FuseFixer is an Android Xposed module that hooks into the MediaProvider's FUSE daemon to prevent package name existence leakage via Unicode Default_Ignorable_Code_Points. The module intercepts path comparison functions (strcasecmp, EqualsIgnoreCase) and access control checks (is_package_owned_path, is_app_accessible_path, is_bpf_backing_path) in the native libfuse_jni.so library, stripping out ignorable code points before evaluation. This closes a vulnerability where attackers could bypass directory access restrictions on /storage/emulated/.../Android/data by inserting invisible Unicode characters. The project includes a custom ELF parser for dynamic symbol resolution, a maps scanner, and a debug UI for testing. The native code is written in C++20 and demonstrates deep understanding of Android's FUSE implementation, kernel casefold behavior, and FUSE BPF internals.
dpt-shell is a sophisticated Android application protection framework that implements a 'hollow shell' obfuscation technique. It functions as a two-part system: a Java-based CLI processor (dpt) that analyzes and modifies target APK/AAB files, and a native Android shell (shell) that is injected into the target application. The processor extracts method bytecode (CodeItem) from the original Dex files, encrypts them, and replaces the original code with NOP instructions. At runtime, the injected shell hooks Android's class loading mechanisms (DefineClass/LoadClass) using native libraries (Dobby, bhook), decrypts the stored bytecode, and patches the memory of the loaded Dex file to restore the original code before execution. This architecture provides runtime code integrity verification and anti-tampering capabilities. The codebase demonstrates high craftsmanship in both Java and C++. The Java processor utilizes smali/dexlib2 for bytecode manipulation and implements a robust rule-based exclusion system for framework classes. The C++ shell implements low-level memory management, ELF parsing, and dynamic hooking to intercept Android Runtime (ART) operations. It includes anti-debugging, anti-Frida, and signature verification features. The project targets very recent Android SDK versions (36) and build tools (Gradle 8.14), indicating active development and forward-looking compatibility.
HyperCeiler is an Xposed/LSPosed module for Xiaomi HyperOS devices that hooks into system applications (SystemUI, Launcher, Settings, Camera, etc.) to unlock hidden features, disable ads/telemetry, and customize UI elements. The project is a multi-module Android application with a settings UI for toggling hundreds of individual hook rules. It uses a dual-layer architecture: Java/Kotlin hooks via EzHookTool and DexKit for dynamic method interception, and native C++ code for low-level inline patching of ARM64 binaries in system libraries. The codebase includes extensive mutation testing and regression harnesses that compile production source against frozen ROM snapshots and verify behavior via QEMU emulation. While highly specialized for Xiaomi's proprietary stack, the project demonstrates advanced reverse engineering skills and a robust testing methodology.
QTTabBar is a Windows Explorer shell extension that adds tabbed browsing, customizable toolbars, and a plugin system to File Explorer. It integrates as a COM band object (IDeskBand) into Explorer's rebar, providing features such as tab management, mouse gestures, keyboard shortcuts, folder groups, and a button bar. The architecture is a hybrid of WinForms and WPF, with heavy use of COM interop and native API hooking via the MinHook library. Key entry points include the BandObject base class, the QTCommandBar band, and the PluginServer that loads interactive and background plugins. External dependencies include the .NET Framework 4.8, Windows Shell APIs, and a native C++ hook library (QTHookLib). The system persists configuration in the Windows Registry and supports multi-language localization. While the codebase is mature and feature-rich, it exhibits technical drift due to reliance on legacy .NET Framework, extensive COM interop that may break on newer Windows versions, and some deprecated APIs. The plugin system and several utility components (e.g., PropVariant wrapper, ChineseCalendar) are well-crafted and potentially reusable in other projects.
This repository is a multi-module Android application that functions as a cheat client for Minecraft Bedrock Edition. It intercepts and modifies network packets between the client and server using a custom relay/proxy (Lunaris) and a comprehensive implementation of the Bedrock protocol (CloudburstMC-derived). The app provides a graphical overlay (Pixie with ImGui) for toggling cheat modules such as flight, speed, killaura, ESP, and more. It also includes Microsoft/Xbox authentication, Discord Rich Presence, and an update check mechanism with native signature verification. Architecture: The project is organized into several Gradle modules: `app` (main Android app with Compose UI and cheat modules), `Protocol/bedrock-codec` (versioned Bedrock packet serializers), `Protocol/bedrock-connection` (Netty-based session management), `Network/transport-raknet` (custom RakNet UDP transport), `Lunaris` (relay/proxy for packet interception), `Pixie` (native C++ overlay with ImGui and Dobby hooking), `minecraft-msftauth` (Microsoft authentication), `lunarisrpc` (Discord RPC), and `animatedux` (Compose UI components). The app uses a packet interception pattern where cheat modules (subclasses of `Element`) override `beforePacketBound` to modify or cancel packets before they are sent to the server. Key entry points: `app` module's `MainActivity` or `LaunchActivity` (Android entry), `Pixie`'s `MuffinService` (overlay service), `Lunaris`'s `LuminaRelaySession` (relay logic), and the protocol codec builders (e.g., `Bedrock_v898`). Data flows: The app connects to a Bedrock server via RakNet, the relay intercepts packets, cheat modules modify them, and the modified packets are forwarded. The protocol library handles serialization/deserialization for dozens of protocol versions. External dependencies: Netty (network), OkHttp (HTTP), Firebase (analytics/crashlytics), Gson (JSON), fastutil (collections), Lombok (Java boilerplate), AndroidX Compose (UI), ImGui (native overlay), Dobby (native hooking), and various Android SDK components.