search

canyie / Dreamland

A third-party Xposed framework implementation which supports Android 5.0~14.
GNU General Public License v3.0
730 stars 69 forks source link

Dreamland Manager 显示框架未安装 #38

Open realSaltyFish opened 1 month ago

realSaltyFish commented 1 month ago

LineageOS, Android 14 (API 34), arm64-v8a, Magisk 27.0, Dreamland 2.1_2106, Dreamland Manager 0.0.8

在安装梦境框架前已经启用了 Zygisk，从 Magisk 刷 zip 包时也显示安装了 Zygisk flavor，但 Dreamland Manager 显示框架未安装（The device does not currently support the dreamland framework）

Magisk 日志如下：

03-05 16:04:56.880   916   916 I : Magisk 27.0(27000) daemon started
03-05 16:04:56.881   916   916 I : * Device API level: 34
03-05 16:04:56.890   916   918 I : ** post-fs-data mode running
03-05 16:04:56.891   916   918 I : * Mounting mirrors
03-05 16:04:56.985   916   918 I : * Initializing Magisk environment
03-05 16:04:57.017   916   918 I : * Running post-fs-data.d scripts
03-05 16:04:57.025   916   918 I : Upgrade / New module: riru_dreamland
03-05 16:04:57.026   916   918 I : * Running module post-fs-data scripts
03-05 16:04:57.029   923   923 I : riru_dreamland: exec [post-fs-data.sh]
03-05 16:04:57.036   916   918 I : * Loading modules
03-05 16:04:57.036   916   918 I : riru_dreamland: loading [system.prop]
08-15 22:24:42.690   986   986 I : zygisk32: replace nativeForkAndSpecialize
08-15 22:24:42.690   986   986 I : zygisk32: replace nativeSpecializeAppProcess
08-15 22:24:42.690   986   986 I : zygisk32: replace nativeForkSystemServer
08-15 22:24:42.739   985   985 I : zygisk64: replace nativeForkAndSpecialize
08-15 22:24:42.739   985   985 I : zygisk64: replace nativeSpecializeAppProcess
08-15 22:24:42.739   985   985 I : zygisk64: replace nativeForkSystemServer
08-15 22:24:42.883   916   918 I : ** late_start service mode running
08-15 22:24:42.883   916   918 I : * Running service.d scripts
08-15 22:24:42.884   916   918 I : * Running module service scripts
08-15 22:24:42.884   916   918 I : riru_dreamland: exec [service.sh]
08-15 22:24:44.279   916   918 I : denylist: initializing internal data structures
08-15 22:24:54.429   916   918 I : ** boot-complete triggered

日志中出现 riru_dreamland 是正常的吗？

尝试过禁用 Zygisk 并安装远古版本 Riru，此时 Magisk 显示安装了 Riru flavor 的梦境框架，但是重启后 Manager 依然显示未安装。

鄙人不才，对安卓的了解不如大佬深入，但也算有一点理解和排查问题的能力，大佬需要什么信息尽管说。

realSaltyFish commented 1 month ago

在开机后首次启动 Dreamland Manager 时，logcat 显示以下错误：

Dreamland error in app process
java.lang.ExceptionInInitializerError
    at top.canyie.dreamland.Main.hookPackageLoad(SourceFile:4)
    at top.canyie.dreamland.Main.onAppProcessStart(SourceFile:90)
    at com.android.internal.os.Zygote.nativeSpecializeAppProcess(Native Method)
    at com.android.internal.os.Zygote.specializeAppProcess(Zygote.java:439)
    at com.android.internal.os.Zygote.childMain(Zygote.java:874)
    at com.android.internal.os.Zygote.forkSimpleApps(Zygote.java:734)
    at com.android.internal.os.ZygoteConnection.processCommand(ZygoteConnection.java:288)
    at com.android.internal.os.ZygoteServer.runSelectLoop(ZygoteServer.java:521)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:865)
Caused by: top.canyie.dreamland.utils.reflect.UncheckedNoSuchFieldException: No field 'compatInfo' found in class android.app.ActivityThread$AppBindData
    at top.canyie.dreamland.utils.reflect.Reflection.a(SourceFile:63)
    at mirror.android.app.ActivityThread$AppBindData.<clinit>(SourceFile:29)
    at top.canyie.dreamland.Main.hookPackageLoad(SourceFile:4) 
    at top.canyie.dreamland.Main.onAppProcessStart(SourceFile:90) 
    at com.android.internal.os.Zygote.nativeSpecializeAppProcess(Native Method) 
    at com.android.internal.os.Zygote.specializeAppProcess(Zygote.java:439) 
    at com.android.internal.os.Zygote.childMain(Zygote.java:874) 
    at com.android.internal.os.Zygote.forkSimpleApps(Zygote.java:734) 
    at com.android.internal.os.ZygoteConnection.processCommand(ZygoteConnection.java:288) 
    at com.android.internal.os.ZygoteServer.runSelectLoop(ZygoteServer.java:521) 
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:865) 
Master0fEvil commented 1 month ago

I don't understand Chinese but I get the same issue probably, running lineageos gsi with android 14

realSaltyFish commented 1 month ago

初步确认问题如下：在我的系统上 android.app.ActivityThread$AppBindData class 中不存在 compatInfo 这个 field。当 Dreamland 的 AppBindData mirror class 初始化时尝试从系统 AppBindData class 的 Reflection 中获取对应的 field，导致报错。

https://github.com/canyie/Dreamland/blob/d4dbb2ea3f4959642c2ddcd62417e47abc854ee0/app/src/main/java/mirror/android/app/ActivityThread.java#L33

注意 Dreamland 框架实际上已经激活（能主动 hook Manager 进程）但其和 Manager 进程的通信出现了一些问题，使得 Manager 无法识别激活状态。

下图为在此处添加 debug print 获取到对应的 Reflection 上所有声明过的 field。

image

我的系统基于 AP2A.240805.005，即 Android 14.0.0 R55，对应代码在此处 ，和截图对比可以发现实际运行时其它 field 都有，唯独少了 compatInfo。原因暂且不明。

Dreamland 获取 compatInfo 实例后只在这里进行了使用：

https://github.com/canyie/Dreamland/blob/d4dbb2ea3f4959642c2ddcd62417e47abc854ee0/app/src/main/java/top/canyie/dreamland/Main.java#L165-L169

可见 Dreamland 需要它的唯一用处是通过 getPackageInfoNoCheck 函数获取 Activity 对应的 LoadedApk。在 Android 14 源码中 getPackageInfoNoCheck 函数有一个只需要 ApplicationInfo 参数的 overload，定义如下：

https://cs.android.com/android/platform/superproject/+/android-14.0.0_r55:frameworks/base/core/java/android/app/ActivityThread.java;l=2844-2848

    @Override
    public LoadedApk getPackageInfoNoCheck(ApplicationInfo ai) {
        return getPackageInfo(ai, mCompatibilityInfo, null /* baseLoader */,
                false /* securityViolation */, true /* includeCode */, false /* registerPackage */);
    }

将该函数的 stub 修改为这一 overload 并且删除获取 compatInfo field 的代码即可让 Dreamland Manager 识别到框架已经激活，并正常管理框架。以下测试 build 包含了这一改动：

dreamland-2106-release.zip

值得注意的是，这一单参数 overload 是最近的 Android 版本引入的，Android 13 QPR 1 的源码中还没有这个 overload 的声明，因此这一改动会使得 Dreamland 不再兼容 Android 13 以及更早的版本，所以暂时还不能提 PR。

根据 @Master0fEvil 的说法，如果 LineageOS 21 GSI 也存在此问题，可能是 LineageOS 对 ActivityThread.java 的内部实现进行了魔改。compatInfo 这一 field 在 Android 源码中被标注为不适合外部调用，因此底层实现可以随时发生变化。需要针对 LineageOS 构建流程进行更深入的分析来确定原因。

@Master0fEvil You can use translation software to understand the contents of this thread. My apologies for the inconvenience. I prefer to post issues in Chinese in a predominantly Chinese community to facilitate smoother communication. Btw, thanks for reporting your experience!

Master0fEvil commented 1 month ago

@realSaltyFish it's all good, I'm using lineage's default browser ATM so don't have a way to translate, but I found out lineageOS 21 already has built in spoofing for microg, so that's probably why this spoofing method isn't working lol