Skip to content

fix: support secure capture on One UI 8 - #115

Open
nullptroma wants to merge 1 commit into
LSPosed:mainfrom
nullptroma:fix/oneui8-system-server-capture
Open

fix: support secure capture on One UI 8 #115
nullptroma wants to merge 1 commit into
LSPosed:mainfrom
nullptroma:fix/oneui8-system-server-capture

Conversation

@nullptroma

Copy link
Copy Markdown

Fixes screenshots and built-in screen recording for FLAG_SECURE apps on Samsung One UI 8 / Android 16.

  • Hooks Samsung WmScreenshotController policy and secure-content capture path.
  • Returns false from WindowState.isSecureLocked() so secure layers can also be mirrored by Samsung Screen Recorder.

Tested on Galaxy S25 (SM-S931B), One UI 8.5 / Android 16: screenshots and screen recordings work.

Note: this intentionally disables app-level FLAG_SECURE protection globally.

Related to #93

@vvb2060

vvb2060 commented Aug 24, 2026

Copy link
Copy Markdown
Member

FLAG_SECURE should not be disabled, as this will break bank app's security detection.

@nullptroma

Copy link
Copy Markdown
Author

Okay, I’ll try a different approach. And there’s also something specific to Samsung that needs to be tried...

@nullptroma
nullptroma force-pushed the fix/oneui8-system-server-capture branch 4 times, most recently from 8fd79da to e653254 Compare August 24, 2026 14:34
@nullptroma

Copy link
Copy Markdown
Author

Updated the branch with a Samsung-specific approach.

  • Restored the original stack-aware hookWindowState, so FLAG_SECURE is preserved during surface creation.
  • Added One UI 8 WmScreenshotController handling that bypasses only the FLAG_SECURE failure reason, while preserving Samsung MDM policy denial.
  • Added a narrow SystemUI hook for managed-profile screenshots: it clears secureLayer for type == 3 requests but leaves disableCapture unchanged.

The implementation was verified against the matching services.jar, framework.jar, and SystemUI.apk from a Galaxy S25 on One UI 8.5 / Android 16, and tested in both primary and Work Profile.

Screen recording is no longer enabled by this PR

@nullptroma

Copy link
Copy Markdown
Author

Warning: This solution was created with extensive use of AI. I tried to remove unnecessary code and tidy it up, but it most likely still requires the attention of a more experienced developer.

@Howard20181

Copy link
Copy Markdown
Member

Warning: This solution was created with extensive use of AI. I tried to remove unnecessary code and tidy it up, but it most likely still requires the attention of a more experienced developer.

Please upload the JAR files for Samsung system framework and services.

@nullptroma

Copy link
Copy Markdown
Author

https://drive.google.com/file/d/1W7u5juRaKsi0IFKuOgd4PdMid1-1IKP6/view?usp=sharing

I couldn’t upload it directly here because of the GitHub limit.

@Inte-H

Inte-H commented Sep 4, 2026

Copy link
Copy Markdown

I got this working on my s26 ultra (SM-S948N). The PR as-is didn't work for me. It matches methods by name and parameter count, but the screenshot method on the s26u takes 6 parameters, so it never hooks. My fix was to hook the method with a single boolean parameter (the secure-content-policy flag) instead, and that did the trick. I can share my code if anyone's interested, though all of it done with AI help.

@Folusmile

Copy link
Copy Markdown

I got this working on my s26 ultra (SM-S948N). The PR as-is didn't work for me. It matches methods by name and parameter count, but the screenshot method on the s26u takes 6 parameters, so it never hooks. My fix was to hook the method with a single boolean parameter (the secure-content-policy flag) instead, and that did the trick. I can share my code if anyone's interested, though all of it done with AI help.

Can this work on temporary root ..(root my galaxy) s24 ultra without bootloop

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants