Add v21.0 release notes

Update Magisk Manager app translation
 - Korean translation updated
(Translation based on "en" strings.xml)

.gitattributes

@@ -17,3 +17,8 @@ tools/** binary
 *.apk binary
 *.png binary
 *.jpg binary
+*.ttf binary
+
+# Help GitHub detect languages
+native/jni/external/** linguist-vendored
+native/jni/systemproperties/** linguist-language=C++

.gitmodules

@@ -22,6 +22,9 @@
 [submodule "mincrypt"]
 	path = native/jni/external/mincrypt
 	url = https://github.com/topjohnwu/mincrypt.git
+[submodule "pcre"]
+	path = native/jni/external/pcre
+	url = https://android.googlesource.com/platform/external/pcre
 [submodule "termux-elf-cleaner"]
 	path = tools/termux-elf-cleaner
 	url = https://github.com/termux/termux-elf-cleaner.git

README.MD

@@ -1,34 +1,70 @@
-# Magisk
+![](docs/images/logo.png)
 
-[Downloads](https://github.com/topjohnwu/Magisk/releases) \| [Documentation](https://topjohnwu.github.io/Magisk/) \| [XDA Thread](https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445)
+![ZIP Downloads](https://img.shields.io/badge/dynamic/json?color=blue&label=ZIP%20Downloads&query=magisk&url=https%3A%2F%2Fraw.githubusercontent.com%2Ftopjohnwu%2Fmagisk_files%2Fcount%2Fcount.json&cacheSeconds=1800)
+![APK Downloads](https://img.shields.io/badge/dynamic/json?color=green&label=APK%20Downloads&query=manager&url=https%3A%2F%2Fraw.githubusercontent.com%2Ftopjohnwu%2Fmagisk_files%2Fcount%2Fcount.json&cacheSeconds=1800)
 
 ## Introduction
 
-Magisk is a suite of open source tools for customizing Android, supporting devices higher than Android 4.2 (API 17). It covers the fundamental parts for Android customization: root, boot scripts, SELinux patches, AVB2.0 / dm-verity / forceencrypt removals etc.
+Magisk is a suite of open source tools for customizing Android, supporting devices higher than Android 4.2. It covers fundamental parts of Android customization: root, boot scripts, SELinux patches, AVB2.0 / dm-verity / forceencrypt removals etc.
 
-Furthermore, Magisk provides a **Systemless Interface** to alter the system (or vendor) arbitrarily while the actual partitions stay completely intact. With its systemless nature along with several other hacks, Magisk can hide modifications from nearly any system integrity verifications used in banking apps, corporation monitoring apps, game cheat detections, and most importantly [Google's SafetyNet API](https://developer.android.com/training/safetynet/index.html).
+Here are some feature highlights:
+
+- **MagiskSU**: Provide root access to your device
+- **Magisk Modules**: Modify read-only partitions by installing modules
+- **MagiskHide**: Hide Magisk from root detections / system integrity checks
+
+## Downloads
+
+[![](https://img.shields.io/badge/Magisk%20Manager-v7.5.1-green)](https://github.com/topjohnwu/Magisk/releases/download/manager-v7.5.1/MagiskManager-v7.5.1.apk)
+[![](https://img.shields.io/badge/Magisk%20Manager-Canary-red)](https://raw.githubusercontent.com/topjohnwu/magisk_files/canary/app-debug.apk)
+<br>
+[![](https://img.shields.io/badge/Magisk-v20.4-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v20.4)
+[![](https://img.shields.io/badge/Magisk%20Beta-v20.4-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v20.4)
+
+## Useful Links
+
+- [Installation Instruction](https://topjohnwu.github.io/Magisk/install.html)
+- [Frequently Asked Questions](https://topjohnwu.github.io/Magisk/faq.html)
+- [Full Official Docs](https://topjohnwu.github.io/Magisk/)
+- [Magisk Troubleshoot Wiki](https://www.didgeridoohan.com/magisk/HomePage) (by [@Didgeridoohan](https://github.com/Didgeridoohan))
+
+## Android Version Support
+
+- Android 4.2+: MagiskSU and Magisk Modules Only
+- Android 4.4+: All core features available
+- Android 6.0+: Guaranteed MagiskHide support
+- Android 7.0+: Full MagiskHide protection
+- Android 9.0+: Magisk Manager stealth mode
 
 ## Bug Reports
 
-**Make sure to install the latest [Canary Build](https://forum.xda-developers.com/apps/magisk/dev-magisk-canary-channel-bleeding-edge-t3839337) before reporting any bugs!** **DO NOT** report bugs that are already fixed upstream. Follow the instructions in the [Canary Channel XDA Thread](https://forum.xda-developers.com/apps/magisk/dev-magisk-canary-channel-bleeding-edge-t3839337), and report a bug either by [opening an issue on GitHub](https://github.com/topjohnwu/Magisk/issues) or directly in the thread.
+Canary Channels are cutting edge builds for those adventurous. To access canary builds, install the Canary Magisk Manager, switch to the Canary Channel in settings and upgrade.
 
-## Building Environment Requirements
+**Only bug reports from Canary builds will be accepted.**
 
--  Python 3: run `build.py` script
--  Java Development Kit (JDK) 8: Compile Magisk Manager and sign zips
--  Latest Android SDK: set `ANDROID_HOME` environment variable to the path to Android SDK
--  Android NDK: Install NDK along with SDK (`$ANDROID_HOME/ndk-bundle`), or optionally specify a custom path `ANDROID_NDK_HOME`
--  (Windows Only) Python package Colorama: Install with `pip install colorama`, used for ANSI color codes
+For installation issues, upload both boot image and install logs.<br>
+For Magisk issues, upload boot logcat or dmesg.<br>
+For Magisk Manager crashes, record and upload the logcat when the crash occurs.
 
-## Building Notes and Instructions
+## Building and Development
 
--  Clone sources with submodules: `git clone --recurse-submodules https://github.com/topjohnwu/Magisk.git`
--  Building is supported on macOS, Linux, and Windows. Official releases are built and tested with [FrankeNDK](https://github.com/topjohnwu/FrankeNDK); point `ANDROID_NDK_HOME` to FrankeNDK if you want to use it for compiling.
--  Set configurations in `config.prop`. A sample file `config.prop.sample` is provided as an example.
--  Run `build.py` with argument `-h` to see the built-in help message. The `-h` option also works for each supported actions, e.g. `./build.py binary -h`
--  By default, `build.py` build binaries and Magisk Manager in debug mode. If you want to build Magisk Manager in release mode (via the `-r, --release` flag), you need a Java Keystore file `release-key.jks` (only `JKS` format is supported) to sign APKs and zips. For more information, check out [Google's Official Documentation](https://developer.android.com/studio/publish/app-signing.html#signing-manually).
+- Magisk builds on any OS Android Studio supports. Install Android Studio and do the initial setups.
+- Clone sources: `git clone --recurse-submodules https://github.com/topjohnwu/Magisk.git`
+- Install Python 3.6+ \
+(Windows only: select **'Add Python to PATH'** in installer, and run `pip install colorama` after install)
+- Configure to use the JDK bundled in Android Studio:
+	- macOS: `export JAVA_HOME="/Applications/Android Studio.app/Contents/jre/jdk/Contents/Home"`
+	- Linux: `export PATH="/path/to/androidstudio/jre/bin:$PATH"`
+	- Windows: Add `C:\Path\To\Android Studio\jre\bin` to environment variable `PATH`
+- Set environment variable `ANDROID_HOME` to the Android SDK folder (can be found in Android Studio settings)
+- Run `./build.py ndk` to let the script download and install NDK for you
+- Set configurations in `config.prop`. A sample `config.prop.sample` is provided.
+- To start building, run `build.py` to see your options. \
+For each action, use `-h` to access help (e.g. `./build.py all -h`)
+- To start development, open the project in Android Studio. Both app (Kotlin/Java) and native (C++/C) source code can be properly developed using the IDE, but *always* use `build.py` for building.
+- `build.py` builds in debug mode by default. If you want release builds (with `-r, --release`), you need a Java Keystore to sign APKs and zips. For more information, check [Google's Documentation](https://developer.android.com/studio/publish/app-signing.html#generate-key).
 
-## Translations
+## Translation Contributions
 
 Default string resources for Magisk Manager and its stub APK are located here:
 
@@ -37,27 +73,6 @@ Default string resources for Magisk Manager and its stub APK are located here:
 
 Translate each and place them in the respective locations (`[module]/src/main/res/values-[lang]/strings.xml`).
 
-## Signature Verification
-
-Official release zips and APKs are signed with my personal private key. You can verify the key certificate to make sure the binaries you downloaded are not manipulated in anyway.
-
-``` bash
-# Use the keytool command from JDK to print certificates
-keytool -printcert -jarfile <APK or Magisk zip>
-
-# The output should contain the following signature
-Owner: CN=John Wu, L=Taipei, C=TW
-Issuer: CN=John Wu, L=Taipei, C=TW
-Serial number: 50514879
-Valid from: Sun Aug 14 13:23:44 EDT 2016 until: Tue Jul 21 13:23:44 EDT 2116
-Certificate fingerprints:
-	 MD5:  CE:DA:68:C1:E1:74:71:0A:EF:58:89:7D:AE:6E:AB:4F
-	 SHA1: DC:0F:2B:61:CB:D7:E9:D3:DB:BE:06:0B:2B:87:0D:46:BB:06:02:11
-	 SHA256: B4:CB:83:B4:DA:D9:9F:99:7D:BE:87:2F:01:3A:A1:6C:14:EE:C4:1D:16:70:21:F3:71:F7:E1:33:0F:27:3E:E6
-	 Signature algorithm name: SHA256withRSA
-	 Version: 3
-```
-
 ## License
 
     Magisk, including all git submodules are free software:

app/build.gradle

@@ -1,135 +0,0 @@
-apply plugin: 'com.android.application'
-apply plugin: 'kotlin-android'
-apply plugin: 'kotlin-android-extensions'
-apply plugin: 'kotlin-kapt'
-
-kapt {
-    correctErrorTypes = true
-    useBuildCache = true
-    mapDiagnosticLocations = true
-    javacOptions {
-        option("-Xmaxerrs", 1000)
-    }
-}
-
-android {
-    defaultConfig {
-        applicationId 'com.topjohnwu.magisk'
-        vectorDrawables.useSupportLibrary = true
-        multiDexEnabled true
-        versionName props['appVersion']
-        versionCode props['appVersionCode'] as Integer
-    }
-
-    buildTypes {
-        release {
-            minifyEnabled true
-            shrinkResources true
-            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'),
-                    'proguard-rules.pro', 'proguard-kotlin.pro'
-        }
-    }
-
-    dataBinding {
-        enabled = true
-    }
-
-    packagingOptions {
-        exclude '/META-INF/**'
-        exclude '/androidsupportmultidexversion.txt'
-        exclude '/org/bouncycastle/**'
-        exclude '/kotlin/**'
-        exclude '/kotlinx/**'
-        exclude '/okhttp3/**'
-    }
-
-    kotlinOptions {
-        jvmTarget = '1.8'
-    }
-}
-
-androidExtensions {
-    experimental = true
-}
-
-dependencies {
-    implementation fileTree(include: ['*.jar'], dir: 'libs')
-    implementation project(':shared')
-    implementation project(':signing')
-
-    implementation 'com.github.topjohnwu:jtar:1.0.0'
-    implementation 'com.jakewharton.timber:timber:4.7.1'
-    implementation 'com.ncapdevi:frag-nav:3.2.0'
-    implementation 'com.github.pwittchen:reactivenetwork-rx2:3.0.6'
-
-    implementation 'io.reactivex.rxjava2:rxjava:2.2.13'
-    implementation 'io.reactivex.rxjava2:rxkotlin:2.4.0'
-    implementation 'io.reactivex.rxjava2:rxandroid:2.1.1'
-
-    implementation "org.jetbrains.kotlin:kotlin-stdlib:${vKotlin}"
-    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:${vKotlin}"
-
-    def vBAdapt = '3.1.1'
-    def bindingAdapter = 'me.tatarka.bindingcollectionadapter2:bindingcollectionadapter'
-    implementation "${bindingAdapter}:${vBAdapt}"
-    implementation "${bindingAdapter}-recyclerview:${vBAdapt}"
-
-    def vMarkwon = '4.2.0'
-    implementation "io.noties.markwon:core:${vMarkwon}"
-    implementation "io.noties.markwon:html:${vMarkwon}"
-    implementation "io.noties.markwon:image:${vMarkwon}"
-    implementation 'com.caverock:androidsvg:1.4'
-
-    def vLibsu = '2.5.1'
-    implementation "com.github.topjohnwu.libsu:core:${vLibsu}"
-    implementation "com.github.topjohnwu.libsu:io:${vLibsu}"
-
-    def vKoin = '2.0.1'
-    implementation "org.koin:koin-core:${vKoin}"
-    implementation "org.koin:koin-android:${vKoin}"
-    implementation "org.koin:koin-androidx-viewmodel:${vKoin}"
-
-    def vRetrofit = '2.6.2'
-    implementation "com.squareup.retrofit2:retrofit:${vRetrofit}"
-    implementation "com.squareup.retrofit2:converter-moshi:${vRetrofit}"
-    implementation "com.squareup.retrofit2:converter-scalars:${vRetrofit}"
-    implementation "com.squareup.retrofit2:adapter-rxjava2:${vRetrofit}"
-
-    def vOkHttp = '3.12.6'
-    implementation "com.squareup.okhttp3:okhttp:${vOkHttp}"
-    implementation "com.squareup.okhttp3:logging-interceptor:${vOkHttp}"
-
-    def vMoshi = '1.9.2'
-    implementation "com.squareup.moshi:moshi:${vMoshi}"
-
-    def vKotshi = '2.0.2'
-    implementation "se.ansman.kotshi:api:${vKotshi}"
-    kapt "se.ansman.kotshi:compiler:${vKotshi}"
-
-    modules {
-        module('androidx.room:room-runtime') {
-            replacedBy('com.github.topjohnwu:room-runtime')
-        }
-    }
-    def vRoom = '2.2.2'
-    implementation "com.github.topjohnwu:room-runtime:${vRoom}"
-    implementation "androidx.room:room-rxjava2:${vRoom}"
-    kapt "androidx.room:room-compiler:${vRoom}"
-
-    def vNav = '2.1.0'
-    implementation "androidx.navigation:navigation-fragment-ktx:${vNav}"
-    implementation "androidx.navigation:navigation-ui-ktx:${vNav}"
-
-    implementation 'androidx.biometric:biometric:1.0.0'
-    implementation 'androidx.constraintlayout:constraintlayout:1.1.3'
-    implementation 'androidx.swiperefreshlayout:swiperefreshlayout:1.1.0-alpha03'
-    implementation 'androidx.preference:preference:1.1.0'
-    implementation 'androidx.recyclerview:recyclerview:1.1.0'
-    implementation 'androidx.fragment:fragment-ktx:1.2.0-rc03'
-    implementation 'androidx.cardview:cardview:1.0.0'
-    implementation 'androidx.work:work-runtime:2.2.0'
-    implementation 'androidx.transition:transition:1.3.0-rc02'
-    implementation 'androidx.multidex:multidex:2.0.1'
-    implementation 'androidx.core:core-ktx:1.1.0'
-    implementation 'com.google.android.material:material:1.2.0-alpha02'
-}

app/build.gradle.kts

@@ -0,0 +1,147 @@
+plugins {
+    id("com.android.application")
+    kotlin("android")
+    kotlin("android.extensions")
+    kotlin("kapt")
+    id("androidx.navigation.safeargs.kotlin")
+}
+
+kapt {
+    correctErrorTypes = true
+    useBuildCache = true
+    mapDiagnosticLocations = true
+    javacOptions {
+        option("-Xmaxerrs", 1000)
+    }
+}
+
+android {
+    defaultConfig {
+        applicationId = "com.topjohnwu.magisk"
+        vectorDrawables.useSupportLibrary = true
+        multiDexEnabled = true
+        versionName = Config["appVersion"]
+        versionCode = Config["appVersionCode"]?.toInt()
+        buildConfigField("int", "LATEST_MAGISK", Config["versionCode"] ?: "Integer.MAX_VALUE")
+
+        javaCompileOptions.annotationProcessorOptions.arguments(
+                mapOf("room.incremental" to "true")
+        )
+    }
+
+    buildTypes {
+        getByName("release") {
+            isMinifyEnabled = true
+            isShrinkResources = true
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro"
+            )
+        }
+    }
+
+    buildFeatures {
+        dataBinding = true
+    }
+
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
+
+    packagingOptions {
+        exclude("/META-INF/**")
+        exclude("/androidsupportmultidexversion.txt")
+        exclude("/org/bouncycastle/**")
+        exclude("/kotlin/**")
+        exclude("/kotlinx/**")
+        exclude("/okhttp3/**")
+    }
+
+    kotlinOptions {
+        jvmTarget = "1.8"
+    }
+}
+
+androidExtensions {
+    isExperimental = true
+}
+
+val copyUtils = tasks.register("copyUtils", Copy::class) {
+    from(rootProject.file("scripts/util_functions.sh"))
+    into("src/main/res/raw")
+}
+
+tasks["preBuild"]?.dependsOn(copyUtils)
+
+dependencies {
+    implementation(fileTree(mapOf("dir" to "libs", "include" to listOf("*.jar"))))
+    implementation(kotlin("stdlib"))
+    implementation(project(":app:shared"))
+    implementation(project(":app:signing"))
+
+    implementation("com.github.topjohnwu:jtar:1.0.0")
+    implementation("com.github.topjohnwu:indeterminate-checkbox:1.0.7")
+    implementation("com.jakewharton.timber:timber:4.7.1")
+
+    val vBAdapt = "4.0.0"
+    val bindingAdapter = "me.tatarka.bindingcollectionadapter2:bindingcollectionadapter"
+    implementation("${bindingAdapter}:${vBAdapt}")
+    implementation("${bindingAdapter}-recyclerview:${vBAdapt}")
+
+    val vMarkwon = "4.6.0"
+    implementation("io.noties.markwon:core:${vMarkwon}")
+    implementation("io.noties.markwon:html:${vMarkwon}")
+    implementation("io.noties.markwon:image:${vMarkwon}")
+    implementation("com.caverock:androidsvg:1.4")
+
+    val vLibsu = "3.0.2"
+    implementation("com.github.topjohnwu.libsu:core:${vLibsu}")
+    implementation("com.github.topjohnwu.libsu:io:${vLibsu}")
+
+    val vKoin = "2.1.6"
+    implementation("org.koin:koin-core:${vKoin}")
+    implementation("org.koin:koin-android:${vKoin}")
+    implementation("org.koin:koin-androidx-viewmodel:${vKoin}")
+
+    val vRetrofit = "2.9.0"
+    implementation("com.squareup.retrofit2:retrofit:${vRetrofit}")
+    implementation("com.squareup.retrofit2:converter-moshi:${vRetrofit}")
+    implementation("com.squareup.retrofit2:converter-scalars:${vRetrofit}")
+
+    val vOkHttp = "3.12.12"
+    implementation("com.squareup.okhttp3:okhttp") {
+        version {
+            strictly(vOkHttp)
+        }
+    }
+    implementation("com.squareup.okhttp3:logging-interceptor:${vOkHttp}")
+    implementation("com.squareup.okhttp3:okhttp-dnsoverhttps:${vOkHttp}")
+
+    val vMoshi = "1.10.0"
+    implementation("com.squareup.moshi:moshi:${vMoshi}")
+    kapt("com.squareup.moshi:moshi-kotlin-codegen:${vMoshi}")
+
+    val vRoom = "2.2.5"
+    implementation("androidx.room:room-runtime:${vRoom}")
+    implementation("androidx.room:room-ktx:${vRoom}")
+    kapt("androidx.room:room-compiler:${vRoom}")
+
+    val vNav: String by rootProject.extra
+    implementation("androidx.navigation:navigation-fragment-ktx:${vNav}")
+    implementation("androidx.navigation:navigation-ui-ktx:${vNav}")
+
+    implementation("androidx.biometric:biometric:1.0.1")
+    implementation("androidx.constraintlayout:constraintlayout:2.0.1")
+    implementation("androidx.swiperefreshlayout:swiperefreshlayout:1.1.0")
+    implementation("androidx.browser:browser:1.2.0")
+    implementation("androidx.preference:preference:1.1.1")
+    implementation("androidx.recyclerview:recyclerview:1.1.0")
+    implementation("androidx.fragment:fragment-ktx:1.2.5")
+    implementation("androidx.work:work-runtime-ktx:2.4.0")
+    implementation("androidx.transition:transition:1.3.1")
+    implementation("androidx.multidex:multidex:2.0.1")
+    implementation("androidx.core:core-ktx:1.3.1")
+    implementation("androidx.localbroadcastmanager:localbroadcastmanager:1.0.0")
+    implementation("com.google.android.material:material:1.2.1")
+}

app/proguard-kotlin.pro

@@ -1,20 +0,0 @@
-## So every class is case insensitive to avoid some bizare problems
--dontusemixedcaseclassnames
-
-## If reflection issues come up uncomment this, that should temporarily fix it
-#-keep class kotlin.** { *; }
-#-keep class kotlin.Metadata { *; }
-#-keepclassmembers class kotlin.Metadata {
-#    public <methods>;
-#}
-
-## Never warn about Kotlin, it should work as-is
--dontwarn kotlin.**
-
-## Removes runtime null checks - doesn't really matter if it crashes on kotlin or java NPE
--assumenosideeffects class kotlin.jvm.internal.Intrinsics {
-    static void checkParameterIsNotNull(java.lang.Object, java.lang.String);
-}
-
-## Useless option for dex
--dontpreverify

app/proguard-rules.pro

@@ -16,33 +16,39 @@
 #   public *;
 #}
 
+# Kotlin
+-assumenosideeffects class kotlin.jvm.internal.Intrinsics {
+	public static void checkExpressionValueIsNotNull(...);
+	public static void checkNotNullExpressionValue(...);
+	public static void checkReturnedValueIsNotNull(...);
+	public static void checkFieldIsNotNull(...);
+	public static void checkParameterIsNotNull(...);
+}
+
+# Stubs
+-keep class a.* { *; }
+
 # Snet
--keepclassmembers class com.topjohnwu.magisk.utils.SafetyNetHelper { *; }
--keep,allowobfuscation interface com.topjohnwu.magisk.utils.SafetyNetHelper$Callback
--keepclassmembers class * implements com.topjohnwu.magisk.utils.SafetyNetHelper$Callback {
-  void onResponse(int);
+-keepclassmembers class com.topjohnwu.magisk.ui.safetynet.SafetyNetHelper { *; }
+-keep,allowobfuscation interface com.topjohnwu.magisk.ui.safetynet.SafetyNetHelper$Callback
+-keepclassmembers class * implements com.topjohnwu.magisk.ui.safetynet.SafetyNetHelper$Callback {
+  void onResponse(org.json.JSONObject);
 }
 
-# Keep all fragment constructors
--keepclassmembers class * extends androidx.fragment.app.Fragment {
-  public <init>(...);
+# Fragments
+# TODO: Remove when AGP 4.1 release
+# https://issuetracker.google.com/issues/142601969
+-keep,allowobfuscation class * extends androidx.fragment.app.Fragment
+-keepnames class androidx.navigation.fragment.NavHostFragment
+
+# Strip Timber verbose and debug logging
+-assumenosideeffects class timber.log.Timber.Tree {
+  public void v(**);
+  public void d(**);
 }
 
-# DelegateWorker
--keep,allowobfuscation class * extends com.topjohnwu.magisk.base.DelegateWorker
-
-# BootSigner
--keep class a.a { *; }
-
-# Workaround R8 bug
--keep,allowobfuscation class com.topjohnwu.magisk.model.receiver.GeneralReceiver
--keepclassmembers class a.e { *; }
-
-# Strip logging
--assumenosideeffects class timber.log.Timber.Tree { *; }
-
 # Excessive obfuscation
--repackageclasses 'a'
+-repackageclasses
 -allowaccessmodification
 
 # QOL

app/res-ids.txt

@@ -1,5 +0,0 @@
-com.topjohnwu.magisk:color/xxxxxxxx = 0x7f010000
-com.topjohnwu.magisk:drawable/xxxxxxxx = 0x7f020000
-com.topjohnwu.magisk:string/xxxxxxxx = 0x7f030000
-com.topjohnwu.magisk:style/xxxxxxxx = 0x7f040000
-com.topjohnwu.magisk:xml/xxxxxxxx = 0x7f050000

app/shared/build.gradle.kts

@@ -0,0 +1,14 @@
+plugins {
+    id("com.android.library")
+}
+
+android {
+    defaultConfig {
+        vectorDrawables.useSupportLibrary = true
+        consumerProguardFiles("proguard-rules.pro")
+    }
+}
+
+dependencies {
+    implementation(fileTree(mapOf("dir" to "libs", "include" to listOf("*.jar"))))
+}

app/shared/src/main/AndroidManifest.xml

@@ -4,21 +4,15 @@
 
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
 
     <application
-        android:icon="@drawable/ic_launcher"
         android:label="Magisk Manager"
         android:installLocation="internalOnly"
         android:usesCleartextTraffic="true"
         android:supportsRtl="true"
+        android:theme="@android:style/Theme.Translucent.NoTitleBar"
         tools:ignore="UnusedAttribute">
 
-        <activity
-            android:name="a.r"
-            android:theme="@android:style/Theme.Translucent.NoTitleBar"
-            android:process=":remote" />
-
         <provider
             android:name="a.p"
             android:authorities="${applicationId}.provider"

app/shared/src/main/java/com/topjohnwu/magisk/FileProvider.java

@@ -4,7 +4,6 @@ import android.content.ContentProvider;
 import android.content.ContentValues;
 import android.content.Context;
 import android.content.pm.ProviderInfo;
-import android.content.res.XmlResourceParser;
 import android.database.Cursor;
 import android.database.MatrixCursor;
 import android.net.Uri;
@@ -16,19 +15,12 @@ import android.provider.OpenableColumns;
 import android.text.TextUtils;
 import android.webkit.MimeTypeMap;
 
-import com.topjohnwu.shared.R;
-
-import org.xmlpull.v1.XmlPullParserException;
-
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
 
-import static org.xmlpull.v1.XmlPullParser.END_DOCUMENT;
-import static org.xmlpull.v1.XmlPullParser.START_TAG;
-
 /**
  * Modified from androidx.core.content.FileProvider
  */
@@ -36,17 +28,6 @@ public class FileProvider extends ContentProvider {
     private static final String[] COLUMNS = {
             OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE };
 
-    private static final String TAG_ROOT_PATH = "root-path";
-    private static final String TAG_FILES_PATH = "files-path";
-    private static final String TAG_CACHE_PATH = "cache-path";
-    private static final String TAG_EXTERNAL = "external-path";
-    private static final String TAG_EXTERNAL_FILES = "external-files-path";
-    private static final String TAG_EXTERNAL_CACHE = "external-cache-path";
-    private static final String TAG_EXTERNAL_MEDIA = "external-media-path";
-
-    private static final String ATTR_NAME = "name";
-    private static final String ATTR_PATH = "path";
-
     private static final File DEVICE_ROOT = new File("/");
 
     private static HashMap<String, PathStrategy> sCache = new HashMap<>();
@@ -171,63 +152,36 @@ public class FileProvider extends ContentProvider {
         synchronized (sCache) {
             strat = sCache.get(authority);
             if (strat == null) {
-                try {
-                    strat = parsePathStrategy(context, authority);
-                } catch (IOException e) {
-                    throw new IllegalArgumentException("Failed to parse xml", e);
-                } catch (XmlPullParserException e) {
-                    throw new IllegalArgumentException("Failed to parse xml", e);
-                }
+                strat = createPathStrategy(context, authority);
                 sCache.put(authority, strat);
             }
         }
         return strat;
     }
 
-    private static PathStrategy parsePathStrategy(Context context, String authority)
-            throws IOException, XmlPullParserException {
+    private static PathStrategy createPathStrategy(Context context, String authority) {
         final SimplePathStrategy strat = new SimplePathStrategy(authority);
 
-        final XmlResourceParser in = context.getResources().getXml(R.xml.file_paths);
-
-        int type;
-        while ((type = in.next()) != END_DOCUMENT) {
-            if (type == START_TAG) {
-                final String tag = in.getName();
-
-                final String name = in.getAttributeValue(null, ATTR_NAME);
-                String path = in.getAttributeValue(null, ATTR_PATH);
-
-                File target = null;
-                if (TAG_ROOT_PATH.equals(tag)) {
-                    target = DEVICE_ROOT;
-                } else if (TAG_FILES_PATH.equals(tag)) {
-                    target = context.getFilesDir();
-                } else if (TAG_CACHE_PATH.equals(tag)) {
-                    target = context.getCacheDir();
-                } else if (TAG_EXTERNAL.equals(tag)) {
-                    target = Environment.getExternalStorageDirectory();
-                } else if (TAG_EXTERNAL_FILES.equals(tag)) {
-                    File[] externalFilesDirs = getExternalFilesDirs(context, null);
-                    if (externalFilesDirs.length > 0) {
-                        target = externalFilesDirs[0];
-                    }
-                } else if (TAG_EXTERNAL_CACHE.equals(tag)) {
-                    File[] externalCacheDirs = getExternalCacheDirs(context);
-                    if (externalCacheDirs.length > 0) {
-                        target = externalCacheDirs[0];
-                    }
-                } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP
-                        && TAG_EXTERNAL_MEDIA.equals(tag)) {
-                    File[] externalMediaDirs = context.getExternalMediaDirs();
-                    if (externalMediaDirs.length > 0) {
-                        target = externalMediaDirs[0];
-                    }
-                }
-
-                if (target != null) {
-                    strat.addRoot(name, buildPath(target, path));
-                }
+        strat.addRoot("root_files", buildPath(DEVICE_ROOT, "."));
+        strat.addRoot("internal_files", buildPath(context.getFilesDir(), "."));
+        strat.addRoot("cache_files", buildPath(context.getCacheDir(), "."));
+        strat.addRoot("external_files", buildPath(Environment.getExternalStorageDirectory(), "."));
+        {
+            File[] externalFilesDirs = getExternalFilesDirs(context, null);
+            if (externalFilesDirs.length > 0) {
+                strat.addRoot("external_file_files", buildPath(externalFilesDirs[0], "."));
+            }
+        }
+        {
+            File[] externalCacheDirs = getExternalCacheDirs(context);
+            if (externalCacheDirs.length > 0) {
+                strat.addRoot("external_cache_files", buildPath(externalCacheDirs[0], "."));
+            }
+        }
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+            File[] externalMediaDirs = context.getExternalMediaDirs();
+            if (externalMediaDirs.length > 0) {
+                strat.addRoot("external_media_files", buildPath(externalMediaDirs[0], "."));
             }
         }
 

app/shared/src/main/java/com/topjohnwu/magisk/net/Networking.java

@@ -47,10 +47,9 @@ public class Networking {
         } catch (Exception e) {
             if (Build.VERSION.SDK_INT < 21) {
                 // Failed to update SSL provider, use NoSSLv3SocketFactory on SDK < 21
-                // and return false to notify potential issues
                 HttpsURLConnection.setDefaultSSLSocketFactory(new NoSSLv3SocketFactory());
-                return false;
             }
+            return false;
         }
         return true;
     }

app/signing/build.gradle.kts

@@ -0,0 +1,35 @@
+import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
+
+plugins {
+    id("java-library")
+    id("java")
+    id("com.github.johnrengelman.shadow") version "6.0.0"
+}
+
+java {
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+}
+
+val jar by tasks.getting(Jar::class) {
+    manifest {
+        attributes["Main-Class"] = "com.topjohnwu.signing.ZipSigner"
+    }
+}
+
+val shadowJar by tasks.getting(ShadowJar::class) {
+    archiveBaseName.set("zipsigner")
+    archiveClassifier.set(null as String?)
+    archiveVersion.set("4.0")
+}
+
+repositories {
+    jcenter()
+}
+
+dependencies {
+    implementation(fileTree(mapOf("dir" to "libs", "include" to listOf("*.jar"))))
+
+    api("org.bouncycastle:bcprov-jdk15on:1.66")
+    api("org.bouncycastle:bcpkix-jdk15on:1.66")
+}

app/signing/src/main/java/com/topjohnwu/signing/ApkSignerV2.java

@@ -0,0 +1,772 @@
+package com.topjohnwu.signing;
+
+import java.nio.BufferUnderflowException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.security.DigestException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyFactory;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.security.spec.AlgorithmParameterSpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.MGF1ParameterSpec;
+import java.security.spec.PSSParameterSpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * APK Signature Scheme v2 signer.
+ *
+ * <p>APK Signature Scheme v2 is a whole-file signature scheme which aims to protect every single
+ * bit of the APK, as opposed to the JAR Signature Scheme which protects only the names and
+ * uncompressed contents of ZIP entries.
+ */
+public abstract class ApkSignerV2 {
+    /*
+     * The two main goals of APK Signature Scheme v2 are:
+     * 1. Detect any unauthorized modifications to the APK. This is achieved by making the signature
+     *    cover every byte of the APK being signed.
+     * 2. Enable much faster signature and integrity verification. This is achieved by requiring
+     *    only a minimal amount of APK parsing before the signature is verified, thus completely
+     *    bypassing ZIP entry decompression and by making integrity verification parallelizable by
+     *    employing a hash tree.
+     *
+     * The generated signature block is wrapped into an APK Signing Block and inserted into the
+     * original APK immediately before the start of ZIP Central Directory. This is to ensure that
+     * JAR and ZIP parsers continue to work on the signed APK. The APK Signing Block is designed for
+     * extensibility. For example, a future signature scheme could insert its signatures there as
+     * well. The contract of the APK Signing Block is that all contents outside of the block must be
+     * protected by signatures inside the block.
+     */
+
+    public static final int SIGNATURE_RSA_PSS_WITH_SHA256 = 0x0101;
+    public static final int SIGNATURE_RSA_PSS_WITH_SHA512 = 0x0102;
+    public static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256 = 0x0103;
+    public static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512 = 0x0104;
+    public static final int SIGNATURE_ECDSA_WITH_SHA256 = 0x0201;
+    public static final int SIGNATURE_ECDSA_WITH_SHA512 = 0x0202;
+    public static final int SIGNATURE_DSA_WITH_SHA256 = 0x0301;
+    public static final int SIGNATURE_DSA_WITH_SHA512 = 0x0302;
+
+    /**
+     * {@code .SF} file header section attribute indicating that the APK is signed not just with
+     * JAR signature scheme but also with APK Signature Scheme v2 or newer. This attribute
+     * facilitates v2 signature stripping detection.
+     *
+     * <p>The attribute contains a comma-separated set of signature scheme IDs.
+     */
+    public static final String SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME = "X-Android-APK-Signed";
+    public static final String SF_ATTRIBUTE_ANDROID_APK_SIGNED_VALUE = "2";
+
+    private static final int CONTENT_DIGEST_CHUNKED_SHA256 = 0;
+    private static final int CONTENT_DIGEST_CHUNKED_SHA512 = 1;
+
+    private static final int CONTENT_DIGESTED_CHUNK_MAX_SIZE_BYTES = 1024 * 1024;
+
+    private static final byte[] APK_SIGNING_BLOCK_MAGIC =
+          new byte[] {
+              0x41, 0x50, 0x4b, 0x20, 0x53, 0x69, 0x67, 0x20,
+              0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x20, 0x34, 0x32,
+          };
+    private static final int APK_SIGNATURE_SCHEME_V2_BLOCK_ID = 0x7109871a;
+
+    private ApkSignerV2() {}
+
+    /**
+     * Signer configuration.
+     */
+    public static final class SignerConfig {
+        /** Private key. */
+        public PrivateKey privateKey;
+
+        /**
+         * Certificates, with the first certificate containing the public key corresponding to
+         * {@link #privateKey}.
+         */
+        public List<X509Certificate> certificates;
+
+        /**
+         * List of signature algorithms with which to sign (see {@code SIGNATURE_...} constants).
+         */
+        public List<Integer> signatureAlgorithms;
+    }
+
+    /**
+     * Signs the provided APK using APK Signature Scheme v2 and returns the signed APK as a list of
+     * consecutive chunks.
+     *
+     * <p>NOTE: To enable APK signature verifier to detect v2 signature stripping, header sections
+     * of META-INF/*.SF files of APK being signed must contain the
+     * {@code X-Android-APK-Signed: true} attribute.
+     *
+     * @param inputApk contents of the APK to be signed. The APK starts at the current position
+     *        of the buffer and ends at the limit of the buffer.
+     * @param signerConfigs signer configurations, one for each signer.
+     *
+     * @throws ApkParseException if the APK cannot be parsed.
+     * @throws InvalidKeyException if a signing key is not suitable for this signature scheme or
+     *         cannot be used in general.
+     * @throws SignatureException if an error occurs when computing digests of generating
+     *         signatures.
+     */
+    public static ByteBuffer[] sign(
+            ByteBuffer inputApk,
+            List<SignerConfig> signerConfigs)
+                    throws ApkParseException, InvalidKeyException, SignatureException {
+        // Slice/create a view in the inputApk to make sure that:
+        // 1. inputApk is what's between position and limit of the original inputApk, and
+        // 2. changes to position, limit, and byte order are not reflected in the original.
+        ByteBuffer originalInputApk = inputApk;
+        inputApk = originalInputApk.slice();
+        inputApk.order(ByteOrder.LITTLE_ENDIAN);
+
+        // Locate ZIP End of Central Directory (EoCD), Central Directory, and check that Central
+        // Directory is immediately followed by the ZIP End of Central Directory.
+        int eocdOffset = ZipUtils.findZipEndOfCentralDirectoryRecord(inputApk);
+        if (eocdOffset == -1) {
+            throw new ApkParseException("Failed to locate ZIP End of Central Directory");
+        }
+        if (ZipUtils.isZip64EndOfCentralDirectoryLocatorPresent(inputApk, eocdOffset)) {
+            throw new ApkParseException("ZIP64 format not supported");
+        }
+        inputApk.position(eocdOffset);
+        long centralDirSizeLong = ZipUtils.getZipEocdCentralDirectorySizeBytes(inputApk);
+        if (centralDirSizeLong > Integer.MAX_VALUE) {
+            throw new ApkParseException(
+                    "ZIP Central Directory size out of range: " + centralDirSizeLong);
+        }
+        int centralDirSize = (int) centralDirSizeLong;
+        long centralDirOffsetLong = ZipUtils.getZipEocdCentralDirectoryOffset(inputApk);
+        if (centralDirOffsetLong > Integer.MAX_VALUE) {
+            throw new ApkParseException(
+                    "ZIP Central Directory offset in file out of range: " + centralDirOffsetLong);
+        }
+        int centralDirOffset = (int) centralDirOffsetLong;
+        int expectedEocdOffset = centralDirOffset + centralDirSize;
+        if (expectedEocdOffset < centralDirOffset) {
+            throw new ApkParseException(
+                    "ZIP Central Directory extent too large. Offset: " + centralDirOffset
+                            + ", size: " + centralDirSize);
+        }
+        if (eocdOffset != expectedEocdOffset) {
+            throw new ApkParseException(
+                    "ZIP Central Directory not immeiately followed by ZIP End of"
+                            + " Central Directory. CD end: " + expectedEocdOffset
+                            + ", EoCD start: " + eocdOffset);
+        }
+
+        // Create ByteBuffers holding the contents of everything before ZIP Central Directory,
+        // ZIP Central Directory, and ZIP End of Central Directory.
+        inputApk.clear();
+        ByteBuffer beforeCentralDir = getByteBuffer(inputApk, centralDirOffset);
+        ByteBuffer centralDir = getByteBuffer(inputApk, eocdOffset - centralDirOffset);
+        // Create a copy of End of Central Directory because we'll need modify its contents later.
+        byte[] eocdBytes = new byte[inputApk.remaining()];
+        inputApk.get(eocdBytes);
+        ByteBuffer eocd = ByteBuffer.wrap(eocdBytes);
+        eocd.order(inputApk.order());
+
+        // Figure which which digests to use for APK contents.
+        Set<Integer> contentDigestAlgorithms = new HashSet<>();
+        for (SignerConfig signerConfig : signerConfigs) {
+            for (int signatureAlgorithm : signerConfig.signatureAlgorithms) {
+                contentDigestAlgorithms.add(
+                        getSignatureAlgorithmContentDigestAlgorithm(signatureAlgorithm));
+            }
+        }
+
+        // Compute digests of APK contents.
+        Map<Integer, byte[]> contentDigests; // digest algorithm ID -> digest
+        try {
+            contentDigests =
+                    computeContentDigests(
+                            contentDigestAlgorithms,
+                            new ByteBuffer[] {beforeCentralDir, centralDir, eocd});
+        } catch (DigestException e) {
+            throw new SignatureException("Failed to compute digests of APK", e);
+        }
+
+        // Sign the digests and wrap the signatures and signer info into an APK Signing Block.
+        ByteBuffer apkSigningBlock =
+                ByteBuffer.wrap(generateApkSigningBlock(signerConfigs, contentDigests));
+
+        // Update Central Directory Offset in End of Central Directory Record. Central Directory
+        // follows the APK Signing Block and thus is shifted by the size of the APK Signing Block.
+        centralDirOffset += apkSigningBlock.remaining();
+        eocd.clear();
+        ZipUtils.setZipEocdCentralDirectoryOffset(eocd, centralDirOffset);
+
+        // Follow the Java NIO pattern for ByteBuffer whose contents have been consumed.
+        originalInputApk.position(originalInputApk.limit());
+
+        // Reset positions (to 0) and limits (to capacity) in the ByteBuffers below to follow the
+        // Java NIO pattern for ByteBuffers which are ready for their contents to be read by caller.
+        // Contrary to the name, this does not clear the contents of these ByteBuffer.
+        beforeCentralDir.clear();
+        centralDir.clear();
+        eocd.clear();
+
+        // Insert APK Signing Block immediately before the ZIP Central Directory.
+        return new ByteBuffer[] {
+            beforeCentralDir,
+            apkSigningBlock,
+            centralDir,
+            eocd,
+        };
+    }
+
+    private static Map<Integer, byte[]> computeContentDigests(
+            Set<Integer> digestAlgorithms,
+            ByteBuffer[] contents) throws DigestException {
+        // For each digest algorithm the result is computed as follows:
+        // 1. Each segment of contents is split into consecutive chunks of 1 MB in size.
+        //    The final chunk will be shorter iff the length of segment is not a multiple of 1 MB.
+        //    No chunks are produced for empty (zero length) segments.
+        // 2. The digest of each chunk is computed over the concatenation of byte 0xa5, the chunk's
+        //    length in bytes (uint32 little-endian) and the chunk's contents.
+        // 3. The output digest is computed over the concatenation of the byte 0x5a, the number of
+        //    chunks (uint32 little-endian) and the concatenation of digests of chunks of all
+        //    segments in-order.
+
+        int chunkCount = 0;
+        for (ByteBuffer input : contents) {
+            chunkCount += getChunkCount(input.remaining(), CONTENT_DIGESTED_CHUNK_MAX_SIZE_BYTES);
+        }
+
+        final Map<Integer, byte[]> digestsOfChunks = new HashMap<>(digestAlgorithms.size());
+        for (int digestAlgorithm : digestAlgorithms) {
+            int digestOutputSizeBytes = getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
+            byte[] concatenationOfChunkCountAndChunkDigests =
+                    new byte[5 + chunkCount * digestOutputSizeBytes];
+            concatenationOfChunkCountAndChunkDigests[0] = 0x5a;
+            setUnsignedInt32LittleEngian(
+                    chunkCount, concatenationOfChunkCountAndChunkDigests, 1);
+            digestsOfChunks.put(digestAlgorithm, concatenationOfChunkCountAndChunkDigests);
+        }
+
+        int chunkIndex = 0;
+        byte[] chunkContentPrefix = new byte[5];
+        chunkContentPrefix[0] = (byte) 0xa5;
+        // Optimization opportunity: digests of chunks can be computed in parallel.
+        for (ByteBuffer input : contents) {
+            while (input.hasRemaining()) {
+                int chunkSize =
+                        Math.min(input.remaining(), CONTENT_DIGESTED_CHUNK_MAX_SIZE_BYTES);
+                final ByteBuffer chunk = getByteBuffer(input, chunkSize);
+                for (int digestAlgorithm : digestAlgorithms) {
+                    String jcaAlgorithmName =
+                            getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm);
+                    MessageDigest md;
+                    try {
+                        md = MessageDigest.getInstance(jcaAlgorithmName);
+                    } catch (NoSuchAlgorithmException e) {
+                        throw new DigestException(
+                                jcaAlgorithmName + " MessageDigest not supported", e);
+                    }
+                    // Reset position to 0 and limit to capacity. Position would've been modified
+                    // by the preceding iteration of this loop. NOTE: Contrary to the method name,
+                    // this does not modify the contents of the chunk.
+                    chunk.clear();
+                    setUnsignedInt32LittleEngian(chunk.remaining(), chunkContentPrefix, 1);
+                    md.update(chunkContentPrefix);
+                    md.update(chunk);
+                    byte[] concatenationOfChunkCountAndChunkDigests =
+                            digestsOfChunks.get(digestAlgorithm);
+                    int expectedDigestSizeBytes =
+                            getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
+                    int actualDigestSizeBytes =
+                            md.digest(
+                                    concatenationOfChunkCountAndChunkDigests,
+                                    5 + chunkIndex * expectedDigestSizeBytes,
+                                    expectedDigestSizeBytes);
+                    if (actualDigestSizeBytes != expectedDigestSizeBytes) {
+                        throw new DigestException(
+                                "Unexpected output size of " + md.getAlgorithm()
+                                        + " digest: " + actualDigestSizeBytes);
+                    }
+                }
+                chunkIndex++;
+            }
+        }
+
+        Map<Integer, byte[]> result = new HashMap<>(digestAlgorithms.size());
+        for (Map.Entry<Integer, byte[]> entry : digestsOfChunks.entrySet()) {
+            int digestAlgorithm = entry.getKey();
+            byte[] concatenationOfChunkCountAndChunkDigests = entry.getValue();
+            String jcaAlgorithmName = getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm);
+            MessageDigest md;
+            try {
+                md = MessageDigest.getInstance(jcaAlgorithmName);
+            } catch (NoSuchAlgorithmException e) {
+                throw new DigestException(jcaAlgorithmName + " MessageDigest not supported", e);
+            }
+            result.put(digestAlgorithm, md.digest(concatenationOfChunkCountAndChunkDigests));
+        }
+        return result;
+    }
+
+    private static int getChunkCount(int inputSize, int chunkSize) {
+        return (inputSize + chunkSize - 1) / chunkSize;
+    }
+
+    private static void setUnsignedInt32LittleEngian(int value, byte[] result, int offset) {
+        result[offset] = (byte) (value & 0xff);
+        result[offset + 1] = (byte) ((value >> 8) & 0xff);
+        result[offset + 2] = (byte) ((value >> 16) & 0xff);
+        result[offset + 3] = (byte) ((value >> 24) & 0xff);
+    }
+
+    private static byte[] generateApkSigningBlock(
+            List<SignerConfig> signerConfigs,
+            Map<Integer, byte[]> contentDigests) throws InvalidKeyException, SignatureException {
+        byte[] apkSignatureSchemeV2Block =
+                generateApkSignatureSchemeV2Block(signerConfigs, contentDigests);
+        return generateApkSigningBlock(apkSignatureSchemeV2Block);
+    }
+
+    private static byte[] generateApkSigningBlock(byte[] apkSignatureSchemeV2Block) {
+        // FORMAT:
+        // uint64:  size (excluding this field)
+        // repeated ID-value pairs:
+        //     uint64:           size (excluding this field)
+        //     uint32:           ID
+        //     (size - 4) bytes: value
+        // uint64:  size (same as the one above)
+        // uint128: magic
+
+        int resultSize =
+                8 // size
+                + 8 + 4 + apkSignatureSchemeV2Block.length // v2Block as ID-value pair
+                + 8 // size
+                + 16 // magic
+                ;
+        ByteBuffer result = ByteBuffer.allocate(resultSize);
+        result.order(ByteOrder.LITTLE_ENDIAN);
+        long blockSizeFieldValue = resultSize - 8;
+        result.putLong(blockSizeFieldValue);
+
+        long pairSizeFieldValue = 4 + apkSignatureSchemeV2Block.length;
+        result.putLong(pairSizeFieldValue);
+        result.putInt(APK_SIGNATURE_SCHEME_V2_BLOCK_ID);
+        result.put(apkSignatureSchemeV2Block);
+
+        result.putLong(blockSizeFieldValue);
+        result.put(APK_SIGNING_BLOCK_MAGIC);
+
+        return result.array();
+    }
+
+    private static byte[] generateApkSignatureSchemeV2Block(
+            List<SignerConfig> signerConfigs,
+            Map<Integer, byte[]> contentDigests) throws InvalidKeyException, SignatureException {
+        // FORMAT:
+        // * length-prefixed sequence of length-prefixed signer blocks.
+
+        List<byte[]> signerBlocks = new ArrayList<>(signerConfigs.size());
+        int signerNumber = 0;
+        for (SignerConfig signerConfig : signerConfigs) {
+            signerNumber++;
+            byte[] signerBlock;
+            try {
+                signerBlock = generateSignerBlock(signerConfig, contentDigests);
+            } catch (InvalidKeyException e) {
+                throw new InvalidKeyException("Signer #" + signerNumber + " failed", e);
+            } catch (SignatureException e) {
+                throw new SignatureException("Signer #" + signerNumber + " failed", e);
+            }
+            signerBlocks.add(signerBlock);
+        }
+
+        return encodeAsSequenceOfLengthPrefixedElements(
+                new byte[][] {
+                    encodeAsSequenceOfLengthPrefixedElements(signerBlocks),
+                });
+    }
+
+    private static byte[] generateSignerBlock(
+            SignerConfig signerConfig,
+            Map<Integer, byte[]> contentDigests) throws InvalidKeyException, SignatureException {
+        if (signerConfig.certificates.isEmpty()) {
+            throw new SignatureException("No certificates configured for signer");
+        }
+        PublicKey publicKey = signerConfig.certificates.get(0).getPublicKey();
+
+        byte[] encodedPublicKey = encodePublicKey(publicKey);
+
+        V2SignatureSchemeBlock.SignedData signedData = new V2SignatureSchemeBlock.SignedData();
+        try {
+            signedData.certificates = encodeCertificates(signerConfig.certificates);
+        } catch (CertificateEncodingException e) {
+            throw new SignatureException("Failed to encode certificates", e);
+        }
+
+        List<Pair<Integer, byte[]>> digests =
+                new ArrayList<>(signerConfig.signatureAlgorithms.size());
+        for (int signatureAlgorithm : signerConfig.signatureAlgorithms) {
+            int contentDigestAlgorithm =
+                    getSignatureAlgorithmContentDigestAlgorithm(signatureAlgorithm);
+            byte[] contentDigest = contentDigests.get(contentDigestAlgorithm);
+            if (contentDigest == null) {
+                throw new RuntimeException(
+                        getContentDigestAlgorithmJcaDigestAlgorithm(contentDigestAlgorithm)
+                        + " content digest for "
+                        + getSignatureAlgorithmJcaSignatureAlgorithm(signatureAlgorithm)
+                        + " not computed");
+            }
+            digests.add(Pair.create(signatureAlgorithm, contentDigest));
+        }
+        signedData.digests = digests;
+
+        V2SignatureSchemeBlock.Signer signer = new V2SignatureSchemeBlock.Signer();
+        // FORMAT:
+        // * length-prefixed sequence of length-prefixed digests:
+        //   * uint32: signature algorithm ID
+        //   * length-prefixed bytes: digest of contents
+        // * length-prefixed sequence of certificates:
+        //   * length-prefixed bytes: X.509 certificate (ASN.1 DER encoded).
+        // * length-prefixed sequence of length-prefixed additional attributes:
+        //   * uint32: ID
+        //   * (length - 4) bytes: value
+        signer.signedData = encodeAsSequenceOfLengthPrefixedElements(new byte[][] {
+            encodeAsSequenceOfLengthPrefixedPairsOfIntAndLengthPrefixedBytes(signedData.digests),
+            encodeAsSequenceOfLengthPrefixedElements(signedData.certificates),
+            // additional attributes
+            new byte[0],
+        });
+        signer.publicKey = encodedPublicKey;
+        signer.signatures = new ArrayList<>();
+        for (int signatureAlgorithm : signerConfig.signatureAlgorithms) {
+            Pair<String, ? extends AlgorithmParameterSpec> signatureParams =
+                    getSignatureAlgorithmJcaSignatureAlgorithm(signatureAlgorithm);
+            String jcaSignatureAlgorithm = signatureParams.getFirst();
+            AlgorithmParameterSpec jcaSignatureAlgorithmParams = signatureParams.getSecond();
+            byte[] signatureBytes;
+            try {
+                Signature signature = Signature.getInstance(jcaSignatureAlgorithm);
+                signature.initSign(signerConfig.privateKey);
+                if (jcaSignatureAlgorithmParams != null) {
+                    signature.setParameter(jcaSignatureAlgorithmParams);
+                }
+                signature.update(signer.signedData);
+                signatureBytes = signature.sign();
+            } catch (InvalidKeyException e) {
+                throw new InvalidKeyException("Failed sign using " + jcaSignatureAlgorithm, e);
+            } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException
+                    | SignatureException e) {
+                throw new SignatureException("Failed sign using " + jcaSignatureAlgorithm, e);
+            }
+
+            try {
+                Signature signature = Signature.getInstance(jcaSignatureAlgorithm);
+                signature.initVerify(publicKey);
+                if (jcaSignatureAlgorithmParams != null) {
+                    signature.setParameter(jcaSignatureAlgorithmParams);
+                }
+                signature.update(signer.signedData);
+                if (!signature.verify(signatureBytes)) {
+                    throw new SignatureException("Signature did not verify");
+                }
+            } catch (InvalidKeyException e) {
+                throw new InvalidKeyException("Failed to verify generated " + jcaSignatureAlgorithm
+                        + " signature using public key from certificate", e);
+            } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException
+                    | SignatureException e) {
+                throw new SignatureException("Failed to verify generated " + jcaSignatureAlgorithm
+                        + " signature using public key from certificate", e);
+            }
+
+            signer.signatures.add(Pair.create(signatureAlgorithm, signatureBytes));
+        }
+
+        // FORMAT:
+        // * length-prefixed signed data
+        // * length-prefixed sequence of length-prefixed signatures:
+        //   * uint32: signature algorithm ID
+        //   * length-prefixed bytes: signature of signed data
+        // * length-prefixed bytes: public key (X.509 SubjectPublicKeyInfo, ASN.1 DER encoded)
+        return encodeAsSequenceOfLengthPrefixedElements(
+                new byte[][] {
+                    signer.signedData,
+                    encodeAsSequenceOfLengthPrefixedPairsOfIntAndLengthPrefixedBytes(
+                            signer.signatures),
+                    signer.publicKey,
+                });
+    }
+
+    private static final class V2SignatureSchemeBlock {
+        private static final class Signer {
+            public byte[] signedData;
+            public List<Pair<Integer, byte[]>> signatures;
+            public byte[] publicKey;
+        }
+
+        private static final class SignedData {
+            public List<Pair<Integer, byte[]>> digests;
+            public List<byte[]> certificates;
+        }
+    }
+
+    private static byte[] encodePublicKey(PublicKey publicKey) throws InvalidKeyException {
+        byte[] encodedPublicKey = null;
+        if ("X.509".equals(publicKey.getFormat())) {
+            encodedPublicKey = publicKey.getEncoded();
+        }
+        if (encodedPublicKey == null) {
+            try {
+                encodedPublicKey =
+                        KeyFactory.getInstance(publicKey.getAlgorithm())
+                                .getKeySpec(publicKey, X509EncodedKeySpec.class)
+                                .getEncoded();
+            } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
+                throw new InvalidKeyException(
+                        "Failed to obtain X.509 encoded form of public key " + publicKey
+                                + " of class " + publicKey.getClass().getName(),
+                        e);
+            }
+        }
+        if ((encodedPublicKey == null) || (encodedPublicKey.length == 0)) {
+            throw new InvalidKeyException(
+                    "Failed to obtain X.509 encoded form of public key " + publicKey
+                            + " of class " + publicKey.getClass().getName());
+        }
+        return encodedPublicKey;
+    }
+
+    public static List<byte[]> encodeCertificates(List<X509Certificate> certificates)
+            throws CertificateEncodingException {
+        List<byte[]> result = new ArrayList<>();
+        for (X509Certificate certificate : certificates) {
+            result.add(certificate.getEncoded());
+        }
+        return result;
+    }
+
+    private static byte[] encodeAsSequenceOfLengthPrefixedElements(List<byte[]> sequence) {
+        return encodeAsSequenceOfLengthPrefixedElements(
+                sequence.toArray(new byte[sequence.size()][]));
+    }
+
+    private static byte[] encodeAsSequenceOfLengthPrefixedElements(byte[][] sequence) {
+        int payloadSize = 0;
+        for (byte[] element : sequence) {
+            payloadSize += 4 + element.length;
+        }
+        ByteBuffer result = ByteBuffer.allocate(payloadSize);
+        result.order(ByteOrder.LITTLE_ENDIAN);
+        for (byte[] element : sequence) {
+            result.putInt(element.length);
+            result.put(element);
+        }
+        return result.array();
+      }
+
+    private static byte[] encodeAsSequenceOfLengthPrefixedPairsOfIntAndLengthPrefixedBytes(
+            List<Pair<Integer, byte[]>> sequence) {
+        int resultSize = 0;
+        for (Pair<Integer, byte[]> element : sequence) {
+            resultSize += 12 + element.getSecond().length;
+        }
+        ByteBuffer result = ByteBuffer.allocate(resultSize);
+        result.order(ByteOrder.LITTLE_ENDIAN);
+        for (Pair<Integer, byte[]> element : sequence) {
+            byte[] second = element.getSecond();
+            result.putInt(8 + second.length);
+            result.putInt(element.getFirst());
+            result.putInt(second.length);
+            result.put(second);
+        }
+        return result.array();
+    }
+
+    /**
+     * Relative <em>get</em> method for reading {@code size} number of bytes from the current
+     * position of this buffer.
+     *
+     * <p>This method reads the next {@code size} bytes at this buffer's current position,
+     * returning them as a {@code ByteBuffer} with start set to 0, limit and capacity set to
+     * {@code size}, byte order set to this buffer's byte order; and then increments the position by
+     * {@code size}.
+     */
+    private static ByteBuffer getByteBuffer(ByteBuffer source, int size) {
+        if (size < 0) {
+            throw new IllegalArgumentException("size: " + size);
+        }
+        int originalLimit = source.limit();
+        int position = source.position();
+        int limit = position + size;
+        if ((limit < position) || (limit > originalLimit)) {
+            throw new BufferUnderflowException();
+        }
+        source.limit(limit);
+        try {
+            ByteBuffer result = source.slice();
+            result.order(source.order());
+            source.position(limit);
+            return result;
+        } finally {
+            source.limit(originalLimit);
+        }
+    }
+
+    private static Pair<String, ? extends AlgorithmParameterSpec>
+            getSignatureAlgorithmJcaSignatureAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+                return Pair.create(
+                        "SHA256withRSA/PSS",
+                        new PSSParameterSpec(
+                                "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 256 / 8, 1));
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+                return Pair.create(
+                        "SHA512withRSA/PSS",
+                        new PSSParameterSpec(
+                                "SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 512 / 8, 1));
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+                return Pair.create("SHA256withRSA", null);
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+                return Pair.create("SHA512withRSA", null);
+            case SIGNATURE_ECDSA_WITH_SHA256:
+                return Pair.create("SHA256withECDSA", null);
+            case SIGNATURE_ECDSA_WITH_SHA512:
+                return Pair.create("SHA512withECDSA", null);
+            case SIGNATURE_DSA_WITH_SHA256:
+                return Pair.create("SHA256withDSA", null);
+            case SIGNATURE_DSA_WITH_SHA512:
+                return Pair.create("SHA512withDSA", null);
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    private static int getSignatureAlgorithmContentDigestAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+            case SIGNATURE_ECDSA_WITH_SHA256:
+            case SIGNATURE_DSA_WITH_SHA256:
+                return CONTENT_DIGEST_CHUNKED_SHA256;
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+            case SIGNATURE_ECDSA_WITH_SHA512:
+            case SIGNATURE_DSA_WITH_SHA512:
+                return CONTENT_DIGEST_CHUNKED_SHA512;
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    private static String getContentDigestAlgorithmJcaDigestAlgorithm(int digestAlgorithm) {
+        switch (digestAlgorithm) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                return "SHA-256";
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                return "SHA-512";
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown content digest algorthm: " + digestAlgorithm);
+        }
+    }
+
+    private static int getContentDigestAlgorithmOutputSizeBytes(int digestAlgorithm) {
+        switch (digestAlgorithm) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                return 256 / 8;
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                return 512 / 8;
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown content digest algorthm: " + digestAlgorithm);
+        }
+    }
+
+    /**
+     * Indicates that APK file could not be parsed.
+     */
+    public static class ApkParseException extends Exception {
+        private static final long serialVersionUID = 1L;
+
+        public ApkParseException(String message) {
+            super(message);
+        }
+
+        public ApkParseException(String message, Throwable cause) {
+            super(message, cause);
+        }
+    }
+
+    /**
+     * Pair of two elements.
+     */
+    private static class Pair<A, B> {
+        private final A mFirst;
+        private final B mSecond;
+
+        private Pair(A first, B second) {
+            mFirst = first;
+            mSecond = second;
+        }
+
+        public static <A, B> Pair<A, B> create(A first, B second) {
+            return new Pair<>(first, second);
+        }
+
+        public A getFirst() {
+            return mFirst;
+        }
+
+        public B getSecond() {
+            return mSecond;
+        }
+
+        @Override
+        public int hashCode() {
+            final int prime = 31;
+            int result = 1;
+            result = prime * result + ((mFirst == null) ? 0 : mFirst.hashCode());
+            result = prime * result + ((mSecond == null) ? 0 : mSecond.hashCode());
+            return result;
+        }
+
+        @Override
+        public boolean equals(Object obj) {
+            if (this == obj) {
+                return true;
+            }
+            if (obj == null) {
+                return false;
+            }
+            if (getClass() != obj.getClass()) {
+                return false;
+            }
+            @SuppressWarnings("rawtypes")
+            Pair other = (Pair) obj;
+            if (mFirst == null) {
+                if (other.mFirst != null) {
+                    return false;
+                }
+            } else if (!mFirst.equals(other.mFirst)) {
+                return false;
+            }
+            if (mSecond == null) {
+                return other.mSecond == null;
+            } else return mSecond.equals(other.mSecond);
+        }
+    }
+}

app/signing/src/main/java/com/topjohnwu/signing/SignApk.java

@@ -1,9 +1,8 @@
 package com.topjohnwu.signing;
 
+import org.bouncycastle.asn1.ASN1Encoding;
 import org.bouncycastle.asn1.ASN1InputStream;
-import org.bouncycastle.asn1.ASN1ObjectIdentifier;
-import org.bouncycastle.asn1.DEROutputStream;
-import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
+import org.bouncycastle.asn1.ASN1OutputStream;
 import org.bouncycastle.cert.jcajce.JcaCertStore;
 import org.bouncycastle.cms.CMSException;
 import org.bouncycastle.cms.CMSProcessableByteArray;
@@ -11,34 +10,38 @@ import org.bouncycastle.cms.CMSSignedData;
 import org.bouncycastle.cms.CMSSignedDataGenerator;
 import org.bouncycastle.cms.CMSTypedData;
 import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
 import org.bouncycastle.operator.OperatorCreationException;
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.util.encoders.Base64;
 
-import java.io.BufferedOutputStream;
 import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.FilterOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.PrintStream;
-import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
 import java.security.DigestOutputStream;
 import java.security.GeneralSecurityException;
+import java.security.InvalidKeyException;
 import java.security.MessageDigest;
 import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Security;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Enumeration;
+import java.util.Iterator;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.TimeZone;
 import java.util.TreeMap;
 import java.util.jar.Attributes;
 import java.util.jar.JarEntry;
@@ -48,71 +51,28 @@ import java.util.jar.Manifest;
 import java.util.regex.Pattern;
 
 /*
-* Modified from from AOSP(Marshmallow) SignAPK.java
-* */
-
-public class SignAPK {
+ * Modified from from AOSP
+ * https://android.googlesource.com/platform/build/+/refs/tags/android-7.1.2_r39/tools/signapk/src/com/android/signapk/SignApk.java
+ * */
 
+public class SignApk {
     private static final String CERT_SF_NAME = "META-INF/CERT.SF";
     private static final String CERT_SIG_NAME = "META-INF/CERT.%s";
+    private static final String CERT_SF_MULTI_NAME = "META-INF/CERT%d.SF";
+    private static final String CERT_SIG_MULTI_NAME = "META-INF/CERT%d.%s";
 
     // bitmasks for which hash algorithms we need the manifest to include.
     private static final int USE_SHA1 = 1;
     private static final int USE_SHA256 = 2;
 
-    public static void signAndAdjust(X509Certificate cert, PrivateKey key,
-                                     JarMap input, OutputStream output) throws Exception {
-        File temp1 = File.createTempFile("signAPK", null);
-        File temp2 = File.createTempFile("signAPK", null);
-
-        try {
-            try (OutputStream out = new BufferedOutputStream(new FileOutputStream(temp1))) {
-                sign(cert, key, input, out, false);
-            }
-
-            ZipAdjust.adjust(temp1, temp2);
-
-            try (JarMap map = JarMap.open(temp2, false)) {
-                sign(cert, key, map, output, true);
-            }
-        } finally {
-            temp1.delete();
-            temp2.delete();
-        }
-    }
-
-    public static void sign(X509Certificate cert, PrivateKey key,
-                            JarMap input, OutputStream output) throws Exception {
-        sign(cert, key, input, output, false);
-    }
-
-    private static void sign(X509Certificate cert, PrivateKey key,
-                             JarMap input, OutputStream output, boolean minSign) throws Exception {
-        int hashes = 0;
-        hashes |= getDigestAlgorithm(cert);
-
-        // Set the ZIP file timestamp to the starting valid time
-        // of the 0th certificate plus one hour (to match what
-        // we've historically done).
-        long timestamp = cert.getNotBefore().getTime() + 3600L * 1000;
-
-        if (minSign) {
-            signWholeFile(input.getFile(), cert, key, output);
-        } else {
-            JarOutputStream outputJar = new JarOutputStream(output);
-            // For signing .apks, use the maximum compression to make
-            // them as small as possible (since they live forever on
-            // the system partition).  For OTA packages, use the
-            // default compression level, which is much much faster
-            // and produces output that is only a tiny bit larger
-            // (~0.1% on full OTA packages I tested).
-            outputJar.setLevel(9);
-            Manifest manifest = addDigestsToManifest(input, hashes);
-            copyFiles(manifest, input, outputJar, timestamp, 4);
-            signFile(manifest, input, cert, key, outputJar);
-            outputJar.close();
-        }
-    }
+    /**
+     * Digest algorithm used when signing the APK using APK Signature Scheme v2.
+     */
+    private static final String APK_SIG_SCHEME_V2_DIGEST_ALGORITHM = "SHA-256";
+    // Files matching this pattern are not copied to the output.
+    private static final Pattern stripPattern =
+            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
+                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
 
     /**
      * Return one of USE_SHA1 or USE_SHA256 according to the signature
@@ -120,7 +80,7 @@ public class SignAPK {
      */
     private static int getDigestAlgorithm(X509Certificate cert) {
         String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
-        if (sigAlg.startsWith("SHA1WITHRSA") || sigAlg.startsWith("MD5WITHRSA")) {
+        if ("SHA1WITHRSA".equals(sigAlg) || "MD5WITHRSA".equals(sigAlg)) {
             return USE_SHA1;
         } else if (sigAlg.startsWith("SHA256WITH")) {
             return USE_SHA256;
@@ -129,9 +89,11 @@ public class SignAPK {
                     "\" in cert [" + cert.getSubjectDN());
         }
     }
-    /** Returns the expected signature algorithm for this key type. */
+
+    /**
+     * Returns the expected signature algorithm for this key type.
+     */
     private static String getSignatureAlgorithm(X509Certificate cert) {
-        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
         String keyType = cert.getPublicKey().getAlgorithm().toUpperCase(Locale.US);
         if ("RSA".equalsIgnoreCase(keyType)) {
             if (getDigestAlgorithm(cert) == USE_SHA256) {
@@ -145,10 +107,6 @@ public class SignAPK {
             throw new IllegalArgumentException("unsupported key type: " + keyType);
         }
     }
-    // Files matching this pattern are not copied to the output.
-    private static Pattern stripPattern =
-            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
-                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
 
     /**
      * Add the hash(es) of every file to the manifest, creating it if
@@ -165,6 +123,7 @@ public class SignAPK {
             main.putValue("Manifest-Version", "1.0");
             main.putValue("Created-By", "1.0 (Android SignApk)");
         }
+
         MessageDigest md_sha1 = null;
         MessageDigest md_sha256 = null;
         if ((hashes & USE_SHA1) != 0) {
@@ -173,32 +132,51 @@ public class SignAPK {
         if ((hashes & USE_SHA256) != 0) {
             md_sha256 = MessageDigest.getInstance("SHA256");
         }
+
         byte[] buffer = new byte[4096];
         int num;
+
         // We sort the input entries by name, and add them to the
         // output manifest in sorted order.  We expect that the output
         // map will be deterministic.
-        TreeMap<String, JarEntry> byName = new TreeMap<String, JarEntry>();
+
+        TreeMap<String, JarEntry> byName = new TreeMap<>();
+
         for (Enumeration<JarEntry> e = jar.entries(); e.hasMoreElements(); ) {
             JarEntry entry = e.nextElement();
             byName.put(entry.getName(), entry);
         }
-        for (JarEntry entry: byName.values()) {
+
+        for (JarEntry entry : byName.values()) {
             String name = entry.getName();
-            if (!entry.isDirectory() &&
-                    (stripPattern == null || !stripPattern.matcher(name).matches())) {
+            if (!entry.isDirectory() && !stripPattern.matcher(name).matches()) {
                 InputStream data = jar.getInputStream(entry);
                 while ((num = data.read(buffer)) > 0) {
                     if (md_sha1 != null) md_sha1.update(buffer, 0, num);
                     if (md_sha256 != null) md_sha256.update(buffer, 0, num);
                 }
+
                 Attributes attr = null;
                 if (input != null) attr = input.getAttributes(name);
                 attr = attr != null ? new Attributes(attr) : new Attributes();
+                // Remove any previously computed digests from this entry's attributes.
+                for (Iterator<Object> i = attr.keySet().iterator(); i.hasNext(); ) {
+                    Object key = i.next();
+                    if (!(key instanceof Attributes.Name)) {
+                        continue;
+                    }
+                    String attributeNameLowerCase =
+                            key.toString().toLowerCase(Locale.US);
+                    if (attributeNameLowerCase.endsWith("-digest")) {
+                        i.remove();
+                    }
+                }
+                // Add SHA-1 digest if requested
                 if (md_sha1 != null) {
                     attr.putValue("SHA1-Digest",
                             new String(Base64.encode(md_sha1.digest()), "ASCII"));
                 }
+                // Add SHA-256 digest if requested
                 if (md_sha256 != null) {
                     attr.putValue("SHA-256-Digest",
                             new String(Base64.encode(md_sha256.digest()), "ASCII"));
@@ -206,33 +184,13 @@ public class SignAPK {
                 output.getEntries().put(name, attr);
             }
         }
+
         return output;
     }
 
-    /** Write to another stream and track how many bytes have been
-     *  written.
+    /**
+     * Write a .SF file with a digest of the specified manifest.
      */
-    private static class CountOutputStream extends FilterOutputStream {
-        private int mCount;
-        public CountOutputStream(OutputStream out) {
-            super(out);
-            mCount = 0;
-        }
-        @Override
-        public void write(int b) throws IOException {
-            super.write(b);
-            mCount++;
-        }
-        @Override
-        public void write(byte[] b, int off, int len) throws IOException {
-            super.write(b, off, len);
-            mCount += len;
-        }
-        public int size() {
-            return mCount;
-        }
-    }
-    /** Write a .SF file with a digest of the specified manifest. */
     private static void writeSignatureFile(Manifest manifest, OutputStream out,
                                            int hash)
             throws IOException, GeneralSecurityException {
@@ -240,16 +198,25 @@ public class SignAPK {
         Attributes main = sf.getMainAttributes();
         main.putValue("Signature-Version", "1.0");
         main.putValue("Created-By", "1.0 (Android SignApk)");
-        MessageDigest md = MessageDigest.getInstance(
-                hash == USE_SHA256 ? "SHA256" : "SHA1");
-        PrintStream print = new PrintStream(
-                new DigestOutputStream(new ByteArrayOutputStream(), md),
+        // Add APK Signature Scheme v2 signature stripping protection.
+        // This attribute indicates that this APK is supposed to have been signed using one or
+        // more APK-specific signature schemes in addition to the standard JAR signature scheme
+        // used by this code. APK signature verifier should reject the APK if it does not
+        // contain a signature for the signature scheme the verifier prefers out of this set.
+        main.putValue(
+                ApkSignerV2.SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME,
+                ApkSignerV2.SF_ATTRIBUTE_ANDROID_APK_SIGNED_VALUE);
+
+        MessageDigest md = MessageDigest.getInstance(hash == USE_SHA256 ? "SHA256" : "SHA1");
+        PrintStream print = new PrintStream(new DigestOutputStream(new ByteArrayOutputStream(), md),
                 true, "UTF-8");
+
         // Digest of the entire manifest
         manifest.write(print);
         print.flush();
         main.putValue(hash == USE_SHA256 ? "SHA-256-Digest-Manifest" : "SHA1-Digest-Manifest",
                 new String(Base64.encode(md.digest()), "ASCII"));
+
         Map<String, Attributes> entries = manifest.getEntries();
         for (Map.Entry<String, Attributes> entry : entries.entrySet()) {
             // Digest of the manifest stanza for this entry.
@@ -259,13 +226,16 @@ public class SignAPK {
             }
             print.print("\r\n");
             print.flush();
+
             Attributes sfAttr = new Attributes();
-            sfAttr.putValue(hash == USE_SHA256 ? "SHA-256-Digest" : "SHA1-Digest-Manifest",
+            sfAttr.putValue(hash == USE_SHA256 ? "SHA-256-Digest" : "SHA1-Digest",
                     new String(Base64.encode(md.digest()), "ASCII"));
             sf.getEntries().put(entry.getKey(), sfAttr);
         }
+
         CountOutputStream cout = new CountOutputStream(out);
         sf.write(cout);
+
         // A bug in the java.util.jar implementation of Android platforms
         // up to version 1.6 will cause a spurious IOException to be thrown
         // if the length of the signature file is a multiple of 1024 bytes.
@@ -275,10 +245,12 @@ public class SignAPK {
             cout.write('\n');
         }
     }
-    /** Sign data and write the digital signature to 'out'. */
+
+    /**
+     * Sign data and write the digital signature to 'out'.
+     */
     private static void writeSignatureBlock(
-            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey,
-            OutputStream out)
+            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey, OutputStream out)
             throws IOException,
             CertificateEncodingException,
             OperatorCreationException,
@@ -286,20 +258,24 @@ public class SignAPK {
         ArrayList<X509Certificate> certList = new ArrayList<>(1);
         certList.add(publicKey);
         JcaCertStore certs = new JcaCertStore(certList);
+
         CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
         ContentSigner signer = new JcaContentSignerBuilder(getSignatureAlgorithm(publicKey))
                 .build(privateKey);
         gen.addSignerInfoGenerator(
-                new JcaSignerInfoGeneratorBuilder(
-                        new JcaDigestCalculatorProviderBuilder().build())
+                new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().build())
                         .setDirectSignature(true)
-                        .build(signer, publicKey));
+                        .build(signer, publicKey)
+        );
         gen.addCertificates(certs);
         CMSSignedData sigData = gen.generate(data, false);
-        ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded());
-        DEROutputStream dos = new DEROutputStream(out);
-        dos.writeObject(asn1.readObject());
+
+        try (ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded())) {
+            ASN1OutputStream dos = ASN1OutputStream.create(out, ASN1Encoding.DER);
+            dos.writeObject(asn1.readObject());
+        }
     }
+
     /**
      * Copy all the files in a manifest from input to output.  We set
      * the modification times in the output to a fixed time, so as to
@@ -307,27 +283,37 @@ public class SignAPK {
      * more efficient.
      */
     private static void copyFiles(Manifest manifest, JarMap in, JarOutputStream out,
-                                  long timestamp, int alignment) throws IOException {
+                                  long timestamp, int defaultAlignment) throws IOException {
         byte[] buffer = new byte[4096];
         int num;
+
         Map<String, Attributes> entries = manifest.getEntries();
         ArrayList<String> names = new ArrayList<>(entries.keySet());
         Collections.sort(names);
+
         boolean firstEntry = true;
         long offset = 0L;
+
         // We do the copy in two passes -- first copying all the
         // entries that are STORED, then copying all the entries that
         // have any other compression flag (which in practice means
         // DEFLATED).  This groups all the stored entries together at
         // the start of the file and makes it easier to do alignment
         // on them (since only stored entries are aligned).
+
         for (String name : names) {
             JarEntry inEntry = in.getJarEntry(name);
-            JarEntry outEntry = null;
+            JarEntry outEntry;
             if (inEntry.getMethod() != JarEntry.STORED) continue;
             // Preserve the STORED method of the input entry.
             outEntry = new JarEntry(inEntry);
             outEntry.setTime(timestamp);
+            // Discard comment and extra fields of this entry to
+            // simplify alignment logic below and for consistency with
+            // how compressed entries are handled later.
+            outEntry.setComment(null);
+            outEntry.setExtra(null);
+
             // 'offset' is the offset into the file at which we expect
             // the file data to begin.  This is the value we need to
             // make a multiple of 'alignement'.
@@ -341,15 +327,18 @@ public class SignAPK {
                 offset += 4;
                 firstEntry = false;
             }
+            int alignment = getStoredEntryDataAlignment(name, defaultAlignment);
             if (alignment > 0 && (offset % alignment != 0)) {
                 // Set the "extra data" of the entry to between 1 and
                 // alignment-1 bytes, to make the file data begin at
                 // an aligned offset.
-                int needed = alignment - (int)(offset % alignment);
+                int needed = alignment - (int) (offset % alignment);
                 outEntry.setExtra(new byte[needed]);
                 offset += needed;
             }
+
             out.putNextEntry(outEntry);
+
             InputStream data = in.getInputStream(inEntry);
             while ((num = data.read(buffer)) > 0) {
                 out.write(buffer, 0, num);
@@ -357,17 +346,20 @@ public class SignAPK {
             }
             out.flush();
         }
+
         // Copy all the non-STORED entries.  We don't attempt to
         // maintain the 'offset' variable past this point; we don't do
         // alignment on these entries.
+
         for (String name : names) {
             JarEntry inEntry = in.getJarEntry(name);
-            JarEntry outEntry = null;
+            JarEntry outEntry;
             if (inEntry.getMethod() == JarEntry.STORED) continue;
             // Create a new entry so that the compressed len is recomputed.
             outEntry = new JarEntry(name);
             outEntry.setTime(timestamp);
             out.putNextEntry(outEntry);
+
             InputStream data = in.getInputStream(inEntry);
             while ((num = data.read(buffer)) > 0) {
                 out.write(buffer, 0, num);
@@ -376,134 +368,203 @@ public class SignAPK {
         }
     }
 
-    // This class is to provide a file's content, but trimming out the last two bytes
-    // Used for signWholeFile
-    private static class CMSProcessableFile implements CMSTypedData {
-
-        private ASN1ObjectIdentifier type;
-        private RandomAccessFile file;
-
-        CMSProcessableFile(File file) throws FileNotFoundException {
-            this.file = new RandomAccessFile(file, "r");
-            type = new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId());
+    /**
+     * Returns the multiple (in bytes) at which the provided {@code STORED} entry's data must start
+     * relative to start of file or {@code 0} if alignment of this entry's data is not important.
+     */
+    private static int getStoredEntryDataAlignment(String entryName, int defaultAlignment) {
+        if (defaultAlignment <= 0) {
+            return 0;
         }
 
-        @Override
-        public ASN1ObjectIdentifier getContentType() {
-            return type;
-        }
-
-        @Override
-        public void write(OutputStream out) throws IOException, CMSException {
-            file.seek(0);
-            int read;
-            byte buffer[] = new byte[4096];
-            int len = (int) file.length() - 2;
-            while ((read = file.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
-                out.write(buffer, 0, read);
-                len -= read;
-            }
-        }
-
-        @Override
-        public Object getContent() {
-            return file;
-        }
-
-        byte[] getTail() throws IOException {
-            byte tail[] = new byte[22];
-            file.seek(file.length() - 22);
-            file.readFully(tail);
-            return tail;
+        if (entryName.endsWith(".so")) {
+            // Align .so contents to memory page boundary to enable memory-mapped
+            // execution.
+            return 4096;
+        } else {
+            return defaultAlignment;
         }
     }
 
-    private static void signWholeFile(File input, X509Certificate publicKey,
-                                      PrivateKey privateKey, OutputStream outputStream)
-            throws Exception {
-        ByteArrayOutputStream temp = new ByteArrayOutputStream();
-        // put a readable message and a null char at the start of the
-        // archive comment, so that tools that display the comment
-        // (hopefully) show something sensible.
-        // TODO: anything more useful we can put in this message?
-        byte[] message = "signed by SignApk".getBytes("UTF-8");
-        temp.write(message);
-        temp.write(0);
-
-        CMSProcessableFile cmsFile = new CMSProcessableFile(input);
-        writeSignatureBlock(cmsFile, publicKey, privateKey, temp);
-
-        // For a zip with no archive comment, the
-        // end-of-central-directory record will be 22 bytes long, so
-        // we expect to find the EOCD marker 22 bytes from the end.
-        byte[] zipData = cmsFile.getTail();
-        if (zipData[zipData.length-22] != 0x50 ||
-                zipData[zipData.length-21] != 0x4b ||
-                zipData[zipData.length-20] != 0x05 ||
-                zipData[zipData.length-19] != 0x06) {
-            throw new IllegalArgumentException("zip data already has an archive comment");
-        }
-        int total_size = temp.size() + 6;
-        if (total_size > 0xffff) {
-            throw new IllegalArgumentException("signature is too big for ZIP file comment");
-        }
-        // signature starts this many bytes from the end of the file
-        int signature_start = total_size - message.length - 1;
-        temp.write(signature_start & 0xff);
-        temp.write((signature_start >> 8) & 0xff);
-        // Why the 0xff bytes?  In a zip file with no archive comment,
-        // bytes [-6:-2] of the file are the little-endian offset from
-        // the start of the file to the central directory.  So for the
-        // two high bytes to be 0xff 0xff, the archive would have to
-        // be nearly 4GB in size.  So it's unlikely that a real
-        // commentless archive would have 0xffs here, and lets us tell
-        // an old signed archive from a new one.
-        temp.write(0xff);
-        temp.write(0xff);
-        temp.write(total_size & 0xff);
-        temp.write((total_size >> 8) & 0xff);
-        temp.flush();
-        // Signature verification checks that the EOCD header is the
-        // last such sequence in the file (to avoid minzip finding a
-        // fake EOCD appended after the signature in its scan).  The
-        // odds of producing this sequence by chance are very low, but
-        // let's catch it here if it does.
-        byte[] b = temp.toByteArray();
-        for (int i = 0; i < b.length-3; ++i) {
-            if (b[i] == 0x50 && b[i+1] == 0x4b && b[i+2] == 0x05 && b[i+3] == 0x06) {
-                throw new IllegalArgumentException("found spurious EOCD header at " + i);
-            }
-        }
-        cmsFile.write(outputStream);
-        outputStream.write(total_size & 0xff);
-        outputStream.write((total_size >> 8) & 0xff);
-        temp.writeTo(outputStream);
-        outputStream.close();
-    }
-    private static void signFile(Manifest manifest, JarMap inputJar,
-                                 X509Certificate cert, PrivateKey privateKey,
-                                 JarOutputStream outputJar)
-            throws Exception {
-        // Assume the certificate is valid for at least an hour.
-        long timestamp = cert.getNotBefore().getTime() + 3600L * 1000;
+    private static void signFile(Manifest manifest,
+                                 X509Certificate[] publicKey, PrivateKey[] privateKey,
+                                 long timestamp, JarOutputStream outputJar) throws Exception {
         // MANIFEST.MF
         JarEntry je = new JarEntry(JarFile.MANIFEST_NAME);
         je.setTime(timestamp);
         outputJar.putNextEntry(je);
         manifest.write(outputJar);
-        je = new JarEntry(CERT_SF_NAME);
-        je.setTime(timestamp);
-        outputJar.putNextEntry(je);
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        writeSignatureFile(manifest, baos, getDigestAlgorithm(cert));
-        byte[] signedData = baos.toByteArray();
-        outputJar.write(signedData);
-        // CERT.{EC,RSA} / CERT#.{EC,RSA}
-        final String keyType = cert.getPublicKey().getAlgorithm();
-        je = new JarEntry(String.format(CERT_SIG_NAME, keyType));
-        je.setTime(timestamp);
-        outputJar.putNextEntry(je);
-        writeSignatureBlock(new CMSProcessableByteArray(signedData),
-                cert, privateKey, outputJar);
+
+        int numKeys = publicKey.length;
+        for (int k = 0; k < numKeys; ++k) {
+            // CERT.SF / CERT#.SF
+            je = new JarEntry(numKeys == 1 ? CERT_SF_NAME :
+                    (String.format(Locale.US, CERT_SF_MULTI_NAME, k)));
+            je.setTime(timestamp);
+            outputJar.putNextEntry(je);
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            writeSignatureFile(manifest, baos, getDigestAlgorithm(publicKey[k]));
+            byte[] signedData = baos.toByteArray();
+            outputJar.write(signedData);
+
+            // CERT.{EC,RSA} / CERT#.{EC,RSA}
+            final String keyType = publicKey[k].getPublicKey().getAlgorithm();
+            je = new JarEntry(numKeys == 1 ? (String.format(CERT_SIG_NAME, keyType)) :
+                    (String.format(Locale.US, CERT_SIG_MULTI_NAME, k, keyType)));
+            je.setTime(timestamp);
+            outputJar.putNextEntry(je);
+            writeSignatureBlock(new CMSProcessableByteArray(signedData),
+                    publicKey[k], privateKey[k], outputJar);
+        }
+    }
+
+    /**
+     * Converts the provided lists of private keys, their X.509 certificates, and digest algorithms
+     * into a list of APK Signature Scheme v2 {@code SignerConfig} instances.
+     */
+    private static List<ApkSignerV2.SignerConfig> createV2SignerConfigs(
+            PrivateKey[] privateKeys, X509Certificate[] certificates, String[] digestAlgorithms)
+            throws InvalidKeyException {
+        if (privateKeys.length != certificates.length) {
+            throw new IllegalArgumentException(
+                    "The number of private keys must match the number of certificates: "
+                            + privateKeys.length + " vs" + certificates.length);
+        }
+        List<ApkSignerV2.SignerConfig> result = new ArrayList<>(privateKeys.length);
+        for (int i = 0; i < privateKeys.length; i++) {
+            PrivateKey privateKey = privateKeys[i];
+            X509Certificate certificate = certificates[i];
+            PublicKey publicKey = certificate.getPublicKey();
+            String keyAlgorithm = privateKey.getAlgorithm();
+            if (!keyAlgorithm.equalsIgnoreCase(publicKey.getAlgorithm())) {
+                throw new InvalidKeyException(
+                        "Key algorithm of private key #" + (i + 1) + " does not match key"
+                                + " algorithm of public key #" + (i + 1) + ": " + keyAlgorithm
+                                + " vs " + publicKey.getAlgorithm());
+            }
+            ApkSignerV2.SignerConfig signerConfig = new ApkSignerV2.SignerConfig();
+            signerConfig.privateKey = privateKey;
+            signerConfig.certificates = Collections.singletonList(certificate);
+            List<Integer> signatureAlgorithms = new ArrayList<>(digestAlgorithms.length);
+            for (String digestAlgorithm : digestAlgorithms) {
+                try {
+                    signatureAlgorithms.add(getV2SignatureAlgorithm(keyAlgorithm, digestAlgorithm));
+                } catch (IllegalArgumentException e) {
+                    throw new InvalidKeyException(
+                            "Unsupported key and digest algorithm combination for signer #"
+                                    + (i + 1), e);
+                }
+            }
+            signerConfig.signatureAlgorithms = signatureAlgorithms;
+            result.add(signerConfig);
+        }
+        return result;
+    }
+
+    private static int getV2SignatureAlgorithm(String keyAlgorithm, String digestAlgorithm) {
+        if ("SHA-256".equalsIgnoreCase(digestAlgorithm)) {
+            if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
+                // Use RSASSA-PKCS1-v1_5 signature scheme instead of RSASSA-PSS to guarantee
+                // deterministic signatures which make life easier for OTA updates (fewer files
+                // changed when deterministic signature schemes are used).
+                return ApkSignerV2.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256;
+            } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_ECDSA_WITH_SHA256;
+            } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_DSA_WITH_SHA256;
+            } else {
+                throw new IllegalArgumentException("Unsupported key algorithm: " + keyAlgorithm);
+            }
+        } else if ("SHA-512".equalsIgnoreCase(digestAlgorithm)) {
+            if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
+                // Use RSASSA-PKCS1-v1_5 signature scheme instead of RSASSA-PSS to guarantee
+                // deterministic signatures which make life easier for OTA updates (fewer files
+                // changed when deterministic signature schemes are used).
+                return ApkSignerV2.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512;
+            } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_ECDSA_WITH_SHA512;
+            } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_DSA_WITH_SHA512;
+            } else {
+                throw new IllegalArgumentException("Unsupported key algorithm: " + keyAlgorithm);
+            }
+        } else {
+            throw new IllegalArgumentException("Unsupported digest algorithm: " + digestAlgorithm);
+        }
+    }
+
+    public static void sign(X509Certificate cert, PrivateKey key,
+                            JarMap inputJar, FileOutputStream outputFile) throws Exception {
+        int alignment = 4;
+        int hashes = 0;
+
+        X509Certificate[] publicKey = new X509Certificate[1];
+        publicKey[0] = cert;
+        hashes |= getDigestAlgorithm(publicKey[0]);
+
+        // Set all ZIP file timestamps to Jan 1 2009 00:00:00.
+        long timestamp = 1230768000000L;
+        // The Java ZipEntry API we're using converts milliseconds since epoch into MS-DOS
+        // timestamp using the current timezone. We thus adjust the milliseconds since epoch
+        // value to end up with MS-DOS timestamp of Jan 1 2009 00:00:00.
+        timestamp -= TimeZone.getDefault().getOffset(timestamp);
+
+        PrivateKey[] privateKey = new PrivateKey[1];
+        privateKey[0] = key;
+
+        // Generate, in memory, an APK signed using standard JAR Signature Scheme.
+        ByteArrayOutputStream v1SignedApkBuf = new ByteArrayOutputStream();
+        JarOutputStream outputJar = new JarOutputStream(v1SignedApkBuf);
+        // Use maximum compression for compressed entries because the APK lives forever on
+        // the system partition.
+        outputJar.setLevel(9);
+        Manifest manifest = addDigestsToManifest(inputJar, hashes);
+        copyFiles(manifest, inputJar, outputJar, timestamp, alignment);
+        signFile(manifest, publicKey, privateKey, timestamp, outputJar);
+        outputJar.close();
+        ByteBuffer v1SignedApk = ByteBuffer.wrap(v1SignedApkBuf.toByteArray());
+        v1SignedApkBuf.reset();
+
+        ByteBuffer[] outputChunks;
+        List<ApkSignerV2.SignerConfig> signerConfigs = createV2SignerConfigs(privateKey, publicKey,
+                new String[]{APK_SIG_SCHEME_V2_DIGEST_ALGORITHM});
+        outputChunks = ApkSignerV2.sign(v1SignedApk, signerConfigs);
+
+        // This assumes outputChunks are array-backed. To avoid this assumption, the
+        // code could be rewritten to use FileChannel.
+        for (ByteBuffer outputChunk : outputChunks) {
+            outputFile.write(outputChunk.array(),
+                    outputChunk.arrayOffset() + outputChunk.position(), outputChunk.remaining());
+            outputChunk.position(outputChunk.limit());
+        }
+    }
+
+    /**
+     * Write to another stream and track how many bytes have been
+     * written.
+     */
+    private static class CountOutputStream extends FilterOutputStream {
+        private int mCount;
+
+        public CountOutputStream(OutputStream out) {
+            super(out);
+            mCount = 0;
+        }
+
+        @Override
+        public void write(int b) throws IOException {
+            super.write(b);
+            mCount++;
+        }
+
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            super.write(b, off, len);
+            mCount += len;
+        }
+
+        public int size() {
+            return mCount;
+        }
     }
 }

app/signing/src/main/java/com/topjohnwu/signing/ZipSigner.java

@@ -6,7 +6,6 @@ import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.OutputStream;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
@@ -28,20 +27,20 @@ public class ZipSigner {
         System.exit(2);
     }
 
-    private static void sign(JarMap input, OutputStream output) throws Exception {
-        sign(SignAPK.class.getResourceAsStream("/keys/testkey.x509.pem"),
-                SignAPK.class.getResourceAsStream("/keys/testkey.pk8"), input, output);
+    private static void sign(JarMap input, FileOutputStream output) throws Exception {
+        sign(SignApk.class.getResourceAsStream("/keys/testkey.x509.pem"),
+                SignApk.class.getResourceAsStream("/keys/testkey.pk8"), input, output);
     }
 
     private static void sign(InputStream certIs, InputStream keyIs,
-                             JarMap input, OutputStream output) throws Exception {
+                             JarMap input, FileOutputStream output) throws Exception {
         X509Certificate cert = CryptoUtils.readCertificate(certIs);
         PrivateKey key = CryptoUtils.readPrivateKey(keyIs);
-        SignAPK.signAndAdjust(cert, key, input, output);
+        SignApk.sign(cert, key, input, output);
     }
 
     private static void sign(String keyStore, String keyStorePass, String alias, String keyPass,
-                             JarMap in, OutputStream out) throws Exception {
+                             JarMap in, FileOutputStream out) throws Exception {
         KeyStore ks;
         try {
             ks = KeyStore.getInstance("JKS");
@@ -56,7 +55,7 @@ public class ZipSigner {
         }
         X509Certificate cert = (X509Certificate) ks.getCertificate(alias);
         PrivateKey key = (PrivateKey) ks.getKey(alias, keyPass.toCharArray());
-        SignAPK.signAndAdjust(cert, key, in, out);
+        SignApk.sign(cert, key, in, out);
     }
 
     public static void main(String[] args) throws Exception {
@@ -66,7 +65,7 @@ public class ZipSigner {
         Security.insertProviderAt(new BouncyCastleProvider(), 1);
 
         try (JarMap in = JarMap.open(args[args.length - 2], false);
-             OutputStream out = new FileOutputStream(args[args.length - 1])) {
+             FileOutputStream out = new FileOutputStream(args[args.length - 1])) {
             if (args.length == 2) {
                 sign(in, out);
             } else if (args.length == 4) {

app/signing/src/main/java/com/topjohnwu/signing/ZipUtils.java

@@ -0,0 +1,136 @@
+package com.topjohnwu.signing;
+
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+
+/**
+ * Assorted ZIP format helpers.
+ *
+ * <p>NOTE: Most helper methods operating on {@code ByteBuffer} instances expect that the byte
+ * order of these buffers is little-endian.
+ */
+public abstract class ZipUtils {
+
+    private static final int ZIP_EOCD_REC_MIN_SIZE = 22;
+    private static final int ZIP_EOCD_REC_SIG = 0x06054b50;
+    private static final int ZIP_EOCD_CENTRAL_DIR_SIZE_FIELD_OFFSET = 12;
+    private static final int ZIP_EOCD_CENTRAL_DIR_OFFSET_FIELD_OFFSET = 16;
+    private static final int ZIP_EOCD_COMMENT_LENGTH_FIELD_OFFSET = 20;
+
+    private static final int ZIP64_EOCD_LOCATOR_SIZE = 20;
+    private static final int ZIP64_EOCD_LOCATOR_SIG = 0x07064b50;
+
+    private static final int UINT16_MAX_VALUE = 0xffff;
+
+    private ZipUtils() {
+    }
+
+    /**
+     * Returns the position at which ZIP End of Central Directory record starts in the provided
+     * buffer or {@code -1} if the record is not present.
+     *
+     * <p>NOTE: Byte order of {@code zipContents} must be little-endian.
+     */
+    public static int findZipEndOfCentralDirectoryRecord(ByteBuffer zipContents) {
+        assertByteOrderLittleEndian(zipContents);
+
+        // ZIP End of Central Directory (EOCD) record is located at the very end of the ZIP archive.
+        // The record can be identified by its 4-byte signature/magic which is located at the very
+        // beginning of the record. A complication is that the record is variable-length because of
+        // the comment field.
+        // The algorithm for locating the ZIP EOCD record is as follows. We search backwards from
+        // end of the buffer for the EOCD record signature. Whenever we find a signature, we check
+        // the candidate record's comment length is such that the remainder of the record takes up
+        // exactly the remaining bytes in the buffer. The search is bounded because the maximum
+        // size of the comment field is 65535 bytes because the field is an unsigned 16-bit number.
+
+        int archiveSize = zipContents.capacity();
+        if (archiveSize < ZIP_EOCD_REC_MIN_SIZE) {
+            return -1;
+        }
+        int maxCommentLength = Math.min(archiveSize - ZIP_EOCD_REC_MIN_SIZE, UINT16_MAX_VALUE);
+        int eocdWithEmptyCommentStartPosition = archiveSize - ZIP_EOCD_REC_MIN_SIZE;
+        for (int expectedCommentLength = 0; expectedCommentLength < maxCommentLength; expectedCommentLength++) {
+            int eocdStartPos = eocdWithEmptyCommentStartPosition - expectedCommentLength;
+            if (zipContents.getInt(eocdStartPos) == ZIP_EOCD_REC_SIG) {
+                int actualCommentLength = getUnsignedInt16(zipContents, eocdStartPos + ZIP_EOCD_COMMENT_LENGTH_FIELD_OFFSET);
+                if (actualCommentLength == expectedCommentLength) {
+                    return eocdStartPos;
+                }
+            }
+        }
+
+        return -1;
+    }
+
+    /**
+     * Returns {@code true} if the provided buffer contains a ZIP64 End of Central Directory
+     * Locator.
+     *
+     * <p>NOTE: Byte order of {@code zipContents} must be little-endian.
+     */
+    public static boolean isZip64EndOfCentralDirectoryLocatorPresent(ByteBuffer zipContents, int zipEndOfCentralDirectoryPosition) {
+        assertByteOrderLittleEndian(zipContents);
+
+        // ZIP64 End of Central Directory Locator immediately precedes the ZIP End of Central
+        // Directory Record.
+
+        int locatorPosition = zipEndOfCentralDirectoryPosition - ZIP64_EOCD_LOCATOR_SIZE;
+        if (locatorPosition < 0) {
+            return false;
+        }
+
+        return zipContents.getInt(locatorPosition) == ZIP64_EOCD_LOCATOR_SIG;
+    }
+
+    /**
+     * Returns the offset of the start of the ZIP Central Directory in the archive.
+     *
+     * <p>NOTE: Byte order of {@code zipEndOfCentralDirectory} must be little-endian.
+     */
+    public static long getZipEocdCentralDirectoryOffset(ByteBuffer zipEndOfCentralDirectory) {
+        assertByteOrderLittleEndian(zipEndOfCentralDirectory);
+        return getUnsignedInt32(zipEndOfCentralDirectory, zipEndOfCentralDirectory.position() + ZIP_EOCD_CENTRAL_DIR_OFFSET_FIELD_OFFSET);
+    }
+
+    /**
+     * Sets the offset of the start of the ZIP Central Directory in the archive.
+     *
+     * <p>NOTE: Byte order of {@code zipEndOfCentralDirectory} must be little-endian.
+     */
+    public static void setZipEocdCentralDirectoryOffset(ByteBuffer zipEndOfCentralDirectory, long offset) {
+        assertByteOrderLittleEndian(zipEndOfCentralDirectory);
+        setUnsignedInt32(zipEndOfCentralDirectory, zipEndOfCentralDirectory.position() + ZIP_EOCD_CENTRAL_DIR_OFFSET_FIELD_OFFSET, offset);
+    }
+
+    /**
+     * Returns the size (in bytes) of the ZIP Central Directory.
+     *
+     * <p>NOTE: Byte order of {@code zipEndOfCentralDirectory} must be little-endian.
+     */
+    public static long getZipEocdCentralDirectorySizeBytes(ByteBuffer zipEndOfCentralDirectory) {
+        assertByteOrderLittleEndian(zipEndOfCentralDirectory);
+        return getUnsignedInt32(zipEndOfCentralDirectory, zipEndOfCentralDirectory.position() + ZIP_EOCD_CENTRAL_DIR_SIZE_FIELD_OFFSET);
+    }
+
+    private static void assertByteOrderLittleEndian(ByteBuffer buffer) {
+        if (buffer.order() != ByteOrder.LITTLE_ENDIAN) {
+            throw new IllegalArgumentException("ByteBuffer byte order must be little endian");
+        }
+    }
+
+    private static int getUnsignedInt16(ByteBuffer buffer, int offset) {
+        return buffer.getShort(offset) & 0xffff;
+    }
+
+    private static long getUnsignedInt32(ByteBuffer buffer, int offset) {
+        return buffer.getInt(offset) & 0xffffffffL;
+    }
+
+    private static void setUnsignedInt32(ByteBuffer buffer, int offset, long value) {
+        if ((value < 0) || (value > 0xffffffffL)) {
+            throw new IllegalArgumentException("uint32 value of out range: " + value);
+        }
+        buffer.putInt(buffer.position() + offset, (int) value);
+    }
+}

app/src/main/AndroidManifest.xml

@@ -1,5 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
-
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools"
     package="com.topjohnwu.magisk">
@@ -7,8 +6,12 @@
     <uses-permission android:name="android.permission.INTERNET"/>
     <uses-permission android:name="android.permission.VIBRATE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission
+        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+        android:maxSdkVersion="28" />
 
     <application
+        android:icon="@drawable/ic_launcher"
         android:name="a.e"
         android:allowBackup="true"
         tools:ignore="UnusedAttribute,GoogleAppIndexingWarning">
@@ -21,21 +24,21 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.APPLICATION_PREFERENCES" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
         </activity>
 
         <!-- Main -->
         <activity android:name="a.b" />
 
-        <!-- Flashing  -->
-        <activity android:name="a.f" />
-
         <!-- Superuser -->
         <activity
             android:name="a.m"
             android:directBootAware="true"
             android:excludeFromRecents="true"
             android:exported="false"
-            android:theme="@android:style/Theme.Translucent.NoTitleBar"
             tools:ignore="AppLinkUrlError">
             <intent-filter>
                 <action android:name="android.intent.action.VIEW"/>

app/src/main/java/a/a.java

@@ -1,20 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.utils.PatchAPK;
-import com.topjohnwu.signing.BootSigner;
-
-public class a {
-
-    @Deprecated
-    public static boolean patchAPK(String in, String out, String pkg) {
-        return PatchAPK.patch(in, out, pkg);
-    }
-
-    public static boolean patchAPK(String in, String out, String pkg, String label) {
-        return PatchAPK.patch(in, out, pkg, label);
-    }
-
-    public static void main(String[] args) throws Exception {
-        BootSigner.main(args);
-    }
-}

app/src/main/java/a/b.java

@@ -1,7 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.ui.MainActivity;
-
-public class b extends MainActivity {
-    /* stub */
-}

app/src/main/java/a/c.java

@@ -1,7 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.ui.SplashActivity;
-
-public class c extends SplashActivity {
-    /* stub */
-}

app/src/main/java/a/e.java

@@ -1,13 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.App;
-
-public class e extends App {
-    public e() {
-        super();
-    }
-
-    public e(Object o) {
-        super(o);
-    }
-}

app/src/main/java/a/f.java

@@ -1,7 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.ui.flash.FlashActivity;
-
-public class f extends FlashActivity {
-    /* stub */
-}

app/src/main/java/a/g.java

@@ -1,15 +0,0 @@
-package a;
-
-import android.content.Context;
-
-import com.topjohnwu.magisk.model.update.UpdateCheckService;
-
-import androidx.annotation.NonNull;
-import androidx.work.WorkerParameters;
-
-public class g extends w<UpdateCheckService> {
-    /* Stub */
-    public g(@NonNull Context context, @NonNull WorkerParameters workerParams) {
-        super(context, workerParams);
-    }
-}

app/src/main/java/a/h.java

@@ -1,7 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.model.receiver.GeneralReceiver;
-
-public class h extends GeneralReceiver {
-    /* stub */
-}

app/src/main/java/a/j.java

@@ -1,7 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.model.download.DownloadService;
-
-public class j extends DownloadService {
-    /* stub */
-}

app/src/main/java/a/m.java

@@ -1,7 +0,0 @@
-package a;
-
-import com.topjohnwu.magisk.ui.surequest.SuRequestActivity;
-
-public class m extends SuRequestActivity {
-    /* stub */
-}

app/src/main/java/a/stubs.kt

@@ -0,0 +1,29 @@
+@file:JvmName("a")
+package a
+
+import com.topjohnwu.magisk.core.App
+import com.topjohnwu.magisk.core.GeneralReceiver
+import com.topjohnwu.magisk.core.SplashActivity
+import com.topjohnwu.magisk.core.download.DownloadService
+import com.topjohnwu.magisk.ui.MainActivity
+import com.topjohnwu.magisk.ui.surequest.SuRequestActivity
+import com.topjohnwu.signing.BootSigner
+
+fun main(args: Array<String>) {
+    BootSigner.main(args)
+}
+
+class b : MainActivity()
+
+class c : SplashActivity()
+
+class e : App {
+    constructor() : super()
+    constructor(o: Any) : super(o)
+}
+
+class h : GeneralReceiver()
+
+class j : DownloadService()
+
+class m : SuRequestActivity()

app/src/main/java/a/w.java

@@ -1,42 +0,0 @@
-package a;
-
-import android.content.Context;
-
-import androidx.annotation.NonNull;
-import androidx.work.Worker;
-import androidx.work.WorkerParameters;
-
-import com.topjohnwu.magisk.base.DelegateWorker;
-
-import java.lang.reflect.ParameterizedType;
-
-public abstract class w<T extends DelegateWorker> extends Worker {
-
-    /* Wrapper class to workaround Proguard -keep class * extends Worker */
-
-    private T base;
-
-    @SuppressWarnings("unchecked")
-    w(@NonNull Context context, @NonNull WorkerParameters workerParams) {
-        super(context, workerParams);
-        try {
-            base = ((Class<T>) ((ParameterizedType) getClass().getGenericSuperclass())
-                    .getActualTypeArguments()[0]).newInstance();
-            base.attachWorker(this);
-        } catch (Exception ignored) {}
-    }
-
-    @NonNull
-    @Override
-    public Result doWork() {
-        if (base == null)
-            return Result.failure();
-        return base.doWork();
-    }
-
-    @Override
-    public void onStopped() {
-        if (base != null)
-            base.onStopped();
-    }
-}

app/src/main/java/com/topjohnwu/magisk/Info.kt

@@ -1,77 +0,0 @@
-package com.topjohnwu.magisk
-
-import com.github.pwittchen.reactivenetwork.library.rx2.ReactiveNetwork
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.subscribeK
-import com.topjohnwu.magisk.model.entity.UpdateInfo
-import com.topjohnwu.magisk.utils.CachedValue
-import com.topjohnwu.magisk.utils.KObservableField
-import com.topjohnwu.superuser.Shell
-import com.topjohnwu.superuser.ShellUtils
-import java.io.FileInputStream
-import java.io.IOException
-
-val isRunningAsStub get() = Info.stub != null
-
-object Info {
-
-    val envRef = CachedValue { loadState() }
-
-    val env by envRef              // Local
-    var remote = UpdateInfo()      // Remote
-    var stub: DynAPK.Data? = null  // Stub
-
-    var keepVerity = false
-    var keepEnc = false
-    var recovery = false
-
-    val isConnected by lazy {
-        KObservableField(false).also { field ->
-            ReactiveNetwork.observeNetworkConnectivity(get())
-                .subscribeK {
-                    field.value = it.available()
-                }
-        }
-    }
-
-    val isNewReboot by lazy {
-        try {
-            FileInputStream("/proc/sys/kernel/random/boot_id").bufferedReader().use {
-                val id = it.readLine()
-                if (id != Config.bootId) {
-                    Config.bootId = id
-                    true
-                } else {
-                    false
-                }
-            }
-        } catch (e: IOException) {
-            false
-        }
-    }
-
-    private fun loadState() = runCatching {
-        val str = ShellUtils.fastCmd("magisk -v").split(":".toRegex())[0]
-        val code = ShellUtils.fastCmd("magisk -V").toInt()
-        val hide = Shell.su("magiskhide --status").exec().isSuccess
-        Env(str, code, hide)
-    }.getOrElse { Env() }
-
-    class Env(
-        val magiskVersionString: String = "",
-        code: Int = -1,
-        hide: Boolean = false
-    ) {
-        val magiskHide get() = Config.magiskHide
-        val magiskVersionCode = when (code) {
-            in Int.MIN_VALUE..Const.Version.MIN_VERCODE -> -1
-            else -> if(Shell.rootAccess()) code else -1
-        }
-        val isUnsupported = code > 0 && code < Const.Version.MIN_VERCODE
-        val isActive = magiskVersionCode >= 0
-
-        init {
-            Config.magiskHide = hide
-        }
-    }
-}

app/src/main/java/com/topjohnwu/magisk/arch/BaseUIActivity.kt

@@ -0,0 +1,113 @@
+package com.topjohnwu.magisk.arch
+
+import android.content.Intent
+import android.os.Bundle
+import android.view.KeyEvent
+import android.view.View
+import androidx.appcompat.app.AppCompatDelegate
+import androidx.core.content.res.use
+import androidx.databinding.DataBindingUtil
+import androidx.databinding.ViewDataBinding
+import androidx.lifecycle.MutableLiveData
+import androidx.navigation.NavController
+import androidx.navigation.NavDirections
+import androidx.navigation.fragment.NavHostFragment
+import com.topjohnwu.magisk.BR
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.base.BaseActivity
+import com.topjohnwu.magisk.ui.theme.Theme
+
+abstract class BaseUIActivity<VM : BaseViewModel, Binding : ViewDataBinding> :
+    BaseActivity(), BaseUIComponent<VM> {
+
+    protected lateinit var binding: Binding
+    protected abstract val layoutRes: Int
+    protected open val themeRes: Int = Theme.selected.themeRes
+
+    private val navHostFragment by lazy {
+        supportFragmentManager.findFragmentById(navHost) as? NavHostFragment
+    }
+    private val topFragment get() = navHostFragment?.childFragmentManager?.fragments?.getOrNull(0)
+    protected val currentFragment get() = topFragment as? BaseUIFragment<*, *>
+
+    override val viewRoot: View get() = binding.root
+    open val navigation: NavController? get() = navHostFragment?.navController
+
+    open val navHost: Int = 0
+    open val snackbarView get() = binding.root
+
+    init {
+        val theme = Config.darkTheme
+        AppCompatDelegate.setDefaultNightMode(theme)
+    }
+
+    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
+        super.onActivityResult(requestCode, resultCode, data)
+        currentFragment?.onActivityResult(requestCode, resultCode, data)
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        setTheme(themeRes)
+        super.onCreate(savedInstanceState)
+
+        startObserveEvents()
+
+        // We need to set the window background explicitly since for whatever reason it's not
+        // propagated upstream
+        obtainStyledAttributes(intArrayOf(android.R.attr.windowBackground))
+            .use { it.getDrawable(0) }
+            .also { window.setBackgroundDrawable(it) }
+
+        directionsDispatcher.observe(this) {
+            it?.navigate()
+            // we don't want the directions to be re-dispatched, so we preemptively set them to null
+            if (it != null) {
+                directionsDispatcher.value = null
+            }
+        }
+    }
+
+    fun setContentView() {
+        binding = DataBindingUtil.setContentView<Binding>(this, layoutRes).also {
+            it.setVariable(BR.viewModel, viewModel)
+            it.lifecycleOwner = this
+        }
+
+        ensureInsets()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        viewModel.requestRefresh()
+    }
+
+    override fun dispatchKeyEvent(event: KeyEvent): Boolean {
+        return currentFragment?.onKeyEvent(event) == true || super.dispatchKeyEvent(event)
+    }
+
+    override fun onEventDispatched(event: ViewEvent) = when(event) {
+        is ContextExecutor -> event(this)
+        is ActivityExecutor -> event(this)
+        else -> Unit
+    }
+
+    override fun onBackPressed() {
+        if (navigation == null || currentFragment?.onBackPressed()?.not() == true) {
+            super.onBackPressed()
+        }
+    }
+
+    fun NavDirections.navigate() {
+        navigation?.navigate(this)
+    }
+
+    companion object {
+
+        private val directionsDispatcher = MutableLiveData<NavDirections?>()
+
+        fun postDirections(navDirections: NavDirections) =
+            directionsDispatcher.postValue(navDirections)
+
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/BaseUIComponent.kt

@@ -0,0 +1,63 @@
+package com.topjohnwu.magisk.arch
+
+import android.view.View
+import androidx.core.graphics.Insets
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.lifecycle.LifecycleOwner
+
+interface BaseUIComponent<VM : BaseViewModel>: LifecycleOwner {
+
+    val viewRoot: View
+    val viewModel: VM
+
+    fun startObserveEvents() {
+        viewModel.viewEvents.observe(this) {
+            onEventDispatched(it)
+        }
+    }
+
+    fun consumeSystemWindowInsets(insets: Insets): Insets? = null
+
+    /**
+     * Called for all [ViewEvent]s published by associated viewModel.
+     */
+    fun onEventDispatched(event: ViewEvent) {}
+
+    fun ensureInsets() {
+        ViewCompat.setOnApplyWindowInsetsListener(viewRoot) { _, insets ->
+            insets.asInsets()
+                .also { viewModel.insets = it }
+                .let { consumeSystemWindowInsets(it) }
+                ?.subtractBy(insets) ?: insets
+        }
+        if (ViewCompat.isAttachedToWindow(viewRoot)) {
+            ViewCompat.requestApplyInsets(viewRoot)
+        } else {
+            viewRoot.addOnAttachStateChangeListener(object : View.OnAttachStateChangeListener {
+                override fun onViewDetachedFromWindow(v: View) = Unit
+                override fun onViewAttachedToWindow(v: View) {
+                    ViewCompat.requestApplyInsets(v)
+                }
+            })
+        }
+    }
+
+    private fun WindowInsetsCompat.asInsets() = Insets.of(
+        systemWindowInsetLeft,
+        systemWindowInsetTop,
+        systemWindowInsetRight,
+        systemWindowInsetBottom
+    )
+
+    private fun Insets.subtractBy(insets: WindowInsetsCompat) =
+        WindowInsetsCompat.Builder(insets).setSystemWindowInsets(
+            Insets.of(
+                insets.systemWindowInsetLeft - left,
+                insets.systemWindowInsetTop - top,
+                insets.systemWindowInsetRight - right,
+                insets.systemWindowInsetBottom - bottom
+            )
+        ).build()
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/BaseUIFragment.kt

@@ -0,0 +1,90 @@
+package com.topjohnwu.magisk.arch
+
+import android.os.Bundle
+import android.view.KeyEvent
+import android.view.LayoutInflater
+import android.view.View
+import android.view.ViewGroup
+import androidx.core.graphics.Insets
+import androidx.databinding.DataBindingUtil
+import androidx.databinding.OnRebindCallback
+import androidx.databinding.ViewDataBinding
+import androidx.fragment.app.Fragment
+import androidx.navigation.NavDirections
+import com.topjohnwu.magisk.BR
+import com.topjohnwu.magisk.ktx.startAnimations
+
+abstract class BaseUIFragment<VM : BaseViewModel, Binding : ViewDataBinding> :
+    Fragment(), BaseUIComponent<VM> {
+
+    protected val activity get() = requireActivity() as BaseUIActivity<*, *>
+    protected lateinit var binding: Binding
+    protected abstract val layoutRes: Int
+
+    override val viewRoot: View get() = binding.root
+    private val navigation get() = activity.navigation
+
+    override fun consumeSystemWindowInsets(insets: Insets) = insets
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        startObserveEvents()
+    }
+
+    override fun onCreateView(
+        inflater: LayoutInflater,
+        container: ViewGroup?,
+        savedInstanceState: Bundle?
+    ): View? {
+        binding = DataBindingUtil.inflate<Binding>(inflater, layoutRes, container, false).also {
+            it.setVariable(BR.viewModel, viewModel)
+            it.lifecycleOwner = this
+        }
+        return binding.root
+    }
+
+    override fun onEventDispatched(event: ViewEvent) = when(event) {
+        is ContextExecutor -> event(requireContext())
+        is ActivityExecutor -> event(activity)
+        is FragmentExecutor -> event(this)
+        else -> Unit
+    }
+
+    open fun onKeyEvent(event: KeyEvent): Boolean {
+        return false
+    }
+
+    open fun onBackPressed(): Boolean = false
+
+
+    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
+        super.onViewCreated(view, savedInstanceState)
+        binding.addOnRebindCallback(object : OnRebindCallback<Binding>() {
+            override fun onPreBind(binding: Binding): Boolean {
+                this@BaseUIFragment.onPreBind(binding)
+                return true
+            }
+        })
+        ensureInsets()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        viewModel.requestRefresh()
+    }
+
+    protected open fun onPreBind(binding: Binding) {
+        (binding.root as? ViewGroup)?.startAnimations()
+    }
+
+    fun NavDirections.navigate() {
+        navigation?.navigate(this)
+    }
+
+}
+
+interface ReselectionTarget {
+
+    fun onReselected()
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/BaseViewModel.kt

@@ -0,0 +1,114 @@
+package com.topjohnwu.magisk.arch
+
+import android.Manifest
+import android.os.Build
+import androidx.annotation.CallSuper
+import androidx.core.graphics.Insets
+import androidx.databinding.Bindable
+import androidx.databinding.Observable
+import androidx.databinding.PropertyChangeRegistry
+import androidx.lifecycle.LiveData
+import androidx.lifecycle.MutableLiveData
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import androidx.navigation.NavDirections
+import com.topjohnwu.magisk.BR
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.base.BaseActivity
+import com.topjohnwu.magisk.events.*
+import com.topjohnwu.magisk.utils.ObservableHost
+import com.topjohnwu.magisk.utils.set
+import kotlinx.coroutines.Job
+import org.koin.core.KoinComponent
+
+abstract class BaseViewModel(
+    initialState: State = State.LOADING
+) : ViewModel(), ObservableHost, KoinComponent {
+
+    override var callbacks: PropertyChangeRegistry? = null
+
+    enum class State {
+        LOADED, LOADING, LOADING_FAILED
+    }
+
+    @get:Bindable
+    val loading get() = state == State.LOADING
+    @get:Bindable
+    val loaded get() = state == State.LOADED
+    @get:Bindable
+    val loadFailed get() = state == State.LOADING_FAILED
+
+    val isConnected get() = Info.isConnected
+    val viewEvents: LiveData<ViewEvent> get() = _viewEvents
+
+    @get:Bindable
+    var insets = Insets.NONE
+        set(value) = set(value, field, { field = it }, BR.insets)
+
+    var state= initialState
+        set(value) = set(value, field, { field = it }, BR.loading, BR.loaded, BR.loadFailed)
+
+    private val _viewEvents = MutableLiveData<ViewEvent>()
+    private var runningJob: Job? = null
+    private val refreshCallback = object : Observable.OnPropertyChangedCallback() {
+        override fun onPropertyChanged(sender: Observable?, propertyId: Int) {
+            requestRefresh()
+        }
+    }
+
+    init {
+        isConnected.addOnPropertyChangedCallback(refreshCallback)
+    }
+
+    /** This should probably never be called manually, it's called manually via delegate. */
+    @Synchronized
+    fun requestRefresh() {
+        if (runningJob?.isActive == true) {
+            return
+        }
+        runningJob = refresh()
+    }
+
+    protected open fun refresh(): Job? = null
+
+    @CallSuper
+    override fun onCleared() {
+        isConnected.removeOnPropertyChangedCallback(refreshCallback)
+        super.onCleared()
+    }
+
+    fun withView(action: BaseActivity.() -> Unit) {
+        ViewActionEvent(action).publish()
+    }
+
+    fun withPermission(permission: String, callback: (Boolean) -> Unit) {
+        PermissionEvent(permission, callback).publish()
+    }
+
+    fun withExternalRW(callback: () -> Unit) {
+        withPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE) {
+            if (!it) {
+                SnackbarEvent(R.string.external_rw_permission_denied).publish()
+            } else {
+                callback()
+            }
+        }
+    }
+
+    fun back() = BackPressEvent().publish()
+
+    fun <Event : ViewEvent> Event.publish() {
+        _viewEvents.postValue(this)
+    }
+
+    fun <Event : ViewEventWithScope> Event.publish() {
+        scope = viewModelScope
+        _viewEvents.postValue(this)
+    }
+
+    fun NavDirections.publish() {
+        _viewEvents.postValue(NavigationEvent(this))
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/Helpers.kt

@@ -0,0 +1,48 @@
+package com.topjohnwu.magisk.arch
+
+import androidx.databinding.ViewDataBinding
+import com.topjohnwu.magisk.databinding.ComparableRvItem
+import com.topjohnwu.magisk.databinding.RvItem
+import com.topjohnwu.magisk.utils.DiffObservableList
+import com.topjohnwu.magisk.utils.FilterableDiffObservableList
+import me.tatarka.bindingcollectionadapter2.BindingRecyclerViewAdapter
+import me.tatarka.bindingcollectionadapter2.ItemBinding
+import me.tatarka.bindingcollectionadapter2.OnItemBind
+
+inline fun <T : ComparableRvItem<*>> diffListOf(
+    vararg newItems: T
+) = diffListOf(newItems.toList())
+
+inline fun <T : ComparableRvItem<*>> diffListOf(
+    newItems: List<T>
+) = DiffObservableList(object : DiffObservableList.Callback<T> {
+    override fun areItemsTheSame(oldItem: T, newItem: T) = oldItem.genericItemSameAs(newItem)
+    override fun areContentsTheSame(oldItem: T, newItem: T) = oldItem.genericContentSameAs(newItem)
+}).also { it.update(newItems) }
+
+inline fun <T : ComparableRvItem<*>> filterableListOf(
+    vararg newItems: T
+) = FilterableDiffObservableList(object : DiffObservableList.Callback<T> {
+    override fun areItemsTheSame(oldItem: T, newItem: T) = oldItem.genericItemSameAs(newItem)
+    override fun areContentsTheSame(oldItem: T, newItem: T) = oldItem.genericContentSameAs(newItem)
+}).also { it.update(newItems.toList()) }
+
+fun <T : RvItem> adapterOf() = object : BindingRecyclerViewAdapter<T>() {
+    override fun onBindBinding(
+        binding: ViewDataBinding,
+        variableId: Int,
+        layoutRes: Int,
+        position: Int,
+        item: T
+    ) {
+        super.onBindBinding(binding, variableId, layoutRes, position, item)
+        item.onBindingBound(binding)
+    }
+}
+
+inline fun <T : RvItem> itemBindingOf(
+    crossinline body: (ItemBinding<*>) -> Unit = {}
+) = OnItemBind<T> { itemBinding, _, item ->
+    item.bind(itemBinding)
+    body(itemBinding)
+}

app/src/main/java/com/topjohnwu/magisk/arch/Queryable.kt

@@ -0,0 +1,17 @@
+package com.topjohnwu.magisk.arch
+
+import android.os.Handler
+import androidx.core.os.postDelayed
+import com.topjohnwu.superuser.internal.UiThreadHandler
+
+interface Queryable {
+
+    val queryDelay: Long
+    val queryHandler: Handler get() = UiThreadHandler.handler
+
+    fun submitQuery() {
+        queryHandler.postDelayed(queryDelay) { query() }
+    }
+
+    fun query()
+}

app/src/main/java/com/topjohnwu/magisk/arch/ViewEvent.kt

@@ -0,0 +1,27 @@
+package com.topjohnwu.magisk.arch
+
+import android.content.Context
+import androidx.fragment.app.Fragment
+import kotlinx.coroutines.CoroutineScope
+
+/**
+ * Class for passing events from ViewModels to Activities/Fragments
+ * (see https://medium.com/google-developers/livedata-with-snackbar-navigation-and-other-events-the-singleliveevent-case-ac2622673150)
+ */
+abstract class ViewEvent
+
+abstract class ViewEventWithScope: ViewEvent() {
+    lateinit var scope: CoroutineScope
+}
+
+interface ContextExecutor {
+    operator fun invoke(context: Context)
+}
+
+interface ActivityExecutor {
+    operator fun invoke(activity: BaseUIActivity<*, *>)
+}
+
+interface FragmentExecutor {
+    operator fun invoke(fragment: Fragment)
+}

app/src/main/java/com/topjohnwu/magisk/base/BaseActivity.kt

@@ -1,124 +0,0 @@
-package com.topjohnwu.magisk.base
-
-import android.Manifest
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageManager
-import android.content.res.Configuration
-import android.os.Bundle
-import androidx.appcompat.app.AppCompatActivity
-import androidx.appcompat.app.AppCompatDelegate
-import androidx.collection.SparseArrayCompat
-import androidx.core.app.ActivityCompat
-import androidx.core.content.ContextCompat
-import androidx.databinding.DataBindingUtil
-import androidx.databinding.ViewDataBinding
-import com.topjohnwu.magisk.BR
-import com.topjohnwu.magisk.Config
-import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.base.viewmodel.BaseViewModel
-import com.topjohnwu.magisk.extensions.set
-import com.topjohnwu.magisk.model.events.EventHandler
-import com.topjohnwu.magisk.model.permissions.PermissionRequestBuilder
-import com.topjohnwu.magisk.utils.currentLocale
-import com.topjohnwu.magisk.wrap
-import kotlin.random.Random
-
-typealias RequestCallback = BaseActivity<*, *>.(Int, Intent?) -> Unit
-
-abstract class BaseActivity<ViewModel : BaseViewModel, Binding : ViewDataBinding> :
-        AppCompatActivity(), EventHandler {
-
-    protected lateinit var binding: Binding
-    protected abstract val layoutRes: Int
-    protected abstract val viewModel: ViewModel
-    protected open val themeRes: Int = R.style.MagiskTheme
-    protected open val snackbarView get() = binding.root
-
-    private val resultCallbacks by lazy { SparseArrayCompat<RequestCallback>() }
-
-    init {
-        val theme = if (Config.darkTheme) {
-            AppCompatDelegate.MODE_NIGHT_YES
-        } else {
-            AppCompatDelegate.MODE_NIGHT_NO
-        }
-        AppCompatDelegate.setDefaultNightMode(theme)
-    }
-
-    override fun applyOverrideConfiguration(config: Configuration?) {
-        // Force applying our preferred local
-        config?.setLocale(currentLocale)
-        super.applyOverrideConfiguration(config)
-    }
-
-    override fun attachBaseContext(base: Context) {
-        super.attachBaseContext(base.wrap(false))
-    }
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        setTheme(themeRes)
-        super.onCreate(savedInstanceState)
-
-        viewModel.viewEvents.observe(this, viewEventObserver)
-
-        binding = DataBindingUtil.setContentView<Binding>(this, layoutRes).apply {
-            setVariable(BR.viewModel, viewModel)
-            lifecycleOwner = this@BaseActivity
-        }
-    }
-
-    fun withPermissions(vararg permissions: String, builder: PermissionRequestBuilder.() -> Unit) {
-        val request = PermissionRequestBuilder().apply(builder).build()
-        val ungranted = permissions.filter {
-            ContextCompat.checkSelfPermission(this, it) != PackageManager.PERMISSION_GRANTED
-        }
-
-        if (ungranted.isEmpty()) {
-            request.onSuccess()
-        } else {
-            val requestCode = Random.nextInt(256, 512)
-            resultCallbacks[requestCode] =  { result, _ ->
-                if (result > 0)
-                    request.onSuccess()
-                else
-                    request.onFailure()
-            }
-            ActivityCompat.requestPermissions(this, ungranted.toTypedArray(), requestCode)
-        }
-    }
-
-    fun withExternalRW(builder: PermissionRequestBuilder.() -> Unit) {
-        withPermissions(Manifest.permission.WRITE_EXTERNAL_STORAGE, builder = builder)
-    }
-
-    override fun onRequestPermissionsResult(
-            requestCode: Int, permissions: Array<out String>, grantResults: IntArray) {
-        var success = true
-        for (res in grantResults) {
-            if (res != PackageManager.PERMISSION_GRANTED) {
-                success = false
-                break
-            }
-        }
-        resultCallbacks[requestCode]?.apply {
-            resultCallbacks.remove(requestCode)
-            invoke(this@BaseActivity, if (success) 1 else -1, null)
-        }
-
-    }
-
-    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
-        super.onActivityResult(requestCode, resultCode, data)
-        resultCallbacks[requestCode]?.apply {
-            resultCallbacks.remove(requestCode)
-            invoke(this@BaseActivity, resultCode, data)
-        }
-    }
-
-    fun startActivityForResult(intent: Intent, requestCode: Int, listener: RequestCallback) {
-        resultCallbacks[requestCode] = listener
-        startActivityForResult(intent, requestCode)
-    }
-
-}

app/src/main/java/com/topjohnwu/magisk/base/BaseFragment.kt

@@ -1,50 +0,0 @@
-package com.topjohnwu.magisk.base
-
-import android.os.Bundle
-import android.view.LayoutInflater
-import android.view.View
-import android.view.ViewGroup
-import androidx.annotation.CallSuper
-import androidx.databinding.DataBindingUtil
-import androidx.databinding.ViewDataBinding
-import androidx.fragment.app.Fragment
-import com.topjohnwu.magisk.BR
-import com.topjohnwu.magisk.base.viewmodel.BaseViewModel
-import com.topjohnwu.magisk.model.events.EventHandler
-import com.topjohnwu.magisk.model.events.ViewEvent
-
-abstract class BaseFragment<ViewModel : BaseViewModel, Binding : ViewDataBinding> :
-    Fragment(), EventHandler {
-
-    protected val activity get() = requireActivity() as BaseActivity<*, *>
-    protected lateinit var binding: Binding
-    protected abstract val layoutRes: Int
-    protected abstract val viewModel: ViewModel
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        viewModel.viewEvents.observe(this, viewEventObserver)
-    }
-
-    override fun onCreateView(
-            inflater: LayoutInflater,
-            container: ViewGroup?,
-            savedInstanceState: Bundle?
-    ): View? {
-        binding = DataBindingUtil.inflate<Binding>(inflater, layoutRes, container, false).apply {
-            setVariable(BR.viewModel, viewModel)
-            lifecycleOwner = this@BaseFragment
-        }
-
-        return binding.root
-    }
-
-    @CallSuper
-    override fun onEventDispatched(event: ViewEvent) {
-        super.onEventDispatched(event)
-        activity.onEventDispatched(event)
-    }
-
-    open fun onBackPressed(): Boolean = false
-
-}

app/src/main/java/com/topjohnwu/magisk/base/BasePreferenceFragment.kt

@@ -1,56 +0,0 @@
-package com.topjohnwu.magisk.base
-
-import android.annotation.SuppressLint
-import android.content.SharedPreferences
-import android.os.Bundle
-import android.view.LayoutInflater
-import android.view.View
-import android.view.ViewGroup
-import androidx.preference.*
-import androidx.recyclerview.widget.RecyclerView
-import org.koin.android.ext.android.inject
-
-abstract class BasePreferenceFragment : PreferenceFragmentCompat(),
-    SharedPreferences.OnSharedPreferenceChangeListener {
-
-    protected val prefs: SharedPreferences by inject()
-    protected val activity get() = requireActivity() as BaseActivity<*, *>
-
-    override fun onCreateView(
-        inflater: LayoutInflater,
-        container: ViewGroup?,
-        savedInstanceState: Bundle?
-    ): View? {
-        val v = super.onCreateView(inflater, container, savedInstanceState)
-        prefs.registerOnSharedPreferenceChangeListener(this)
-        return v
-    }
-
-    override fun onDestroyView() {
-        prefs.unregisterOnSharedPreferenceChangeListener(this)
-        super.onDestroyView()
-    }
-
-    private fun setAllPreferencesToAvoidHavingExtraSpace(preference: Preference) {
-        preference.isIconSpaceReserved = false
-        if (preference is PreferenceGroup)
-            for (i in 0 until preference.preferenceCount)
-                setAllPreferencesToAvoidHavingExtraSpace(preference.getPreference(i))
-    }
-
-    override fun setPreferenceScreen(preferenceScreen: PreferenceScreen?) {
-        if (preferenceScreen != null)
-            setAllPreferencesToAvoidHavingExtraSpace(preferenceScreen)
-        super.setPreferenceScreen(preferenceScreen)
-    }
-
-    override fun onCreateAdapter(preferenceScreen: PreferenceScreen?): RecyclerView.Adapter<*> =
-            object : PreferenceGroupAdapter(preferenceScreen) {
-                @SuppressLint("RestrictedApi")
-                override fun onPreferenceHierarchyChange(preference: Preference?) {
-                    if (preference != null)
-                        setAllPreferencesToAvoidHavingExtraSpace(preference)
-                    super.onPreferenceHierarchyChange(preference)
-                }
-            }
-}

app/src/main/java/com/topjohnwu/magisk/base/viewmodel/BaseViewModel.kt

@@ -1,35 +0,0 @@
-package com.topjohnwu.magisk.base.viewmodel
-
-import com.topjohnwu.magisk.base.BaseActivity
-import com.topjohnwu.magisk.extensions.doOnSubscribeUi
-import com.topjohnwu.magisk.model.events.BackPressEvent
-import com.topjohnwu.magisk.model.events.PermissionEvent
-import com.topjohnwu.magisk.model.events.ViewActionEvent
-import com.topjohnwu.magisk.utils.KObservableField
-import io.reactivex.Observable
-import io.reactivex.subjects.PublishSubject
-import com.topjohnwu.magisk.Info.isConnected as gIsConnected
-
-
-abstract class BaseViewModel(
-    initialState: State = State.LOADING
-) : LoadingViewModel(initialState) {
-
-    val isConnected = object : KObservableField<Boolean>(gIsConnected.value, gIsConnected) {
-        override fun get(): Boolean {
-            return gIsConnected.value
-        }
-    }
-
-    fun withView(action: BaseActivity<*, *>.() -> Unit) {
-        ViewActionEvent(action).publish()
-    }
-
-    fun withPermissions(vararg permissions: String): Observable<Boolean> {
-        val subject = PublishSubject.create<Boolean>()
-        return subject.doOnSubscribeUi { PermissionEvent(permissions.toList(), subject).publish() }
-    }
-
-    fun back() = BackPressEvent().publish()
-
-}

app/src/main/java/com/topjohnwu/magisk/base/viewmodel/LoadingViewModel.kt

@@ -1,78 +0,0 @@
-package com.topjohnwu.magisk.base.viewmodel
-
-import androidx.databinding.Bindable
-import com.topjohnwu.magisk.BR
-import io.reactivex.*
-
-abstract class LoadingViewModel(defaultState: State = State.LOADING) :
-    StatefulViewModel<LoadingViewModel.State>(defaultState) {
-
-    val loading @Bindable get() = state == State.LOADING
-    val loaded @Bindable get() = state == State.LOADED
-    val loadingFailed @Bindable get() = state == State.LOADING_FAILED
-
-    @Deprecated(
-        "Direct access is recommended since 0.2. This access method will be removed in 1.0",
-        ReplaceWith("state = State.LOADING", "com.topjohnwu.magisk.base.viewmodel.LoadingViewModel.State"),
-        DeprecationLevel.WARNING
-    )
-    fun setLoading() {
-        state = State.LOADING
-    }
-
-    @Deprecated(
-        "Direct access is recommended since 0.2. This access method will be removed in 1.0",
-        ReplaceWith("state = State.LOADED", "com.topjohnwu.magisk.base.viewmodel.LoadingViewModel.State"),
-        DeprecationLevel.WARNING
-    )
-    fun setLoaded() {
-        state = State.LOADED
-    }
-
-    @Deprecated(
-        "Direct access is recommended since 0.2. This access method will be removed in 1.0",
-        ReplaceWith("state = State.LOADING_FAILED", "com.topjohnwu.magisk.base.viewmodel.LoadingViewModel.State"),
-        DeprecationLevel.WARNING
-    )
-    fun setLoadingFailed() {
-        state = State.LOADING_FAILED
-    }
-
-    override fun notifyStateChanged() {
-        notifyPropertyChanged(BR.loading)
-        notifyPropertyChanged(BR.loaded)
-        notifyPropertyChanged(BR.loadingFailed)
-    }
-
-    enum class State {
-        LOADED, LOADING, LOADING_FAILED
-    }
-
-    //region Rx
-    protected fun <T> Observable<T>.applyViewModel(viewModel: LoadingViewModel, allowFinishing: Boolean = true) =
-        doOnSubscribe { viewModel.state = State.LOADING }
-            .doOnError { viewModel.state = State.LOADING_FAILED }
-            .doOnNext { if (allowFinishing) viewModel.state = State.LOADED }
-
-    protected fun <T> Single<T>.applyViewModel(viewModel: LoadingViewModel, allowFinishing: Boolean = true) =
-        doOnSubscribe { viewModel.state = State.LOADING }
-            .doOnError { viewModel.state = State.LOADING_FAILED }
-            .doOnSuccess { if (allowFinishing) viewModel.state = State.LOADED }
-
-    protected fun <T> Maybe<T>.applyViewModel(viewModel: LoadingViewModel, allowFinishing: Boolean = true) =
-        doOnSubscribe { viewModel.state = State.LOADING }
-            .doOnError { viewModel.state = State.LOADING_FAILED }
-            .doOnComplete { if (allowFinishing) viewModel.state = State.LOADED }
-            .doOnSuccess { if (allowFinishing) viewModel.state = State.LOADED }
-
-    protected fun <T> Flowable<T>.applyViewModel(viewModel: LoadingViewModel, allowFinishing: Boolean = true) =
-        doOnSubscribe { viewModel.state = State.LOADING }
-            .doOnError { viewModel.state = State.LOADING_FAILED }
-            .doOnNext { if (allowFinishing) viewModel.state = State.LOADED }
-
-    protected fun Completable.applyViewModel(viewModel: LoadingViewModel, allowFinishing: Boolean = true) =
-        doOnSubscribe { viewModel.state = State.LOADING }
-            .doOnError { viewModel.state = State.LOADING_FAILED }
-            .doOnComplete { if (allowFinishing) viewModel.state = State.LOADED }
-    //endregion
-}

app/src/main/java/com/topjohnwu/magisk/base/viewmodel/ObservableViewModel.kt

@@ -1,46 +0,0 @@
-package com.topjohnwu.magisk.base.viewmodel
-
-import androidx.databinding.Observable
-import androidx.databinding.PropertyChangeRegistry
-import androidx.lifecycle.ViewModel
-
-/**
- * Copy of [android.databinding.BaseObservable] which extends [ViewModel]
- */
-abstract class ObservableViewModel : TeanityViewModel(), Observable {
-
-    @Transient
-    private var callbacks: PropertyChangeRegistry? = null
-
-    @Synchronized
-    override fun addOnPropertyChangedCallback(callback: Observable.OnPropertyChangedCallback) {
-        if (callbacks == null) {
-            callbacks = PropertyChangeRegistry()
-        }
-        callbacks?.add(callback)
-    }
-
-    @Synchronized
-    override fun removeOnPropertyChangedCallback(callback: Observable.OnPropertyChangedCallback) {
-        callbacks?.remove(callback)
-    }
-
-    /**
-     * Notifies listeners that all properties of this instance have changed.
-     */
-    @Synchronized
-    fun notifyChange() {
-        callbacks?.notifyCallbacks(this, 0, null)
-    }
-
-    /**
-     * Notifies listeners that a specific property has changed. The getter for the property
-     * that changes should be marked with [android.databinding.Bindable] to generate a field in
-     * `BR` to be used as `fieldId`.
-     *
-     * @param fieldId The generated BR id for the Bindable field.
-     */
-    fun notifyPropertyChanged(fieldId: Int) {
-        callbacks?.notifyCallbacks(this, fieldId, null)
-    }
-}

app/src/main/java/com/topjohnwu/magisk/base/viewmodel/StatefulViewModel.kt

@@ -1,15 +0,0 @@
-package com.topjohnwu.magisk.base.viewmodel
-
-abstract class StatefulViewModel<State : Enum<*>>(
-    val defaultState: State
-) : ObservableViewModel() {
-
-    var state: State = defaultState
-        set(value) {
-            field = value
-            notifyStateChanged()
-        }
-
-    open fun notifyStateChanged() = Unit
-
-}

app/src/main/java/com/topjohnwu/magisk/base/viewmodel/TeanityViewModel.kt

@@ -1,33 +0,0 @@
-package com.topjohnwu.magisk.base.viewmodel
-
-import androidx.lifecycle.LiveData
-import androidx.lifecycle.MutableLiveData
-import androidx.lifecycle.ViewModel
-import com.topjohnwu.magisk.model.events.SimpleViewEvent
-import com.topjohnwu.magisk.model.events.ViewEvent
-import io.reactivex.disposables.CompositeDisposable
-import io.reactivex.disposables.Disposable
-
-abstract class TeanityViewModel : ViewModel() {
-
-    private val disposables = CompositeDisposable()
-    private val _viewEvents = MutableLiveData<ViewEvent>()
-    val viewEvents: LiveData<ViewEvent> get() = _viewEvents
-
-    override fun onCleared() {
-        super.onCleared()
-        disposables.clear()
-    }
-
-    fun <Event : ViewEvent> Event.publish() {
-        _viewEvents.value = this
-    }
-
-    fun Int.publish() {
-        _viewEvents.value = SimpleViewEvent(this)
-    }
-
-    fun Disposable.add() {
-        disposables.add(this)
-    }
-}

app/src/main/java/com/topjohnwu/magisk/core/App.kt

@@ -1,29 +1,27 @@
-package com.topjohnwu.magisk
+package com.topjohnwu.magisk.core
 
+import android.app.Activity
 import android.app.Application
 import android.content.Context
 import android.content.res.Configuration
+import android.os.Bundle
 import androidx.appcompat.app.AppCompatDelegate
 import androidx.multidex.MultiDex
-import androidx.room.Room
 import androidx.work.WorkManager
-import androidx.work.impl.WorkDatabase
-import androidx.work.impl.WorkDatabase_Impl
-import com.topjohnwu.magisk.data.database.RepoDatabase
-import com.topjohnwu.magisk.data.database.RepoDatabase_Impl
-import com.topjohnwu.magisk.data.database.SuLogDatabase
-import com.topjohnwu.magisk.data.database.SuLogDatabase_Impl
-import com.topjohnwu.magisk.di.ActivityTracker
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.DynAPK
+import com.topjohnwu.magisk.FileProvider
+import com.topjohnwu.magisk.core.su.SuCallbackHandler
+import com.topjohnwu.magisk.core.utils.IODispatcherExecutor
+import com.topjohnwu.magisk.core.utils.RootInit
+import com.topjohnwu.magisk.core.utils.updateConfig
 import com.topjohnwu.magisk.di.koinModules
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.unwrap
-import com.topjohnwu.magisk.utils.RootInit
-import com.topjohnwu.magisk.utils.SuHandler
-import com.topjohnwu.magisk.utils.updateConfig
+import com.topjohnwu.magisk.ktx.unwrap
 import com.topjohnwu.superuser.Shell
 import org.koin.android.ext.koin.androidContext
 import org.koin.core.context.startKoin
 import timber.log.Timber
+import kotlin.system.exitProcess
 
 open class App() : Application() {
 
@@ -33,18 +31,18 @@ open class App() : Application() {
 
     init {
         AppCompatDelegate.setCompatVectorFromResourcesEnabled(true)
-        Shell.Config.setFlags(Shell.FLAG_MOUNT_MASTER or Shell.FLAG_USE_MAGISK_BUSYBOX)
-        Shell.Config.verboseLogging(BuildConfig.DEBUG)
-        Shell.Config.addInitializers(RootInit::class.java)
-        Shell.Config.setTimeout(2)
-        FileProvider.callHandler = SuHandler
-        Room.setFactory {
-            when (it) {
-                WorkDatabase::class.java -> WorkDatabase_Impl()
-                RepoDatabase::class.java -> RepoDatabase_Impl()
-                SuLogDatabase::class.java -> SuLogDatabase_Impl()
-                else -> null
-            }
+        Shell.setDefaultBuilder(Shell.Builder.create()
+            .setFlags(Shell.FLAG_MOUNT_MASTER)
+            .setInitializers(RootInit::class.java)
+            .setTimeout(2))
+        Shell.EXECUTOR = IODispatcherExecutor()
+        FileProvider.callHandler = SuCallbackHandler
+
+        // Always log full stack trace with Timber
+        Timber.plant(Timber.DebugTree())
+        Thread.setDefaultUncaughtExceptionHandler { _, e ->
+            Timber.e(e)
+            exitProcess(1)
         }
     }
 
@@ -52,7 +50,6 @@ open class App() : Application() {
         // Basic setup
         if (BuildConfig.DEBUG)
             MultiDex.install(base)
-        Timber.plant(Timber.DebugTree())
 
         // Some context magic
         val app: Application
@@ -72,8 +69,8 @@ open class App() : Application() {
             androidContext(wrapped)
             modules(koinModules)
         }
-        ResourceMgr.init(impl)
-        app.registerActivityLifecycleCallbacks(get<ActivityTracker>())
+        ResMgr.init(impl)
+        app.registerActivityLifecycleCallbacks(ForegroundTracker)
         WorkManager.initialize(impl.wrapJob(), androidx.work.Configuration.Builder().build())
     }
 
@@ -88,3 +85,25 @@ open class App() : Application() {
             super.onConfigurationChanged(newConfig)
     }
 }
+
+object ForegroundTracker : Application.ActivityLifecycleCallbacks {
+
+    @Volatile
+    var foreground: Activity? = null
+
+    val hasForeground get() = foreground != null
+
+    override fun onActivityResumed(activity: Activity) {
+        foreground = activity
+    }
+
+    override fun onActivityPaused(activity: Activity) {
+        foreground = null
+    }
+
+    override fun onActivityCreated(activity: Activity, bundle: Bundle?) {}
+    override fun onActivityStarted(activity: Activity) {}
+    override fun onActivityStopped(activity: Activity) {}
+    override fun onActivitySaveInstanceState(activity: Activity, bundle: Bundle) {}
+    override fun onActivityDestroyed(activity: Activity) {}
+}

app/src/main/java/com/topjohnwu/magisk/core/Config.kt

@@ -1,19 +1,22 @@
-package com.topjohnwu.magisk
+package com.topjohnwu.magisk.core
 
 import android.content.Context
 import android.content.SharedPreferences
-import android.os.Environment
 import android.util.Xml
+import androidx.appcompat.app.AppCompatDelegate
 import androidx.core.content.edit
-import com.topjohnwu.magisk.data.database.SettingsDao
-import com.topjohnwu.magisk.data.database.StringDao
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.core.magiskdb.SettingsDao
+import com.topjohnwu.magisk.core.magiskdb.StringDao
+import com.topjohnwu.magisk.core.utils.BiometricHelper
+import com.topjohnwu.magisk.core.utils.defaultLocale
+import com.topjohnwu.magisk.core.utils.refreshLocale
+import com.topjohnwu.magisk.data.preference.PreferenceModel
 import com.topjohnwu.magisk.data.repository.DBConfig
 import com.topjohnwu.magisk.di.Protected
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.inject
-import com.topjohnwu.magisk.model.preference.PreferenceModel
-import com.topjohnwu.magisk.utils.BiometricHelper
-import com.topjohnwu.magisk.utils.Utils
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.inject
+import com.topjohnwu.magisk.ui.theme.Theme
 import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.io.SuFile
 import com.topjohnwu.superuser.io.SuFileInputStream
@@ -44,15 +47,18 @@ object Config : PreferenceModel, DBConfig {
         const val UPDATE_CHANNEL = "update_channel"
         const val CUSTOM_CHANNEL = "custom_channel"
         const val LOCALE = "locale"
-        const val DARK_THEME = "dark_theme"
+        const val DARK_THEME = "dark_theme_extended"
         const val REPO_ORDER = "repo_order"
         const val SHOW_SYSTEM_APP = "show_system"
-        const val DOWNLOAD_PATH = "download_path"
+        const val DOWNLOAD_DIR = "download_dir"
+        const val SAFETY = "safety_notice"
+        const val THEME_ORDINAL = "theme_ordinal"
         const val BOOT_ID = "boot_id"
+        const val ASKED_HOME = "asked_home"
+        const val DOH = "doh"
 
         // system state
         const val MAGISKHIDE = "magiskhide"
-        const val COREONLY = "disable"
     }
 
     object Value {
@@ -62,7 +68,6 @@ object Config : PreferenceModel, DBConfig {
         const val BETA_CHANNEL = 1
         const val CUSTOM_CHANNEL = 2
         const val CANARY_CHANNEL = 3
-        const val CANARY_DEBUG_CHANNEL = 4
 
         // root access mode
         const val ROOT_ACCESS_DISABLED = 0
@@ -98,17 +103,19 @@ object Config : PreferenceModel, DBConfig {
     }
 
     private val defaultChannel =
-        if (Utils.isCanary) {
-            if (BuildConfig.DEBUG)
-                Value.CANARY_DEBUG_CHANNEL
-            else
-                Value.CANARY_CHANNEL
-        }
-        else Value.DEFAULT_CHANNEL
+        if (BuildConfig.DEBUG)
+            Value.CANARY_CHANNEL
+        else
+            Value.DEFAULT_CHANNEL
+
+    @JvmStatic var keepVerity = false
+    @JvmStatic var keepEnc = false
+    @JvmStatic var recovery = false
 
     var bootId by preference(Key.BOOT_ID, "")
+    var askedHome by preference(Key.ASKED_HOME, false)
 
-    var downloadPath by preference(Key.DOWNLOAD_PATH, Environment.DIRECTORY_DOWNLOADS)
+    var downloadDir by preference(Key.DOWNLOAD_DIR, "")
     var repoOrder by preference(Key.REPO_ORDER, Value.ORDER_DATE)
 
     var suDefaultTimeout by preferenceStrInt(Key.SU_REQUEST_TIMEOUT, 10)
@@ -116,15 +123,23 @@ object Config : PreferenceModel, DBConfig {
     var suNotification by preferenceStrInt(Key.SU_NOTIFICATION, Value.NOTIFICATION_TOAST)
     var updateChannel by preferenceStrInt(Key.UPDATE_CHANNEL, defaultChannel)
 
-    var darkTheme by preference(Key.DARK_THEME, true)
+    var safetyNotice by preference(Key.SAFETY, true)
+    var darkTheme by preference(Key.DARK_THEME, AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
+    var themeOrdinal by preference(Key.THEME_ORDINAL, Theme.Piplup.ordinal)
     var suReAuth by preference(Key.SU_REAUTH, false)
     var checkUpdate by preference(Key.CHECK_UPDATES, true)
+    var doh by preference(Key.DOH, defaultLocale.country == "CN")
     var magiskHide by preference(Key.MAGISKHIDE, true)
-    var coreOnly by preference(Key.COREONLY, false)
     var showSystemApp by preference(Key.SHOW_SYSTEM_APP, false)
 
     var customChannelUrl by preference(Key.CUSTOM_CHANNEL, "")
-    var locale by preference(Key.LOCALE, "")
+    private var localePrefs by preference(Key.LOCALE, "")
+    var locale
+        get() = localePrefs
+        set(value) {
+            localePrefs = value
+            refreshLocale()
+        }
 
     var rootMode by dbSettings(Key.ROOT_ACCESS, Value.ROOT_ACCESS_APPS_AND_ADB)
     var suMntNamespaceMode by dbSettings(Key.SU_MNT_NS, Value.NAMESPACE_MODE_REQUESTER)
@@ -133,36 +148,32 @@ object Config : PreferenceModel, DBConfig {
     var suManager by dbStrings(Key.SU_MANAGER, "", true)
     var keyStoreRaw by dbStrings(Key.KEYSTORE, "", true)
 
-    // Always return a path in external storage where we can write
-    val downloadDirectory get() =
-        Utils.ensureDownloadPath(downloadPath) ?: get<Context>().getExternalFilesDir(null)!!
-
     private const val SU_FINGERPRINT = "su_fingerprint"
 
-    fun initialize() = prefs.also {
-        if (it.getBoolean(SU_FINGERPRINT, false)) {
-            suBiometric = true
+    fun initialize() {
+        prefs.edit { parsePrefs() }
+
+        prefs.edit {
+            // Settings migration
+            if (prefs.getBoolean(SU_FINGERPRINT, false))
+                suBiometric = true
+            remove(SU_FINGERPRINT)
+            prefs.getString(Key.UPDATE_CHANNEL, null).also {
+                if (it == null)
+                    putString(Key.UPDATE_CHANNEL, defaultChannel.toString())
+                else if (it.toInt() > Value.CANARY_CHANNEL)
+                    putString(Key.UPDATE_CHANNEL, Value.CANARY_CHANNEL.toString())
+            }
+
+            // Write database configs
+            putString(Key.ROOT_ACCESS, rootMode.toString())
+            putString(Key.SU_MNT_NS, suMntNamespaceMode.toString())
+            putString(Key.SU_MULTIUSER_MODE, suMultiuserMode.toString())
+            putBoolean(Key.SU_BIOMETRIC, BiometricHelper.isEnabled)
         }
-    }.edit {
-        parsePrefs(this)
-
-        // Legacy stuff
-        remove(SU_FINGERPRINT)
-
-        // Get actual state
-        putBoolean(Key.COREONLY, Const.MAGISK_DISABLE_FILE.exists())
-
-        // Write database configs
-        putString(Key.ROOT_ACCESS, rootMode.toString())
-        putString(Key.SU_MNT_NS, suMntNamespaceMode.toString())
-        putString(Key.SU_MULTIUSER_MODE, suMultiuserMode.toString())
-        putBoolean(Key.SU_BIOMETRIC, BiometricHelper.isEnabled)
-    }.also {
-        if (!prefs.contains(Key.UPDATE_CHANNEL))
-            prefs.edit().putString(Key.UPDATE_CHANNEL, defaultChannel.toString()).apply()
     }
 
-    private fun parsePrefs(editor: SharedPreferences.Editor) = editor.apply {
+    private fun SharedPreferences.Editor.parsePrefs() {
         val config = SuFile.open("/data/adb", Const.MANAGER_CONFIGS)
         if (config.exists()) runCatching {
             val input = SuFileInputStream(config)
@@ -215,7 +226,9 @@ object Config : PreferenceModel, DBConfig {
 
     fun export() {
         // Flush prefs to disk
-        prefs.edit().commit()
+        prefs.edit().apply {
+            remove(Key.ASKED_HOME)
+        }.commit()
         val context = get<Context>(Protected)
         val xml = File(
             "${context.filesDir.parent}/shared_prefs",

app/src/main/java/com/topjohnwu/magisk/core/Const.kt

@@ -1,19 +1,18 @@
-package com.topjohnwu.magisk
+package com.topjohnwu.magisk.core
 
 import android.os.Process
-import java.io.File
 
 object Const {
 
     // Paths
-    const val MAGISK_PATH = "/sbin/.magisk/img"
-    var MAGISK_DISABLE_FILE = File("xxx")
+    lateinit var MAGISKTMP: String
+    val MAGISK_PATH get() = "$MAGISKTMP/modules"
     const val TMP_FOLDER_PATH = "/dev/tmp"
     const val MAGISK_LOG = "/cache/magisk.log"
 
     // Versions
-    const val SNET_EXT_VER = 13
-    const val SNET_REVISION = "a6c47f86f10b310358afa9dbe837037dd5d561df"
+    const val SNET_EXT_VER = 15
+    const val SNET_REVISION = "d494bc726e86166913a13629e3b1336728ec5d7f"
     const val BOOTCTL_REVISION = "a6c47f86f10b310358afa9dbe837037dd5d561df"
 
     // Misc
@@ -23,10 +22,13 @@ object Const {
     val USER_ID = Process.myUid() / 100000
 
     object Version {
-        const val MIN_VERSION = "v18.0"
-        const val MIN_VERCODE = 18000
-        const val CONNECT_MODE = 20100
-        const val PROVIDER_CONNECT = 20102
+        const val MIN_VERSION = "v19.0"
+        const val MIN_VERCODE = 19000
+
+        fun atLeast_20_2() = Info.env.magiskVersionCode >= 20200 || isCanary()
+        fun atLeast_20_4() = Info.env.magiskVersionCode >= 20400 || isCanary()
+        fun atLeast_21_0() = Info.env.magiskVersionCode >= 21000 || isCanary()
+        fun isCanary() = Info.env.magiskVersionCode % 100 != 0
     }
 
     object ID {
@@ -45,14 +47,12 @@ object Const {
 
     object Url {
         const val ZIP_URL = "https://github.com/Magisk-Modules-Repo/%s/archive/master.zip"
-        const val PAYPAL_URL = "https://www.paypal.me/topjohnwu"
         const val PATREON_URL = "https://www.patreon.com/topjohnwu"
-        const val TWITTER_URL = "https://twitter.com/topjohnwu"
-        const val XDA_THREAD = "http://forum.xda-developers.com/showthread.php?t=3432382"
         const val SOURCE_CODE_URL = "https://github.com/topjohnwu/Magisk"
 
         const val GITHUB_RAW_URL = "https://raw.githubusercontent.com/"
         const val GITHUB_API_URL = "https://api.github.com/users/Magisk-Modules-Repo/"
+        const val GITHUB_PAGE_URL = "https://topjohnwu.github.io/magisk_files/"
     }
 
     object Key {
@@ -62,12 +62,6 @@ object Const {
         const val ETAG_KEY = "ETag"
         // intents
         const val OPEN_SECTION = "section"
-        const val INTENT_SET_APP = "app_json"
-        const val FLASH_ACTION = "action"
-        const val FLASH_DATA = "additional_data"
-        const val DISMISS_ID = "dismiss_id"
-        const val BROADCAST_MANAGER_UPDATE = "manager_update"
-        const val BROADCAST_REBOOT = "reboot"
     }
 
     object Value {
@@ -78,4 +72,11 @@ object Const {
         const val UNINSTALL = "uninstall"
     }
 
+    object Nav {
+        const val HOME = "home"
+        const val SETTINGS = "settings"
+        const val HIDE = "hide"
+        const val MODULES = "modules"
+        const val SUPERUSER = "superuser"
+    }
 }

app/src/main/java/com/topjohnwu/magisk/core/GeneralReceiver.kt

@@ -0,0 +1,46 @@
+package com.topjohnwu.magisk.core
+
+import android.content.ContextWrapper
+import android.content.Intent
+import com.topjohnwu.magisk.core.base.BaseReceiver
+import com.topjohnwu.magisk.core.magiskdb.PolicyDao
+import com.topjohnwu.magisk.core.su.SuCallbackHandler
+import com.topjohnwu.magisk.view.Shortcuts
+import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
+import org.koin.core.inject
+
+open class GeneralReceiver : BaseReceiver() {
+
+    private val policyDB: PolicyDao by inject()
+
+    private fun getPkg(intent: Intent): String {
+        return intent.data?.encodedSchemeSpecificPart.orEmpty()
+    }
+
+    override fun onReceive(context: ContextWrapper, intent: Intent?) {
+        intent ?: return
+
+        fun rmPolicy(pkg: String) = GlobalScope.launch {
+            policyDB.delete(pkg)
+        }
+
+        when (intent.action ?: return) {
+            Intent.ACTION_REBOOT -> {
+                SuCallbackHandler(context, intent.getStringExtra("action"), intent.extras)
+            }
+            Intent.ACTION_PACKAGE_REPLACED -> {
+                // This will only work pre-O
+                if (Config.suReAuth)
+                    rmPolicy(getPkg(intent))
+            }
+            Intent.ACTION_PACKAGE_FULLY_REMOVED -> {
+                val pkg = getPkg(intent)
+                rmPolicy(pkg)
+                Shell.su("magiskhide --rm $pkg").submit()
+            }
+            Intent.ACTION_LOCALE_CHANGED -> Shortcuts.setupDynamic(context)
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/Hacks.kt

@@ -1,8 +1,9 @@
 @file:Suppress("DEPRECATION")
 
-package com.topjohnwu.magisk
+package com.topjohnwu.magisk.core
 
 import android.annotation.SuppressLint
+import android.app.Activity
 import android.app.job.JobInfo
 import android.app.job.JobScheduler
 import android.app.job.JobWorkItem
@@ -14,23 +15,21 @@ import android.content.res.AssetManager
 import android.content.res.Configuration
 import android.content.res.Resources
 import androidx.annotation.RequiresApi
-import com.topjohnwu.magisk.extensions.forceGetDeclaredField
-import com.topjohnwu.magisk.model.download.DownloadService
-import com.topjohnwu.magisk.model.receiver.GeneralReceiver
-import com.topjohnwu.magisk.model.update.UpdateCheckService
+import com.topjohnwu.magisk.DynAPK
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.download.DownloadService
+import com.topjohnwu.magisk.core.utils.refreshLocale
+import com.topjohnwu.magisk.core.utils.updateConfig
+import com.topjohnwu.magisk.ktx.forceGetDeclaredField
 import com.topjohnwu.magisk.ui.MainActivity
-import com.topjohnwu.magisk.ui.SplashActivity
-import com.topjohnwu.magisk.ui.flash.FlashActivity
 import com.topjohnwu.magisk.ui.surequest.SuRequestActivity
-import com.topjohnwu.magisk.utils.refreshLocale
-import com.topjohnwu.magisk.utils.updateConfig
 
 fun AssetManager.addAssetPath(path: String) {
     DynAPK.addAssetPath(this, path)
 }
 
-fun Context.wrap(global: Boolean = true): Context
-        = if (global) GlobalResContext(this) else ResContext(this)
+fun Context.wrap(global: Boolean = true): Context =
+    if (global) GlobalResContext(this) else ResContext(this)
 
 fun Context.wrapJob(): Context = object : GlobalResContext(this) {
 
@@ -54,10 +53,14 @@ fun Class<*>.cmp(pkg: String): ComponentName {
     return ComponentName(pkg, Info.stub?.classToComponent?.get(name) ?: name)
 }
 
+inline fun <reified T> Activity.redirect() = Intent(intent)
+    .setComponent(T::class.java.cmp(packageName))
+    .setFlags(0)
+
 inline fun <reified T> Context.intent() = Intent().setComponent(T::class.java.cmp(packageName))
 
 private open class GlobalResContext(base: Context) : ContextWrapper(base) {
-    open val mRes: Resources get() = ResourceMgr.resource
+    open val mRes: Resources get() = ResMgr.resource
 
     override fun getResources(): Resources {
         return mRes
@@ -78,22 +81,24 @@ private class ResContext(base: Context) : GlobalResContext(base) {
     private fun Resources.patch(): Resources {
         updateConfig()
         if (isRunningAsStub)
-            assets.addAssetPath(ResourceMgr.resApk)
+            assets.addAssetPath(ResMgr.apk)
         return this
     }
 }
 
-object ResourceMgr {
+object ResMgr {
 
     lateinit var resource: Resources
-    lateinit var resApk: String
+    lateinit var apk: String
 
     fun init(context: Context) {
         resource = context.resources
         refreshLocale()
         if (isRunningAsStub) {
-            resApk = DynAPK.current(context).path
-            resource.assets.addAssetPath(resApk)
+            apk = DynAPK.current(context).path
+            resource.assets.addAssetPath(apk)
+        } else {
+            apk = context.packageResourcePath
         }
     }
 }
@@ -130,26 +135,39 @@ private class JobSchedulerWrapper(private val base: JobScheduler) : JobScheduler
         val name = service.className
         val component = ComponentName(
             service.packageName,
-            Info.stub!!.classToComponent[name] ?: name)
+            Info.stubChk.classToComponent[name] ?: name
+        )
 
         javaClass.forceGetDeclaredField("service")?.set(this, component)
         return this
     }
 }
 
-object ClassMap {
+private object ClassMap {
 
     private val map = mapOf(
         App::class.java to a.e::class.java,
         MainActivity::class.java to a.b::class.java,
         SplashActivity::class.java to a.c::class.java,
-        FlashActivity::class.java to a.f::class.java,
-        UpdateCheckService::class.java to a.g::class.java,
         GeneralReceiver::class.java to a.h::class.java,
         DownloadService::class.java to a.j::class.java,
-        SuRequestActivity::class.java to a.m::class.java,
-        ProcessPhoenix::class.java to a.r::class.java
+        SuRequestActivity::class.java to a.m::class.java
     )
 
     operator fun get(c: Class<*>) = map.getOrElse(c) { c }
 }
+
+// Keep a reference to these resources to prevent it from
+// being removed when running "remove unused resources"
+val shouldKeepResources = listOf(
+    R.string.no_info_provided,
+    R.string.release_notes,
+    R.string.invalid_update_channel,
+    R.string.update_available,
+    R.string.safetynet_api_error,
+    R.raw.changelog,
+    R.drawable.ic_device,
+    R.drawable.ic_hide_select_md2,
+    R.drawable.ic_more,
+    R.drawable.ic_magisk_delete
+)

app/src/main/java/com/topjohnwu/magisk/core/Info.kt

@@ -0,0 +1,87 @@
+package com.topjohnwu.magisk.core
+
+import androidx.databinding.ObservableBoolean
+import com.topjohnwu.magisk.DynAPK
+import com.topjohnwu.magisk.core.model.UpdateInfo
+import com.topjohnwu.magisk.core.utils.net.NetworkObserver
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.utils.CachedValue
+import com.topjohnwu.superuser.Shell
+import com.topjohnwu.superuser.ShellUtils.fastCmd
+import com.topjohnwu.superuser.internal.UiThreadHandler
+import java.io.FileInputStream
+import java.io.IOException
+import java.util.*
+
+val isRunningAsStub get() = Info.stub != null
+
+object Info {
+
+    val envRef = CachedValue { loadState() }
+
+    @JvmStatic val env by envRef
+
+    var stub: DynAPK.Data? = null
+    val stubChk: DynAPK.Data
+        get() = stub as DynAPK.Data
+
+    var remote = UpdateInfo()
+
+    // Device state
+    var crypto = ""
+    @JvmStatic var isSAR = false
+    @JvmStatic var isAB = false
+    @JvmStatic val isFDE get() = crypto == "block"
+    @JvmStatic var ramdisk = false
+    @JvmStatic var hasGMS = true
+    @JvmStatic var isPixel = false
+    @JvmStatic val cryptoText get() = crypto.capitalize(Locale.US)
+
+    val isConnected by lazy {
+        ObservableBoolean(false).also { field ->
+            NetworkObserver.observe(get()) {
+                UiThreadHandler.run { field.set(it) }
+            }
+        }
+    }
+
+    val isNewReboot by lazy {
+        try {
+            FileInputStream("/proc/sys/kernel/random/boot_id").bufferedReader().use {
+                val id = it.readLine()
+                if (id != Config.bootId) {
+                    Config.bootId = id
+                    true
+                } else {
+                    false
+                }
+            }
+        } catch (e: IOException) {
+            false
+        }
+    }
+
+    private fun loadState() = Env(
+        fastCmd("magisk -v").split(":".toRegex())[0],
+        runCatching { fastCmd("magisk -V").toInt() }.getOrDefault(-1),
+        Shell.su("magiskhide --status").exec().isSuccess
+    )
+
+    class Env(
+        val magiskVersionString: String = "",
+        code: Int = -1,
+        hide: Boolean = false
+    ) {
+        val magiskHide get() = Config.magiskHide
+        val magiskVersionCode = when (code) {
+            in Int.MIN_VALUE..Const.Version.MIN_VERCODE -> -1
+            else -> if (Shell.rootAccess()) code else -1
+        }
+        val isUnsupported = code > 0 && code < Const.Version.MIN_VERCODE
+        val isActive = magiskVersionCode >= 0
+
+        init {
+            Config.magiskHide = hide
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/SplashActivity.kt

@@ -0,0 +1,69 @@
+package com.topjohnwu.magisk.core
+
+import android.app.Activity
+import android.content.Context
+import android.os.Bundle
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.data.network.GithubRawServices
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ui.MainActivity
+import com.topjohnwu.magisk.view.Notifications
+import com.topjohnwu.magisk.view.Shortcuts
+import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
+
+open class SplashActivity : Activity() {
+
+    override fun attachBaseContext(base: Context) {
+        super.attachBaseContext(base.wrap())
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        setTheme(R.style.SplashTheme)
+        super.onCreate(savedInstanceState)
+        GlobalScope.launch(Dispatchers.IO) {
+            initAndStart()
+        }
+    }
+
+    private fun handleRepackage() {
+        val pkg = Config.suManager
+        if (Config.suManager.isNotEmpty() && packageName == BuildConfig.APPLICATION_ID) {
+            Config.suManager = ""
+            Shell.su("(pm uninstall $pkg)& >/dev/null 2>&1").exec()
+        }
+        if (pkg == packageName) {
+            runCatching {
+                // We are the manager, remove com.topjohnwu.magisk as it could be malware
+                packageManager.getApplicationInfo(BuildConfig.APPLICATION_ID, 0)
+                Shell.su("(pm uninstall ${BuildConfig.APPLICATION_ID})& >/dev/null 2>&1").exec()
+            }
+        }
+    }
+
+    private fun initAndStart() {
+        // Pre-initialize root shell
+        Shell.getShell()
+
+        Config.initialize()
+        handleRepackage()
+        Notifications.setup(this)
+        UpdateCheckService.schedule(this)
+        Shortcuts.setupDynamic(this)
+
+        // Pre-fetch network stuffs
+        get<GithubRawServices>()
+
+        DONE = true
+
+        redirect<MainActivity>().also { startActivity(it) }
+        finish()
+    }
+
+    companion object {
+        var DONE = false
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/UpdateCheckService.kt

@@ -0,0 +1,53 @@
+package com.topjohnwu.magisk.core
+
+import android.content.Context
+import androidx.work.*
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.data.repository.MagiskRepository
+import com.topjohnwu.magisk.view.Notifications
+import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.koin.core.KoinComponent
+import org.koin.core.inject
+import java.util.concurrent.TimeUnit
+
+class UpdateCheckService(context: Context, workerParams: WorkerParameters)
+    : CoroutineWorker(context, workerParams), KoinComponent {
+
+    private val magiskRepo: MagiskRepository by inject()
+
+    override suspend fun doWork(): Result {
+        // Make sure shell initializer was ran
+        withContext(Dispatchers.IO) {
+            Shell.getShell()
+        }
+        return magiskRepo.fetchUpdate()?.let {
+            if (BuildConfig.VERSION_CODE < it.app.versionCode)
+                Notifications.managerUpdate(applicationContext)
+            else if (Info.env.isActive && Info.env.magiskVersionCode < it.magisk.versionCode)
+                Notifications.magiskUpdate(applicationContext)
+            Result.success()
+        } ?: Result.failure()
+    }
+
+    companion object {
+        fun schedule(context: Context) {
+            if (Config.checkUpdate) {
+                val constraints = Constraints.Builder()
+                    .setRequiredNetworkType(NetworkType.CONNECTED)
+                    .setRequiresDeviceIdle(true)
+                    .build()
+                val request = PeriodicWorkRequestBuilder<UpdateCheckService>(12, TimeUnit.HOURS)
+                    .setConstraints(constraints)
+                    .build()
+                WorkManager.getInstance(context).enqueueUniquePeriodicWork(
+                    Const.ID.CHECK_MAGISK_UPDATE_WORKER_ID,
+                    ExistingPeriodicWorkPolicy.REPLACE, request)
+            } else {
+                WorkManager.getInstance(context)
+                    .cancelUniqueWork(Const.ID.CHECK_MAGISK_UPDATE_WORKER_ID)
+            }
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/base/BaseActivity.kt

@@ -0,0 +1,104 @@
+package com.topjohnwu.magisk.core.base
+
+import android.Manifest
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.content.res.Configuration
+import android.os.Build
+import android.widget.Toast
+import androidx.appcompat.app.AppCompatActivity
+import androidx.collection.SparseArrayCompat
+import androidx.core.app.ActivityCompat
+import androidx.core.content.ContextCompat
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.utils.currentLocale
+import com.topjohnwu.magisk.core.wrap
+import com.topjohnwu.magisk.ktx.set
+import com.topjohnwu.magisk.utils.Utils
+import kotlin.random.Random
+
+typealias RequestCallback = BaseActivity.(Int, Intent?) -> Unit
+
+abstract class BaseActivity : AppCompatActivity() {
+
+    private val resultCallbacks by lazy { SparseArrayCompat<RequestCallback>() }
+
+    override fun applyOverrideConfiguration(config: Configuration?) {
+        // Force applying our preferred local
+        config?.setLocale(currentLocale)
+        super.applyOverrideConfiguration(config)
+    }
+
+    override fun attachBaseContext(base: Context) {
+        super.attachBaseContext(base.wrap(false))
+    }
+
+    fun withPermission(permission: String, builder: PermissionRequestBuilder.() -> Unit) {
+        val request = PermissionRequestBuilder().apply(builder).build()
+
+        if (permission == Manifest.permission.WRITE_EXTERNAL_STORAGE &&
+            Build.VERSION.SDK_INT >= 29) {
+            // We do not need external rw on 29+
+            request.onSuccess()
+            return
+        }
+
+        if (ContextCompat.checkSelfPermission(this, permission) == PackageManager.PERMISSION_GRANTED) {
+            request.onSuccess()
+        } else {
+            val requestCode = Random.nextInt(256, 512)
+            resultCallbacks[requestCode] =  { result, _ ->
+                if (result > 0)
+                    request.onSuccess()
+                else
+                    request.onFailure()
+            }
+            ActivityCompat.requestPermissions(this, arrayOf(permission), requestCode)
+        }
+    }
+
+    fun withExternalRW(builder: PermissionRequestBuilder.() -> Unit) {
+        withPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE, builder = builder)
+    }
+
+    override fun onRequestPermissionsResult(
+        requestCode: Int, permissions: Array<out String>, grantResults: IntArray) {
+        var success = true
+        for (res in grantResults) {
+            if (res != PackageManager.PERMISSION_GRANTED) {
+                success = false
+                break
+            }
+        }
+        resultCallbacks[requestCode]?.also {
+            resultCallbacks.remove(requestCode)
+            it(this, if (success) 1 else -1, null)
+        }
+
+    }
+
+    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
+        super.onActivityResult(requestCode, resultCode, data)
+        resultCallbacks[requestCode]?.also {
+            resultCallbacks.remove(requestCode)
+            it(this, resultCode, data)
+        }
+    }
+
+    fun startActivityForResult(intent: Intent, requestCode: Int, listener: RequestCallback) {
+        resultCallbacks[requestCode] = listener
+        try {
+            startActivityForResult(intent, requestCode)
+        } catch (e: ActivityNotFoundException) {
+            Utils.toast(R.string.app_not_found, Toast.LENGTH_SHORT)
+        }
+    }
+
+    override fun recreate() {
+        startActivity(Intent().setComponent(intent.component))
+        finish()
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/core/base/BaseReceiver.kt

@@ -1,10 +1,10 @@
-package com.topjohnwu.magisk.base
+package com.topjohnwu.magisk.core.base
 
 import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.ContextWrapper
 import android.content.Intent
-import com.topjohnwu.magisk.wrap
+import com.topjohnwu.magisk.core.wrap
 import org.koin.core.KoinComponent
 
 abstract class BaseReceiver : BroadcastReceiver(), KoinComponent {

app/src/main/java/com/topjohnwu/magisk/core/base/BaseService.kt

@@ -1,8 +1,8 @@
-package com.topjohnwu.magisk.base
+package com.topjohnwu.magisk.core.base
 
 import android.app.Service
 import android.content.Context
-import com.topjohnwu.magisk.wrap
+import com.topjohnwu.magisk.core.wrap
 import org.koin.core.KoinComponent
 
 abstract class BaseService : Service(), KoinComponent {

app/src/main/java/com/topjohnwu/magisk/core/base/BaseWorkerWrapper.kt

@@ -1,4 +1,4 @@
-package com.topjohnwu.magisk.base
+package com.topjohnwu.magisk.core.base
 
 import android.content.Context
 import android.net.Network
@@ -10,7 +10,7 @@ import androidx.work.ListenableWorker
 import com.google.common.util.concurrent.ListenableFuture
 import java.util.*
 
-abstract class DelegateWorker {
+abstract class BaseWorkerWrapper {
 
     private lateinit var worker: ListenableWorker
 

app/src/main/java/com/topjohnwu/magisk/core/base/PermissionRequestBuilder.kt

@@ -1,4 +1,4 @@
-package com.topjohnwu.magisk.model.permissions
+package com.topjohnwu.magisk.core.base
 
 typealias SimpleCallback = () -> Unit
 typealias PermissionRationaleCallback = (List<String>) -> Unit
@@ -37,4 +37,4 @@ class PermissionRequest(
     fun onFailure() = onFailureCallback()
     fun onShowRationale(permissions: List<String>) = onShowRationaleCallback(permissions)
 
-}
+}

app/src/main/java/com/topjohnwu/magisk/core/download/Action.kt

@@ -1,12 +1,12 @@
-package com.topjohnwu.magisk.model.entity.internal
+package com.topjohnwu.magisk.core.download
 
 import android.net.Uri
 import android.os.Parcelable
 import kotlinx.android.parcel.Parcelize
 
-sealed class Configuration : Parcelable {
+sealed class Action : Parcelable {
 
-    sealed class Flash : Configuration() {
+    sealed class Flash : Action() {
 
         @Parcelize
         object Primary : Flash()
@@ -16,7 +16,7 @@ sealed class Configuration : Parcelable {
 
     }
 
-    sealed class APK : Configuration() {
+    sealed class APK : Action() {
 
         @Parcelize
         object Upgrade : APK()
@@ -26,12 +26,15 @@ sealed class Configuration : Parcelable {
     }
 
     @Parcelize
-    object Download : Configuration()
+    object Download : Action()
 
     @Parcelize
-    object Uninstall : Configuration()
+    object Uninstall : Action()
 
     @Parcelize
-    data class Patch(val fileUri: Uri) : Configuration()
+    object EnvFix : Action()
 
-}
+    @Parcelize
+    data class Patch(val fileUri: Uri) : Action()
+
+}

app/src/main/java/com/topjohnwu/magisk/core/download/BaseDownloader.kt

@@ -0,0 +1,204 @@
+package com.topjohnwu.magisk.core.download
+
+import android.app.Notification
+import android.content.Intent
+import android.os.IBinder
+import androidx.lifecycle.LifecycleOwner
+import androidx.lifecycle.MutableLiveData
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.ForegroundTracker
+import com.topjohnwu.magisk.core.base.BaseService
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.checkSum
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.outputStream
+import com.topjohnwu.magisk.core.utils.ProgressInputStream
+import com.topjohnwu.magisk.data.network.GithubRawServices
+import com.topjohnwu.magisk.ktx.withStreams
+import com.topjohnwu.magisk.view.Notifications
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.launch
+import okhttp3.ResponseBody
+import org.koin.android.ext.android.inject
+import org.koin.core.KoinComponent
+import timber.log.Timber
+import java.io.IOException
+import java.io.InputStream
+import java.util.*
+import kotlin.collections.HashMap
+import kotlin.random.Random.Default.nextInt
+
+abstract class BaseDownloader : BaseService(), KoinComponent {
+
+    private val hasNotifications get() = notifications.isNotEmpty()
+    private val notifications = Collections.synchronizedMap(HashMap<Int, Notification.Builder>())
+    private val coroutineScope = CoroutineScope(Dispatchers.IO)
+
+    val service: GithubRawServices by inject()
+
+    // -- Service overrides
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onStartCommand(intent: Intent, flags: Int, startId: Int): Int {
+        intent.getParcelableExtra<Subject>(ACTION_KEY)?.let { subject ->
+            update(subject.notifyID())
+            coroutineScope.launch {
+                try {
+                    subject.startDownload()
+                } catch (e: IOException) {
+                    Timber.e(e)
+                    notifyFail(subject)
+                }
+            }
+        }
+        return START_REDELIVER_INTENT
+    }
+
+    override fun onTaskRemoved(rootIntent: Intent?) {
+        super.onTaskRemoved(rootIntent)
+        notifications.forEach { cancel(it.key) }
+        notifications.clear()
+    }
+
+    override fun onDestroy() {
+        super.onDestroy()
+        coroutineScope.cancel()
+    }
+
+    // -- Download logic
+
+    private suspend fun Subject.startDownload() {
+        val skip = this is Subject.Magisk && file.checkSum("MD5", magisk.md5)
+        if (!skip) {
+            val stream = service.fetchFile(url).toProgressStream(this)
+            when (this) {
+                is Subject.Module ->  // Download and process on-the-fly
+                    stream.toModule(file, service.fetchInstaller().byteStream())
+                else -> {
+                    withStreams(stream, file.outputStream()) { it, out -> it.copyTo(out) }
+                    if (this is Subject.Manager)
+                        handleAPK(this)
+                }
+            }
+        }
+        val newId = notifyFinish(this)
+        if (ForegroundTracker.hasForeground)
+            onFinish(this, newId)
+        if (!hasNotifications)
+            stopSelf()
+    }
+
+    private fun ResponseBody.toProgressStream(subject: Subject): InputStream {
+        val max = contentLength()
+        val total = max.toFloat() / 1048576
+        val id = subject.notifyID()
+
+        update(id) { it.setContentTitle(subject.title) }
+
+        return ProgressInputStream(byteStream()) {
+            val progress = it.toFloat() / 1048576
+            update(id) { notification ->
+                if (max > 0) {
+                    broadcast(progress / total, subject)
+                    notification
+                        .setProgress(max.toInt(), it.toInt(), false)
+                        .setContentText("%.2f / %.2f MB".format(progress, total))
+                } else {
+                    broadcast(-1f, subject)
+                    notification.setContentText("%.2f MB / ??".format(progress))
+                }
+            }
+        }
+    }
+
+    // --- Notification managements
+
+    fun Subject.notifyID() = hashCode()
+
+    private fun notifyFail(subject: Subject) = lastNotify(subject.notifyID()) {
+        broadcast(-1f, subject)
+        it.setContentText(getString(R.string.download_file_error))
+            .setSmallIcon(android.R.drawable.stat_notify_error)
+            .setOngoing(false)
+    }
+
+    private fun notifyFinish(subject: Subject) = lastNotify(subject.notifyID()) {
+        broadcast(1f, subject)
+        it.setIntent(subject)
+            .setContentTitle(subject.title)
+            .setContentText(getString(R.string.download_complete))
+            .setSmallIcon(android.R.drawable.stat_sys_download_done)
+            .setProgress(0, 0, false)
+            .setOngoing(false)
+            .setAutoCancel(true)
+    }
+
+    private fun create() = Notifications.progress(this, "")
+
+    fun update(id: Int, editor: (Notification.Builder) -> Unit = {}) {
+        val wasEmpty = !hasNotifications
+        val notification = notifications.getOrPut(id, ::create).also(editor)
+        if (wasEmpty)
+            updateForeground()
+        else
+            notify(id, notification.build())
+    }
+
+    private fun lastNotify(
+        id: Int,
+        editor: (Notification.Builder) -> Notification.Builder? = { null }
+    ) : Int {
+        val notification = remove(id)?.run(editor) ?: return -1
+        val newId: Int = nextInt()
+        notify(newId, notification.build())
+        return newId
+    }
+
+    protected fun remove(id: Int) = notifications.remove(id)
+        ?.also { updateForeground(); cancel(id) }
+        ?: { cancel(id); null }()
+
+    private fun notify(id: Int, notification: Notification) {
+        Notifications.mgr.notify(id, notification)
+    }
+
+    private fun cancel(id: Int) {
+        Notifications.mgr.cancel(id)
+    }
+
+    private fun updateForeground() {
+        if (hasNotifications) {
+            val (id, notification) = notifications.entries.first()
+            startForeground(id, notification.build())
+        } else {
+            stopForeground(false)
+        }
+    }
+
+    // --- Implement custom logic
+
+    protected abstract suspend fun onFinish(subject: Subject, id: Int)
+
+    protected abstract fun Notification.Builder.setIntent(subject: Subject): Notification.Builder
+
+    // ---
+
+    companion object : KoinComponent {
+        const val ACTION_KEY = "download_action"
+
+        private val progressBroadcast = MutableLiveData<Pair<Float, Subject>>()
+
+        fun observeProgress(owner: LifecycleOwner, callback: (Float, Subject) -> Unit) {
+            progressBroadcast.value = null
+            progressBroadcast.observe(owner) {
+                val (progress, subject) = it ?: return@observe
+                callback(progress, subject)
+            }
+        }
+
+        private fun broadcast(progress: Float, subject: Subject) {
+            progressBroadcast.postValue(progress to subject)
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/download/DownloadService.kt

@@ -0,0 +1,113 @@
+package com.topjohnwu.magisk.core.download
+
+import android.annotation.SuppressLint
+import android.app.Notification
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import androidx.core.net.toFile
+import com.topjohnwu.magisk.core.download.Action.*
+import com.topjohnwu.magisk.core.download.Action.Flash.Secondary
+import com.topjohnwu.magisk.core.download.Subject.*
+import com.topjohnwu.magisk.core.intent
+import com.topjohnwu.magisk.core.tasks.EnvFixTask
+import com.topjohnwu.magisk.ui.flash.FlashFragment
+import com.topjohnwu.magisk.utils.APKInstall
+import kotlin.random.Random.Default.nextInt
+
+@SuppressLint("Registered")
+open class DownloadService : BaseDownloader() {
+
+    private val context get() = this
+
+    override suspend fun onFinish(subject: Subject, id: Int) = when (subject) {
+        is Magisk -> subject.onFinish(id)
+        is Module -> subject.onFinish(id)
+        is Manager -> subject.onFinish(id)
+    }
+
+    private suspend fun Magisk.onFinish(id: Int) = when (val action = action) {
+        Uninstall -> FlashFragment.uninstall(file, id)
+        EnvFix -> {
+            remove(id)
+            EnvFixTask(file).exec()
+            Unit
+        }
+        is Patch -> FlashFragment.patch(file, action.fileUri, id)
+        is Flash -> FlashFragment.flash(file, action is Secondary, id)
+        else -> Unit
+    }
+
+    private fun Module.onFinish(id: Int) = when (action) {
+        is Flash -> FlashFragment.install(file, id)
+        else -> Unit
+    }
+
+    private fun Manager.onFinish(id: Int) {
+        remove(id)
+        APKInstall.install(context, file.toFile())
+    }
+
+    // --- Customize finish notification
+
+    override fun Notification.Builder.setIntent(subject: Subject)
+    = when (subject) {
+        is Magisk -> setIntent(subject)
+        is Module -> setIntent(subject)
+        is Manager -> setIntent(subject)
+    }
+
+    private fun Notification.Builder.setIntent(subject: Magisk)
+    = when (val action = subject.action) {
+        Uninstall -> setContentIntent(FlashFragment.uninstallIntent(context, subject.file))
+        is Flash -> setContentIntent(FlashFragment.flashIntent(context, subject.file, action is Secondary))
+        is Patch -> setContentIntent(FlashFragment.patchIntent(context, subject.file, action.fileUri))
+        else -> setContentIntent(Intent())
+    }
+
+    private fun Notification.Builder.setIntent(subject: Module)
+    = when (subject.action) {
+        is Flash -> setContentIntent(FlashFragment.installIntent(context, subject.file))
+        else -> setContentIntent(Intent())
+    }
+
+    private fun Notification.Builder.setIntent(subject: Manager)
+    = when (subject.action) {
+        APK.Upgrade -> setContentIntent(APKInstall.installIntent(context, subject.file.toFile()))
+        else -> setContentIntent(Intent())
+    }
+
+    private fun Notification.Builder.setContentIntent(intent: Intent) =
+        setContentIntent(
+            PendingIntent.getActivity(context, nextInt(), intent, PendingIntent.FLAG_ONE_SHOT)
+        )
+
+    // ---
+
+    companion object {
+
+        private fun intent(context: Context, subject: Subject) =
+            context.intent<DownloadService>().putExtra(ACTION_KEY, subject)
+
+        fun pendingIntent(context: Context, subject: Subject): PendingIntent {
+            return if (Build.VERSION.SDK_INT >= 26) {
+                PendingIntent.getForegroundService(context, nextInt(),
+                    intent(context, subject), PendingIntent.FLAG_UPDATE_CURRENT)
+            } else {
+                PendingIntent.getService(context, nextInt(),
+                    intent(context, subject), PendingIntent.FLAG_UPDATE_CURRENT)
+            }
+        }
+
+        fun start(context: Context, subject: Subject) {
+            val app = context.applicationContext
+            if (Build.VERSION.SDK_INT >= 26) {
+                app.startForegroundService(intent(app, subject))
+            } else {
+                app.startService(intent(app, subject))
+            }
+        }
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/core/download/ManagerHandler.kt

@@ -0,0 +1,72 @@
+package com.topjohnwu.magisk.core.download
+
+import android.content.Context
+import androidx.core.net.toFile
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.DynAPK
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.download.Action.APK.Restore
+import com.topjohnwu.magisk.core.download.Action.APK.Upgrade
+import com.topjohnwu.magisk.core.isRunningAsStub
+import com.topjohnwu.magisk.core.tasks.PatchAPK
+import com.topjohnwu.magisk.ktx.relaunchApp
+import com.topjohnwu.magisk.ktx.writeTo
+import com.topjohnwu.superuser.Shell
+import java.io.File
+
+private fun Context.patch(apk: File) {
+    val patched = File(apk.parent, "patched.apk")
+    PatchAPK.patch(this, apk.path, patched.path, packageName, applicationInfo.nonLocalizedLabel)
+    apk.delete()
+    patched.renameTo(apk)
+}
+
+private fun BaseDownloader.notifyHide(id: Int) {
+    update(id) {
+        it.setProgress(0, 0, true)
+            .setContentTitle(getString(R.string.hide_manager_title))
+            .setContentText("")
+    }
+}
+
+private suspend fun BaseDownloader.upgrade(subject: Subject.Manager) {
+    val apk = subject.file.toFile()
+    val id = subject.notifyID()
+    if (isRunningAsStub) {
+        // Move to upgrade location
+        apk.copyTo(DynAPK.update(this), overwrite = true)
+        apk.delete()
+        if (Info.stubChk.version < subject.stub.versionCode) {
+            notifyHide(id)
+            // Also upgrade stub
+            service.fetchFile(subject.stub.link).byteStream().use { it.writeTo(apk) }
+            patch(apk)
+        } else {
+            // Simply relaunch the app
+            stopSelf()
+            relaunchApp(this)
+        }
+    } else if (packageName != BuildConfig.APPLICATION_ID) {
+        notifyHide(id)
+        patch(apk)
+    }
+}
+
+private fun BaseDownloader.restore(apk: File, id: Int) {
+    update(id) {
+        it.setProgress(0, 0, true)
+            .setProgress(0, 0, true)
+            .setContentTitle(getString(R.string.restore_img_msg))
+            .setContentText("")
+    }
+    Config.export()
+    Shell.su("pm install $apk && pm uninstall $packageName").exec()
+}
+
+suspend fun BaseDownloader.handleAPK(subject: Subject.Manager) =
+    when (subject.action) {
+        is Upgrade -> upgrade(subject)
+        is Restore -> restore(subject.file.toFile(), subject.notifyID())
+    }

app/src/main/java/com/topjohnwu/magisk/core/download/ModuleProcessor.kt

@@ -1,13 +1,14 @@
-package com.topjohnwu.magisk.model.download
+package com.topjohnwu.magisk.core.download
 
-import com.topjohnwu.magisk.extensions.withStreams
-import java.io.File
+import android.net.Uri
+import com.topjohnwu.magisk.ktx.withStreams
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.outputStream
 import java.io.InputStream
 import java.util.zip.ZipEntry
 import java.util.zip.ZipInputStream
 import java.util.zip.ZipOutputStream
 
-fun InputStream.toModule(file: File, installer: InputStream) {
+fun InputStream.toModule(file: Uri, installer: InputStream) {
 
     val input = ZipInputStream(buffered())
     val output = ZipOutputStream(file.outputStream().buffered())
@@ -41,4 +42,4 @@ fun InputStream.toModule(file: File, installer: InputStream) {
             entry = zin.nextEntry
         }
     }
-}
+}

app/src/main/java/com/topjohnwu/magisk/core/download/Subject.kt

@@ -0,0 +1,114 @@
+package com.topjohnwu.magisk.core.download
+
+import android.content.Context
+import android.net.Uri
+import android.os.Parcelable
+import androidx.core.net.toUri
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.model.MagiskJson
+import com.topjohnwu.magisk.core.model.ManagerJson
+import com.topjohnwu.magisk.core.model.StubJson
+import com.topjohnwu.magisk.core.model.module.Repo
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils
+import com.topjohnwu.magisk.ktx.cachedFile
+import com.topjohnwu.magisk.ktx.get
+import kotlinx.android.parcel.IgnoredOnParcel
+import kotlinx.android.parcel.Parcelize
+
+private fun cachedFile(name: String) = get<Context>().cachedFile(name).apply { delete() }.toUri()
+
+sealed class Subject : Parcelable {
+
+    abstract val url: String
+    abstract val file: Uri
+    abstract val action: Action
+    abstract val title: String
+
+    @Parcelize
+    class Module(
+        val module: Repo,
+        override val action: Action
+    ) : Subject() {
+        override val url: String get() = module.zipUrl
+        override val title: String get() = module.downloadFilename
+
+        @IgnoredOnParcel
+        override val file by lazy {
+            MediaStoreUtils.getFile(title).uri
+        }
+    }
+
+    @Parcelize
+    class Manager(
+        override val action: Action.APK,
+        private val app: ManagerJson = Info.remote.app,
+        val stub: StubJson = Info.remote.stub
+    ) : Subject() {
+
+        override val title: String
+            get() = "MagiskManager-${app.version}(${app.versionCode})"
+
+        override val url: String
+            get() = app.link
+
+        @IgnoredOnParcel
+        override val file by lazy {
+            cachedFile("manager.apk")
+        }
+
+    }
+
+    abstract class Magisk : Subject() {
+
+        val magisk: MagiskJson = Info.remote.magisk
+
+        @Parcelize
+        private class Internal(
+            override val action: Action
+        ) : Magisk() {
+            override val url: String get() = magisk.link
+            override val title: String get() = "Magisk-${magisk.version}(${magisk.versionCode})"
+
+            @IgnoredOnParcel
+            override val file by lazy {
+                cachedFile("magisk.zip")
+            }
+        }
+
+        @Parcelize
+        private class Uninstall : Magisk() {
+            override val action get() = Action.Uninstall
+            override val url: String get() = Info.remote.uninstaller.link
+            override val title: String get() = "uninstall.zip"
+
+            @IgnoredOnParcel
+            override val file by lazy {
+                cachedFile(title)
+            }
+
+        }
+
+        @Parcelize
+        private class Download : Magisk() {
+            override val action get() = Action.Download
+            override val url: String get() = magisk.link
+            override val title: String get() = "Magisk-${magisk.version}(${magisk.versionCode}).zip"
+
+            @IgnoredOnParcel
+            override val file by lazy {
+                MediaStoreUtils.getFile(title).uri
+            }
+        }
+
+        companion object {
+            operator fun invoke(config: Action) = when (config) {
+                Action.Download -> Download()
+                Action.Uninstall -> Uninstall()
+                Action.EnvFix, is Action.Flash, is Action.Patch -> Internal(config)
+                else -> throw IllegalArgumentException()
+            }
+        }
+
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/BaseDao.kt

@@ -0,0 +1,28 @@
+package com.topjohnwu.magisk.core.magiskdb
+
+import androidx.annotation.StringDef
+
+abstract class BaseDao {
+
+    object Table {
+        const val POLICY = "policies"
+        const val LOG = "logs"
+        const val SETTINGS = "settings"
+        const val STRINGS = "strings"
+    }
+
+    @StringDef(Table.POLICY, Table.LOG, Table.SETTINGS, Table.STRINGS)
+    @Retention(AnnotationRetention.SOURCE)
+    annotation class TableStrict
+
+    @TableStrict
+    abstract val table: String
+
+    inline fun <reified Builder : Query.Builder> buildQuery(builder: Builder.() -> Unit = {}) =
+        Builder::class.java.newInstance()
+            .apply { table = this@BaseDao.table }
+            .apply(builder)
+            .toString()
+            .let { Query(it) }
+
+}

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/PolicyDao.kt

@@ -0,0 +1,77 @@
+package com.topjohnwu.magisk.core.magiskdb
+
+import android.content.Context
+import android.content.pm.PackageManager
+import com.topjohnwu.magisk.core.Const
+import com.topjohnwu.magisk.core.model.su.SuPolicy
+import com.topjohnwu.magisk.core.model.su.toMap
+import com.topjohnwu.magisk.core.model.su.toPolicy
+import com.topjohnwu.magisk.ktx.now
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
+import timber.log.Timber
+import java.util.concurrent.TimeUnit
+
+
+class PolicyDao(
+    private val context: Context
+) : BaseDao() {
+
+    override val table: String = Table.POLICY
+
+    suspend fun deleteOutdated() = buildQuery<Delete> {
+        condition {
+            greaterThan("until", "0")
+            and {
+                lessThan("until", TimeUnit.MILLISECONDS.toSeconds(now).toString())
+            }
+            or {
+                lessThan("until", "0")
+            }
+        }
+    }.commit()
+
+    suspend fun delete(packageName: String) = buildQuery<Delete> {
+        condition {
+            equals("package_name", packageName)
+        }
+    }.commit()
+
+    suspend fun delete(uid: Int) = buildQuery<Delete> {
+        condition {
+            equals("uid", uid)
+        }
+    }.commit()
+
+    suspend fun fetch(uid: Int) = buildQuery<Select> {
+        condition {
+            equals("uid", uid)
+        }
+    }.query().first().toPolicyOrNull()
+
+    suspend fun update(policy: SuPolicy) = buildQuery<Replace> {
+        values(policy.toMap())
+    }.commit()
+
+    suspend fun <R: Any> fetchAll(mapper: (SuPolicy) -> R) = buildQuery<Select> {
+        condition {
+            equals("uid/100000", Const.USER_ID)
+        }
+    }.query {
+        it.toPolicyOrNull()?.let(mapper)
+    }
+
+    private fun Map<String, String>.toPolicyOrNull(): SuPolicy? {
+        return runCatching { toPolicy(context.packageManager) }.getOrElse {
+            Timber.e(it)
+            if (it is PackageManager.NameNotFoundException) {
+                val uid = getOrElse("uid") { null } ?: return null
+                GlobalScope.launch {
+                    delete(uid.toInt())
+                }
+            }
+            null
+        }
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/Query.kt

@@ -1,6 +1,12 @@
-package com.topjohnwu.magisk.data.database.magiskdb
+package com.topjohnwu.magisk.core.magiskdb
 
 import androidx.annotation.StringDef
+import com.topjohnwu.magisk.ktx.await
+import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitAll
+import kotlinx.coroutines.withContext
 
 class Query(private val _query: String) {
     val query get() = "magisk --sqlite '$_query'"
@@ -9,6 +15,24 @@ class Query(private val _query: String) {
         val requestType: String
         var table: String
     }
+
+    suspend inline fun <R : Any> query(crossinline mapper: (Map<String, String>) -> R?): List<R> =
+        withContext(Dispatchers.Default) {
+            Shell.su(query).await().out.map { line ->
+                async {
+                    line.split("\\|".toRegex())
+                        .map { it.split("=", limit = 2) }
+                        .filter { it.size == 2 }
+                        .map { it[0] to it[1] }
+                        .toMap()
+                        .let(mapper)
+                }
+            }.awaitAll().filterNotNull()
+        }
+
+    suspend inline fun query() = query { it }
+
+    suspend inline fun commit() = Shell.su(query).to(null).await()
 }
 
 class Delete : Query.Builder {

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/SettingsDao.kt

@@ -0,0 +1,22 @@
+package com.topjohnwu.magisk.core.magiskdb
+
+class SettingsDao : BaseDao() {
+
+    override val table = Table.SETTINGS
+
+    suspend fun delete(key: String) = buildQuery<Delete> {
+        condition { equals("key", key) }
+    }.commit()
+
+    suspend fun put(key: String, value: Int) = buildQuery<Replace> {
+        values("key" to key, "value" to value)
+    }.commit()
+
+    suspend fun fetch(key: String, default: Int = -1) = buildQuery<Select> {
+        fields("value")
+        condition { equals("key", key) }
+    }.query {
+        it["value"]?.toIntOrNull()
+    }.firstOrNull() ?: default
+
+}

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/StringDao.kt

@@ -0,0 +1,22 @@
+package com.topjohnwu.magisk.core.magiskdb
+
+class StringDao : BaseDao() {
+
+    override val table = Table.STRINGS
+
+    suspend fun delete(key: String) = buildQuery<Delete> {
+        condition { equals("key", key) }
+    }.commit()
+
+    suspend fun put(key: String, value: String) = buildQuery<Replace> {
+        values("key" to key, "value" to value)
+    }.commit()
+
+    suspend fun fetch(key: String, default: String = "") = buildQuery<Select> {
+        fields("value")
+        condition { equals("key", key) }
+    }.query {
+        it["value"]
+    }.firstOrNull() ?: default
+
+}

app/src/main/java/com/topjohnwu/magisk/core/model/UpdateInfo.kt

@@ -1,10 +1,10 @@
-package com.topjohnwu.magisk.model.entity
+package com.topjohnwu.magisk.core.model
 
 import android.os.Parcelable
+import com.squareup.moshi.JsonClass
 import kotlinx.android.parcel.Parcelize
-import se.ansman.kotshi.JsonSerializable
 
-@JsonSerializable
+@JsonClass(generateAdapter = true)
 data class UpdateInfo(
     val app: ManagerJson = ManagerJson(),
     val uninstaller: UninstallerJson = UninstallerJson(),
@@ -12,12 +12,12 @@ data class UpdateInfo(
     val stub: StubJson = StubJson()
 )
 
-@JsonSerializable
+@JsonClass(generateAdapter = true)
 data class UninstallerJson(
     val link: String = ""
 )
 
-@JsonSerializable
+@JsonClass(generateAdapter = true)
 data class MagiskJson(
     val version: String = "",
     val versionCode: Int = -1,
@@ -27,7 +27,7 @@ data class MagiskJson(
 )
 
 @Parcelize
-@JsonSerializable
+@JsonClass(generateAdapter = true)
 data class ManagerJson(
     val version: String = "",
     val versionCode: Int = -1,
@@ -35,8 +35,9 @@ data class ManagerJson(
     val note: String = ""
 ) : Parcelable
 
-@JsonSerializable
+@Parcelize
+@JsonClass(generateAdapter = true)
 data class StubJson(
     val versionCode: Int = -1,
     val link: String = ""
-)
+) : Parcelable

app/src/main/java/com/topjohnwu/magisk/core/model/module/BaseModule.kt

@@ -1,4 +1,4 @@
-package com.topjohnwu.magisk.model.entity.module
+package com.topjohnwu.magisk.core.model.module
 
 abstract class BaseModule : Comparable<BaseModule> {
     abstract var id: String

app/src/main/java/com/topjohnwu/magisk/core/model/module/Module.kt

@@ -1,9 +1,10 @@
-package com.topjohnwu.magisk.model.entity.module
+package com.topjohnwu.magisk.core.model.module
 
-import androidx.annotation.WorkerThread
-import com.topjohnwu.magisk.Const
+import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.io.SuFile
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
 
 class Module(path: String) : BaseModule() {
     override var id: String = ""
@@ -18,12 +19,13 @@ class Module(path: String) : BaseModule() {
     private val updateFile = SuFile(path, "update")
     private val ruleFile = SuFile(path, "sepolicy.rule")
 
-    val updated: Boolean = updateFile.exists()
+    val updated: Boolean get() = updateFile.exists()
 
-    var enable: Boolean = !disableFile.exists()
+    var enable: Boolean
+        get() = !disableFile.exists()
         set(enable) {
             val dir = "$PERSIST/$id"
-            field = if (enable) {
+            if (enable) {
                 Shell.su("mkdir -p $dir", "cp -af $ruleFile $dir").submit()
                 disableFile.delete()
             } else {
@@ -32,9 +34,10 @@ class Module(path: String) : BaseModule() {
             }
         }
 
-    var remove: Boolean = removeFile.exists()
+    var remove: Boolean
+        get() = removeFile.exists()
         set(remove) {
-            field = if (remove) {
+            if (remove) {
                 Shell.su("rm -rf $PERSIST/$id").submit()
                 removeFile.createNewFile()
             } else {
@@ -60,20 +63,15 @@ class Module(path: String) : BaseModule() {
 
     companion object {
 
-        private const val PERSIST = "/sbin/.magisk/mirror/persist/magisk"
+        private val PERSIST get() = "${Const.MAGISKTMP}/mirror/persist/magisk"
 
-        @WorkerThread
-        fun loadModules(): List<Module> {
-            val moduleList = mutableListOf<Module>()
-            val path = SuFile(Const.MAGISK_PATH)
-            val modules =
-                    path.listFiles { _, name -> name != "lost+found" && name != ".core" }.orEmpty()
-            for (file in modules) {
-                if (file.isFile) continue
-                val module = Module(Const.MAGISK_PATH + "/" + file.name)
-                moduleList.add(module)
-            }
-            return moduleList.sortedBy { it.name.toLowerCase() }
+        suspend fun installed() = withContext(Dispatchers.IO) {
+            SuFile(Const.MAGISK_PATH)
+                .listFiles { _, name -> name != "lost+found" && name != ".core" }
+                .orEmpty()
+                .filter { !it.isFile }
+                .map { Module("${Const.MAGISK_PATH}/${it.name}") }
+                .sortedBy { it.name.toLowerCase() }
         }
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/model/module/Repo.kt

@@ -1,12 +1,12 @@
-package com.topjohnwu.magisk.model.entity.module
+package com.topjohnwu.magisk.core.model.module
 
 import android.os.Parcelable
 import androidx.room.Entity
 import androidx.room.PrimaryKey
-import com.topjohnwu.magisk.Const
+import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.data.repository.StringRepository
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.legalFilename
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.legalFilename
 import kotlinx.android.parcel.Parcelize
 import java.text.DateFormat
 import java.util.*
@@ -31,22 +31,15 @@ data class Repo(
 
     val downloadFilename: String get() = "$name-$version($versionCode).zip".legalFilename()
 
-    val readme get() = stringRepo.getReadme(this)
+    suspend fun readme() = stringRepo.getReadme(this)
 
     val zipUrl: String get() = Const.Url.ZIP_URL.format(id)
 
     constructor(id: String) : this(id, "", "", "", -1, "", 0)
 
     @Throws(IllegalRepoException::class)
-    fun update() {
-        val props = runCatching {
-            stringRepo.getMetadata(this).blockingGet()
-                    .orEmpty().split("\\n".toRegex()).dropLastWhile { it.isEmpty() }
-        }.getOrElse {
-            throw IllegalRepoException("Repo [$id] module.prop download error: " + it.message)
-        }
-
-        props.runCatching {
+    private fun loadProps(props: String) {
+        props.split("\\n".toRegex()).dropLastWhile { it.isEmpty() }.runCatching {
             parseProps(this)
         }.onFailure {
             throw IllegalRepoException("Repo [$id] parse error: " + it.message)
@@ -58,14 +51,14 @@ data class Repo(
     }
 
     @Throws(IllegalRepoException::class)
-    fun update(lastUpdate: Date) {
-        last_update = lastUpdate.time
-        update()
+    suspend fun update(lastUpdate: Date? = null) {
+        lastUpdate?.let { last_update = it.time }
+        loadProps(stringRepo.getMetadata(this))
     }
 
     class IllegalRepoException(message: String) : Exception(message)
 
     companion object {
-        val dateFormat = DateFormat.getDateTimeInstance(DateFormat.MEDIUM, DateFormat.MEDIUM)!!
+        val dateFormat = DateFormat.getDateTimeInstance(DateFormat.MEDIUM, DateFormat.MEDIUM)
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/model/su/SuLog.kt

@@ -1,15 +1,15 @@
-package com.topjohnwu.magisk.model.entity
+package com.topjohnwu.magisk.core.model.su
 
 import androidx.room.Entity
 import androidx.room.Ignore
 import androidx.room.PrimaryKey
-import com.topjohnwu.magisk.extensions.now
-import com.topjohnwu.magisk.extensions.timeFormatTime
-import com.topjohnwu.magisk.extensions.toTime
-import com.topjohnwu.magisk.model.entity.MagiskPolicy.Companion.ALLOW
+import com.topjohnwu.magisk.core.model.su.SuPolicy.Companion.ALLOW
+import com.topjohnwu.magisk.ktx.now
+import com.topjohnwu.magisk.ktx.timeFormatTime
+import com.topjohnwu.magisk.ktx.toTime
 
 @Entity(tableName = "logs")
-data class MagiskLog(
+data class SuLog(
     val fromUid: Int,
     val toUid: Int,
     val fromPid: Int,
@@ -23,13 +23,8 @@ data class MagiskLog(
     @Ignore val timeString = time.toTime(timeFormatTime)
 }
 
-data class WrappedMagiskLog(
-    val time: Long,
-    val items: List<MagiskLog>
-)
-
-fun MagiskPolicy.toLog(
+fun SuPolicy.toLog(
     toUid: Int,
     fromPid: Int,
     command: String
-) = MagiskLog(uid, toUid, fromPid, packageName, appName, command, policy == ALLOW, now)
+) = SuLog(uid, toUid, fromPid, packageName, appName, command, policy == ALLOW, now)

app/src/main/java/com/topjohnwu/magisk/core/model/su/SuPolicy.kt

@@ -1,20 +1,20 @@
-package com.topjohnwu.magisk.model.entity
+package com.topjohnwu.magisk.core.model.su
 
-import android.content.pm.ApplicationInfo
 import android.content.pm.PackageManager
-import com.topjohnwu.magisk.extensions.getLabel
-import com.topjohnwu.magisk.model.entity.MagiskPolicy.Companion.INTERACTIVE
+import android.graphics.drawable.Drawable
+import com.topjohnwu.magisk.core.model.su.SuPolicy.Companion.INTERACTIVE
+import com.topjohnwu.magisk.ktx.getLabel
 
 
-data class MagiskPolicy(
+data class SuPolicy(
     var uid: Int,
     val packageName: String,
     val appName: String,
+    val icon: Drawable,
     var policy: Int = INTERACTIVE,
     var until: Long = -1L,
     val logging: Boolean = true,
-    val notification: Boolean = true,
-    val applicationInfo: ApplicationInfo
+    val notification: Boolean = true
 ) {
 
     companion object {
@@ -25,7 +25,7 @@ data class MagiskPolicy(
 
 }
 
-fun MagiskPolicy.toMap() = mapOf(
+fun SuPolicy.toMap() = mapOf(
     "uid" to uid,
     "package_name" to packageName,
     "policy" to policy,
@@ -35,7 +35,7 @@ fun MagiskPolicy.toMap() = mapOf(
 )
 
 @Throws(PackageManager.NameNotFoundException::class)
-fun Map<String, String>.toPolicy(pm: PackageManager): MagiskPolicy {
+fun Map<String, String>.toPolicy(pm: PackageManager): SuPolicy {
     val uid = get("uid")?.toIntOrNull() ?: -1
     val packageName = get("package_name").orEmpty()
     val info = pm.getApplicationInfo(packageName, PackageManager.GET_UNINSTALLED_PACKAGES)
@@ -43,28 +43,28 @@ fun Map<String, String>.toPolicy(pm: PackageManager): MagiskPolicy {
     if (info.uid != uid)
         throw PackageManager.NameNotFoundException()
 
-    return MagiskPolicy(
+    return SuPolicy(
         uid = uid,
         packageName = packageName,
+        appName = info.getLabel(pm),
+        icon = info.loadIcon(pm),
         policy = get("policy")?.toIntOrNull() ?: INTERACTIVE,
         until = get("until")?.toLongOrNull() ?: -1L,
         logging = get("logging")?.toIntOrNull() != 0,
-        notification = get("notification")?.toIntOrNull() != 0,
-        applicationInfo = info,
-        appName = info.getLabel(pm)
+        notification = get("notification")?.toIntOrNull() != 0
     )
 }
 
 @Throws(PackageManager.NameNotFoundException::class)
-fun Int.toPolicy(pm: PackageManager, policy: Int = INTERACTIVE): MagiskPolicy {
+fun Int.toPolicy(pm: PackageManager, policy: Int = INTERACTIVE): SuPolicy {
     val pkg = pm.getPackagesForUid(this)?.firstOrNull()
         ?: throw PackageManager.NameNotFoundException()
     val info = pm.getApplicationInfo(pkg, PackageManager.GET_UNINSTALLED_PACKAGES)
-    return MagiskPolicy(
+    return SuPolicy(
         uid = info.uid,
         packageName = pkg,
-        policy = policy,
-        applicationInfo = info,
-        appName = info.getLabel(pm)
+        appName = info.getLabel(pm),
+        icon = info.loadIcon(pm),
+        policy = policy
     )
 }

app/src/main/java/com/topjohnwu/magisk/core/su/SuCallbackHandler.kt

@@ -1,4 +1,4 @@
-package com.topjohnwu.magisk.utils
+package com.topjohnwu.magisk.core.su
 
 import android.content.Context
 import android.content.Intent
@@ -6,20 +6,27 @@ import android.os.Build
 import android.os.Bundle
 import android.os.Process
 import android.widget.Toast
-import com.topjohnwu.magisk.*
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.ProviderCallHandler
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.intent
+import com.topjohnwu.magisk.core.model.su.SuPolicy
+import com.topjohnwu.magisk.core.model.su.toLog
+import com.topjohnwu.magisk.core.model.su.toPolicy
+import com.topjohnwu.magisk.core.wrap
 import com.topjohnwu.magisk.data.repository.LogRepository
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.startActivity
-import com.topjohnwu.magisk.extensions.startActivityWithRoot
-import com.topjohnwu.magisk.extensions.subscribeK
-import com.topjohnwu.magisk.model.entity.MagiskPolicy
-import com.topjohnwu.magisk.model.entity.toLog
-import com.topjohnwu.magisk.model.entity.toPolicy
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.startActivity
+import com.topjohnwu.magisk.ktx.startActivityWithRoot
 import com.topjohnwu.magisk.ui.surequest.SuRequestActivity
+import com.topjohnwu.magisk.utils.Utils
 import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
 import timber.log.Timber
 
-object SuHandler : ProviderCallHandler {
+object SuCallbackHandler : ProviderCallHandler {
 
     const val REQUEST = "request"
     const val LOG = "log"
@@ -45,20 +52,8 @@ object SuHandler : ProviderCallHandler {
         }
 
         when (action) {
-            REQUEST -> {
-                val intent = context.intent<SuRequestActivity>()
-                    .setAction(action)
-                    .putExtras(data)
-                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                    .addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK)
-                if (Build.VERSION.SDK_INT >= 29) {
-                    // Android Q does not allow starting activity from background
-                    intent.startActivityWithRoot()
-                } else {
-                    intent.startActivity(context)
-                }
-            }
-            LOG -> handleLogs(context, data)
+            REQUEST -> handleRequest(context, data)
+            LOG -> handleLogging(context, data)
             NOTIFY -> handleNotify(context, data)
             TEST -> {
                 val mode = data.getInt("mode", 2)
@@ -72,13 +67,26 @@ object SuHandler : ProviderCallHandler {
 
     private fun Any?.toInt(): Int? {
         return when (this) {
-            is Int -> this
-            is Long -> this.toInt()
+            is Number -> this.toInt()
             else -> null
         }
     }
 
-    private fun handleLogs(context: Context, data: Bundle) {
+    private fun handleRequest(context: Context, data: Bundle) {
+        val intent = context.intent<SuRequestActivity>()
+            .setAction(REQUEST)
+            .putExtras(data)
+            .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            .addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK)
+        if (Build.VERSION.SDK_INT >= 29) {
+            // Android Q does not allow starting activity from background
+            intent.startActivityWithRoot()
+        } else {
+            intent.startActivity(context)
+        }
+    }
+
+    private fun handleLogging(context: Context, data: Bundle) {
         val fromUid = data["from.uid"].toInt() ?: return
         if (fromUid == Process.myUid())
             return
@@ -104,7 +112,9 @@ object SuHandler : ProviderCallHandler {
         )
 
         val logRepo = get<LogRepository>()
-        logRepo.insert(log).subscribeK(onError = { Timber.e(it) })
+        GlobalScope.launch {
+            logRepo.insert(log)
+        }
     }
 
     private fun handleNotify(context: Context, data: Bundle) {
@@ -122,9 +132,9 @@ object SuHandler : ProviderCallHandler {
         }
     }
 
-    private fun notify(context: Context, policy: MagiskPolicy) {
+    private fun notify(context: Context, policy: SuPolicy) {
         if (policy.notification && Config.suNotification == Config.Value.NOTIFICATION_TOAST) {
-            val resId = if (policy.policy == MagiskPolicy.ALLOW)
+            val resId = if (policy.policy == SuPolicy.ALLOW)
                 R.string.su_allow_toast
             else
                 R.string.su_deny_toast