ONPatch

- When NPatch packages, it directly places mtprovider.dex into the main DEX sequence (classesN.dex), allowing the system's native MultiDex to load it. - Removed the runtime copying of provider.dex and the reflection injection logic for DexPathList$Element(DexFile), which does not exist on Android 8+. - In signature bypass mode, the installer's DEX is appended via the standard addDexPath method.

fix(loader): give framework classloader an XResources super parent

The framework InMemoryDexClassLoader was built with stub_classloader as its parent, which does not define XResources' synthetic super (xposed.dummy.XResourcesSuperClass extending android.content.res.Resources). When a module uses XResources, ART resolves android.content.res.XResources with its super unreachable and records the class as erroneous for the whole process, so resource hooking hard-fails (seen on Android 16). Build the dummy super class loader (already provided by core's BuildDummySuperClassLoader) and install it as the framework loader's parent at construction, falling back to stub_classloader if it cannot be built. Mirrors JingMatrix/LSPatch.

規避匿名可執行段掃描，修復了對於非標準XML的解析

https://bbs.binmt.cc/thread-175114-1-1.html 大家可以測試一下去簽名校驗的實際效果。目前各個去簽方案的側重點各有不同，未來或許能找到更全面的繞過方式。不過就目前而言，即便是 LSPosed 在默認配置下，依然存在四個已知的檢測風險點

我们将签名绕过后端的 PLT/GOT Hook 方案由 爱奇艺的 xHook 全面迁移至 字节跳动的 bhook，同时剥离了 ShadowHook 依赖，使 bhook 得以独立轻量运作😈 这次重构旨在显著提升原生层签名绕过的效能与整体稳定性，我相信你们也能看到光是 apk 产物，即使是在压缩后发布的版本，它也小了约 0.5MB🦀 有趣的是，这两个开源库的作者都是 caikelun 🐾 由于涉及核心 Native 机制的调整，影响范围较广，特在此频道发布测试版，希望能收集大家的第一手反馈！遇到任何问题请随时回报 ❤️

fix(manager): 修復 Shizuku 使用者服務無法啟動並強化斷線處理 ShizukuService 只以類別名稱交給 Shizuku，由 ServiceStarter 在另一個程序以 loadClass 加上無參建構子實例化；manager 本身從不實例化它，R8 因此把它併入抽象的 AIDL Stub，導致 InstantiationException、使用者服務永遠起不來，診斷匯出拿不到 logcat。加入 keep 規則保留其無參建構子。 dumpLogcat 改為擷取最近 10 分鐘的 logcat，過濾後只保留最新的 maxLines 行；原本取最後 5000 行原始日誌，在日誌密集的 ROM 上只涵蓋數秒。 performDexOptMode 與 isPackageInstalledWithoutPatch 在 Shizuku 於 UI 判斷可用後才斷線時會拋出例外並導致閃退，改為失敗時回傳 false。 fix(loader): 修復 execute-only (.text) 頁掃描在 MagicOS 等 ROM 上崩潰 等級 3 的 svc 重導掃描直接以 uint32_t 讀取每個可執行 PT_LOAD 段尋找 svc #0，在把 .text 對映成 execute-only (XOM) 的 ROM（如 Honor MagicOS 9）上，讀取會觸發 SEGV_ACCERR 並殺掉行程，修補後的 app 冷啟動約 1 秒即崩潰 (#156)。掃描前先以 mprotect 將涵蓋頁加上 PROT_READ 權限（保留可執行，一般 r-x 情況為 no-op），失敗則跳過該段不讀取。 一併修正 xhook SIGSEGV 保護的 act.sa_flags 未初始化問題：殘留的垃圾值可能帶有 SA_RESETHAND，使處理器在第一次接住後即失效，導致 Stealth 模式在 XOM 裝置上第二次 fault 時崩潰。 feat(ui): 首頁計數卡片並排重構、關於頁補齊構建資訊與官網連結

fix(manager): warn when diagnostic export cannot see patched app logs Without all files access the manager cannot see another app's log files under Android/media, so the export silently reported zero logs as if the app had never launched. Record the missing access and unlistable directories as collection warnings instead. fix(loader): keep framework service binder local so modules load without the manager When the manager bind timed out, RemoteApplicationService.asBinder() returned null, so VectorServiceClient never accepted the service and XposedInit loaded no modules even though the local cache had them. A manager binder that died later also made VectorServiceClient drop the service. Make RemoteApplicationService a local stub whose asBinder() is itself; every call already falls back to the local cache when the manager is unavailable. Fixes #154. fix(manager): restrict patch input types and keep split APKs intact Only accept .apk, .apks and .xapk when picking files to patch. Read the base signer from the signing block like its splits, so a v3.1 rotated key no longer fails the split signature check. Feed patched splits back as-is when updating the loader, since only the base embeds origin.apk, and carry installed splits over when re-patching an extracted original. feat(manager): accept .apkm bundles and duplicate-download .apk.N files Treat .apkm like the other split bundles, and read names such as app.apk.1 that browsers give repeated downloads as plain APKs.

fix(manager): Fix the issue where storage permissions might not be obtained on Android 10 Enable requestLegacyExternalStorage and adjust the WRITE_EXTERNAL_STORAGE limit to API 29 build(deps): Update Vector core base to the latest version (core-837) and upgrade Gradle Wrapper to 9.8.0

fix(patch): 開啟 DEX 注入時停用 entry-hook，修復模組不生效 (#158) fix(manager): 修復 Android 17 下 Shizuku 套件查詢失敗並加入反射快取 (#160)

fix(manager): 修復模組掃描受限丟失、Companion 激活推送與多選 APK 打包白屏 - 修正 hasRealAppListAccess 假陽性檢測，被系統攔截包列表時不再誤判為已授權 - ConfigManager.updateModules 增加受限掃描與本機 APK 存在性防護，防止已配置模組被清空 - fetchAppList 掃描時自動合併資料庫既有模組，避免受限環境下模組列表消失 - 解除 AppDetailScreen 與 ModuleManageViewModel 針對 Shizuku 的硬性門檻，支援 ContentProvider 雙軌推送 - ModuleService 於宿主查詢模組時補齊 pushToCompanionsAsync，恢復後台 QA/QF/HookVip 激活展示 - ModuleScopeSyncStore 追蹤名單對齊 SQLite 資料庫，增強自救重推可靠性 - NewPatchScreen 與 NeoPackageManager 支援解析多個獨立 Base APK 並提供選單引導，補齊過渡載入與錯誤彈窗以防止全白屏

重構了一些簽名繞過的實作（上個版本的內容）優化的很多介面的樣式，優化了管理器離線後的處理方式

🔨 2 new commits feat(sigbypass): EXTREME Added new svc hook to prevent inlining bypass, HIGH leveled stability fix(manager): API 102 module companion binder will not auto-repush after manager is killed

fix (manager): Optimize package parsing and repository download Package parsing: Removed the GET_SIGNING_CERTIFICATES flag and added a fallback parsing strategy to prevent parsing interruptions caused by APK signature anomalies or malformed Manifests, allowing normal processing of hardened / non-standard APKs. Repository download: Changed to atomic writing; first save to a .tmp temporary file, then rename and overwrite after the download is complete, preventing corrupted repo.json cache and Gson parsing errors caused by network interruptions. fix (sigbypass): Fixed crashes caused by ART14+/16 dex writability checks and the issue of SQLite misidentifying read-only databases After generating the origin.apk cache, directly set it to read-only using chmod 444 to bypass the ART dex writability check from the source; added logic to delete old files to avoid permission errors when overwriting read-only files. Removed the fstat identity spoofing hook and the corresponding (dev,ino) cache to resolve the bug where inode reuse caused SQLite databases to be incorrectly set as read-only; retained stat series path interception, using only file size information to pass checks. Corresponds to Issue #153 and #155, resolving the "Writable dex file ... is not allowed" crash.