You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+16-1Lines changed: 16 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
5
5
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
8
+
## [Unreleased]
9
+
10
+
### Added
11
+
- Added unified strategy health models and `Fw.check()` health report with restartable-strategy recovery.
12
+
- Added `FwMediaBrowserService` strategy and wired it into config, startup, shutdown, and health checks.
13
+
- Added native startActivity strategies for `NEW_TASK + EXCLUDE_FROM_RECENTS + NO_ANIMATION` and `moveTaskToFront`.
14
+
- Added `FwStart.startAuditAll()` for full native strategy audit while keeping `FwStart.start()` on executable strategies by default.
15
+
16
+
### Changed
17
+
- Hardened VPN startup to require user authorization, foreground notification startup, no default traffic routing, and explicit special-use subtype metadata.
18
+
- Changed 1-pixel Activity and contacts/SMS observers to opt-in defaults, and stopped merging contacts/SMS permissions into host apps by default.
19
+
- Updated PendingIntent background-launch handling for Android 14-16 sender/creator-side options.
20
+
- Upgraded the build toolchain to Gradle 9.5.1, AGP 9.2.1, Kotlin 2.3.21, Compose BOM 2026.05.01, and migrated to AGP built-in Kotlin with the new DSL.
21
+
- Updated README, English README, and helper docs to document health checks, VPN authorization, MediaBrowser, and full startActivity strategy boundaries.
22
+
8
23
## [2.0.1] - 2026-05-26
9
24
10
25
### Changed
@@ -29,7 +44,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
That's it. All 35+ keep-alive strategies are automatically enabled.
54
+
That's it. Low-intrusion strategies start automatically. User-authorized or invasive strategies such as 1-pixel activity, contacts/SMS observers, VPN, CompanionDevice, CallStyle, Device Admin, lock-screen activity, floating window, and force-stop resistance stay off until you enable them explicitly.
55
55
56
56
### Step 3 (Optional): Fine-Grained Control
57
57
@@ -62,8 +62,10 @@ Fw.init(this) {
62
62
enableDualProcess =true
63
63
enableNativeDaemon =true
64
64
enableMediaRouteProvider =true
65
+
enableMediaBrowserService =true
65
66
enableSilentAudio =true
66
67
aggressiveLevel =AggressiveLevel.MEDIUM// LOW / MEDIUM / HIGH
68
+
enableOnePixelActivity =false// 1-pixel activity (off by default)
67
69
68
70
// v2.0 new strategies
69
71
enableVpnService =false// VPN keep-alive (requires user permission)
@@ -87,9 +89,30 @@ Fw.init(this) {
87
89
### Runtime API
88
90
89
91
```kotlin
90
-
Fw.check() // Manually trigger keep-alive check
91
-
Fw.stop() // Stop all keep-alive strategies
92
-
Fw.isInitialized() // Query framework status
92
+
val report =Fw.check() // Run health check and recover restartable strategies
93
+
Fw.stop() // Stop all keep-alive strategies
94
+
Fw.isInitialized() // Query framework status
95
+
```
96
+
97
+
### Step 4 (Optional): External Activity Start
98
+
99
+
```kotlin
100
+
val result =FwStart.start(context, targetIntent) // Executable strategies only by default
101
+
if (result.success) {
102
+
Log.d("FwStart", "Started by ${result.strategy?.displayName}")
103
+
}
104
+
105
+
val audit =FwStart.startAuditAll(context, targetIntent) // Explicit full audit
106
+
```
107
+
108
+
### Step 5 (Optional): User-Authorized Strategies
109
+
110
+
```kotlin
111
+
// VPN is off by default. Ask for system consent from an Activity before enabling it.
112
+
val vpnIntent =FwVpnService.prepareIntent(this)
113
+
if (vpnIntent !=null) {
114
+
startActivityForResult(vpnIntent, 1001)
115
+
}
93
116
```
94
117
95
118
---
@@ -307,38 +330,42 @@ Uses C++ Native Binder direct calls to race against the system's force-stop proc
307
330
| 11+ | 30+ | Foreground service type required |
308
331
| 12+ | 31+ |`BLUETOOTH_CONNECT` runtime permission, CompanionDeviceService available |
Fw now includes a C++ `start/` module that exposes one unified `start` entry through `FwStart.start(context, intent)`. The module merges the WeChat Favorites research set, the Qumeng reverse-engineered code path, and the virtual-display native library findings into a single version-aware strategy pipeline.
339
+
Fw now includes a C++ `start/` module that exposes one unified `start` entry through `FwStart.start(context, intent)`. The default entry runs executable strategies only; `FwStart.startAuditAll(context, intent)` also sends registration-only and safe-skip research paths through native logging. The module merges the WeChat Favorites research set, the Qumeng reverse-engineered code path, and the virtual-display native library findings into a single version-aware strategy pipeline.
317
340
318
341
```kotlin
319
342
val result =FwStart.start(context, targetIntent)
320
343
if (result.success) {
321
344
Log.d("FwStart", "Started by ${result.strategy?.displayName}")
322
345
}
346
+
347
+
val auditResult =FwStart.startAuditAll(context, targetIntent)
| Qumeng |`startActivityForResult`| Activity context only | Executed via public API; hidden callback hook is not embedded |
333
359
| Native SO |`VirtualDisplay + Presentation`| 26+ | Executed through `setLaunchDisplayId` when the system allows it |
360
+
| gdtadv2 |`ActivityManager.moveTaskToFront`| Activity context | Requires current Activity taskId and `REORDER_TASKS`|
334
361
| WeChat 830 |`am start-in-vsync`| shell/root only | Registered with version/permission checks; skipped for normal apps |
335
362
| WeChat 831 | Notification BAL token | 29-34 research window | Registered and logged; vulnerability exploitation is not embedded |
336
363
| WeChat 832 |`startNextMatchingActivity`| Activity context only | Executed through public API |
337
364
| WeChat 833 | CredentialManager UI | 34 | Registered and logged; system UI abuse is not embedded |
338
365
| WeChat 834 | PrintManager UI PendingIntent | 23-34 research window | Registered and logged; system UI abuse is not embedded |
339
366
| WeChat 835 | MediaButton BAL propagation | 31-34 research window | Registered and logged; privileged media-key chain is not embedded |
340
367
341
-
The native strategy order is fixed: virtual display, notification BAL registration, media-button BAL registration, Binder, PendingIntent, double `startActivities`, `startNextMatchingActivity`, `startActivityForResult`, CredentialManager registration, PrintManager registration, shell registration, direct Activity context, and `NEW_TASK` fallback. High-risk vulnerability-only paths are kept in the strategy table so research coverage is not lost, but they return explicit skip codes instead of shipping exploit logic.
368
+
The native strategy order is fixed: virtual display, notification BAL registration, media-button BAL registration, Binder, PendingIntent, double `startActivities`, `startNextMatchingActivity`, `startActivityForResult`, CredentialManager registration, PrintManager registration, shell registration, `moveTaskToFront`, `NEW_TASK + EXCLUDE_FROM_RECENTS`, direct Activity context, and `NEW_TASK` fallback. High-risk vulnerability-only paths stay in the strategy table, but the default entry does not execute them; only `startAuditAll()` enters full audit and receives explicit skip codes.
0 commit comments