[Google Pixel XL Guides, News, & Discussion] Fenny:
This thread is about hiding root. Feel free to discuss anything ranging from MagiskHide to suhide. See the suhide patching instructions below.

Introduction:

With the November security patches, Google back-ported a security feature that allows only a certain whitelist of filesystem sockets to be used.

This is the same feature that prevents suhide from working.

This particular commit is here:

https://android.googlesource.com/pl...8be33b0bedec211708c4525b9d3f3b4effb385c^!/#F0

If you are building CM or AOSP, all you need to do is revert this commit.

However, for binary builds a more direct patching approach is needed.

As I said earlier:

ARM

Let me get into a bit more detail, and we can start with the error message that zygote spits out with an unpatched version of the file:

"Unable to construct file descriptor table"

We see that in the commit here:

+ // Close any logging related FDs before we start evaluating the list of
+ // file descriptors.
+ __android_log_close();
+
+ // If this is the first fork for this zygote, create the open FD table.
+ // If it isn't, we just need to check whether the list of open files has
+ // changed (and it shouldn't in the normal case).
+ if (gOpenFdTable == NULL) {
+ gOpenFdTable = FileDescriptorTable::Create();
+ if (gOpenFdTable == NULL) {
+ RuntimeAbort(env, __LINE__, "Unable to construct file descriptor table.");
+ }
+ } else if (!gOpenFdTable->Restat()) {
+ RuntimeAbort(env, __LINE__, "Unable to restat file descriptor table.");
+ }
+
pid_t pid = fork();

When searching for references to the string in the disassembly of the file:

.text:000C8CC8 ADD R2, PC ; "Unable to construct file descriptor tab"...
.text:000C8CCA B loc_C8CDE
.text:000C8CCC BL sub_C845C
.text:000C8CD0 CBNZ R0, loc_C8CE2
.text:000C8CD2 LDR.W R2, =(aUnableToRestat - 0xC8CE0)
.text:000C8CD6 MOV R0, R4
.text:000C8CD8 MOV.W R1, #0x1D6
.text:000C8CDC ADD R2, PC ; "Unable to restat file descriptor table."
.text:000C8CDE BL sub_C873C
.text:000C8CE2 BLX fork

So, we're looking at the instruction "BL sub_C873C" as "RuntimeAbort" we know it's the right one because it is a conditional call just before the fork.

Which in hex is:

FF F7 2D FD

The simplest patch is to remove the function call entirely by replacing this with the arm equivalent of nop.

00 00 00 00

However, that breaks things because the file descriptor variable now contains a null where a reference should be.

.text:000C8D08 LDR.W R0, [R12]
.text:000C8D0C LDR.W R9, [R0,#8] ; <- Crash happens here.
.text:000C8D10 CMP.W R9, #0
.text:000C8D14 BEQ loc_C8D38

Hex:

DC F8 00 00 D0 F8 08 90 B9 F1 00 0F

So, since we always need to take the BEQ branch, we're going to replace the whole lot of functions with:

.text:000C8D08 MOVS R0, #0
.text:000C8D0A MOVS R0, #0
.text:000C8D0C MOVS R0, #0
.text:000C8D0E MOVS R0, #0
.text:000C8D10 MOVS R0, #0
.text:000C8D12 CMP R0, #0

Hex:

00 20 00 20 00 20 00 20 00 20 00 28

ARM64

The ARM64 patches are the same idea, but different opcodes:

In this example sub_881B8 calls our RuntimeAbort function, so first we nop out the call to that.

Replace:

.text:000000000014EF8C ADD X2, X27, #aSocketNameNotW@PAGEOFF ; "Socket name not whitelisted : %s (fd=%d"...
.text:000000000014EF90 MOV W4, W20
.text:000000000014EF94 MOV W0, #6
.text:000000000014EF98 MOV X19, #0
[B].text:000000000014EF9C BL sub_881B8[/B]
.text:000000000014EFA0 B loc_14ECA0

Hex:

87 E4 FC 97

Replace with:

.text:000000000014EF8C ADD X2, X27, #aSocketNameNotW@PAGEOFF ; "Socket name not whitelisted : %s (fd=%d"...
.text:000000000014EF90 MOV W4, W20
.text:000000000014EF94 MOV W0, #6
.text:000000000014EF98 MOV X19, #0
[B].text:000000000014EF9C NOP[/B]
.text:000000000014EFA0 B loc_14ECA0

Hex:

1F 20 03 D5

Next, we patch away the crash:

We want to take the CBZ X23, loc_151AC0 jump.

Replace:

.text:00000000001510CC ADRP X9, #qword_1CB1B8@PAGE
.text:00000000001510D0 LDR X10, [X9,#qword_1CB1B8@PAGEOFF]
[B].text:00000000001510D4 LDR X23, [X10,#0x10][/B]
.text:00000000001510D8 CBZ X23, loc_151AC0
.text:00000000001510DC LDR X19, [X23,#0x18]
.text:00000000001510E0 CBZ X19, loc_1511F4
.text:00000000001510E4 BL sub_88468
.text:00000000001510E8 MOV X22, X0
.text:00000000001510EC ADRP X11, #aDevNull@PAGE ; "/dev/null"
.text:00000000001510F0 ADD X24, X11, #aDevNull@PAGEOFF ; "/dev/null"
.text:00000000001510F4 B loc_151174

Hex:

57 09 40 F9

Replace with:

.text:00000000001510CC ADRP X9, #qword_1CB1B8@PAGE
.text:00000000001510D0 LDR X10, [X9,#qword_1CB1B8@PAGEOFF]
[B].text:00000000001510D4 MOV X23, #0[/B]
.text:00000000001510D8 CBZ X23, loc_151AC0
.text:00000000001510DC LDR X19, [X23,#0x18]
.text:00000000001510E0 CBZ X19, loc_1511F4
.text:00000000001510E4 BL sub_88468
.text:00000000001510E8 MOV X22, X0
.text:00000000001510EC ADRP X11, #aDevNull@PAGE ; "/dev/null"
.text:00000000001510F0 ADD X24, X11, #aDevNull@PAGEOFF ; "/dev/null"
.text:00000000001510F4 B loc_151174

Hex:

17 00 80 D2

Finally, nop out the second call to RuntimeAbort (ARM optimized these two calls into one, whereas arm64 split them into two subfunctions.)

Replace:

.text:0000000000151AAC MOV X0, X25
.text:0000000000151AB0 MOV W1, #0x1D3
.text:0000000000151AB4 ADD X2, X4, #aUnableToConstr@PAGEOFF ; "Unable to construct file descriptor tab"...
[B].text:0000000000151AB8 BL sub_150264[/B]
.text:0000000000151ABC B loc_150F10

Hex:

EB F9 FF 97

Replace with:

.text:0000000000151AAC MOV X0, X25
.text:0000000000151AB0 MOV W1, #0x1D3
.text:0000000000151AB4 ADD X2, X4, #aUnableToConstr@PAGEOFF ; "Unable to construct file descriptor tab"...
[B].text:0000000000151AB8 NOP[/B]
.text:0000000000151ABC B loc_150F10

1F 20 03 D5

TL;DR

I have this working on 7.1/7.1.1.

The gist:

Patching ART binaries required. System modification required. (can't bind mount modified ART or suhide breaks).

Known issues:

UI prompts to allow new or updated root apps do not display when suhide is enabled. (7.1.1+)

SuperSU 2.79 SR1 and above use incompatible selinux contexts with Suhide 0.55 and below.

Downloads:

Here are a couple patched versions:

libandroid_runtime_pixelxl_NDE63V.tar

libandroid_runtime_pixelxl_NMF26O.tar

libandroid_runtime_pixelxl_NMF26Q.tar

libandroid_runtime_pixelxl_NOF26V.tar (Reported working with NOF27B/C, N2G47E/J/K)

You WILL need to match your builds up.