HyperOS A13，银行无法截屏，alipayhk无法截屏，无法使用

[mrxxx66]

LSPosed version

v1.9.2-it(7461)

Android version

13

Custom OS version

1.0.10.0

Version requirement

• I am using latest debug CI version

LSPosed requirement

• I am using official LSPosed version

Behavior

Framework, Services, and Screenshot App

汇丰银行，Alipayhk

[mrxxx66]

4.3没有debug版本，我应该用这个天鹅debug对吗

[Howard20181]

https://github.com/LSPosed/DisableFlagSecure/actions/runs/20538045080

这个才有签名
https://github.com/LSPosed/DisableFlagSecure/actions/runs/20538008228

[mrxxx66]

https://github.com/LSPosed/DisableFlagSecure/actions/runs/20538045080

这个才有签名 https://github.com/LSPosed/DisableFlagSecure/actions/runs/20538008228

[mrxxx66]

https://github.com/LSPosed/DisableFlagSecure/actions/runs/20538045080

这个才有签名 https://github.com/LSPosed/DisableFlagSecure/actions/runs/20538008228

另外，我可以在tg私聊你吗

[Howard20181]

作用域设置不完整，你试试勾选系统框架然后重启手机

[mrxxx66]

安装的时候已经勾选并重启了，我在重启一次，发你日志。> 作用域设置不完整，你试试勾选系统框架然后重启手机

[Howard20181]

更新 LSPosed 试试，不知道为什么系统框架没 hook 到
现在版本是 7469

[mrxxx66]

问题依旧

[Howard20181]

使用 release with log 版本 LSPosed，启用详细日志
LSPosed 设置有个 hook 调试，开了之后重启一次，尝试截图之后转储调试信息再发送日志

[JasonKhew96]

lsposed release with log 详见 https://t.me/c/2496139642/9913

[Howard20181]

HyperOS 对 android.permission.CAPTURE_BLACKOUT_CONTENT 加了额外的校验，具有此权限的应用不能是由系统界面调用的。

AOSP
hasCaptureBlackoutContentPermission

HyperOS

hasCaptureBlackoutContentPermission()

  CallingPid = android::IPCThreadState::getCallingPid(v16);
  CallingUid = android::IPCThreadState::getCallingUid(v16);
  isCallingBySystemui = android::MiSurfaceFlingerStub::isCallingBySystemui(
                          (android::MiSurfaceFlingerStub *)CallingPid,
                          v19);
  v22 = android::PermissionCache::checkPermission(
          (android::PermissionCache *)&unk_846D78,
          (const android::String16 *)CallingPid,
          CallingUid,
          v21);
  if ( CallingUid == 1003 || CallingUid == 1000 && (isCallingBySystemui & 1) == 0 )
    v23 = 1;
  else
    v23 = v22 & (isCallingBySystemui ^ 1);

static bool hasCaptureBlackoutContentPermission() {
    IPCThreadState* ipc = IPCThreadState::self();
    const int pid = ipc->getCallingPid();
    const int uid = ipc->getCallingUid();
    //MIUI MODE : START
    //return uid == AID_GRAPHICS || uid == AID_SYSTEM ||
    //       PermissionCache::checkPermission(sCaptureBlackoutContent, pid, uid);
    const bool isCallingBySystemui = MiSurfaceFlingerStub::isCallingBySystemui(pid);
    const bool permission = PermissionCache::checkPermission(sCaptureBlackoutContent, pid, uid);
    return uid == AID_GRAPHICS || (uid == AID_SYSTEM && !isCallingBySystemui) ||
            (permission && !isCallingBySystemui);
    //END
}

/system_ext/lib64/libmisurfaceflinger.so

isCallingBySystemui(pid)

bool __fastcall android::MiSurfaceFlingerImpl::isCallingBySystemui(
        android::MiSurfaceFlingerImpl *this,
        __int64 a2,
        __int64 a3)
{
  int v3; // w20
  FILE *v4; // x0
  FILE *v5; // x19
  _BOOL4 v6; // w20
  __int128 v8; // [xsp+0h] [xbp-90h] BYREF
  __int128 v9; // [xsp+10h] [xbp-80h]
  __int128 v10; // [xsp+20h] [xbp-70h]
  __int128 v11; // [xsp+30h] [xbp-60h]
  char filename[16]; // [xsp+40h] [xbp-50h] BYREF
  __int128 v13; // [xsp+50h] [xbp-40h]
  __int128 v14; // [xsp+60h] [xbp-30h]
  __int128 v15; // [xsp+70h] [xbp-20h]
  __int64 v16; // [xsp+88h] [xbp-8h]

  v3 = a2;
  v16 = *(_QWORD *)(_ReadStatusReg(TPIDR_EL0) + 40);
  v14 = 0u;
  v15 = 0u;
  *(_OWORD *)filename = 0u;
  v13 = 0u;
  sprintf(filename, a2, a3, (unsigned int)a2);
  v4 = fopen(filename, "r");
  if ( v4 )
  {
    v5 = v4;
    v10 = 0u;
    v11 = 0u;
    v8 = 0u;
    v9 = 0u;
    fgets((char *)&v8, 63, v4);
    if ( (unsigned __int64)v8 ^ 0x72646E612E6D6F63LL  // "com.andr"
       | *((_QWORD *)&v8 + 1) ^ 0x747379732E64696FLL // "oid.syst"
       | (unsigned __int64)v9 ^ 0x7263733A69756D65LL  // "emui:scr"
       | *((_QWORD *)&v9 + 1) ^ 0x746F68736E6565LL )  // "eenshot"
	// "com.android.systemui:screenshot"
    {
      v6 = ((unsigned __int64)v8 ^ 0x6975696D2E6D6F63LL // "com.miui"
          | *((_QWORD *)&v8 + 1) ^ 0x736E65657263732ELL // ".screeen"
          | (unsigned int)v9 ^ 0x746F68LL) == 0; // "hot"
		// "com.miui.screenshot"
    }
    else
    {
      v6 = 1;
    }
    fclose(v5);
  }
  else
  {
    _android_log_print(3, "MI-SF", "Can not open file of /proc/%d/cmdline.", v3);
    return 0;
  }
  return v6;
}

bool MiSurfaceFlingerImpl::isCallingBySystemui(const int callingPid) {
    char filename[64];
    sprintf(filename, "/proc/%d/cmdline", callingPid);
    FILE *f = fopen(filename, "r");
    if (!f) {
        ALOGD("Can not open file of /proc/%d/cmdline.", callingPid);
        // For some reason, can't open file. But avoid to take screenshot unsuccessfully, return true.
        return false;
    }
    char processName[64] = {0};
    fgets(processName, sizeof(processName) - 1, f);
    if (strcmp(processName, "com.android.systemui:screenshot") == 0
        || strcmp(processName, "com.miui.screenshot") == 0) {
        fclose(f);
        return true;
    }
    fclose(f);
    return false;
}

[aviraxp]

hook systemui 和 screenshot，在调用截图api前自己通过argv改cmdline？

[Howard20181]

hook systemui 和 screenshot，在调用截图api前自己通过argv改cmdline？

你试试？我不知道怎么改
我有台设备刷了移植的 Android 13 的 HyperOS，复现了这个问题
从代码进版日期（2022年）来看，应该 MIUI 也有这个问题，只不过一直没有人反馈

这对系统有一点点小小的影响，如果 surfaceflinger 认为截图不是系统界面或截屏 APP 会把纸质护眼这一层截进去，不过问题不大