Dreamland Manager 显示框架未安装

[realSaltyFish]

LineageOS, Android 14 (API 34), arm64-v8a, Magisk 27.0, Dreamland 2.1_2106, Dreamland Manager 0.0.8

在安装梦境框架前已经启用了 Zygisk，从 Magisk 刷 zip 包时也显示安装了 Zygisk flavor，但 Dreamland Manager 显示框架未安装（The device does not currently support the dreamland framework）

Magisk 日志如下：

03-05 16:04:56.880   916   916 I : Magisk 27.0(27000) daemon started
03-05 16:04:56.881   916   916 I : * Device API level: 34
03-05 16:04:56.890   916   918 I : ** post-fs-data mode running
03-05 16:04:56.891   916   918 I : * Mounting mirrors
03-05 16:04:56.985   916   918 I : * Initializing Magisk environment
03-05 16:04:57.017   916   918 I : * Running post-fs-data.d scripts
03-05 16:04:57.025   916   918 I : Upgrade / New module: riru_dreamland
03-05 16:04:57.026   916   918 I : * Running module post-fs-data scripts
03-05 16:04:57.029   923   923 I : riru_dreamland: exec [post-fs-data.sh]
03-05 16:04:57.036   916   918 I : * Loading modules
03-05 16:04:57.036   916   918 I : riru_dreamland: loading [system.prop]
08-15 22:24:42.690   986   986 I : zygisk32: replace nativeForkAndSpecialize
08-15 22:24:42.690   986   986 I : zygisk32: replace nativeSpecializeAppProcess
08-15 22:24:42.690   986   986 I : zygisk32: replace nativeForkSystemServer
08-15 22:24:42.739   985   985 I : zygisk64: replace nativeForkAndSpecialize
08-15 22:24:42.739   985   985 I : zygisk64: replace nativeSpecializeAppProcess
08-15 22:24:42.739   985   985 I : zygisk64: replace nativeForkSystemServer
08-15 22:24:42.883   916   918 I : ** late_start service mode running
08-15 22:24:42.883   916   918 I : * Running service.d scripts
08-15 22:24:42.884   916   918 I : * Running module service scripts
08-15 22:24:42.884   916   918 I : riru_dreamland: exec [service.sh]
08-15 22:24:44.279   916   918 I : denylist: initializing internal data structures
08-15 22:24:54.429   916   918 I : ** boot-complete triggered

日志中出现 riru_dreamland 是正常的吗？

尝试过禁用 Zygisk 并安装远古版本 Riru，此时 Magisk 显示安装了 Riru flavor 的梦境框架，但是重启后 Manager 依然显示未安装。

鄙人不才，对安卓的了解不如大佬深入，但也算有一点理解和排查问题的能力，大佬需要什么信息尽管说。

[realSaltyFish]

在开机后首次启动 Dreamland Manager 时，logcat 显示以下错误：

Dreamland error in app process
java.lang.ExceptionInInitializerError
	at top.canyie.dreamland.Main.hookPackageLoad(SourceFile:4)
	at top.canyie.dreamland.Main.onAppProcessStart(SourceFile:90)
	at com.android.internal.os.Zygote.nativeSpecializeAppProcess(Native Method)
	at com.android.internal.os.Zygote.specializeAppProcess(Zygote.java:439)
	at com.android.internal.os.Zygote.childMain(Zygote.java:874)
	at com.android.internal.os.Zygote.forkSimpleApps(Zygote.java:734)
	at com.android.internal.os.ZygoteConnection.processCommand(ZygoteConnection.java:288)
	at com.android.internal.os.ZygoteServer.runSelectLoop(ZygoteServer.java:521)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:865)
Caused by: top.canyie.dreamland.utils.reflect.UncheckedNoSuchFieldException: No field 'compatInfo' found in class android.app.ActivityThread$AppBindData
	at top.canyie.dreamland.utils.reflect.Reflection.a(SourceFile:63)
	at mirror.android.app.ActivityThread$AppBindData.<clinit>(SourceFile:29)
	at top.canyie.dreamland.Main.hookPackageLoad(SourceFile:4) 
	at top.canyie.dreamland.Main.onAppProcessStart(SourceFile:90) 
	at com.android.internal.os.Zygote.nativeSpecializeAppProcess(Native Method) 
	at com.android.internal.os.Zygote.specializeAppProcess(Zygote.java:439) 
	at com.android.internal.os.Zygote.childMain(Zygote.java:874) 
	at com.android.internal.os.Zygote.forkSimpleApps(Zygote.java:734) 
	at com.android.internal.os.ZygoteConnection.processCommand(ZygoteConnection.java:288) 
	at com.android.internal.os.ZygoteServer.runSelectLoop(ZygoteServer.java:521) 
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:865) 

[Master0fEvil]

I don't understand Chinese but I get the same issue probably, running lineageos gsi with android 14

[realSaltyFish]

初步确认问题如下：在我的系统上 android.app.ActivityThread$AppBindData class 中不存在 compatInfo 这个 field。当 Dreamland 的 AppBindData mirror class 初始化时尝试从系统 AppBindData class 的 Reflection 中获取对应的 field，导致报错。

Dreamland/app/src/main/java/mirror/android/app/ActivityThread.java

Line 33 in d4dbb2e

public static final FieldWrapper compatInfo = REF.field("compatInfo");

注意 Dreamland 框架实际上已经激活（能主动 hook Manager 进程）但其和 Manager 进程的通信出现了一些问题，使得 Manager 无法识别激活状态。

下图为在此处添加 debug print 获取到对应的 Reflection 上所有声明过的 field。

我的系统基于 AP2A.240805.005，即 Android 14.0.0 R55，对应代码在此处 ，和截图对比可以发现实际运行时其它 field 都有，唯独少了 compatInfo。原因暂且不明。

Dreamland 获取 compatInfo 实例后只在这里进行了使用：

Dreamland/app/src/main/java/top/canyie/dreamland/Main.java

Lines 165 to 169 in d4dbb2e

	ApplicationInfo appInfo = ActivityThread.AppBindData.appInfo.getValue(appBindData);
	if (appInfo == null) return;
	CompatibilityInfo compatInfo = ActivityThread.AppBindData.compatInfo.getValue(appBindData);
	ActivityThread.mBoundApplication.setValue(activityThread, appBindData);
	LoadedApk loadedApk = activityThread.getPackageInfoNoCheck(appInfo, compatInfo);

可见 Dreamland 需要它的唯一用处是通过 getPackageInfoNoCheck 函数获取 Activity 对应的 LoadedApk。在 Android 14 源码中 getPackageInfoNoCheck 函数有一个只需要 ApplicationInfo 参数的 overload，定义如下：

https://cs.android.com/android/platform/superproject/+/android-14.0.0_r55:frameworks/base/core/java/android/app/ActivityThread.java;l=2844-2848

    @Override
    public LoadedApk getPackageInfoNoCheck(ApplicationInfo ai) {
        return getPackageInfo(ai, mCompatibilityInfo, null /* baseLoader */,
                false /* securityViolation */, true /* includeCode */, false /* registerPackage */);
    }

将该函数的 stub 修改为这一 overload 并且删除获取 compatInfo field 的代码即可让 Dreamland Manager 识别到框架已经激活，并正常管理框架。以下测试 build 包含了这一改动：

dreamland-2106-release.zip

值得注意的是，这一单参数 overload 是最近的 Android 版本引入的，Android 13 QPR 1 的源码中还没有这个 overload 的声明，因此这一改动会使得 Dreamland 不再兼容 Android 13 以及更早的版本，所以暂时还不能提 PR。

根据 @Master0fEvil 的说法，如果 LineageOS 21 GSI 也存在此问题，可能是 LineageOS 对 ActivityThread.java 的内部实现进行了魔改。compatInfo 这一 field 在 Android 源码中被标注为不适合外部调用，因此底层实现可以随时发生变化。需要针对 LineageOS 构建流程进行更深入的分析来确定原因。

@Master0fEvil You can use translation software to understand the contents of this thread. My apologies for the inconvenience. I prefer to post issues in Chinese in a predominantly Chinese community to facilitate smoother communication. Btw, thanks for reporting your experience!

[Master0fEvil]

@realSaltyFish it's all good, I'm using lineage's default browser ATM so don't have a way to translate, but I found out lineageOS 21 already has built in spoofing for microg, so that's probably why this spoofing method isn't working lol