Skip to content

Parasitic manager fails to open on GrapheneOS #491

Closed

Description

@raxod502

Steps to reproduce/复现步骤

I use KernelSU on GrapheneOS and am interested in getting LSPosed set up. I applied a custom patch to my build of GrapheneOS to allow me to enable memory DCL for Shell, which is required for LSPosed. After doing this, granting root to Shell via KernelSU, and installing the latest debug builds of NeoZygisk and LSPosed as KernelSU modules, I tried to open the LSPosed manager app.

Expected behaviour/预期行为

I expect to see the manager interface after clicking on the "Action" button under "Zygisk - LSPosed" in KernelSU. If I follow the directions in #123 (comment) to install the manager as a user app, and open it from the launcher, it opens as expected, but it displays a warning signaling that the parasitic mode is preferred. I would expect that the two modes of operation should have the same result.

Note that LSPosed is working: I installed https://github.com/VarunS2002/Xposed-Disable-FLAG_SECURE and verified it operates as intended. It's just that I can only open the manager as a user app, and not in parasitic mode.

Actual behaviour/实际行为

Image

When opening the manager app in parasitic mode (i.e. by tapping the Action button on the module in KernelSU), the Shell application is opened, but only displays a bug report screen.

Image

Tapping any button closes the screen and returns to the launcher. In the KernelSU manager, the interface is replaced with an "Action" screen that shows a single log entry:

Starting: Intent { act=android.intent.action.MAIN cat=[org.lsposed.manager.LAUNCH_MANAGER] cmp=com.android.shell/.BugreportWarningActivity }
Image

This screen disappears immediately upon foregrounding KernelSU again.

Xposed Module List/Xposed 模块列表

None

Root implementation/Root 方案

KernelSU 1.0.5

System Module List/系统模块列表

https://github.com/symbuzzer/systemless-hosts-KernelSU-module 1.2.2
https://github.com/JingMatrix/NeoZygisk 2.2 (debug)
https://github.com/JingMatrix/LSPosed 1.10.2-7199 (debug, master @ 0e457e3)

LSPosed version/LSPosed 版本

1.10.2-7199

Android version/Android 版本

GrapheneOS 2025110800 (Android 16)

Version requirement/版本要求

Logs/日志

Sorry, I can't attach the bugreport zip directly, as GitHub has a maximum of 25MB and the bugreport zip is 36MB. However I have made it available directly at https://files.intuitiveexplanations.com/u/W3NO9De3GcAz6bFy.zip.

I'm assuming that everything important shows up in that zip file? But if it would be helpful for me to also generate the adb logs for specific applications mentioned in #123 (comment), let me know and I can do that too.

Activity

  1. ExHalationZQ commented on Dec 23, 2025

    @ExHalationZQ
  2. Ramedon1 commented on Dec 23, 2025

    @Ramedon1
  3. raxod502 commented on Dec 23, 2025

    @raxod502
    Author
  4. sumithemmadi commented on Jan 9, 2026

    @sumithemmadi
  5. Ramedon1 commented on Jan 9, 2026

    @Ramedon1
  6. sumithemmadi commented on Jan 10, 2026

    @sumithemmadi
  7. Ramedon1 commented on Jan 11, 2026

    @Ramedon1
  8. nikr-dev commented on Jan 20, 2026

    @nikr-dev
  9. JingMatrix commented on Jan 20, 2026

    @JingMatrix
    Owner

    @raxod502 Once the manager is avaible (installed as app), please open it, save logs and upload the generated zip archive.
    This is indeed the purpose to install manager as app: save logs.

  10. Ramedon1 commented on Jan 20, 2026

    @Ramedon1
  11. JingMatrix commented on Jan 20, 2026

    @JingMatrix
  12. raxod502 commented on Jan 21, 2026

    @raxod502
    Author

    Here are my debug logs from the manager installed as a user app:

    LSPosed_2026-01-20T16_15_41.087716.zip

  13. JingMatrix commented on Jan 21, 2026

    @JingMatrix
    Owner

    @raxod502 Sorry, I wasn't able to find some clues on your logs. Please do (and only) the following to help me locate curcial logs:

    1. Reboot your device
    2. Try open manager from your root manager (which will fail)
    3. Open your installed manager app and save logs
    4. Upload logs

    Moreover, it is mostly a problem of the permission you set for the Shell (com.android.shell) app. Please also attach a screenshot of its permission detail in your root manager app.

  14. nikr-dev commented on Jan 21, 2026

    @nikr-dev
  15. 1 remaining item

  16. JingMatrix commented on Jan 21, 2026

    @JingMatrix
    Owner

    @NonCertus Thanks for sharing your case. No, it is not needed if the bug is already fixed for you.

  17. NonCertus commented on Jan 21, 2026

    @NonCertus

    @NonCertus Thanks for sharing your case. No, it is not needed if the bug is already fixed for you.

    Ok. And thank you very much for this and your other projects - especially TEESimulator & NeoZygisk! Your open source alternatives really make the (Android-)world a better place!

  18. raxod502 commented on Jan 22, 2026

    @raxod502
    Author

    Here is the information requested in #491 (comment):

    LSPosed_2026-01-21T17_29_49.571771.zip

    Image
  19. JingMatrix commented on Jan 22, 2026

    @JingMatrix
    Owner

    @raxod502 Please test if any Xposed module works for you.

    I think it is still due to GrapheneOS restriction.

    Below is the related logs, from which, several things fail to work:

    1. GrapeheOS kills the injected Shell app at the last line of line, probably due to deeper dynamic code injection detection technique or simple process-and-package identity check (if your test shows that some Xposed modules could work on your OS)
    2. All methods deoptimizing are not working properly, LSPosed failed to find the correct address.
    [ 2026-01-21T17:29:16.236    10235:  7302:  7302 I/KernelSU        ] ksud::cli: command: Debug { command: Su { global_mnt: true } }
    [ 2026-01-21T17:29:16.309        0:  7305:  7305 I/KernelSU        ] ksud::cli: command: Module { command: Action { id: "zygisk_lsposed" } }
    [ 2026-01-21T17:29:16.310        0:  7305:  7305 I/KernelSU        ] ksud::module: exec /data/adb/modules/zygisk_lsposed/action.sh
    [ 2026-01-21T17:29:16.414     1000:  1387:  6917 D/LSPosed         ] LoadedApk#<init> starts: pkg=null, prc=null
    [ 2026-01-21T17:29:16.415     1000:  1387:  6917 D/LSPosed         ] LoadedApk#<init> ends: /system/priv-app/Shell/Shell.apk: pkg=null, prc=null
    [ 2026-01-21T17:29:16.473    10235:  4792:  4985 I/KernelSU        ] Module runAction result: A2.i@6c0a62c
    [ 2026-01-21T17:29:16.480        0:   883:   883 V/zygisk-core64   ] pre forkAndSpecialize [org.lsposed.manager]
    [ 2026-01-21T17:29:16.499        0:   884:   884 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: GetProcessFlags
    [ 2026-01-21T17:29:16.500        0:   884:  7318 V/zygiskd64       ] zygiskd::zygiskd: Flags for UID 2000: ProcessFlags(PROCESS_GRANTED_ROOT | PROCESS_ROOT_IS_KSU)
    [ 2026-01-21T17:29:16.504        0:   884:   884 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: ReadModules
    [ 2026-01-21T17:29:16.510        0:  7313:  7313 I/Dobby           ] ================================
    [ 2026-01-21T17:29:16.510        0:  7313:  7313 I/Dobby           ] Dobby
    [ 2026-01-21T17:29:16.510        0:  7313:  7313 I/Dobby           ] dobby in debug log mode, disable with cmake flag "-DDOBBY_DEBUG=OFF"
    [ 2026-01-21T17:29:16.510        0:  7313:  7313 I/Dobby           ] ================================
    [ 2026-01-21T17:29:16.510        0:  7313:  7313 V/zygisk-core64   ] dlopen_ext from fd 68 succeeded: handle 0xb0516e7b19f92983
    [ 2026-01-21T17:29:16.516        0:  7313:  7313 V/zygisk-core64   ] updating mount namespace to type Root
    [ 2026-01-21T17:29:16.516        0:   884:   884 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: UpdateMountNamespace
    [ 2026-01-21T17:29:16.536     2000:  7313:  7313 V/zygisk-core64   ] post forkAndSpecialize [org.lsposed.manager]
    [ 2026-01-21T17:29:16.539     1000:  1387:  6917 D/LSPosed-Bridge  ] onTransact: action=ACTION_GET_BINDER, callingUid=2000, callingPid=7313
    [ 2026-01-21T17:29:16.540        0:  1268:  1559 D/LSPosedService  ] starting injected manager: pid = 7313 uid = 2000 processName = org.lsposed.manager
    [ 2026-01-21T17:29:16.541        0:  1268:  1559 D/LSPosedService  ] returned service
    [ 2026-01-21T17:29:16.541        0:  1268:  1559 D/LSPosedService  ] register ProcessInfo{uid=2000, pid=7313, processName='org.lsposed.manager', heartBeat=android.os.BinderProxy@d047bee}
    [ 2026-01-21T17:29:16.542     1000:  1387:  6917 D/LSPosed-Bridge  ] got binder is android.os.BinderProxy@ff6b52e
    [ 2026-01-21T17:29:16.542        0:  1268:  1559 D/LSPosedService  ] LSPApplicationService.onTransact: code=1310096052
    [ 2026-01-21T17:29:16.543     2000:  7313:  7313 D/LSPosed         ] service.cpp:359#std::tuple<int, size_t> lspd::Service::RequestLSPDex(JNIEnv *, const ScopedLocalRef<jobject> &): fd=72, size=1155876
    [ 2026-01-21T17:29:16.545        0:  1268:  1559 D/LSPosedService  ] LSPApplicationService.onTransact: code=724533732
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): android.app.AndroidApp => gQc.Wg.Y.gTIT.wNwhd.x.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): android.content.res.XModule => PkuXHh.uqXpVeykmpYpO.NzdVK.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): android.content.res.XRes => R.BPHSKMurtAWX.KdQmRwpa.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): de.robv.android.xposed. => Fsk.KKTcIkXl.ml.DGJvIl.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): org.lsposed.lspd.core. => GOSwiI.EhKW.hQwhCaQQQ.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): org.lsposed.lspd.nativebridge. => KPMOKACNeEDsdxl.u.m.OgTIG.RnA.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] service.cpp:389#std::map<std::string, std::string> lspd::Service::RequestObfuscationMap(JNIEnv *, const ScopedLocalRef<jobject> &): org.lsposed.lspd.service. => nkhNSCeInENkXZPeGovg.ISJ.
    [ 2026-01-21T17:29:16.549     2000:  7313:  7313 D/LSPosed         ] context.cpp:40#lspd::Context::PreloadedDex::PreloadedDex(int, std::size_t): Context::PreloadedDex::PreloadedDex: fd=72, size=1155876
    [ 2026-01-21T17:29:16.586     2000:  7313:  7313 D/LSPlant         ] art_method.cxx:232: ArtMethod size: 32
    [ 2026-01-21T17:29:16.589     2000:  7313:  7313 D/LSPlant         ] art_method.cxx:286: ArtMethod::declaring_class offset: 0
    [ 2026-01-21T17:29:16.589     2000:  7313:  7313 D/LSPlant         ] art_method.cxx:287: ArtMethod::entrypoint offset: 24
    [ 2026-01-21T17:29:16.589     2000:  7313:  7313 D/LSPlant         ] art_method.cxx:288: ArtMethod::data offset: 16
    [ 2026-01-21T17:29:16.589     2000:  7313:  7313 D/LSPlant         ] art_method.cxx:289: ArtMethod::access_flags offset: 4
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:427#bool SandHook::ElfImg::findModuleBase(): Found 4 filtered map entries for libart.so:
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:429#bool SandHook::ElfImg::findModuleBase():   0xc87e98131000 r--p /apex/com.android.art/lib64/libart.so
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:429#bool SandHook::ElfImg::findModuleBase():   0xc87e98331000 r-xp /apex/com.android.art/lib64/libart.so
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:429#bool SandHook::ElfImg::findModuleBase():   0xc87e98d31000 rw-p /apex/com.android.art/lib64/libart.so
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:429#bool SandHook::ElfImg::findModuleBase():   0xc89502b6c000 r--p /apex/com.android.art/lib64/libart.so
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:440#bool SandHook::ElfImg::findModuleBase(): Found `r--p` -> `r-xp` pattern. Choosing base from `r--p` block at 0xc87e98131000
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:466#bool SandHook::ElfImg::findModuleBase(): get module base /apex/com.android.art/lib64/libart.so: 0xc87e98131000
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:467#bool SandHook::ElfImg::findModuleBase(): update path: /apex/com.android.art/lib64/libart.so
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:91#void SandHook::ElfImg::parse(Elf64_Ehdr *): dynsym header 0x2f8 size 61752
    [ 2026-01-21T17:29:16.595     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:112#void SandHook::ElfImg::parse(Elf64_Ehdr *): strtab header 0x13e0c size 146664
    [ 2026-01-21T17:29:16.600     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:103#void SandHook::ElfImg::parse(Elf64_Ehdr *): symtab header 0xc00bb0 size 1404288 found in orgin elf
    [ 2026-01-21T17:29:16.605        0:  7328:  7328 I/KernelSU        ] ksud::cli: command: Module { command: List }
    [ 2026-01-21T17:29:16.611        0:  7328:  7328 I/KernelSU        ] ksud::module: path: /data/adb/modules/systemless-hosts-KernelSU-module
    [ 2026-01-21T17:29:16.619        0:  7328:  7328 I/KernelSU        ] ksud::module: path: /data/adb/modules/lost+found
    [ 2026-01-21T17:29:16.623        0:  7328:  7328 I/KernelSU        ] ksud::module: path: /data/adb/modules/zygisksu
    [ 2026-01-21T17:29:16.625        0:  7328:  7328 I/KernelSU        ] ksud::module: path: /data/adb/modules/zygisk_lsposed
    [ 2026-01-21T17:29:16.668     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:340#Elf64_Addr SandHook::ElfImg::PrefixLookupFirst(std::string_view) const: found prefix _ZN3artL15GetMethodShortyEP7_JNIEnvP10_jmethodID of _ZN3artL15GetMethodShortyEP7_JNIEnvP10_jmethodID.__uniq.224004613612541769487030999398936232930 0x890b80 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.668     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art9ArtMethod12PrettyMethodEPS0_b 0x323830 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.668     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art6Thread14CurrentFromGdbEv 0x8d73c0 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.668     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art6mirror5Class13GetDescriptorEPNSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEE 0x354460 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.668     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art6mirror5Class11GetClassDefEv 0x871080 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.668     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art6mirror5Class9SetStatusENS_6HandleIS1_EENS_11ClassStatusEPNS_6ThreadE 0x21d140 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] native_api.h:62#int lspd::HookInline(void *, void *, void **): Dobby hooking _ZN3art6mirror5Class9SetStatusENS_6HandleIS1_EENS_11ClassStatusEPNS_6ThreadE (0xc87e9834e140) from /apex/com.android.art/lib64/libart.so (0xc87e98131000)
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] ----- [DobbyHook:0xc87e9834e140] -----
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [trampoline] use [adrp, add, br]
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [memory allocator] allocate exec memory at: 0xc895029fd000, size: 0x1c
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [insn relocate] origin 0xc87e9834e140 - 12
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] ffc303d1fd7b09a9fc6f0aa9
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [insn relocate] relocated 0xc895029fd000 - 28
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] ffc303d1fd7b09a9fc6f0aa95100005820021fd64ce134987ec80000
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [intercept routing] active
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art7Runtime9instance_E 0xc14198 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPlant         ] runtime.cxx:60: runtime instance = 0xb400c63842360000
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art7Runtime20SetRuntimeDebugStateENS0_17RuntimeDebugStateE 0x8c62f0 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPlant         ] runtime.cxx:78: found debug_state at offset 980
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:368#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art11ClassLinker22FixupStaticTrampolinesEPNS_6ThreadENS_6ObjPtrINS_6mirror5ClassEEE 0x3e8790 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] native_api.h:62#int lspd::HookInline(void *, void *, void **): Dobby hooking (unknown symbol) (0xc87e98519790) from /apex/com.android.art/lib64/libart.so (0xc87e98131000)
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] ----- [DobbyHook:0xc87e98519790] -----
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [trampoline] use [adrp, add, br]
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [memory allocator] allocate exec memory at: 0xc895029fd01c, size: 0x1c
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [insn relocate] origin 0xc87e98519790 - 12
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] fd7bbaa9fc6f01a9fa6702a9
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [insn relocate] relocated 0xc895029fd01c - 28
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] fd7bbaa9fc6f01a9fa6702a95100005820021fd69c9751987ec80000
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] [intercept routing] active
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:368#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art11ClassLinker14RegisterNativeEPNS_6ThreadEPNS_9ArtMethodEPKv 0x37c280 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 D/LSPosed         ] native_api.h:62#int lspd::HookInline(void *, void *, void **): Dobby hooking (unknown symbol) (0xc87e984ad280) from /apex/com.android.art/lib64/libart.so (0xc87e98131000)
    [ 2026-01-21T17:29:16.669     2000:  7313:  7313 I/Dobby           ] ----- [DobbyHook:0xc87e984ad280] -----
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] [trampoline] use [adrp, add, br]
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] [memory allocator] allocate exec memory at: 0xc895029fd038, size: 0x1c
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] [insn relocate] origin 0xc87e984ad280 - 12
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] ff0302d1fd7b03a9f92300f9
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] [insn relocate] relocated 0xc895029fd038 - 28
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] ff0302d1fd7b03a9f92300f95100005820021fd68cd24a987ec80000
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] [intercept routing] active
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:368#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art11ClassLinker16UnregisterNativeEPNS_6ThreadEPNS_9ArtMethodE 0x5fe240 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 D/LSPosed         ] native_api.h:62#int lspd::HookInline(void *, void *, void **): Dobby hooking (unknown symbol) (0xc87e9872f240) from /apex/com.android.art/lib64/libart.so (0xc87e98131000)
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] ----- [DobbyHook:0xc87e9872f240] -----
    [ 2026-01-21T17:29:16.671     2000:  7313:  7313 I/Dobby           ] [trampoline] use [adrp, add, br]
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [memory allocator] allocate exec memory at: 0xc895029fd054, size: 0x1c
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [insn relocate] origin 0xc87e9872f240 - 12
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] ffc301d1fd7b04a9f65705a9
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [insn relocate] relocated 0xc895029fd054 - 28
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] ffc301d1fd7b04a9f65705a95100005820021fd64cf272987ec80000
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [intercept routing] active
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:368#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art11ClassLinker26VisiblyInitializedCallback22MarkVisiblyInitializedEPNS_6ThreadE 0x21b470 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] native_api.h:62#int lspd::HookInline(void *, void *, void **): Dobby hooking (unknown symbol) (0xc87e9834c470) from /apex/com.android.art/lib64/libart.so (0xc87e98131000)
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] ----- [DobbyHook:0xc87e9834c470] -----
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [trampoline] use [adrp, add, br]
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [memory allocator] allocate exec memory at: 0xc895029fd070, size: 0x1c
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [insn relocate] origin 0xc87e9834c470 - 12
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] ff0305d1fd7b0ea9fc6f0fa9
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [insn relocate] relocated 0xc895029fd070 - 28
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] ff0305d1fd7b0ea9fc6f0fa95100005820021fd67cc434987ec80000
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] [intercept routing] active
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:368#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found art_quick_to_interpreter_bridge 0x33cfe0 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPlant         ] class_linker.cxx:218: art_quick_to_interpreter_bridge = 0xc87e9846dfe0
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art16ScopedSuspendAllC2EPKcb 0x413c30 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art16ScopedSuspendAllD2Ev 0x412c80 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art2gc23ScopedGCCriticalSectionC2EPNS_6ThreadENS0_7GcCauseENS0_13CollectorTypeE 0x47d630 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art2gc23ScopedGCCriticalSectionD2Ev 0x3be040 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art3jit12JitCodeCache18MoveObsoleteMethodEPNS_9ArtMethodES3_ 0x7f9c90 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:362#Elf64_Addr SandHook::ElfImg::getSymbOffset(std::string_view, uint32_t, uint32_t) const: found _ZN3art3jit12JitCodeCache12DoCollectionEPNS_6ThreadE 0x7fa860 in /apex/com.android.art/lib64/libart.so in dynsym by gnuhash
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 D/LSPosed         ] native_api.h:62#int lspd::HookInline(void *, void *, void **): Dobby hooking _ZN3art3jit12JitCodeCache12DoCollectionEPNS_6ThreadE (0xc87e9892b860) from /apex/com.android.art/lib64/libart.so (0xc87e98131000)
    [ 2026-01-21T17:29:16.672     2000:  7313:  7313 I/Dobby           ] ----- [DobbyHook:0xc87e9892b860] -----
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] [trampoline] use [adrp, add, br]
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] [memory allocator] allocate exec memory at: 0xc895029fd08c, size: 0x1c
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] [insn relocate] origin 0xc87e9892b860 - 12
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] ff0303d1fd7b06a9fb3b00f9
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] [insn relocate] relocated 0xc895029fd08c - 28
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] ff0303d1fd7b06a9fb3b00f95100005820021fd66cb892987ec80000
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 I/Dobby           ] [intercept routing] active
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 D/LSPosed         ] elf_util.cpp:340#Elf64_Addr SandHook::ElfImg::PrefixLookupFirst(std::string_view) const: found prefix _ZN3artL18DexFile_setTrustedEP7_JNIEnvP7_jclassP8_jobject of _ZN3artL18DexFile_setTrustedEP7_JNIEnvP7_jclassP8_jobject.__uniq.325793859780145791435928139633802341359 0x87c560 in /apex/com.android.art/lib64/libart.so in symtab by linear lookup
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 D/LSPlant         ] common.cxx:111: java runtime debuggable false
    [ 2026-01-21T17:29:16.673     2000:  7313:  7313 D/LSPosed         ] resources_hook.cpp:56#std::string lspd::GetXResourcesClassName(): R/BPHSKMurtAWX/KdQmRwpa/ources
    [ 2026-01-21T17:29:16.674     2000:  7313:  7313 D/LSPosed         ] magisk_loader.cpp:187#void lspd::MagiskLoader::OnNativeForkAndSpecializePost(JNIEnv *, jstring, jstring): Done prepare
    [ 2026-01-21T17:29:16.676        0:  1268:  2808 D/LSPosedService  ] LSPApplicationService.onTransact: code=1598968902
    [ 2026-01-21T17:29:16.692     2000:  7313:  7313 D/LSPosed         ] deoptimizing public android.app.Application android.app.Instrumentation.newApplication(java.lang.ClassLoader,java.lang.String,android.content.Context) throws java.lang.InstantiationException,java.lang.IllegalAccessException,java.lang.ClassNotFoundException: pkg=null, prc=null
    [ 2026-01-21T17:29:16.692     2000:  7313:  7313 V/LSPlant         ] class_linker.cxx:233: deoptimize method android.app.Application android.app.Instrumentation.newApplication(java.lang.ClassLoader, java.lang.String, android.content.Context) from 0x720c2060 to 0xc87e9846dfe0
    [ 2026-01-21T17:29:16.694     2000:  7313:  7313 D/LSPosed         ] deoptimizing private android.app.Application android.app.LoadedApk.makeApplicationInner(boolean,android.app.Instrumentation,boolean): pkg=null, prc=null
    [ 2026-01-21T17:29:16.694     2000:  7313:  7313 V/LSPlant         ] class_linker.cxx:233: deoptimize method android.app.Application android.app.LoadedApk.makeApplicationInner(boolean, android.app.Instrumentation, boolean) from 0x720cc020 to 0xc87e9846dfe0
    [ 2026-01-21T17:29:16.694     2000:  7313:  7313 D/LSPosed         ] deoptimizing public android.app.Application android.app.LoadedApk.makeApplicationInner(boolean,android.app.Instrumentation): pkg=null, prc=null
    [ 2026-01-21T17:29:16.694     2000:  7313:  7313 V/LSPlant         ] class_linker.cxx:233: deoptimize method android.app.Application android.app.LoadedApk.makeApplicationInner(boolean, android.app.Instrumentation) from 0x720d0950 to 0xc87e9846dfe0
    [ 2026-01-21T17:29:16.695     2000:  7313:  7313 D/LSPosed         ] deoptimizing public android.app.Application android.app.LoadedApk.makeApplication(boolean,android.app.Instrumentation): pkg=null, prc=null
    [ 2026-01-21T17:29:16.695     2000:  7313:  7313 V/LSPlant         ] class_linker.cxx:233: deoptimize method android.app.Application android.app.LoadedApk.makeApplication(boolean, android.app.Instrumentation) from 0x720d0900 to 0xc87e9846dfe0
    [ 2026-01-21T17:29:16.695     2000:  7313:  7313 D/LSPosed         ] deoptimizing public java.io.File android.app.ContextImpl.getSharedPreferencesPath(java.lang.String): pkg=null, prc=null
    [ 2026-01-21T17:29:16.695     2000:  7313:  7313 V/LSPlant         ] class_linker.cxx:233: deoptimize method java.io.File android.app.ContextImpl.getSharedPreferencesPath(java.lang.String) from 0x72086410 to 0xc87e9846dfe0
    [ 2026-01-21T17:29:16.695        0:  1268:  2808 D/LSPosedService  ] LSPApplicationService.onTransact: code=1
    [ 2026-01-21T17:29:16.696        0:  1268:  2808 D/LSPosedService  ] LSPApplicationService.onTransact: code=5
    [ 2026-01-21T17:29:16.858     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = void android.app.ActivityThread.handleBindApplication(android.app.ActivityThread$AppBindData)(0x712b7a78), hook = void LSPHooker_.handleBindApplication(java.lang.Object, java.lang.Object)(0xc87dc0086050), backup = void LSPHooker_.backup(java.lang.Object, java.lang.Object)(0xc87dc0086030)
    [ 2026-01-21T17:29:16.859     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 0, address = c895029fa000, target = c895029fa000
    [ 2026-01-21T17:29:16.859     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa000
    [ 2026-01-21T17:29:16.859     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x712b7a78:0x2300002) -> 0xc895029fa000; backup(0xc87dc0086030:0x42300002) -> 0x7203ee60; hook(0xc87dc0086050:0x10380009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.859     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 2228us
    [ 2026-01-21T17:29:16.861     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = java.lang.ClassLoader android.app.LoadedApk.getClassLoader()(0x70fed5f8), hook = java.lang.Object LSPHooker_.getClassLoader(java.lang.Object)(0xc87dc00a7050), backup = java.lang.Object LSPHooker_.backup(java.lang.Object)(0xc87dc00a7030)
    [ 2026-01-21T17:29:16.861     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 1, address = c895029fa000, target = c895029fa018
    [ 2026-01-21T17:29:16.861     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa018
    [ 2026-01-21T17:29:16.861     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x70fed5f8:0x2380001) -> 0xc895029fa018; backup(0xc87dc00a7030:0x42380002) -> 0x720cfe70; hook(0xc87dc00a7050:0x10380009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.861     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 2073us
    [ 2026-01-21T17:29:16.864     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = void android.app.ActivityThread$ActivityClientRecord.<init>()(0x70fc4c18), hook = void LSPHooker_.constructor(java.lang.Object)(0xc87dc00c8050), backup = void LSPHooker_.backup(java.lang.Object)(0xc87dc00c8030)
    [ 2026-01-21T17:29:16.864     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 2, address = c895029fa000, target = c895029fa030
    [ 2026-01-21T17:29:16.864     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa030
    [ 2026-01-21T17:29:16.864     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x70fc4c18:0x2390001) -> 0xc895029fa030; backup(0xc87dc00c8030:0x42390002) -> 0xc87e987c91c0; hook(0xc87dc00c8050:0x10380009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.864     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 1958us
    [ 2026-01-21T17:29:16.867     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = void android.app.ActivityThread$ActivityClientRecord.<init>(android.os.IBinder, android.content.Intent, int, android.content.pm.ActivityInfo, android.content.res.Configuration, java.lang.String, com.android.internal.app.IVoiceInteractor, android.os.Bundle, android.os.PersistableBundle, java.util.List, java.util.List, android.app.ActivityOptions$SceneTransitionInfo, boolean, android.app.ProfilerInfo, android.app.ClientTransactionHandler, android.os.IBinder, android.os.IBinder, boolean, android.os.IBinder, android.os.IBinder, android.window.ActivityWindowInfo)(0x70fc4c38), hook = void LSPHooker_.constructor(java.lang.Object, java.lang.Object, java.lang.Object, int, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, boolean, java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, boolean, java.lang.Object, java.lang.Object, java.lang.Object)(0xc87dc00e9
    [ 2026-01-21T17:29:16.867     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 3, address = c895029fa000, target = c895029fa048
    [ 2026-01-21T17:29:16.867     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa048
    [ 2026-01-21T17:29:16.867     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x70fc4c38:0x2290001) -> 0xc895029fa048; backup(0xc87dc00e9030:0x42290002) -> 0x7202f490; hook(0xc87dc00e9050:0x10280009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.867     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 3133us
    [ 2026-01-21T17:29:16.871     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = void android.app.ActivityThread.handleReceiver(android.app.ActivityThread$ReceiverData)(0x712b7c78), hook = void LSPHooker_.handleReceiver(java.lang.Object, java.lang.Object)(0xc87dc010a050), backup = void LSPHooker_.backup(java.lang.Object, java.lang.Object)(0xc87dc010a030)
    [ 2026-01-21T17:29:16.871     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 4, address = c895029fa000, target = c895029fa060
    [ 2026-01-21T17:29:16.871     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa060
    [ 2026-01-21T17:29:16.871     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x712b7c78:0x2300002) -> 0xc895029fa060; backup(0xc87dc010a030:0x42300002) -> 0x72043c20; hook(0xc87dc010a050:0x10380009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.871     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 1158us
    [ 2026-01-21T17:29:16.873     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = android.app.ContentProviderHolder android.app.ActivityThread.installProvider(android.content.Context, android.app.ContentProviderHolder, android.content.pm.ProviderInfo, boolean, boolean, boolean)(0x712b7f38), hook = java.lang.Object LSPHooker_.installProvider(java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, boolean, boolean, boolean)(0xc87dc012b050), backup = java.lang.Object LSPHooker_.backup(java.lang.Object, java.lang.Object, java.lang.Object, java.lang.Object, boolean, boolean, boolean)(0xc87dc012b030)
    [ 2026-01-21T17:29:16.873     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 5, address = c895029fa000, target = c895029fa078
    [ 2026-01-21T17:29:16.873     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa078
    [ 2026-01-21T17:29:16.874     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x712b7f38:0x2200002) -> 0xc895029fa078; backup(0xc87dc012b030:0x42200002) -> 0x72046bc0; hook(0xc87dc012b050:0x10280009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.874     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 1326us
    [ 2026-01-21T17:29:16.876     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = android.webkit.WebViewFactoryProvider android.webkit.WebViewFactory.getProvider()(0x711fff98), hook = java.lang.Object LSPHooker_.getProvider()(0xc87dc014c050), backup = java.lang.Object LSPHooker_.backup()(0xc87dc014c030)
    [ 2026-01-21T17:29:16.876     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 6, address = c895029fa000, target = c895029fa090
    [ 2026-01-21T17:29:16.876     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa090
    [ 2026-01-21T17:29:16.876     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x711fff98:0x2380008) -> 0xc895029fa090; backup(0xc87dc014c030:0x42380008) -> 0x7254f9f0; hook(0xc87dc014c050:0x10380009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.876     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 1752us
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:533: Hooking: target = void android.app.ActivityThread.performStopActivityInner(android.app.ActivityThread$ActivityClientRecord, android.app.servertransaction.PendingTransactionActions$StopInfo, boolean, boolean, java.lang.String)(0x712b8298), hook = void LSPHooker_.performStopActivityInner(java.lang.Object, java.lang.Object, java.lang.Object, boolean, boolean, java.lang.Object)(0xc87dc016d050), backup = void LSPHooker_.backup(java.lang.Object, java.lang.Object, java.lang.Object, boolean, boolean, java.lang.Object)(0xc87dc016d030)
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:514: trampoline: count = 7, address = c895029fa000, target = c895029fa0a8
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:540: Generated trampoline 0xc895029fa0a8
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 V/LSPlant         ] lsplant.cc:550: Done hook: target(0x712b8298:0x2200002) -> 0xc895029fa0a8; backup(0xc87dc016d030:0x42200002) -> 0x7204a720; hook(0xc87dc016d050:0x10280009) -> 0xc87e9846dd30
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 V/LSPosed         ] hook_bridge.cpp:86#lspd::Java_org_lsposed_lspd_nativebridge_HookBridge_hookMethod(JNIEnv *, jclass, jboolean, jobject, jclass, jint, jobject)::finally::~finally(): New hook took 2904us
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 D/LSPosed         ] injected manager
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 I/LSPosed         ] Loaded manager, skipping next steps
    [ 2026-01-21T17:29:16.880     2000:  7313:  7313 D/LSPosed         ] magisk_loader.cpp:191#void lspd::MagiskLoader::OnNativeForkAndSpecializePost(JNIEnv *, jstring, jstring): injected xposed into com.android.shell
    [ 2026-01-21T17:29:16.887     2000:  7313:  7313 V/zygisk-core64   ] modules unloaded: 0/1
    [ 2026-01-21T17:29:16.887     2000:  7313:  7313 V/zygisk-core64   ] cleaning linker trace for path jit-cache-zygisk
    [ 2026-01-21T17:29:16.887     2000:  7313:  7313 V/zygisk-core64   ] reset g_module_load_counter: [363 -> 362]
    [ 2026-01-21T17:29:16.887     2000:  7313:  7313 V/zygisk-core64   ] replaced com/android/internal/os/Zygote!nativeForkAndSpecialize @0xc87e9aeeb838
    [ 2026-01-21T17:29:16.887     2000:  7313:  7313 V/zygisk-core64   ] replaced com/android/internal/os/Zygote!nativeSpecializeAppProcess @0xc87e9aeec2b4
    [ 2026-01-21T17:29:16.887     2000:  7313:  7313 V/zygisk-core64   ] replaced com/android/internal/os/Zygote!nativeForkSystemServer @0xc87e9aeec4dc
    [ 2026-01-21T17:29:16.888     2000:  7313:  7313 V/LSPlt           ] RegisterHook 2701 fork
    [ 2026-01-21T17:29:16.888     2000:  7313:  7313 V/LSPlt           ] RegisterHook 2701 unshare
    [ 2026-01-21T17:29:16.888     2000:  7313:  7313 V/LSPlt           ] RegisterHook 2701 strdup
    [ 2026-01-21T17:29:16.888     2000:  7313:  7313 V/LSPlt           ] RegisterHook 85 pthread_attr_setstacksize
    [ 2026-01-21T17:29:16.893     2000:  7313:  7313 V/LSPlt           ] match hook info /system/lib64/libandroid_runtime.so:2701 c89502c49000 c89502c6c000-2b0000
    [ 2026-01-21T17:29:16.893     2000:  7313:  7313 V/LSPlt           ] match hook info /apex/com.android.art/lib64/libart.so:85 c89502b6c000 c89502ba4000-a00000
    [ 2026-01-21T17:29:16.894     2000:  7313:  7313 V/LSPlt           ] match hook info /system/lib64/libandroid_runtime.so:2701 c894dc0d7000 c894dc0d8000-2d3000
    [ 2026-01-21T17:29:16.894     2000:  7313:  7313 V/LSPlt           ] match hook info /system/lib64/libandroid_runtime.so:2701 c894dbeef000 c894dc0b4000-eb000
    [ 2026-01-21T17:29:16.894     2000:  7313:  7313 V/LSPlt           ] match hook info /system/lib64/libandroid_runtime.so:2701 c894dbe04000 c894dbeef000-0
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] match hook info /apex/com.android.art/lib64/libart.so:85 c87e98d31000 c87e98d32000-c00000
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] match hook info /apex/com.android.art/lib64/libart.so:85 c87e98331000 c87e98aa1000-200000
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] match hook info /apex/com.android.art/lib64/libart.so:85 c87e98131000 c87e982b9000-0
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] restoring 4 functions
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] found matching hook for symbol [fork] at address 0xc894dc0d61e0.
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] hooking 0xc894dc0d61e0
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] found matching hook for symbol [unshare] at address 0xc894dc0d62d0.
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] hooking 0xc894dc0d62d0
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] found matching hook for symbol [strdup] at address 0xc894dc0d1f60.
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] hooking 0xc894dc0d1f60
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] restore 0xc894dc0b4000 from 0xc89502c49000
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] found matching hook for symbol [pthread_attr_setstacksize] at address 0xc87e98b68510.
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] hooking 0xc87e98b68510
    [ 2026-01-21T17:29:16.895     2000:  7313:  7313 V/LSPlt           ] restore 0xc87e98b31000 from 0xc89502b6c000
    [ 2026-01-21T17:29:16.917     2000:  7313:  7313 V/zygisk-core64   ] unmap libzygisk.so loaded at 0xc87e9ae49000 with size 1417216
    [ 2026-01-21T17:29:16.939        0:  1268:  2808 D/LSPosedService  ] ProcessInfo{uid=2000, pid=7313, processName='org.lsposed.manager', heartBeat=android.os.BinderProxy@d047bee} is dead
    
  20. changed the title [-]Parasitic manager fails to open, but works when installed as user app[/-] [+]Parasitic manager fails to open on GrapheneOS[/+] on Jan 22, 2026
  21. raxod502 commented on Jan 22, 2026

    @raxod502
    Author

    Well, https://github.com/VarunS2002/Xposed-Disable-FLAG_SECURE works on GrapheneOS under LSPosed for me. That's what I installed and tested right after setting up LSPosed and working out that I could install the manager as a user app.

    Is DCL via storage also needed? I only turned on DCL via memory and that got the manager working as a user app.

  22. sofia-nep commented on Jan 26, 2026

    @sofia-nep

    The bug is reproducible on DivestOS and disabling "secure app spawning" seems to fix it, at least from a preliminary check, maybe something similar can be done on GrapheneOS?

  23. Ubuntuify commented on Jan 26, 2026

    @Ubuntuify

    Not on GrapheneOS, but I'm pretty sure that GrapheneOS does away with the Zygote model and spawns processes initializing everything manually which may interfere with stuff like Zygisk (which modifies the Zygote).

    The "Secure app spawning" setting, I believe, is what switches it back to the Zygote model.

    Documentation on how GrapheneOS spawns app processes can be seen at this link.

  24. raxod502 commented on Jan 27, 2026

    @raxod502
    Author

    Confirmed. Disabling secure app spawning restores functionality of the parasitic launcher.

    Shall I contribute LSPosed documentation noting this required workaround for GrapheneOS and DivestOS, after which we can close this issue?

  25. JingMatrix commented on Jan 27, 2026

    @JingMatrix
    Owner

    @raxod502 , nice to hear that. Currently, this issue itself can serve as a documentation.
    When I finish refactoring LSPosed, I may invite you to add a short section of GrapeheOS.

    Before that, do you also encounter issue #206 ?

  26. raxod502 commented on Jan 27, 2026

    @raxod502
    Author

    I uninstalled the user app, then removed the KernelSU module I had installed, and installed the latest release version 1.10.2. What I observe is that the parasitic manager can still be opened OK, and reports that LSPosed is active. Furthermore, my already-installed "Disable FLAG_SECURE" LSPosed module appears to still be effective.

    So, based on my understanding, I do not encounter issue #206.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions