Couldn't install app via Vector manager with PIF-inject on HyperOS

[a0193143]

Steps to reproduce/复现步骤

1. Install PIF-inject (https://github.com/KOWX712/PlayIntegrityFix) and Vector
2. Try install any app in Vector's store or Vector's "Install as an app"

Expected behaviour/预期行为

Apps installed properly.

Actual behaviour/实际行为

Apps could not be installed.

Xposed Module List/Xposed 模块列表

All disabled

Root implementation/Root 方案

KernelSU-Next v3.3.0

System Module List/系统模块列表

Play Integrity Fix Inject (https://github.com/KOWX712/PlayIntegrityFix)
bindhosts
De-Bloater
JamesDSP Manager
Magisk Mount-rs (https://github.com/Tools-cx-app/meta-magic_mount-rs)
NeoZygisk
Morphe mounted apps

Vector version/Vector 版本

2.2

Android version/Android 版本

HyperOS 3 (Android 16)

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

Vector-logs-debug-20260829-174727.zip

[JingMatrix]

I don't think the installation is affected by Play Integrity Fix Inject.

Try disable PIF module, and test installation again. It seems to be an OEM restriction.

08-29 17:46:56.305  2482  2972 I wm_pause_activity: [0,220412398,com.android.shell/.BugreportWarningActivity,userLeaving=false,pauseBackTasks]
08-29 17:46:56.305  1656  1701 I ANDR-PWR-OPT: GAMEPOWEROPT: sendEvents() 232: Start hint for app com.miui.securitycenter/com.miui.permcenter.install.AdbInstallActivity/101256, hintID : 4099, hintID hex : 1003 value: -1
08-29 17:46:56.306  2482  3260 I CameraActivitySceneMode: decideSceneMode: ActivityStateChange isn't resumend activityName = com.android.shell.BugreportWarningActivity, displayId = 0, state = 3, mIsVideocallResumed = false
08-29 17:46:56.306  2482  2972 D Transition: setReady 8 wc=Task{cc4051c #14 type=standard A=2000:com.android.shell} ready=false
08-29 17:46:56.307  1656  1701 I ANDR-PWR-OPT: PowerAppClassifier: getAppType() 59: checking app [com.miui.securitycenter] is type 1
08-29 17:46:56.307  1656  1701 I ANDR-PWR-OPT: GAMEPOWEROPT: isGame() 355: com.miui.securitycenter is Game = 1
08-29 17:46:56.307  1656  1701 I ANDR-PWR-OPT: GAMEPOWEROPT: sendEvents() 232: Start hint for app com.android.shell/com.android.shell.BugreportWarningActivity/36, hintID : 4100, hintID hex : 1004 value: -1
08-29 17:46:56.307  2482  2972 D WindowManager: Collecting in transition 8: ActivityRecord{14792768 u0 com.miui.securitycenter/com.miui.permcenter.install.AdbInstallActivity t15} init visibleRequested:false dc:Display{#0 state=ON size=1600x2560 ROTATION_0}
08-29 17:46:56.308  1716  2081 D SDM     : DisplayBuiltIn::PreCommit: display_builtin.cpp histogramNextTriger 1 histogramSetup 1  histogramSample 0
08-29 17:46:56.309  2482  2972 I ActivityTaskManager: START u0 {act=android.intent.action.VIEW flg=0x18040000 cmp=com.miui.securitycenter/com.miui.permcenter.install.AdbInstallActivity (has extras)} with LAUNCH_MULTIPLE from uid 1000 from pid 2482 callingPackage pm callers: com.android.server.wm.ActivityTaskManagerService.startActivityAsUser:1495 com.android.server.wm.ActivityTaskManagerService.startActivity:1463 com.android.server.am.ActivityManagerService.startActivity:3707 com.android.server.pm.PmInjector.installVerify:65 com.android.server.pm.PackageManagerServiceImpl.verifyInstallFromShell:1491  (BAL_ALLOW_NON_APP_VISIBLE_WINDOW) result code=0
08-29 17:46:56.310  2482  2972 I AppStartScenario: notifyScenarioChanged: active=true param=Bundle[{uid=1000, name=com.miui.permcenter.install.AdbInstallActivity, type=2, preStartProc=false, state=1, processName=com.miui.securitycenter, packageName=com.miui.securitycenter, appSwitch=true}]
08-29 17:46:57.055  2482  2894 I DisplayModeDirectorImpl: updateRefreshRateResultIfNeeded after:baseModeId=1 allowGroupSwitching=false primary=physical: (0.0 Infinity) render:  (0.0 120.0) appRequest=physical: (0.0 Infinity) render:  (0.0 120.0) idleScreenRefreshRateConfig=null mNormalModeSkipOveride: false
...
08-29 17:46:57.057 12630 12630 I wm_on_destroy_called: [0,14792768,com.miui.permcenter.install.AdbInstallActivity,performDestroy,1]
08-29 17:46:57.057  2482  2972 E Pm      : install msg : Failure [INSTALL_CANCELED_BY_USER]
08-29 17:46:57.057  2482  2972 E PKMSImpl: MIUILOG- assertCallerAndPackage: uid=2000, installerPkg=com.android.shell, packageName: org.matrix.vector.manager, msg=Install canceled by user
08-29 17:46:57.058  2482  2972 D PackageInstallerSession: Marking session 616586251 as failed: INSTALL_FAILED_USER_RESTRICTED: Install canceled by user
08-29 17:46:57.058  2482  2972 I PackageInstallerSession: Session [616586251] was destroyed because of [Session marked as failed: INSTALL_FAILED_USER_RESTRICTED: Install canceled by user]
...
08-29 17:46:57.058 12630 12630 E WindowManager: android.view.WindowLeaked: Activity com.miui.permcenter.install.AdbInstallActivity has leaked window com.android.internal.policy.DecorView{efbed13 V.ED..... R....... 0,0-1600,2560}[AdbInstallActivity] that was originally added here
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.view.ViewRootImpl.<init>(ViewRootImpl.java:1698)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.view.ViewRootImpl.<init>(ViewRootImpl.java:1685)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.view.WindowManagerGlobal.addView(WindowManagerGlobal.java:645)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.view.WindowManagerGlobal.addView(WindowManagerGlobal.java:496)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.view.WindowManagerImpl.addView(WindowManagerImpl.java:168)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.Dialog.show(Dialog.java:375)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at miuix.appcompat.app.AlertDialog.show(SourceFile:14)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at com.miui.common.base.AlertActivity.R0(SourceFile:5)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at com.miui.permcenter.install.AdbInstallActivity.Q0(SourceFile:4)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at com.miui.common.base.AlertActivity.onCreate(SourceFile:46)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.Activity.performCreate(Activity.java:9428)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.Activity.performCreate(Activity.java:9371)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1537)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:4703)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:4950)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:222)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.servertransaction.TransactionExecutor.executeNonLifecycleItem(TransactionExecutor.java:136)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.servertransaction.TransactionExecutor.executeTransactionItems(TransactionExecutor.java:106)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:83)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:3103)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.os.Handler.dispatchMessage(Handler.java:114)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.os.Looper.loopOnce(Looper.java:274)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.os.Looper.loop(Looper.java:369)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at android.app.ActivityThread.main(ActivityThread.java:10090)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at java.lang.reflect.Method.invoke(Native Method)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:616)
08-29 17:46:57.058 12630 12630 E WindowManager: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1137)

[a0193143]

Without PIF-inject, apk installed normally.
Vector-logs-debug-20260901-233506.zip
With PIF-inject, apk failed to install.
Vector-logs-debug-20260901-233720.zip

I switched NeoZygisk to debug build hopes could catch more about what PIF-inject doing.

[JingMatrix]

Thanks for running the A/B — that is exactly what was needed.

The refusal itself comes from MIUI, not from Vector: PmInjector.installVerify → PackageManagerServiceImpl.verifyInstallFromShell starts com.miui.permcenter.install.AdbInstallActivity, which finishes on its own and returns INSTALL_FAILED_USER_RESTRICTED. Google's verifier returned ALLOW in both of your runs, and PIF-inject only spoofs inside com.android.vending and com.google.android.gms.unstable — it never enters the process that refuses. MIUI logs no reason for its decision, so to understand why the same install is allowed without PIF-inject and refused with it, I need to read the code that makes it.

Could you pull three files? No root needed.

adb shell pm path com.miui.securitycenter

That prints package:/product/priv-app/.../SomeName.apk. Pull that path:

adb pull /product/priv-app/.../SomeName.apk

Then check which framework jars your build has, and pull the ones that exist:

adb shell ls -l /system/framework/services.jar /system/framework/miui-services.jar /system_ext/framework/miui-services.jar
adb pull /system/framework/services.jar
adb pull /system/framework/miui-services.jar
adb pull /system_ext/framework/miui-services.jar

GitHub does not accept .apk or .jar attachments, so zip them first:

zip miui-install.zip SomeName.apk services.jar miui-services.jar

Send me the zip via Telegram (see my GitHub profile).

[JingMatrix]

Thank you for the files. They settle it, and your original attribution was right: PIF-inject really is the cause.

Every install whose caller is the shell uid is routed by PackageManagerServiceImpl.verifyInstallFromShell to Security Center's AdbInstallActivity, which answers back with a value that defaults to "reject". The first thing that activity checks is whether install interception is enabled at all; if it is not, it allows the install immediately and nothing else runs. That setting has no stored value on your device, so its default decides, and the default is computed from ro.debuggable, Build.TAGS and ro.boot.vbmeta.device_state. When the bootloader looks unlocked, interception defaults to off and the install goes through.

PIF-inject's service.sh resets ro.boot.vbmeta.device_state to locked, along with ro.boot.flash.locked, ro.boot.verifiedbootstate and ro.secureboot.lockstate; its post-fs-data.sh also forces ro.debuggable to 0 and every ro.*.build.tags to release-keys. All three inputs then point the same way, interception defaults to on, and the activity moves to its next check — whether "Install via USB" is enabled. On your device it is not, so it refuses without showing anything, which is the Failure [INSTALL_CANCELED_BY_USER] in your log. Your two runs differ in exactly this: in the passing one the activity answered before it ever asked the guard provider to parse the APK, which only happens when interception is off. The property dump inside the log archive does not show the spoofed values, because Vector takes that snapshot when its daemon starts, before PIF's late script has run.

For anyone reproducing this, the analysis is pinned to these files:

com.miui.securitycenter  versionCode 101256  versionName 12.5.6-260414.1.1.pad
  sha256 68a95097998e1c97bb2928e316f5280aff14d86df73eca05f0c73647d3d7844e
miui-services.jar
  sha256 638c948193f5772c6c9dcb2f12fc9a561bcb4e091ea29d9ab1cc2bc4f413250d
ROM  Redmi/flute_global/flute:16/BP2A.250605.031.A3/OS3.0.302.0.WPWTWXM:user/release-keys

The verifyInstallFromShell path above is com.android.server.pm.PackageManagerServiceImpl and com.android.server.pm.PmInjector in miui-services.jar. The gate itself is below, from baksmali on classes3.dex extracted from that Security Center APK, with the .line directives trimmed:

# Lz5/d;-><clinit>()V
    const-string v0, "ro.boot.vbmeta.device_state"
    const-string v1, ""
    invoke-static {v0, v1}, Lcom/miui/common/utils/D0;->c(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
    const-string v1, "locked"
    ...
    sput-boolean v0, Lz5/d;->d:Z
    sget-object v0, Lmiui/os/Build;->TAGS:Ljava/lang/String;
    const-string v1, "release-key"
    ...
    sput-boolean v1, Lz5/d;->e:Z

# Lz5/d;->t()Z          — v() is false once d is true, so the default becomes true
    invoke-static {}, Lz5/d;->v()Z
    move-result v0
    xor-int/lit8 v0, v0, 0x1
    const-string v1, "permcenter_install_intercept_enabled"
    invoke-static {v1, v0}, LX1/e;->e(Ljava/lang/String;Z)Z
    move-result v0
    return v0

# Lcom/miui/permcenter/install/AdbInstallActivity;->P0()V
    iget-object v4, p0, Lcom/miui/permcenter/install/AdbInstallActivity;->k:Lz5/d;
    invoke-virtual {v4}, Lz5/d;->t()Z
    move-result v4
    const/4 v5, -0x1
    if-nez v4, :cond_3b                 # interception on: fall through to the checks
    iput v5, p0, Lcom/miui/permcenter/install/AdbInstallActivity;->g:I   # g = -1, allow
    invoke-virtual {p0}, Lcom/miui/permcenter/install/AdbInstallActivity;->finish()V
    return-void

There is nothing Vector can change here, but two things should get you moving. Enabling "Install via USB" in Security Center replaces the silent refusal with the confirmation dialog, where "Continue install" allows it. And once the manager is installed, Security Center allows every later install of it unconditionally, so this only affects the first one. Any module that spoofs bootloader state will have the same effect on HyperOS, so it is worth mentioning upstream as well.

[a0193143]

I see.
Enabling "Install via USB" requires sign in with Mi account, for someone who don't want to sign in, an Xposed module caller HyperCeiler has an option to bypass (Security Center -> Others -> Disable USB installation interception).

I wonder if Vector could have the traditional user prompted install method as alternative like the old rovo89 Xposed manager?
In case some weird ROM causing the similar issue.