PixelIMS crashing on latest android pixel 8a

[qobrosi-design]

Once i open Pixel IMS it closes immediately

[WhoIsDevelop]

Latest graphene os. Pixel 9 pro xl. Its crashing after tap on any toggle.

[WhoIsDevelop]

type: crash
osVersion: google/komodo/komodo:16/BP2A.250805.005/2025092701:user/release-keys
flags: dev options enabled
package: dev.bluehouse.enablevolte:13, targetSdk 33
process: dev.bluehouse.enablevolte
processUptime: 2485 + 307 ms
installer: com.android.packageinstaller

java.lang.SecurityException: overrideConfig cannot be invoked by shell
	at android.os.Parcel.createExceptionOrNull(Parcel.java:3348)
	at android.os.Parcel.createException(Parcel.java:3332)
	at android.os.Parcel.readException(Parcel.java:3308)
	at android.os.Parcel.readException(Parcel.java:3250)
	at com.android.internal.telephony.ICarrierConfigLoader$Stub$Proxy.overrideConfig(ICarrierConfigLoader.java:295)
	at dev.bluehouse.enablevolte.SubscriptionModer.publishBundle(Moder.kt:121)
	at dev.bluehouse.enablevolte.SubscriptionModer.updateCarrierConfig(Moder.kt:125)
	at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:148)
	at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:143)
	at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:124)
	at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:118)
	at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke-k-4lQ0M(Clickable.kt:167)
	at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke(Clickable.kt:156)
	at androidx.compose.foundation.gestures.TapGestureDetectorKt$detectTapAndPress$2$1.invokeSuspend(TapGestureDetector.kt:255)
	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
	at kotlinx.coroutines.DispatchedTaskKt.resume(DispatchedTask.kt:178)
	at kotlinx.coroutines.DispatchedTaskKt.dispatch(DispatchedTask.kt:166)
	at kotlinx.coroutines.CancellableContinuationImpl.dispatchResume(CancellableContinuationImpl.kt:397)
	at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl(CancellableContinuationImpl.kt:431)
	at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl$default(CancellableContinuationImpl.kt:420)
	at kotlinx.coroutines.CancellableContinuationImpl.resumeWith(CancellableContinuationImpl.kt:328)
	at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter$PointerEventHandlerCoroutine.offerPointerEvent(SuspendingPointerInputFilter.kt:566)
	at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.dispatchPointerEvent(SuspendingPointerInputFilter.kt:456)
	at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.onPointerEvent-H0pRuoY(SuspendingPointerInputFilter.kt:469)
	at androidx.compose.ui.node.BackwardsCompatNode.onPointerEvent-H0pRuoY(BackwardsCompatNode.kt:374)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:314)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
	at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
	at androidx.compose.ui.input.pointer.NodeParent.dispatchMainEventPass(HitPathTracker.kt:183)
	at androidx.compose.ui.input.pointer.HitPathTracker.dispatchChanges(HitPathTracker.kt:102)
	at androidx.compose.ui.input.pointer.PointerInputEventProcessor.process-BIzXfog(PointerInputEventProcessor.kt:98)
	at androidx.compose.ui.platform.AndroidComposeView.sendMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1334)
	at androidx.compose.ui.platform.AndroidComposeView.handleMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1280)
	at androidx.compose.ui.platform.AndroidComposeView.dispatchTouchEvent(AndroidComposeView.android.kt:1219)
	at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
	at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
	at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
	at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
	at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
	at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
	at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
	at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
	at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:475)
	at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:2025)
	at android.app.Activity.dispatchTouchEvent(Activity.java:4612)
	at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:433)
	at android.view.View.dispatchPointerEvent(View.java:16938)
	at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:8228)
	at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:7987)
	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7369)
	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7426)
	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7392)
	at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:7558)
	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7400)
	at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:7615)
	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7373)
	at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7426)
	at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7392)
	at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7400)
	at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7373)
	at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:10533)
	at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:10484)
	at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:10452)
	at android.view.ViewRootImpl.processRawInputEvent(ViewRootImpl.java:10897)
	at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:10655)
	at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:300)
	at android.os.MessageQueue.nativePollOnce(Native Method)
	at android.os.MessageQueue.nextLegacy(MessageQueue.java:913)
	at android.os.MessageQueue.next(MessageQueue.java:1025)
	at android.os.Looper.loopOnce(Looper.java:196)
	at android.os.Looper.loop(Looper.java:338)
	at android.app.ActivityThread.main(ActivityThread.java:9106)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:593)
	at com.android.internal.os.ExecInit.main(ExecInit.java:50)
	at com.android.internal.os.RuntimeInit.nativeFinishInit(Native Method)
	at com.android.internal.os.RuntimeInit.main(RuntimeInit.java:371)
	Suppressed: kotlinx.coroutines.DiagnosticCoroutineContextException: [androidx.compose.ui.platform.MotionDurationScaleImpl@1b19f8d, androidx.compose.runtime.BroadcastFrameClock@b4c1542, StandaloneCoroutine{Cancelling}@eb5953, AndroidUiDispatcher@29e8290]

[scottzzhu]

Also encountering similar issues on Vanilla Pixel 10 Pro.
java.lang.SecurityException: overrideConfig cannot be invoked by shell at android.os.Parcel.createExceptionOrNull(Parcel.java:3355) at android.os.Parcel.createException(Parcel.java:3339) at android.os.Parcel.readException(Parcel.java:3322) at android.os.Parcel.readException(Parcel.java:3264) at com.android.internal.telephony.ICarrierConfigLoader$Stub$Proxy.overrideConfig(ICarrierConfigLoader.java:295) at dev.bluehouse.enablevolte.SubscriptionModer.publishBundle(Moder.kt:121) at dev.bluehouse.enablevolte.SubscriptionModer.updateCarrierConfig(Moder.kt:125) at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:148) at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:143) at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:124) at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:118) at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke-k-4lQ0M(Clickable.kt:167) at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke(Clickable.kt:156) at androidx.compose.foundation.gestures.TapGestureDetectorKt$detectTapAndPress$2$1.invokeSuspend(TapGestureDetector.kt:255) at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) at kotlinx.coroutines.DispatchedTaskKt.resume(DispatchedTask.kt:178) at kotlinx.coroutines.DispatchedTaskKt.dispatch(DispatchedTask.kt:166) at kotlinx.coroutines.CancellableContinuationImpl.dispatchResume(CancellableContinuationImpl.kt:397) at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl(CancellableContinuationImpl.kt:431) at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl$default(CancellableContinuationImpl.kt:420) at kotlinx.coroutines.CancellableContinuationImpl.resumeWith(CancellableContinuationImpl.kt:328) at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter$PointerEventHandlerCoroutine.offerPointerEvent(SuspendingPointerInputFilter.kt:566) at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.dispatchPointerEvent(SuspendingPointerInputFilter.kt:456) at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.onPointerEvent-H0pRuoY(SuspendingPointerInputFilter.kt:469) at androidx.compose.ui.node.BackwardsCompatNode.onPointerEvent-H0pRuoY(BackwardsCompatNode.kt:374) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:314) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.NodeParent.dispatchMainEventPass(HitPathTracker.kt:183) at androidx.compose.ui.input.pointer.HitPathTracker.dispatchChanges(HitPathTracker.kt:102) at androidx.compose.ui.input.pointer.PointerInputEventProcessor.process-BIzXfog(PointerInputEventProcessor.kt:98) at androidx.compose.ui.platform.AndroidComposeView.sendMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1334) at androidx.compose.ui.platform.AndroidComposeView.handleMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1280) at androidx.compose.ui.platform.AndroidComposeView.dispatchTouchEvent(AndroidComposeView.android.kt:1219) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3148) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2831) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3148) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2831) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3148) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2831) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3148) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2831) at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:510) at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:2019) at android.app.Activity.dispatchTouchEvent(Activity.java:4623) at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:445) at android.view.View.dispatchPointerEvent(View.java:17128) at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:8247) at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:8001) at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7382) at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7439) at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7405) at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:7571) at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7413) at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:7628) at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7386) at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7439) at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7405) at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7413) at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7386) at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:10549) at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:10500) at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:10468) at android.view.ViewRootImpl.processRawInputEvent(ViewRootImpl.java:10914) at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:10671) at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:303) at android.os.MessageQueue.nativePollOnce(Native Method) at android.os.MessageQueue.nextLegacy(MessageQueue.java:1003) at android.os.MessageQueue.next(MessageQueue.java:1112) at android.os.Looper.loopOnce(Looper.java:197) at android.os.Looper.loop(Looper.java:349) at android.app.ActivityThread.main(ActivityThread.java:9041) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:593) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:929) Suppressed: kotlinx.coroutines.DiagnosticCoroutineContextException: [androidx.compose.ui.platform.MotionDurationScaleImpl@fcdbebc, androidx.compose.runtime.BroadcastFrameClock@c1fae45, StandaloneCoroutine{Cancelling}@ef4699a, AndroidUiDispatcher@d5a12cb]

[kyujin-cho]

I'll take a look about it.

[qobrosi-design]

Thank you so much Application opens normally any option I choose it closed immediately this happened after latest Android updates I believe

…

On Fri, Oct 3, 2025, 3:56 PM Kyujin Cho ***@***.***> wrote: *kyujin-cho* left a comment (kyujin-cho/pixel-volte-patch#382) <#382 (comment)> I'll take a look about it. — Reply to this email directly, view it on GitHub <#382 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYAZCWNYC4LORSYRTE5ITCT3VZXARAVCNFSM6AAAAACHXJK2NKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRVGU4TCMRSHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[kyujin-cho]

So, all good things come to an end... And I think this project is no exception for the almighty rule. As the error message clearly states, recent Android security finally found a way to patch the stupid rabbit hole I've found, by limiting write access to carrier config on behalf of ADB shell. I will keep dig into other possibilities but the situation does not look good.

[qobrosi-design]

I thought the same as it sounds whenever we try to write app crashes.

…

On Fri, Oct 3, 2025, 7:31 PM Kyujin Cho ***@***.***> wrote: *kyujin-cho* left a comment (kyujin-cho/pixel-volte-patch#382) <#382 (comment)> So, all good things come to an end... And I think this project is no exception for the almighty rule. As the error message clearly states, recent Android security finally found a way to patch the stupid rabbit hole I've found, by limiting write access to carrier config on behalf of ADB shell. I will keep dig into other possibilities but this does not look good. — Reply to this email directly, view it on GitHub <#382 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYAZCWMHX5OQX7ANH4KCMDL3V2QFHAVCNFSM6AAAAACHXJK2NKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRWGM3TGNZSGI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[nokia735402]

Same on my pixel 8 pro.Latest graphene os.

type: crash
osVersion: google/husky/husky:16/BP2A.250805.005/2025100300:user/release-keys
flags: dev options enabled
package: dev.bluehouse.enablevolte:13, targetSdk 33
process: dev.bluehouse.enablevolte
processUptime: 1849 + 61 ms
installer: com.android.packageinstaller

java.lang.NoSuchMethodError: No interface method overrideConfig(ILandroid/os/PersistableBundle;Z)V in class Lcom/android/internal/telephony/ICarrierConfigLoader; or its super classes (declaration of 'com.android.internal.telephony.ICarrierConfigLoader' appears in /system/framework/framework.jar!classes5.dex)
at dev.bluehouse.enablevolte.SubscriptionModer.publishBundle(Moder.kt:121)
at dev.bluehouse.enablevolte.SubscriptionModer.updateCarrierConfig(Moder.kt:125)
at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:148)
at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:143)
at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:124)
at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:118)
at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke-k-4lQ0M(Clickable.kt:167)
at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke(Clickable.kt:156)
at androidx.compose.foundation.gestures.TapGestureDetectorKt$detectTapAndPress$2$1.invokeSuspend(TapGestureDetector.kt:255)
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
at kotlinx.coroutines.DispatchedTaskKt.resume(DispatchedTask.kt:178)
at kotlinx.coroutines.DispatchedTaskKt.dispatch(DispatchedTask.kt:166)
at kotlinx.coroutines.CancellableContinuationImpl.dispatchResume(CancellableContinuationImpl.kt:397)
at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl(CancellableContinuationImpl.kt:431)
at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl$default(CancellableContinuationImpl.kt:420)
at kotlinx.coroutines.CancellableContinuationImpl.resumeWith(CancellableContinuationImpl.kt:328)
at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter$PointerEventHandlerCoroutine.offerPointerEvent(SuspendingPointerInputFilter.kt:566)
at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.dispatchPointerEvent(SuspendingPointerInputFilter.kt:456)
at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.onPointerEvent-H0pRuoY(SuspendingPointerInputFilter.kt:469)
at androidx.compose.ui.node.BackwardsCompatNode.onPointerEvent-H0pRuoY(BackwardsCompatNode.kt:374)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:314)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301)
at androidx.compose.ui.input.pointer.NodeParent.dispatchMainEventPass(HitPathTracker.kt:183)
at androidx.compose.ui.input.pointer.HitPathTracker.dispatchChanges(HitPathTracker.kt:102)
at androidx.compose.ui.input.pointer.PointerInputEventProcessor.process-BIzXfog(PointerInputEventProcessor.kt:98)
at androidx.compose.ui.platform.AndroidComposeView.sendMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1334)
at androidx.compose.ui.platform.AndroidComposeView.handleMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1280)
at androidx.compose.ui.platform.AndroidComposeView.dispatchTouchEvent(AndroidComposeView.android.kt:1219)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829)
at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:475)
at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:2025)
at android.app.Activity.dispatchTouchEvent(Activity.java:4612)
at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:433)
at android.view.View.dispatchPointerEvent(View.java:16938)
at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:8228)
at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:7987)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7369)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7426)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7392)
at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:7558)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7400)
at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:7615)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7373)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7426)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7392)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7400)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7373)
at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:10533)
at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:10484)
at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:10452)
at android.view.ViewRootImpl.processRawInputEvent(ViewRootImpl.java:10897)
at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:10655)
at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:300)
at android.os.MessageQueue.nativePollOnce(Native Method)
at android.os.MessageQueue.nextLegacy(MessageQueue.java:913)
at android.os.MessageQueue.next(MessageQueue.java:1025)
at android.os.Looper.loopOnce(Looper.java:196)
at android.os.Looper.loop(Looper.java:338)
at android.app.ActivityThread.main(ActivityThread.java:9106)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:593)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:948)
Suppressed: kotlinx.coroutines.DiagnosticCoroutineContextException: [androidx.compose.ui.platform.MotionDurationScaleImpl@c12cff, androidx.compose.runtime.BroadcastFrameClock@a300acc, StandaloneCoroutine{Cancelling}@f86f115, AndroidUiDispatcher@5273c2a]

[vvb2060]

Can someone upload /system/framework/services.jar and /system/framework/framework.jar ?
If Google uses Binder.getCallingUid() == 2000, we can bypass it.

    public static void overrideConfig(int subscriptionId) throws Exception {
        var instrumentation = InstrumentationRegistry.getInstrumentation();
        var ui = instrumentation.getUiAutomation();
        try {
            ui.adoptShellPermissionIdentity();

            var configurationManager = instrumentation.getContext().getSystemService(CarrierConfigManager.class);

            var bundle = new PersistableBundle();
            bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_VOLTE_AVAILABLE_BOOL, true);
            bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_WFC_IMS_AVAILABLE_BOOL, true);
            bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_SUPPORTS_SS_OVER_UT_BOOL, true);
            bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_VT_AVAILABLE_BOOL, true);
            bundle.putBoolean(CarrierConfigManager.KEY_VONR_ENABLED_BOOL, true);
            bundle.putBoolean(CarrierConfigManager.KEY_VONR_SETTING_VISIBILITY_BOOL, true);

            configurationManager.overrideConfig(subscriptionId, bundle, true);
        } finally {
            ui.dropShellPermissionIdentity();
        }
    }

    // am.startInstrumentation(ComponentName, null, flags, args, null, new UiAutomationConnection(), 0, null)
    // Now ComponentName have shell permissions, but uid is not 2000. 
    // More info: https://developer.android.com/reference/android/app/UiAutomation#adoptShellPermissionIdentity()

[Fei1Yang]

Same on my pixel 8 pro.Latest graphene os.

type: crash osVersion: google/husky/husky:16/BP2A.250805.005/2025100300:user/release-keys flags: dev options enabled package: dev.bluehouse.enablevolte:13, targetSdk 33 process: dev.bluehouse.enablevolte processUptime: 1849 + 61 ms installer: com.android.packageinstaller

java.lang.NoSuchMethodError: No interface method overrideConfig(ILandroid/os/PersistableBundle;Z)V in class Lcom/android/internal/telephony/ICarrierConfigLoader; or its super classes (declaration of 'com.android.internal.telephony.ICarrierConfigLoader' appears in /system/framework/framework.jar!classes5.dex) at dev.bluehouse.enablevolte.SubscriptionModer.publishBundle(Moder.kt:121) at dev.bluehouse.enablevolte.SubscriptionModer.updateCarrierConfig(Moder.kt:125) at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:148) at dev.bluehouse.enablevolte.pages.ConfigKt$Config$2$1$1.invoke(Config.kt:143) at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:124) at androidx.compose.foundation.selection.ToggleableKt$toggleable$4$1.invoke(Toggleable.kt:118) at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke-k-4lQ0M(Clickable.kt:167) at androidx.compose.foundation.ClickableKt$clickable$4$gesture$1$1$2.invoke(Clickable.kt:156) at androidx.compose.foundation.gestures.TapGestureDetectorKt$detectTapAndPress$2$1.invokeSuspend(TapGestureDetector.kt:255) at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) at kotlinx.coroutines.DispatchedTaskKt.resume(DispatchedTask.kt:178) at kotlinx.coroutines.DispatchedTaskKt.dispatch(DispatchedTask.kt:166) at kotlinx.coroutines.CancellableContinuationImpl.dispatchResume(CancellableContinuationImpl.kt:397) at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl(CancellableContinuationImpl.kt:431) at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl$default(CancellableContinuationImpl.kt:420) at kotlinx.coroutines.CancellableContinuationImpl.resumeWith(CancellableContinuationImpl.kt:328) at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter$PointerEventHandlerCoroutine.offerPointerEvent(SuspendingPointerInputFilter.kt:566) at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.dispatchPointerEvent(SuspendingPointerInputFilter.kt:456) at androidx.compose.ui.input.pointer.SuspendingPointerInputFilter.onPointerEvent-H0pRuoY(SuspendingPointerInputFilter.kt:469) at androidx.compose.ui.node.BackwardsCompatNode.onPointerEvent-H0pRuoY(BackwardsCompatNode.kt:374) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:314) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:301) at androidx.compose.ui.input.pointer.NodeParent.dispatchMainEventPass(HitPathTracker.kt:183) at androidx.compose.ui.input.pointer.HitPathTracker.dispatchChanges(HitPathTracker.kt:102) at androidx.compose.ui.input.pointer.PointerInputEventProcessor.process-BIzXfog(PointerInputEventProcessor.kt:98) at androidx.compose.ui.platform.AndroidComposeView.sendMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1334) at androidx.compose.ui.platform.AndroidComposeView.handleMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1280) at androidx.compose.ui.platform.AndroidComposeView.dispatchTouchEvent(AndroidComposeView.android.kt:1219) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829) at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3146) at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2829) at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:475) at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:2025) at android.app.Activity.dispatchTouchEvent(Activity.java:4612) at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:433) at android.view.View.dispatchPointerEvent(View.java:16938) at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:8228) at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:7987) at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7369) at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7426) at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7392) at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:7558) at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7400) at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:7615) at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7373) at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:7426) at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:7392) at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:7400) at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:7373) at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:10533) at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:10484) at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:10452) at android.view.ViewRootImpl.processRawInputEvent(ViewRootImpl.java:10897) at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:10655) at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:300) at android.os.MessageQueue.nativePollOnce(Native Method) at android.os.MessageQueue.nextLegacy(MessageQueue.java:913) at android.os.MessageQueue.next(MessageQueue.java:1025) at android.os.Looper.loopOnce(Looper.java:196) at android.os.Looper.loop(Looper.java:338) at android.app.ActivityThread.main(ActivityThread.java:9106) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:593) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:948) Suppressed: kotlinx.coroutines.DiagnosticCoroutineContextException: [androidx.compose.ui.platform.MotionDurationScaleImpl@c12cff, androidx.compose.runtime.BroadcastFrameClock@a300acc, StandaloneCoroutine{Cancelling}@f86f115, AndroidUiDispatcher@5273c2a]

GrapheneOS added a limited carrier config overriding feature in 20251003, function signature of overrideConfig is modified to support such feature, it's unrelated to this issue.

[Fei1Yang]

Can someone upload /system/framework/services.jar and /system/framework/framework.jar ? If Google uses Binder.getCallingUid() == 2000, we can bypass it.

public static void overrideConfig(int subscriptionId) throws Exception {
    var instrumentation = InstrumentationRegistry.getInstrumentation();
    var ui = instrumentation.getUiAutomation();
    try {
        ui.adoptShellPermissionIdentity();

        var configurationManager = instrumentation.getContext().getSystemService(CarrierConfigManager.class);

        var bundle = new PersistableBundle();
        bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_VOLTE_AVAILABLE_BOOL, true);
        bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_WFC_IMS_AVAILABLE_BOOL, true);
        bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_SUPPORTS_SS_OVER_UT_BOOL, true);
        bundle.putBoolean(CarrierConfigManager.KEY_CARRIER_VT_AVAILABLE_BOOL, true);
        bundle.putBoolean(CarrierConfigManager.KEY_VONR_ENABLED_BOOL, true);
        bundle.putBoolean(CarrierConfigManager.KEY_VONR_SETTING_VISIBILITY_BOOL, true);

        configurationManager.overrideConfig(subscriptionId, bundle, true);
    } finally {
        ui.dropShellPermissionIdentity();
    }
}

// am.startInstrumentation(ComponentName, null, flags, args, null, new UiAutomationConnection(), 0, null)
// Now ComponentName have shell permissions, but uid is not 2000. 
// More info: https://developer.android.com/reference/android/app/UiAutomation#adoptShellPermissionIdentity()

GitHub seems to have some issues uploading jar/zip files, I have uploaded these files from GrapheneOS 2025100301 to https://gofile.io/d/zGMHwD as a workaround.

[vvb2060]

Sorry, I made a mistake. service code is in com.android.phone app, upload /system/priv-app/TeleService/TeleService.apk

[Fei1Yang]

The actual code for checking permission is in TeleService.apk (https://gofile.io/d/Twzfk8), not these jar files, it looks like it's just using a more packaged version of Binder.getCallingUid() == 2000:

CarrierConfigLoader

    @Override // com.android.internal.telephony.ICarrierConfigLoader
    public void overrideConfig(final int i, final PersistableBundle persistableBundle, final int i2) throws SecurityException {
        overrideConfig_enforcePermission();
        if (TelephonyPermissions.isShell(ICarrierConfigLoader.Stub.getCallingUid())) {
            throw new SecurityException("overrideConfig cannot be invoked by shell");
        }
        final int phoneId = SubscriptionManager.getPhoneId(i);
        if (SubscriptionManager.isValidPhoneId(phoneId)) {
            if (i2 != 0 && i2 != 1 && i2 != 2) {
                throw new IllegalArgumentException("invalid override type: " + i2);
            }
            enforceTelephonyFeatureWithException(getCurrentPackageName(), "overrideConfig");
            this.mHandler.post(new Runnable() { // from class: com.android.phone.CarrierConfigLoader$$ExternalSyntheticLambda0
                @Override // java.lang.Runnable
                public final void run() throws IOException {
                    this.f$0.lambda$overrideConfig$1(phoneId, i2, persistableBundle, i);
                }
            });
            return;
        }
        logd("Ignore invalid phoneId: " + phoneId + " for subId: " + i);

TelephonyPermissions

    public static boolean isShell(int uid) {
        return UserHandle.isSameApp(uid, 2000);
    }

UserHandle

    public static boolean isSameApp(int uid1, int uid2) {
        return getAppId(uid1) == getAppId(uid2);
    }
    ...
    @SystemApi
    public static int getAppId(int uid) {
        return uid % 100000;
    }

[vvb2060]

Great, we can bypass this check!