Edxposed: [BUG] Android Q 安装此模块会无法启动

Created on 8 Aug 2019  ·  16Comments  ·  Source: ElderDrivers/EdXposed

什么情况/What happened?

Android Q 安装此模块会无法启动，卡在开机动画，但是 adb 可以连接。
Pixel 3
QPP5.190530.014

Xposed模块列表/Xposed Module List

无

Magisk模块列表/Magisk Module List

MagiskHide Props Config v4.0.3-v61
Riru-Core v19.4
Riru-Storage Redirect v19.6

EdXposed及Riru版本/Versions of EdXposed and Riru

EdXposed: v0.4.5.1_beta

Riru: v19.4

相关Logcat/Logcat

https://pastebin.com/qeDMDYd0

bug
Source
picture ITJesse

Most helpful comment

fixed #354

picture kotori2 on 15 Sep 2019
👍7 ❤3

All 16 comments

小米9基于Android Q bate 6的MIUI 9.8.8同样无法启动，adb日志显示似乎是SensorManager出了问题，但没有进一步的详细日志

singleNeuron picture singleNeuron on 15 Aug 2019
👀1

Android Q Beta 6 搭配YAHFA edxposed可正常启动无问题
31565925521_ pic_hd

hlwhl picture hlwhl on 16 Aug 2019

日志：https://pastebin.com/qeDMDYd0

ITJesse picture ITJesse on 16 Aug 2019

我也是小米9 安卓Q MIUI 8.15 Magisk勾上EDXPOSED就卡米

Rakau picture Rakau on 16 Aug 2019

一加7pro 氧beta5（也就是Google的beta6）用YAHFA 也不能开机
09-01 23:49:09.966 6186 6247 D audio_hw_primary: ultra_sound_thread_loop enter 09-01 23:49:09.966 6186 6247 D audio_hw_notify_sensor: receive_sensor_state: ready loop 09-01 23:49:09.967 6229 6229 W zygote : Using default instruction set features for ARM CPU variant (cortex-a9) using conservative defaults 09-01 23:49:09.968 600 600 I ServiceManager: service 'wificond' died 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/SeempLog 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods com/android/internal/os/RuntimeInit 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods com/android/internal/os/ZygoteInit 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/os/SystemClock 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/EventLog 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/Log 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/MemoryIntArray 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/PathParser 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/StatsLog 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/util/StatsLogInternal 09-01 23:49:09.970 6229 6229 V Riru : jniRegisterNativeMethods android/app/admin/SecurityLog 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/content/res/AssetManager 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/content/res/StringBlock 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/content/res/XmlBlock 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/content/res/ApkAssets 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/text/AndroidCharacter 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/text/Hyphenator 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/view/KeyCharacterMap 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/Process 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/SystemProperties 09-01 23:49:09.971 6229 6229 I Riru : replaced android.os.SystemProperties#native_set 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/Binder 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods com/android/internal/os/BinderInternal 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/BinderProxy 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/Parcel 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/HidlSupport 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/HwBinder 09-01 23:49:09.971 6229 6229 V Riru : jniRegisterNativeMethods android/os/HwBlob 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/os/HwParcel 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/os/HwRemoteBinder 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/os/VintfObject 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/os/VintfRuntimeInfo 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/Canvas 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/BaseCanvas 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/BaseRecordingCanvas 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/ColorSpace$Rgb 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/view/DisplayEventReceiver 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/RenderNode 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/view/RenderNodeAnimator 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/RecordingCanvas 09-01 23:49:09.972 6229 6229 V Riru : jniRegisterNativeMethods android/view/InputApplicationHandle 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/InputWindowHandle 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/TextureLayer 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/graphics/HardwareRenderer 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/Surface 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/SurfaceControl 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/SurfaceSession 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/CompositionSamplingListener 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods android/view/TextureView 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods com/android/internal/view/animation/NativeInterpolatorFactoryHelper 09-01 23:49:09.973 6229 6229 V Riru : jniRegisterNativeMethods com/google/android/gles_jni/EGLImpl 09-01 23:49:10.050 895 1626 W ServiceManagement: Waited one second for [email protected]::ISensorManager/default 09-01 23:49:10.050 895 1626 I ServiceManagement: getService: Trying again for [email protected]::ISensorManager/default... 09-01 23:49:10.285 977 977 E oemlogkit: oemlogkit: Waiting for internal sd be mounted... 09-01 23:49:10.885 735 735 V Riru : zygote64 not started, wait 1s 09-01 23:49:11.050 895 1626 W ServiceManagement: Waited one second for [email protected]::ISensorManager/default 09-01 23:49:11.051 895 1626 I ServiceManagement: getService: Trying again for [email protected]::ISensorManager/default... 09-01 23:49:11.285 977 977 E oemlogkit: oemlogkit: Waiting for internal sd be mounted... 09-01 23:49:11.898 735 735 V Riru : zygote64 not started, wait 1s 09-01 23:49:12.051 895 1626 W ServiceManagement: Waited one second for [email protected]::ISensorManager/default 09-01 23:49:12.051 895 1626 I ServiceManagement: getService: Trying again for [email protected]::ISensorManager/default... 09-01 23:49:12.285 977 977 E oemlogkit: oemlogkit: Waiting for internal sd be mounted... 09-01 23:49:12.910 735 735 V Riru : zygote64 not started, wait 1s 09-01 23:49:13.051 895 1626 W ServiceManagement: Waited one second for [email protected]::ISensorManager/default 09-01 23:49:13.051 895 1626 I ServiceManagement: getService: Trying again for [email protected]::ISensorManager/default... 09-01 23:49:13.285 977 977 E oemlogkit: oemlogkit: Waiting for internal sd be mounted...

zanjie1999 picture zanjie1999 on 1 Sep 2019

一加7pro 氧 open beta 1版本（也就是Google的正式版）用YAHFA 也不能开机

@zanjie1999 你那边不能开机后面怎么解决的？我直接fastboot都进不去，adb也不行了

yidongnan picture yidongnan on 4 Sep 2019

@yidongnan 我没有要求输入密码才能开机，所以在启动的过程中可以adb shell
这个时候删掉/data/adb/modules里的模块就可以了
rm /data/adb/modules/riru*

zanjie1999 picture zanjie1999 on 4 Sep 2019

@yidongnan 我没有要求输入密码才能开机，所以在启动的过程中可以adb shell
这个时候删掉/data/adb/modules里的模块就可以了
rm /data/adb/modules/riru*

和密码没关系吧，我有密码也可以adb shell。

MlgmXyysd picture MlgmXyysd on 4 Sep 2019

一加7pro 氧 open beta 1版本（也就是Google的正式版）用YAHFA 也不能开机

@zanjie1999 你那边不能开机后面怎么解决的？我直接fastboot都进不去，adb也不行了

Magisk模块几乎不可能影响fastboot的吧

singleNeuron picture singleNeuron on 4 Sep 2019

@yidongnan
切到另一个slot，再fastboot boot即可进twrp，但是这时候data分区解密不了。
再切回来，用zip安装twrp
最后开机进rec，即可解密分区，用mm禁用edxp就行。

kotori2 picture kotori2 on 4 Sep 2019

貌似在Pixel的release版Q上，可以正常用了，但是一加7p上还是bootloop
以下是log

[ 09-11 00:26:41.252   815:  815 I/Riru     ]
module loaded: location_report_enabler (api 4)[ 09-11 00:26:41.240     1:    1 W/init     ]
type=1400 audit(0.0:255): avc: denied { create } for name="cgroup.procs" scontext=u:r:init:s0 tcontext=u:object_r:cgroup:s0 tclass=file permissive=0[ 09-11 00:26:41.254   815:  815 I/Riru     ]
module loaded: edxp (api 4)[ 09-11 00:26:41.254   815:  815 V/Riru     ]
edxp: onModuleLoaded[ 09-11 00:26:41.254   815:  815 I/EdXposed ]
onModuleLoaded: welcome to EdXposed![ 09-11 00:26:41.254   815:  815 I/EdXposed ]
Start to install inline hooks[ 09-11 00:26:41.254   815:  815 I/EdXposed ]
Using api level 29[ 09-11 00:26:41.254   815:  815 I/EdXposed ]
Start to install Riru hook[ 09-11 00:26:41.250   859:  859 W/init     ]
type=1400 audit(0.0:256): avc: denied { noatsecure } for scontext=u:r:init:s0 tcontext=u:r:qti_init_shell:s0 tclass=process permissive=0[ 09-11 00:26:41.264   815:  815 I/EdXposed ]
Riru hooks installed--------- beginning of crash
[ 09-11 00:26:41.267   815:  815 F/libc     ]
Fatal signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x78e5d3aa68 in tid 815 (app_process64), pid 815 (app_process64)[ 09-11 00:26:41.260   862:  862 W/app_process64 ]
type=1400 audit(0.0:257): avc: denied { noatsecure } for scontext=u:r:zygote:s0 tcontext=u:r:crash_dump:s0 tclass=process permissive=0[ 09-11 00:26:41.272   643:  643 I//vendor/bin/sscrpcd ]
remote_handle_open: Successfully opened handle 0x62 for '":;./\createstaticpd:sensorspd on domain 2[ 09-11 00:26:41.272   643:  643 E//vendor/bin/sscrpcd ]
Error 0xffffffff: apps_dev_init failed for domain 2, errno Transport endpoint is not connected
[ 09-11 00:26:41.272   643:  643 E//vendor/bin/sscrpcd ]
Error 0xffffffff: open_dev (-1) failed for domain 2
[ 09-11 00:26:41.272   643:  643 E//vendor/bin/sscrpcd ]
vendor/qcom/proprietary/sensors-see/sscrpcd/src/sscrpcd.cpp:42:adsp daemon will restart after 25ms...[ 09-11 00:26:41.278   864:  864 I/crash_dump64 ]
obtaining output fd from tombstoned, type: kDebuggerdTombstone[ 09-11 00:26:41.278   864:  864 E/libc     ]
failed to connect to tombstoned: No such file or directory[ 09-11 00:26:41.278   864:  864 I/crash_dump64 ]
performing dump of process 815 (target tid = 815)[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
Build fingerprint: 'OnePlus/OnePlus7Pro/OnePlus7Pro:10/QKQ1.190716.003/1909010630:user/release-keys'
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
Revision: '0'
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
ABI: 'arm64'
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
Timestamp: 2019-09-11 00:26:41+0800
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
pid: 815, tid: 815, name: app_process64  >>> /system/bin/app_process64 <<<
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
uid: 0
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x78e5d3aa68
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
Cause: execute-only (no-read) memory access error; likely due to data in .text.
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x0  000000786142c040  x1  00000078e5d3aa68  x2  0000000000000010  x3  0000000000000020
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x4  00000078e5d3aa78  x5  000000786142c050  x6  0000000000000003  x7  4d595dff44444444
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x8  009bd6448fdc5d4d  x9  009bd6448fdc5d4d  x10 000000000000006b  x11 0000000000000001
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x12 0000000000000000  x13 0000000000001000  x14 0000000000000008  x15 0000000000000002
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x16 0000007861967f28  x17 00000078e2bb56c0  x18 000000786196dc50  x19 0000007861467040
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x20 0000000000000010  x21 000000786141d000  x22 00000078e5d3aa68  x23 000000786142c030
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x24 00000078e68ad020  x25 0000000000000004  x26 000000786144c0c3  x27 00000078e1c72000
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    x28 00000078e1c559ad  x29 0000007fe5d652e0
[ 09-11 00:26:41.280   864:  864 F/DEBUG    ]
    sp  0000007fe5d64f50  lr  00000078618b6e24  pc  00000078e2bb55a8
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]backtrace:
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #00 pc 000000000006f5a8  /apex/com.android.runtime/lib64/bionic/libc.so (__memcpy+88) (BuildId: a2584ee8458a61d422edf24b4cd23b78)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #01 pc 000000000004ce20  /system/lib64/libwhale.edxp.so (BuildId: db1ac3b254e77c33accea7342dc4d3317247c37f)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #02 pc 0000000000048a0c  /system/lib64/libwhale.edxp.so (BuildId: db1ac3b254e77c33accea7342dc4d3317247c37f)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #03 pc 0000000000048568  /system/lib64/libwhale.edxp.so (WInlineHookFunction+96) (BuildId: db1ac3b254e77c33accea7342dc4d3317247c37f)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #04 pc 00000000000447e4  /system/lib64/libriru_edxp.so (BuildId: cc51b1fed919e39c882c3d8a32b6afe0ab2b2e54)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #05 pc 00000000000441ec  /system/lib64/libriru_edxp.so (onModuleLoaded+44) (BuildId: cc51b1fed919e39c882c3d8a32b6afe0ab2b2e54)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #06 pc 000000000000fe38  /system/lib64/libmemtrack.so (BuildId: ebbc4afa36cce1f6943eeb8dc64c4d1b2a56533c)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #07 pc 0000000000052358  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl__ZL10call_arrayIPFviPPcS1_EEvPKcPT_mbS5_+276) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #08 pc 0000000000052574  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl__ZN6soinfo17call_constructorsEv+376) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #09 pc 0000000000052480  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl__ZN6soinfo17call_constructorsEv+132) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #10 pc 0000000000052480  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl__ZN6soinfo17call_constructorsEv+132) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #11 pc 000000000004e5d4  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl__ZL29__linker_init_post_relocationR19KernelArgumentBlockR6soinfo+3624) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #12 pc 000000000004d750  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl___linker_init+396) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
[ 09-11 00:26:41.282   864:  864 F/DEBUG    ]
      #13 pc 0000000000054a54  /apex/com.android.runtime/bin/linker64!ld-android.so (offset 0x39000) (__dl__start+4) (BuildId: 918f6f7c9b972f4bdb1b5ba917a81744)
kotori2 picture kotori2 on 10 Sep 2019

反汇编了一下so，发现崩在了这个地方
https://github.com/ElderDrivers/EdXposed/blob/3334a6d9f651e1c0bb4c3e047d41235fe5bb25c3/edxp-core/src/main/cpp/main/include/framework/fd_utils.h#L20-L23
白天搞一份一加的so来看看是不是hook不到这个函数

kotori2 picture kotori2 on 10 Sep 2019

comp
对比了一下 这俩被hook的函数貌似完全一致啊...

kotori2 picture kotori2 on 11 Sep 2019

image
找到原因了，ARM64的inline hook需要至少16B空间，然而这个函数只有12B。但是为什么Pixel上没崩呢？

kotori2 picture kotori2 on 14 Sep 2019

fixed #354

kotori2 picture kotori2 on 15 Sep 2019
👍7 ❤3

一加7pro 氧 open beta 1版本（也就是Google的正式版）用YAHFA 也不能开机

@zanjie1999 你那边不能开机后面怎么解决的？我直接fastboot都进不去，adb也不行了

我的pixel4 也是装了模块白屏幕 但是adb可以用 最后adb shell 进去之后运行 magisk --remove-modules 可以删除全部模块就好了。

shadowwider picture shadowwider on 3 Dec 2019
👍1
Was this page helpful?
0 / 5 - 0 ratings

Related issues

coderstory picture coderstory  ·  7Comments
F3FFO picture F3FFO  ·  8Comments
perfiction picture perfiction  ·  3Comments
eebssk1 picture eebssk1  ·  5Comments
JReverse picture JReverse  ·  5Comments