Register the serial proxy service on Android 10 and below - #793
Merged
Conversation
The Zygisk module polls `ServiceManager.getService("serial")` while
specializing `system_server`, but since #648 the matching
`ServiceManager.addService` call sits inside the `SDK_INT >= R` branch that
exists only for `IServiceManager.registerForNotifications`. On Android 8.1 to
10 nothing claims the name, so the module aborts the injection after ten
attempts.
Keep only `registerForNotifications` behind the version check. Without the
callback we cannot capture the real service, but its own registration replaces
our proxy in servicemanager anyway.
JingMatrix
force-pushed
the
fix-pre-r-proxy-service
branch
from
July 25, 2026 21:36
015ead4 to
38c839e
Compare
JingMatrix
changed the title
serial proxy service on Android 10 and below
1 task
`IActivityManager.startActivityAsUserWithFeature` only arrived in Android R, but both call sites used it unconditionally, so on Android 10 the manager opened once and then took the daemon down, as reported in #773: java.lang.NoSuchMethodError: No interface method startActivityAsUserWithFeature(...) at org.matrix.vector.daemon.ipc.ManagerService.startActivityAsUserWithFeature(ManagerService.kt:379) at org.lsposed.lspd.ILSPManagerService$Stub.onTransact(ILSPManagerService.java:377) E/VectorDaemon: Uncaught exception in Daemon The error escaped the binder transaction because that call site was not guarded, and the manager was then left in the shell host process without a daemon, which is where the `BugreportWarningActivity` crash comes from. Route both call sites through `startActivityAsUserCompat`, following the `registerReceiverCompat` pattern: pick the signature the platform provides and turn a failure into a negative result instead of an uncaught error.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Android 10 the Zygisk module never finds the proxy that the daemon claims to have registered, as reported in #773:
The daemon prints
Waiting system service: packageon every second between those attempts, so it is alive: this is not the startup race of #648, the name is simply never registered.registerProxyServiceneeds the version check only forIServiceManager.registerForNotifications, which arrived in Android R, and #648 movedServiceManager.addServiceinto that same branch, leaving API 27 to 29 without a proxy.We keep only
registerForNotificationsbehind the check. On pre-R we cannot capture the real service, but its own registration replaces our proxy in servicemanager anyway.The reporter confirmed that the Manager now opens, but only once. The follow-up log in #773 shows a second pre-R gap behind that:
IActivityManager.startActivityAsUserWithFeaturealso arrived in Android R, and our stub already marks it@RequiresApi(30), but both call sites used it unconditionally.openManagerhid the error insiderunCatching, while the binder override did not, so it escapedonTransactand killed the daemon. The Manager is then left in the shell host process with nothing to hand it an intent, which is theBugreportWarningActivityNPE further down the same log.The second commit routes both call sites through
startActivityAsUserCompat, shaped like the existingregisterReceiverCompat: pick the signature the platform provides, and report a failure as a negative result instead of letting an unchecked error escape a binder transaction.Close #773 as fixed.