update compile sdk to 36

Or surfaceflinger will silently reject screen capture after checking uid.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -9,7 +9,7 @@ body:
   - type: input
     attributes:
       label: LSPosed version
-      description:  Don't use 'latest'. Specify actual version with 4 digits.
+      description:  Only official LSPosed is supported. Don't use 'latest'. Specify actual version with 4 digits.
     validations:
       required: true
   - type: input
@@ -29,6 +29,20 @@ body:
       options:
         - label: I am using latest debug CI version
           required: true
+  - type: checkboxes
+    id: official
+    attributes:
+      label: LSPosed requirement
+      options:
+        - label: I am using official LSPosed version
+          required: true
+  - type: textarea
+    attributes:
+      label: Behavior
+      description: Please describe the behavior when trying to screenshot.
+      placeholder: The screenshot is black. / Cannot screenshot with error notification or toast.
+    validations:
+      required: true
   - type: textarea
     attributes:
       label: Logs
@@ -38,8 +52,8 @@ body:
       required: true
   - type: textarea
     attributes:
-      label: Framework JAR
-      description: Please upload your /system/framework/framework.jar.
-      placeholder: Upload jar by clicking the bar on the bottom.
+      label: Framework, Services, and Screenshot App
+      description: Please upload your /system/framework/framework.jar, services.jar, and the screenshot app of your ROM(on AOSP, it's System UI), compressed in a zip file. If the file size is too large to fit GitHub's limit, please upload it to https://catbox.moe and provide the link.
+      placeholder: Upload by clicking the bar on the bottom.
     validations:
-      required: true
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1 @@
-blank_issues_enabled: false
+blank_issues_enabled: false

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: gradle
+    directory: "/"
+    schedule:
+      interval: daily
+      time: "21:00"
+    open-pull-requests-limit: 10
+    target-branch: main
+    registries:
+      - maven-google
+      - gralde-plugin
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+registries:
+  maven-google:
+    type: maven-repository
+    url: "https://dl.google.com/dl/android/maven2/"
+  gralde-plugin:
+    type: maven-repository
+    url: "https://plugins.gradle.org/m2/"

.github/workflows/android.yml

@@ -2,7 +2,6 @@ name: Android CI
 
 on:
   push:
-    branches: [ "main" ]
   pull_request:
   workflow_dispatch:
 
@@ -12,12 +11,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
-
-    - name: set up JDK 17
-      uses: actions/setup-java@v3
+    - uses: actions/checkout@v4
       with:
-        java-version: '17'
+        fetch-depth: 0
+
+    - name: Checkout libxposed/api
+      uses: actions/checkout@v4
+      with:
+        repository: libxposed/api
+        ref: 64e29bd657ef4d2540b34402f5a988778f29e676
+        path: libxposed/api
+        fetch-depth: 0
+
+    - name: set up JDK 21
+      uses: actions/setup-java@v4
+      with:
+        java-version: '21'
         distribution: 'temurin'
         cache: gradle
 
@@ -33,10 +42,21 @@ jobs:
         fi
 
     - name: Build with Gradle
-      run: ./gradlew assembleRelease assembleDebug
+      run: |
+        # gradle properties
+        mkdir -p ~/.gradle
+        echo 'org.gradle.caching=true' >> ~/.gradle/gradle.properties
+        echo 'org.gradle.parallel=true' >> ~/.gradle/gradle.properties
+        echo 'org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 -XX:+UseParallelGC' >> ~/.gradle/gradle.properties
+        echo 'android.native.buildOutput=verbose' >> ~/.gradle/gradle.properties
+        # build dependencies
+        cd libxposed/api && ./gradlew publishToMavenLocal && cd ../..
+        # build DisableFlagSecure
+        chmod +x gradlew
+        ./gradlew assembleRelease assembleDebug
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: Signed app bundle
         path: app/build/outputs/apk

README.md

@@ -1,2 +1,15 @@
-# DisableFlagSecure
-Disable FLAG_SECURE on all windows, enabling screenshots in apps that normally wouldn\'t allow it.
+# Enable Screenshot (formerly known as Disable FLAG_SECURE)
+Enabling screenshots in apps that normally wouldn\'t allow it, and disabling screenshot(Android 14+) & screen record(Android 15+) detection.
+
+**Unofficial LSPosed versions are not supported.**
+
+## Supported OSes
+- Android 12-16 Beta 3 (Custom ROMs are **not** supported)
+- Xiaomi Hyper OS
+- OPlus OS (Color OS/Realme UI/Oxygen OS)
+- Samsung One UI
+
+## Usage
+1. Enable the module
+2. Select **ONLY** recommended apps
+3. Reboot

SOURCE_URL

@@ -0,0 +1 @@
+https://github.com/LSPosed/DisableFlagSecure

SUMMARY

@@ -0,0 +1 @@
+Enabling screenshots in apps that normally wouldn't allow it, and disabling screenshot(Android 14+) & screen record(Android 15+) detection.

app/build.gradle

@@ -3,15 +3,15 @@ plugins {
 }
 
 android {
-    compileSdk 34
-    buildToolsVersion "34.0.0"
+    compileSdk 36
+    buildToolsVersion "36.0.0"
 
     defaultConfig {
         applicationId "io.github.lsposed.disableflagsecure"
-        minSdkVersion 24
-        targetSdkVersion 34
-        versionCode 8
-        versionName "3.1.0"
+        minSdkVersion 31
+        targetSdkVersion 36
+        versionCode rootProject.ext.commitCount
+        versionName "4.2.0"
     }
 
     Properties localProperties = new Properties()
@@ -42,14 +42,15 @@ android {
             } else {
                 signingConfig signingConfigs.debug
             }
+            vcsInfo.include false
             minifyEnabled true
             proguardFiles 'proguard-rules.pro'
         }
     }
 
     compileOptions {
-        sourceCompatibility JavaVersion.VERSION_11
-        targetCompatibility JavaVersion.VERSION_11
+        sourceCompatibility JavaVersion.VERSION_21
+        targetCompatibility JavaVersion.VERSION_21
     }
 
     lint {
@@ -61,5 +62,7 @@ android {
 }
 
 dependencies {
-    compileOnly 'de.robv.android.xposed:api:82'
+    compileOnly 'androidx.annotation:annotation:1.9.1'
+    compileOnly 'io.github.libxposed:api:100'
+    compileOnly project(":libxposed-compat")
 }

app/proguard-rules.pro

@@ -1,5 +1,21 @@
--keep class io.github.lsposed.disableflagsecure.DisableFlagSecure
+-adaptresourcefilecontents META-INF/xposed/java_init.list
+-keepattributes RuntimeVisibleAnnotations
+
+-keep,allowobfuscation,allowoptimization public class * extends io.github.libxposed.api.XposedModule {
+    public <init>(...);
+    public void onPackageLoaded(...);
+    public void onSystemServerLoaded(...);
+}
+-keep,allowshrinking,allowoptimization,allowobfuscation class ** implements io.github.libxposed.api.XposedInterface$Hooker
+-keepclassmembers,allowoptimization class ** implements io.github.libxposed.api.XposedInterface$Hooker {
+    public *** before(***);
+    public *** after(***);
+    public static *** before();
+    public static *** before(io.github.libxposed.api.XposedInterface$BeforeHookCallback);
+    public static void after();
+    public static void after(io.github.libxposed.api.XposedInterface$AfterHookCallback);
+    public static void after(io.github.libxposed.api.XposedInterface$AfterHookCallback, ***);
+}
 
 -repackageclasses
--allowaccessmodification
--overloadaggressively
+-allowaccessmodification

app/src/debug/AndroidManifest.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:tools="http://schemas.android.com/tools"
+    xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <application tools:ignore="MissingApplicationIcon">
+        <activity
+            android:name=".TestActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="de.robv.android.xposed.category.MODULE_SETTINGS" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>

app/src/debug/java/io/github/lsposed/disableflagsecure/TestActivity.java

@@ -0,0 +1,63 @@
+package io.github.lsposed.disableflagsecure;
+
+import android.app.Activity;
+import android.graphics.Paint;
+import android.os.Bundle;
+import android.view.SurfaceHolder;
+import android.view.SurfaceView;
+import android.view.WindowManager;
+import android.widget.LinearLayout;
+import android.widget.TextView;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+public class TestActivity extends Activity implements SurfaceHolder.Callback {
+    private TextView textView;
+    private SurfaceView surfaceView;
+    private final Paint paint = new Paint(Paint.ANTI_ALIAS_FLAG) {{
+        setColor(0xFF00FFFF);
+    }};
+
+    @Override
+    protected void onCreate(@Nullable Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        getWindow().addFlags(WindowManager.LayoutParams.FLAG_SECURE);
+
+        var linearLayout = new LinearLayout(this);
+        linearLayout.setOrientation(LinearLayout.VERTICAL);
+        linearLayout.setBackgroundColor(0xFFFFFF00);
+        setContentView(linearLayout, new LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.MATCH_PARENT));
+
+        textView = new TextView(this);
+        linearLayout.addView(textView, new LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.MATCH_PARENT, 1.0f));
+
+        surfaceView = new SurfaceView(this);
+        surfaceView.setZOrderOnTop(true);
+        surfaceView.setSecure(true);
+        surfaceView.getHolder().addCallback(this);
+        linearLayout.addView(surfaceView, new LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.MATCH_PARENT, 1.0f));
+    }
+
+
+    @Override
+    public void surfaceCreated(@NonNull SurfaceHolder holder) {
+        var canvas = holder.lockCanvas();
+        canvas.drawRect(0, 0, surfaceView.getMeasuredWidth(), surfaceView.getMeasuredHeight(), paint);
+        textView.setText("SurfaceView");
+        textView.draw(canvas);
+        textView.setText("TextView");
+        holder.unlockCanvasAndPost(canvas);
+    }
+
+    @Override
+    public void surfaceChanged(@NonNull SurfaceHolder holder, int format, int width, int height) {
+
+    }
+
+    @Override
+    public void surfaceDestroyed(@NonNull SurfaceHolder holder) {
+
+    }
+}

app/src/main/AndroidManifest.xml

@@ -5,20 +5,8 @@
     <application
         android:allowBackup="true"
         android:label="@string/app_name"
+        android:description="@string/xposed_description"
         android:supportsRtl="true"
-        tools:ignore="AllowBackup,MissingApplicationIcon">
-        <meta-data
-            android:name="xposedmodule"
-            android:value="true" />
-        <meta-data
-            android:name="xposeddescription"
-            android:value="@string/xposed_description" />
-        <meta-data
-            android:name="xposedminversion"
-            android:value="53" />
-        <meta-data
-            android:name="xposedscope"
-            android:resource="@array/scope" />
-    </application>
+        tools:ignore="AllowBackup,MissingApplicationIcon" />
 
 </manifest>

app/src/main/java/io/github/lsposed/disableflagsecure/DisableFlagSecure.java

@@ -1,144 +1,470 @@
 package io.github.lsposed.disableflagsecure;
 
+import android.annotation.SuppressLint;
 import android.app.Activity;
+import android.app.AlertDialog;
+import android.hardware.display.DisplayManager;
 import android.os.Build;
-import android.util.Log;
-import android.widget.Toast;
+import android.view.SurfaceControl;
 
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Member;
-import java.lang.reflect.Method;
+import androidx.annotation.NonNull;
+import androidx.annotation.RequiresApi;
+
+import java.lang.reflect.Field;
+import java.util.Arrays;
 import java.util.function.BiConsumer;
 import java.util.function.BiPredicate;
 
-import de.robv.android.xposed.IXposedHookLoadPackage;
-import de.robv.android.xposed.XC_MethodHook;
-import de.robv.android.xposed.XC_MethodReplacement;
-import de.robv.android.xposed.XposedBridge;
-import de.robv.android.xposed.XposedHelpers;
-import de.robv.android.xposed.callbacks.XC_LoadPackage;
+import io.github.libxposed.api.XposedInterface;
+import io.github.libxposed.api.XposedModule;
+import io.github.libxposed.api.annotations.BeforeInvocation;
+import io.github.libxposed.api.annotations.XposedHooker;
 
-public class DisableFlagSecure implements IXposedHookLoadPackage {
-    private final static Method deoptimizeMethod;
+@SuppressLint({"PrivateApi", "BlockedPrivateApi"})
+public class DisableFlagSecure extends XposedModule {
+    private static final String SYSTEMUI = "com.android.systemui";
+    private static final String OPLUS_APPPLATFORM = "com.oplus.appplatform";
+    private static final String OPLUS_SCREENSHOT = "com.oplus.screenshot";
+    private static final String FLYME_SYSTEMUIEX = "com.flyme.systemuiex";
+    private static final String MIUI_SCREENSHOT = "com.miui.screenshot";
 
-    static {
-        Method m = null;
-        try {
-            //noinspection JavaReflectionMemberAccess
-            m = XposedBridge.class.getDeclaredMethod("deoptimizeMethod", Member.class);
-        } catch (Throwable t) {
-            XposedBridge.log(t);
-        }
-        deoptimizeMethod = m;
-    }
+    private static XposedModule module;
 
-    static void deoptimizeMethod(Class<?> c, String n) throws InvocationTargetException, IllegalAccessException {
-        for (Method m : c.getDeclaredMethods()) {
-            if (deoptimizeMethod != null && m.getName().equals(n)) {
-                deoptimizeMethod.invoke(null, m);
-                Log.d("DisableFlagSecure", "Deoptimized " + m);
-            }
-        }
+    public DisableFlagSecure(XposedInterface base, ModuleLoadedParam param) {
+        super(base, param);
+        module = this;
     }
 
     @Override
-    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) {
-        if (loadPackageParam.packageName.equals("android")) {
+    public void onSystemServerLoaded(@NonNull SystemServerLoadedParam param) {
+        var classLoader = param.getClassLoader();
+
+        try {
+            deoptimizeSystemServer(classLoader);
+        } catch (Throwable t) {
+            log("deoptimize system server failed", t);
+        }
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM) {
+            // Screen record detection (V~Baklava)
             try {
-                Class<?> windowsState = XposedHelpers.findClass("com.android.server.wm.WindowState", loadPackageParam.classLoader);
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-                    XposedHelpers.findAndHookMethod(
-                            windowsState,
-                            "isSecureLocked",
-                            XC_MethodReplacement.returnConstant(false));
-                } else {
-                    XposedHelpers.findAndHookMethod(
-                            "com.android.server.wm.WindowManagerService",
-                            loadPackageParam.classLoader,
-                            "isSecureLocked",
-                            windowsState,
-                            XC_MethodReplacement.returnConstant(false));
-                }
+                hookWindowManagerService(classLoader);
             } catch (Throwable t) {
-                XposedBridge.log(t);
-            }
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-                try {
-                    XposedHelpers.findAndHookMethod(
-                            "com.android.server.wm.ActivityTaskManagerService",
-                            loadPackageParam.classLoader,
-                            "registerScreenCaptureObserver",
-                            "android.os.IBinder",
-                            "android.app.IScreenCaptureObserver",
-                            XC_MethodReplacement.DO_NOTHING);
-                } catch (Throwable t) {
-                    XposedBridge.log(t);
-                }
+                log("hook WindowManagerService failed", t);
             }
+        }
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            // Screenshot detection (U~Baklava)
             try {
-                deoptimizeMethod(XposedHelpers.findClass("com.android.server.wm.WindowStateAnimator", loadPackageParam.classLoader), "createSurfaceLocked");
-                var c = XposedHelpers.findClass("com.android.server.display.DisplayManagerService", loadPackageParam.classLoader);
-                deoptimizeMethod(c, "setUserPreferredModeForDisplayLocked");
-                deoptimizeMethod(c, "setUserPreferredDisplayModeInternal");
-                c = XposedHelpers.findClass("com.android.server.wm.InsetsPolicy$InsetsPolicyAnimationControlListener", loadPackageParam.classLoader);
-                for (var m : c.getDeclaredConstructors()) {
-                    deoptimizeMethod.invoke(null, m);
-                }
-                c = XposedHelpers.findClass("com.android.server.wm.InsetsPolicy", loadPackageParam.classLoader);
-                deoptimizeMethod(c, "startAnimation");
-                deoptimizeMethod(c, "controlAnimationUnchecked");
-                for (int i = 0; i < 20; i++) {
-                    c = XposedHelpers.findClassIfExists("com.android.server.wm.DisplayContent$$ExternalSyntheticLambda" + i, loadPackageParam.classLoader);
-                    if (c != null && BiPredicate.class.isAssignableFrom(c)) {
-                        deoptimizeMethod(c, "test");
-                    }
-                }
-                c = XposedHelpers.findClass("com.android.server.wm.WindowManagerService", loadPackageParam.classLoader);
-                deoptimizeMethod(c, "relayoutWindow");
-                for (int i = 0; i < 20; i++) {
-                    c = XposedHelpers.findClassIfExists("com.android.server.wm.RootWindowContainer$$ExternalSyntheticLambda" + i, loadPackageParam.classLoader);
-                    if (c != null && BiConsumer.class.isAssignableFrom(c)) {
-                        deoptimizeMethod(c, "accept");
-                    }
-                }
+                hookActivityTaskManagerService(classLoader);
             } catch (Throwable t) {
-                XposedBridge.log(t);
+                log("hook ActivityTaskManagerService failed", t);
             }
+
+            // Xiaomi HyperOS (U~Baklava)
+            // OS2.0.250220.1.WOCCNXM.PRE
             try {
-                Class<?> windowsManagerServiceImpl = XposedHelpers.findClassIfExists("com.android.server.wm.WindowManagerServiceImpl", loadPackageParam.classLoader);
-                if (windowsManagerServiceImpl != null) {
-                    XposedBridge.hookAllMethods(
-                            windowsManagerServiceImpl,
-                            "notAllowCaptureDisplay",
-                            XC_MethodReplacement.returnConstant(false));
-                }
+                hookHyperOS(classLoader);
+            } catch (ClassNotFoundException ignored) {
             } catch (Throwable t) {
-                XposedBridge.log(t);
+                log("hook HyperOS failed", t);
             }
-        } else if (loadPackageParam.packageName.equals("com.flyme.systemuiex")) {
+        }
+
+        // ScreenCapture in WindowManagerService (S~Baklava)
+        try {
+            hookScreenCapture(classLoader);
+        } catch (Throwable t) {
+            log("hook ScreenCapture failed", t);
+        }
+
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            // Blackout permission check (S~T)
             try {
-                XposedHelpers.findAndHookMethod("android.view.SurfaceControl$ScreenshotHardwareBuffer", loadPackageParam.classLoader, "containsSecureLayers", XC_MethodReplacement.returnConstant(false));
+                hookActivityManagerService(classLoader);
             } catch (Throwable t) {
-                XposedBridge.log(t);
+                log("hook ActivityManagerService failed", t);
             }
-        } else if (loadPackageParam.packageName.equals("com.oplus.screenshot")) {
-            try {
-                Class<?> screenshotContext = XposedHelpers.findClassIfExists("com.oplus.screenshot.screenshot.core.ScreenshotContext", loadPackageParam.classLoader);
-                XposedBridge.hookAllMethods(screenshotContext, "setScreenshotReject", XC_MethodReplacement.DO_NOTHING);
-                XposedBridge.hookAllMethods(screenshotContext, "setLongshotReject", XC_MethodReplacement.DO_NOTHING);
-            } catch (Throwable t) {
-                XposedBridge.log(t);
+        }
+
+        // WifiDisplay (S~Baklava) / OverlayDisplay (S~Baklava) / VirtualDisplay (U~Baklava)
+        try {
+            hookDisplayControl(classLoader);
+        } catch (Throwable t) {
+            log("hook DisplayControl failed", t);
+        }
+
+        // VirtualDisplay with MediaProjection (S~Baklava)
+        try {
+            hookVirtualDisplayAdapter(classLoader);
+        } catch (Throwable t) {
+            log("hook VirtualDisplayAdapter failed", t);
+        }
+
+        // OneUI
+        try {
+            hookScreenshotHardwareBuffer(classLoader);
+        } catch (Throwable t) {
+            if (!(t instanceof ClassNotFoundException)) {
+                log("hook ScreenshotHardwareBuffer failed", t);
+            }
+        }
+        try {
+            hookOneUI(classLoader);
+        } catch (Throwable t) {
+            if (!(t instanceof ClassNotFoundException)) {
+                log("hook OneUI failed", t);
+            }
+        }
+
+        // secureLocked flag
+        try {
+            // Screenshot
+            hookWindowState(classLoader);
+        } catch (Throwable t) {
+            log("hook WindowState failed", t);
+        }
+
+        // oplus dumpsys
+        // dumpsys window screenshot systemQuickTileScreenshotOut display_id=0
+        try {
+            hookOplus(classLoader);
+        } catch (Throwable t) {
+            if (!(t instanceof ClassNotFoundException)) {
+                log("hook Oplus failed", t);
             }
-        } else {
-            XposedHelpers.findAndHookMethod(Activity.class, "onResume", new XC_MethodHook() {
-                @Override
-                protected void afterHookedMethod(MethodHookParam param) {
-                    Activity activity = (Activity) param.thisObject;
-                    Toast.makeText(activity, "DFS: Incorrect module usage, remove this app from scope.", Toast.LENGTH_LONG).show();
-                    activity.finish();
-                }
-            });
         }
     }
 
+    @SuppressLint("PrivateApi")
+    @Override
+    public void onPackageLoaded(@NonNull PackageLoadedParam param) {
+        if (!param.isFirstPackage()) return;
+
+        var classLoader = param.getClassLoader();
+        var pn = param.getPackageName();
+        switch (pn) {
+            case OPLUS_SCREENSHOT:
+                // Oplus Screenshot 15.0.0
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM) {
+                    try {
+                        hookOplusScreenCapture(classLoader);
+                    } catch (Throwable t) {
+                        if (!(t instanceof ClassNotFoundException)) {
+                            log("hook OplusScreenCapture failed", t);
+                        }
+                    }
+                }
+            case FLYME_SYSTEMUIEX:
+            case OPLUS_APPPLATFORM:
+                // Flyme SystemUI Ext 10.3.0
+                // OPlus AppPlatform 13.1.0 / 14.0.0
+                try {
+                    hookScreenshotHardwareBuffer(classLoader);
+                } catch (Throwable t) {
+                    if (!(t instanceof ClassNotFoundException)) {
+                        log("hook ScreenshotHardwareBuffer failed", t);
+                    }
+                }
+            case SYSTEMUI:
+            case MIUI_SCREENSHOT:
+                if (OPLUS_APPPLATFORM.equals(pn) || OPLUS_SCREENSHOT.equals(pn) ||
+                        Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                    // ScreenCapture in App (S~T) (OPlus S~V)
+                    // TODO: test Oplus Baklava
+                    try {
+                        hookScreenCapture(classLoader);
+                    } catch (Throwable t) {
+                        log("hook ScreenCapture failed", t);
+                    }
+                }
+                break;
+            default:
+                try {
+                    hookOnResume();
+                } catch (Throwable ignored) {
+                }
+        }
+    }
+
+    private void deoptimizeSystemServer(ClassLoader classLoader) throws ClassNotFoundException {
+        deoptimizeMethods(
+                classLoader.loadClass("com.android.server.wm.WindowStateAnimator"),
+                "createSurfaceLocked");
+
+        deoptimizeMethods(
+                classLoader.loadClass("com.android.server.wm.WindowManagerService"),
+                "relayoutWindow");
+
+        for (int i = 0; i < 20; i++) {
+            try {
+                var clazz = classLoader.loadClass("com.android.server.wm.RootWindowContainer$$ExternalSyntheticLambda" + i);
+                if (BiConsumer.class.isAssignableFrom(clazz)) {
+                    deoptimizeMethods(clazz, "accept");
+                }
+            } catch (ClassNotFoundException ignored) {
+            }
+            try {
+                var clazz = classLoader.loadClass("com.android.server.wm.DisplayContent$" + i);
+                if (BiPredicate.class.isAssignableFrom(clazz)) {
+                    deoptimizeMethods(clazz, "test");
+                }
+            } catch (ClassNotFoundException ignored) {
+            }
+        }
+    }
+
+    private void deoptimizeMethods(Class<?> clazz, String... names) {
+        var list = Arrays.asList(names);
+        Arrays.stream(clazz.getDeclaredMethods())
+                .filter(method -> list.contains(method.getName()))
+                .forEach(this::deoptimize);
+    }
+
+    private void hookWindowState(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var windowStateClazz = classLoader.loadClass("com.android.server.wm.WindowState");
+        var isSecureLockedMethod = windowStateClazz.getDeclaredMethod("isSecureLocked");
+        hook(isSecureLockedMethod, SecureLockedHooker.class);
+    }
+
+    private static Field captureSecureLayersField;
+
+    private void hookScreenCapture(ClassLoader classLoader) throws ClassNotFoundException, NoSuchFieldException {
+        var screenCaptureClazz = Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE ?
+                classLoader.loadClass("android.window.ScreenCapture") :
+                SurfaceControl.class;
+        var captureArgsClazz = classLoader.loadClass(Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE ?
+                "android.window.ScreenCapture$CaptureArgs" :
+                "android.view.SurfaceControl$CaptureArgs");
+        captureSecureLayersField = captureArgsClazz.getDeclaredField("mCaptureSecureLayers");
+        captureSecureLayersField.setAccessible(true);
+        hookMethods(screenCaptureClazz, ScreenCaptureHooker.class, "nativeCaptureDisplay");
+        hookMethods(screenCaptureClazz, ScreenCaptureHooker.class, "nativeCaptureLayers");
+    }
+
+    private void hookDisplayControl(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var displayControlClazz = Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE ?
+                classLoader.loadClass("com.android.server.display.DisplayControl") :
+                SurfaceControl.class;
+        var method = displayControlClazz.getDeclaredMethod(
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM ?
+                        "createVirtualDisplay" :
+                        "createDisplay", String.class, boolean.class);
+        hook(method, CreateDisplayHooker.class);
+    }
+
+    private void hookVirtualDisplayAdapter(ClassLoader classLoader) throws ClassNotFoundException {
+        var displayControlClazz = classLoader.loadClass("com.android.server.display.VirtualDisplayAdapter");
+        hookMethods(displayControlClazz, CreateVirtualDisplayLockedHooker.class, "createVirtualDisplayLocked");
+    }
+
+    @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    private void hookActivityTaskManagerService(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var activityTaskManagerServiceClazz = classLoader.loadClass("com.android.server.wm.ActivityTaskManagerService");
+        var iBinderClazz = classLoader.loadClass("android.os.IBinder");
+        var iScreenCaptureObserverClazz = classLoader.loadClass("android.app.IScreenCaptureObserver");
+        var method = activityTaskManagerServiceClazz.getDeclaredMethod("registerScreenCaptureObserver", iBinderClazz, iScreenCaptureObserverClazz);
+        hook(method, ReturnNullHooker.class);
+    }
+
+    @RequiresApi(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    private void hookWindowManagerService(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var windowManagerServiceClazz = classLoader.loadClass("com.android.server.wm.WindowManagerService");
+        var iScreenRecordingCallbackClazz = classLoader.loadClass("android.window.IScreenRecordingCallback");
+        var method = windowManagerServiceClazz.getDeclaredMethod("registerScreenRecordingCallback", iScreenRecordingCallbackClazz);
+        hook(method, ReturnFalseHooker.class);
+    }
+
+    private void hookActivityManagerService(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var activityTaskManagerServiceClazz = classLoader.loadClass("com.android.server.am.ActivityManagerService");
+        var method = activityTaskManagerServiceClazz.getDeclaredMethod("checkPermission", String.class, int.class, int.class);
+        hook(method, CheckPermissionHooker.class);
+    }
+
+    @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    private void hookHyperOS(ClassLoader classLoader) throws ClassNotFoundException {
+        var windowManagerServiceImplClazz = classLoader.loadClass("com.android.server.wm.WindowManagerServiceImpl");
+        hookMethods(windowManagerServiceImplClazz, ReturnFalseHooker.class, "notAllowCaptureDisplay");
+    }
+
+    private void hookScreenshotHardwareBuffer(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var screenshotHardwareBufferClazz = classLoader.loadClass(
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE ?
+                        "android.window.ScreenCapture$ScreenshotHardwareBuffer" :
+                        "android.view.SurfaceControl$ScreenshotHardwareBuffer");
+        var method = screenshotHardwareBufferClazz.getDeclaredMethod("containsSecureLayers");
+        hook(method, ReturnFalseHooker.class);
+    }
+
+    @RequiresApi(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    private void hookOplusScreenCapture(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var oplusScreenCaptureClazz = classLoader.loadClass("com.oplus.screenshot.OplusScreenCapture$CaptureArgs$Builder");
+        var method = oplusScreenCaptureClazz.getDeclaredMethod("setUid", long.class);
+        hook(method, OplusScreenCaptureHooker.class);
+    }
+
+    private void hookOplus(ClassLoader classLoader) throws ClassNotFoundException {
+        // caller: com.android.server.wm.OplusLongshotWindowDump#dumpWindows
+        var longshotMainClazz = classLoader.loadClass("com.android.server.wm.OplusLongshotMainWindow");
+        hookMethods(longshotMainClazz, ReturnFalseHooker.class, "hasSecure");
+    }
+
+    private void hookOneUI(ClassLoader classLoader) throws ClassNotFoundException {
+        var wmScreenshotControllerClazz = classLoader.loadClass("com.android.server.wm.WmScreenshotController");
+        hookMethods(wmScreenshotControllerClazz, ReturnTrueHooker.class, "canBeScreenshotTarget");
+    }
+
+    private void hookMethods(Class<?> clazz, Class<? extends Hooker> hooker, String... names) {
+        var list = Arrays.asList(names);
+        Arrays.stream(clazz.getDeclaredMethods())
+                .filter(method -> list.contains(method.getName()))
+                .forEach(method -> hook(method, hooker));
+    }
+
+    private void hookOnResume() throws NoSuchMethodException {
+        var method = Activity.class.getDeclaredMethod("onResume");
+        hook(method, ToastHooker.class);
+    }
+
+    @XposedHooker
+    private static class CreateDisplayHooker implements Hooker {
+
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                var stackTrace = new Throwable().getStackTrace();
+                for (int i = 4; i < stackTrace.length && i < 8; i++) {
+                    var name = stackTrace[i].getMethodName();
+                    if (name.equals("createVirtualDisplayLocked")) {
+                        return;
+                    }
+                }
+            }
+            callback.getArgs()[1] = true;
+        }
+    }
+
+    @XposedHooker
+    private static class CheckPermissionHooker implements Hooker {
+
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            var permission = callback.getArgs()[0];
+            if ("android.permission.CAPTURE_BLACKOUT_CONTENT".equals(permission)) {
+                callback.getArgs()[0] = "android.permission.READ_FRAME_BUFFER";
+            }
+        }
+    }
+
+    @XposedHooker
+    private static class OplusScreenCaptureHooker implements Hooker {
+
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            callback.getArgs()[0] = -1;
+        }
+    }
+
+    @XposedHooker
+    private static class ScreenCaptureHooker implements Hooker {
+
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            var captureArgs = callback.getArgs()[0];
+            try {
+                captureSecureLayersField.set(captureArgs, true);
+            } catch (IllegalAccessException t) {
+                module.log("ScreenCaptureHooker failed", t);
+            }
+        }
+    }
+
+    @XposedHooker
+    private static class CreateVirtualDisplayLockedHooker implements Hooker {
+
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            var caller = (int) callback.getArgs()[2];
+            if (caller >= 10000 && callback.getArgs()[1] == null) {
+                // not os and not media projection
+                return;
+            }
+            for (int i = 3; i < callback.getArgs().length; i++) {
+                var arg = callback.getArgs()[i];
+                if (arg instanceof Integer) {
+                    var flags = (int) arg;
+                    flags |= DisplayManager.VIRTUAL_DISPLAY_FLAG_SECURE;
+                    callback.getArgs()[i] = flags;
+                    return;
+                }
+            }
+            module.log("flag not found in CreateVirtualDisplayLockedHooker");
+        }
+    }
+
+    @XposedHooker
+    private static class SecureLockedHooker implements Hooker {
+
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                var walker = StackWalker.getInstance();
+                var match = walker.walk(frames -> frames
+                        .map(StackWalker.StackFrame::getMethodName)
+                        .limit(6)
+                        .skip(2)
+                        .anyMatch(s -> s.equals("setInitialSurfaceControlProperties") || s.equals("createSurfaceLocked")));
+                if (match) return;
+            } else {
+                var stackTrace = new Throwable().getStackTrace();
+                for (int i = 4; i < stackTrace.length && i < 8; i++) {
+                    var name = stackTrace[i].getMethodName();
+                    if (name.equals("setInitialSurfaceControlProperties") ||
+                            name.equals("createSurfaceLocked")) {
+                        return;
+                    }
+                }
+            }
+            callback.returnAndSkip(false);
+        }
+    }
+
+    @XposedHooker
+    private static class ReturnTrueHooker implements Hooker {
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            callback.returnAndSkip(true);
+        }
+    }
+
+    @XposedHooker
+    private static class ReturnFalseHooker implements Hooker {
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            callback.returnAndSkip(false);
+        }
+    }
+
+    @XposedHooker
+    private static class ReturnNullHooker implements Hooker {
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            callback.returnAndSkip(null);
+        }
+    }
+
+    @XposedHooker
+    private static class ToastHooker implements Hooker {
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            var activity = (Activity) callback.getThisObject();
+            new AlertDialog.Builder(activity)
+                    .setTitle("Enable Screenshot")
+                    .setMessage("Incorrect module usage, remove this app from scope.")
+                    .setCancelable(false)
+                    .setPositiveButton("OK", (dialog, which) -> System.exit(0))
+                    .show();
+        }
+    }
 }

app/src/main/res/values-v34/strings.xml

@@ -1,3 +1,3 @@
 <resources>
-    <string name="xposed_description">Disable FLAG_SECURE on all windows, enabling screenshots in apps that normally wouldn\'t allow it and disabling screenshot detection.</string>
+    <string name="xposed_description">Enabling screenshots in apps that normally wouldn\'t allow it and disabling screenshot detection.</string>
 </resources>

app/src/main/res/values-v35/strings.xml

@@ -0,0 +1,3 @@
+<resources>
+    <string name="xposed_description">Enabling screenshots in apps that normally wouldn\'t allow it and disabling screenshot &amp; screen record detection.</string>
+</resources>

app/src/main/res/values-zh-rCN-v34/strings.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="xposed_description">对所有 Window 禁用 FLAG_SECURE，在通常不允许截图的应用中启用屏幕截图并禁用截图检测。</string>
+    <string name="xposed_description">在通常不允许截图的应用中启用屏幕截图并禁用截图检测。</string>
 </resources>

app/src/main/res/values-zh-rCN-v35/strings.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="xposed_description">在通常不允许截图的应用中启用屏幕截图并禁用截图与录屏检测。</string>
+</resources>

app/src/main/res/values-zh-rCN/strings.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">禁用 FLAG_SECURE</string>
-    <string name="xposed_description">对所有 Window 禁用 FLAG_SECURE，在通常不允许截图的应用中启用屏幕截图。</string>
+    <string name="app_name">启用截图</string>
+    <string name="xposed_description">在通常不允许截图的应用中启用屏幕截图。</string>
 </resources>

app/src/main/res/values/strings.xml

@@ -1,9 +1,4 @@
 <resources>
-    <string name="app_name">Disable FLAG_SECURE</string>
-    <string name="xposed_description">Disable FLAG_SECURE on all windows, enabling screenshots in apps that normally wouldn\'t allow it.</string>
-    <string-array name="scope">
-        <item>android</item>
-        <item>com.flyme.systemuiex</item>
-        <item>com.oplus.screenshot</item>
-    </string-array>
+    <string name="app_name">Enable Screenshot</string>
+    <string name="xposed_description">Enabling screenshots in apps that normally wouldn\'t allow it.</string>
 </resources>

app/src/main/resources/META-INF/xposed/module.prop

@@ -0,0 +1,3 @@
+minApiVersion=100
+targetApiVersion=100
+staticScope=true

app/src/main/resources/META-INF/xposed/scope.list

@@ -0,0 +1,6 @@
+system
+com.android.systemui
+com.flyme.systemuiex
+com.miui.screenshot
+com.oplus.appplatform
+com.oplus.screenshot

build.gradle

@@ -1,25 +1,11 @@
-// Top-level build file where you can add configuration options common to all sub-projects/modules.
-buildscript {
-    repositories {
-        google()
-        mavenCentral()
-    }
-    dependencies {
-        classpath 'com.android.tools.build:gradle:8.2.0'
-
-        // NOTE: Do not place your application dependencies here; they belong
-        // in the individual module build.gradle files
-    }
+plugins {
+    id 'com.android.application' version '8.9.1' apply false
+    id 'org.lsposed.lsplugin.jgit' version "1.1"
 }
 
-allprojects {
-    repositories {
-        google()
-        mavenCentral()
-        maven { url = "https://api.xposed.info" }
-    }
+tasks.register('clean', Delete) {
+    delete rootProject.layout.buildDirectory
 }
 
-task clean(type: Delete) {
-    delete rootProject.buildDir
-}
+var repo = jgit.repo(true)
+ext.commitCount = repo.commitCount('refs/remotes/origin/main')

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

gradlew

@@ -15,6 +15,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
 #
@@ -55,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -84,7 +86,7 @@ done
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
 # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -203,7 +205,7 @@ fi
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
 # Collect all arguments for the java command:
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
 #     and any embedded shellness will be escaped.
 #   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
 #     treated as '${Hostname}' itself on the command line.

gradlew.bat

@@ -13,6 +13,8 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 @rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
 
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
@@ -43,11 +45,11 @@ set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -57,11 +59,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 

libxposed-compat/.gitignore

@@ -0,0 +1 @@
+/build

libxposed-compat/build.gradle

@@ -0,0 +1,18 @@
+plugins {
+    id 'com.android.library'
+}
+
+android {
+    namespace 'io.github.libxposed'
+    compileSdk 35
+
+    defaultConfig {
+        minSdk 24
+        targetSdk 35
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_21
+        targetCompatibility JavaVersion.VERSION_21
+    }
+}

libxposed-compat/src/main/AndroidManifest.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest>
+</manifest>

libxposed-compat/src/main/java/io/github/libxposed/api/annotations/AfterInvocation.java

@@ -0,0 +1,11 @@
+package io.github.libxposed.api.annotations;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface AfterInvocation {
+}

libxposed-compat/src/main/java/io/github/libxposed/api/annotations/BeforeInvocation.java

@@ -0,0 +1,11 @@
+package io.github.libxposed.api.annotations;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface BeforeInvocation {
+}

libxposed-compat/src/main/java/io/github/libxposed/api/annotations/XposedHooker.java

@@ -0,0 +1,11 @@
+package io.github.libxposed.api.annotations;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.TYPE, ElementType.TYPE_USE})
+public @interface XposedHooker {
+}

settings.gradle

@@ -1,2 +1,22 @@
-rootProject.name = "Disable FLAG_SECURE"
+pluginManagement {
+    repositories {
+        gradlePluginPortal()
+        google()
+        mavenCentral()
+    }
+}
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+        mavenLocal {
+            content {
+                includeGroup("io.github.libxposed")
+            }
+        }
+    }
+}
+rootProject.name = "DisableFlagSecure"
 include ':app'
+include ':libxposed-compat'