[Bug] LSPatch blocks isolated process such as Chrome

[JingMatrix]

Steps to reproduce/复现步骤

1. Write an empty module (can skip if you want to embed no module)
2. Patch it with bromite (not using Chrome to avoid signature conflicting for system-installed Chrome )
3. open bromite, pages won't be load

Expected behaviour/预期行为

bromite should function normally since nothing is done in the module

Actual behaviour/实际行为

Bromite cannot load URL

Xposed Module List/Xposed 模块列表

An empty module

class MainHook : IXposedHookLoadPackage { 
  override fun handleLoadPackage(lpparam: XC_LoadPackage.LoadPackageParam) {
    
  }
}

LSPatch version/LSPatch 版本

jar-v0.5.1-373-debug

Android version/Android 版本

13

Shizuku version/Shizuku 版本

N/A

Version requirement/版本要求

• I am using latest debug CI version of LSPatch and enable verbose log/我正在使用最新 CI 调试版本且启用详细日志

Apk file/Apk 文件

No response

Logs/日志

adb logcat -s AndroidRuntime:V

04-29 15:49:03.846 23746 23746 D AndroidRuntime: Shutting down VM
04-29 15:49:03.847 23746 23746 E AndroidRuntime: FATAL EXCEPTION: main
04-29 15:49:03.847 23746 23746 E AndroidRuntime: Process: org.bromite.bromite:sandboxed_process1:org.chromium.content.app.SandboxedProcessService1:2, PID: 23746
04-29 15:49:03.847 23746 23746 E AndroidRuntime: java.lang.RuntimeException: Unable to instantiate application org.chromium.chrome.browser.base.SplitChromeApplication package org.bromite.bromite: java.lang.ClassNotFoundException: Didn't find class "org.chromium.chrome.browser.base.SplitChromeApplication" on path: DexPathList[[zip file "/data/app/~~3sdAPRj390tTA7JsFhBaXg==/org.bromite.bromite-fCURQIXlDVQr9f-jzZ2Iuw==/base.apk"],nativeLibraryDirectories=[/data/app/~~3sdAPRj390tTA7JsFhBaXg==/org.bromite.bromite-fCURQIXlDVQr9f-jzZ2Iuw==/lib/arm64, /data/app/~~3sdAPRj390tTA7JsFhBaXg==/org.bromite.bromite-fCURQIXlDVQr9f-jzZ2Iuw==/base.apk!/lib/arm64-v8a, /system/lib64, /system_ext/lib64]]
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.LoadedApk.makeApplicationInner(LoadedApk.java:1466)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.LoadedApk.makeApplicationInner(LoadedApk.java:1395)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.ActivityThread.handleBindApplication(ActivityThread.java:6732)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.ActivityThread.-$$Nest$mhandleBindApplication(Unknown Source:0)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2129)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.os.Handler.dispatchMessage(Handler.java:106)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.os.Looper.loopOnce(Looper.java:201)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.os.Looper.loop(Looper.java:288)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.ActivityThread.main(ActivityThread.java:7884)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at java.lang.reflect.Method.invoke(Native Method)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: Caused by: java.lang.ClassNotFoundException: Didn't find class "org.chromium.chrome.browser.base.SplitChromeApplication" on path: DexPathList[[zip file "/data/app/~~3sdAPRj390tTA7JsFhBaXg==/org.bromite.bromite-fCURQIXlDVQr9f-jzZ2Iuw==/base.apk"],nativeLibraryDirectories=[/data/app/~~3sdAPRj390tTA7JsFhBaXg==/org.bromite.bromite-fCURQIXlDVQr9f-jzZ2Iuw==/lib/arm64, /data/app/~~3sdAPRj390tTA7JsFhBaXg==/org.bromite.bromite-fCURQIXlDVQr9f-jzZ2Iuw==/base.apk!/lib/arm64-v8a, /system/lib64, /system_ext/lib64]]
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:259)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at java.lang.ClassLoader.loadClass(ClassLoader.java:379)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at java.lang.ClassLoader.loadClass(ClassLoader.java:312)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.AppComponentFactory.instantiateApplication(AppComponentFactory.java:76)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.Instrumentation.newApplication(Instrumentation.java:1243)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	at android.app.LoadedApk.makeApplicationInner(LoadedApk.java:1458)
04-29 15:49:03.847 23746 23746 E AndroidRuntime: 	... 11 more

[JingMatrix]

At the beginning, I tried with my own module ChromeXt, the codes in the module worked fine but the browser cannot load pages.

Later I found the problem had nothing to with module, even empty module couldn't work.

It seems that LSPacth blocks loading APKs.

To reproduce it quickly

java -jar jar-v0.5.1-373-debug.jar bromite_arm64.apk -d -v --force && adb install ./bromite_arm64-373-lspatched.apk && adb logcat -s AndroidRuntime

[JingMatrix]

Here is some information useful for you to find out the problems, compare the following two logs by LSPosed and LSPacth.

By LSPosed:

04-29 18:18:12.064 26974 26974 I ChromeXt: com.android.chrome started (com.android.chrome)
04-29 18:18:12.120 26974 26974 I ChromeXt: Package: com.android.chrome, v112.0.5615.135
04-29 18:18:12.125 26974 26974 I ChromeXt: Inited hook: UserScriptHook
04-29 18:18:12.127 26974 26974 I ChromeXt: Inited hook: GestureNavHook
04-29 18:18:12.131 26974 26974 I ChromeXt: Inited hook: MenuHook
04-29 18:18:12.132 26974 26974 I ChromeXt: Inited hook: IntentHook
04-29 18:18:12.597 27081 27081 I ChromeXt: com.android.chrome:privileged_process0 started (com.android.chrome)

and continues with other normal logs.

By LSPatch:

04-29 18:46:29.228 32495 32495 I LSPatch : Use manager: false
04-29 18:46:29.228 32495 32495 I LSPatch : Signature bypass level: 0
04-29 18:46:29.230 32495 32495 I LSPatch : hooked app initialized: android.app.LoadedApk@f2a3afc
04-29 18:46:29.233 32495 32495 W LSPatch : Original AppComponentFactory not found: org.chromium.chrome.browser.base.SplitCompatAppComponentFactory
04-29 18:46:29.233 32495 32495 D LSPatch : Initialize service client
04-29 18:46:29.247 32495 32495 D LSPatch : Processing /data/misc/profiles/cur/0/org.bromite.bromite/primary.prof
04-29 18:46:29.248 32495 32495 D LSPatch : Skip profile /data/misc/profiles/cur/0/org.bromite.bromite/primary.prof
04-29 18:46:29.250 32495 32495 I LSPatch : Bootstrap Xposed
04-29 18:46:29.265 32495 32495 I LSPatch : Load modules
04-29 18:46:29.299 32495 32495 I ChromeXt: org.bromite.bromite started (org.bromite.bromite)
04-29 18:46:29.312 32495 32495 I LSPatch : Modules initialized
04-29 18:46:29.313 32495 32495 I LSPatch : LSPatch bootstrap completed
04-29 18:46:29.370 32495 32495 I ChromeXt: Package: org.bromite.bromite, v108.0.5359.156
04-29 18:46:29.375 32495 32495 I ChromeXt: Inited hook: UserScriptHook
04-29 18:46:29.377 32495 32495 I ChromeXt: Inited hook: GestureNavHook
04-29 18:46:29.381 32495 32495 I ChromeXt: Inited hook: MenuHook
04-29 18:46:29.383 32495 32495 I ChromeXt: Inited hook: IntentHook
04-29 18:46:30.061 32616 32616 I LSPatch : Use manager: false
04-29 18:46:30.062 32616 32616 I LSPatch : Signature bypass level: 0
04-29 18:46:30.073 32616 32616 I LSPatch : hooked app initialized: android.app.LoadedApk@f2a3afc
04-29 18:46:30.080 32616 32616 W LSPatch : Original AppComponentFactory not found: org.chromium.chrome.browser.base.SplitCompatAppComponentFactory
04-29 18:46:30.080 32616 32616 D LSPatch : Initialize service client
04-29 18:46:30.128 32616 32616 D LSPatch : Processing /data/misc/profiles/cur/0/org.bromite.bromite/primary.prof
04-29 18:46:30.129 32616 32616 D LSPatch : Skip profile /data/misc/profiles/cur/0/org.bromite.bromite/primary.prof
04-29 18:46:30.138 32616 32616 I LSPatch : Bootstrap Xposed
04-29 18:46:30.195 32616 32616 I LSPatch : Load modules
04-29 18:46:30.282 32616 32616 I ChromeXt: org.bromite.bromite:privileged_process0 started (org.bromite.bromite)
04-29 18:46:30.363 32616 32616 I LSPatch : Modules initialized
04-29 18:46:30.364 32616 32616 I LSPatch : LSPatch bootstrap completed
04-29 18:46:39.678 32663 32663 D LSPatch : Skip isolated process
04-29 18:46:39.686 32663 32663 D AndroidRuntime: Shutting down VM
04-29 18:46:39.686 32663 32663 E AndroidRuntime: FATAL EXCEPTION: main
04-29 18:46:39.686 32663 32663 E AndroidRuntime: Process: org.bromite.bromite:sandboxed_process1:org.chromium.content.app.SandboxedProcessService1:0, PID: 32663
04-29 18:46:39.686 32663 32663 E AndroidRuntime: java.lang.RuntimeException: Unable to instantiate application org.chromium.chrome.browser.base.SplitChromeApplication package org.bromite.bromite: java.lang.ClassNotFoundException: Didn't find class "org.chromium.chrome.browser.base.SplitChromeApplication" on path: DexPathList[[zip file "/data/app/~~uJWh7uaG5pqxgS8ixuB_rg==/org.bromite.bromite-VcbllUuw2fiZMsAWEakjfg==/base.apk"],nativeLibraryDirectories=[/data/app/~~uJWh7uaG5pqxgS8ixuB_rg==/org.bromite.bromite-VcbllUuw2fiZMsAWEakjfg==/lib/arm64, /data/app/~~uJWh7uaG5pqxgS8ixuB_rg==/org.bromite.bromite-VcbllUuw2fiZMsAWEakjfg==/base.apk!/lib/arm64-v8a, /system/lib64, /system_ext/lib64]]

[JingMatrix]

From the log we know that stubLoadedApk couldn't load class config.appComponentFactory, but only appLoadedApk could find it.
Hence, I tried to add classloader of cacheApkPath to the isolated proceess, as follows in the method createLoadedApkWithContext of org.lsposed.lspatch.loader.LSPApplication

if (isIsolated()) {
	XposedHelpers.setObjectField(appLoadedApk, "mClassLoader",
		new PathClassLoader(appInfo.sourceDir, appLoadedApk.getClassLoader()));
}

XposedHelpers.setObjectField(mBoundApplication, "info", appLoadedApk);

if (isIsolated()) {
	return null;
}

And, of course, remove the return logic at the beginning of the onLoad method.

But it still fails, and this time the classloader path becomes empty:

 DexPathList[[],nativeLibraryDirectories=[/system/lib64, /system_ext/lib64]]

I conjecture that isolated process has no access to cacheApkPath.

The problem remains to be solved, i.e., how to restore the original classLoader for an isolated process.

[JingMatrix]

From the source of chromium

 <service android:name="org.chromium.content.app.SandboxedProcessService{{ i }}"
          android:process=":sandboxed_process{{ i }}"
          android:permission="{{ manifest_package }}.permission.CHILD_SERVICE"
          android:isolatedProcess="true"  
          android:exported="{{sandboxed_service_exported|default(false)}}"
          {% if (i == 0) %}
          android:useAppZygote="true"
          {% endif %}
          {% if (sandboxed_service_exported|default(false)) == 'true' %}
          android:externalService="true"
          tools:ignore="ExportedService"
          android:visibleToInstantApps="true"
          {% endif %} />
      {% endfor %}

and the explanation of android:isolatedProcess

If set to true, this service will run under a special process that is isolated from the rest of the system and has no permissions of its own. The only communication with it is through the Service API (binding and starting).

there is no way to access to the extraced APK for an isolated process. I tried to extract it into appInfo.sourceDir, but still no access.

Therefore, the only hope is to change the patching mechanism so that config.appComponentFactory is visible to stubLoadedApk.
I mean, we cannot hook an isolated process and load the orginal APK for it.

It seems that isIsolated is still handled by handleBindApplication, one may temporarily revert the isolated state.

[JingMatrix]

A solution would be redesignig the LSPatch mechanism using APK bundles instead of including orginal APK (and module APKs) into assets.
It seems that there is not much docs on APK bundles for dynamically loading splits.
A mature example is the design of Chromium, see the AndroidManifest file.
In the compiled version, it becomes split="chrome" property of <manifest>.

We can load the orginal APK and various modules as splits as well, using methods such as getSplitClassLoader of LoadedAPK, createContextForSplit of ContextImpl.

This requires a new design of LSPatch, I think it will solve the problem here and remove the needs to do things like switchClassLoaders.

[Dr-TSNG]

The solution you mentioned is technically possible by putting the original apk's dexes to patched apk or split apk and disabling signature bypass on isolated process.
However, this still has some problems. Before LSPatch separated metaloader, we kept original apk's dexes in the patched apk and this led to some compatibility problems. The main question is we need original apk to be loaded in a clean classloader without any modification.
Using split apk might be a choice, but I'm not sure if it's hard to deal when the original apk itself is splitted.

[JingMatrix]

Here is what I learn today:

1. According to The Android App Bundle format, an app with multiple split APKs has aab file extension. So any APKs we have ever patched aren't splitted: this is true in practice, Chrome installed from Google Play has split APKs, but those installed from single APKs have only base.apk in their package paths.
2. Feature module manifest reference gives standards on the manifest file.
3. Some Chinese docs by Qigsaw.

One idea: we may first build the LSPacth as a bundled aab, decompile it and add the original APK (maybe modules as well) into it.

[JingMatrix]

I have done an experiment to test the possibility of changing a given apk to be a split one.
It succeeded, see the script:
https://github.com/JingMatrix/ChromeXt/blob/split/split-test

I think it is not hard for you devs to adapt this method into LSPatch.

[JingMatrix]

I have tested LSPatch using split APKs to solve this problem.
It works.

I will submit a pull-request soon after making my code consistent.