Skip to content

add(app): Add Android jailbreak mode - #209

Open
xingguangcuican6666 wants to merge 4 commits into
devfrom
yueyu
Open

add(app): Add Android jailbreak mode#209
xingguangcuican6666 wants to merge 4 commits into
devfrom
yueyu

Conversation

@xingguangcuican6666

Copy link
Copy Markdown
Owner

No description provided.

@xingguangcuican6666

Copy link
Copy Markdown
Owner Author

/codex review

@xingguangcuicanbot xingguangcuicanbot left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated PR Review

Summary

The release build does not keep the manifest-referenced app-zygote preload/native entry point, which can break the jailbreak path in minified APKs. The request is also consumed before bootstrap success, making failed attempts unnecessarily non-retryable.

Decision

request_changes

Notes

Codex recommendation: request_changes
Posted 2 inline review comment(s).

private static final String REQUEST_RELATIVE_PATH = "files/magica-jailbreak/request.properties";
private static final String REQUEST_MODULE_PATH = "modulePath";

private static native void forkDontCareAndExecKsud(

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Location: app/src/main/java/com/abk/kernel/magica/AppZygotePreload.java:19

Issue: AppZygotePreload is only referenced by the manifest's android:zygotePreloadName string, and its native method is resolved by the exact JNI symbol name. The release build enables R8 shrinking/obfuscation, but there is no keep rule for this class or method. R8 can remove or rename the preload class/method, causing the app-zygote preload to fail or the native lookup to throw in release APKs.

Suggestion: Add release keep rules for com.abk.kernel.magica.AppZygotePreload and its native method, or annotate the class/method with an appropriate keep annotation.

throw new IllegalStateException("ksud does not exist: " + ksud);
}
Request request = readRequest(appInfo);
if (!request.delete()) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Location: app/src/main/java/com/abk/kernel/magica/AppZygotePreload.java:33

Issue: The request file is deleted before loading abkksu and before the fork/exec succeeds. Any transient failure in native-library loading, fork, setuid, or exec consumes the only request, so retrying jailbreak mode requires staging the module again and can leave the feature silently unavailable after a failed attempt.

Suggestion: Consume the request only after the native bootstrap has been successfully initiated, or preserve it when bootstrap fails so the operation can be retried.

Suggested change
if (!request.delete()) {
System.loadLibrary("abkksu");
Log.d(TAG, "executing magica with external module: " + request.modulePath);
forkDontCareAndExecKsud(ksud.getAbsolutePath(), appInfo.packageName, request.modulePath);
if (!request.delete()) {
Log.w(TAG, "failed to delete consumed request: " + request.file);
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants