Patch not working for Android 15 X86_64 Redroid image

[nekrondev]

I tried to manually apply a patched services.jar to the redroid x86_64-based image to enable spoofing for my test environment. However, the patched services.jar results into dead system exception.

Source image:

docker pull erstt/redroid:15.0.0_ndk_magisk_AVD

Patch applied on host:

java -jar .\dexpatcher-1.8.0-beta1.jar --multi-dex-threaded --api-level 35 --verbose --debug --output dex services.jar .\haruka_core.dex .\haruka_35.dex
DexPatcher version 1.8.0-beta1 by Lanchon (https://dexpatcher.github.io/)
info: read 'services.jar'
debug: read 'services.jar': file 'classes.dex': 6823 types
debug: read 'services.jar': file 'classes2.dex': 6464 types
debug: read 'services.jar': file 'classes3.dex': 1518 types
info: read '.\haruka_core.dex'
debug: read '.\haruka_core.dex': 12 types
debug: type 'io.github.shomy.haruka.Haruka': (Haruka.java:0): add
debug: type 'io.github.shomy.haruka.Reflector': (Reflector.java:0): add
debug: type 'lanchon.dexpatcher.annotation.DexAction': (DexAction.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexAdd': (DexAdd.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexAppend': (DexAppend.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexEdit': (DexEdit.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexIgnore': (DexIgnore.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexPrepend': (DexPrepend.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexRemove': (DexRemove.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexReplace': (DexReplace.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexTarget': (DexTarget.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexWrap': (DexWrap.java:0): ignore
info: read '.\haruka_35.dex'
debug: read '.\haruka_35.dex': 13 types
debug: type 'com.android.server.pm.ComputerEngine': (ComputerEngine.java:0): edit
debug: type 'com.android.server.pm.ComputerEngine': field 'FAKE_PACKAGE_SIGNATURE_PERM:java.lang.String': (ComputerEngine.java:0): add
info: type 'com.android.server.pm.ComputerEngine': method '<init>():void': (ComputerEngine.java:21): implicit ignore of trivial default constructor
debug: type 'com.android.server.pm.ComputerEngine': method '<init>():void': (ComputerEngine.java:21): ignore
debug: type 'com.android.server.pm.ComputerEngine': method 'generatePackageInfo(com.android.server.pm.pkg.PackageStateInternal, long, int):android.content.pm.PackageInfo': (ComputerEngine.java:37): wrap
debug: type 'io.github.shomy.haruka.HarukaPackageWrapper': (HarukaPackageWrapper.java:0): add
debug: type 'io.github.shomy.haruka.HarukaSignatureSpoofingCore': (HarukaSignatureSpoofingCore.java:0): add
debug: type 'lanchon.dexpatcher.annotation.DexAction': (DexAction.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexAdd': (DexAdd.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexAppend': (DexAppend.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexEdit': (DexEdit.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexIgnore': (DexIgnore.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexPrepend': (DexPrepend.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexRemove': (DexRemove.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexReplace': (DexReplace.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexTarget': (DexTarget.java:0): ignore
debug: type 'lanchon.dexpatcher.annotation.DexWrap': (DexWrap.java:0): ignore
info: write 'dex'
debug: write 'dex': dex version '039'
debug: write 'dex': file 'classes.dex': 5000 types
debug: write 'dex': file 'classes2.dex': 4109 types
debug: write 'dex': file 'classes3.dex': 5500 types
debug: write 'dex': file 'classes4.dex': 200 types
0 error(s), 0 warning(s)

Dex2oat64 run inside redroid emulator:

dex2oat64 --dex-file=services.jar --oat-file=services.odex

Merged patch into docker image via:

FROM erstt/redroid:15.0.0_ndk_magisk_AVD

# patch folder contains subfolders of ./system/framework/oat/x86_64 with the patched jar and vdex/odex files
COPY patch /

Build a new image containing the spoof patch:

docker build -t nekron/redroid_spoof .

Launch the image with:

docker run -itd --rm --privileged -v ~/data:/data -p 5555:5555 -p 27042:27042 nekron/redroid_spoof

When executing the container I get a crashloop:

01-08 15:49:39.811  5435  5450 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: binder:5435_2
01-08 15:49:39.811  5435  5450 E AndroidRuntime: java.lang.VerifyError: Verifier rejected class com.android.server.inputmethod.AdditionalSubtypeMapRepository$WriteTask: boolean com.android.ser
ver.inputmethod.AdditionalSubtypeMapRepository$WriteTask.equals(java.lang.Object) failed to verify: boolean com.android.server.inputmethod.AdditionalSubtypeMapRepository$WriteTask.equals(java.
lang.Object): [0x0] invalid argument count (2) exceeds outsSize (0)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:  int com.android.server.inputmethod.AdditionalSubtypeMapRepository$WriteTask.hashCode() failed to verify: int com.android.server.inputmethod.Ad
ditionalSubtypeMapRepository$WriteTask.hashCode(): [0x0] invalid argument count (1) exceeds outsSize (0)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:  java.lang.String com.android.server.inputmethod.AdditionalSubtypeMapRepository$WriteTask.toString() failed to verify: java.lang.String com.and
roid.server.inputmethod.AdditionalSubtypeMapRepository$WriteTask.toString(): [0x0] invalid argument count (1) exceeds outsSize (0) (declaration of 'com.android.server.inputmethod.AdditionalSub
typeMapRepository$WriteTask' appears in /system/framework/services.jar!classes2.dex)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at com.android.server.inputmethod.AdditionalSubtypeMapRepository$SingleThreadedBackgroundWriter.scheduleWriteTask(AdditionalSubtypeMapRe
pository.java:138)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at com.android.server.inputmethod.AdditionalSubtypeMapRepository.putAndSave(AdditionalSubtypeMapRepository.java:221)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at com.android.server.inputmethod.InputMethodManagerService.setAdditionalInputMethodSubtypes(InputMethodManagerService.java:4269)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at com.android.server.inputmethod.ZeroJankProxy.setAdditionalInputMethodSubtypes(ZeroJankProxy.java:307)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at com.android.server.inputmethod.IInputMethodManagerImpl.setAdditionalInputMethodSubtypes(IInputMethodManagerImpl.java:355)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at com.android.internal.view.IInputMethodManager$Stub.onTransact(IInputMethodManager.java:640)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at android.os.Binder.execTransactInternal(Binder.java:1500)
01-08 15:49:39.811  5435  5450 E AndroidRuntime:        at android.os.Binder.execTransact(Binder.java:1444)
01-08 15:49:39.855  6027  6027 E AndroidRuntime: FATAL EXCEPTION: main
01-08 15:49:39.855  6027  6027 E AndroidRuntime: Process: com.android.inputmethod.latin, PID: 6027
01-08 15:49:39.855  6027  6027 E AndroidRuntime: DeadSystemException: The system died; earlier logs will point to the root cause
01-08 15:49:39.884  6039  6039 E AndroidRuntime: FATAL EXCEPTION: main
01-08 15:49:39.884  6039  6039 E AndroidRuntime: Process: android.ext.services, PID: 6039
01-08 15:49:39.884  6039  6039 E AndroidRuntime: DeadSystemException: The system died; earlier logs will point to the root cause

[nekrondev]

Attached patched services.jar (decomp with jedx looks fine to me)

services.jar.zip

[shomykohai]

Hi, unfortunately this issue comes from dexpatcher (the tool I use to inject haruka), because the tool is old and not updated for new android versions, so dex2oat generates invalid odex and vdex files, that cause android to crash :(

I'm still trying to figure out how to solve the issue and/or another tool to inject haruka, see #5 and DexPatcher/dexpatcher-tool#39

I'm afraid you'll have to rely on another tool 'til a solution is found :(

[nekrondev]

Many thanks for your help and investigations. I recompiled your dex files today based on the redroid settings.jar and framework.jar to out rule framework issues but unfortunately I run into the same exception. It looks like the injection is somehow breaking bytecode. Android is moving too fast to keep the tools updated :(.

[nekrondev]

A short notice on this: I patched the redroid 14 docker image with the patched files and signature spoofing works.

[shomykohai]

A short notice on this: I patched the redroid 14 docker image with the patched files and signature spoofing works.

Hi, with Sig spoof git patches or haruka? Just curious to know.

[nekrondev]

I used the latest haruka_34.dex and haruka_core.dex files with dexpatcher on the redroid 14 services.jar. The patched services.jar had been copied into an unpatched redroid 14 container where I generated the new odex/vdex files that afterwards had been added with the patched services.jar into an updated docker image.