fix: request users to grant 'PROJECT_MEDIA' permission on Android 15+ due to new screen sharing restrictions

Author: timschneeb

app/src/main/java/me/timschneeberger/rootlessjamesdsp/activity/MainActivity.kt

@@ -70,6 +70,7 @@ import me.timschneeberger.rootlessjamesdsp.utils.extensions.ContextExtensions.sh
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.ContextExtensions.toast
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.ContextExtensions.unregisterLocalReceiver
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasDumpPermission
+import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasProjectMediaAppOp
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasRecordPermission
 import me.timschneeberger.rootlessjamesdsp.utils.isPlugin
 import me.timschneeberger.rootlessjamesdsp.utils.isRoot
@@ -382,9 +383,7 @@ class MainActivity : BaseActivity() {
             }
         }
 
-        if (isRootless() && SdkCheck.isVanillaIceCream) {
-            showAndroid15Alert()
-        }
+        showAndroid15Alert()
 
         dspFragment.setUpdateCardOnClick { updateManager.installUpdate(this) }
         dspFragment.setUpdateCardOnCloseClick(::dismissUpdate)
@@ -454,6 +453,24 @@ class MainActivity : BaseActivity() {
     }
 
     private fun showAndroid15Alert() {
+        if(!isRootless() || !SdkCheck.isVanillaIceCream)
+            return
+
+        if(!hasProjectMediaAppOp()) {
+            MaterialAlertDialogBuilder(this)
+                .setTitle(R.string.android_15_screenshare_warning_title)
+                .setMessage(R.string.android_15_screenshare_keyguard_warning)
+                .setCancelable(false)
+                .setPositiveButton(R.string.continue_action) { _, _ ->
+                    startActivity(Intent(this, OnboardingActivity::class.java).apply {
+                        putExtra(OnboardingActivity.EXTRA_FIX_PERMS, false)
+                    })
+                    this.finish()
+                }
+                .show()
+            return
+        }
+
         if(prefsVar.get<Boolean>(R.string.key_android15_screenrecord_restriction_seen))
             return
 

app/src/main/java/me/timschneeberger/rootlessjamesdsp/fragment/OnboardingFragment.kt

@@ -38,6 +38,7 @@ import me.timschneeberger.rootlessjamesdsp.utils.extensions.ContextExtensions.sh
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.ContextExtensions.toast
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasDumpPermission
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasNotificationPermission
+import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasProjectMediaAppOp
 import me.timschneeberger.rootlessjamesdsp.utils.extensions.PermissionExtensions.hasRecordPermission
 import me.timschneeberger.rootlessjamesdsp.utils.isRootless
 import me.timschneeberger.rootlessjamesdsp.utils.preferences.Preferences
@@ -443,12 +444,18 @@ class OnboardingFragment : Fragment() {
         goToPage(nextIndex)
     }
 
+    private fun areAdbPermissionsGranted(): Boolean {
+        return requireContext().hasDumpPermission() &&
+                // Android 15+ doesn't allow keyguard recording without PROJECT_MEDIA
+                requireContext().hasProjectMediaAppOp()
+    }
+
     private fun requestNextPage(nextPage: Int, forward: Boolean): Int
     {
         val shouldSkip = when (nextPage) {
             // Don't skip ADB setup if redoAdbSetup is set
-            PAGE_METHOD_SELECT -> requireContext().hasDumpPermission() && !redoAdbSetup
-            PAGE_ADB_SETUP -> requireContext().hasDumpPermission() && !redoAdbSetup
+            PAGE_METHOD_SELECT -> areAdbPermissionsGranted() && !redoAdbSetup
+            PAGE_ADB_SETUP -> areAdbPermissionsGranted() && !redoAdbSetup
             PAGE_RUNTIME_PERMISSIONS -> {
                requireContext().hasNotificationPermission() && requireContext().hasRecordPermission()
             }
@@ -466,19 +473,19 @@ class OnboardingFragment : Fragment() {
     private fun canAccessNextPage(currentPage: Int): Boolean
     {
         return when (currentPage) {
-            PAGE_ADB_SETUP -> ensureDumpPermission()
+            PAGE_ADB_SETUP -> ensureAdbPermissions()
             PAGE_RUNTIME_PERMISSIONS -> ensureRuntimePermissions()
             else -> true
         }
     }
 
-    private fun ensureDumpPermission(): Boolean{
+    private fun ensureAdbPermissions(): Boolean {
         /* Permission already granted?
          * Note: If were are redoing the ADB setup, make sure that the Shizuku setup
          *       can run regardless to grant optional permissions
          */
-        if(requireContext().hasDumpPermission() && (!redoAdbSetup || selectedSetupMethod != SetupMethods.Shizuku)) {
-            Timber.d("DUMP permission granted")
+        if(areAdbPermissionsGranted() && (!redoAdbSetup || selectedSetupMethod != SetupMethods.Shizuku)) {
+            Timber.d("ADB permissions already granted")
             return true
         }
 
@@ -510,55 +517,56 @@ class OnboardingFragment : Fragment() {
 
             // Grant permanent SYSTEM_ALERT_WINDOW op as shell
             try {
-                val result = ShizukuSystemServerApi.AppOpsService_setMode(
+                ShizukuSystemServerApi.AppOpsService_setMode(
                     ShizukuSystemServerApi.APP_OPS_OP_SYSTEM_ALERT_WINDOW,
                     uid,
                     pkg,
                     ShizukuSystemServerApi.APP_OPS_MODE_ALLOW
                 )
-                if(!result)
-                    Timber.e("AppOpsService_setMode for system_alert_window failed")
             }
             catch (ex: Exception) {
                 Timber.e("AppOpsService_setMode for system_alert_window threw an exception")
                 Timber.e(ex)
+                ShizukuSystemServerApi.exec("appops set $pkg SYSTEM_ALERT_WINDOW allow")
             }
 
             // Grant permanent PROJECT_MEDIA op as shell
             try {
-                val result = ShizukuSystemServerApi.AppOpsService_setMode(
+                ShizukuSystemServerApi.AppOpsService_setMode(
                     ShizukuSystemServerApi.APP_OPS_OP_PROJECT_MEDIA,
                     uid,
                     pkg,
                     ShizukuSystemServerApi.APP_OPS_MODE_ALLOW
                 )
-                if(!result)
-                    Timber.e("AppOpsService_setMode failed")
             }
             catch (ex: Exception) {
                 Timber.e("AppOpsService_setMode threw an exception")
                 Timber.e(ex)
+                ShizukuSystemServerApi.exec("appops set $pkg PROJECT_MEDIA allow")
             }
 
             // Re-check permission
-            return if (requireContext().hasDumpPermission()) {
-                Timber.d("DUMP permission via Shizuku granted")
+            return if (areAdbPermissionsGranted()) {
+                Timber.d("ADB permissions via Shizuku granted")
                 true
             } else {
-                Timber.e("DUMP not granted")
+                Timber.e("ADB permissions not granted")
                 requireContext().showAlert(R.string.onboarding_adb_shizuku_no_dump_perm_title,
                     R.string.onboarding_adb_shizuku_no_dump_perm)
-
-                // Fallback just in case
-                @Suppress("DEPRECATION")
-                val proc = Shizuku.newProcess(arrayOf<String>("pm", "grant", pkg, Manifest.permission.DUMP), null, null)
-                proc.waitFor()
                 false
             }
         }
 
-        requireContext().showAlert(R.string.onboarding_adb_dump_not_granted_title,
-            R.string.onboarding_adb_dump_not_granted)
+        // Regular ADB setup
+        if(!requireContext().hasDumpPermission()) {
+            requireContext().showAlert(R.string.onboarding_adb_not_granted_title,
+                R.string.onboarding_adb_dump_permission_not_granted)
+        }
+        else if(!requireContext().hasProjectMediaAppOp()) {
+            requireContext().showAlert(R.string.onboarding_adb_not_granted_title,
+                R.string.onboarding_adb_project_media_not_granted)
+        }
+
         return false
     }
 
@@ -587,8 +595,8 @@ class OnboardingFragment : Fragment() {
         val page = binding.adbSetup
 
         page.step4.isVisible = selectedSetupMethod == SetupMethods.Adb
-        page.step5.isVisible = selectedSetupMethod == SetupMethods.Adb
-        page.step5bOptional.isVisible = selectedSetupMethod == SetupMethods.Adb && isRootless()
+        page.step6.isVisible = selectedSetupMethod == SetupMethods.Adb
+        page.step5b.isVisible = selectedSetupMethod == SetupMethods.Adb && isRootless()
         page.step5cOptional.isVisible = selectedSetupMethod == SetupMethods.Adb && isRootless()
 
         if(selectedSetupMethod == SetupMethods.Shizuku) {
@@ -632,8 +640,8 @@ class OnboardingFragment : Fragment() {
             page.step2.bodyText = getString(R.string.onboarding_adb_manual_step2)
             page.step3.bodyText = getString(R.string.onboarding_adb_manual_step3)
             page.step4.bodyText = getString(R.string.onboarding_adb_manual_step4, requireContext().packageName)
-            page.step5.bodyText = getString(R.string.onboarding_adb_manual_step5)
-            page.step5bOptional.bodyText = getString(R.string.onboarding_adb_manual_step5b, requireContext().packageName)
+            page.step6.bodyText = getString(R.string.onboarding_adb_manual_step5)
+            page.step5b.bodyText = getString(R.string.onboarding_adb_manual_step5b_required, requireContext().packageName)
             page.step5cOptional.bodyText = getString(R.string.onboarding_adb_manual_step5c, requireContext().packageName)
 
             page.title.text = getString(R.string.onboarding_adb_adb_title)

app/src/main/res/drawable/ic_numeric_6_circle_outline.xml

@@ -0,0 +1,8 @@
+<!-- drawable/numeric_6_circle_outline.xml -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android" android:height="24dp" android:width="24dp" android:viewportWidth="24" android:viewportHeight="24">
+    <path android:fillAlpha="0.3"
+        android:fillColor="@android:color/white"
+        android:pathData="M12,12m-8,0a8,8 0,1 1,16 0a8,8 0,1 1,-16 0" android:strokeAlpha="0.3"/>
+    <path android:fillColor="@android:color/white"
+        android:pathData="M11,7H15V9H11V11H13A2,2 0 0,1 15,13V15A2,2 0 0,1 13,17H11A2,2 0 0,1 9,15V9A2,2 0 0,1 11,7M11,13V15H13V13H11M12,2A10,10 0 0,1 22,12A10,10 0 0,1 12,22A10,10 0 0,1 2,12A10,10 0 0,1 12,2M12,4A8,8 0 0,0 4,12A8,8 0 0,0 12,20A8,8 0 0,0 20,12A8,8 0 0,0 12,4Z" />
+</vector>

app/src/main/res/layout/onboarding_page4.xml

@@ -88,12 +88,12 @@
                 app:iconTint="?attr/colorOnSurface" />
 
             <me.timschneeberger.rootlessjamesdsp.view.Card
-                android:id="@+id/step5b_optional"
+                android:id="@+id/step5b"
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
                 android:visibility="gone"
                 app:cardMargin="8dp"
-                app:iconSrc="@drawable/ic_twotone_info_24dp"
+                app:iconSrc="@drawable/ic_numeric_5_circle_outline"
                 app:iconTint="?attr/colorOnSurface" />
 
 
@@ -107,12 +107,12 @@
                 app:iconTint="?attr/colorOnSurface" />
 
             <me.timschneeberger.rootlessjamesdsp.view.Card
-                android:id="@+id/step5"
+                android:id="@+id/step6"
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
                 android:visibility="gone"
                 app:cardMargin="8dp"
-                app:iconSrc="@drawable/ic_numeric_5_circle_outline"
+                app:iconSrc="@drawable/ic_numeric_6_circle_outline"
                 app:iconTint="?attr/colorOnSurface" />
         </LinearLayout>
 

app/src/main/res/values/strings.xml

@@ -54,6 +54,7 @@
     <string name="success">Success</string>
     <string name="open">Open</string>
     <string name="close">Close</string>
+    <string name="continue_action">Continue</string>
     <string name="tutorial">Tutorial</string>
     <string name="never_show_warning_again">Never show this warning again</string>
     <string name="delete">Delete</string>
@@ -236,14 +237,15 @@
     <string name="onboarding_adb_shizuku_grant_fail_denied">Please grant this application access to Shizuku. You may need to open Shizuku\'s permission manager and grant the permission manually if you previously denied it and the popup no longer shows.</string>
     <string name="onboarding_adb_shizuku_no_dump_perm_title">Shizuku failed to grant ADB permissions</string>
     <string name="onboarding_adb_shizuku_no_dump_perm">Please wait a few seconds and try again. If it still does not work, try the alternative method.</string>
-    <string name="onboarding_adb_dump_not_granted_title">Permission not yet granted</string>
-    <string name="onboarding_adb_dump_not_granted">Please follow the instructions first and try again. The ADB access is not yet set-up properly.</string>
+    <string name="onboarding_adb_not_granted_title">Permission not yet granted</string>
+    <string name="onboarding_adb_dump_permission_not_granted">Please follow the instructions first and try again. The DUMP permission has not been granted.</string>
+    <string name="onboarding_adb_project_media_not_granted">Please follow the instructions first and try again. The PROJECT_MEDIA permission has not been granted.</string>
     <string name="onboarding_adb_manual_step1">Go to Android\'s hidden development settings and enable USB debugging. You need to unlock these settings by tapping the build number in the system settings several times.</string>
     <string name="onboarding_adb_manual_step2">Open https://app.webadb.com in your computer\'s browser (works best in Chrome) and connect your device using USB to the computer.</string>
     <string name="onboarding_adb_manual_step3">Add and connect the USB device in WebADB.</string>
     <string name="onboarding_adb_manual_step4">Navigate to \'Interactive Shell\' and execute the following command in the shell: \'pm grant %s android.permission.DUMP\'</string>
     <string name="onboarding_adb_manual_step5">Tap \'Next\' in this app to continue.</string>
-    <string name="onboarding_adb_manual_step5b">(Optional) You can permanently skip the audio capture permission prompts by executing this command: \'appops set %s PROJECT_MEDIA allow\'</string>
+    <string name="onboarding_adb_manual_step5b_required">Execute the following command to grant permanent permission to project audio: \'appops set %s PROJECT_MEDIA allow\'</string>
     <string name="onboarding_adb_manual_step5c">(Optional) In addition to the previous step, you can also enable auto-start by executing the following command: \'appops set %s SYSTEM_ALERT_WINDOW allow\'</string>
     <string name="onboarding_adb_manual_step1_button">Open development settings</string>
 
@@ -659,5 +661,7 @@ Even though this app only records system audio, it is still affected by this res
 
 To workaround this issue, you can enable \'Disable screen share protections\' in the system developer settings.
 Tap on \'Tutorial\' below for detailed instructions.</string>
+    <string name="android_15_screenshare_keyguard_warning">Android 15 introduces a restriction that stops screen sharing when the device is locked. To workaround this issue, the \'PROJECT_MEDIA\' permission must be granted using Shizuku or ADB.
 
+Please press \'Continue\' below to re-do the setup wizard.</string>
 </resources>

hidden-api-impl/src/main/java/me/timschneeberger/hiddenapi_impl/ShizukuSystemServerApi.java

@@ -68,7 +68,7 @@ else if (Build.VERSION.SDK_INT == 34) {
         }
     }
 
-    private static synchronized void exec(String cmd) {
+    public static synchronized void exec(String cmd) {
         try {
             Method newProcess = Shizuku.class.getDeclaredMethod("newProcess", String[].class, String[].class, String.class);
             newProcess.setAccessible(true);
@@ -94,7 +94,7 @@ private static synchronized void exec(String cmd) {
     public static final String APP_OPS_OP_PROJECT_MEDIA = "PROJECT_MEDIA";
     public static final String APP_OPS_OP_SYSTEM_ALERT_WINDOW = "SYSTEM_ALERT_WINDOW";
 
-    public static boolean AppOpsService_setMode(String op, int packageUid, String packageName, String mode) throws RemoteException {
+    public static void AppOpsService_setMode(String op, int packageUid, String packageName, String mode) throws RemoteException {
         int index = -1;
 
         try {
@@ -117,18 +117,20 @@ public static boolean AppOpsService_setMode(String op, int packageUid, String pa
                     .getMethod("strOpToOp", String.class);
 
             opIndex = (int) method.invoke(null, op);
-        }
-        catch(Exception ignored) {}
-        try {
-            Method method = Class.forName("android.app.AppOpsManager")
-                    .getMethod("strDebugOpToOp", String.class);
+        } catch (Exception e) {
+            Log.e("ShizukuSystemServerApi", "Failed to get op index via strOpToOp");
 
-            opIndex = (int) method.invoke(null, op);
-        }
-        catch(Exception ignored) {}
+            try {
+                Method methodDbg = Class.forName("android.app.AppOpsManager")
+                        .getMethod("strDebugOpToOp", String.class);
 
-        if(index < 0 || opIndex < 0)
-            return false;
+                opIndex = (int) methodDbg.invoke(null, op);
+            }
+            catch (Exception ex) {
+                Log.e("ShizukuSystemServerApi", "Failed to get op index via strDebugOpToOp");
+                throw new RuntimeException(e);
+            }
+        }
 
         try {
             APP_OPS_SERVICE.getOrThrow().setMode(
@@ -140,10 +142,8 @@ public static boolean AppOpsService_setMode(String op, int packageUid, String pa
         }
         catch(NullPointerException ex) {
             Log.e("ShizukuSystemServerApi", "Failed to call app ops service");
-            return false;
+            throw new RuntimeException(ex);
         }
-
-        return true;
     }
 
     public static void AudioPolicyService_setAllowedCapturePolicy(int uid, CapturePolicy capturePolicy) {