actions
• Launcher tweaks
• Screen recording
• Smart radio
• Notification control (per-app notification LED/sounds/vibrations)
• Fingerprint Launcher
• Advanced tuning of Framework and System UI parameters
• Media Visualizer

... and many more

• Supports AOSP devices running vanilla Android 10
• Supports OnePlus devices running official OxygenOS
• Supports Pixel devices running official Google OS
• DOES NOT support devices running ROMs vastly modified by device manufacturers (HTC Sense, LG, Samsung Touchwiz, MIUI, LeWa, Xperia, ...)
• SHOULD NOT be used with custom ROMs like Lineage, AOSPA, or any other derivative - it makes no sense since the most of the features are already in the ROM (may cause conflicts and unexpected behavior)

• Magisk v20 or later
• Riru core v21 or later (Magisk module)
• Riru - EdXposed v0.4 or later (Magisk module; YAHFA or Sandhook whatever works best on your device)
• EdXposed Manager

1. Those who supported development via PayPal donation can use their PayPal transaction ID to unlock premium features. Currently there are two premium features: 1) Backup/restore of GB settings 2) Ultimate notification control

2. If you contributed to the project by providing translations, code fragments, or by any other way. You can apply for a free transaction ID by contacting me via PM @ forum.xda-developers.com

3. Be aware that there's a system that can identify potential transaction ID abuse. E.g. when one ID is being used by more users. Such IDs will get blocked automatically. This can also happen when you previously exposed your ID in public forum and other users took advantage of it. If this is the case, contact me via PM so I can issue new, special ID. In case you own more devices, you can use one transaction ID on up to 10 of them.

4. If you are using your own custom builds of GB for personal use, you will get hash mismatch upon verifying your ID as verification system accepts requests only from official releases of GB. If you want to be able to verify IDs with your custom build, contact me via PM so I can setup a special hash for your build. If you are using a custom build that you provide for broader group of users (e.g. in a custom ROM), It is necessary to ask for new hash everytime your new custom version is released for public use. These rules are based on mutual trust so please, do not violate them.

中文用户请向下滑动以查看简体中文版自述文件内容。

AppErrorsTracking

Added more features to app's errors dialog, fixed custom rom deleted dialog, the best experience to Android developer.

This project is an Xposed Module that can be used in any Android system, currently only tested in LSPosed.

This Xposed Module is specially designed for Android developers.

When it is possible that the computer cannot be connected and ADB cannot be performed, this module can be used to quickly capture any exception of any installed apps, so as to quickly locate the problem.

The error log of apps crashing is an invaluable asset for developers. If you are not a developer, you can still install this module to provide developers with more exception information to quickly solve problems.

Minimum support Android 7.0

The releases of this Xposed Module is limited to the urls listed above.

We have nothing to do with versions downloaded from other informal channels or any impact on you.

Hey, please stay! ? Here are related projects such as Android development tools, UI design, Gradle plugins, Xposed Modules and practical software. If the project below can help you, please give me a star! All projects are free, open source, and follow the corresponding open source license agreement. → To see more about my projects, please click here ←

This Xposed Module is built using YukiHookAPI

YukiHookAPI is an efficient Hook API and Xposed Module solution built in Kotlin, making your Xposed Module development easier.

Copyright © 2017 Fankes Studio(qzmmcn@163.com)

异常跟踪

为原生 FC 对话框增加更多功能并修复国内定制 ROM 删除 FC 对话框的问题，给 Android 开发者带来更好的体验。

此项目为 Xposed 模块，可用在任何 Android 系统中，目前仅在 LSPosed 中测试通过。

此模块专为 Android 开发者而打造。

在可能的无法连接电脑，不能进行 ADB 调试的时候，可通过此模块来快速捕获任意已安装应用的任意异常，以便快速定位问题。

应用发生崩溃的错误日志对开发者来说是无价的财富，若你不是开发者，你依然可以安装此模块，以便给开发者提供更多异常信息快速解决问题。

最低支持 Android 7.0

本模块发布地址仅限于上述所列出的地址，从其他非正规渠道下载到的版本或对您造成任何影响均与我们无关。

1. 本软件免费、由兴趣使然、仅供学习交流而开发，如果你是从其他不明来源的渠道付费得到本软件，则你已上当受骗，若发现欢迎向我们举报。 2. 未经本人许可，禁止转载、搬运本软件的安装包及源代码到 GitHub 以外的平台并提供下载链接。

嘿，还请君留步！? 这里有 Android 开发工具、UI 设计、Gradle 插件、Xposed 模块和实用软件等相关项目。 如果下方的项目能为你提供帮助，不妨为我点个 star 吧！ 所有项目免费、开源，遵循对应开源许可协议。 → 查看更多关于我的项目，请点击这里 ←

本模块使用 YukiHookAPI 构建

YukiHookAPI 是一个使用 Kotlin 重构的高效 Hook API 构建工具，让你的 Xposed 模块开发变得更加简单。

版权所有 © 2017 Fankes Studio(qzmmcn@163.com)

NewQStory

• 预估支持的QQ版本 8.9.68 +

  • 其他版本未经测试 您或许可以自己尝试

• 推荐使用的框架

  • 1.LSPosed
  • 2.LSPatch 本地模式(没root的可以用这个)
  • 3.LSPatch 内置模式(便携模式 或者这个)
  • 4.太极-无极

• 更新频率

  • 随缘更新
  • Releases 更新直链
  • Telegram 在构建测试结束后会更新

~~由于开发人员的急缺暂时无法测试其他框架是否可用~~
经过大多数用户的测试目前在所有的框架中已经完成了适配

请勿使用此插件用于违法 商业行为
插件只是提高日常方便性的工具 请勿过度依赖该插件
此项目会因为各种可抗不可抗因素随时停止维护
如果发生了更糟糕的情况我们会及时 删除代码库 以及 发行渠道的所有版本
在此之前你或许可以及时保存我们的工作成品

LSPosed-Repo-Github

深夜拿起手机，不小心点到付款码、收款码、扫描二维码，屏幕亮度强制最高，人直接去世……

请给用户一个选择，拒绝 APP 强制屏幕亮度，从我做起。

• 只需勾选你需要生效的 APP 即可

• 建议不要勾选系统应用以免发生异常

• 模块已对系统框架设置了黑名单，勾选也不会生效

• Fork 项目后 前往这里 贡献作用域。

目前已添加

• QQ(标准版)
• TIM
• 微信
• 支付宝

• 只支持 LSPosed，请不要在其它管理器上激活模块，否则会不生效

• 理论最低 Android 版本没有限制，但是 LSPosed 最低支持到 Android 8.0

• 激活后的 APP 将失去设置指定 Activity 亮度的功能(目前设定)

• 支持根据系统特定亮度区间和指定 Activity 做出亮度调整功能，防止必要的设置不生效

• 可配合屏幕遮罩和 Android 12 下的极暗模式自动限制调整屏幕亮度

1. 本软件免费、由兴趣使然、仅供学习交流而开发，如果你是从其他不明来源的渠道付费得到本软件，则你已上当受骗，若发现欢迎向我们举报。 2. 未经本人许可，禁止转载、搬运本软件的安装包及源代码到 GitHub 以外的平台并提供下载链接。

嘿，还请君留步！? 这里有 Android 开发工具、UI 设计、Gradle 插件、Xposed 模块和实用软件等相关项目。 如果下方的项目能为你提供帮助，不妨为我点个 star 吧！ 所有项目免费、开源，遵循对应开源许可协议。 → 查看更多关于我的项目，请点击这里 ←

本模块使用 YukiHookAPI 构建

YukiHookAPI 是一个使用 Kotlin 重构的高效 Hook API 构建工具，让你的 Xposed 模块开发变得更加简单。

版权所有 © 2019-2022 Fankes Studio(qzmmcn@163.com)

微博轻享版6.1.7-(去除开屏广告，去除时间线广告，强制暗黑模式)

• 提交 Issues

本项目使用 GPL-3.0 协议开放源代码

ThisReallyLite
Copyright (C) 2023 RealHeart
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program.  If not, see .

• LSPosed
• YukiHookAPI
• RemoveAdsPlugin

目前只支持社区版 + 去除所有广告
+ 去除各种弹窗
+ 自动签到
+ 其他 Features

源码

反馈问题请点击源码地址，发起 issue

画涯漫画去广告

v1.3.0

激活模块，作用域勾选画涯漫画

模块完全开源免费，请勿用于非法用途

This is an Xposed Module to clean LINE.

LINE を掃除する Xposed Module です。

Details:

Xposed module. A collection of fixes for some apps to work properly, especially on OnePlus7.

• Rakuten Edy

The Rakuten Edy can work on a device without NFC-F, however it's not well tested. 
To use the app on an unsupported device, we need to bypass the device checking.
We spoof one of the supported device, Nexus 6 here. For more info, refer:
https://edy.rakuten.co.jp/howto/android/nfc/support/

• Google Daydream

NOTE: VR apps should be added to the LSPosed's scope for it to work.
(Ver 1.3) A new approach to enable Daydream using Xposed Framework.
Yep, there is no need to install another Magisk module! It works!

(Ver 1.2) With Magisk Pix3lify module, we can get Daydream VR support on unsupported device.
Almost everything work, however, the main scene of Daydream app is visually distorted for unknown reason.
Issue on Pix3lify:
https://github.com/Magisk-Modules-Repo/Pix3lify/issues/104
And if we spoof Pixel device here, the distortion bug disappear, very weird indeed...
(Tested on OnePlus7, not sure if this can solve the same bug on different device)

Before After

• Japan Post Bank

USB debug mode bypass for Japan Post Bank app.

• Remove Lock Screen Album Art (OxygenOS 10)

- Remove Lock Screen Album Art (OxygenOS 11)

OnePlus added the sh*t functionality back to the OxygenOS 11?
Don't worry, I got your back!

• Disable the stupid "Device supports Qualcomm® aptX™" notification

• Hide "Clear All" button in Overview (Recent Screen)

NOTE: This mod is NOT enabled by default.
User who need this feature should opt-in by adding "OnePlus Launcher" to the LSPosed's scope.

This mod aims to eliminate the bad habit of users who frequently press on the Clear All button for no reason.
Why it is a bad habit?

GravityBox is a module which primary goal is to provide the users of devices running vanilla or close to vanilla Android

with a tweak box that turns their stock ROM into a custom ROM packed with additional features and tweaks;

without the need of flashing a custom ROM. Most of the preferences can be changed on-the-fly without rebooting.

This module utilizes EdXposed Framework which is still in early development stage and may contain bugs or might not be fully compatible with system of your Android device. I take no responsibility for any issues arising from using GravityBox with EdXposed and strongly recommend creating a full backup of your device before activating the module.

THIS VERSION IS FOR ANDROID 11 (R) ROMs - For Lollipop, use GravityBox [LP] - For KitKat, use GravityBox [KK] - For JellyBean, use GravityBox [JB] - For Marshmallow, use GravityBox [MM] - For Nougat, use GravityBox [N] - For Oreo, use GravityBox [O] - For Pie, use GravityBox [P] - For Q, use GravityBox [Q]

• QuickSettings tile management with additional tiles
• Pie Controls
• Expanded desktop with semi-immersive and immersive modes
• Lockscreen tweaks
• Statusbar tweaks
• Navigation bar tweaks
• Power tweaks
• Display tweaks
• Media tweaks
• Phone tweaks
• Hardware key actions
• Launcher tweaks
• Screen recording
• Smart radio
• Notification control (per-app notification LED/sounds/vibrations)
• Fingerprint Launcher
• Advanced tuning of Framework and System UI parameters
• Media Visualizer

... and many more

• Supports AOSP devices running vanilla Android 10
• Supports OnePlus devices running official OxygenOS
• Supports Pixel devices running official Google OS
• DOES NOT support devices running ROMs vastly modified by device manufacturers (HTC Sense, LG, Samsung Touchwiz, MIUI, LeWa, Xperia, ...)
• SHOULD NOT be used with custom ROMs like Lineage, AOSPA, or any other derivative - it makes no sense since the most of the features are already in the ROM (may cause conflicts and unexpected behavior)

• Magisk v20 or later
• Riru core v21 or later (Magisk module)
• Riru - EdXposed v0.4 or later (Magisk module; YAHFA or Sandhook whatever works best on your device)
• EdXposed Manager

1. Those who supported development via PayPal donation can use their PayPal transaction ID to unlock premium features. Currently there are two premium features: 1) Backup/restore of GB settings 2) Ultimate notification control

2. If you contributed to the project by providing translations, code fragments, or by any other way. You can apply for a free transaction ID by contacting me via PM @ forum.xda-developers.com

3. Be aware that there's a system that can identify potential transaction ID abuse. E.g. when one ID is being used by more users. Such IDs will get blocked automatically. This can also happen when you previously exposed your ID in public forum and other users took advantage of it. If this is the case, contact me via PM so I can issue new, special ID. In case you own more devices, you can use one transaction ID on up to 10 of them.

4. If you are using your own custom builds of GB for personal use, you will get hash mismatch upon verifying your ID as verification system accepts requests only from official releases of GB. If you want to be able to verify IDs with your custom build, contact me via PM so I can setup a special hash for your build. If you are using a custom build that you provide for broader group of users (e.g. in a custom ROM), It is necessary to ask for new hash everytime your new custom version is released for public use. These rules are based on mutual trust so please, do not violate them.

/!\SINCE RIRU V22 YOU MUST ENABLE RESOURCE HOOK IN LSPOSED SETTINGS/!\ Thanks to @Hyper.Alvi for his help ! /!\ SystemUI must be restart to apply modifications (it changes dynamically after)/!\ Officially working with : OneUI 3.x AOSP R

/PS : Don't hesitate to try it on your rom and tell me if it work or no, I can support a lot of roms with your help/

Fileprefs

XposedBridge

Libsuperuser

PhotoshopColorPicker

Contact : If you want to help me or suggest me some ideas you can send mail

Mail : xhookmandev@gmail.com

My other modules :

Samsung Music Customiser

Samsung Messages Customiser

Notigif

Thank you for reading this, don't forget to press thanks on my XDA page ^_^ PS : I'm french, so I try to speak english I hope your eyes still lives and that there are not too mistakes.

Removes the restriction when selecting folders (Sdcard, Download, data and obb) through the file manager on Android 11 and higher

• This module WILL NOT let any app access /data or /obb folders directly, my module only gets around file selection limitations in the stock files app (and any app using the storage access framework to access files), fully getting around /data /obb limitation is currently out of the scope of this module
• In most cases DO NOT enable the module for the files app (only keep it enabled for the External Storage app), only enable it for the Files app when you want an app to be able to access something on /Android/data through the files app, otherwise keep it only enabled for the External Storage app

Donation/Paypal

感谢蚂蚁森林对绿化事业的贡献。快速收取蚂蚁森林能量，也为祖国的绿化事业出一份微薄之力~

• [x] 修复原版森林功能
• [x] 增加I18n中文
• [x] 增加同步步数功能
• [x] 允许自定义步数
• [x] 修复原版农场功能
• [ ] 森林完善
• [x] 增加收能量限制
• [x] 能量雨开关
• [x] 赠送能量雨列表
• [x] 签到
• [x] 浇水功能
• [x] 7:00-7:30只收能量
• [x] 收取金球
• [x] 双击卡功能
• [ ] 触发异常暂停，等待下次扫描
• [X] 保活模式
• [x] 好友昵称
• [ ] 神奇海洋
• [ ] 蚂蚁新村

目前没有大小号、号码切换的计划

1. 本APP是为了学习研究用，不得进行任何形式的转发，发布，传播。
2. 请于24小时内卸载本APP。若使用期间造成任何损失，作者不负任何责任。
3. 本APP不篡改，不修改，不获取任何个人信息及其支付宝信息。
4. 本APP使用者因为违反本声明的规定而触犯中华人民共和国法律的，一切后果自负，作者不承担任何责任。
5. 凡以任何方式直接、间接使用APP者，视为自愿接受本声明的约束。
6. 本APP如无意中侵犯了某个媒体或个人的知识产权，请来信或来电告之，作者将立即删除。

本项目基于 XQuickEnergy 开发，遵循 Apache-2.0 协议

• 自动跳过App开屏页
• 屏蔽各大广告联盟

Historically, setting a custom MAC address on Android was very easy for rooted users. Starting with Android 12, however, Google's implementation of MAC address randomization has made it impossible, as the MAC address is always changed when the network state is altered. If you have encountered this problem, then you need MACsposed! MACsposed is an Xposed module that blocks the MAC address randomizer on Android 12 through 15 and provides a user-friendly interface for spoofing your MAC address. Do you have other spoofing tools that you would prefer to use instead? No problem! Simply enable MACsposed and go back to using your preferred address spoofing tool.

MACsposed is not free software and requires an in-app purchase of a subscription or a lifetime license to unlock its functionality.

⚠️ WARNING: MACsposed is intended for rooted devices running Android 12 through 15 and requires Xposed. The required Xposed variant to use is LSPosed. Other Xposed variants will not work. Additionally, this module cannot be guaranteed to work on all devices. In the worst case, it can cause a bootloop. Use at your own risk.

An Xposed Framework module that bypasses Android's user/profile creation limits

• Bypass common profile creation errors
• Support Android 4.2 through Android 14+
• Compatible with popular profile apps (Island, Shelter, etc.)

• "Cannot add more profiles of type android.os.usertype.profile.(MANAGED | CLONE | PRIVATE) for user 0"
• "Maximum user limit is reached"
• "Cannot add more managed profiles for user"
• "Error: couldn't create User"

Open Terminal and Follow the Procedure

1. pm create-user --profileOf 0 --managed Island

If succeed, you will be prompted with the ID of newly created user (usually 10 or above). Remember it and replace the in following commands with this ID.

1. pm install-existing --user com.oasisfeng.island

2. dpm set-profile-owner --user com.oasisfeng.island/.IslandDeviceAdminReceiver

If you get error message java.lang.SecurityException: Neither user 2000 nor current process has android.permission.MANAGE_DEVICE_ADMIN, please review the MIUI-specific Preparation”.

1. am start-user

If all goes well, Island will show the app list. For more Users/Profiles , Follow the same procedure again...

• Gemini
• DeepSeek
• CorePath

Best present for 316 and 423.

• Remove ads from feed
• Remove tracking parameters when sharing
• Remove "Mentioned Goods" in post
• Remove items in search activity
• Check post status
• Custom navigation bar
• ......

• Latest LSPosed
• Latest official version (if still under maintenance)

• Module setting panel is in the setting activity.
• Some features may not work in some versions, so test it by yourself.
• Don't forget to hide this module by your smart brain, or your account may be banned. ?

• Telegram channel
• Telegram group

Currently we adopt an invitation policy, if you are interested in development, please email to fuckcoolapk@pm.me.

# FunJni

在分析Apk的时候难免去分析So层，大多数native层都需要IDA调试，特别是分析数量很多的Apk的时候。我之前就想着，能不能对各种Naitive层进行监听。Apk放进去就可以实现自动化分析，包括调用了哪些方法，每个Java类里面保存了哪些数据。做了什么事情。特别是分析设备指纹的时候，Apk会采集非常多的设备信息。但是这些设备信息，无从下手，不知道应该从哪里改起，加上很多Apk都有混淆，分析起来是一件很费劲的事情。我们完全可以把一些关键信息，进行快速序列化，保存起来，对里面的东西直接搜索我们需要的内容即可即可 。

现在市面上有很多Java层的自吐工具，比如Hook，Java层的常见加密信息，以实现自吐，现在很多大厂基本都不会走Java层基础加密，大多数都是自己实现的加密方式，Java层最多只能算是辅助作用。几年之前还很好用，现在看起来有点鸡肋 。那么有没有什么比较好的分析Native的工具呢？

现在市面上常见的hook基本就是Frida和Xposed占大头，Frida常见的分析工具，比如Frida 的Jnitrace，Unidbg之类的 就很好用，根据Unidbg 的实现逻辑，targetSdk版本号检测，或者检测某个字符串的Hash的返回值 。

检测Frida的方法就更多了，各种反调试都是可以检测出来，比如文件，端口号，特征都是常见的anti点。

但是针对Xposed的检测却很难，需要先拿到Classloader，和一些特征才能判断是否被注入。特别是Lsposed，在Hunter里面也只能通过检测Libart的CRC，内存文件和本地文件的指令累加，判断是否相等，以检测Libart是否被修改，但是这种方式一般大厂也不敢轻易去上，很容易SIGN11。Lsposed因为是系统层注入，加上命名空间，还有本身Lsp的Classloader被隐藏了，在应用层很难去拿到比较好的特征点。这篇文章主要是介绍一下之前几年搞的各种小工具，做了个合计 。也方便各位以后能快速对各种Apk进行分析 。这篇文章读下来也会有不少收获 。

另外代码会开源，还希望各位老板多多start ！

第一版本我只做了6个功能 。

• Java内存序列化
• JNIEnv监听，支持全量监听，防止动态下发SO绕过
• libc String处理函数监听
• JNIEnvRegisterNative监听
• Linker加载CallBack监听
• Java方法调用全量监听

第一版本算是搭了个架子，后面有时间的话会慢慢完善 。当然也欢迎各位大佬进行push和pull ，有好的建议可以在issues提想法 。

使用的话也很简单，Xposed模块，先选择需要Hook的Apk ，内存序列化和Native层Hook只能选一个 。如果没开启内存序列化的话，会弹窗。

推荐根据自己的需求去Hook指定的So 。比如libaaa.so ，只需要输入libaaa或者libaaa.so 即可，如果需要Hook监听多个So的话可以用|分割 。

如 libaaa.so|libbbb.so 即可 。下面会分别介绍一下具体的实现过程，不然只看代码学习效率很低。下面主要是一些实现的细节 。

这个很简单，直接把So注入即可，不同版本调用的api不同 。具体代码如下 。

public static void LoadSoForPath(String path, Object object) {
    try {
        CLog.e("load so path ->  " + path);
        if (Build.VERSION.SDK_INT >= 28) {
            String nativeLoad = (String) XposedHelpers.callMethod(Runtime.getRuntime(), "nativeLoad", path, object);
            CLog.e(nativeLoad == null ? "" : nativeLoad);
        } else {
            String doLoad = (String) XposedHelpers.callMethod(Runtime.getRuntime(), "doLoad", path, object);
            CLog.e(doLoad == null ? "" : doLoad);
        }
        CLog.i("load so for path success "+path);
    } catch (Throwable e) {
        CLog.e("load so for path " + e.getMessage());
    }
}

第一个参数是SO路径，这块有一个细节，卡住了不少人，就是这个方法的参数2，他是一个Classloader，这Classloader 表示当前注入So的Classloader ，在Native层不同的Classloader的作用域是不一样的，跟Dex一样，每个SO也是有属于自己的Classloader，因为Xposed的Classloader和当前进程Context的Classloader是不一样的。

如果你用当前进程的Context的Classloader进行注入，他会找不到Xposed加载的类，因为Classloader不一样 ，会一直提示class not find ，导致无法在Naitive层注册一个Native方法 。解决办法也很简单，直接用XposedHook类的.class.getClassLoader()即可 。

还有就是如何自动化区分被HookApk是64位还是32位。这块代码里面都会很详细的介绍和实现逻辑 ，具体参考代码。

什么是Java内存序列化，就是讲Java层整个虚拟机的全部Java实例转换成JSON字符串，保存到本地 。这个也是我经常用的功能之一 。

他有什么作用？比如一个很简单的CASE场景，我想知道一个大厂Apk设备指纹都保存在哪些Java类里面 ？都保存了什么东西 ？

直接让软件运行30秒以后( 这个时间可以根据自己的业务场景去控制)，扫描一下内存即可 。遍历的时间和Apk的大小有关系，Apk越大保存的对象越多，耗时越长 。

获取内存实例，实现原理也很简单，之前文章介绍过如何获取 https://bbs.kanxue.com/thread-269094.htm

这个Api是一个隐藏api ，目前只做了 android 9- 11支持 。9-11是系统自带Api , 其他版本需要自己实现，我尝试在 5 - 9实现发现稳定性存在问题，所以在XposedJni里面做了判断，所以这个功能只有9-11支持 。

代码如下：

private void startSerialization(Context context) {
    try {
        //手动触发gc,清空多余实例
        System.gc();
        final File file = new File("/data/data/"
                + mTagPackageName + "/" + mProcessName + "_MemorySerializationInfo.txt");
        if (file.exists()) {
            file.delete();
        }
        file.createNewFile();
        //子线程和主线程共享数据
        ThreadUtils.runOnNonUIThread(() -> {
            ArrayList choose = ChooseUtils.choose(Object.class, true);
            int size = choose.size();
            CLog.e("memory object size -> " + size);
            for (int index = 0; index < size; index++) {
                Object obj = choose.get(index);
                String objStr = GsonUtils.obj2str(obj);
                if (objStr != null) {
                    String objClassName = obj.getClass().getName();
                    String infoStr = index + "/" + size + "[" + mProcessName + "]" + objClassName + " " + objStr + "\n";
                    //增加效率暂不打印进度
                    //printfProgress(size,index,context);
                    //ToastUtils.showToast(context,"MemorySerialization["+index+"/"+size+"]");
                    CLog.i(infoStr);
                    FileUtils.saveStringNoClose(infoStr, file);
                }
            }
            FileUtils.saveStringClose();
        }, 30 * 1000);
    } catch (Throwable e) {
        CLog.e("startSerialization error " + e);
    }
}

在子线程开启，将内存全部的Object实例拿到手以后，对每一个Object进行JSON字符串的转换，然后将转换以后的内容保存到本地 。包括Class的类名 。内容的JSON传等信息 。当然也可以根据自己需求取来，只获取需要的类即可 。比如我想查看内存里面全部的String变量 。可以将Object.class换成String.class即可 。方便快速分析和定位 。

效果如下基本一个大一点的Apk对象数量都超过15W以上，大约10分钟左右就可以遍历完毕，和手机配置有关系 。

2023-04-01 23:44:34.749 18522-19106/? I/Zhenxi: [Zhenxi] 287/204804[进程名]android.system.StructTimespec {"tv_nsec":288510927,"tv_sec":1680363817}
2023-04-01 23:44:34.749 18522-19106/? I/Zhenxi: [Zhenxi] 288/204804[进程名]android.system.StructTimespec {"tv_nsec":288510927,"tv_sec":1680363817}
2023-04-01 23:44:34.750 18522-19106/? I/Zhenxi: [Zhenxi] 289/204804[进程名]android.system.StructTimespec {"tv_nsec":288510927,"tv_sec":1680363817}
2023-04-01 23:44:34.752 18522-19106/? I/Zhenxi: [Zhenxi] 290/204804[进程名]android.system.StructStat {"st_atim":{"tv_nsec":288510927,"tv_sec":1680363817},"st_atime":1680363817,"st_blksize":4096,"st_blocks":8,"st_ctim":{"tv_nsec":288510927,"tv_sec":1680363817},"st_ctime":1680363817,"st_dev":64522,"st_gid":10236,"st_ino":137495,"st_mode":33200,"st_mtim":{"tv_nsec":288510927,"tv_sec":1680363817},"st_mtime":1680363817,"st_nlink":1,"st_rdev":0,"st_size":148,"st_uid":10236}
2023-04-01 23:44:34.755 18522-19106/? I/Zhenxi: [Zhenxi] 291/204804[进程名]java.io.BufferedInputStream {"count":148,"marklimit":0,"markpos":-1,"pos":148}
2023-04-01 23:44:34.759 18522-19106/? I/Zhenxi: [Zhenxi] 292/204804[进程名]java.io.FileInputStream {"closeLock":{},"closed":true,"fd":{"descriptor":-1,"ownerId":0},"guard":{},"isFdOwner":true,"path":"/data/user/0/进程名/shared_prefs/RDeliveryHitSubTaskTagFile.xml","tracker":{"isOpen":true,"mode":"READ","opCount":1,"totalByteCount":16384}}
2023-04-01 23:44:34.772 18522-19106/? I/Zhenxi: [Zhenxi] 294/204804[进程名]java.lang.Object {}
2023-04-01 23:44:34.773 18522-19106/? I/Zhenxi: [Zhenxi] 295/204804[进程名]dalvik.system.CloseGuard {}
2023-04-01 23:44:34.774 18522-19106/? I/Zhenxi: [Zhenxi] 296/204804[进程名]libcore.io.IoTracker {"isOpen":true,"mode":"READ","opCount":1,"totalByteCount":16384}
2023-04-01 23:44:34.775 18522-19106/? I/Zhenxi: [Zhenxi] 297/204804[进程名]java.io.FileDescriptor {"descriptor":-1,"ownerId":0}
2023-04-01 23:44:34.776 18522-19106/? I/Zhenxi: [Zhenxi] 298/204804[进程名]android.system.StructTimespec {"tv_nsec":288510927,"tv_sec":1680363817}
2023-04-01 23:44:34.777 18522-19106/? I/Zhenxi: [Zhenxi] 299/204804[进程名]android.system.StructTimespec {"tv_nsec":288510927,"tv_sec":1680363817}
2023-04-01 23:44:34.778 18522-19106/? I/Zhenxi: [Zhenxi] 300/204804[进程名]android.system.StructTimespec {"tv_nsec":288510927,"tv_sec":1680363817}
2023-04-01 23:44:34.779 18522-19106/? I/Zhenxi: [Zhenxi] 301/204804[进程名]android.system.StructStat {"st_atim":{"tv_nsec":288510927,"tv_sec":1680363817},"st_atime":1680363817,"st_blksize":4096,"st_blocks":8,"st_ctim":{"tv_nsec":288510927,"tv_sec":1680363817},"st_ctime":1680363817,"st_dev":64522,"st_gid":10236,"st_ino":137495,"st_mode":33200,"st_mtim":{"tv_nsec":288510927,"tv_sec":1680363817},"st_mtime":1680363817,"st_nlink":1,"st_rdev":0,"st_size":148,"st_uid":10236}

... ...

这个是我之前写的一个小工具，地址如下。

https://github.com/w296488320/JnitraceForCpp

代码直接粘过来的 。今天有时间顺便改了改一些之前错误和多余的逻辑 。

主要监听的函数列表如下 。

HOOK_JNITRACE(env, CallObjectMethodV)
HOOK_JNITRACE(env, CallBooleanMethodV)
HOOK_JNITRACE(env, CallByteMethodV)
HOOK_JNITRACE(env, CallCharMethodV)
HOOK_JNITRACE(env, CallShortMethodV)
HOOK_JNITRACE(env, CallIntMethodV)
HOOK_JNITRACE(env, CallLongMethodV)
HOOK_JNITRACE(env, CallFloatMethodV)
HOOK_JNITRACE(env, CallDoubleMethodV)
HOOK_JNITRACE(env, CallVoidMethodV)

HOOK_JNITRACE(env, CallStaticObjectMethodV)
HOOK_JNITRACE(env, CallStaticBooleanMethodV)
HOOK_JNITRACE(env, CallStaticByteMethodV)
HOOK_JNITRACE(env, CallStaticCharMethodV)
HOOK_JNITRACE(env, CallStaticShortMethodV)
HOOK_JNITRACE(env, CallStaticIntMethodV)
HOOK_JNITRACE(env, CallStaticLongMethodV)
HOOK_JNITRACE(env, CallStaticFloatMethodV)
HOOK_JNITRACE(env, CallStaticDoubleMethodV)
HOOK_JNITRACE(env, CallStaticVoidMethodV)

HOOK_JNITRACE(env, GetObjectField)
HOOK_JNITRACE(env, GetBooleanField)
HOOK_JNITRACE(env, GetByteField)
HOOK_JNITRACE(env, GetCharField)
HOOK_JNITRACE(env, GetShortField)
HOOK_JNITRACE(env, GetIntField)
HOOK_JNITRACE(env, GetLongField)
HOOK_JNITRACE(env, GetFloatField)
HOOK_JNITRACE(env, GetDoubleField)
HOOK_JNITRACE(env, GetStaticObjectField)
HOOK_JNITRACE(env, GetStaticBooleanField)
HOOK_JNITRACE(env, GetStaticByteField)
HOOK_JNITRACE(env, GetStaticCharField)
HOOK_JNITRACE(env, GetStaticShortField)
HOOK_JNITRACE(env, GetStaticIntField)
HOOK_JNITRACE(env, GetStaticLongField)
HOOK_JNITRACE(env, GetStaticFloatField)
HOOK_JNITRACE(env, GetStaticDoubleField)
HOOK_JNITRACE(env, NewStringUTF)
HOOK_JNITRACE(env, GetStringUTFChars)
HOOK_JNITRACE(env, FindClass)
HOOK_JNITRACE(env, ToReflectedMethod)
HOOK_JNITRACE(env, FromReflectedMethod)
HOOK_JNITRACE(env, GetFieldID)
HOOK_JNITRACE(env, GetStaticFieldID)
HOOK_JNITRACE(env, NewObjectV)

都是一些常见的JNI交互函数，Hook以后在调用之前和调用之后将jobject 进行toString打印即可。这块需要注意的是打印可变参数和栈溢出问题，

因为我们也需要调用JNI函数，需要判断哪些SO监听，哪些不需要监听 ，剩下的就是代码细节实现了 。因为打印日志量比较多，所以需要将Log一些信息保存到本地文件里面 。代码实现也很简单，封装了大量的宏，减少工作量 。

//jobject CallObjectMethod(JNIEnv*, jobject, jmethodID, va_list args);
JNI_HOOK_DEF(jobject, CallObjectMethodV, JNIEnv *env, jobject obj, jmethodID jmethodId,
             va_list args)
    DL_INFO
    IS_MATCH
            GET_JOBJECT_INFO(env, obj, "CallObjectMethodV")
            GET_METHOD_INFO_ARGS(env, obj, jmethodId, args, false)
            jobject ret = orig_CallObjectMethodV(env, obj, jmethodId, args);
            getJObjectInfoInternal(env, ret, "result object :", true, nullptr);
            return ret;
        }
    }
    return orig_CallObjectMethodV(env, obj, jmethodId, args);
}

//void CallVoidMethod(jobject obj, jmethodID methodID, va_list args)
JNI_HOOK_DEF(void, CallVoidMethodV, JNIEnv *env, jobject obj, jmethodID jmethodId,
             va_list args)
    DL_INFO
    IS_MATCH
            GET_JOBJECT_INFO(env, obj, "CallVoidMethodV")
            GET_METHOD_INFO_ARGS(env, obj, jmethodId, args, false)
        }
    }
    return orig_CallVoidMethodV(env, obj, jmethodId, args);
}
...

打印效果截取如下 ：

2023-04-01 23:47:27.494 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : vb_platformInfo_channel_id
2023-04-01 23:47:27.494 21432-21457/? I/Zhenxi: [文件名] args 0   1  1
2023-04-01 23:47:27.495 21432-21432/? I/Zhenxi: [文件名] GetStringUTFChars : android.hardware.Sensor
2023-04-01 23:47:27.495 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : key_guid
2023-04-01 23:47:27.495 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : VBIPExchanger_InnerInitTask
2023-04-01 23:47:27.495 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : isMainProc proc:包名:cache packageName:包名
2023-04-01 23:47:27.495 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : VBPBService-6447
2023-04-01 23:47:27.495 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : NXNetwork_Transport_HttpImpl
2023-04-01 23:47:27.495 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : [GetCarrierIPRequest]-1  connectStart():/60.28.219.101:443
2023-04-01 23:47:27.495 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : VBPBService-6447
2023-04-01 23:47:27.496 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : QAD
2023-04-01 23:47:27.496 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : setQAdMediaPlayerCreator() QAD_TVKPlayer注册成功
2023-04-01 23:47:27.496 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : TVK-HighPriorityThread1
2023-04-01 23:47:27.496 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : VBNetStateService_VBNetTypeHelper
2023-04-01 23:47:27.496 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : getNetworkInfo network capability validated:true
2023-04-01 23:47:27.496 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : VBPBService-6447
2023-04-01 23:47:27.496 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : creator_account_info_key
2023-04-01 23:47:27.497 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : vb_platformInfo_channel_id
2023-04-01 23:47:27.497 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : key_guid
2023-04-01 23:47:27.498 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : creator_account_info_key
2023-04-01 23:47:27.498 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : vb_platformInfo_channel_id
2023-04-01 23:47:27.500 21432-21709/? I/Zhenxi: [文件名] GetStringUTFChars : key_guid
2023-04-01 23:47:27.502 21432-21486/? I/Zhenxi: [文件名] GetStringUTFChars : public_io_pool-6479
2023-04-01 23:47:27.503 21432-21796/? I/Zhenxi: [文件名] args 3   17  17
2023-04-01 23:47:27.503 21432-21796/? I/Zhenxi: [文件名] invoke method result Boolean : true
2023-04-01 23:47:27.504 21432-21432/? I/Zhenxi: <<<<<------------------CallBooleanMethodV start--------------------->>>>>
2023-04-01 23:47:27.506 21432-21432/? I/Zhenxi: [文件名] invoke this object  android.hardware.Sensor  {Sensor name="linear_acceleration", vendor="qualcomm", version=1, type=0, maxRange=156.98999, resolution=0.01, power=0.515, minDelay=5000}
2023-04-01 23:47:27.507 21432-21432/? I/Zhenxi: [文件名] invoke method  private boolean android.hardware.Sensor.setType(int)
2023-04-01 23:47:27.508 21432-21432/? I/Zhenxi: [文件名] args 0   10  10
2023-04-01 23:47:27.508 21432-21432/? I/Zhenxi: [文件名] invoke method result Boolean : true
2023-04-01 23:47:27.509 21543-21672/? I/Zhenxi: [文件名] GetStringUTFChars : VBNetStateService_VBNetTypeHelper
2023-04-01 23:47:27.509 21432-21459/? I/Zhenxi: [文件名] invoke this object  android.view.ViewRootImpl$W  android.view.ViewRootImpl$W@43c430d

...

主要处理函数如下

void stringHandler::init() {
    void *handle = dlopen("libc.so", RTLD_NOW);

    if (handle == nullptr) {
        LOG(ERROR) << "strhadler get handle == null   ";
        return;
    }


    HOOK_SYMBOL_DOBBY(handle, strstr)
    HOOK_SYMBOL_DOBBY(handle, strcmp)
    HOOK_SYMBOL_DOBBY(handle, strcpy)
    HOOK_SYMBOL_DOBBY(handle, strdup)

    HOOK_SYMBOL_DOBBY(handle, strxfrm)
    HOOK_SYMBOL_DOBBY(handle, strtok)

//    HOOK_SYMBOL_DOBBY(handle, memcpy)
//    HOOK_SYMBOL_DOBBY(handle, read)
//    HOOK_SYMBOL_DOBBY(handle, write)

//    HOOK_SYMBOL_DOBBY(handle, sprintf);
//    HOOK_SYMBOL_DOBBY(handle, printf);
//    HOOK_SYMBOL_DOBBY(handle, snprintf);
//    HOOK_SYMBOL_DOBBY(handle, vsnprintf);

其他大部分底层都是这几个函数，也是将不同函数的参数进行hook和拦截 。在处理之前和处理之后进行打印 。一般不注重安全的程序员，都会用系统的函数进行比较和替换，而非自己去实现，比如比较当前进程是否正在被调试，我们只需要打印比较传入的参数的内容 。找到以后直接打印调用栈和函数地址 。

可以很快速的定位反调试的位置 。还有其他地方， 也可以通过这些函数也可以获取到很多有用的信息 。

这块我想处理一下C++ STD里面的string ，因为string 会被inline ，所以只能去宿主so里面去hook 。就一直没来得及时间去处理后面有时间补上 。

打印效果如下：

2023-04-01 23:51:02.119 22893-22970/? I/Zhenxi: [文件名]strcmp() arg1 -> /storage/emulated/0/DCIM/.tmfs/.turing.dat  arg2-> /storage/emulated/0/.turing.dat
2023-04-01 23:51:02.119 22893-22970/? I/Zhenxi: [文件名]strcmp() arg1 -> /storage/emulated/0/DCIM/.tmfs/.turing.dat  arg2-> /storage/emulated/0/DCIM/.tmfs/.turing.dat
2023-04-01 23:51:02.119 22893-22970/? I/Zhenxi: [文件名]strcmp() arg1 -> /storage/emulated/0/.turing.dat  arg2-> /storage/emulated/0/.turing.dat
2023-04-01 23:51:02.120 22893-22970/? I/Zhenxi: [文件名]strcmp() arg1 -> /data/user/0/com.xxxxxx.vvvv/app_turingdfp/1/.turing.dat  arg2-> /storage/emulated/0/.turing.dat
2023-04-01 23:51:02.120 22893-22970/? I/Zhenxi: [文件名]strcmp() arg1 -> /data/user/0/com.xxxxxx.vvvv/app_turingdfp/1/.turing.dat  arg2-> /storage/emulated/0/DCIM/.tmfs/.turing.dat
2023-04-01 23:51:02.136 23013-23041/? I/Zhenxi: [文件名]strcpy() arg1 -> android.os.Handler$MessengerImpl  arg2-> android.os.Handler$MessengerImplresult -> android.os.Handler$MessengerImpl
2023-04-01 23:51:02.136 23013-23041/? I/Zhenxi: [文件名]strcmp() arg1 -> org.chromium.android_webview.AwContents  arg2-> android.os.Handler$MessengerImpl
2023-04-01 23:51:02.136 23013-23041/? I/Zhenxi: [文件名]strcmp() arg1 -> android.app.ActivityThread$ApplicationThread  arg2-> android.os.Handler$MessengerImpl
2023-04-01 23:51:02.136 23013-23041/? I/Zhenxi: [文件名]strcpy() arg1 -> android.os.IMessenger$Stub  arg2-> android.os.IMessenger$Stubresult -> android.os.IMessenger$Stub
2023-04-01 23:51:02.137 23013-23041/? I/Zhenxi: [文件名]strcmp() arg1 -> org.chromium.android_webview.AwContents  arg2-> android.os.IMessenger$Stub
2023-04-01 23:51:02.137 23013-23041/? I/Zhenxi: [文件名]strcmp() arg1 -> android.app.ActivityThread$ApplicationThread  arg2-> android.os.IMessenger$Stub
2023-04-01 23:51:02.137 23013-23041/? I/Zhenxi: [文件名]strcpy() arg1 -> android.os.Binder  arg2-> android.os.Binderresult -> android.os.Binder
2023-04-01 23:51:02.137 23013-23041/? I/Zhenxi: [文件名]strcmp() arg1 -> org.chromium.android_webview.AwContents  arg2-> android.os.Binder
2023-04-01 23:51:02.138 23013-23041/? I/Zhenxi: [文件名]strcmp() arg1 -> android.app.ActivityThread$ApplicationThread  arg2-> android.os.Binder
....

这个实现也很简单，直接hook artmethod里面的RegisterNative ,然后调用prettyMethod函数指针打印artmethod信息 。

我这块在在回调里面打印了，方法基础签名信息 ，绝对地址，相对地址，所属efl文件 。这个方法里面没做判断，会打印注册全部的信息 。

HOOK_DEF(void*, RegisterNative, void *thiz, void *native_method) {
    string basicString = invokePrintf_org_PrettyMethodSym(thiz, true);
    if (isSave) {
        *invokeOs << basicString.append("\n");
    }
    Dl_info info;
    dladdr(native_method, &info);
    size_t relative_offset =
            reinterpret_cast(native_method) - reinterpret_cast(info.dli_fbase);

    LOG(INFO) <<"REGISTER_NATIVE " << basicString.c_str() << " absolute address(内存地址) -> "
                        << native_method << "  relative offset(相对地址) "<<(void*)relative_offset
                        <<"所属ELF文件 ["< 0x77787377fc  relative offset(相对地址) 0x3357fc所属ELF文件 [mmmm.so]
2023-04-01 23:53:12.617 24017-24247/? I/Zhenxi: REGISTER_NATIVE long com.xxxxxx.bbbb.core.downloadproxy.jni.TPDownloadProxyNative.verifyOfflineCacheSync(java.lang.String, int, java.lang.String, java.lang.String)
     absolute address(内存地址) -> 0x7778737908  relative offset(相对地址) 0x335908所属ELF文件 [mmmm.so]
2023-04-01 23:53:12.617 24017-24247/? I/Zhenxi: REGISTER_NATIVE void com.xxxxxx.bbbb.core.downloadproxy.jni.TPDownloadProxyNative.setPlayerState(int, int)
     absolute address(内存地址) -> 0x7778737a68  relative offset(相对地址) 0x335a68所属ELF文件 [mmmm.so]
2023-04-01 23:53:12.617 24017-24247/? I/Zhenxi: REGISTER_NATIVE void com.xxxxxx.bbbb.core.downloadproxy.jni.TPDownloadProxyNative.updateTaskInfo(int, java.lang.String, java.lang.String)
     absolute address(内存地址) -> 0x7778737a74  relative offset(相对地址) 0x335a74所属ELF文件 [mmmm.so]
2023-04-01 23:53:12.617 24017-24247/? I/Zhenxi: REGISTER_NATIVE void com.xxxxxx.bbbb.core.downloadproxy.jni.TPDownloadProxyNative.updatePlayerPlayMsg(int, int, int, int)
     absolute address(内存地址) -> 0x7778737b78  relative offset(相对地址) 0x335b78所属ELF文件 [mmmm.so]
2023-04-01 23:53:12.617 24017-24247/? I/Zhenxi: REGISTER_NATIVE boolean com.xxxxxx.bbbb.core.downloadproxy.jni.TPDownloadProxyNative.isNativeReadyForWork()
     absolute address(内存地址) -> 0x7778737b8c  relative offset(相对地址) 0x335b8c所属ELF文件 [mmmm.so]
...

这个方法里面主要是Hook了 linker 底层open的方法，在Linker刚刚将内存加载到内存里还没有进行初始化的时候，得到一个回调。

也是详细打印了各种信息 ，比如SO开始地址，结束地址，ELF的长度。可以在这块进行SO的dump和保存，这个时机点还有一个作用就是做监听和资源文件。

举个栗子，在对游戏源码进行脱壳和修复的时候，比如LUA文件的dump修复，是需要先Hook buffloader函数的 ，也就是在这这个时机点进行Hook 。So刚刚加载到内存里面，还没有进行源码的加载，即刻进行Hook ，这么一来他加载的文件都会被拦截。实际太早或者太晚，都可能导致dump的不全 。

这块也是暴露出来一个时机点，方便Hook 。

void onSoLoadedAfter(const char *filename,void *ret){
    auto mapInfo = getSoBaseAddress(filename);
    char buffer[PATH_MAX];
    sprintf(buffer, "linker load %s  start-> 0x%zx  end-> 0x%zx  size -> %lu",
            filename, mapInfo.start, mapInfo.end, (mapInfo.end - mapInfo.start));
    if (isSave) {
        if (hookStrHandlerOs != nullptr) {
            (*hookStrHandlerOs) << buffer;
        }
    }
    LOGI("%s ", buffer);
}

打印效果如下：

2023-04-01 23:53:12.023 24017-24429/? I/Zhenxi: linker load /data/app/~~KJajvMQT0WLC5kpaiv75pA==/baoming-ZPiDMFjwVCA12Ot9z_btog==/lib/arm64/yyyy.so  start-> 0x77a275b000  end-> 0x77a27ad000  size -> 335872 
2023-04-01 23:53:12.140 24017-24247/? I/Zhenxi: linker load /data/app/~~KJajvMQT0WLC5kpaiv75pA==/baoming-ZPiDMFjwVCA12Ot9z_btog==/lib/arm64/kkkk.so  start-> 0x778f68b000  end-> 0x779054c000  size -> 15470592 
2023-04-01 23:53:12.172 24017-24424/? I/Zhenxi: linker load libnetd_client.so  start-> 0x78ff86c000  end-> 0x78ff875000  size -> 36864 
2023-04-01 23:53:12.362 24017-24429/? I/Zhenxi: linker load /data/app/~~KJajvMQT0WLC5kpaiv75pA==/baoming-ZPiDMFjwVCA12Ot9z_btog==/lib/arm64/libckeygeneratorV2.so  start-> 0x7783a48000  end-> 0x7783aeb000  size -> 667648 
2023-04-01 23:53:12.410 24017-24429/? I/Zhenxi: linker load /data/app/~~KJajvMQT0WLC5kpaiv75pA==/baoming-ZPiDMFjwVCA12Ot9z_btog==/lib/arm64/libxps_ws.so  start-> 0x778159a000  end-> 0x77816ef000  size -> 1396736 
2023-04-01 23:53:12.611 24017-24247/? I/Zhenxi: linker load /data/app/~~KJajvMQT0WLC5kpaiv75pA==/baoming-ZPiDMFjwVCA12Ot9z_btog==/lib/arm64/libDownloadProxy.so  start-> 0x7778402000  end-> 0x7778d73000  size -> 9900032 
2023-04-01 23:53:12.700 24017-24247/? I/Zhenxi: linker load libc.so  start-> 0x7900557000  end-> 0x7900653000  size -> 1032192 
2023-04-01 23:53:12.729 23903-23903/? I/Zhenxi: linker load /data/app/~~KJajvMQT0WLC5kpaiv75pA==/baoming-ZPiDMFjwVCA12Ot9z_btog==/lib/arm64/kkkk.so  start-> 0x772d186000  end-> 0x772e047000  size -> 15470592 
...

主要是Hook了artmethod的invoke方法，一切的java方法底层都会走这个方法，包括脱壳也是修改的这个方法获取被抽取的指令，然后对Dex进行重构 。

我想尝试在这个方法里面对参数进行打印，但是失败了，在源码里面很好修改，但是通过Hook的话很多函数拿不到 ，加上一些核心的方法被编译器inline了，很不好操作和处理，就没继续关注了 。如果你有想法和思路可以提issues 或者提交代码 。这个方法不建议开启，个人用的很少，主要打印量太大了，一秒几千条日志 。他会打印系统的一些Java方法 ，所以很卡顿 ，不过如果你想做监听和记录 ，分析一些隐藏Api很有用 。callback实现如下 。

HOOK_DEF(void*, invoke, void *thiz, void *self, uint32_t *args, uint32_t args_size, void *result,
         const char *shorty) {

    string basicString = invokePrintf_org_PrettyMethodSym(thiz, true);

    LOG(INFO) << "invoke method info -> " << basicString;

    if (isSave) {
        *invokeOs << basicString.append("\n");
    }
    return orig_invoke(thiz, self, args, args_size, result, shorty);
}

这个是一个我自己封装的一个native库，里面有很多常用的方法，都进行了封装 ，删除了一些改机和没用的模块，留了一些常用的模块 。

主要是下面几个比较常用的 ，也方便后续开发和维护 。

• hook模块
• 符号查找模块（支持非导出函数）
• 常用工具类模块
• raw_syscall模块
• libpath

比如常见的hook操作 。如何inlinehook少于四个字节的方法，如何插装hook和如何异常hook 。这些都不需要关注，导入头文件以后直接 。

HookUtils::Hooker(xxx,(void *) xxx,(void **) &new_xxx);

一键hook即可 。底层封装分三步实现，先dobby hook ，失败了则使用异常hook， 最后dobby插装 。代码如下

bool HookUtils::Hooker(void *dysym, void *newrep, void **org) {
    if (dysym == nullptr) {
        LOG(ERROR) << "dobby hook org == null ";
        return false;
    }
    if (hookedList == nullptr) {
        hookedList = new list();
    }

    //如果这个地址已经被Hook了 。也有可能返回失败 。dobby 会提示 already been hooked 。
    for (void *ptr: *hookedList) {
        if (ptr == dysym) {
            //如果保存了这个地址,说明之前hook成功过,我们也认为hook成功
            return true;
        }
    }

    bool ret = DobbyHook(dysym,
                         reinterpret_cast(newrep),
                         reinterpret_cast(org)) == RT_SUCCESS;
    if (ret) {
        //LOG(ERROR) << "hook utils hook success !" ;
        //将地址添加到已经hook的列表,防止这个地址被多次hook
        hookedList->push_back(dysym);
        return true;
    }

    //如果dobby hook失败了,采用sandhook异常hook进行补救,
    LOG(ERROR) << "zhenxi runtime inlinehook start sandhook InlineHookImpl  ";
    ret = SandHook::Inline::InlineHookImpl(dysym, newrep, org);
    if (ret) {
        hookedList->push_back(dysym);
        return true;
    }

    LOG(ERROR)
            << ">>>>>>>>>>>>>>> sandhook inlinehook hook error,start dobby branch_trampoline hook ";
    //如果sandhook sign hook 也失败了,我们采用dobby附近插装去hook
    dobby_enable_near_branch_trampoline();
    //二次hook
    ret = DobbyHook(dysym,
                    reinterpret_cast(newrep),
                    reinterpret_cast(org)) == RT_SUCCESS;
    //关闭附近插装
    dobby_disable_near_branch_trampoline();
    if (!ret) {
        LOG(ERROR) << "!!!!!!!!!!!!!!!  HookUtils hook error   ";
        return false;
    }
    hookedList->push_back(dysym);
    return ret;

}

其他的不一一概述了，感兴趣的可以去看代码 。项目主要采用C++ 20编译的，需要NDK 23以上版本支持 。

• 移除所有广告（包括开屏广告、信息流广告、评论区广告）

本模块使用 Yuki Hook API。

Refer to kazutoiris/zuiyou-adfree

Make RoamingX Great Again !

Issue, Pull Requests, Star, Fork are all welcomed.

Designed for:

• Bypass restrictions of RoamingX.

Only support LSPosed.

Enjoy :)

This module is built using Yuki Hook API.

• 移除所有广告（包括开屏广告、商城功能、横幅广告）

本模块使用 Yuki Hook API。

Refer to kazutoiris/dingda-adfree

Let all apps dive into the realm of Infinite Illusion !

Issue, Pull Requests, Star, Fork are all welcomed.

Designed for:

• Bypass restrictions of Fake Location.

Only support LSPosed.

Enjoy :)

This module is built using Yuki Hook API.

钉钉反撤回神器

• Anti-Recall
• Recall anything

Refer to kazutoiris/anti-dingtalk-recall

This repository will probably not update any longer, since I am now wirting a new app to change view attributes while running. It's like element inspection in web development. Follow this link.

本仓库不会再更新（可能），因为我现在在写一个更加通用的应用，用来修改应用运行过程中的View参数，就像web开发中的元素审查一样。详情可以查看这里。

This application provides features to modify any TextView in any other applications.

本应用提供了修改原生Android应用的文本功能。

This application depends on the Xposed framework. For more information about this framework, just visit their website.

Here's the hook process:

1. Hook the onCreate method of Application .
2. After application hook, register an ActivityLifecycleCallback.
3. In ActivityLifecycleCallback, hook the OnClickListener or directly set it if there's no listener set inside the TextView, set it to my own customized one.

Quite simple right?

本应用依赖于Xposed框架，如果想要获取更多关于本框架的信息，请访问他们的官网。

应用Hook流程：

1. Hook掉Application类的onCreate方法。
2. 在执行onCreate之后，注册ActivityLifecycleCallback回调。
3. 在ActivityLifecycleCallback中，替换掉TextView中的OnClickListener，把它设置成自己的封装实现。

是不是挺简单的，你也可以自己写一个。

This application is completely free and 100% open-source. It's just for learning usage. I don't take any responsibilities for the result you make while using this application.

本应用完全开源免费，且仅供学习交流使用。使用者在使用本应用的过程产生的任何后果都与开发者无关。

Screenshots CANNOT be used as evidences!

都说了截图能当个锤子的证据.jpg

解锁Pydroid 3

支持6.4版本与7.52版本

链接: 123云盘

自用模块。完美适用于FLYme 10.5.5.1A，附近的版本应该也适用，但是其他系统有些功能应该没法用。
功能有 :

• 隐藏wifi图标

• 隐藏移动图标

• 隐藏其他图标

• 双击状态栏锁屏

• 网速小于200kb/s不显示

• 修改时间样式

• 去除下拉通知中心背景

目前只有这些，有意思的功能可以和我说，我也觉得有意思的话会实现一下哦?

由于自用，就没有怎么写ui，使用起来也很简单。

下方文本是可以编辑的，只需要把"?"改为"☹️"或者反过来就行。代表应用，也就是true，代表不应用，也就是false。其中 is_change_time_style比较特殊，它有三个附加属性，bold(加粗), null(时间转换为时辰), cpu(显示cpu温度)，中间用&链接。比如我图中状态栏的效果，你可以修改成is_change_time_style = ?&bold&cpu。部分内容需要root，不要忘了手动授予
使用愉快?

PokeGOPip is an Xposed module that enables Picture-in-Picture (PiP) mode in Pokémon GO, allowing you to play the game in a small, resizable overlay window. This feature can be useful for multitasking while keeping the game open, ideal for users who want to continue their Pokémon GO sessions while using other apps.

• Enables Picture-in-Picture (PiP) mode in Pokémon GO
• Allows users to continue playing while multitasking
• Resizable, movable overlay window

1. Install Xposed or LSPosed
2. Install PokeGOPip
3. Enable the module in Xposed/LSPosed
4. Select both Pokémon GO and System Framework in the scope settings
5. System Framework access is required to grant PiP permissions
6. Reboot your device for the changes to take effect

This module is intended for personal use only and is not affiliated with or endorsed by Niantic, Inc., or The Pokémon Company. Use of this module may violate Pokémon GO's terms of service. Use at your own risk.

Enjoy multitasking with Pokémon GO in PiP mode!

固定应用(Pinning App)

English | 简体中文

• 模块通过调用安卓自有的固定应用功能实现对应用的固定。
• 上层建筑比如：
• 触发固定方式、忽略退出手势、拒绝弹出侧边栏、退出固定息屏、
• Pad： 拒绝呼出Dock栏，拒绝响应小窗手势，隐藏小白条。
• 等上述功能均为模块自身实现，不依赖原生安卓的固定应用功能。
• ~~本模块功能类似于IOS的引导式访问~~

• 当进入固定模式时，手机将被固定显示一个App，系统返回等手势将失效。
• 如下是GIF动图展示：

• 无法查看点击此处

• 首先确定你是小米手机，模块只支持小米手机！当然如果你有办法可以为本项目PR，来获得更广泛的支持！
• 其次下载本模块并勾选推荐的作用域，然后重启手机！
• 重启完成模块即正在运行。

• 在应用界面长按通知栏1~2秒即可进入，如果失败请确定期间手指没有移动！
• 进入时会有Toast提示，如果出现提示即成功进入
• 再次在本应用界面长按通知栏1~2秒即可退出！同样也会有Toast提示！

• 打开MT或其他可以执行Shell命令的软件。
• 执行su回车获取ROOT权限，这是必要的！！
• 执行pm pinning -l 0为关闭本功能；
• 执行pm pinning -l 1为开启本功能。
• 执行pm pinning -l -g可获取本功能状态。
• 获取详细帮助可执行pm pinning -h

• 开启后在退出固定模式时将强制跳转到锁屏密码界面。
• ~~妈妈再也不用担心手机隐私被别人看见啦！~~

• 打开MT或其他可以执行Shell命令的软件。
• 执行su回车获取ROOT权限，这是必要的！！
• 执行pm pinning -s 0为关闭本功能；
• 执行pm pinning -s 1为开启本功能。
• 执行pm pinning -s -g可获取本功能状态。
• 获取详细帮助可执行pm pinning -h

• 顾名思义，开启后进入固定模式不能呼出侧边栏。

• Q：为什么我没有成功进入？ A：可能长按时间偏短或者手指移动，请再试。
• Q：为什么在桌面时长按无效？ A：模块暂不支持在桌面时进入固定模式。
• Q：为什么提示“`请在被锁定应用界面解锁”？ A：你通过某种手段切换了界面，需要在进入固定模式的App界面解锁。但无需担心，超过一定次数会自动解除固定模式。
• Q：为什么模块没有工作？ A：请带上Lsp日志等信息反馈，虽然我修的概率很小。

• 感谢Android官方提供本功能的基本底层支持！
• 感谢Xposed工具提供强大的Hook支持！
• 感谢DexKit工具对本模块功能性支持！
• 感谢Sevtinge对本模块适配Pad做出的贡献！

• 本项目完全开源！
• 但是也请遵守GPL3.0的开源协议！
• 任何使用本模块必须注明作者和GitHub地址！
• 对本模块有任何要求请不要疯狂Call作者，请自行PR，我没有义务实现你的功能或适配你的手机！

• QQ：517788148
• 电报：t.me/HChen_AppRetention

• 爱发电：焕晨HChen

• 解锁外部设备功能
• 默认使用目录中的的 icon.png 文件作为封面
• 去除广告

模块

软件

NoActive正如其名，让Android后台CPU不再活跃

模块功能介绍：

通过Hook系统框架实现Android墓碑

作用域说明：

系统框架：

1、Hook应用切换事件，冻结切换至后台的应用，解冻切换至前台的应用

2、Hook广播分发事件，屏蔽被冻结的应用接收广播，从而避免触发广播ANR

3、Hook应用Activity休眠事件，阻止休眠长时间不活跃的Activity(休眠后存在打开重载、最近任务中消失问题)

4、Hook系统ANR事件，由于冻结之后，应用无法做出响应被系统认为是ANR，所以需要屏蔽ANR避免系统误杀被冻结的APP

5、Hook系统是否开启暂停执行已缓存变量获取，由于系统自带的暂停执行已缓存在收到广播后可能解冻再次活跃

6、Hook显示暂停执行已缓存开关，仅显示无作用(Happy freezer)

7、Hook获取PMS为冻结后的APP释放唤醒锁

8、Hook接收小米Millet网络临时解冻APP

9、Hook接收小米Binder通知临时解冻APP

10、Hook获取NMS为冻结后的APP断开网络连接

11、Hook控制AppStandby为冻结后的APP限制后台

电量和性能(MIUI)： 1、Hook杀进程方法，阻止电量性能杀后台 2、禁用millet，该功能与NoActive重复

冻结方式说明：

目前Linux进程冻结方式有Kill -19、Kill -20、Cgroup Freezer V1、Cgroup Freezer V2

推荐 API & V2 > Kill -19 & Kill -20

首推API和V2其次Kill，小米MIUI13机子可以使用V1，其他机子使用V1会有内存泄露

Freezer天然优势，Kill存在一段时间后进程还在打开仍然重载

部分机子存在系统框架无法读写Freezer目录，可以开启提权模式，与Thanox的Su插件一样

关于白名单推送进程，需要同时白名单主进程，才不会被StandBy限制后台

MIUI对APP开启保持连接，即可启用网络解冻，微信等即时通信APP必备

日志说明：

日志级别分为debug(调试信息)、info(基本信息)、warn(警告信息)、error(错误信息)

NoActive交流QQ群750812133

如果你觉得模块不错，可以打赏开发者一瓶可乐(理性打赏)

这是一个适用于MIUI 13/14/HyperOS的基带增强型Xposed模块

• 为部分机型增加双卡5G支持
• 解锁N5/N8/N28频段支持
• 智能双卡切换
• 副卡VoLTE通话时可联网
• 解锁MTB的开发权限限制
• 智能双卡
• 机场/郊野/地铁网络场景优化
• 无视白名单开启郊野网络场景优化
• 全局开启5G双卡数据并发
• 全局开启5G双卡数据辅助
• 智能双卡并发无视 频段限制
• 关闭视频彩铃
• 智能互转

• 是小米/Redmi手机，非sgsi/gsi
• Android版本≥12, MIUI版本≥13
• 双卡5G支持需要使用骁龙865/870机型方可开启
• 智能双卡...全局5G双卡数据并发等功能需要HyperOS方可使用

• 在LSPosed仓库内下载并安装
• 在LSPosed App内开启本模块，并勾选所有的推荐作用域
• 开启/关闭你需要的功能
• 重启手机后即可享用

• 解锁N5/N5/N28频段后实际可能因为信令不上报导致无效，如果有大佬能解决欢迎pr

• 双卡5G功能因为副卡为5G NSA，且因为目前NSA基站较少，系统不会优先连接，请自行在拨号盘输入##4636##锁定NR，若无服务则说明附近没有NSA基站
• 请勾选全部的作用域，否则可能出现在系统设置里没有功能开关的问题

• Github Action: https://github.com/Weverses/ModemPro/actions
• Github Releases: https://github.com/Xposed-Modules-Repo/com.weverses.modempro/releases/
• Xposed Modules Repo: https://modules.lsposed.org/module/com.weverses.modempro

• 源码 ModemPro

• GNU Lesser General Public License v2.1 577fkj/blockmiui
• Apache License 2.0 KyuubiRan/EzXHelper

GNU General Public License v3.0

Historically, setting a custom MAC address on Android was very easy for rooted users. Starting with Android 12, however, Google's implementation of MAC address randomization has made it impossible, as the MAC address is always changed when the network state is altered. If you have encountered this problem, then you need MACsposed! MACsposed is an Xposed module that blocks the MAC address randomizer on Android 12 through 15 and provides a user-friendly interface for spoofing your MAC address. Do you have other spoofing tools that you would prefer to use instead? No problem! Simply enable MACsposed and go back to using your preferred address spoofing tool.

MACsposed is not free software and requires an in-app purchase of a subscription or a lifetime license to unlock its functionality.

⚠️ WARNING: MACsposed is intended for rooted devices running Android 12 through 15 and requires Xposed. The required Xposed variant to use is LSPosed. Other Xposed variants will not work. Additionally, this module cannot be guaranteed to work on all devices. In the worst case, it can cause a bootloop. Use at your own risk.

An Xposed module that supports LSPatch and is compatible with all versions

LSPatchをサポートし、すべてのバージョンに対応するXposedモジュール

• Remove ads / 広告の削除
• Remove tabs / タブの削除

Android's app installation system does not allow users to downgrade to an older version of an app when they already have a newer version installed. Let Me Downgrade is an Xposed module for Android 12 through 15 QPR1 that enables users to bypass this restriction. As an added bonus, Let Me Downgrade provides a Quick Settings tile to easily enable and disable the downgrade block.

⚠️ WARNING: Let Me Downgrade is intended for rooted devices running Android 12 through 15 QPR1 and requires Xposed. The required Xposed variant to use is LSPosed. Other Xposed variants will not work. Additionally, this module cannot be guaranteed to work on all devices. In the worst case, it can cause a bootloop. Use at your own risk.

To use Let Me Downgrade: 1. Install LSposed. This requires your device to be rooted with Magisk or KernelSU. Installation instructions for LSPosed are available here. 2. Install Let Me Downgrade. 3. Activate the Let Me Downgrade module in the LSposed user interface.

1. Reboot your device and sign in.

2. Open the quick settings panel. The Let Me Downgrade tile will appear.

3. Toggle the Let Me Downgrade tile on or off to enable or disable it.

[Android 14+] Xposed module to kill foreground app on "Back" button long-press.

ColorOS 应用包安装程序自动点击安装与完成按钮，记得配合ColorOSTool开启原生安装程序哦！