Unverified Commit a3381da7 authored by 残页's avatar 残页 Committed by GitHub

Bypass DexFile's security check for RootService (#5911)

Old Android (pre 8.0) enforces `optimizedDirectory` to have the same uid with the process. If repackaged, root service (uid=0) will crash when trying to load current.apk. So we set `optimizedDirectory` to null to bypass the check.
parent 351e0944
...@@ -5,18 +5,19 @@ import java.io.IOException; ...@@ -5,18 +5,19 @@ import java.io.IOException;
import java.net.URL; import java.net.URL;
import java.util.Enumeration; import java.util.Enumeration;
import dalvik.system.DexClassLoader; import dalvik.system.BaseDexClassLoader;
public class DynamicClassLoader extends DexClassLoader { public class DynamicClassLoader extends BaseDexClassLoader {
private static final ClassLoader base = Object.class.getClassLoader(); private static final ClassLoader base = Object.class.getClassLoader();
public DynamicClassLoader(File apk) { public DynamicClassLoader(File apk) {
super(apk.getPath(), apk.getParent(), null, base); this(apk, base);
} }
public DynamicClassLoader(File apk, ClassLoader parent) { public DynamicClassLoader(File apk, ClassLoader parent) {
super(apk.getPath(), apk.getParent(), null, parent); // Set optimizedDirectory to null to bypass DexFile's security checks
super(apk.getPath(), null, null, parent);
} }
@Override @Override
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment