[Temporarily Resolved] A11 GSI App crashes immediately on open with 'shell keeps stopping' – fail

[Milor123]

Steps to reproduce:

1. Install Vector (either stable v2.2 or pre-release 3105-5e4dcb) on a GSI ROM (Android 11, PHH‑Treble).
2. Ensure Magisk Zygisk is enabled (with NeoZygisk) (or disable while tring with Zygisk Next / ).
3. Open the Vector app from the notification and then try open it from magisk
4. Immediately see the toast "shell keeps stopping" and the app crashes / becomes unresponsive.

Expected behaviour:
Vector opens normally without crashes.

Actual behaviour:
App crashes with "shell keeps stopping" on all tested configurations.

---

Xposed Module List:
No Xposed modules are installed (the file /data/adb/lspd/config/modules.list does not exist). I completely uninstalled Vector and reinstalled it to ensure no leftover modules affect the behaviour.

Root implementation: Magisk v30.6 And upgrade to Magisk v30.7 for try solved the problem
I have also tested:

• Zygisk Next (with Magisk Zygisk OFF) → same crash.
• NeoZygisk (with Magisk Zygisk ON) → same crash.
• clearing data for com.android.shell

System Module List:

hosts
sepolicy.rule
zn_magisk_compat
zygisk_vector
zygisksu

(Note: zygisk_vector is the Vector module itself; no other LSPosed modules are present.)

Vector version:

• Stable: v2.2
• Pre‑release: 3105-5e4dcb (latest debug build from GitHub Actions)
  (Both exhibit the same crash.)

Android version: 11 (SDK 30) – ROM GSI PHH (userdebug/test-keys) – Model: BACH2-W19

Version requirement:

• I am using the latest debug build from GitHub pre-releases (I tested the pre‑release 3105-5e4dcb).
• I also tested the stable v2.2, and the problem persists.

Logs:
lsposed_verbose.log
log_completo.txt

Additional context:

• The device runs a PHH‑Treble GSI (Generic System Image) with userdebug/test-keys.
• The crash occurs even with no Xposed modules active.
• Changing the Zygisk implementation (stock, Zygisk Next, NeoZygisk) does not resolve the issue.
• The crash seems related to the interaction between Vector, Zygisk, and the GSI environment.

Additional note

My device is quite old and barely supports A11 because it is a Huawei with almost everything locked. I am using a GSI port that a developer maintained until the end of 2025. They usually have some complications, and I understand that my errors may stem more from my ROM than from your code, but I would greatly appreciate it if you could help me solve it based on your expertise.
Thank you very much!

One mention that I think is worth making is that I updated to a 2025 ROM (only the system partition). Previously, I had one from 2022 (where LSPosed and even Vector 2.2 worked), but on the new one, it stopped working even though I deleted everything I could and reinstalled it. (rm /data/adb/lspd)

[Milor123]

[Temporarily Resolved]: I've found a temporal solution by the AI, check the next AI commentaries

---

Vector v2.2 fix — parasitic mode crash on GSI A11 enforcing after dirty flash

Environment: Huawei BAH2-W19 (hi6250) — GSI LeaOS treble_arm64_bvZ Android 11 RQ3A.211001.001, system.img 2025-03-05 (unknown/unknown/unknown:11/RP1A.200720.011/phh:userdebug/test-keys), kernel Enforcing (never permissive), Magisk 30.7:R + Zygisk Next 1.5.0, Vector v2.2 (3107-5e4dcb92-JingMatrix-Vector).

Symptom

After flashing a new system.img keeping /data (dirty flash, only wipe cache), the Vector action/notification stopped working:

• Tapping the Vector notification (or running the Magisk action) launched:
  am start -c org.matrix.vector.manager.LAUNCH_MANAGER com.android.shell/.BugreportWarningActivity (action.sh)

• The activity crashed immediately with “shell has stopped” / BugreportWarningActivity onCreate:54 hasExtra on null:

  java.lang.RuntimeException: Unable to start activity {com.android.shell/.BugreportWarningActivity}
  Caused by: java.lang.NullPointerException: Intent.hasExtra(String) on a null Intent
    at com.android.shell.BugreportWarningActivity.onCreate(BugreportWarningActivity.java:54)
  

• Logcat repeatedly showed parasitic injection failed at JgVvyHILDIXFGmDs.Pta.x.Main.forkCommon:63 (NPE getClass() on null).

• The same system.img on two other A11 GSI phones (also enforcing) works fine.

Context from my side: I did a dirty flash — flashed the new system.img via fastboot and kept /data, only wiped cache. That likely left stale state that the new GSI did not expect.

Root cause

Two issues combined, both exposed by the dirty flash + the stricter sepolicy of the new GSI:

1) Sepolicy denied shell → manager.apk (the crash)

Vector v2.2 runs in parasitic mode — it has no launcher app, it hosts its manager inside com.android.shell (UID 2000). Every launch therefore needs shell to read /data/adb/modules/zygisk_vector/manager.apk.

logcat and dmesg showed the denial on every attempt (enforcing, never permissive here):

avc: denied { read } for path="/data/adb/modules/zygisk_vector/manager.apk"
  scontext=u:r:shell:s0 tcontext=u:object_r:adb_data_file:s0 tclass=file permissive=0
  comm="Binder:XXXX_X" dev="mmcblk0p59"

The shipped zygisk_vector/sepolicy.rule only allowed dex2oat/xposed_file/xposed_data — it had no allow shell adb_data_file file { read ... }. The old 2022 GSI was more permissive; the 2025-03-05 GSI enforces it, so the parasitic fork gets a null object and the hooked Intent is lost (forkCommon:63 NPE), which surfaces as hasExtra on null in BugreportWarningActivity.

2) Stale Vector config left the framework disabled

/data/adb/lspd/config/modules_config.db survived the dirty flash:

SELECT mid, module_pkg_name, enabled FROM modules;
-- 1|lspd|/data/adb/modules/zygisk_vector/manager.apk|0
SELECT count(*) FROM scope; -- 0

enabled=0 (and empty scope) made vectord (running as system) report the framework as inactive even though the daemon and Zygisk Next were loaded (zn-daemon, vectord, VectorZygiskBridge GET_BINDER all present).

Fix (enforcing, no new module needed — patched zygisk_vector in place)

All done via ADB, staying in Enforcing:

1) Persistent sepolicy fix — appended to /data/adb/modules/zygisk_vector/sepolicy.rule (backed up as sepolicy.rule.bak.20260828):

# Vector parasitic fix GSI 2025-03-05 enforcing - manager.apk read
allow shell adb_data_file file { read open getattr map }
allow untrusted_app adb_data_file file { read open getattr map }
allow priv_app adb_data_file file { read open getattr map }
allow system_server adb_data_file file { read open getattr map }
allow shell adb_data_file dir { search open read getattr }
allow untrusted_app adb_data_file dir { search open read getattr }
allow priv_app adb_data_file dir { search open read getattr }
allow system_server adb_data_file dir { search open read getattr }

Applied live for the current boot as well:

magiskpolicy --live "allow shell adb_data_file file { read open getattr map }"
magiskpolicy --live "allow untrusted_app adb_data_file file { read open getattr map }"
magiskpolicy --live "allow priv_app adb_data_file file { read open getattr map }"
magiskpolicy --live "allow shell adb_data_file dir { search open read getattr }"
magiskpolicy --live "allow untrusted_app adb_data_file dir { search open read getattr }"

The file-level read is what fixes the crash; the dir search covers the system_file-labeled /data/adb/modules directory on this GSI (otherwise a dir search denial remains after reboot).

2) Re-enabled the framework DB:

sqlite3 /data/adb/lspd/config/modules_config.db "UPDATE modules SET enabled=1 WHERE module_pkg_name='lspd';"

3) Reboot — Magisk reloads sepolicy.rule at post-fs-data. Verified after reboot:

• getenforce → Enforcing
• vectord + zn-daemon running, VectorZygiskBridge GET_BINDER present
• am start -c org.matrix.vector.manager.LAUNCH_MANAGER com.android.shell/.BugreportWarningActivity no longer crashes; dumpsys window shows com.android.shell/org.matrix.vector.manager.ui.MainActivity in foreground
• avc: denied ... manager.apk no longer recurs (except the single early post-fs-data load which is expected)

No kernel set to permissive, no migration away from Vector.

Notes for the maintainer

• The dirty flash is likely what left modules_config.db with enabled=0; a clean flash of the same system.img on two other identical devices did not reproduce the DB issue. Might be worth handling enabled re-validation on daemon startup after a system fingerprint change.
• Adding the allow { shell untrusted_app priv_app system_server } adb_data_file { file read/open/getattr/map; dir search/open/read/getattr } rules to the shipped zygisk_vector/sepolicy.rule would make parasitic mode work out of the box on newer GSI sepolicies in enforcing.

Thanks for Vector — happy to provide fresh logcat/dmesg if needed.

Module of magisk with the local Fix for me.

vector_enforcing_fix_v1.0.zip