fix: our reaction to android security patch Oct 2025

Author: kyujin-cho

.idea/compiler.xml

@@ -0,0 +1,150 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+**Pixel IMS** is an Android application that enables VoLTE (Voice over LTE) functionality on Google Tensor-powered Pixel devices without requiring root access. The app leverages Android's internal `telephony.ICarrierConfigLoader.overrideConfig()` API through Shizuku to override carrier configurations and enable IMS features.
+
+**Primary carriers supported:**
+- LG U+ (Republic of Korea) - 1st tier support
+- Various international carriers - 2nd tier (community-reported)
+
+**Target devices:** Google Pixel 6/6a/6 Pro, 7/7a/7 Pro, 8/8 Pro, Pixel Fold (Tensor chipset)
+
+## Build & Development Commands
+
+### Prerequisites
+This project requires a **patched android.jar** to compile successfully:
+1. Download the [patched android.jar](https://github.com/Reginer/aosp-android-jar/raw/main/android-34/android.jar)
+2. Place it under `$ANDROID_SDK/platforms/android-34/`
+3. This enables access to hidden Android APIs at compile-time
+
+### Build Commands
+```bash
+# Build debug APK
+./gradlew assembleDebug
+
+# Build release APK
+./gradlew assembleRelease
+
+# Install debug build to connected device
+./gradlew installDebug
+
+# Run lint checks
+ktlint --reporter=checkstyle,output=build/ktlint-report.xml
+```
+
+### Testing
+Currently, this project does not have automated unit tests. Testing is performed manually by:
+- Installing the APK on a Tensor Pixel device
+- Verifying Shizuku permission grant
+- Toggling VoLTE settings
+- Checking IMS registration status
+
+## Architecture
+
+### Core Components
+
+**1. Moder Classes (`Moder.kt`)**
+- `Moder`: Base class providing access to hidden Android telephony services via Shizuku
+  - `carrierConfigLoader`: ICarrierConfigLoader interface for carrier config overrides
+  - `telephony`: ITelephony interface for telephony operations
+  - `phoneSubInfo`: IPhoneSubInfo for subscription info
+  - `sub`: ISub for subscription management
+
+- `CarrierModer`: Device-level operations
+  - Get active subscriptions
+  - Check device IMS support
+
+- `SubscriptionModer`: Per-SIM operations
+  - Override carrier configs (VoLTE, VoWiFi, VoNR, etc.)
+  - Query current config values
+  - Restart IMS registration
+
+**2. Shizuku Integration (`Utils.kt`)**
+- `checkShizukuPermission()`: Verifies Shizuku service is running and permission is granted
+- Shizuku provides ADB-level privileges without root to call hidden system APIs
+
+**3. UI Layer**
+- Built with **Jetpack Compose** and Material 3
+- `HomeActivity.kt`: Main entry point with bottom navigation
+- Navigation structure:
+  - `/home`: Overview page showing app status
+  - `/config{subscriptionId}`: Per-SIM configuration page
+  - `/config{subscriptionId}/dump`: Raw config dump viewer
+  - `/config{subscriptionId}/edit`: Expert mode editor
+
+**4. Hidden API Access**
+- Uses `HiddenApiBypass` library to bypass Android's hidden API restrictions
+- AIDL interfaces (`IPrivilegedService.aidl`) for Shizuku service binding
+
+### Key Configuration Keys
+The app primarily modifies these `CarrierConfigManager` keys:
+- `KEY_CARRIER_VOLTE_AVAILABLE_BOOL`: Enable VoLTE
+- `KEY_CARRIER_WFC_IMS_AVAILABLE_BOOL`: Enable VoWiFi
+- `KEY_CARRIER_VT_AVAILABLE_BOOL`: Enable Video Telephony
+- `KEY_VONR_ENABLED_BOOL`: Enable VoNR (5G voice)
+- `KEY_CARRIER_CROSS_SIM_IMS_AVAILABLE_BOOL`: Enable cross-SIM calling
+
+## Important Development Notes
+
+### Hidden API Bypass
+On app startup (`HomeActivity.onCreate`), the app adds hidden API exemptions:
+```kotlin
+HiddenApiBypass.addHiddenApiExemptions("L") // Classes starting with L
+HiddenApiBypass.addHiddenApiExemptions("I") // Interfaces starting with I
+```
+
+### Interface Caching
+The `Moder` class implements `loadCachedInterface()` to cache Binder interfaces and avoid repeated service lookups, improving performance.
+
+### Subscription Handling
+- The app dynamically generates navigation routes based on active SIM subscriptions
+- Each SIM gets its own config page with unique subscription ID
+- Uses `SubscriptionInfo.uniqueName` extension: `"${displayName} (SIM ${simSlotIndex + 1})"`
+
+### IMS Registration Check
+VoLTE status is verified via:
+1. `SubscriptionModer.isIMSRegistered`: Programmatic check using `ITelephony.isImsRegistered()`
+2. User can also check via dialer codes: `*#*#4636#*#*` → Phone information → IMS Service Status
+
+### Version Updates
+The app checks GitHub Releases API for updates:
+```kotlin
+getLatestAppVersion { latestVersion ->
+    // Compare with BuildConfig.VERSION_NAME
+}
+```
+
+## CI/CD
+
+### GitHub Actions Workflows
+- **default.yml**: Runs ktlint on PRs, builds debug APK, posts download link as PR comment
+- **build-apk.yml**: Reusable workflow for building APKs with signing
+- **build-aab.yml**: Builds Android App Bundle for Play Store releases
+- **build-debug-apk.yml**: Standalone debug build workflow
+
+### Linting
+The project uses **ktlint 0.48.2**. Lint violations will fail CI checks on PRs affecting `app/src/**`.
+
+## Distribution
+
+The app is distributed via:
+1. **Google Play Store**: `dev.bluehouse.enablevolte`
+2. **GitHub Releases**: Direct APK download
+
+## Troubleshooting Development Issues
+
+### Build Failures
+- **Missing hidden API classes**: Ensure patched `android.jar` is installed at `$ANDROID_SDK/platforms/android-34/`
+- **Shizuku not working**: Shizuku must be running via ADB or wireless debugging before launching the app
+
+### Common Runtime Issues
+- **Shizuku permission denied**: App will prompt for permission; grant "Allow all the time"
+- **IMS not registering**: After toggling VoLTE, restart device 2-3 times with 5-minute intervals
+- **Post-system update**: VoLTE configuration must be re-applied after Android system updates
+
+## Code Style
+
+Follow standard Kotlin conventions and ktlint rules. Use Jetpack Compose best practices for UI components.

.idea/gradle.xml

@@ -1,16 +1,17 @@
 plugins {
     id 'com.android.application'
     id 'org.jetbrains.kotlin.android'
+    id 'org.jetbrains.kotlin.plugin.compose'
 }
 
 android {
     namespace 'dev.bluehouse.enablevolte'
-    compileSdk 34
+    compileSdk 36
 
     defaultConfig {
         applicationId "dev.bluehouse.enablevolte"
         minSdk 29
-        targetSdk 34
+        targetSdk 36
         versionCode 13
         versionName "1.2.8"
 
@@ -49,17 +50,18 @@ android {
 }
 
 dependencies {
-    debugImplementation 'androidx.compose.ui:ui-tooling:1.6.1'
-    def compose_runtime_version = "1.4.0-beta01"
+    implementation 'androidx.test:monitor:1.8.0'
+    debugImplementation 'androidx.compose.ui:ui-tooling:1.9.3'
+    def compose_runtime_version = "1.9.3"
 
-    implementation 'androidx.core:core-ktx:1.12.0'
-    implementation 'androidx.appcompat:appcompat:1.6.1'
-    implementation 'com.google.android.material:material:1.11.0'
-    implementation 'androidx.constraintlayout:constraintlayout:2.1.4'
+    implementation 'androidx.core:core-ktx:1.17.0'
+    implementation 'androidx.appcompat:appcompat:1.7.1'
+    implementation 'com.google.android.material:material:1.13.0'
+    implementation 'androidx.constraintlayout:constraintlayout:2.2.1'
 
-    implementation 'androidx.activity:activity-compose:1.8.2'
+    implementation 'androidx.activity:activity-compose:1.11.0'
 
-    implementation "androidx.navigation:navigation-compose:2.7.7"
+    implementation "androidx.navigation:navigation-compose:2.9.5"
 
     implementation "androidx.compose.runtime:runtime:$compose_runtime_version"
     implementation "androidx.compose.runtime:runtime-livedata:$compose_runtime_version"
@@ -68,23 +70,24 @@ dependencies {
     implementation "androidx.compose.ui:ui:$compose_version"
     implementation "androidx.compose.ui:ui-tooling-preview:$compose_version"
 
-    implementation "androidx.compose.material:material:1.6.1"
-    implementation "androidx.compose.material3:material3:1.2.0"
+    implementation "androidx.compose.material:material:1.9.3"
+    implementation "androidx.compose.material:material-icons-core:1.7.8"
+    implementation "androidx.compose.material3:material3:1.4.0"
 
-    implementation "io.arrow-kt:arrow-core:1.2.0-RC"
-    implementation "io.arrow-kt:arrow-fx-coroutines:1.2.0-RC"
+    implementation "io.arrow-kt:arrow-core:2.1.2"
+    implementation "io.arrow-kt:arrow-fx-coroutines:2.1.2"
 
-    implementation "com.google.accompanist:accompanist-systemuicontroller:0.28.0"
+    implementation "com.google.accompanist:accompanist-systemuicontroller:0.36.0"
 
     def shizuku_version = "13.1.5"
     implementation "dev.rikka.shizuku:api:$shizuku_version"
     implementation "dev.rikka.shizuku:provider:$shizuku_version"
-    implementation 'com.anggrayudi:android-hidden-api:30.0'
+    implementation 'com.anggrayudi:android-hidden-api:35.0'
 
-    implementation 'org.lsposed.hiddenapibypass:hiddenapibypass:4.3'
+    implementation 'org.lsposed.hiddenapibypass:hiddenapibypass:6.1'
 
     implementation "com.github.kittinunf.fuel:fuel:2.3.1"
     implementation "com.github.kittinunf.fuel:fuel-android:2.3.1"
     implementation "com.github.kittinunf.fuel:fuel-json:2.3.1"
-    implementation 'net.swiftzer.semver:semver:1.1.2'
+    implementation 'net.swiftzer.semver:semver:2.1.0'
 }

.idea/misc.xml

@@ -1,8 +1,12 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
+    xmlns:tools="http://schemas.android.com/tools"
+    package="dev.bluehouse.enablevolte">
 
     <uses-permission android:name="android.permission.INTERNET" />
+    <instrumentation
+        android:name="dev.bluehouse.enablevolte.BrokerInstrumentation"
+        android:targetPackage="dev.bluehouse.enablevolte"/>
     <application
         android:allowBackup="true"
         android:dataExtractionRules="@xml/data_extraction_rules"
@@ -11,7 +15,7 @@
         android:label="@string/app_name"
         android:supportsRtl="true"
         android:theme="@style/Theme.EnableVoLTE"
-        tools:targetApi="34"
+        tools:targetApi="36"
         android:localeConfig="@xml/locales_config">
         <activity
             android:name=".HomeActivity"

CLAUDE.md

@@ -0,0 +1,71 @@
+package dev.bluehouse.enablevolte
+
+import android.annotation.SuppressLint
+import android.app.IActivityManager
+import android.app.Instrumentation
+import android.content.Context
+import android.os.Bundle
+import android.system.Os
+import android.telephony.CarrierConfigManager
+import android.util.Log
+import rikka.shizuku.ShizukuBinderWrapper
+import rikka.shizuku.SystemServiceHelper
+
+const val TAG = "BrokerInstrumentation"
+
+class BrokerInstrumentation : Instrumentation() {
+    @SuppressLint("MissingPermission")
+    private fun applyConfig(
+        subId: Int,
+        arguments: Bundle,
+    ) {
+        Log.i(TAG, "applyConfig")
+        val am = IActivityManager.Stub.asInterface(ShizukuBinderWrapper(SystemServiceHelper.getSystemService(Context.ACTIVITY_SERVICE)))
+        am.startDelegateShellPermissionIdentity(Os.getuid(), null)
+        try {
+            val configurationManager = this.context.getSystemService(CarrierConfigManager::class.java)
+            val overrideValues = toPersistableBundle(arguments)
+
+            configurationManager.overrideConfig(subId, overrideValues, true)
+        } finally {
+            Log.i(TAG, "applyConfig done")
+            am.stopDelegateShellPermissionIdentity()
+        }
+    }
+
+    @SuppressLint("MissingPermission")
+    private fun clearConfig(subId: Int) {
+        Log.i(TAG, "clearConfig")
+        val am = IActivityManager.Stub.asInterface(ShizukuBinderWrapper(SystemServiceHelper.getSystemService(Context.ACTIVITY_SERVICE)))
+        am.startDelegateShellPermissionIdentity(Os.getuid(), null)
+        try {
+            val configurationManager = this.context.getSystemService(CarrierConfigManager::class.java)
+
+            configurationManager.overrideConfig(subId, null, true)
+        } finally {
+            Log.i(TAG, "clearConfig done")
+            am.stopDelegateShellPermissionIdentity()
+        }
+    }
+
+    override fun onCreate(arguments: Bundle?) {
+        super.onCreate(arguments)
+
+        if (arguments == null) {
+            return
+        }
+
+        val clear = arguments.getBoolean("moder_clear")
+        val subId = arguments.getInt("moder_subId")
+
+        try {
+            if (clear) {
+                this.clearConfig(subId)
+            } else {
+                this.applyConfig(subId, arguments)
+            }
+        } finally {
+            finish(0, Bundle())
+        }
+    }
+}