LSPosed / LSPatch

LSPatch: A non-root Xposed framework extending from LSPosed
GNU General Public License v3.0
6.71k stars 707 forks source link

[Bug] CameraManager.openCamera not hooked #249

Closed incapdns closed 10 months ago

incapdns commented 10 months ago

Steps to reproduce/复现步骤

1. Download any app that uses CameraX, ie: https://github.com/robertlevonyan/camerax-demo 2. Hook the following function:

hookMethod(
    CameraManager::class,
    "openCamera",
    {
        showMessage("MANAGER? 1")
        val callback = it.args[1] as StateCallback?
        callback?.let(::captureStateCallback)
    },
    String::class,
    StateCallback::class,
    Handler::class
)

3. You will see the function was not called, and after analyzing, I realized that the hook is not picking up this function

Importante Note: The function is working normally (that is, xposed is intercepting) if I use an application that uses the Android Camera 2 API, but anyway, the CameraX API uses CameraManager.openCamera internally, see: image

I tested with two local applications, and the first one that uses CameraManager.openCamera worked normally, and the second one that uses CameraX did not work

It is worth mentioning that when using Frida Gadget, on a non-rooted device like my S10 + Plus, the function is correctly intercepted in both applications (Camera2API and CameraX).

For this reason I believe it is a bug in LSPatch, that is, why would it work in Frida and not in LSPatch?

Expected behaviour/预期行为

That the function is intercepted successfully

Actual behaviour/实际行为

The function is not being intercepted when using an application that uses CameraX

Xposed Module List/Xposed 模块列表

https://github.com/incapdns/NewVCAM

LSPatch version/LSPatch 版本

0.5.1

Android version/Android 版本

12

Shizuku version/Shizuku 版本

13.5

Version requirement/版本要求

Apk file/Apk 文件

Debug version TwoApplications.zip

CameraX.apk: The app which contains the CameraX which uses indirectly CameraDevice.openCamera

Camera2.apk: The app which contains CameraDevice.openCamera directly

Logs/日志

``` N/A ```
JasonKhew96 commented 10 months ago

unable to reproduce