Skip to content

Commit

Permalink
Bypass DexFile's security check for RootService (topjohnwu#5911)
Browse files Browse the repository at this point in the history
Old Android (pre 8.0) enforces `optimizedDirectory` to have the same uid with the process. If repackaged, root service (uid=0) will crash when trying to load current.apk. So we set `optimizedDirectory` to null to bypass the check.
  • Loading branch information
canyie authored Jun 4, 2022
1 parent 351e094 commit a3381da
Showing 1 changed file with 5 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,19 @@
import java.net.URL;
import java.util.Enumeration;

import dalvik.system.DexClassLoader;
import dalvik.system.BaseDexClassLoader;

public class DynamicClassLoader extends DexClassLoader {
public class DynamicClassLoader extends BaseDexClassLoader {

private static final ClassLoader base = Object.class.getClassLoader();

public DynamicClassLoader(File apk) {
super(apk.getPath(), apk.getParent(), null, base);
this(apk, base);
}

public DynamicClassLoader(File apk, ClassLoader parent) {
super(apk.getPath(), apk.getParent(), null, parent);
// Set optimizedDirectory to null to bypass DexFile's security checks
super(apk.getPath(), null, null, parent);
}

@Override
Expand Down

0 comments on commit a3381da

Please sign in to comment.