FuseFixer is an Android Xposed module that hooks into the MediaProvider's FUSE daemon to prevent package name existence leakage via Unicode Default_Ignorable_Code_Points. The module intercepts path comparison functions (strcasecmp, EqualsIgnoreCase) and access control checks (is_package_owned_path, is_app_accessible_path, is_bpf_backing_path) in the native libfuse_jni.so library, stripping out ignorable code points before evaluation. This closes a vulnerability where attackers could bypass directory access restrictions on /storage/emulated/.../Android/data by inserting invisible Unicode characters. The project includes a custom ELF parser for dynamic symbol resolution, a maps scanner, and a debug UI for testing. The native code is written in C++20 and demonstrates deep understanding of Android's FUSE implementation, kernel casefold behavior, and FUSE BPF internals.
HyperCeiler is an Xposed/LSPosed module for Xiaomi HyperOS devices that hooks into system applications (SystemUI, Launcher, Settings, Camera, etc.) to unlock hidden features, disable ads/telemetry, and customize UI elements. The project is a multi-module Android application with a settings UI for toggling hundreds of individual hook rules. It uses a dual-layer architecture: Java/Kotlin hooks via EzHookTool and DexKit for dynamic method interception, and native C++ code for low-level inline patching of ARM64 binaries in system libraries. The codebase includes extensive mutation testing and regression harnesses that compile production source against frozen ROM snapshots and verify behavior via QEMU emulation. While highly specialized for Xiaomi's proprietary stack, the project demonstrates advanced reverse engineering skills and a robust testing methodology.
NoWakeLock is a production-grade Android Xposed module and companion app that provides granular control over system power management. It intercepts and selectively blocks or limits WakeLocks, Alarms, and Services at the Android framework level via Xposed hooks, enabling users to reduce battery drain. The system consists of two processes: an Xposed module running in the system_server process that performs the actual interception using both legacy (XposedBridge) and modern (libxposed API 102) APIs, and a standard Android application with a Jetpack Compose UI that allows users to configure per-app and per-item blocking rules, view real-time statistics, and manage settings. Data flows from the Xposed hooks through a ContentProvider-based IPC (XProvider) into a dual Room database architecture (AppDatabase for configuration, InfoDatabase for runtime events). The app features Material Design 3, multi-language support, backup/restore via JSON, multi-user profiles, module health diagnostics, and hot reload support for modern Xposed frameworks. The codebase demonstrates a clean MVVM architecture with Koin dependency injection, Kotlin Coroutines/Flow for reactive data flow, and comprehensive unit/instrumentation tests. While primarily a standalone application, several core concurrency utilities (BoundedEventQueue, ReloadableEventConsumer, WakelockRegistry) could be extracted and reused in other Android or system-level projects.
ONO is an Android Xposed module that modifies and enhances the QQ messaging application (Tencent). It provides a broad set of features including custom sticker panels, message encryption, anti-revoke, developer tools (packet inspection, cookie retrieval), UI tweaks (bubble redirect, profile card menu), and entertainment hooks (fake group owner, sport step spoofing). The module supports both legacy Xposed (API 51–99) and modern LSPosed (libxposed API 100) frameworks, with a dual-entry architecture that unifies startup through a shared `UnifiedEntryPoint` and `StartupRoutine`. Internally, it uses a sophisticated hook item framework based on annotations and a KSP annotation processor to automatically register hook classes. The codebase is heavily reliant on reflection and reverse-engineering of QQ's internal classes, making it tightly coupled to specific QQ versions, but the core utilities (reflection helpers, configuration management, protocol building) are well-crafted and potentially reusable in other Android hooking projects. The project is actively maintained with frequent commits, responsive issue triage, and a comprehensive build system using Gradle convention plugins.
This is an Android Xposed module (using LSPosed/libxposed API) that hooks system APIs to bypass eSIM (Embedded SIM / eUICC) support checks and intercept activation codes. It forces `PackageManager.hasSystemFeature` for eUICC to return true, returns a fake EuiccService in query results, and captures activation codes from `DownloadableSubscription.forActivationCode` or `getEncodedActivationCode`, copying them to the clipboard and offering to share via an Intent. Additionally, it provides an OMAPI bypass by hooking `com.android.se.security.AccessControlEnforcer` to disable ARF/ARA access control, enabling OMAPI access without proper ARA rules. The module targets specific packages listed in `scope.list` (com.android.se, com.miui.euicc, app.septs.euiccprobe). The code is a single Java class (`HookEuicc.java`) that extends `XposedModule` and installs hooks in `onPackageReady`. It demonstrates solid reflection-based hooking patterns and includes a reusable utility method for setting boolean fields via reflection across the class hierarchy. The build system uses Gradle with Android Gradle Plugin 8.6.0 and targets Android SDK 35.