KnoxGuard

[russel5]

Phone - SM-S908E (Samsung S22 Ultra) Android - 13 OneUI - 5.1 Magisk - 26102 (latest canary build) Lsposed- 1.8.6 (6900)

Don't know issue or not?

modules_2023-05-29T01_50_08.788966.log

[salvogiangri]

This behaviour is normal. The module hooks the constructor of the KnoxGuardService class and throws a UnsupportedOperationException on purpose to avoid starting the system service, this will completely disable KnoxGuard in system.

https://github.com/BlackMesa123/KnoxPatch/blob/ea94555e8314bc1062781916bf8815da0510d6d1/app/src/main/java/io/mesalabs/knoxpatch/hooks/KnoxGuardHooks.kt#L46-L55

And this is the KnoxGuardService constructor code:

public KnoxGuardSeService(Context context) {
    if (!Utils.isSupportKGOnSEC()) {
        throw new UnsupportedOperationException("KnoxGuard is unsupported");
    }
    setContext(context);
    int tAState = getTAState();
    registerReceiver(mContext);
    registerReceiver(mContext, tAState);
    IntegritySeUtil.setInitialState(mContext, tAState);
}

As you can see the module simply replicates the original system behaviour when isSupportKGOnSEC() return false, hooking directly isSupportKGOnSEC() doesn't works since the method is inlined. Of course the exception is catched in SystemServer to prevent the system from bootlooping:

if (!FactoryTest.isFactoryBinary()) { // SystemProperties.get("ro.factory.factory_binary", "Unknown").equalsIgnoreCase("factory");
    timingsTraceAndSlog.traceBegin("StartKnoxGuard");

    try {
        if (SystemProperties.getInt("ro.product.first_api_level", 0) >= 30) {
            ServiceManager.addService("knoxguard_service", new KnoxGuardSeService(context));
        } else {
            ServiceManager.addService("knoxguard_service", new KnoxGuardService(context));
        }
    } catch (Throwable e) {
        Slog.e(TAG, "Failed to add KnoxGuardService.");
        e.printStackTrace();
    }

    timingsTraceAndSlog.traceEnd();
}