Add v21.0 release notes

Update Magisk Manager app translation
 - Korean translation updated
(Translation based on "en" strings.xml)

README.MD

@@ -1,41 +1,70 @@
-# Magisk
+![](docs/images/logo.png)
 
-[Downloads](https://github.com/topjohnwu/Magisk/releases) \| [Documentation](https://topjohnwu.github.io/Magisk/) \| [XDA Thread](https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445)
+![ZIP Downloads](https://img.shields.io/badge/dynamic/json?color=blue&label=ZIP%20Downloads&query=magisk&url=https%3A%2F%2Fraw.githubusercontent.com%2Ftopjohnwu%2Fmagisk_files%2Fcount%2Fcount.json&cacheSeconds=1800)
+![APK Downloads](https://img.shields.io/badge/dynamic/json?color=green&label=APK%20Downloads&query=manager&url=https%3A%2F%2Fraw.githubusercontent.com%2Ftopjohnwu%2Fmagisk_files%2Fcount%2Fcount.json&cacheSeconds=1800)
 
 ## Introduction
 
-Magisk is a suite of open source tools for customizing Android, supporting devices higher than Android 4.2 (API 17). It covers the fundamental parts for Android customization: root, boot scripts, SELinux patches, AVB2.0 / dm-verity / forceencrypt removals etc.
+Magisk is a suite of open source tools for customizing Android, supporting devices higher than Android 4.2. It covers fundamental parts of Android customization: root, boot scripts, SELinux patches, AVB2.0 / dm-verity / forceencrypt removals etc.
 
-Furthermore, Magisk provides a **Systemless Interface** to alter the system (or vendor) arbitrarily while the actual partitions stay completely intact. With its systemless nature along with several other hacks, Magisk can almost perfectly hide modifications within userspace. Note that since 2020.3, the CTS check of [Google's SafetyNet API](https://developer.android.com/training/safetynet/index.html) will **NOT** pass.
+Here are some feature highlights:
+
+- **MagiskSU**: Provide root access to your device
+- **Magisk Modules**: Modify read-only partitions by installing modules
+- **MagiskHide**: Hide Magisk from root detections / system integrity checks
+
+## Downloads
+
+[![](https://img.shields.io/badge/Magisk%20Manager-v7.5.1-green)](https://github.com/topjohnwu/Magisk/releases/download/manager-v7.5.1/MagiskManager-v7.5.1.apk)
+[![](https://img.shields.io/badge/Magisk%20Manager-Canary-red)](https://raw.githubusercontent.com/topjohnwu/magisk_files/canary/app-debug.apk)
+<br>
+[![](https://img.shields.io/badge/Magisk-v20.4-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v20.4)
+[![](https://img.shields.io/badge/Magisk%20Beta-v20.4-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v20.4)
+
+## Useful Links
+
+- [Installation Instruction](https://topjohnwu.github.io/Magisk/install.html)
+- [Frequently Asked Questions](https://topjohnwu.github.io/Magisk/faq.html)
+- [Full Official Docs](https://topjohnwu.github.io/Magisk/)
+- [Magisk Troubleshoot Wiki](https://www.didgeridoohan.com/magisk/HomePage) (by [@Didgeridoohan](https://github.com/Didgeridoohan))
+
+## Android Version Support
+
+- Android 4.2+: MagiskSU and Magisk Modules Only
+- Android 4.4+: All core features available
+- Android 6.0+: Guaranteed MagiskHide support
+- Android 7.0+: Full MagiskHide protection
+- Android 9.0+: Magisk Manager stealth mode
 
 ## Bug Reports
 
-**Only reports using debug canary builds will be accepted.** \
-Access canary builds by upgrading to either canary Magisk Manager:
-- [Canary Manager (Release)](https://raw.githubusercontent.com/topjohnwu/magisk_files/canary/app-release.apk)
-- [Canary Manager (Debug)](https://raw.githubusercontent.com/topjohnwu/magisk_files/canary/app-debug.apk)
+Canary Channels are cutting edge builds for those adventurous. To access canary builds, install the Canary Magisk Manager, switch to the Canary Channel in settings and upgrade.
 
-For installation issues, upload both boot image and install logs. \
-For Magisk issues, upload boot logcat or dmesg. \
+**Only bug reports from Canary builds will be accepted.**
+
+For installation issues, upload both boot image and install logs.<br>
+For Magisk issues, upload boot logcat or dmesg.<br>
 For Magisk Manager crashes, record and upload the logcat when the crash occurs.
 
-## Building Environment Requirements
+## Building and Development
 
--  Python 3: run `build.py` script
--  Java Development Kit (JDK) 8: Compile Magisk Manager and sign zips
--  Latest Android SDK: set `ANDROID_HOME` environment variable to the path to Android SDK
--  Android NDK: Install NDK along with SDK (`$ANDROID_HOME/ndk-bundle`), or optionally specify a custom path `ANDROID_NDK_HOME`
--  (Windows Only) Python package Colorama: Install with `pip install colorama`, used for ANSI color codes
+- Magisk builds on any OS Android Studio supports. Install Android Studio and do the initial setups.
+- Clone sources: `git clone --recurse-submodules https://github.com/topjohnwu/Magisk.git`
+- Install Python 3.6+ \
+(Windows only: select **'Add Python to PATH'** in installer, and run `pip install colorama` after install)
+- Configure to use the JDK bundled in Android Studio:
+	- macOS: `export JAVA_HOME="/Applications/Android Studio.app/Contents/jre/jdk/Contents/Home"`
+	- Linux: `export PATH="/path/to/androidstudio/jre/bin:$PATH"`
+	- Windows: Add `C:\Path\To\Android Studio\jre\bin` to environment variable `PATH`
+- Set environment variable `ANDROID_HOME` to the Android SDK folder (can be found in Android Studio settings)
+- Run `./build.py ndk` to let the script download and install NDK for you
+- Set configurations in `config.prop`. A sample `config.prop.sample` is provided.
+- To start building, run `build.py` to see your options. \
+For each action, use `-h` to access help (e.g. `./build.py all -h`)
+- To start development, open the project in Android Studio. Both app (Kotlin/Java) and native (C++/C) source code can be properly developed using the IDE, but *always* use `build.py` for building.
+- `build.py` builds in debug mode by default. If you want release builds (with `-r, --release`), you need a Java Keystore to sign APKs and zips. For more information, check [Google's Documentation](https://developer.android.com/studio/publish/app-signing.html#generate-key).
 
-## Building Notes and Instructions
-
--  Clone sources with submodules: `git clone --recurse-submodules https://github.com/topjohnwu/Magisk.git`
--  Building is supported on macOS, Linux, and Windows. Official releases are built and tested with [FrankeNDK](https://github.com/topjohnwu/FrankeNDK); point `ANDROID_NDK_HOME` to FrankeNDK if you want to use it for compiling.
--  Set configurations in `config.prop`. A sample file `config.prop.sample` is provided as an example.
--  Run `build.py` with argument `-h` to see the built-in help message. The `-h` option also works for each supported actions, e.g. `./build.py binary -h`
--  By default, `build.py` build binaries and Magisk Manager in debug mode. If you want to build Magisk Manager in release mode (via the `-r, --release` flag), you need a Java Keystore file `release-key.jks` (only `JKS` format is supported) to sign APKs and zips. For more information, check out [Google's Official Documentation](https://developer.android.com/studio/publish/app-signing.html#signing-manually).
-
-## Translations
+## Translation Contributions
 
 Default string resources for Magisk Manager and its stub APK are located here:
 

app/build.gradle

@@ -1,135 +0,0 @@
-apply plugin: 'com.android.application'
-apply plugin: 'kotlin-android'
-apply plugin: 'kotlin-android-extensions'
-apply plugin: 'kotlin-kapt'
-
-kapt {
-    correctErrorTypes = true
-    useBuildCache = true
-    mapDiagnosticLocations = true
-    javacOptions {
-        option("-Xmaxerrs", 1000)
-    }
-}
-
-android {
-    defaultConfig {
-        applicationId 'com.topjohnwu.magisk'
-        vectorDrawables.useSupportLibrary = true
-        multiDexEnabled true
-        versionName props['appVersion']
-        versionCode props['appVersionCode'] as Integer
-
-        javaCompileOptions {
-            annotationProcessorOptions {
-                arguments = ["room.incremental":"true"]
-            }
-        }
-    }
-
-    buildTypes {
-        release {
-            minifyEnabled true
-            shrinkResources true
-            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'),
-                    'proguard-rules.pro'
-        }
-    }
-
-    dataBinding {
-        enabled = true
-    }
-
-    packagingOptions {
-        exclude '/META-INF/**'
-        exclude '/androidsupportmultidexversion.txt'
-        exclude '/org/bouncycastle/**'
-        exclude '/kotlin/**'
-        exclude '/kotlinx/**'
-        exclude '/okhttp3/**'
-    }
-
-    kotlinOptions {
-        jvmTarget = '1.8'
-    }
-}
-
-androidExtensions {
-    experimental = true
-}
-
-dependencies {
-    implementation fileTree(include: ['*.jar'], dir: 'libs')
-    implementation project(':shared')
-    implementation project(':signing')
-
-    implementation 'com.github.topjohnwu:jtar:1.0.0'
-    implementation 'com.jakewharton.timber:timber:4.7.1'
-    implementation 'com.ncapdevi:frag-nav:3.2.0'
-    implementation 'com.github.pwittchen:reactivenetwork-rx2:3.0.6'
-
-    implementation 'io.reactivex.rxjava2:rxjava:2.2.18'
-    implementation 'io.reactivex.rxjava2:rxkotlin:2.4.0'
-    implementation 'io.reactivex.rxjava2:rxandroid:2.1.1'
-
-    implementation "org.jetbrains.kotlin:kotlin-stdlib:${vKotlin}"
-    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:${vKotlin}"
-
-    def vBAdapt = '3.1.1'
-    def bindingAdapter = 'me.tatarka.bindingcollectionadapter2:bindingcollectionadapter'
-    implementation "${bindingAdapter}:${vBAdapt}"
-    implementation "${bindingAdapter}-recyclerview:${vBAdapt}"
-
-    def vMarkwon = '4.2.1'
-    implementation "io.noties.markwon:core:${vMarkwon}"
-    implementation "io.noties.markwon:html:${vMarkwon}"
-    implementation "io.noties.markwon:image:${vMarkwon}"
-    implementation 'com.caverock:androidsvg:1.4'
-
-    def vLibsu = '2.5.1'
-    implementation "com.github.topjohnwu.libsu:core:${vLibsu}"
-    implementation "com.github.topjohnwu.libsu:io:${vLibsu}"
-
-    def vKoin = '2.0.1'
-    implementation "org.koin:koin-core:${vKoin}"
-    implementation "org.koin:koin-android:${vKoin}"
-    implementation "org.koin:koin-androidx-viewmodel:${vKoin}"
-
-    def vRetrofit = '2.7.1'
-    implementation "com.squareup.retrofit2:retrofit:${vRetrofit}"
-    implementation "com.squareup.retrofit2:converter-moshi:${vRetrofit}"
-    implementation "com.squareup.retrofit2:converter-scalars:${vRetrofit}"
-    implementation "com.squareup.retrofit2:adapter-rxjava2:${vRetrofit}"
-
-    def vOkHttp = '3.12.10'
-    implementation("com.squareup.okhttp3:okhttp:${vOkHttp}") {
-        force = true
-    }
-    implementation "com.squareup.okhttp3:logging-interceptor:${vOkHttp}"
-
-    def vMoshi = '1.10.0-SNAPSHOT'
-    implementation "com.squareup.moshi:moshi:${vMoshi}"
-    kapt "com.squareup.moshi:moshi-kotlin-codegen:${vMoshi}"
-
-    def vRoom = '2.2.4'
-    implementation "androidx.room:room-runtime:${vRoom}"
-    implementation "androidx.room:room-rxjava2:${vRoom}"
-    kapt "androidx.room:room-compiler:${vRoom}"
-
-    def vNav = '2.2.1'
-    implementation "androidx.navigation:navigation-fragment-ktx:${vNav}"
-    implementation "androidx.navigation:navigation-ui-ktx:${vNav}"
-
-    implementation 'androidx.biometric:biometric:1.0.1'
-    implementation 'androidx.constraintlayout:constraintlayout:2.0.0-beta4'
-    implementation 'androidx.swiperefreshlayout:swiperefreshlayout:1.1.0-beta01'
-    implementation 'androidx.browser:browser:1.2.0'
-    implementation 'androidx.preference:preference:1.1.0'
-    implementation 'androidx.recyclerview:recyclerview:1.1.0'
-    implementation 'androidx.fragment:fragment-ktx:1.2.2'
-    implementation 'androidx.work:work-runtime:2.3.3'
-    implementation 'androidx.transition:transition:1.3.1'
-    implementation 'androidx.multidex:multidex:2.0.1'
-    implementation 'androidx.core:core-ktx:1.2.0'
-    implementation 'com.google.android.material:material:1.2.0-alpha03'
-}

app/build.gradle.kts

@@ -0,0 +1,147 @@
+plugins {
+    id("com.android.application")
+    kotlin("android")
+    kotlin("android.extensions")
+    kotlin("kapt")
+    id("androidx.navigation.safeargs.kotlin")
+}
+
+kapt {
+    correctErrorTypes = true
+    useBuildCache = true
+    mapDiagnosticLocations = true
+    javacOptions {
+        option("-Xmaxerrs", 1000)
+    }
+}
+
+android {
+    defaultConfig {
+        applicationId = "com.topjohnwu.magisk"
+        vectorDrawables.useSupportLibrary = true
+        multiDexEnabled = true
+        versionName = Config["appVersion"]
+        versionCode = Config["appVersionCode"]?.toInt()
+        buildConfigField("int", "LATEST_MAGISK", Config["versionCode"] ?: "Integer.MAX_VALUE")
+
+        javaCompileOptions.annotationProcessorOptions.arguments(
+                mapOf("room.incremental" to "true")
+        )
+    }
+
+    buildTypes {
+        getByName("release") {
+            isMinifyEnabled = true
+            isShrinkResources = true
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro"
+            )
+        }
+    }
+
+    buildFeatures {
+        dataBinding = true
+    }
+
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
+
+    packagingOptions {
+        exclude("/META-INF/**")
+        exclude("/androidsupportmultidexversion.txt")
+        exclude("/org/bouncycastle/**")
+        exclude("/kotlin/**")
+        exclude("/kotlinx/**")
+        exclude("/okhttp3/**")
+    }
+
+    kotlinOptions {
+        jvmTarget = "1.8"
+    }
+}
+
+androidExtensions {
+    isExperimental = true
+}
+
+val copyUtils = tasks.register("copyUtils", Copy::class) {
+    from(rootProject.file("scripts/util_functions.sh"))
+    into("src/main/res/raw")
+}
+
+tasks["preBuild"]?.dependsOn(copyUtils)
+
+dependencies {
+    implementation(fileTree(mapOf("dir" to "libs", "include" to listOf("*.jar"))))
+    implementation(kotlin("stdlib"))
+    implementation(project(":app:shared"))
+    implementation(project(":app:signing"))
+
+    implementation("com.github.topjohnwu:jtar:1.0.0")
+    implementation("com.github.topjohnwu:indeterminate-checkbox:1.0.7")
+    implementation("com.jakewharton.timber:timber:4.7.1")
+
+    val vBAdapt = "4.0.0"
+    val bindingAdapter = "me.tatarka.bindingcollectionadapter2:bindingcollectionadapter"
+    implementation("${bindingAdapter}:${vBAdapt}")
+    implementation("${bindingAdapter}-recyclerview:${vBAdapt}")
+
+    val vMarkwon = "4.6.0"
+    implementation("io.noties.markwon:core:${vMarkwon}")
+    implementation("io.noties.markwon:html:${vMarkwon}")
+    implementation("io.noties.markwon:image:${vMarkwon}")
+    implementation("com.caverock:androidsvg:1.4")
+
+    val vLibsu = "3.0.2"
+    implementation("com.github.topjohnwu.libsu:core:${vLibsu}")
+    implementation("com.github.topjohnwu.libsu:io:${vLibsu}")
+
+    val vKoin = "2.1.6"
+    implementation("org.koin:koin-core:${vKoin}")
+    implementation("org.koin:koin-android:${vKoin}")
+    implementation("org.koin:koin-androidx-viewmodel:${vKoin}")
+
+    val vRetrofit = "2.9.0"
+    implementation("com.squareup.retrofit2:retrofit:${vRetrofit}")
+    implementation("com.squareup.retrofit2:converter-moshi:${vRetrofit}")
+    implementation("com.squareup.retrofit2:converter-scalars:${vRetrofit}")
+
+    val vOkHttp = "3.12.12"
+    implementation("com.squareup.okhttp3:okhttp") {
+        version {
+            strictly(vOkHttp)
+        }
+    }
+    implementation("com.squareup.okhttp3:logging-interceptor:${vOkHttp}")
+    implementation("com.squareup.okhttp3:okhttp-dnsoverhttps:${vOkHttp}")
+
+    val vMoshi = "1.10.0"
+    implementation("com.squareup.moshi:moshi:${vMoshi}")
+    kapt("com.squareup.moshi:moshi-kotlin-codegen:${vMoshi}")
+
+    val vRoom = "2.2.5"
+    implementation("androidx.room:room-runtime:${vRoom}")
+    implementation("androidx.room:room-ktx:${vRoom}")
+    kapt("androidx.room:room-compiler:${vRoom}")
+
+    val vNav: String by rootProject.extra
+    implementation("androidx.navigation:navigation-fragment-ktx:${vNav}")
+    implementation("androidx.navigation:navigation-ui-ktx:${vNav}")
+
+    implementation("androidx.biometric:biometric:1.0.1")
+    implementation("androidx.constraintlayout:constraintlayout:2.0.1")
+    implementation("androidx.swiperefreshlayout:swiperefreshlayout:1.1.0")
+    implementation("androidx.browser:browser:1.2.0")
+    implementation("androidx.preference:preference:1.1.1")
+    implementation("androidx.recyclerview:recyclerview:1.1.0")
+    implementation("androidx.fragment:fragment-ktx:1.2.5")
+    implementation("androidx.work:work-runtime-ktx:2.4.0")
+    implementation("androidx.transition:transition:1.3.1")
+    implementation("androidx.multidex:multidex:2.0.1")
+    implementation("androidx.core:core-ktx:1.3.1")
+    implementation("androidx.localbroadcastmanager:localbroadcastmanager:1.0.0")
+    implementation("com.google.android.material:material:1.2.1")
+}

app/proguard-rules.pro

@@ -29,14 +29,17 @@
 -keep class a.* { *; }
 
 # Snet
--keepclassmembers class com.topjohnwu.magisk.core.utils.SafetyNetHelper { *; }
--keep,allowobfuscation interface com.topjohnwu.magisk.core.utils.SafetyNetHelper$Callback
--keepclassmembers class * implements com.topjohnwu.magisk.core.utils.SafetyNetHelper$Callback {
-  void onResponse(int);
+-keepclassmembers class com.topjohnwu.magisk.ui.safetynet.SafetyNetHelper { *; }
+-keep,allowobfuscation interface com.topjohnwu.magisk.ui.safetynet.SafetyNetHelper$Callback
+-keepclassmembers class * implements com.topjohnwu.magisk.ui.safetynet.SafetyNetHelper$Callback {
+  void onResponse(org.json.JSONObject);
 }
 
 # Fragments
+# TODO: Remove when AGP 4.1 release
+# https://issuetracker.google.com/issues/142601969
 -keep,allowobfuscation class * extends androidx.fragment.app.Fragment
+-keepnames class androidx.navigation.fragment.NavHostFragment
 
 # Strip Timber verbose and debug logging
 -assumenosideeffects class timber.log.Timber.Tree {

app/res-ids.txt

@@ -1,5 +0,0 @@
-com.topjohnwu.magisk:color/xxxxxxxx = 0x7f010000
-com.topjohnwu.magisk:drawable/xxxxxxxx = 0x7f020000
-com.topjohnwu.magisk:string/xxxxxxxx = 0x7f030000
-com.topjohnwu.magisk:style/xxxxxxxx = 0x7f040000
-com.topjohnwu.magisk:xml/xxxxxxxx = 0x7f050000

app/shared/build.gradle.kts

@@ -0,0 +1,14 @@
+plugins {
+    id("com.android.library")
+}
+
+android {
+    defaultConfig {
+        vectorDrawables.useSupportLibrary = true
+        consumerProguardFiles("proguard-rules.pro")
+    }
+}
+
+dependencies {
+    implementation(fileTree(mapOf("dir" to "libs", "include" to listOf("*.jar"))))
+}

app/shared/src/main/AndroidManifest.xml

@@ -4,21 +4,15 @@
 
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
 
     <application
-        android:icon="@drawable/ic_launcher"
         android:label="Magisk Manager"
         android:installLocation="internalOnly"
         android:usesCleartextTraffic="true"
         android:supportsRtl="true"
+        android:theme="@android:style/Theme.Translucent.NoTitleBar"
         tools:ignore="UnusedAttribute">
 
-        <activity
-            android:name="a.r"
-            android:theme="@android:style/Theme.Translucent.NoTitleBar"
-            android:process=":remote" />
-
         <provider
             android:name="a.p"
             android:authorities="${applicationId}.provider"

app/shared/src/main/java/com/topjohnwu/magisk/FileProvider.java

@@ -4,7 +4,6 @@ import android.content.ContentProvider;
 import android.content.ContentValues;
 import android.content.Context;
 import android.content.pm.ProviderInfo;
-import android.content.res.XmlResourceParser;
 import android.database.Cursor;
 import android.database.MatrixCursor;
 import android.net.Uri;
@@ -16,19 +15,12 @@ import android.provider.OpenableColumns;
 import android.text.TextUtils;
 import android.webkit.MimeTypeMap;
 
-import com.topjohnwu.shared.R;
-
-import org.xmlpull.v1.XmlPullParserException;
-
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
 
-import static org.xmlpull.v1.XmlPullParser.END_DOCUMENT;
-import static org.xmlpull.v1.XmlPullParser.START_TAG;
-
 /**
  * Modified from androidx.core.content.FileProvider
  */
@@ -36,17 +28,6 @@ public class FileProvider extends ContentProvider {
     private static final String[] COLUMNS = {
             OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE };
 
-    private static final String TAG_ROOT_PATH = "root-path";
-    private static final String TAG_FILES_PATH = "files-path";
-    private static final String TAG_CACHE_PATH = "cache-path";
-    private static final String TAG_EXTERNAL = "external-path";
-    private static final String TAG_EXTERNAL_FILES = "external-files-path";
-    private static final String TAG_EXTERNAL_CACHE = "external-cache-path";
-    private static final String TAG_EXTERNAL_MEDIA = "external-media-path";
-
-    private static final String ATTR_NAME = "name";
-    private static final String ATTR_PATH = "path";
-
     private static final File DEVICE_ROOT = new File("/");
 
     private static HashMap<String, PathStrategy> sCache = new HashMap<>();
@@ -171,63 +152,36 @@ public class FileProvider extends ContentProvider {
         synchronized (sCache) {
             strat = sCache.get(authority);
             if (strat == null) {
-                try {
-                    strat = parsePathStrategy(context, authority);
-                } catch (IOException e) {
-                    throw new IllegalArgumentException("Failed to parse xml", e);
-                } catch (XmlPullParserException e) {
-                    throw new IllegalArgumentException("Failed to parse xml", e);
-                }
+                strat = createPathStrategy(context, authority);
                 sCache.put(authority, strat);
             }
         }
         return strat;
     }
 
-    private static PathStrategy parsePathStrategy(Context context, String authority)
-            throws IOException, XmlPullParserException {
+    private static PathStrategy createPathStrategy(Context context, String authority) {
         final SimplePathStrategy strat = new SimplePathStrategy(authority);
 
-        final XmlResourceParser in = context.getResources().getXml(R.xml.file_paths);
-
-        int type;
-        while ((type = in.next()) != END_DOCUMENT) {
-            if (type == START_TAG) {
-                final String tag = in.getName();
-
-                final String name = in.getAttributeValue(null, ATTR_NAME);
-                String path = in.getAttributeValue(null, ATTR_PATH);
-
-                File target = null;
-                if (TAG_ROOT_PATH.equals(tag)) {
-                    target = DEVICE_ROOT;
-                } else if (TAG_FILES_PATH.equals(tag)) {
-                    target = context.getFilesDir();
-                } else if (TAG_CACHE_PATH.equals(tag)) {
-                    target = context.getCacheDir();
-                } else if (TAG_EXTERNAL.equals(tag)) {
-                    target = Environment.getExternalStorageDirectory();
-                } else if (TAG_EXTERNAL_FILES.equals(tag)) {
-                    File[] externalFilesDirs = getExternalFilesDirs(context, null);
-                    if (externalFilesDirs.length > 0) {
-                        target = externalFilesDirs[0];
-                    }
-                } else if (TAG_EXTERNAL_CACHE.equals(tag)) {
-                    File[] externalCacheDirs = getExternalCacheDirs(context);
-                    if (externalCacheDirs.length > 0) {
-                        target = externalCacheDirs[0];
-                    }
-                } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP
-                        && TAG_EXTERNAL_MEDIA.equals(tag)) {
-                    File[] externalMediaDirs = context.getExternalMediaDirs();
-                    if (externalMediaDirs.length > 0) {
-                        target = externalMediaDirs[0];
-                    }
-                }
-
-                if (target != null) {
-                    strat.addRoot(name, buildPath(target, path));
-                }
+        strat.addRoot("root_files", buildPath(DEVICE_ROOT, "."));
+        strat.addRoot("internal_files", buildPath(context.getFilesDir(), "."));
+        strat.addRoot("cache_files", buildPath(context.getCacheDir(), "."));
+        strat.addRoot("external_files", buildPath(Environment.getExternalStorageDirectory(), "."));
+        {
+            File[] externalFilesDirs = getExternalFilesDirs(context, null);
+            if (externalFilesDirs.length > 0) {
+                strat.addRoot("external_file_files", buildPath(externalFilesDirs[0], "."));
+            }
+        }
+        {
+            File[] externalCacheDirs = getExternalCacheDirs(context);
+            if (externalCacheDirs.length > 0) {
+                strat.addRoot("external_cache_files", buildPath(externalCacheDirs[0], "."));
+            }
+        }
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+            File[] externalMediaDirs = context.getExternalMediaDirs();
+            if (externalMediaDirs.length > 0) {
+                strat.addRoot("external_media_files", buildPath(externalMediaDirs[0], "."));
             }
         }
 

app/shared/src/main/java/com/topjohnwu/magisk/net/Networking.java

@@ -47,10 +47,9 @@ public class Networking {
         } catch (Exception e) {
             if (Build.VERSION.SDK_INT < 21) {
                 // Failed to update SSL provider, use NoSSLv3SocketFactory on SDK < 21
-                // and return false to notify potential issues
                 HttpsURLConnection.setDefaultSSLSocketFactory(new NoSSLv3SocketFactory());
-                return false;
             }
+            return false;
         }
         return true;
     }

app/signing/build.gradle.kts

@@ -0,0 +1,35 @@
+import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
+
+plugins {
+    id("java-library")
+    id("java")
+    id("com.github.johnrengelman.shadow") version "6.0.0"
+}
+
+java {
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+}
+
+val jar by tasks.getting(Jar::class) {
+    manifest {
+        attributes["Main-Class"] = "com.topjohnwu.signing.ZipSigner"
+    }
+}
+
+val shadowJar by tasks.getting(ShadowJar::class) {
+    archiveBaseName.set("zipsigner")
+    archiveClassifier.set(null as String?)
+    archiveVersion.set("4.0")
+}
+
+repositories {
+    jcenter()
+}
+
+dependencies {
+    implementation(fileTree(mapOf("dir" to "libs", "include" to listOf("*.jar"))))
+
+    api("org.bouncycastle:bcprov-jdk15on:1.66")
+    api("org.bouncycastle:bcpkix-jdk15on:1.66")
+}

app/signing/src/main/java/com/topjohnwu/signing/ApkSignerV2.java

@@ -0,0 +1,772 @@
+package com.topjohnwu.signing;
+
+import java.nio.BufferUnderflowException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.security.DigestException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyFactory;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.security.spec.AlgorithmParameterSpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.MGF1ParameterSpec;
+import java.security.spec.PSSParameterSpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * APK Signature Scheme v2 signer.
+ *
+ * <p>APK Signature Scheme v2 is a whole-file signature scheme which aims to protect every single
+ * bit of the APK, as opposed to the JAR Signature Scheme which protects only the names and
+ * uncompressed contents of ZIP entries.
+ */
+public abstract class ApkSignerV2 {
+    /*
+     * The two main goals of APK Signature Scheme v2 are:
+     * 1. Detect any unauthorized modifications to the APK. This is achieved by making the signature
+     *    cover every byte of the APK being signed.
+     * 2. Enable much faster signature and integrity verification. This is achieved by requiring
+     *    only a minimal amount of APK parsing before the signature is verified, thus completely
+     *    bypassing ZIP entry decompression and by making integrity verification parallelizable by
+     *    employing a hash tree.
+     *
+     * The generated signature block is wrapped into an APK Signing Block and inserted into the
+     * original APK immediately before the start of ZIP Central Directory. This is to ensure that
+     * JAR and ZIP parsers continue to work on the signed APK. The APK Signing Block is designed for
+     * extensibility. For example, a future signature scheme could insert its signatures there as
+     * well. The contract of the APK Signing Block is that all contents outside of the block must be
+     * protected by signatures inside the block.
+     */
+
+    public static final int SIGNATURE_RSA_PSS_WITH_SHA256 = 0x0101;
+    public static final int SIGNATURE_RSA_PSS_WITH_SHA512 = 0x0102;
+    public static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256 = 0x0103;
+    public static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512 = 0x0104;
+    public static final int SIGNATURE_ECDSA_WITH_SHA256 = 0x0201;
+    public static final int SIGNATURE_ECDSA_WITH_SHA512 = 0x0202;
+    public static final int SIGNATURE_DSA_WITH_SHA256 = 0x0301;
+    public static final int SIGNATURE_DSA_WITH_SHA512 = 0x0302;
+
+    /**
+     * {@code .SF} file header section attribute indicating that the APK is signed not just with
+     * JAR signature scheme but also with APK Signature Scheme v2 or newer. This attribute
+     * facilitates v2 signature stripping detection.
+     *
+     * <p>The attribute contains a comma-separated set of signature scheme IDs.
+     */
+    public static final String SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME = "X-Android-APK-Signed";
+    public static final String SF_ATTRIBUTE_ANDROID_APK_SIGNED_VALUE = "2";
+
+    private static final int CONTENT_DIGEST_CHUNKED_SHA256 = 0;
+    private static final int CONTENT_DIGEST_CHUNKED_SHA512 = 1;
+
+    private static final int CONTENT_DIGESTED_CHUNK_MAX_SIZE_BYTES = 1024 * 1024;
+
+    private static final byte[] APK_SIGNING_BLOCK_MAGIC =
+          new byte[] {
+              0x41, 0x50, 0x4b, 0x20, 0x53, 0x69, 0x67, 0x20,
+              0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x20, 0x34, 0x32,
+          };
+    private static final int APK_SIGNATURE_SCHEME_V2_BLOCK_ID = 0x7109871a;
+
+    private ApkSignerV2() {}
+
+    /**
+     * Signer configuration.
+     */
+    public static final class SignerConfig {
+        /** Private key. */
+        public PrivateKey privateKey;
+
+        /**
+         * Certificates, with the first certificate containing the public key corresponding to
+         * {@link #privateKey}.
+         */
+        public List<X509Certificate> certificates;
+
+        /**
+         * List of signature algorithms with which to sign (see {@code SIGNATURE_...} constants).
+         */
+        public List<Integer> signatureAlgorithms;
+    }
+
+    /**
+     * Signs the provided APK using APK Signature Scheme v2 and returns the signed APK as a list of
+     * consecutive chunks.
+     *
+     * <p>NOTE: To enable APK signature verifier to detect v2 signature stripping, header sections
+     * of META-INF/*.SF files of APK being signed must contain the
+     * {@code X-Android-APK-Signed: true} attribute.
+     *
+     * @param inputApk contents of the APK to be signed. The APK starts at the current position
+     *        of the buffer and ends at the limit of the buffer.
+     * @param signerConfigs signer configurations, one for each signer.
+     *
+     * @throws ApkParseException if the APK cannot be parsed.
+     * @throws InvalidKeyException if a signing key is not suitable for this signature scheme or
+     *         cannot be used in general.
+     * @throws SignatureException if an error occurs when computing digests of generating
+     *         signatures.
+     */
+    public static ByteBuffer[] sign(
+            ByteBuffer inputApk,
+            List<SignerConfig> signerConfigs)
+                    throws ApkParseException, InvalidKeyException, SignatureException {
+        // Slice/create a view in the inputApk to make sure that:
+        // 1. inputApk is what's between position and limit of the original inputApk, and
+        // 2. changes to position, limit, and byte order are not reflected in the original.
+        ByteBuffer originalInputApk = inputApk;
+        inputApk = originalInputApk.slice();
+        inputApk.order(ByteOrder.LITTLE_ENDIAN);
+
+        // Locate ZIP End of Central Directory (EoCD), Central Directory, and check that Central
+        // Directory is immediately followed by the ZIP End of Central Directory.
+        int eocdOffset = ZipUtils.findZipEndOfCentralDirectoryRecord(inputApk);
+        if (eocdOffset == -1) {
+            throw new ApkParseException("Failed to locate ZIP End of Central Directory");
+        }
+        if (ZipUtils.isZip64EndOfCentralDirectoryLocatorPresent(inputApk, eocdOffset)) {
+            throw new ApkParseException("ZIP64 format not supported");
+        }
+        inputApk.position(eocdOffset);
+        long centralDirSizeLong = ZipUtils.getZipEocdCentralDirectorySizeBytes(inputApk);
+        if (centralDirSizeLong > Integer.MAX_VALUE) {
+            throw new ApkParseException(
+                    "ZIP Central Directory size out of range: " + centralDirSizeLong);
+        }
+        int centralDirSize = (int) centralDirSizeLong;
+        long centralDirOffsetLong = ZipUtils.getZipEocdCentralDirectoryOffset(inputApk);
+        if (centralDirOffsetLong > Integer.MAX_VALUE) {
+            throw new ApkParseException(
+                    "ZIP Central Directory offset in file out of range: " + centralDirOffsetLong);
+        }
+        int centralDirOffset = (int) centralDirOffsetLong;
+        int expectedEocdOffset = centralDirOffset + centralDirSize;
+        if (expectedEocdOffset < centralDirOffset) {
+            throw new ApkParseException(
+                    "ZIP Central Directory extent too large. Offset: " + centralDirOffset
+                            + ", size: " + centralDirSize);
+        }
+        if (eocdOffset != expectedEocdOffset) {
+            throw new ApkParseException(
+                    "ZIP Central Directory not immeiately followed by ZIP End of"
+                            + " Central Directory. CD end: " + expectedEocdOffset
+                            + ", EoCD start: " + eocdOffset);
+        }
+
+        // Create ByteBuffers holding the contents of everything before ZIP Central Directory,
+        // ZIP Central Directory, and ZIP End of Central Directory.
+        inputApk.clear();
+        ByteBuffer beforeCentralDir = getByteBuffer(inputApk, centralDirOffset);
+        ByteBuffer centralDir = getByteBuffer(inputApk, eocdOffset - centralDirOffset);
+        // Create a copy of End of Central Directory because we'll need modify its contents later.
+        byte[] eocdBytes = new byte[inputApk.remaining()];
+        inputApk.get(eocdBytes);
+        ByteBuffer eocd = ByteBuffer.wrap(eocdBytes);
+        eocd.order(inputApk.order());
+
+        // Figure which which digests to use for APK contents.
+        Set<Integer> contentDigestAlgorithms = new HashSet<>();
+        for (SignerConfig signerConfig : signerConfigs) {
+            for (int signatureAlgorithm : signerConfig.signatureAlgorithms) {
+                contentDigestAlgorithms.add(
+                        getSignatureAlgorithmContentDigestAlgorithm(signatureAlgorithm));
+            }
+        }
+
+        // Compute digests of APK contents.
+        Map<Integer, byte[]> contentDigests; // digest algorithm ID -> digest
+        try {
+            contentDigests =
+                    computeContentDigests(
+                            contentDigestAlgorithms,
+                            new ByteBuffer[] {beforeCentralDir, centralDir, eocd});
+        } catch (DigestException e) {
+            throw new SignatureException("Failed to compute digests of APK", e);
+        }
+
+        // Sign the digests and wrap the signatures and signer info into an APK Signing Block.
+        ByteBuffer apkSigningBlock =
+                ByteBuffer.wrap(generateApkSigningBlock(signerConfigs, contentDigests));
+
+        // Update Central Directory Offset in End of Central Directory Record. Central Directory
+        // follows the APK Signing Block and thus is shifted by the size of the APK Signing Block.
+        centralDirOffset += apkSigningBlock.remaining();
+        eocd.clear();
+        ZipUtils.setZipEocdCentralDirectoryOffset(eocd, centralDirOffset);
+
+        // Follow the Java NIO pattern for ByteBuffer whose contents have been consumed.
+        originalInputApk.position(originalInputApk.limit());
+
+        // Reset positions (to 0) and limits (to capacity) in the ByteBuffers below to follow the
+        // Java NIO pattern for ByteBuffers which are ready for their contents to be read by caller.
+        // Contrary to the name, this does not clear the contents of these ByteBuffer.
+        beforeCentralDir.clear();
+        centralDir.clear();
+        eocd.clear();
+
+        // Insert APK Signing Block immediately before the ZIP Central Directory.
+        return new ByteBuffer[] {
+            beforeCentralDir,
+            apkSigningBlock,
+            centralDir,
+            eocd,
+        };
+    }
+
+    private static Map<Integer, byte[]> computeContentDigests(
+            Set<Integer> digestAlgorithms,
+            ByteBuffer[] contents) throws DigestException {
+        // For each digest algorithm the result is computed as follows:
+        // 1. Each segment of contents is split into consecutive chunks of 1 MB in size.
+        //    The final chunk will be shorter iff the length of segment is not a multiple of 1 MB.
+        //    No chunks are produced for empty (zero length) segments.
+        // 2. The digest of each chunk is computed over the concatenation of byte 0xa5, the chunk's
+        //    length in bytes (uint32 little-endian) and the chunk's contents.
+        // 3. The output digest is computed over the concatenation of the byte 0x5a, the number of
+        //    chunks (uint32 little-endian) and the concatenation of digests of chunks of all
+        //    segments in-order.
+
+        int chunkCount = 0;
+        for (ByteBuffer input : contents) {
+            chunkCount += getChunkCount(input.remaining(), CONTENT_DIGESTED_CHUNK_MAX_SIZE_BYTES);
+        }
+
+        final Map<Integer, byte[]> digestsOfChunks = new HashMap<>(digestAlgorithms.size());
+        for (int digestAlgorithm : digestAlgorithms) {
+            int digestOutputSizeBytes = getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
+            byte[] concatenationOfChunkCountAndChunkDigests =
+                    new byte[5 + chunkCount * digestOutputSizeBytes];
+            concatenationOfChunkCountAndChunkDigests[0] = 0x5a;
+            setUnsignedInt32LittleEngian(
+                    chunkCount, concatenationOfChunkCountAndChunkDigests, 1);
+            digestsOfChunks.put(digestAlgorithm, concatenationOfChunkCountAndChunkDigests);
+        }
+
+        int chunkIndex = 0;
+        byte[] chunkContentPrefix = new byte[5];
+        chunkContentPrefix[0] = (byte) 0xa5;
+        // Optimization opportunity: digests of chunks can be computed in parallel.
+        for (ByteBuffer input : contents) {
+            while (input.hasRemaining()) {
+                int chunkSize =
+                        Math.min(input.remaining(), CONTENT_DIGESTED_CHUNK_MAX_SIZE_BYTES);
+                final ByteBuffer chunk = getByteBuffer(input, chunkSize);
+                for (int digestAlgorithm : digestAlgorithms) {
+                    String jcaAlgorithmName =
+                            getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm);
+                    MessageDigest md;
+                    try {
+                        md = MessageDigest.getInstance(jcaAlgorithmName);
+                    } catch (NoSuchAlgorithmException e) {
+                        throw new DigestException(
+                                jcaAlgorithmName + " MessageDigest not supported", e);
+                    }
+                    // Reset position to 0 and limit to capacity. Position would've been modified
+                    // by the preceding iteration of this loop. NOTE: Contrary to the method name,
+                    // this does not modify the contents of the chunk.
+                    chunk.clear();
+                    setUnsignedInt32LittleEngian(chunk.remaining(), chunkContentPrefix, 1);
+                    md.update(chunkContentPrefix);
+                    md.update(chunk);
+                    byte[] concatenationOfChunkCountAndChunkDigests =
+                            digestsOfChunks.get(digestAlgorithm);
+                    int expectedDigestSizeBytes =
+                            getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
+                    int actualDigestSizeBytes =
+                            md.digest(
+                                    concatenationOfChunkCountAndChunkDigests,
+                                    5 + chunkIndex * expectedDigestSizeBytes,
+                                    expectedDigestSizeBytes);
+                    if (actualDigestSizeBytes != expectedDigestSizeBytes) {
+                        throw new DigestException(
+                                "Unexpected output size of " + md.getAlgorithm()
+                                        + " digest: " + actualDigestSizeBytes);
+                    }
+                }
+                chunkIndex++;
+            }
+        }
+
+        Map<Integer, byte[]> result = new HashMap<>(digestAlgorithms.size());
+        for (Map.Entry<Integer, byte[]> entry : digestsOfChunks.entrySet()) {
+            int digestAlgorithm = entry.getKey();
+            byte[] concatenationOfChunkCountAndChunkDigests = entry.getValue();
+            String jcaAlgorithmName = getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm);
+            MessageDigest md;
+            try {
+                md = MessageDigest.getInstance(jcaAlgorithmName);
+            } catch (NoSuchAlgorithmException e) {
+                throw new DigestException(jcaAlgorithmName + " MessageDigest not supported", e);
+            }
+            result.put(digestAlgorithm, md.digest(concatenationOfChunkCountAndChunkDigests));
+        }
+        return result;
+    }
+
+    private static int getChunkCount(int inputSize, int chunkSize) {
+        return (inputSize + chunkSize - 1) / chunkSize;
+    }
+
+    private static void setUnsignedInt32LittleEngian(int value, byte[] result, int offset) {
+        result[offset] = (byte) (value & 0xff);
+        result[offset + 1] = (byte) ((value >> 8) & 0xff);
+        result[offset + 2] = (byte) ((value >> 16) & 0xff);
+        result[offset + 3] = (byte) ((value >> 24) & 0xff);
+    }
+
+    private static byte[] generateApkSigningBlock(
+            List<SignerConfig> signerConfigs,
+            Map<Integer, byte[]> contentDigests) throws InvalidKeyException, SignatureException {
+        byte[] apkSignatureSchemeV2Block =
+                generateApkSignatureSchemeV2Block(signerConfigs, contentDigests);
+        return generateApkSigningBlock(apkSignatureSchemeV2Block);
+    }
+
+    private static byte[] generateApkSigningBlock(byte[] apkSignatureSchemeV2Block) {
+        // FORMAT:
+        // uint64:  size (excluding this field)
+        // repeated ID-value pairs:
+        //     uint64:           size (excluding this field)
+        //     uint32:           ID
+        //     (size - 4) bytes: value
+        // uint64:  size (same as the one above)
+        // uint128: magic
+
+        int resultSize =
+                8 // size
+                + 8 + 4 + apkSignatureSchemeV2Block.length // v2Block as ID-value pair
+                + 8 // size
+                + 16 // magic
+                ;
+        ByteBuffer result = ByteBuffer.allocate(resultSize);
+        result.order(ByteOrder.LITTLE_ENDIAN);
+        long blockSizeFieldValue = resultSize - 8;
+        result.putLong(blockSizeFieldValue);
+
+        long pairSizeFieldValue = 4 + apkSignatureSchemeV2Block.length;
+        result.putLong(pairSizeFieldValue);
+        result.putInt(APK_SIGNATURE_SCHEME_V2_BLOCK_ID);
+        result.put(apkSignatureSchemeV2Block);
+
+        result.putLong(blockSizeFieldValue);
+        result.put(APK_SIGNING_BLOCK_MAGIC);
+
+        return result.array();
+    }
+
+    private static byte[] generateApkSignatureSchemeV2Block(
+            List<SignerConfig> signerConfigs,
+            Map<Integer, byte[]> contentDigests) throws InvalidKeyException, SignatureException {
+        // FORMAT:
+        // * length-prefixed sequence of length-prefixed signer blocks.
+
+        List<byte[]> signerBlocks = new ArrayList<>(signerConfigs.size());
+        int signerNumber = 0;
+        for (SignerConfig signerConfig : signerConfigs) {
+            signerNumber++;
+            byte[] signerBlock;
+            try {
+                signerBlock = generateSignerBlock(signerConfig, contentDigests);
+            } catch (InvalidKeyException e) {
+                throw new InvalidKeyException("Signer #" + signerNumber + " failed", e);
+            } catch (SignatureException e) {
+                throw new SignatureException("Signer #" + signerNumber + " failed", e);
+            }
+            signerBlocks.add(signerBlock);
+        }
+
+        return encodeAsSequenceOfLengthPrefixedElements(
+                new byte[][] {
+                    encodeAsSequenceOfLengthPrefixedElements(signerBlocks),
+                });
+    }
+
+    private static byte[] generateSignerBlock(
+            SignerConfig signerConfig,
+            Map<Integer, byte[]> contentDigests) throws InvalidKeyException, SignatureException {
+        if (signerConfig.certificates.isEmpty()) {
+            throw new SignatureException("No certificates configured for signer");
+        }
+        PublicKey publicKey = signerConfig.certificates.get(0).getPublicKey();
+
+        byte[] encodedPublicKey = encodePublicKey(publicKey);
+
+        V2SignatureSchemeBlock.SignedData signedData = new V2SignatureSchemeBlock.SignedData();
+        try {
+            signedData.certificates = encodeCertificates(signerConfig.certificates);
+        } catch (CertificateEncodingException e) {
+            throw new SignatureException("Failed to encode certificates", e);
+        }
+
+        List<Pair<Integer, byte[]>> digests =
+                new ArrayList<>(signerConfig.signatureAlgorithms.size());
+        for (int signatureAlgorithm : signerConfig.signatureAlgorithms) {
+            int contentDigestAlgorithm =
+                    getSignatureAlgorithmContentDigestAlgorithm(signatureAlgorithm);
+            byte[] contentDigest = contentDigests.get(contentDigestAlgorithm);
+            if (contentDigest == null) {
+                throw new RuntimeException(
+                        getContentDigestAlgorithmJcaDigestAlgorithm(contentDigestAlgorithm)
+                        + " content digest for "
+                        + getSignatureAlgorithmJcaSignatureAlgorithm(signatureAlgorithm)
+                        + " not computed");
+            }
+            digests.add(Pair.create(signatureAlgorithm, contentDigest));
+        }
+        signedData.digests = digests;
+
+        V2SignatureSchemeBlock.Signer signer = new V2SignatureSchemeBlock.Signer();
+        // FORMAT:
+        // * length-prefixed sequence of length-prefixed digests:
+        //   * uint32: signature algorithm ID
+        //   * length-prefixed bytes: digest of contents
+        // * length-prefixed sequence of certificates:
+        //   * length-prefixed bytes: X.509 certificate (ASN.1 DER encoded).
+        // * length-prefixed sequence of length-prefixed additional attributes:
+        //   * uint32: ID
+        //   * (length - 4) bytes: value
+        signer.signedData = encodeAsSequenceOfLengthPrefixedElements(new byte[][] {
+            encodeAsSequenceOfLengthPrefixedPairsOfIntAndLengthPrefixedBytes(signedData.digests),
+            encodeAsSequenceOfLengthPrefixedElements(signedData.certificates),
+            // additional attributes
+            new byte[0],
+        });
+        signer.publicKey = encodedPublicKey;
+        signer.signatures = new ArrayList<>();
+        for (int signatureAlgorithm : signerConfig.signatureAlgorithms) {
+            Pair<String, ? extends AlgorithmParameterSpec> signatureParams =
+                    getSignatureAlgorithmJcaSignatureAlgorithm(signatureAlgorithm);
+            String jcaSignatureAlgorithm = signatureParams.getFirst();
+            AlgorithmParameterSpec jcaSignatureAlgorithmParams = signatureParams.getSecond();
+            byte[] signatureBytes;
+            try {
+                Signature signature = Signature.getInstance(jcaSignatureAlgorithm);
+                signature.initSign(signerConfig.privateKey);
+                if (jcaSignatureAlgorithmParams != null) {
+                    signature.setParameter(jcaSignatureAlgorithmParams);
+                }
+                signature.update(signer.signedData);
+                signatureBytes = signature.sign();
+            } catch (InvalidKeyException e) {
+                throw new InvalidKeyException("Failed sign using " + jcaSignatureAlgorithm, e);
+            } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException
+                    | SignatureException e) {
+                throw new SignatureException("Failed sign using " + jcaSignatureAlgorithm, e);
+            }
+
+            try {
+                Signature signature = Signature.getInstance(jcaSignatureAlgorithm);
+                signature.initVerify(publicKey);
+                if (jcaSignatureAlgorithmParams != null) {
+                    signature.setParameter(jcaSignatureAlgorithmParams);
+                }
+                signature.update(signer.signedData);
+                if (!signature.verify(signatureBytes)) {
+                    throw new SignatureException("Signature did not verify");
+                }
+            } catch (InvalidKeyException e) {
+                throw new InvalidKeyException("Failed to verify generated " + jcaSignatureAlgorithm
+                        + " signature using public key from certificate", e);
+            } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException
+                    | SignatureException e) {
+                throw new SignatureException("Failed to verify generated " + jcaSignatureAlgorithm
+                        + " signature using public key from certificate", e);
+            }
+
+            signer.signatures.add(Pair.create(signatureAlgorithm, signatureBytes));
+        }
+
+        // FORMAT:
+        // * length-prefixed signed data
+        // * length-prefixed sequence of length-prefixed signatures:
+        //   * uint32: signature algorithm ID
+        //   * length-prefixed bytes: signature of signed data
+        // * length-prefixed bytes: public key (X.509 SubjectPublicKeyInfo, ASN.1 DER encoded)
+        return encodeAsSequenceOfLengthPrefixedElements(
+                new byte[][] {
+                    signer.signedData,
+                    encodeAsSequenceOfLengthPrefixedPairsOfIntAndLengthPrefixedBytes(
+                            signer.signatures),
+                    signer.publicKey,
+                });
+    }
+
+    private static final class V2SignatureSchemeBlock {
+        private static final class Signer {
+            public byte[] signedData;
+            public List<Pair<Integer, byte[]>> signatures;
+            public byte[] publicKey;
+        }
+
+        private static final class SignedData {
+            public List<Pair<Integer, byte[]>> digests;
+            public List<byte[]> certificates;
+        }
+    }
+
+    private static byte[] encodePublicKey(PublicKey publicKey) throws InvalidKeyException {
+        byte[] encodedPublicKey = null;
+        if ("X.509".equals(publicKey.getFormat())) {
+            encodedPublicKey = publicKey.getEncoded();
+        }
+        if (encodedPublicKey == null) {
+            try {
+                encodedPublicKey =
+                        KeyFactory.getInstance(publicKey.getAlgorithm())
+                                .getKeySpec(publicKey, X509EncodedKeySpec.class)
+                                .getEncoded();
+            } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
+                throw new InvalidKeyException(
+                        "Failed to obtain X.509 encoded form of public key " + publicKey
+                                + " of class " + publicKey.getClass().getName(),
+                        e);
+            }
+        }
+        if ((encodedPublicKey == null) || (encodedPublicKey.length == 0)) {
+            throw new InvalidKeyException(
+                    "Failed to obtain X.509 encoded form of public key " + publicKey
+                            + " of class " + publicKey.getClass().getName());
+        }
+        return encodedPublicKey;
+    }
+
+    public static List<byte[]> encodeCertificates(List<X509Certificate> certificates)
+            throws CertificateEncodingException {
+        List<byte[]> result = new ArrayList<>();
+        for (X509Certificate certificate : certificates) {
+            result.add(certificate.getEncoded());
+        }
+        return result;
+    }
+
+    private static byte[] encodeAsSequenceOfLengthPrefixedElements(List<byte[]> sequence) {
+        return encodeAsSequenceOfLengthPrefixedElements(
+                sequence.toArray(new byte[sequence.size()][]));
+    }
+
+    private static byte[] encodeAsSequenceOfLengthPrefixedElements(byte[][] sequence) {
+        int payloadSize = 0;
+        for (byte[] element : sequence) {
+            payloadSize += 4 + element.length;
+        }
+        ByteBuffer result = ByteBuffer.allocate(payloadSize);
+        result.order(ByteOrder.LITTLE_ENDIAN);
+        for (byte[] element : sequence) {
+            result.putInt(element.length);
+            result.put(element);
+        }
+        return result.array();
+      }
+
+    private static byte[] encodeAsSequenceOfLengthPrefixedPairsOfIntAndLengthPrefixedBytes(
+            List<Pair<Integer, byte[]>> sequence) {
+        int resultSize = 0;
+        for (Pair<Integer, byte[]> element : sequence) {
+            resultSize += 12 + element.getSecond().length;
+        }
+        ByteBuffer result = ByteBuffer.allocate(resultSize);
+        result.order(ByteOrder.LITTLE_ENDIAN);
+        for (Pair<Integer, byte[]> element : sequence) {
+            byte[] second = element.getSecond();
+            result.putInt(8 + second.length);
+            result.putInt(element.getFirst());
+            result.putInt(second.length);
+            result.put(second);
+        }
+        return result.array();
+    }
+
+    /**
+     * Relative <em>get</em> method for reading {@code size} number of bytes from the current
+     * position of this buffer.
+     *
+     * <p>This method reads the next {@code size} bytes at this buffer's current position,
+     * returning them as a {@code ByteBuffer} with start set to 0, limit and capacity set to
+     * {@code size}, byte order set to this buffer's byte order; and then increments the position by
+     * {@code size}.
+     */
+    private static ByteBuffer getByteBuffer(ByteBuffer source, int size) {
+        if (size < 0) {
+            throw new IllegalArgumentException("size: " + size);
+        }
+        int originalLimit = source.limit();
+        int position = source.position();
+        int limit = position + size;
+        if ((limit < position) || (limit > originalLimit)) {
+            throw new BufferUnderflowException();
+        }
+        source.limit(limit);
+        try {
+            ByteBuffer result = source.slice();
+            result.order(source.order());
+            source.position(limit);
+            return result;
+        } finally {
+            source.limit(originalLimit);
+        }
+    }
+
+    private static Pair<String, ? extends AlgorithmParameterSpec>
+            getSignatureAlgorithmJcaSignatureAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+                return Pair.create(
+                        "SHA256withRSA/PSS",
+                        new PSSParameterSpec(
+                                "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 256 / 8, 1));
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+                return Pair.create(
+                        "SHA512withRSA/PSS",
+                        new PSSParameterSpec(
+                                "SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 512 / 8, 1));
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+                return Pair.create("SHA256withRSA", null);
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+                return Pair.create("SHA512withRSA", null);
+            case SIGNATURE_ECDSA_WITH_SHA256:
+                return Pair.create("SHA256withECDSA", null);
+            case SIGNATURE_ECDSA_WITH_SHA512:
+                return Pair.create("SHA512withECDSA", null);
+            case SIGNATURE_DSA_WITH_SHA256:
+                return Pair.create("SHA256withDSA", null);
+            case SIGNATURE_DSA_WITH_SHA512:
+                return Pair.create("SHA512withDSA", null);
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    private static int getSignatureAlgorithmContentDigestAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+            case SIGNATURE_ECDSA_WITH_SHA256:
+            case SIGNATURE_DSA_WITH_SHA256:
+                return CONTENT_DIGEST_CHUNKED_SHA256;
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+            case SIGNATURE_ECDSA_WITH_SHA512:
+            case SIGNATURE_DSA_WITH_SHA512:
+                return CONTENT_DIGEST_CHUNKED_SHA512;
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    private static String getContentDigestAlgorithmJcaDigestAlgorithm(int digestAlgorithm) {
+        switch (digestAlgorithm) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                return "SHA-256";
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                return "SHA-512";
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown content digest algorthm: " + digestAlgorithm);
+        }
+    }
+
+    private static int getContentDigestAlgorithmOutputSizeBytes(int digestAlgorithm) {
+        switch (digestAlgorithm) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                return 256 / 8;
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                return 512 / 8;
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown content digest algorthm: " + digestAlgorithm);
+        }
+    }
+
+    /**
+     * Indicates that APK file could not be parsed.
+     */
+    public static class ApkParseException extends Exception {
+        private static final long serialVersionUID = 1L;
+
+        public ApkParseException(String message) {
+            super(message);
+        }
+
+        public ApkParseException(String message, Throwable cause) {
+            super(message, cause);
+        }
+    }
+
+    /**
+     * Pair of two elements.
+     */
+    private static class Pair<A, B> {
+        private final A mFirst;
+        private final B mSecond;
+
+        private Pair(A first, B second) {
+            mFirst = first;
+            mSecond = second;
+        }
+
+        public static <A, B> Pair<A, B> create(A first, B second) {
+            return new Pair<>(first, second);
+        }
+
+        public A getFirst() {
+            return mFirst;
+        }
+
+        public B getSecond() {
+            return mSecond;
+        }
+
+        @Override
+        public int hashCode() {
+            final int prime = 31;
+            int result = 1;
+            result = prime * result + ((mFirst == null) ? 0 : mFirst.hashCode());
+            result = prime * result + ((mSecond == null) ? 0 : mSecond.hashCode());
+            return result;
+        }
+
+        @Override
+        public boolean equals(Object obj) {
+            if (this == obj) {
+                return true;
+            }
+            if (obj == null) {
+                return false;
+            }
+            if (getClass() != obj.getClass()) {
+                return false;
+            }
+            @SuppressWarnings("rawtypes")
+            Pair other = (Pair) obj;
+            if (mFirst == null) {
+                if (other.mFirst != null) {
+                    return false;
+                }
+            } else if (!mFirst.equals(other.mFirst)) {
+                return false;
+            }
+            if (mSecond == null) {
+                return other.mSecond == null;
+            } else return mSecond.equals(other.mSecond);
+        }
+    }
+}

app/signing/src/main/java/com/topjohnwu/signing/SignApk.java

@@ -2,9 +2,7 @@ package com.topjohnwu.signing;
 
 import org.bouncycastle.asn1.ASN1Encoding;
 import org.bouncycastle.asn1.ASN1InputStream;
-import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.ASN1OutputStream;
-import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
 import org.bouncycastle.cert.jcajce.JcaCertStore;
 import org.bouncycastle.cms.CMSException;
 import org.bouncycastle.cms.CMSProcessableByteArray;
@@ -12,34 +10,38 @@ import org.bouncycastle.cms.CMSSignedData;
 import org.bouncycastle.cms.CMSSignedDataGenerator;
 import org.bouncycastle.cms.CMSTypedData;
 import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
 import org.bouncycastle.operator.OperatorCreationException;
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.util.encoders.Base64;
 
-import java.io.BufferedOutputStream;
 import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.FilterOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.PrintStream;
-import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
 import java.security.DigestOutputStream;
 import java.security.GeneralSecurityException;
+import java.security.InvalidKeyException;
 import java.security.MessageDigest;
 import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Security;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Enumeration;
+import java.util.Iterator;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.TimeZone;
 import java.util.TreeMap;
 import java.util.jar.Attributes;
 import java.util.jar.JarEntry;
@@ -49,72 +51,28 @@ import java.util.jar.Manifest;
 import java.util.regex.Pattern;
 
 /*
-* Modified from from AOSP
-* https://android.googlesource.com/platform/build/+/refs/heads/marshmallow-release/tools/signapk/SignApk.java
-* */
-
-public class SignAPK {
+ * Modified from from AOSP
+ * https://android.googlesource.com/platform/build/+/refs/tags/android-7.1.2_r39/tools/signapk/src/com/android/signapk/SignApk.java
+ * */
 
+public class SignApk {
     private static final String CERT_SF_NAME = "META-INF/CERT.SF";
     private static final String CERT_SIG_NAME = "META-INF/CERT.%s";
+    private static final String CERT_SF_MULTI_NAME = "META-INF/CERT%d.SF";
+    private static final String CERT_SIG_MULTI_NAME = "META-INF/CERT%d.%s";
 
     // bitmasks for which hash algorithms we need the manifest to include.
     private static final int USE_SHA1 = 1;
     private static final int USE_SHA256 = 2;
 
-    public static void signAndAdjust(X509Certificate cert, PrivateKey key,
-                                     JarMap input, OutputStream output) throws Exception {
-        File temp1 = File.createTempFile("signAPK", null);
-        File temp2 = File.createTempFile("signAPK", null);
-
-        try {
-            try (OutputStream out = new BufferedOutputStream(new FileOutputStream(temp1))) {
-                sign(cert, key, input, out, false);
-            }
-
-            ZipAdjust.adjust(temp1, temp2);
-
-            try (JarMap map = JarMap.open(temp2, false)) {
-                sign(cert, key, map, output, true);
-            }
-        } finally {
-            temp1.delete();
-            temp2.delete();
-        }
-    }
-
-    public static void sign(X509Certificate cert, PrivateKey key,
-                            JarMap input, OutputStream output) throws Exception {
-        sign(cert, key, input, output, false);
-    }
-
-    private static void sign(X509Certificate cert, PrivateKey key, JarMap input,
-                             OutputStream output, boolean wholeFile) throws Exception {
-        int hashes = 0;
-        hashes |= getDigestAlgorithm(cert);
-
-        // Set the ZIP file timestamp to the starting valid time
-        // of the 0th certificate plus one hour (to match what
-        // we've historically done).
-        long timestamp = cert.getNotBefore().getTime() + 3600L * 1000;
-
-        if (wholeFile) {
-            signWholeFile(input.getFile(), cert, key, output);
-        } else {
-            JarOutputStream outputJar = new JarOutputStream(output);
-            // For signing .apks, use the maximum compression to make
-            // them as small as possible (since they live forever on
-            // the system partition).  For OTA packages, use the
-            // default compression level, which is much much faster
-            // and produces output that is only a tiny bit larger
-            // (~0.1% on full OTA packages I tested).
-            outputJar.setLevel(9);
-            Manifest manifest = addDigestsToManifest(input, hashes);
-            copyFiles(manifest, input, outputJar, timestamp, 4);
-            signFile(manifest, input, cert, key, outputJar);
-            outputJar.close();
-        }
-    }
+    /**
+     * Digest algorithm used when signing the APK using APK Signature Scheme v2.
+     */
+    private static final String APK_SIG_SCHEME_V2_DIGEST_ALGORITHM = "SHA-256";
+    // Files matching this pattern are not copied to the output.
+    private static final Pattern stripPattern =
+            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
+                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
 
     /**
      * Return one of USE_SHA1 or USE_SHA256 according to the signature
@@ -122,7 +80,7 @@ public class SignAPK {
      */
     private static int getDigestAlgorithm(X509Certificate cert) {
         String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
-        if (sigAlg.startsWith("SHA1WITHRSA") || sigAlg.startsWith("MD5WITHRSA")) {
+        if ("SHA1WITHRSA".equals(sigAlg) || "MD5WITHRSA".equals(sigAlg)) {
             return USE_SHA1;
         } else if (sigAlg.startsWith("SHA256WITH")) {
             return USE_SHA256;
@@ -132,9 +90,10 @@ public class SignAPK {
         }
     }
 
-    /** Returns the expected signature algorithm for this key type. */
+    /**
+     * Returns the expected signature algorithm for this key type.
+     */
     private static String getSignatureAlgorithm(X509Certificate cert) {
-        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
         String keyType = cert.getPublicKey().getAlgorithm().toUpperCase(Locale.US);
         if ("RSA".equalsIgnoreCase(keyType)) {
             if (getDigestAlgorithm(cert) == USE_SHA256) {
@@ -149,11 +108,6 @@ public class SignAPK {
         }
     }
 
-    // Files matching this pattern are not copied to the output.
-    private static Pattern stripPattern =
-            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
-                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
-
     /**
      * Add the hash(es) of every file to the manifest, creating it if
      * necessary.
@@ -169,6 +123,7 @@ public class SignAPK {
             main.putValue("Manifest-Version", "1.0");
             main.putValue("Created-By", "1.0 (Android SignApk)");
         }
+
         MessageDigest md_sha1 = null;
         MessageDigest md_sha256 = null;
         if ((hashes & USE_SHA1) != 0) {
@@ -177,32 +132,51 @@ public class SignAPK {
         if ((hashes & USE_SHA256) != 0) {
             md_sha256 = MessageDigest.getInstance("SHA256");
         }
+
         byte[] buffer = new byte[4096];
         int num;
+
         // We sort the input entries by name, and add them to the
         // output manifest in sorted order.  We expect that the output
         // map will be deterministic.
+
         TreeMap<String, JarEntry> byName = new TreeMap<>();
+
         for (Enumeration<JarEntry> e = jar.entries(); e.hasMoreElements(); ) {
             JarEntry entry = e.nextElement();
             byName.put(entry.getName(), entry);
         }
-        for (JarEntry entry: byName.values()) {
+
+        for (JarEntry entry : byName.values()) {
             String name = entry.getName();
-            if (!entry.isDirectory() &&
-                    (stripPattern == null || !stripPattern.matcher(name).matches())) {
+            if (!entry.isDirectory() && !stripPattern.matcher(name).matches()) {
                 InputStream data = jar.getInputStream(entry);
                 while ((num = data.read(buffer)) > 0) {
                     if (md_sha1 != null) md_sha1.update(buffer, 0, num);
                     if (md_sha256 != null) md_sha256.update(buffer, 0, num);
                 }
+
                 Attributes attr = null;
                 if (input != null) attr = input.getAttributes(name);
                 attr = attr != null ? new Attributes(attr) : new Attributes();
+                // Remove any previously computed digests from this entry's attributes.
+                for (Iterator<Object> i = attr.keySet().iterator(); i.hasNext(); ) {
+                    Object key = i.next();
+                    if (!(key instanceof Attributes.Name)) {
+                        continue;
+                    }
+                    String attributeNameLowerCase =
+                            key.toString().toLowerCase(Locale.US);
+                    if (attributeNameLowerCase.endsWith("-digest")) {
+                        i.remove();
+                    }
+                }
+                // Add SHA-1 digest if requested
                 if (md_sha1 != null) {
                     attr.putValue("SHA1-Digest",
                             new String(Base64.encode(md_sha1.digest()), "ASCII"));
                 }
+                // Add SHA-256 digest if requested
                 if (md_sha256 != null) {
                     attr.putValue("SHA-256-Digest",
                             new String(Base64.encode(md_sha256.digest()), "ASCII"));
@@ -210,62 +184,39 @@ public class SignAPK {
                 output.getEntries().put(name, attr);
             }
         }
+
         return output;
     }
 
     /**
-     * Write to another stream and track how many bytes have been
-     * written.
+     * Write a .SF file with a digest of the specified manifest.
      */
-    private static class CountOutputStream extends FilterOutputStream {
-        private int mCount;
-        public CountOutputStream(OutputStream out) {
-            super(out);
-            mCount = 0;
-        }
-        @Override
-        public void write(int b) throws IOException {
-            super.write(b);
-            mCount++;
-        }
-        @Override
-        public void write(byte[] b, int off, int len) throws IOException {
-            super.write(b, off, len);
-            mCount += len;
-        }
-        public int size() {
-            return mCount;
-        }
-    }
-
-    /**
-     * An OutputStream that does literally nothing
-     */
-    private static OutputStream stubStream = new OutputStream() {
-        @Override
-        public void write(int b) {}
-
-        @Override
-        public void write(byte[] b, int off, int len) {}
-    };
-
-    /** Write a .SF file with a digest of the specified manifest. */
-    private static void writeSignatureFile(Manifest manifest, OutputStream out, int hash)
+    private static void writeSignatureFile(Manifest manifest, OutputStream out,
+                                           int hash)
             throws IOException, GeneralSecurityException {
         Manifest sf = new Manifest();
         Attributes main = sf.getMainAttributes();
         main.putValue("Signature-Version", "1.0");
         main.putValue("Created-By", "1.0 (Android SignApk)");
-        MessageDigest md = MessageDigest.getInstance(
-                hash == USE_SHA256 ? "SHA256" : "SHA1");
-        PrintStream print = new PrintStream(
-                new DigestOutputStream(stubStream, md),
+        // Add APK Signature Scheme v2 signature stripping protection.
+        // This attribute indicates that this APK is supposed to have been signed using one or
+        // more APK-specific signature schemes in addition to the standard JAR signature scheme
+        // used by this code. APK signature verifier should reject the APK if it does not
+        // contain a signature for the signature scheme the verifier prefers out of this set.
+        main.putValue(
+                ApkSignerV2.SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME,
+                ApkSignerV2.SF_ATTRIBUTE_ANDROID_APK_SIGNED_VALUE);
+
+        MessageDigest md = MessageDigest.getInstance(hash == USE_SHA256 ? "SHA256" : "SHA1");
+        PrintStream print = new PrintStream(new DigestOutputStream(new ByteArrayOutputStream(), md),
                 true, "UTF-8");
+
         // Digest of the entire manifest
         manifest.write(print);
         print.flush();
         main.putValue(hash == USE_SHA256 ? "SHA-256-Digest-Manifest" : "SHA1-Digest-Manifest",
                 new String(Base64.encode(md.digest()), "ASCII"));
+
         Map<String, Attributes> entries = manifest.getEntries();
         for (Map.Entry<String, Attributes> entry : entries.entrySet()) {
             // Digest of the manifest stanza for this entry.
@@ -275,13 +226,16 @@ public class SignAPK {
             }
             print.print("\r\n");
             print.flush();
+
             Attributes sfAttr = new Attributes();
             sfAttr.putValue(hash == USE_SHA256 ? "SHA-256-Digest" : "SHA1-Digest",
                     new String(Base64.encode(md.digest()), "ASCII"));
             sf.getEntries().put(entry.getKey(), sfAttr);
         }
+
         CountOutputStream cout = new CountOutputStream(out);
         sf.write(cout);
+
         // A bug in the java.util.jar implementation of Android platforms
         // up to version 1.6 will cause a spurious IOException to be thrown
         // if the length of the signature file is a multiple of 1024 bytes.
@@ -292,10 +246,11 @@ public class SignAPK {
         }
     }
 
-    /** Sign data and write the digital signature to 'out'. */
+    /**
+     * Sign data and write the digital signature to 'out'.
+     */
     private static void writeSignatureBlock(
-            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey,
-            OutputStream out)
+            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey, OutputStream out)
             throws IOException,
             CertificateEncodingException,
             OperatorCreationException,
@@ -303,19 +258,22 @@ public class SignAPK {
         ArrayList<X509Certificate> certList = new ArrayList<>(1);
         certList.add(publicKey);
         JcaCertStore certs = new JcaCertStore(certList);
+
         CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
         ContentSigner signer = new JcaContentSignerBuilder(getSignatureAlgorithm(publicKey))
                 .build(privateKey);
         gen.addSignerInfoGenerator(
-                new JcaSignerInfoGeneratorBuilder(
-                        new JcaDigestCalculatorProviderBuilder().build())
+                new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().build())
                         .setDirectSignature(true)
-                        .build(signer, publicKey));
+                        .build(signer, publicKey)
+        );
         gen.addCertificates(certs);
         CMSSignedData sigData = gen.generate(data, false);
-        ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded());
-        ASN1OutputStream dos = ASN1OutputStream.create(out, ASN1Encoding.DER);
-        dos.writeObject(asn1.readObject());
+
+        try (ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded())) {
+            ASN1OutputStream dos = ASN1OutputStream.create(out, ASN1Encoding.DER);
+            dos.writeObject(asn1.readObject());
+        }
     }
 
     /**
@@ -325,27 +283,37 @@ public class SignAPK {
      * more efficient.
      */
     private static void copyFiles(Manifest manifest, JarMap in, JarOutputStream out,
-                                  long timestamp, int alignment) throws IOException {
+                                  long timestamp, int defaultAlignment) throws IOException {
         byte[] buffer = new byte[4096];
         int num;
+
         Map<String, Attributes> entries = manifest.getEntries();
         ArrayList<String> names = new ArrayList<>(entries.keySet());
         Collections.sort(names);
+
         boolean firstEntry = true;
         long offset = 0L;
+
         // We do the copy in two passes -- first copying all the
         // entries that are STORED, then copying all the entries that
         // have any other compression flag (which in practice means
         // DEFLATED).  This groups all the stored entries together at
         // the start of the file and makes it easier to do alignment
         // on them (since only stored entries are aligned).
+
         for (String name : names) {
             JarEntry inEntry = in.getJarEntry(name);
-            JarEntry outEntry = null;
+            JarEntry outEntry;
             if (inEntry.getMethod() != JarEntry.STORED) continue;
             // Preserve the STORED method of the input entry.
             outEntry = new JarEntry(inEntry);
             outEntry.setTime(timestamp);
+            // Discard comment and extra fields of this entry to
+            // simplify alignment logic below and for consistency with
+            // how compressed entries are handled later.
+            outEntry.setComment(null);
+            outEntry.setExtra(null);
+
             // 'offset' is the offset into the file at which we expect
             // the file data to begin.  This is the value we need to
             // make a multiple of 'alignement'.
@@ -359,15 +327,18 @@ public class SignAPK {
                 offset += 4;
                 firstEntry = false;
             }
+            int alignment = getStoredEntryDataAlignment(name, defaultAlignment);
             if (alignment > 0 && (offset % alignment != 0)) {
                 // Set the "extra data" of the entry to between 1 and
                 // alignment-1 bytes, to make the file data begin at
                 // an aligned offset.
-                int needed = alignment - (int)(offset % alignment);
+                int needed = alignment - (int) (offset % alignment);
                 outEntry.setExtra(new byte[needed]);
                 offset += needed;
             }
+
             out.putNextEntry(outEntry);
+
             InputStream data = in.getInputStream(inEntry);
             while ((num = data.read(buffer)) > 0) {
                 out.write(buffer, 0, num);
@@ -375,17 +346,20 @@ public class SignAPK {
             }
             out.flush();
         }
+
         // Copy all the non-STORED entries.  We don't attempt to
         // maintain the 'offset' variable past this point; we don't do
         // alignment on these entries.
+
         for (String name : names) {
             JarEntry inEntry = in.getJarEntry(name);
-            JarEntry outEntry = null;
+            JarEntry outEntry;
             if (inEntry.getMethod() == JarEntry.STORED) continue;
             // Create a new entry so that the compressed len is recomputed.
             outEntry = new JarEntry(name);
             outEntry.setTime(timestamp);
             out.putNextEntry(outEntry);
+
             InputStream data = in.getInputStream(inEntry);
             while ((num = data.read(buffer)) > 0) {
                 out.write(buffer, 0, num);
@@ -394,135 +368,203 @@ public class SignAPK {
         }
     }
 
-    // This class is to provide a file's content, but trimming out the last two bytes
-    // Used for signWholeFile
-    private static class CMSProcessableFile implements CMSTypedData {
-
-        private ASN1ObjectIdentifier type;
-        private RandomAccessFile file;
-
-        CMSProcessableFile(File file) throws FileNotFoundException {
-            this.file = new RandomAccessFile(file, "r");
-            type = new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId());
+    /**
+     * Returns the multiple (in bytes) at which the provided {@code STORED} entry's data must start
+     * relative to start of file or {@code 0} if alignment of this entry's data is not important.
+     */
+    private static int getStoredEntryDataAlignment(String entryName, int defaultAlignment) {
+        if (defaultAlignment <= 0) {
+            return 0;
         }
 
-        @Override
-        public ASN1ObjectIdentifier getContentType() {
-            return type;
-        }
-
-        @Override
-        public void write(OutputStream out) throws IOException, CMSException {
-            file.seek(0);
-            int read;
-            byte buffer[] = new byte[4096];
-            int len = (int) file.length() - 2;
-            while ((read = file.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
-                out.write(buffer, 0, read);
-                len -= read;
-            }
-        }
-
-        @Override
-        public Object getContent() {
-            return file;
-        }
-
-        byte[] getTail() throws IOException {
-            byte tail[] = new byte[22];
-            file.seek(file.length() - 22);
-            file.readFully(tail);
-            return tail;
+        if (entryName.endsWith(".so")) {
+            // Align .so contents to memory page boundary to enable memory-mapped
+            // execution.
+            return 4096;
+        } else {
+            return defaultAlignment;
         }
     }
 
-    private static void signWholeFile(File input, X509Certificate publicKey,
-                                      PrivateKey privateKey, OutputStream outputStream)
-            throws Exception {
-        ByteArrayOutputStream temp = new ByteArrayOutputStream();
-        // put a readable message and a null char at the start of the
-        // archive comment, so that tools that display the comment
-        // (hopefully) show something sensible.
-        // TODO: anything more useful we can put in this message?
-        byte[] message = "signed by SignApk".getBytes("UTF-8");
-        temp.write(message);
-        temp.write(0);
-
-        CMSProcessableFile cmsFile = new CMSProcessableFile(input);
-        writeSignatureBlock(cmsFile, publicKey, privateKey, temp);
-
-        // For a zip with no archive comment, the
-        // end-of-central-directory record will be 22 bytes long, so
-        // we expect to find the EOCD marker 22 bytes from the end.
-        byte[] zipData = cmsFile.getTail();
-        if (zipData[zipData.length-22] != 0x50 ||
-                zipData[zipData.length-21] != 0x4b ||
-                zipData[zipData.length-20] != 0x05 ||
-                zipData[zipData.length-19] != 0x06) {
-            throw new IllegalArgumentException("zip data already has an archive comment");
-        }
-        int total_size = temp.size() + 6;
-        if (total_size > 0xffff) {
-            throw new IllegalArgumentException("signature is too big for ZIP file comment");
-        }
-        // signature starts this many bytes from the end of the file
-        int signature_start = total_size - message.length - 1;
-        temp.write(signature_start & 0xff);
-        temp.write((signature_start >> 8) & 0xff);
-        // Why the 0xff bytes?  In a zip file with no archive comment,
-        // bytes [-6:-2] of the file are the little-endian offset from
-        // the start of the file to the central directory.  So for the
-        // two high bytes to be 0xff 0xff, the archive would have to
-        // be nearly 4GB in size.  So it's unlikely that a real
-        // commentless archive would have 0xffs here, and lets us tell
-        // an old signed archive from a new one.
-        temp.write(0xff);
-        temp.write(0xff);
-        temp.write(total_size & 0xff);
-        temp.write((total_size >> 8) & 0xff);
-        temp.flush();
-        // Signature verification checks that the EOCD header is the
-        // last such sequence in the file (to avoid minzip finding a
-        // fake EOCD appended after the signature in its scan).  The
-        // odds of producing this sequence by chance are very low, but
-        // let's catch it here if it does.
-        byte[] b = temp.toByteArray();
-        for (int i = 0; i < b.length-3; ++i) {
-            if (b[i] == 0x50 && b[i+1] == 0x4b && b[i+2] == 0x05 && b[i+3] == 0x06) {
-                throw new IllegalArgumentException("found spurious EOCD header at " + i);
-            }
-        }
-        cmsFile.write(outputStream);
-        outputStream.write(total_size & 0xff);
-        outputStream.write((total_size >> 8) & 0xff);
-        temp.writeTo(outputStream);
-        outputStream.close();
-    }
-
-    private static void signFile(Manifest manifest, JarMap inputJar,
-                                 X509Certificate cert, PrivateKey privateKey,
-                                 JarOutputStream outputJar)
-            throws Exception {
-        // Assume the certificate is valid for at least an hour.
-        long timestamp = cert.getNotBefore().getTime() + 3600L * 1000;
+    private static void signFile(Manifest manifest,
+                                 X509Certificate[] publicKey, PrivateKey[] privateKey,
+                                 long timestamp, JarOutputStream outputJar) throws Exception {
         // MANIFEST.MF
         JarEntry je = new JarEntry(JarFile.MANIFEST_NAME);
         je.setTime(timestamp);
         outputJar.putNextEntry(je);
         manifest.write(outputJar);
-        je = new JarEntry(CERT_SF_NAME);
-        je.setTime(timestamp);
-        outputJar.putNextEntry(je);
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        writeSignatureFile(manifest, baos, getDigestAlgorithm(cert));
-        byte[] signedData = baos.toByteArray();
-        outputJar.write(signedData);
-        // CERT.{EC,RSA} / CERT#.{EC,RSA}
-        final String keyType = cert.getPublicKey().getAlgorithm();
-        je = new JarEntry(String.format(CERT_SIG_NAME, keyType));
-        je.setTime(timestamp);
-        outputJar.putNextEntry(je);
-        writeSignatureBlock(new CMSProcessableByteArray(signedData),
-                cert, privateKey, outputJar);
+
+        int numKeys = publicKey.length;
+        for (int k = 0; k < numKeys; ++k) {
+            // CERT.SF / CERT#.SF
+            je = new JarEntry(numKeys == 1 ? CERT_SF_NAME :
+                    (String.format(Locale.US, CERT_SF_MULTI_NAME, k)));
+            je.setTime(timestamp);
+            outputJar.putNextEntry(je);
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            writeSignatureFile(manifest, baos, getDigestAlgorithm(publicKey[k]));
+            byte[] signedData = baos.toByteArray();
+            outputJar.write(signedData);
+
+            // CERT.{EC,RSA} / CERT#.{EC,RSA}
+            final String keyType = publicKey[k].getPublicKey().getAlgorithm();
+            je = new JarEntry(numKeys == 1 ? (String.format(CERT_SIG_NAME, keyType)) :
+                    (String.format(Locale.US, CERT_SIG_MULTI_NAME, k, keyType)));
+            je.setTime(timestamp);
+            outputJar.putNextEntry(je);
+            writeSignatureBlock(new CMSProcessableByteArray(signedData),
+                    publicKey[k], privateKey[k], outputJar);
+        }
+    }
+
+    /**
+     * Converts the provided lists of private keys, their X.509 certificates, and digest algorithms
+     * into a list of APK Signature Scheme v2 {@code SignerConfig} instances.
+     */
+    private static List<ApkSignerV2.SignerConfig> createV2SignerConfigs(
+            PrivateKey[] privateKeys, X509Certificate[] certificates, String[] digestAlgorithms)
+            throws InvalidKeyException {
+        if (privateKeys.length != certificates.length) {
+            throw new IllegalArgumentException(
+                    "The number of private keys must match the number of certificates: "
+                            + privateKeys.length + " vs" + certificates.length);
+        }
+        List<ApkSignerV2.SignerConfig> result = new ArrayList<>(privateKeys.length);
+        for (int i = 0; i < privateKeys.length; i++) {
+            PrivateKey privateKey = privateKeys[i];
+            X509Certificate certificate = certificates[i];
+            PublicKey publicKey = certificate.getPublicKey();
+            String keyAlgorithm = privateKey.getAlgorithm();
+            if (!keyAlgorithm.equalsIgnoreCase(publicKey.getAlgorithm())) {
+                throw new InvalidKeyException(
+                        "Key algorithm of private key #" + (i + 1) + " does not match key"
+                                + " algorithm of public key #" + (i + 1) + ": " + keyAlgorithm
+                                + " vs " + publicKey.getAlgorithm());
+            }
+            ApkSignerV2.SignerConfig signerConfig = new ApkSignerV2.SignerConfig();
+            signerConfig.privateKey = privateKey;
+            signerConfig.certificates = Collections.singletonList(certificate);
+            List<Integer> signatureAlgorithms = new ArrayList<>(digestAlgorithms.length);
+            for (String digestAlgorithm : digestAlgorithms) {
+                try {
+                    signatureAlgorithms.add(getV2SignatureAlgorithm(keyAlgorithm, digestAlgorithm));
+                } catch (IllegalArgumentException e) {
+                    throw new InvalidKeyException(
+                            "Unsupported key and digest algorithm combination for signer #"
+                                    + (i + 1), e);
+                }
+            }
+            signerConfig.signatureAlgorithms = signatureAlgorithms;
+            result.add(signerConfig);
+        }
+        return result;
+    }
+
+    private static int getV2SignatureAlgorithm(String keyAlgorithm, String digestAlgorithm) {
+        if ("SHA-256".equalsIgnoreCase(digestAlgorithm)) {
+            if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
+                // Use RSASSA-PKCS1-v1_5 signature scheme instead of RSASSA-PSS to guarantee
+                // deterministic signatures which make life easier for OTA updates (fewer files
+                // changed when deterministic signature schemes are used).
+                return ApkSignerV2.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256;
+            } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_ECDSA_WITH_SHA256;
+            } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_DSA_WITH_SHA256;
+            } else {
+                throw new IllegalArgumentException("Unsupported key algorithm: " + keyAlgorithm);
+            }
+        } else if ("SHA-512".equalsIgnoreCase(digestAlgorithm)) {
+            if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
+                // Use RSASSA-PKCS1-v1_5 signature scheme instead of RSASSA-PSS to guarantee
+                // deterministic signatures which make life easier for OTA updates (fewer files
+                // changed when deterministic signature schemes are used).
+                return ApkSignerV2.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512;
+            } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_ECDSA_WITH_SHA512;
+            } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
+                return ApkSignerV2.SIGNATURE_DSA_WITH_SHA512;
+            } else {
+                throw new IllegalArgumentException("Unsupported key algorithm: " + keyAlgorithm);
+            }
+        } else {
+            throw new IllegalArgumentException("Unsupported digest algorithm: " + digestAlgorithm);
+        }
+    }
+
+    public static void sign(X509Certificate cert, PrivateKey key,
+                            JarMap inputJar, FileOutputStream outputFile) throws Exception {
+        int alignment = 4;
+        int hashes = 0;
+
+        X509Certificate[] publicKey = new X509Certificate[1];
+        publicKey[0] = cert;
+        hashes |= getDigestAlgorithm(publicKey[0]);
+
+        // Set all ZIP file timestamps to Jan 1 2009 00:00:00.
+        long timestamp = 1230768000000L;
+        // The Java ZipEntry API we're using converts milliseconds since epoch into MS-DOS
+        // timestamp using the current timezone. We thus adjust the milliseconds since epoch
+        // value to end up with MS-DOS timestamp of Jan 1 2009 00:00:00.
+        timestamp -= TimeZone.getDefault().getOffset(timestamp);
+
+        PrivateKey[] privateKey = new PrivateKey[1];
+        privateKey[0] = key;
+
+        // Generate, in memory, an APK signed using standard JAR Signature Scheme.
+        ByteArrayOutputStream v1SignedApkBuf = new ByteArrayOutputStream();
+        JarOutputStream outputJar = new JarOutputStream(v1SignedApkBuf);
+        // Use maximum compression for compressed entries because the APK lives forever on
+        // the system partition.
+        outputJar.setLevel(9);
+        Manifest manifest = addDigestsToManifest(inputJar, hashes);
+        copyFiles(manifest, inputJar, outputJar, timestamp, alignment);
+        signFile(manifest, publicKey, privateKey, timestamp, outputJar);
+        outputJar.close();
+        ByteBuffer v1SignedApk = ByteBuffer.wrap(v1SignedApkBuf.toByteArray());
+        v1SignedApkBuf.reset();
+
+        ByteBuffer[] outputChunks;
+        List<ApkSignerV2.SignerConfig> signerConfigs = createV2SignerConfigs(privateKey, publicKey,
+                new String[]{APK_SIG_SCHEME_V2_DIGEST_ALGORITHM});
+        outputChunks = ApkSignerV2.sign(v1SignedApk, signerConfigs);
+
+        // This assumes outputChunks are array-backed. To avoid this assumption, the
+        // code could be rewritten to use FileChannel.
+        for (ByteBuffer outputChunk : outputChunks) {
+            outputFile.write(outputChunk.array(),
+                    outputChunk.arrayOffset() + outputChunk.position(), outputChunk.remaining());
+            outputChunk.position(outputChunk.limit());
+        }
+    }
+
+    /**
+     * Write to another stream and track how many bytes have been
+     * written.
+     */
+    private static class CountOutputStream extends FilterOutputStream {
+        private int mCount;
+
+        public CountOutputStream(OutputStream out) {
+            super(out);
+            mCount = 0;
+        }
+
+        @Override
+        public void write(int b) throws IOException {
+            super.write(b);
+            mCount++;
+        }
+
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            super.write(b, off, len);
+            mCount += len;
+        }
+
+        public int size() {
+            return mCount;
+        }
     }
 }

app/signing/src/main/java/com/topjohnwu/signing/ZipSigner.java

@@ -6,7 +6,6 @@ import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.OutputStream;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
@@ -28,20 +27,20 @@ public class ZipSigner {
         System.exit(2);
     }
 
-    private static void sign(JarMap input, OutputStream output) throws Exception {
-        sign(SignAPK.class.getResourceAsStream("/keys/testkey.x509.pem"),
-                SignAPK.class.getResourceAsStream("/keys/testkey.pk8"), input, output);
+    private static void sign(JarMap input, FileOutputStream output) throws Exception {
+        sign(SignApk.class.getResourceAsStream("/keys/testkey.x509.pem"),
+                SignApk.class.getResourceAsStream("/keys/testkey.pk8"), input, output);
     }
 
     private static void sign(InputStream certIs, InputStream keyIs,
-                             JarMap input, OutputStream output) throws Exception {
+                             JarMap input, FileOutputStream output) throws Exception {
         X509Certificate cert = CryptoUtils.readCertificate(certIs);
         PrivateKey key = CryptoUtils.readPrivateKey(keyIs);
-        SignAPK.signAndAdjust(cert, key, input, output);
+        SignApk.sign(cert, key, input, output);
     }
 
     private static void sign(String keyStore, String keyStorePass, String alias, String keyPass,
-                             JarMap in, OutputStream out) throws Exception {
+                             JarMap in, FileOutputStream out) throws Exception {
         KeyStore ks;
         try {
             ks = KeyStore.getInstance("JKS");
@@ -56,7 +55,7 @@ public class ZipSigner {
         }
         X509Certificate cert = (X509Certificate) ks.getCertificate(alias);
         PrivateKey key = (PrivateKey) ks.getKey(alias, keyPass.toCharArray());
-        SignAPK.signAndAdjust(cert, key, in, out);
+        SignApk.sign(cert, key, in, out);
     }
 
     public static void main(String[] args) throws Exception {
@@ -66,7 +65,7 @@ public class ZipSigner {
         Security.insertProviderAt(new BouncyCastleProvider(), 1);
 
         try (JarMap in = JarMap.open(args[args.length - 2], false);
-             OutputStream out = new FileOutputStream(args[args.length - 1])) {
+             FileOutputStream out = new FileOutputStream(args[args.length - 1])) {
             if (args.length == 2) {
                 sign(in, out);
             } else if (args.length == 4) {

app/signing/src/main/java/com/topjohnwu/signing/ZipUtils.java

@@ -0,0 +1,136 @@
+package com.topjohnwu.signing;
+
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+
+/**
+ * Assorted ZIP format helpers.
+ *
+ * <p>NOTE: Most helper methods operating on {@code ByteBuffer} instances expect that the byte
+ * order of these buffers is little-endian.
+ */
+public abstract class ZipUtils {
+
+    private static final int ZIP_EOCD_REC_MIN_SIZE = 22;
+    private static final int ZIP_EOCD_REC_SIG = 0x06054b50;
+    private static final int ZIP_EOCD_CENTRAL_DIR_SIZE_FIELD_OFFSET = 12;
+    private static final int ZIP_EOCD_CENTRAL_DIR_OFFSET_FIELD_OFFSET = 16;
+    private static final int ZIP_EOCD_COMMENT_LENGTH_FIELD_OFFSET = 20;
+
+    private static final int ZIP64_EOCD_LOCATOR_SIZE = 20;
+    private static final int ZIP64_EOCD_LOCATOR_SIG = 0x07064b50;
+
+    private static final int UINT16_MAX_VALUE = 0xffff;
+
+    private ZipUtils() {
+    }
+
+    /**
+     * Returns the position at which ZIP End of Central Directory record starts in the provided
+     * buffer or {@code -1} if the record is not present.
+     *
+     * <p>NOTE: Byte order of {@code zipContents} must be little-endian.
+     */
+    public static int findZipEndOfCentralDirectoryRecord(ByteBuffer zipContents) {
+        assertByteOrderLittleEndian(zipContents);
+
+        // ZIP End of Central Directory (EOCD) record is located at the very end of the ZIP archive.
+        // The record can be identified by its 4-byte signature/magic which is located at the very
+        // beginning of the record. A complication is that the record is variable-length because of
+        // the comment field.
+        // The algorithm for locating the ZIP EOCD record is as follows. We search backwards from
+        // end of the buffer for the EOCD record signature. Whenever we find a signature, we check
+        // the candidate record's comment length is such that the remainder of the record takes up
+        // exactly the remaining bytes in the buffer. The search is bounded because the maximum
+        // size of the comment field is 65535 bytes because the field is an unsigned 16-bit number.
+
+        int archiveSize = zipContents.capacity();
+        if (archiveSize < ZIP_EOCD_REC_MIN_SIZE) {
+            return -1;
+        }
+        int maxCommentLength = Math.min(archiveSize - ZIP_EOCD_REC_MIN_SIZE, UINT16_MAX_VALUE);
+        int eocdWithEmptyCommentStartPosition = archiveSize - ZIP_EOCD_REC_MIN_SIZE;
+        for (int expectedCommentLength = 0; expectedCommentLength < maxCommentLength; expectedCommentLength++) {
+            int eocdStartPos = eocdWithEmptyCommentStartPosition - expectedCommentLength;
+            if (zipContents.getInt(eocdStartPos) == ZIP_EOCD_REC_SIG) {
+                int actualCommentLength = getUnsignedInt16(zipContents, eocdStartPos + ZIP_EOCD_COMMENT_LENGTH_FIELD_OFFSET);
+                if (actualCommentLength == expectedCommentLength) {
+                    return eocdStartPos;
+                }
+            }
+        }
+
+        return -1;
+    }
+
+    /**
+     * Returns {@code true} if the provided buffer contains a ZIP64 End of Central Directory
+     * Locator.
+     *
+     * <p>NOTE: Byte order of {@code zipContents} must be little-endian.
+     */
+    public static boolean isZip64EndOfCentralDirectoryLocatorPresent(ByteBuffer zipContents, int zipEndOfCentralDirectoryPosition) {
+        assertByteOrderLittleEndian(zipContents);
+
+        // ZIP64 End of Central Directory Locator immediately precedes the ZIP End of Central
+        // Directory Record.
+
+        int locatorPosition = zipEndOfCentralDirectoryPosition - ZIP64_EOCD_LOCATOR_SIZE;
+        if (locatorPosition < 0) {
+            return false;
+        }
+
+        return zipContents.getInt(locatorPosition) == ZIP64_EOCD_LOCATOR_SIG;
+    }
+
+    /**
+     * Returns the offset of the start of the ZIP Central Directory in the archive.
+     *
+     * <p>NOTE: Byte order of {@code zipEndOfCentralDirectory} must be little-endian.
+     */
+    public static long getZipEocdCentralDirectoryOffset(ByteBuffer zipEndOfCentralDirectory) {
+        assertByteOrderLittleEndian(zipEndOfCentralDirectory);
+        return getUnsignedInt32(zipEndOfCentralDirectory, zipEndOfCentralDirectory.position() + ZIP_EOCD_CENTRAL_DIR_OFFSET_FIELD_OFFSET);
+    }
+
+    /**
+     * Sets the offset of the start of the ZIP Central Directory in the archive.
+     *
+     * <p>NOTE: Byte order of {@code zipEndOfCentralDirectory} must be little-endian.
+     */
+    public static void setZipEocdCentralDirectoryOffset(ByteBuffer zipEndOfCentralDirectory, long offset) {
+        assertByteOrderLittleEndian(zipEndOfCentralDirectory);
+        setUnsignedInt32(zipEndOfCentralDirectory, zipEndOfCentralDirectory.position() + ZIP_EOCD_CENTRAL_DIR_OFFSET_FIELD_OFFSET, offset);
+    }
+
+    /**
+     * Returns the size (in bytes) of the ZIP Central Directory.
+     *
+     * <p>NOTE: Byte order of {@code zipEndOfCentralDirectory} must be little-endian.
+     */
+    public static long getZipEocdCentralDirectorySizeBytes(ByteBuffer zipEndOfCentralDirectory) {
+        assertByteOrderLittleEndian(zipEndOfCentralDirectory);
+        return getUnsignedInt32(zipEndOfCentralDirectory, zipEndOfCentralDirectory.position() + ZIP_EOCD_CENTRAL_DIR_SIZE_FIELD_OFFSET);
+    }
+
+    private static void assertByteOrderLittleEndian(ByteBuffer buffer) {
+        if (buffer.order() != ByteOrder.LITTLE_ENDIAN) {
+            throw new IllegalArgumentException("ByteBuffer byte order must be little endian");
+        }
+    }
+
+    private static int getUnsignedInt16(ByteBuffer buffer, int offset) {
+        return buffer.getShort(offset) & 0xffff;
+    }
+
+    private static long getUnsignedInt32(ByteBuffer buffer, int offset) {
+        return buffer.getInt(offset) & 0xffffffffL;
+    }
+
+    private static void setUnsignedInt32(ByteBuffer buffer, int offset, long value) {
+        if ((value < 0) || (value > 0xffffffffL)) {
+            throw new IllegalArgumentException("uint32 value of out range: " + value);
+        }
+        buffer.putInt(buffer.position() + offset, (int) value);
+    }
+}

app/src/main/AndroidManifest.xml

@@ -6,8 +6,12 @@
     <uses-permission android:name="android.permission.INTERNET"/>
     <uses-permission android:name="android.permission.VIBRATE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission
+        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+        android:maxSdkVersion="28" />
 
     <application
+        android:icon="@drawable/ic_launcher"
         android:name="a.e"
         android:allowBackup="true"
         tools:ignore="UnusedAttribute,GoogleAppIndexingWarning">
@@ -29,16 +33,12 @@
         <!-- Main -->
         <activity android:name="a.b" />
 
-        <!-- Flashing  -->
-        <activity android:name="a.f" />
-
         <!-- Superuser -->
         <activity
             android:name="a.m"
             android:directBootAware="true"
             android:excludeFromRecents="true"
             android:exported="false"
-            android:theme="@android:style/Theme.Translucent.NoTitleBar"
             tools:ignore="AppLinkUrlError">
             <intent-filter>
                 <action android:name="android.intent.action.VIEW"/>

app/src/main/java/a/a.java

@@ -1,10 +0,0 @@
-package a;
-
-import com.topjohnwu.signing.BootSigner;
-
-public class a {
-
-    public static void main(String[] args) throws Exception {
-        BootSigner.main(args);
-    }
-}

app/src/main/java/a/stubs.kt

@@ -1,12 +1,17 @@
+@file:JvmName("a")
 package a
 
 import com.topjohnwu.magisk.core.App
 import com.topjohnwu.magisk.core.GeneralReceiver
 import com.topjohnwu.magisk.core.SplashActivity
 import com.topjohnwu.magisk.core.download.DownloadService
-import com.topjohnwu.magisk.legacy.flash.FlashActivity
-import com.topjohnwu.magisk.legacy.surequest.SuRequestActivity
 import com.topjohnwu.magisk.ui.MainActivity
+import com.topjohnwu.magisk.ui.surequest.SuRequestActivity
+import com.topjohnwu.signing.BootSigner
+
+fun main(args: Array<String>) {
+    BootSigner.main(args)
+}
 
 class b : MainActivity()
 
@@ -17,8 +22,6 @@ class e : App {
     constructor(o: Any) : super(o)
 }
 
-class f : FlashActivity()
-
 class h : GeneralReceiver()
 
 class j : DownloadService()

app/src/main/java/com/topjohnwu/magisk/arch/BaseUIActivity.kt

@@ -0,0 +1,113 @@
+package com.topjohnwu.magisk.arch
+
+import android.content.Intent
+import android.os.Bundle
+import android.view.KeyEvent
+import android.view.View
+import androidx.appcompat.app.AppCompatDelegate
+import androidx.core.content.res.use
+import androidx.databinding.DataBindingUtil
+import androidx.databinding.ViewDataBinding
+import androidx.lifecycle.MutableLiveData
+import androidx.navigation.NavController
+import androidx.navigation.NavDirections
+import androidx.navigation.fragment.NavHostFragment
+import com.topjohnwu.magisk.BR
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.base.BaseActivity
+import com.topjohnwu.magisk.ui.theme.Theme
+
+abstract class BaseUIActivity<VM : BaseViewModel, Binding : ViewDataBinding> :
+    BaseActivity(), BaseUIComponent<VM> {
+
+    protected lateinit var binding: Binding
+    protected abstract val layoutRes: Int
+    protected open val themeRes: Int = Theme.selected.themeRes
+
+    private val navHostFragment by lazy {
+        supportFragmentManager.findFragmentById(navHost) as? NavHostFragment
+    }
+    private val topFragment get() = navHostFragment?.childFragmentManager?.fragments?.getOrNull(0)
+    protected val currentFragment get() = topFragment as? BaseUIFragment<*, *>
+
+    override val viewRoot: View get() = binding.root
+    open val navigation: NavController? get() = navHostFragment?.navController
+
+    open val navHost: Int = 0
+    open val snackbarView get() = binding.root
+
+    init {
+        val theme = Config.darkTheme
+        AppCompatDelegate.setDefaultNightMode(theme)
+    }
+
+    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
+        super.onActivityResult(requestCode, resultCode, data)
+        currentFragment?.onActivityResult(requestCode, resultCode, data)
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        setTheme(themeRes)
+        super.onCreate(savedInstanceState)
+
+        startObserveEvents()
+
+        // We need to set the window background explicitly since for whatever reason it's not
+        // propagated upstream
+        obtainStyledAttributes(intArrayOf(android.R.attr.windowBackground))
+            .use { it.getDrawable(0) }
+            .also { window.setBackgroundDrawable(it) }
+
+        directionsDispatcher.observe(this) {
+            it?.navigate()
+            // we don't want the directions to be re-dispatched, so we preemptively set them to null
+            if (it != null) {
+                directionsDispatcher.value = null
+            }
+        }
+    }
+
+    fun setContentView() {
+        binding = DataBindingUtil.setContentView<Binding>(this, layoutRes).also {
+            it.setVariable(BR.viewModel, viewModel)
+            it.lifecycleOwner = this
+        }
+
+        ensureInsets()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        viewModel.requestRefresh()
+    }
+
+    override fun dispatchKeyEvent(event: KeyEvent): Boolean {
+        return currentFragment?.onKeyEvent(event) == true || super.dispatchKeyEvent(event)
+    }
+
+    override fun onEventDispatched(event: ViewEvent) = when(event) {
+        is ContextExecutor -> event(this)
+        is ActivityExecutor -> event(this)
+        else -> Unit
+    }
+
+    override fun onBackPressed() {
+        if (navigation == null || currentFragment?.onBackPressed()?.not() == true) {
+            super.onBackPressed()
+        }
+    }
+
+    fun NavDirections.navigate() {
+        navigation?.navigate(this)
+    }
+
+    companion object {
+
+        private val directionsDispatcher = MutableLiveData<NavDirections?>()
+
+        fun postDirections(navDirections: NavDirections) =
+            directionsDispatcher.postValue(navDirections)
+
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/BaseUIComponent.kt

@@ -0,0 +1,63 @@
+package com.topjohnwu.magisk.arch
+
+import android.view.View
+import androidx.core.graphics.Insets
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.lifecycle.LifecycleOwner
+
+interface BaseUIComponent<VM : BaseViewModel>: LifecycleOwner {
+
+    val viewRoot: View
+    val viewModel: VM
+
+    fun startObserveEvents() {
+        viewModel.viewEvents.observe(this) {
+            onEventDispatched(it)
+        }
+    }
+
+    fun consumeSystemWindowInsets(insets: Insets): Insets? = null
+
+    /**
+     * Called for all [ViewEvent]s published by associated viewModel.
+     */
+    fun onEventDispatched(event: ViewEvent) {}
+
+    fun ensureInsets() {
+        ViewCompat.setOnApplyWindowInsetsListener(viewRoot) { _, insets ->
+            insets.asInsets()
+                .also { viewModel.insets = it }
+                .let { consumeSystemWindowInsets(it) }
+                ?.subtractBy(insets) ?: insets
+        }
+        if (ViewCompat.isAttachedToWindow(viewRoot)) {
+            ViewCompat.requestApplyInsets(viewRoot)
+        } else {
+            viewRoot.addOnAttachStateChangeListener(object : View.OnAttachStateChangeListener {
+                override fun onViewDetachedFromWindow(v: View) = Unit
+                override fun onViewAttachedToWindow(v: View) {
+                    ViewCompat.requestApplyInsets(v)
+                }
+            })
+        }
+    }
+
+    private fun WindowInsetsCompat.asInsets() = Insets.of(
+        systemWindowInsetLeft,
+        systemWindowInsetTop,
+        systemWindowInsetRight,
+        systemWindowInsetBottom
+    )
+
+    private fun Insets.subtractBy(insets: WindowInsetsCompat) =
+        WindowInsetsCompat.Builder(insets).setSystemWindowInsets(
+            Insets.of(
+                insets.systemWindowInsetLeft - left,
+                insets.systemWindowInsetTop - top,
+                insets.systemWindowInsetRight - right,
+                insets.systemWindowInsetBottom - bottom
+            )
+        ).build()
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/BaseUIFragment.kt

@@ -1,6 +1,7 @@
-package com.topjohnwu.magisk.ui.base
+package com.topjohnwu.magisk.arch
 
 import android.os.Bundle
+import android.view.KeyEvent
 import android.view.LayoutInflater
 import android.view.View
 import android.view.ViewGroup
@@ -9,27 +10,25 @@ import androidx.databinding.DataBindingUtil
 import androidx.databinding.OnRebindCallback
 import androidx.databinding.ViewDataBinding
 import androidx.fragment.app.Fragment
+import androidx.navigation.NavDirections
 import com.topjohnwu.magisk.BR
-import com.topjohnwu.magisk.extensions.startAnimations
-import com.topjohnwu.magisk.model.events.EventHandler
-import com.topjohnwu.magisk.model.events.ViewEvent
+import com.topjohnwu.magisk.ktx.startAnimations
 
-abstract class BaseUIFragment<ViewModel : BaseViewModel, Binding : ViewDataBinding> :
-    Fragment(), CompatView<ViewModel>, EventHandler {
+abstract class BaseUIFragment<VM : BaseViewModel, Binding : ViewDataBinding> :
+    Fragment(), BaseUIComponent<VM> {
 
     protected val activity get() = requireActivity() as BaseUIActivity<*, *>
     protected lateinit var binding: Binding
     protected abstract val layoutRes: Int
 
     override val viewRoot: View get() = binding.root
-    override val navigation by lazy { activity.navigation }
-    private val delegate by lazy { CompatDelegate(this) }
+    private val navigation get() = activity.navigation
 
     override fun consumeSystemWindowInsets(insets: Insets) = insets
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        viewModel.viewEvents.observe(this, viewEventObserver)
+        startObserveEvents()
     }
 
     override fun onCreateView(
@@ -37,17 +36,22 @@ abstract class BaseUIFragment<ViewModel : BaseViewModel, Binding : ViewDataBindi
         container: ViewGroup?,
         savedInstanceState: Bundle?
     ): View? {
-        binding = DataBindingUtil.inflate<Binding>(inflater, layoutRes, container, false).apply {
-            setVariable(BR.viewModel, viewModel)
-            lifecycleOwner = this@BaseUIFragment
+        binding = DataBindingUtil.inflate<Binding>(inflater, layoutRes, container, false).also {
+            it.setVariable(BR.viewModel, viewModel)
+            it.lifecycleOwner = this
         }
-
         return binding.root
     }
 
-    override fun onEventDispatched(event: ViewEvent) {
-        super.onEventDispatched(event)
-        delegate.onEventExecute(event, this)
+    override fun onEventDispatched(event: ViewEvent) = when(event) {
+        is ContextExecutor -> event(requireContext())
+        is ActivityExecutor -> event(activity)
+        is FragmentExecutor -> event(this)
+        else -> Unit
+    }
+
+    open fun onKeyEvent(event: KeyEvent): Boolean {
+        return false
     }
 
     open fun onBackPressed(): Boolean = false
@@ -55,27 +59,32 @@ abstract class BaseUIFragment<ViewModel : BaseViewModel, Binding : ViewDataBindi
 
     override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
         super.onViewCreated(view, savedInstanceState)
-
         binding.addOnRebindCallback(object : OnRebindCallback<Binding>() {
             override fun onPreBind(binding: Binding): Boolean {
                 this@BaseUIFragment.onPreBind(binding)
                 return true
             }
         })
-
-        delegate.onCreate()
+        ensureInsets()
     }
 
     override fun onResume() {
         super.onResume()
-
-        delegate.onResume()
+        viewModel.requestRefresh()
     }
 
     protected open fun onPreBind(binding: Binding) {
         (binding.root as? ViewGroup)?.startAnimations()
     }
 
-    protected fun ViewEvent.dispatchOnSelf() = delegate.onEventExecute(this, this@BaseUIFragment)
+    fun NavDirections.navigate() {
+        navigation?.navigate(this)
+    }
+
+}
+
+interface ReselectionTarget {
+
+    fun onReselected()
 
 }

app/src/main/java/com/topjohnwu/magisk/arch/BaseViewModel.kt

@@ -0,0 +1,114 @@
+package com.topjohnwu.magisk.arch
+
+import android.Manifest
+import android.os.Build
+import androidx.annotation.CallSuper
+import androidx.core.graphics.Insets
+import androidx.databinding.Bindable
+import androidx.databinding.Observable
+import androidx.databinding.PropertyChangeRegistry
+import androidx.lifecycle.LiveData
+import androidx.lifecycle.MutableLiveData
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import androidx.navigation.NavDirections
+import com.topjohnwu.magisk.BR
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.base.BaseActivity
+import com.topjohnwu.magisk.events.*
+import com.topjohnwu.magisk.utils.ObservableHost
+import com.topjohnwu.magisk.utils.set
+import kotlinx.coroutines.Job
+import org.koin.core.KoinComponent
+
+abstract class BaseViewModel(
+    initialState: State = State.LOADING
+) : ViewModel(), ObservableHost, KoinComponent {
+
+    override var callbacks: PropertyChangeRegistry? = null
+
+    enum class State {
+        LOADED, LOADING, LOADING_FAILED
+    }
+
+    @get:Bindable
+    val loading get() = state == State.LOADING
+    @get:Bindable
+    val loaded get() = state == State.LOADED
+    @get:Bindable
+    val loadFailed get() = state == State.LOADING_FAILED
+
+    val isConnected get() = Info.isConnected
+    val viewEvents: LiveData<ViewEvent> get() = _viewEvents
+
+    @get:Bindable
+    var insets = Insets.NONE
+        set(value) = set(value, field, { field = it }, BR.insets)
+
+    var state= initialState
+        set(value) = set(value, field, { field = it }, BR.loading, BR.loaded, BR.loadFailed)
+
+    private val _viewEvents = MutableLiveData<ViewEvent>()
+    private var runningJob: Job? = null
+    private val refreshCallback = object : Observable.OnPropertyChangedCallback() {
+        override fun onPropertyChanged(sender: Observable?, propertyId: Int) {
+            requestRefresh()
+        }
+    }
+
+    init {
+        isConnected.addOnPropertyChangedCallback(refreshCallback)
+    }
+
+    /** This should probably never be called manually, it's called manually via delegate. */
+    @Synchronized
+    fun requestRefresh() {
+        if (runningJob?.isActive == true) {
+            return
+        }
+        runningJob = refresh()
+    }
+
+    protected open fun refresh(): Job? = null
+
+    @CallSuper
+    override fun onCleared() {
+        isConnected.removeOnPropertyChangedCallback(refreshCallback)
+        super.onCleared()
+    }
+
+    fun withView(action: BaseActivity.() -> Unit) {
+        ViewActionEvent(action).publish()
+    }
+
+    fun withPermission(permission: String, callback: (Boolean) -> Unit) {
+        PermissionEvent(permission, callback).publish()
+    }
+
+    fun withExternalRW(callback: () -> Unit) {
+        withPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE) {
+            if (!it) {
+                SnackbarEvent(R.string.external_rw_permission_denied).publish()
+            } else {
+                callback()
+            }
+        }
+    }
+
+    fun back() = BackPressEvent().publish()
+
+    fun <Event : ViewEvent> Event.publish() {
+        _viewEvents.postValue(this)
+    }
+
+    fun <Event : ViewEventWithScope> Event.publish() {
+        scope = viewModelScope
+        _viewEvents.postValue(this)
+    }
+
+    fun NavDirections.publish() {
+        _viewEvents.postValue(NavigationEvent(this))
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/arch/Helpers.kt

@@ -1,7 +1,8 @@
-package com.topjohnwu.magisk.ui.base
+package com.topjohnwu.magisk.arch
 
 import androidx.databinding.ViewDataBinding
 import com.topjohnwu.magisk.databinding.ComparableRvItem
+import com.topjohnwu.magisk.databinding.RvItem
 import com.topjohnwu.magisk.utils.DiffObservableList
 import com.topjohnwu.magisk.utils.FilterableDiffObservableList
 import me.tatarka.bindingcollectionadapter2.BindingRecyclerViewAdapter
@@ -26,7 +27,7 @@ inline fun <T : ComparableRvItem<*>> filterableListOf(
     override fun areContentsTheSame(oldItem: T, newItem: T) = oldItem.genericContentSameAs(newItem)
 }).also { it.update(newItems.toList()) }
 
-fun <T : ComparableRvItem<*>> adapterOf() = object : BindingRecyclerViewAdapter<T>() {
+fun <T : RvItem> adapterOf() = object : BindingRecyclerViewAdapter<T>() {
     override fun onBindBinding(
         binding: ViewDataBinding,
         variableId: Int,
@@ -39,7 +40,7 @@ fun <T : ComparableRvItem<*>> adapterOf() = object : BindingRecyclerViewAdapter<
     }
 }
 
-inline fun <T : ComparableRvItem<*>> itemBindingOf(
+inline fun <T : RvItem> itemBindingOf(
     crossinline body: (ItemBinding<*>) -> Unit = {}
 ) = OnItemBind<T> { itemBinding, _, item ->
     item.bind(itemBinding)

app/src/main/java/com/topjohnwu/magisk/arch/Queryable.kt

@@ -0,0 +1,17 @@
+package com.topjohnwu.magisk.arch
+
+import android.os.Handler
+import androidx.core.os.postDelayed
+import com.topjohnwu.superuser.internal.UiThreadHandler
+
+interface Queryable {
+
+    val queryDelay: Long
+    val queryHandler: Handler get() = UiThreadHandler.handler
+
+    fun submitQuery() {
+        queryHandler.postDelayed(queryDelay) { query() }
+    }
+
+    fun query()
+}

app/src/main/java/com/topjohnwu/magisk/arch/ViewEvent.kt

@@ -0,0 +1,27 @@
+package com.topjohnwu.magisk.arch
+
+import android.content.Context
+import androidx.fragment.app.Fragment
+import kotlinx.coroutines.CoroutineScope
+
+/**
+ * Class for passing events from ViewModels to Activities/Fragments
+ * (see https://medium.com/google-developers/livedata-with-snackbar-navigation-and-other-events-the-singleliveevent-case-ac2622673150)
+ */
+abstract class ViewEvent
+
+abstract class ViewEventWithScope: ViewEvent() {
+    lateinit var scope: CoroutineScope
+}
+
+interface ContextExecutor {
+    operator fun invoke(context: Context)
+}
+
+interface ActivityExecutor {
+    operator fun invoke(activity: BaseUIActivity<*, *>)
+}
+
+interface FragmentExecutor {
+    operator fun invoke(fragment: Fragment)
+}

app/src/main/java/com/topjohnwu/magisk/core/App.kt

@@ -1,8 +1,10 @@
 package com.topjohnwu.magisk.core
 
+import android.app.Activity
 import android.app.Application
 import android.content.Context
 import android.content.res.Configuration
+import android.os.Bundle
 import androidx.appcompat.app.AppCompatDelegate
 import androidx.multidex.MultiDex
 import androidx.work.WorkManager
@@ -10,12 +12,11 @@ import com.topjohnwu.magisk.BuildConfig
 import com.topjohnwu.magisk.DynAPK
 import com.topjohnwu.magisk.FileProvider
 import com.topjohnwu.magisk.core.su.SuCallbackHandler
+import com.topjohnwu.magisk.core.utils.IODispatcherExecutor
 import com.topjohnwu.magisk.core.utils.RootInit
 import com.topjohnwu.magisk.core.utils.updateConfig
-import com.topjohnwu.magisk.di.ActivityTracker
 import com.topjohnwu.magisk.di.koinModules
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.unwrap
+import com.topjohnwu.magisk.ktx.unwrap
 import com.topjohnwu.superuser.Shell
 import org.koin.android.ext.koin.androidContext
 import org.koin.core.context.startKoin
@@ -30,10 +31,11 @@ open class App() : Application() {
 
     init {
         AppCompatDelegate.setCompatVectorFromResourcesEnabled(true)
-        Shell.Config.setFlags(Shell.FLAG_MOUNT_MASTER or Shell.FLAG_USE_MAGISK_BUSYBOX)
-        Shell.Config.verboseLogging(BuildConfig.DEBUG)
-        Shell.Config.addInitializers(RootInit::class.java)
-        Shell.Config.setTimeout(2)
+        Shell.setDefaultBuilder(Shell.Builder.create()
+            .setFlags(Shell.FLAG_MOUNT_MASTER)
+            .setInitializers(RootInit::class.java)
+            .setTimeout(2))
+        Shell.EXECUTOR = IODispatcherExecutor()
         FileProvider.callHandler = SuCallbackHandler
 
         // Always log full stack trace with Timber
@@ -68,7 +70,7 @@ open class App() : Application() {
             modules(koinModules)
         }
         ResMgr.init(impl)
-        app.registerActivityLifecycleCallbacks(get<ActivityTracker>())
+        app.registerActivityLifecycleCallbacks(ForegroundTracker)
         WorkManager.initialize(impl.wrapJob(), androidx.work.Configuration.Builder().build())
     }
 
@@ -83,3 +85,25 @@ open class App() : Application() {
             super.onConfigurationChanged(newConfig)
     }
 }
+
+object ForegroundTracker : Application.ActivityLifecycleCallbacks {
+
+    @Volatile
+    var foreground: Activity? = null
+
+    val hasForeground get() = foreground != null
+
+    override fun onActivityResumed(activity: Activity) {
+        foreground = activity
+    }
+
+    override fun onActivityPaused(activity: Activity) {
+        foreground = null
+    }
+
+    override fun onActivityCreated(activity: Activity, bundle: Bundle?) {}
+    override fun onActivityStarted(activity: Activity) {}
+    override fun onActivityStopped(activity: Activity) {}
+    override fun onActivitySaveInstanceState(activity: Activity, bundle: Bundle) {}
+    override fun onActivityDestroyed(activity: Activity) {}
+}

app/src/main/java/com/topjohnwu/magisk/core/Config.kt

@@ -2,7 +2,6 @@ package com.topjohnwu.magisk.core
 
 import android.content.Context
 import android.content.SharedPreferences
-import android.os.Environment
 import android.util.Xml
 import androidx.appcompat.app.AppCompatDelegate
 import androidx.core.content.edit
@@ -10,12 +9,13 @@ import com.topjohnwu.magisk.BuildConfig
 import com.topjohnwu.magisk.core.magiskdb.SettingsDao
 import com.topjohnwu.magisk.core.magiskdb.StringDao
 import com.topjohnwu.magisk.core.utils.BiometricHelper
-import com.topjohnwu.magisk.core.utils.Utils
+import com.topjohnwu.magisk.core.utils.defaultLocale
+import com.topjohnwu.magisk.core.utils.refreshLocale
+import com.topjohnwu.magisk.data.preference.PreferenceModel
 import com.topjohnwu.magisk.data.repository.DBConfig
 import com.topjohnwu.magisk.di.Protected
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.inject
-import com.topjohnwu.magisk.model.preference.PreferenceModel
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.inject
 import com.topjohnwu.magisk.ui.theme.Theme
 import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.io.SuFile
@@ -47,20 +47,18 @@ object Config : PreferenceModel, DBConfig {
         const val UPDATE_CHANNEL = "update_channel"
         const val CUSTOM_CHANNEL = "custom_channel"
         const val LOCALE = "locale"
-        const val DARK_THEME = "dark_theme"
-        const val DARK_THEME_EXTENDED = "dark_theme_extended"
+        const val DARK_THEME = "dark_theme_extended"
         const val REPO_ORDER = "repo_order"
         const val SHOW_SYSTEM_APP = "show_system"
-        const val DOWNLOAD_PATH = "download_path"
-        const val REDESIGN = "redesign"
+        const val DOWNLOAD_DIR = "download_dir"
         const val SAFETY = "safety_notice"
         const val THEME_ORDINAL = "theme_ordinal"
         const val BOOT_ID = "boot_id"
-        const val LIST_SPAN_COUNT = "column_count"
+        const val ASKED_HOME = "asked_home"
+        const val DOH = "doh"
 
         // system state
         const val MAGISKHIDE = "magiskhide"
-        const val COREONLY = "disable"
     }
 
     object Value {
@@ -70,7 +68,6 @@ object Config : PreferenceModel, DBConfig {
         const val BETA_CHANNEL = 1
         const val CUSTOM_CHANNEL = 2
         const val CANARY_CHANNEL = 3
-        const val CANARY_DEBUG_CHANNEL = 4
 
         // root access mode
         const val ROOT_ACCESS_DISABLED = 0
@@ -106,16 +103,19 @@ object Config : PreferenceModel, DBConfig {
     }
 
     private val defaultChannel =
-        if (isCanaryVersion) {
-            if (BuildConfig.DEBUG)
-                Value.CANARY_DEBUG_CHANNEL
-            else
-                Value.CANARY_CHANNEL
-        } else Value.DEFAULT_CHANNEL
+        if (BuildConfig.DEBUG)
+            Value.CANARY_CHANNEL
+        else
+            Value.DEFAULT_CHANNEL
+
+    @JvmStatic var keepVerity = false
+    @JvmStatic var keepEnc = false
+    @JvmStatic var recovery = false
 
     var bootId by preference(Key.BOOT_ID, "")
+    var askedHome by preference(Key.ASKED_HOME, false)
 
-    var downloadPath by preference(Key.DOWNLOAD_PATH, Environment.DIRECTORY_DOWNLOADS)
+    var downloadDir by preference(Key.DOWNLOAD_DIR, "")
     var repoOrder by preference(Key.REPO_ORDER, Value.ORDER_DATE)
 
     var suDefaultTimeout by preferenceStrInt(Key.SU_REQUEST_TIMEOUT, 10)
@@ -124,22 +124,22 @@ object Config : PreferenceModel, DBConfig {
     var updateChannel by preferenceStrInt(Key.UPDATE_CHANNEL, defaultChannel)
 
     var safetyNotice by preference(Key.SAFETY, true)
-    var darkThemeExtended by preference(
-        Key.DARK_THEME_EXTENDED,
-        AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM
-    )
+    var darkTheme by preference(Key.DARK_THEME, AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
     var themeOrdinal by preference(Key.THEME_ORDINAL, Theme.Piplup.ordinal)
     var suReAuth by preference(Key.SU_REAUTH, false)
     var checkUpdate by preference(Key.CHECK_UPDATES, true)
+    var doh by preference(Key.DOH, defaultLocale.country == "CN")
     var magiskHide by preference(Key.MAGISKHIDE, true)
-    @JvmStatic
-    var coreOnly by preference(Key.COREONLY, false)
     var showSystemApp by preference(Key.SHOW_SYSTEM_APP, false)
-    @JvmStatic
-    var listSpanCount by preference(Key.LIST_SPAN_COUNT, 1)
 
     var customChannelUrl by preference(Key.CUSTOM_CHANNEL, "")
-    var locale by preference(Key.LOCALE, "")
+    private var localePrefs by preference(Key.LOCALE, "")
+    var locale
+        get() = localePrefs
+        set(value) {
+            localePrefs = value
+            refreshLocale()
+        }
 
     var rootMode by dbSettings(Key.ROOT_ACCESS, Value.ROOT_ACCESS_APPS_AND_ADB)
     var suMntNamespaceMode by dbSettings(Key.SU_MNT_NS, Value.NAMESPACE_MODE_REQUESTER)
@@ -148,39 +148,33 @@ object Config : PreferenceModel, DBConfig {
     var suManager by dbStrings(Key.SU_MANAGER, "", true)
     var keyStoreRaw by dbStrings(Key.KEYSTORE, "", true)
 
-    // Always return a path in external storage where we can write
-    val downloadDirectory get() =
-        Utils.ensureDownloadPath(downloadPath) ?: get<Context>().getExternalFilesDir(null)!!
-
     private const val SU_FINGERPRINT = "su_fingerprint"
 
-    fun initialize() = prefs.also {
-        if (it.getBoolean(SU_FINGERPRINT, false)) {
-            suBiometric = true
+    fun initialize() {
+        prefs.edit { parsePrefs() }
+
+        prefs.edit {
+            // Settings migration
+            if (prefs.getBoolean(SU_FINGERPRINT, false))
+                suBiometric = true
+            remove(SU_FINGERPRINT)
+            prefs.getString(Key.UPDATE_CHANNEL, null).also {
+                if (it == null)
+                    putString(Key.UPDATE_CHANNEL, defaultChannel.toString())
+                else if (it.toInt() > Value.CANARY_CHANNEL)
+                    putString(Key.UPDATE_CHANNEL, Value.CANARY_CHANNEL.toString())
+            }
+
+            // Write database configs
+            putString(Key.ROOT_ACCESS, rootMode.toString())
+            putString(Key.SU_MNT_NS, suMntNamespaceMode.toString())
+            putString(Key.SU_MULTIUSER_MODE, suMultiuserMode.toString())
+            putBoolean(Key.SU_BIOMETRIC, BiometricHelper.isEnabled)
         }
-    }.edit {
-        parsePrefs(this)
-
-        // Legacy stuff
-        remove(SU_FINGERPRINT)
-
-        // Get actual state
-        putBoolean(Key.COREONLY, Const.MAGISK_DISABLE_FILE.exists())
-
-        // Write database configs
-        putString(Key.ROOT_ACCESS, rootMode.toString())
-        putString(Key.SU_MNT_NS, suMntNamespaceMode.toString())
-        putString(Key.SU_MULTIUSER_MODE, suMultiuserMode.toString())
-        putBoolean(Key.SU_BIOMETRIC, BiometricHelper.isEnabled)
-    }.also {
-        if (!prefs.contains(Key.UPDATE_CHANNEL))
-            prefs.edit().putString(Key.UPDATE_CHANNEL, defaultChannel.toString()).apply()
     }
 
-    private fun parsePrefs(editor: SharedPreferences.Editor) = editor.apply {
-        val config = SuFile.open("/data/adb",
-            Const.MANAGER_CONFIGS
-        )
+    private fun SharedPreferences.Editor.parsePrefs() {
+        val config = SuFile.open("/data/adb", Const.MANAGER_CONFIGS)
         if (config.exists()) runCatching {
             val input = SuFileInputStream(config)
             val parser = Xml.newPullParser()
@@ -232,7 +226,9 @@ object Config : PreferenceModel, DBConfig {
 
     fun export() {
         // Flush prefs to disk
-        prefs.edit().commit()
+        prefs.edit().apply {
+            remove(Key.ASKED_HOME)
+        }.commit()
         val context = get<Context>(Protected)
         val xml = File(
             "${context.filesDir.parent}/shared_prefs",

app/src/main/java/com/topjohnwu/magisk/core/Const.kt

@@ -1,19 +1,18 @@
 package com.topjohnwu.magisk.core
 
 import android.os.Process
-import java.io.File
 
 object Const {
 
     // Paths
-    const val MAGISK_PATH = "/sbin/.magisk/modules"
-    var MAGISK_DISABLE_FILE = File("xxx")
+    lateinit var MAGISKTMP: String
+    val MAGISK_PATH get() = "$MAGISKTMP/modules"
     const val TMP_FOLDER_PATH = "/dev/tmp"
     const val MAGISK_LOG = "/cache/magisk.log"
 
     // Versions
-    const val SNET_EXT_VER = 13
-    const val SNET_REVISION = "a6c47f86f10b310358afa9dbe837037dd5d561df"
+    const val SNET_EXT_VER = 15
+    const val SNET_REVISION = "d494bc726e86166913a13629e3b1336728ec5d7f"
     const val BOOTCTL_REVISION = "a6c47f86f10b310358afa9dbe837037dd5d561df"
 
     // Misc
@@ -25,8 +24,11 @@ object Const {
     object Version {
         const val MIN_VERSION = "v19.0"
         const val MIN_VERCODE = 19000
-        const val CONNECT_MODE = 20100
-        const val PROVIDER_CONNECT = 20102
+
+        fun atLeast_20_2() = Info.env.magiskVersionCode >= 20200 || isCanary()
+        fun atLeast_20_4() = Info.env.magiskVersionCode >= 20400 || isCanary()
+        fun atLeast_21_0() = Info.env.magiskVersionCode >= 21000 || isCanary()
+        fun isCanary() = Info.env.magiskVersionCode % 100 != 0
     }
 
     object ID {
@@ -45,14 +47,12 @@ object Const {
 
     object Url {
         const val ZIP_URL = "https://github.com/Magisk-Modules-Repo/%s/archive/master.zip"
-        const val PAYPAL_URL = "https://www.paypal.me/topjohnwu"
         const val PATREON_URL = "https://www.patreon.com/topjohnwu"
-        const val TWITTER_URL = "https://twitter.com/topjohnwu"
-        const val XDA_THREAD = "http://forum.xda-developers.com/showthread.php?t=3432382"
         const val SOURCE_CODE_URL = "https://github.com/topjohnwu/Magisk"
 
         const val GITHUB_RAW_URL = "https://raw.githubusercontent.com/"
         const val GITHUB_API_URL = "https://api.github.com/users/Magisk-Modules-Repo/"
+        const val GITHUB_PAGE_URL = "https://topjohnwu.github.io/magisk_files/"
     }
 
     object Key {
@@ -62,13 +62,6 @@ object Const {
         const val ETAG_KEY = "ETag"
         // intents
         const val OPEN_SECTION = "section"
-        const val OPEN_SETTINGS = "settings"
-        const val INTENT_SET_APP = "app_json"
-        const val FLASH_ACTION = "action"
-        const val FLASH_DATA = "additional_data"
-        const val DISMISS_ID = "dismiss_id"
-        const val BROADCAST_MANAGER_UPDATE = "manager_update"
-        const val BROADCAST_REBOOT = "reboot"
     }
 
     object Value {
@@ -79,4 +72,11 @@ object Const {
         const val UNINSTALL = "uninstall"
     }
 
+    object Nav {
+        const val HOME = "home"
+        const val SETTINGS = "settings"
+        const val HIDE = "hide"
+        const val MODULES = "modules"
+        const val SUPERUSER = "superuser"
+    }
 }

app/src/main/java/com/topjohnwu/magisk/core/GeneralReceiver.kt

@@ -3,15 +3,12 @@ package com.topjohnwu.magisk.core
 import android.content.ContextWrapper
 import android.content.Intent
 import com.topjohnwu.magisk.core.base.BaseReceiver
-import com.topjohnwu.magisk.core.download.DownloadService
 import com.topjohnwu.magisk.core.magiskdb.PolicyDao
-import com.topjohnwu.magisk.core.model.ManagerJson
 import com.topjohnwu.magisk.core.su.SuCallbackHandler
-import com.topjohnwu.magisk.core.view.Shortcuts
-import com.topjohnwu.magisk.extensions.reboot
-import com.topjohnwu.magisk.model.entity.internal.Configuration
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject
+import com.topjohnwu.magisk.view.Shortcuts
 import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
 import org.koin.core.inject
 
 open class GeneralReceiver : BaseReceiver() {
@@ -25,6 +22,10 @@ open class GeneralReceiver : BaseReceiver() {
     override fun onReceive(context: ContextWrapper, intent: Intent?) {
         intent ?: return
 
+        fun rmPolicy(pkg: String) = GlobalScope.launch {
+            policyDB.delete(pkg)
+        }
+
         when (intent.action ?: return) {
             Intent.ACTION_REBOOT -> {
                 SuCallbackHandler(context, intent.getStringExtra("action"), intent.extras)
@@ -32,23 +33,14 @@ open class GeneralReceiver : BaseReceiver() {
             Intent.ACTION_PACKAGE_REPLACED -> {
                 // This will only work pre-O
                 if (Config.suReAuth)
-                    policyDB.delete(getPkg(intent)).blockingGet()
+                    rmPolicy(getPkg(intent))
             }
             Intent.ACTION_PACKAGE_FULLY_REMOVED -> {
                 val pkg = getPkg(intent)
-                policyDB.delete(pkg).blockingGet()
+                rmPolicy(pkg)
                 Shell.su("magiskhide --rm $pkg").submit()
             }
-            Intent.ACTION_LOCALE_CHANGED -> Shortcuts.setup(context)
-            Const.Key.BROADCAST_MANAGER_UPDATE -> {
-                intent.getParcelableExtra<ManagerJson>(Const.Key.INTENT_SET_APP)?.let {
-                    Info.remote = Info.remote.copy(app = it)
-                }
-                DownloadService(context) {
-                    subject = DownloadSubject.Manager(Configuration.APK.Upgrade)
-                }
-            }
-            Const.Key.BROADCAST_REBOOT -> reboot()
+            Intent.ACTION_LOCALE_CHANGED -> Shortcuts.setupDynamic(context)
         }
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/Hacks.kt

@@ -3,6 +3,7 @@
 package com.topjohnwu.magisk.core
 
 import android.annotation.SuppressLint
+import android.app.Activity
 import android.app.job.JobInfo
 import android.app.job.JobScheduler
 import android.app.job.JobWorkItem
@@ -15,15 +16,13 @@ import android.content.res.Configuration
 import android.content.res.Resources
 import androidx.annotation.RequiresApi
 import com.topjohnwu.magisk.DynAPK
-import com.topjohnwu.magisk.ProcessPhoenix
 import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.download.DownloadService
 import com.topjohnwu.magisk.core.utils.refreshLocale
 import com.topjohnwu.magisk.core.utils.updateConfig
-import com.topjohnwu.magisk.extensions.forceGetDeclaredField
-import com.topjohnwu.magisk.legacy.flash.FlashActivity
-import com.topjohnwu.magisk.legacy.surequest.SuRequestActivity
+import com.topjohnwu.magisk.ktx.forceGetDeclaredField
 import com.topjohnwu.magisk.ui.MainActivity
+import com.topjohnwu.magisk.ui.surequest.SuRequestActivity
 
 fun AssetManager.addAssetPath(path: String) {
     DynAPK.addAssetPath(this, path)
@@ -54,6 +53,10 @@ fun Class<*>.cmp(pkg: String): ComponentName {
     return ComponentName(pkg, Info.stub?.classToComponent?.get(name) ?: name)
 }
 
+inline fun <reified T> Activity.redirect() = Intent(intent)
+    .setComponent(T::class.java.cmp(packageName))
+    .setFlags(0)
+
 inline fun <reified T> Context.intent() = Intent().setComponent(T::class.java.cmp(packageName))
 
 private open class GlobalResContext(base: Context) : ContextWrapper(base) {
@@ -132,7 +135,7 @@ private class JobSchedulerWrapper(private val base: JobScheduler) : JobScheduler
         val name = service.className
         val component = ComponentName(
             service.packageName,
-            Info.stub!!.classToComponent[name] ?: name
+            Info.stubChk.classToComponent[name] ?: name
         )
 
         javaClass.forceGetDeclaredField("service")?.set(this, component)
@@ -140,31 +143,31 @@ private class JobSchedulerWrapper(private val base: JobScheduler) : JobScheduler
     }
 }
 
-object ClassMap {
+private object ClassMap {
 
     private val map = mapOf(
         App::class.java to a.e::class.java,
         MainActivity::class.java to a.b::class.java,
         SplashActivity::class.java to a.c::class.java,
-        FlashActivity::class.java to a.f::class.java,
         GeneralReceiver::class.java to a.h::class.java,
         DownloadService::class.java to a.j::class.java,
-        SuRequestActivity::class.java to a.m::class.java,
-        ProcessPhoenix::class.java to a.r::class.java
+        SuRequestActivity::class.java to a.m::class.java
     )
 
     operator fun get(c: Class<*>) = map.getOrElse(c) { c }
 }
 
-/*
-* Keep a reference to these resources to prevent it from
-* being removed when running "remove unused resources" */
+// Keep a reference to these resources to prevent it from
+// being removed when running "remove unused resources"
 val shouldKeepResources = listOf(
-    /* TODO: The following strings should be used somewhere */
-    R.string.no_apps_found,
     R.string.no_info_provided,
     R.string.release_notes,
-    R.string.settings_download_path_error,
     R.string.invalid_update_channel,
-    R.string.update_available
+    R.string.update_available,
+    R.string.safetynet_api_error,
+    R.raw.changelog,
+    R.drawable.ic_device,
+    R.drawable.ic_hide_select_md2,
+    R.drawable.ic_more,
+    R.drawable.ic_magisk_delete
 )

app/src/main/java/com/topjohnwu/magisk/core/Info.kt

@@ -1,47 +1,47 @@
 package com.topjohnwu.magisk.core
 
-import com.github.pwittchen.reactivenetwork.library.rx2.ReactiveNetwork
-import com.topjohnwu.magisk.BuildConfig
+import androidx.databinding.ObservableBoolean
 import com.topjohnwu.magisk.DynAPK
 import com.topjohnwu.magisk.core.model.UpdateInfo
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.subscribeK
+import com.topjohnwu.magisk.core.utils.net.NetworkObserver
+import com.topjohnwu.magisk.ktx.get
 import com.topjohnwu.magisk.utils.CachedValue
-import com.topjohnwu.magisk.utils.KObservableField
 import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.ShellUtils.fastCmd
+import com.topjohnwu.superuser.internal.UiThreadHandler
 import java.io.FileInputStream
 import java.io.IOException
+import java.util.*
 
 val isRunningAsStub get() = Info.stub != null
-val isCanaryVersion = !BuildConfig.VERSION_NAME.contains(".")
 
 object Info {
 
     val envRef = CachedValue { loadState() }
 
-    @JvmStatic
-    val env by envRef              // Local
-    var remote = UpdateInfo()      // Remote
-    @JvmStatic
-    var stub: DynAPK.Data? = null  // Stub
+    @JvmStatic val env by envRef
 
-    // Toggle-able options
-    @JvmStatic var keepVerity = false
-    @JvmStatic var keepEnc = false
-    @JvmStatic var recovery = false
+    var stub: DynAPK.Data? = null
+    val stubChk: DynAPK.Data
+        get() = stub as DynAPK.Data
 
-    // Immutable device state
+    var remote = UpdateInfo()
+
+    // Device state
+    var crypto = ""
     @JvmStatic var isSAR = false
     @JvmStatic var isAB = false
+    @JvmStatic val isFDE get() = crypto == "block"
     @JvmStatic var ramdisk = false
+    @JvmStatic var hasGMS = true
+    @JvmStatic var isPixel = false
+    @JvmStatic val cryptoText get() = crypto.capitalize(Locale.US)
 
     val isConnected by lazy {
-        KObservableField(false).also { field ->
-            ReactiveNetwork.observeNetworkConnectivity(get())
-                .subscribeK {
-                    field.value = it.available()
-                }
+        ObservableBoolean(false).also { field ->
+            NetworkObserver.observe(get()) {
+                UiThreadHandler.run { field.set(it) }
+            }
         }
     }
 

app/src/main/java/com/topjohnwu/magisk/core/SplashActivity.kt

@@ -4,14 +4,16 @@ import android.app.Activity
 import android.content.Context
 import android.os.Bundle
 import com.topjohnwu.magisk.BuildConfig
-import com.topjohnwu.magisk.core.tasks.patchDTB
-import com.topjohnwu.magisk.core.utils.Utils
-import com.topjohnwu.magisk.core.view.Notifications
-import com.topjohnwu.magisk.core.view.Shortcuts
+import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.data.network.GithubRawServices
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.model.navigation.Navigation
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ui.MainActivity
+import com.topjohnwu.magisk.view.Notifications
+import com.topjohnwu.magisk.view.Shortcuts
 import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
 
 open class SplashActivity : Activity() {
 
@@ -20,8 +22,11 @@ open class SplashActivity : Activity() {
     }
 
     override fun onCreate(savedInstanceState: Bundle?) {
+        setTheme(R.style.SplashTheme)
         super.onCreate(savedInstanceState)
-        Shell.getShell { Shell.EXECUTOR.execute(this::initAndStart) }
+        GlobalScope.launch(Dispatchers.IO) {
+            initAndStart()
+        }
     }
 
     private fun handleRepackage() {
@@ -40,25 +45,25 @@ open class SplashActivity : Activity() {
     }
 
     private fun initAndStart() {
+        // Pre-initialize root shell
+        Shell.getShell()
+
         Config.initialize()
         handleRepackage()
         Notifications.setup(this)
-        Utils.scheduleUpdateCheck(this)
-        Shortcuts.setup(this)
-
-        // Patch DTB partitions if needed
-        patchDTB(this)
+        UpdateCheckService.schedule(this)
+        Shortcuts.setupDynamic(this)
 
         // Pre-fetch network stuffs
         get<GithubRawServices>()
 
         DONE = true
-        Navigation.start(intent, this)
+
+        redirect<MainActivity>().also { startActivity(it) }
         finish()
     }
 
     companion object {
-
         var DONE = false
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/UpdateCheckService.kt

@@ -1,31 +1,53 @@
 package com.topjohnwu.magisk.core
 
 import android.content.Context
-import androidx.work.Worker
-import androidx.work.WorkerParameters
+import androidx.work.*
 import com.topjohnwu.magisk.BuildConfig
-import com.topjohnwu.magisk.core.view.Notifications
 import com.topjohnwu.magisk.data.repository.MagiskRepository
-import com.topjohnwu.magisk.extensions.inject
+import com.topjohnwu.magisk.view.Notifications
 import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.koin.core.KoinComponent
+import org.koin.core.inject
+import java.util.concurrent.TimeUnit
 
 class UpdateCheckService(context: Context, workerParams: WorkerParameters)
-    : Worker(context, workerParams) {
+    : CoroutineWorker(context, workerParams), KoinComponent {
 
     private val magiskRepo: MagiskRepository by inject()
 
-    override fun doWork(): Result {
+    override suspend fun doWork(): Result {
         // Make sure shell initializer was ran
-        Shell.getShell()
-        return runCatching {
-            magiskRepo.fetchUpdate().blockingGet()
-            if (BuildConfig.VERSION_CODE < Info.remote.app.versionCode)
+        withContext(Dispatchers.IO) {
+            Shell.getShell()
+        }
+        return magiskRepo.fetchUpdate()?.let {
+            if (BuildConfig.VERSION_CODE < it.app.versionCode)
                 Notifications.managerUpdate(applicationContext)
-            else if (Info.env.magiskVersionCode < Info.remote.magisk.versionCode)
+            else if (Info.env.isActive && Info.env.magiskVersionCode < it.magisk.versionCode)
                 Notifications.magiskUpdate(applicationContext)
             Result.success()
-        }.getOrElse {
-            Result.failure()
+        } ?: Result.failure()
+    }
+
+    companion object {
+        fun schedule(context: Context) {
+            if (Config.checkUpdate) {
+                val constraints = Constraints.Builder()
+                    .setRequiredNetworkType(NetworkType.CONNECTED)
+                    .setRequiresDeviceIdle(true)
+                    .build()
+                val request = PeriodicWorkRequestBuilder<UpdateCheckService>(12, TimeUnit.HOURS)
+                    .setConstraints(constraints)
+                    .build()
+                WorkManager.getInstance(context).enqueueUniquePeriodicWork(
+                    Const.ID.CHECK_MAGISK_UPDATE_WORKER_ID,
+                    ExistingPeriodicWorkPolicy.REPLACE, request)
+            } else {
+                WorkManager.getInstance(context)
+                    .cancelUniqueWork(Const.ID.CHECK_MAGISK_UPDATE_WORKER_ID)
+            }
         }
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/base/BaseActivity.kt

@@ -1,18 +1,22 @@
 package com.topjohnwu.magisk.core.base
 
 import android.Manifest
+import android.content.ActivityNotFoundException
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.content.res.Configuration
+import android.os.Build
+import android.widget.Toast
 import androidx.appcompat.app.AppCompatActivity
 import androidx.collection.SparseArrayCompat
 import androidx.core.app.ActivityCompat
 import androidx.core.content.ContextCompat
+import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.utils.currentLocale
 import com.topjohnwu.magisk.core.wrap
-import com.topjohnwu.magisk.extensions.set
-import com.topjohnwu.magisk.model.permissions.PermissionRequestBuilder
+import com.topjohnwu.magisk.ktx.set
+import com.topjohnwu.magisk.utils.Utils
 import kotlin.random.Random
 
 typealias RequestCallback = BaseActivity.(Int, Intent?) -> Unit
@@ -31,13 +35,17 @@ abstract class BaseActivity : AppCompatActivity() {
         super.attachBaseContext(base.wrap(false))
     }
 
-    fun withPermissions(vararg permissions: String, builder: PermissionRequestBuilder.() -> Unit) {
+    fun withPermission(permission: String, builder: PermissionRequestBuilder.() -> Unit) {
         val request = PermissionRequestBuilder().apply(builder).build()
-        val ungranted = permissions.filter {
-            ContextCompat.checkSelfPermission(this, it) != PackageManager.PERMISSION_GRANTED
+
+        if (permission == Manifest.permission.WRITE_EXTERNAL_STORAGE &&
+            Build.VERSION.SDK_INT >= 29) {
+            // We do not need external rw on 29+
+            request.onSuccess()
+            return
         }
 
-        if (ungranted.isEmpty()) {
+        if (ContextCompat.checkSelfPermission(this, permission) == PackageManager.PERMISSION_GRANTED) {
             request.onSuccess()
         } else {
             val requestCode = Random.nextInt(256, 512)
@@ -47,12 +55,12 @@ abstract class BaseActivity : AppCompatActivity() {
                 else
                     request.onFailure()
             }
-            ActivityCompat.requestPermissions(this, ungranted.toTypedArray(), requestCode)
+            ActivityCompat.requestPermissions(this, arrayOf(permission), requestCode)
         }
     }
 
     fun withExternalRW(builder: PermissionRequestBuilder.() -> Unit) {
-        withPermissions(Manifest.permission.WRITE_EXTERNAL_STORAGE, builder = builder)
+        withPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE, builder = builder)
     }
 
     override fun onRequestPermissionsResult(
@@ -66,7 +74,7 @@ abstract class BaseActivity : AppCompatActivity() {
         }
         resultCallbacks[requestCode]?.also {
             resultCallbacks.remove(requestCode)
-            it(this@BaseActivity, if (success) 1 else -1, null)
+            it(this, if (success) 1 else -1, null)
         }
 
     }
@@ -75,17 +83,21 @@ abstract class BaseActivity : AppCompatActivity() {
         super.onActivityResult(requestCode, resultCode, data)
         resultCallbacks[requestCode]?.also {
             resultCallbacks.remove(requestCode)
-            it(this@BaseActivity, resultCode, data)
+            it(this, resultCode, data)
         }
     }
 
     fun startActivityForResult(intent: Intent, requestCode: Int, listener: RequestCallback) {
         resultCallbacks[requestCode] = listener
-        startActivityForResult(intent, requestCode)
+        try {
+            startActivityForResult(intent, requestCode)
+        } catch (e: ActivityNotFoundException) {
+            Utils.toast(R.string.app_not_found, Toast.LENGTH_SHORT)
+        }
     }
 
     override fun recreate() {
-        startActivity(intent)
+        startActivity(Intent().setComponent(intent.component))
         finish()
     }
 

app/src/main/java/com/topjohnwu/magisk/core/base/PermissionRequestBuilder.kt

@@ -1,4 +1,4 @@
-package com.topjohnwu.magisk.model.permissions
+package com.topjohnwu.magisk.core.base
 
 typealias SimpleCallback = () -> Unit
 typealias PermissionRationaleCallback = (List<String>) -> Unit
@@ -37,4 +37,4 @@ class PermissionRequest(
     fun onFailure() = onFailureCallback()
     fun onShowRationale(permissions: List<String>) = onShowRationaleCallback(permissions)
 
-}
+}

app/src/main/java/com/topjohnwu/magisk/core/download/Action.kt

@@ -1,12 +1,12 @@
-package com.topjohnwu.magisk.model.entity.internal
+package com.topjohnwu.magisk.core.download
 
 import android.net.Uri
 import android.os.Parcelable
 import kotlinx.android.parcel.Parcelize
 
-sealed class Configuration : Parcelable {
+sealed class Action : Parcelable {
 
-    sealed class Flash : Configuration() {
+    sealed class Flash : Action() {
 
         @Parcelize
         object Primary : Flash()
@@ -16,7 +16,7 @@ sealed class Configuration : Parcelable {
 
     }
 
-    sealed class APK : Configuration() {
+    sealed class APK : Action() {
 
         @Parcelize
         object Upgrade : APK()
@@ -26,15 +26,15 @@ sealed class Configuration : Parcelable {
     }
 
     @Parcelize
-    object Download : Configuration()
+    object Download : Action()
 
     @Parcelize
-    object Uninstall : Configuration()
+    object Uninstall : Action()
 
     @Parcelize
-    object EnvFix : Configuration()
+    object EnvFix : Action()
 
     @Parcelize
-    data class Patch(val fileUri: Uri) : Configuration()
+    data class Patch(val fileUri: Uri) : Action()
 
 }

app/src/main/java/com/topjohnwu/magisk/core/download/BaseDownloader.kt

@@ -0,0 +1,204 @@
+package com.topjohnwu.magisk.core.download
+
+import android.app.Notification
+import android.content.Intent
+import android.os.IBinder
+import androidx.lifecycle.LifecycleOwner
+import androidx.lifecycle.MutableLiveData
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.ForegroundTracker
+import com.topjohnwu.magisk.core.base.BaseService
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.checkSum
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.outputStream
+import com.topjohnwu.magisk.core.utils.ProgressInputStream
+import com.topjohnwu.magisk.data.network.GithubRawServices
+import com.topjohnwu.magisk.ktx.withStreams
+import com.topjohnwu.magisk.view.Notifications
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.launch
+import okhttp3.ResponseBody
+import org.koin.android.ext.android.inject
+import org.koin.core.KoinComponent
+import timber.log.Timber
+import java.io.IOException
+import java.io.InputStream
+import java.util.*
+import kotlin.collections.HashMap
+import kotlin.random.Random.Default.nextInt
+
+abstract class BaseDownloader : BaseService(), KoinComponent {
+
+    private val hasNotifications get() = notifications.isNotEmpty()
+    private val notifications = Collections.synchronizedMap(HashMap<Int, Notification.Builder>())
+    private val coroutineScope = CoroutineScope(Dispatchers.IO)
+
+    val service: GithubRawServices by inject()
+
+    // -- Service overrides
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onStartCommand(intent: Intent, flags: Int, startId: Int): Int {
+        intent.getParcelableExtra<Subject>(ACTION_KEY)?.let { subject ->
+            update(subject.notifyID())
+            coroutineScope.launch {
+                try {
+                    subject.startDownload()
+                } catch (e: IOException) {
+                    Timber.e(e)
+                    notifyFail(subject)
+                }
+            }
+        }
+        return START_REDELIVER_INTENT
+    }
+
+    override fun onTaskRemoved(rootIntent: Intent?) {
+        super.onTaskRemoved(rootIntent)
+        notifications.forEach { cancel(it.key) }
+        notifications.clear()
+    }
+
+    override fun onDestroy() {
+        super.onDestroy()
+        coroutineScope.cancel()
+    }
+
+    // -- Download logic
+
+    private suspend fun Subject.startDownload() {
+        val skip = this is Subject.Magisk && file.checkSum("MD5", magisk.md5)
+        if (!skip) {
+            val stream = service.fetchFile(url).toProgressStream(this)
+            when (this) {
+                is Subject.Module ->  // Download and process on-the-fly
+                    stream.toModule(file, service.fetchInstaller().byteStream())
+                else -> {
+                    withStreams(stream, file.outputStream()) { it, out -> it.copyTo(out) }
+                    if (this is Subject.Manager)
+                        handleAPK(this)
+                }
+            }
+        }
+        val newId = notifyFinish(this)
+        if (ForegroundTracker.hasForeground)
+            onFinish(this, newId)
+        if (!hasNotifications)
+            stopSelf()
+    }
+
+    private fun ResponseBody.toProgressStream(subject: Subject): InputStream {
+        val max = contentLength()
+        val total = max.toFloat() / 1048576
+        val id = subject.notifyID()
+
+        update(id) { it.setContentTitle(subject.title) }
+
+        return ProgressInputStream(byteStream()) {
+            val progress = it.toFloat() / 1048576
+            update(id) { notification ->
+                if (max > 0) {
+                    broadcast(progress / total, subject)
+                    notification
+                        .setProgress(max.toInt(), it.toInt(), false)
+                        .setContentText("%.2f / %.2f MB".format(progress, total))
+                } else {
+                    broadcast(-1f, subject)
+                    notification.setContentText("%.2f MB / ??".format(progress))
+                }
+            }
+        }
+    }
+
+    // --- Notification managements
+
+    fun Subject.notifyID() = hashCode()
+
+    private fun notifyFail(subject: Subject) = lastNotify(subject.notifyID()) {
+        broadcast(-1f, subject)
+        it.setContentText(getString(R.string.download_file_error))
+            .setSmallIcon(android.R.drawable.stat_notify_error)
+            .setOngoing(false)
+    }
+
+    private fun notifyFinish(subject: Subject) = lastNotify(subject.notifyID()) {
+        broadcast(1f, subject)
+        it.setIntent(subject)
+            .setContentTitle(subject.title)
+            .setContentText(getString(R.string.download_complete))
+            .setSmallIcon(android.R.drawable.stat_sys_download_done)
+            .setProgress(0, 0, false)
+            .setOngoing(false)
+            .setAutoCancel(true)
+    }
+
+    private fun create() = Notifications.progress(this, "")
+
+    fun update(id: Int, editor: (Notification.Builder) -> Unit = {}) {
+        val wasEmpty = !hasNotifications
+        val notification = notifications.getOrPut(id, ::create).also(editor)
+        if (wasEmpty)
+            updateForeground()
+        else
+            notify(id, notification.build())
+    }
+
+    private fun lastNotify(
+        id: Int,
+        editor: (Notification.Builder) -> Notification.Builder? = { null }
+    ) : Int {
+        val notification = remove(id)?.run(editor) ?: return -1
+        val newId: Int = nextInt()
+        notify(newId, notification.build())
+        return newId
+    }
+
+    protected fun remove(id: Int) = notifications.remove(id)
+        ?.also { updateForeground(); cancel(id) }
+        ?: { cancel(id); null }()
+
+    private fun notify(id: Int, notification: Notification) {
+        Notifications.mgr.notify(id, notification)
+    }
+
+    private fun cancel(id: Int) {
+        Notifications.mgr.cancel(id)
+    }
+
+    private fun updateForeground() {
+        if (hasNotifications) {
+            val (id, notification) = notifications.entries.first()
+            startForeground(id, notification.build())
+        } else {
+            stopForeground(false)
+        }
+    }
+
+    // --- Implement custom logic
+
+    protected abstract suspend fun onFinish(subject: Subject, id: Int)
+
+    protected abstract fun Notification.Builder.setIntent(subject: Subject): Notification.Builder
+
+    // ---
+
+    companion object : KoinComponent {
+        const val ACTION_KEY = "download_action"
+
+        private val progressBroadcast = MutableLiveData<Pair<Float, Subject>>()
+
+        fun observeProgress(owner: LifecycleOwner, callback: (Float, Subject) -> Unit) {
+            progressBroadcast.value = null
+            progressBroadcast.observe(owner) {
+                val (progress, subject) = it ?: return@observe
+                callback(progress, subject)
+            }
+        }
+
+        private fun broadcast(progress: Float, subject: Subject) {
+            progressBroadcast.postValue(progress to subject)
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/download/DownloadService.kt

@@ -6,159 +6,108 @@ import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
 import android.os.Build
-import android.webkit.MimeTypeMap
-import com.topjohnwu.magisk.R
+import androidx.core.net.toFile
+import com.topjohnwu.magisk.core.download.Action.*
+import com.topjohnwu.magisk.core.download.Action.Flash.Secondary
+import com.topjohnwu.magisk.core.download.Subject.*
 import com.topjohnwu.magisk.core.intent
 import com.topjohnwu.magisk.core.tasks.EnvFixTask
-import com.topjohnwu.magisk.extensions.chooser
-import com.topjohnwu.magisk.extensions.exists
-import com.topjohnwu.magisk.extensions.provide
-import com.topjohnwu.magisk.extensions.subscribeK
-import com.topjohnwu.magisk.legacy.flash.FlashActivity
-import com.topjohnwu.magisk.model.entity.internal.Configuration.*
-import com.topjohnwu.magisk.model.entity.internal.Configuration.Flash.Secondary
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject.*
+import com.topjohnwu.magisk.ui.flash.FlashFragment
 import com.topjohnwu.magisk.utils.APKInstall
-import io.reactivex.Completable
-import org.koin.core.get
-import java.io.File
 import kotlin.random.Random.Default.nextInt
 
-/* More of a facade for [RemoteFileService], but whatever... */
 @SuppressLint("Registered")
-open class DownloadService : RemoteFileService() {
+open class DownloadService : BaseDownloader() {
 
     private val context get() = this
-    private val File.type
-        get() = MimeTypeMap.getSingleton()
-            .getMimeTypeFromExtension(extension)
-            ?: "resource/folder"
 
-    override fun onFinished(subject: DownloadSubject, id: Int) = when (subject) {
-        is Magisk -> onFinishedInternal(subject, id)
-        is Module -> onFinishedInternal(subject, id)
-        is Manager -> onFinishedInternal(subject, id)
+    override suspend fun onFinish(subject: Subject, id: Int) = when (subject) {
+        is Magisk -> subject.onFinish(id)
+        is Module -> subject.onFinish(id)
+        is Manager -> subject.onFinish(id)
     }
 
-    private fun onFinishedInternal(
-        subject: Magisk,
-        id: Int
-    ) = when (val conf = subject.configuration) {
-        Uninstall -> FlashActivity.uninstall(this, subject.file, id)
-        EnvFix -> { remove(id); EnvFixTask(subject.file).exec() }
-        is Patch -> FlashActivity.patch(this, subject.file, conf.fileUri, id)
-        is Flash -> FlashActivity.flash(this, subject.file, conf is Secondary, id)
-        else -> Unit
-    }
-
-    private fun onFinishedInternal(
-        subject: Module,
-        id: Int
-    ) = when (subject.configuration) {
-        is Flash -> FlashActivity.install(this, subject.file, id)
-        else -> Unit
-    }
-
-    private fun onFinishedInternal(
-        subject: Manager,
-        id: Int
-    ) {
-        Completable.fromAction {
-            handleAPK(subject)
-        }.subscribeK {
+    private suspend fun Magisk.onFinish(id: Int) = when (val action = action) {
+        Uninstall -> FlashFragment.uninstall(file, id)
+        EnvFix -> {
             remove(id)
-            when (subject.configuration)  {
-                is APK.Upgrade -> APKInstall.install(this, subject.file)
-                is APK.Restore -> Unit
-            }
+            EnvFixTask(file).exec()
+            Unit
         }
+        is Patch -> FlashFragment.patch(file, action.fileUri, id)
+        is Flash -> FlashFragment.flash(file, action is Secondary, id)
+        else -> Unit
     }
 
-    // ---
+    private fun Module.onFinish(id: Int) = when (action) {
+        is Flash -> FlashFragment.install(file, id)
+        else -> Unit
+    }
 
-    override fun Notification.Builder.addActions(subject: DownloadSubject)
+    private fun Manager.onFinish(id: Int) {
+        remove(id)
+        APKInstall.install(context, file.toFile())
+    }
+
+    // --- Customize finish notification
+
+    override fun Notification.Builder.setIntent(subject: Subject)
     = when (subject) {
-        is Magisk -> addActionsInternal(subject)
-        is Module -> addActionsInternal(subject)
-        is Manager -> addActionsInternal(subject)
+        is Magisk -> setIntent(subject)
+        is Module -> setIntent(subject)
+        is Manager -> setIntent(subject)
     }
 
-    private fun Notification.Builder.addActionsInternal(subject: Magisk)
-    = when (val conf = subject.configuration) {
-        Download -> this.apply {
-            fileIntent(subject.file.parentFile!!)
-                .takeIf { it.exists(get()) }
-                ?.let { addAction(0, R.string.download_open_parent, it.chooser()) }
-            fileIntent(subject.file)
-                .takeIf { it.exists(get()) }
-                ?.let { addAction(0, R.string.download_open_self, it.chooser()) }
-        }
-        Uninstall -> setContentIntent(FlashActivity.uninstallIntent(context, subject.file))
-        is Flash -> setContentIntent(FlashActivity.flashIntent(context, subject.file, conf is Secondary))
-        is Patch -> setContentIntent(FlashActivity.patchIntent(context, subject.file, conf.fileUri))
-        else -> this
+    private fun Notification.Builder.setIntent(subject: Magisk)
+    = when (val action = subject.action) {
+        Uninstall -> setContentIntent(FlashFragment.uninstallIntent(context, subject.file))
+        is Flash -> setContentIntent(FlashFragment.flashIntent(context, subject.file, action is Secondary))
+        is Patch -> setContentIntent(FlashFragment.patchIntent(context, subject.file, action.fileUri))
+        else -> setContentIntent(Intent())
     }
 
-    private fun Notification.Builder.addActionsInternal(subject: Module)
-    = when (subject.configuration) {
-        Download -> this.apply {
-            fileIntent(subject.file.parentFile!!)
-                .takeIf { it.exists(get()) }
-                ?.let { addAction(0, R.string.download_open_parent, it.chooser()) }
-            fileIntent(subject.file)
-                .takeIf { it.exists(get()) }
-                ?.let { addAction(0, R.string.download_open_self, it.chooser()) }
-        }
-        is Flash -> setContentIntent(FlashActivity.installIntent(context, subject.file))
-        else -> this
+    private fun Notification.Builder.setIntent(subject: Module)
+    = when (subject.action) {
+        is Flash -> setContentIntent(FlashFragment.installIntent(context, subject.file))
+        else -> setContentIntent(Intent())
     }
 
-    private fun Notification.Builder.addActionsInternal(subject: Manager)
-    = when (subject.configuration) {
-        APK.Upgrade -> setContentIntent(APKInstall.installIntent(context, subject.file))
-        else -> this
+    private fun Notification.Builder.setIntent(subject: Manager)
+    = when (subject.action) {
+        APK.Upgrade -> setContentIntent(APKInstall.installIntent(context, subject.file.toFile()))
+        else -> setContentIntent(Intent())
     }
 
-    @Suppress("ReplaceSingleLineLet")
     private fun Notification.Builder.setContentIntent(intent: Intent) =
         setContentIntent(
             PendingIntent.getActivity(context, nextInt(), intent, PendingIntent.FLAG_ONE_SHOT)
         )
 
-    @Suppress("ReplaceSingleLineLet")
-    private fun Notification.Builder.addAction(icon: Int, title: Int, intent: Intent) =
-        addAction(icon, getString(title),
-            PendingIntent.getActivity(context, nextInt(), intent, PendingIntent.FLAG_ONE_SHOT)
-        )
-
     // ---
 
-    private fun fileIntent(file: File): Intent {
-        return Intent(Intent.ACTION_VIEW)
-            .setDataAndType(file.provide(this), file.type)
-            .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-            .addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-    }
-
-    class Builder {
-        lateinit var subject: DownloadSubject
-    }
-
     companion object {
 
-        inline operator fun invoke(context: Context, argBuilder: Builder.() -> Unit) {
-            val app = context.applicationContext
-            val builder = Builder().apply(argBuilder)
-            val intent = app.intent<DownloadService>().putExtra(ARG_URL, builder.subject)
+        private fun intent(context: Context, subject: Subject) =
+            context.intent<DownloadService>().putExtra(ACTION_KEY, subject)
 
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                app.startForegroundService(intent)
+        fun pendingIntent(context: Context, subject: Subject): PendingIntent {
+            return if (Build.VERSION.SDK_INT >= 26) {
+                PendingIntent.getForegroundService(context, nextInt(),
+                    intent(context, subject), PendingIntent.FLAG_UPDATE_CURRENT)
             } else {
-                app.startService(intent)
+                PendingIntent.getService(context, nextInt(),
+                    intent(context, subject), PendingIntent.FLAG_UPDATE_CURRENT)
             }
         }
 
+        fun start(context: Context, subject: Subject) {
+            val app = context.applicationContext
+            if (Build.VERSION.SDK_INT >= 26) {
+                app.startForegroundService(intent(app, subject))
+            } else {
+                app.startService(intent(app, subject))
+            }
+        }
     }
 
 }

app/src/main/java/com/topjohnwu/magisk/core/download/ManagerHandler.kt

@@ -0,0 +1,72 @@
+package com.topjohnwu.magisk.core.download
+
+import android.content.Context
+import androidx.core.net.toFile
+import com.topjohnwu.magisk.BuildConfig
+import com.topjohnwu.magisk.DynAPK
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.download.Action.APK.Restore
+import com.topjohnwu.magisk.core.download.Action.APK.Upgrade
+import com.topjohnwu.magisk.core.isRunningAsStub
+import com.topjohnwu.magisk.core.tasks.PatchAPK
+import com.topjohnwu.magisk.ktx.relaunchApp
+import com.topjohnwu.magisk.ktx.writeTo
+import com.topjohnwu.superuser.Shell
+import java.io.File
+
+private fun Context.patch(apk: File) {
+    val patched = File(apk.parent, "patched.apk")
+    PatchAPK.patch(this, apk.path, patched.path, packageName, applicationInfo.nonLocalizedLabel)
+    apk.delete()
+    patched.renameTo(apk)
+}
+
+private fun BaseDownloader.notifyHide(id: Int) {
+    update(id) {
+        it.setProgress(0, 0, true)
+            .setContentTitle(getString(R.string.hide_manager_title))
+            .setContentText("")
+    }
+}
+
+private suspend fun BaseDownloader.upgrade(subject: Subject.Manager) {
+    val apk = subject.file.toFile()
+    val id = subject.notifyID()
+    if (isRunningAsStub) {
+        // Move to upgrade location
+        apk.copyTo(DynAPK.update(this), overwrite = true)
+        apk.delete()
+        if (Info.stubChk.version < subject.stub.versionCode) {
+            notifyHide(id)
+            // Also upgrade stub
+            service.fetchFile(subject.stub.link).byteStream().use { it.writeTo(apk) }
+            patch(apk)
+        } else {
+            // Simply relaunch the app
+            stopSelf()
+            relaunchApp(this)
+        }
+    } else if (packageName != BuildConfig.APPLICATION_ID) {
+        notifyHide(id)
+        patch(apk)
+    }
+}
+
+private fun BaseDownloader.restore(apk: File, id: Int) {
+    update(id) {
+        it.setProgress(0, 0, true)
+            .setProgress(0, 0, true)
+            .setContentTitle(getString(R.string.restore_img_msg))
+            .setContentText("")
+    }
+    Config.export()
+    Shell.su("pm install $apk && pm uninstall $packageName").exec()
+}
+
+suspend fun BaseDownloader.handleAPK(subject: Subject.Manager) =
+    when (subject.action) {
+        is Upgrade -> upgrade(subject)
+        is Restore -> restore(subject.file.toFile(), subject.notifyID())
+    }

app/src/main/java/com/topjohnwu/magisk/core/download/ManagerUpgrade.kt

@@ -1,72 +0,0 @@
-package com.topjohnwu.magisk.core.download
-
-import com.topjohnwu.magisk.BuildConfig
-import com.topjohnwu.magisk.DynAPK
-import com.topjohnwu.magisk.ProcessPhoenix
-import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.core.Config
-import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.core.intent
-import com.topjohnwu.magisk.core.isRunningAsStub
-import com.topjohnwu.magisk.core.utils.PatchAPK
-import com.topjohnwu.magisk.extensions.writeTo
-import com.topjohnwu.magisk.model.entity.internal.Configuration.APK.Restore
-import com.topjohnwu.magisk.model.entity.internal.Configuration.APK.Upgrade
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject
-import com.topjohnwu.superuser.Shell
-import java.io.File
-
-private fun RemoteFileService.patch(apk: File, id: Int) {
-    if (packageName == BuildConfig.APPLICATION_ID)
-        return
-
-    update(id) {
-        it.setProgress(0, 0, true)
-            .setProgress(0, 0, true)
-            .setContentTitle(getString(R.string.hide_manager_title))
-            .setContentText("")
-    }
-    val patched = File(apk.parent, "patched.apk")
-    PatchAPK.patch(apk.path, patched.path, packageName, applicationInfo.nonLocalizedLabel)
-    apk.delete()
-    patched.renameTo(apk)
-}
-
-private fun RemoteFileService.upgrade(apk: File, id: Int) {
-    if (isRunningAsStub) {
-        // Move to upgrade location
-        apk.copyTo(DynAPK.update(this), overwrite = true)
-        apk.delete()
-        if (Info.stub!!.version < Info.remote.stub.versionCode) {
-            // We also want to upgrade stub
-            service.fetchFile(Info.remote.stub.link).blockingGet().byteStream().use {
-                it.writeTo(apk)
-            }
-            patch(apk, id)
-        } else {
-            // Simply relaunch the app
-            ProcessPhoenix.triggerRebirth(this, intent<ProcessPhoenix>())
-        }
-    } else {
-        patch(apk, id)
-    }
-}
-
-private fun RemoteFileService.restore(apk: File, id: Int) {
-    update(id) {
-        it.setProgress(0, 0, true)
-            .setProgress(0, 0, true)
-            .setContentTitle(getString(R.string.restore_img_msg))
-            .setContentText("")
-    }
-    Config.export()
-    // Make it world readable
-    apk.setReadable(true, false)
-    Shell.su("pm install $apk && pm uninstall $packageName").exec()
-}
-
-fun RemoteFileService.handleAPK(subject: DownloadSubject.Manager) =
-    when (subject.configuration) {
-        is Upgrade -> upgrade(subject.file, subject.hashCode())
-        is Restore -> restore(subject.file, subject.hashCode())
-    }

app/src/main/java/com/topjohnwu/magisk/core/download/ModuleProcessor.kt

@@ -1,13 +1,14 @@
 package com.topjohnwu.magisk.core.download
 
-import com.topjohnwu.magisk.extensions.withStreams
-import java.io.File
+import android.net.Uri
+import com.topjohnwu.magisk.ktx.withStreams
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.outputStream
 import java.io.InputStream
 import java.util.zip.ZipEntry
 import java.util.zip.ZipInputStream
 import java.util.zip.ZipOutputStream
 
-fun InputStream.toModule(file: File, installer: InputStream) {
+fun InputStream.toModule(file: Uri, installer: InputStream) {
 
     val input = ZipInputStream(buffered())
     val output = ZipOutputStream(file.outputStream().buffered())

app/src/main/java/com/topjohnwu/magisk/core/download/NotificationService.kt

@@ -1,86 +0,0 @@
-package com.topjohnwu.magisk.core.download
-
-import android.app.Notification
-import android.content.Intent
-import android.os.IBinder
-import com.topjohnwu.magisk.core.base.BaseService
-import com.topjohnwu.magisk.core.view.Notifications
-import org.koin.core.KoinComponent
-import java.util.*
-import kotlin.collections.HashMap
-import kotlin.random.Random.Default.nextInt
-
-abstract class NotificationService : BaseService(), KoinComponent {
-
-    private val hasNotifications get() = notifications.isNotEmpty()
-
-    private val notifications = Collections.synchronizedMap(HashMap<Int, Notification.Builder>())
-
-    override fun onTaskRemoved(rootIntent: Intent?) {
-        super.onTaskRemoved(rootIntent)
-        notifications.forEach { cancel(it.key) }
-        notifications.clear()
-    }
-
-    abstract fun createNotification(): Notification.Builder
-
-    // --
-
-    fun update(
-        id: Int,
-        body: (Notification.Builder) -> Unit = {}
-    ) {
-        val wasEmpty = notifications.isEmpty()
-        val notification = notifications.getOrPut(id, ::createNotification).also(body)
-        if (wasEmpty)
-            updateForeground()
-        else
-            notify(id, notification.build())
-    }
-
-    protected fun lastNotify(
-        id: Int,
-        editBody: (Notification.Builder) -> Notification.Builder? = { null }
-    ) : Int {
-        val currentNotification = remove(id)?.run(editBody)
-
-        var newId = -1
-        currentNotification?.let {
-            newId = nextInt(Int.MAX_VALUE)
-            notify(newId, it.build())
-        }
-
-        if (!hasNotifications) {
-            stopSelf()
-        }
-        return newId
-    }
-
-    protected fun remove(id: Int) = notifications.remove(id).also {
-        cancel(id)
-        updateForeground()
-    }
-
-    // ---
-
-    private fun notify(id: Int, notification: Notification) {
-        Notifications.mgr.notify(id, notification)
-    }
-
-    private fun cancel(id: Int) {
-        Notifications.mgr.cancel(id)
-    }
-
-    private fun updateForeground() {
-        if (hasNotifications) {
-            val first = notifications.entries.first()
-            startForeground(first.key, first.value.build())
-        } else {
-            stopForeground(true)
-        }
-    }
-
-    // --
-
-    override fun onBind(p0: Intent?): IBinder? = null
-}

app/src/main/java/com/topjohnwu/magisk/core/download/RemoteFileService.kt

@@ -1,135 +0,0 @@
-package com.topjohnwu.magisk.core.download
-
-import android.app.Activity
-import android.app.Notification
-import android.content.Intent
-import androidx.lifecycle.LiveData
-import androidx.lifecycle.MutableLiveData
-import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.core.utils.ProgressInputStream
-import com.topjohnwu.magisk.core.view.Notifications
-import com.topjohnwu.magisk.data.network.GithubRawServices
-import com.topjohnwu.magisk.di.NullActivity
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.subscribeK
-import com.topjohnwu.magisk.extensions.writeTo
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject.Magisk
-import com.topjohnwu.magisk.model.entity.internal.DownloadSubject.Module
-import com.topjohnwu.superuser.ShellUtils
-import io.reactivex.Completable
-import okhttp3.ResponseBody
-import org.koin.android.ext.android.inject
-import org.koin.core.KoinComponent
-import timber.log.Timber
-import java.io.InputStream
-
-abstract class RemoteFileService : NotificationService() {
-
-    val service: GithubRawServices by inject()
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        intent?.getParcelableExtra<DownloadSubject>(ARG_URL)?.let { start(it) }
-        return START_REDELIVER_INTENT
-    }
-
-    override fun createNotification() = Notifications.progress(this, "")
-
-    // ---
-
-    private fun start(subject: DownloadSubject) = checkExisting(subject)
-        .onErrorResumeNext { download(subject) }
-        .subscribeK(onError = {
-            Timber.e(it)
-            failNotify(subject)
-        }) {
-            val newId = finishNotify(subject)
-            if (get<Activity>() !is NullActivity) {
-                onFinished(subject, newId)
-            }
-        }
-
-    private fun checkExisting(subject: DownloadSubject) = Completable.fromAction {
-        check(subject is Magisk) { "Download cache is disabled" }
-        check(subject.file.exists() &&
-                ShellUtils.checkSum("MD5", subject.file, subject.magisk.md5)) {
-            "The given file does not match checksum"
-        }
-    }
-
-    private fun download(subject: DownloadSubject) = service.fetchFile(subject.url)
-        .map { it.toProgressStream(subject) }
-        .flatMapCompletable { stream ->
-            when (subject) {
-                is Module -> service.fetchInstaller()
-                    .doOnSuccess { stream.toModule(subject.file, it.byteStream()) }
-                    .ignoreElement()
-                else -> Completable.fromAction { stream.writeTo(subject.file) }
-            }
-        }
-
-    private fun ResponseBody.toProgressStream(subject: DownloadSubject): InputStream {
-        val maxRaw = contentLength()
-        val max = maxRaw / 1_000_000f
-        val id = subject.hashCode()
-
-        update(id) { it.setContentTitle(subject.title) }
-
-        return ProgressInputStream(byteStream()) {
-            val progress = it / 1_000_000f
-            update(id) { notification ->
-                if (maxRaw > 0) {
-                    send(progress / max, subject)
-                    notification
-                        .setProgress(maxRaw.toInt(), it.toInt(), false)
-                        .setContentText("%.2f / %.2f MB".format(progress, max))
-                } else {
-                    send(-1f, subject)
-                    notification.setContentText("%.2f MB / ??".format(progress))
-                }
-            }
-        }
-    }
-
-    private fun failNotify(subject: DownloadSubject) = lastNotify(subject.hashCode()) {
-        send(0f, subject)
-        it.setContentText(getString(R.string.download_file_error))
-            .setSmallIcon(android.R.drawable.stat_notify_error)
-            .setOngoing(false)
-    }
-
-    private fun finishNotify(subject: DownloadSubject) = lastNotify(subject.hashCode()) {
-        send(1f, subject)
-        it.addActions(subject)
-            .setContentText(getString(R.string.download_complete))
-            .setSmallIcon(android.R.drawable.stat_sys_download_done)
-            .setProgress(0, 0, false)
-            .setOngoing(false)
-            .setAutoCancel(true)
-    }
-
-    // ---
-
-
-    @Throws(Throwable::class)
-    protected abstract fun onFinished(subject: DownloadSubject, id: Int)
-
-    protected abstract fun Notification.Builder.addActions(subject: DownloadSubject)
-            : Notification.Builder
-
-    companion object : KoinComponent {
-        const val ARG_URL = "arg_url"
-
-        private val internalProgressBroadcast = MutableLiveData<Pair<Float, DownloadSubject>>()
-        val progressBroadcast: LiveData<Pair<Float, DownloadSubject>> get() = internalProgressBroadcast
-
-        fun send(progress: Float, subject: DownloadSubject) {
-            internalProgressBroadcast.postValue(progress to subject)
-        }
-
-        fun reset() {
-            internalProgressBroadcast.value = null
-        }
-    }
-
-}

app/src/main/java/com/topjohnwu/magisk/core/download/Subject.kt

@@ -0,0 +1,114 @@
+package com.topjohnwu.magisk.core.download
+
+import android.content.Context
+import android.net.Uri
+import android.os.Parcelable
+import androidx.core.net.toUri
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.model.MagiskJson
+import com.topjohnwu.magisk.core.model.ManagerJson
+import com.topjohnwu.magisk.core.model.StubJson
+import com.topjohnwu.magisk.core.model.module.Repo
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils
+import com.topjohnwu.magisk.ktx.cachedFile
+import com.topjohnwu.magisk.ktx.get
+import kotlinx.android.parcel.IgnoredOnParcel
+import kotlinx.android.parcel.Parcelize
+
+private fun cachedFile(name: String) = get<Context>().cachedFile(name).apply { delete() }.toUri()
+
+sealed class Subject : Parcelable {
+
+    abstract val url: String
+    abstract val file: Uri
+    abstract val action: Action
+    abstract val title: String
+
+    @Parcelize
+    class Module(
+        val module: Repo,
+        override val action: Action
+    ) : Subject() {
+        override val url: String get() = module.zipUrl
+        override val title: String get() = module.downloadFilename
+
+        @IgnoredOnParcel
+        override val file by lazy {
+            MediaStoreUtils.getFile(title).uri
+        }
+    }
+
+    @Parcelize
+    class Manager(
+        override val action: Action.APK,
+        private val app: ManagerJson = Info.remote.app,
+        val stub: StubJson = Info.remote.stub
+    ) : Subject() {
+
+        override val title: String
+            get() = "MagiskManager-${app.version}(${app.versionCode})"
+
+        override val url: String
+            get() = app.link
+
+        @IgnoredOnParcel
+        override val file by lazy {
+            cachedFile("manager.apk")
+        }
+
+    }
+
+    abstract class Magisk : Subject() {
+
+        val magisk: MagiskJson = Info.remote.magisk
+
+        @Parcelize
+        private class Internal(
+            override val action: Action
+        ) : Magisk() {
+            override val url: String get() = magisk.link
+            override val title: String get() = "Magisk-${magisk.version}(${magisk.versionCode})"
+
+            @IgnoredOnParcel
+            override val file by lazy {
+                cachedFile("magisk.zip")
+            }
+        }
+
+        @Parcelize
+        private class Uninstall : Magisk() {
+            override val action get() = Action.Uninstall
+            override val url: String get() = Info.remote.uninstaller.link
+            override val title: String get() = "uninstall.zip"
+
+            @IgnoredOnParcel
+            override val file by lazy {
+                cachedFile(title)
+            }
+
+        }
+
+        @Parcelize
+        private class Download : Magisk() {
+            override val action get() = Action.Download
+            override val url: String get() = magisk.link
+            override val title: String get() = "Magisk-${magisk.version}(${magisk.versionCode}).zip"
+
+            @IgnoredOnParcel
+            override val file by lazy {
+                MediaStoreUtils.getFile(title).uri
+            }
+        }
+
+        companion object {
+            operator fun invoke(config: Action) = when (config) {
+                Action.Download -> Download()
+                Action.Uninstall -> Uninstall()
+                Action.EnvFix, is Action.Flash, is Action.Patch -> Internal(config)
+                else -> throw IllegalArgumentException()
+            }
+        }
+
+    }
+
+}

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/BaseDao.kt

@@ -1,8 +1,6 @@
 package com.topjohnwu.magisk.core.magiskdb
 
 import androidx.annotation.StringDef
-import com.topjohnwu.superuser.Shell
-import io.reactivex.Single
 
 abstract class BaseDao {
 
@@ -20,25 +18,11 @@ abstract class BaseDao {
     @TableStrict
     abstract val table: String
 
-    inline fun <reified Builder : Query.Builder> query(builder: Builder.() -> Unit = {}) =
+    inline fun <reified Builder : Query.Builder> buildQuery(builder: Builder.() -> Unit = {}) =
         Builder::class.java.newInstance()
             .apply { table = this@BaseDao.table }
             .apply(builder)
             .toString()
             .let { Query(it) }
-            .query()
 
 }
-
-fun Query.query() = query.su()
-
-private fun String.suRaw() = Single.fromCallable { Shell.su(this).exec().out }
-private fun String.su() = suRaw().map { it.toMap() }
-
-private fun List<String>.toMap() = map { it.split(Regex("\\|")) }
-    .map { it.toMapInternal() }
-
-private fun List<String>.toMapInternal() = map { it.split("=", limit = 2) }
-    .filter { it.size == 2 }
-    .map { Pair(it[0], it[1]) }
-    .toMap()

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/PolicyDao.kt

@@ -3,10 +3,12 @@ package com.topjohnwu.magisk.core.magiskdb
 import android.content.Context
 import android.content.pm.PackageManager
 import com.topjohnwu.magisk.core.Const
-import com.topjohnwu.magisk.core.model.MagiskPolicy
-import com.topjohnwu.magisk.core.model.toMap
-import com.topjohnwu.magisk.core.model.toPolicy
-import com.topjohnwu.magisk.extensions.now
+import com.topjohnwu.magisk.core.model.su.SuPolicy
+import com.topjohnwu.magisk.core.model.su.toMap
+import com.topjohnwu.magisk.core.model.su.toPolicy
+import com.topjohnwu.magisk.ktx.now
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
 import timber.log.Timber
 import java.util.concurrent.TimeUnit
 
@@ -17,55 +19,56 @@ class PolicyDao(
 
     override val table: String = Table.POLICY
 
-    fun deleteOutdated(
-        nowSeconds: Long = TimeUnit.MILLISECONDS.toSeconds(now)
-    ) = query<Delete> {
+    suspend fun deleteOutdated() = buildQuery<Delete> {
         condition {
             greaterThan("until", "0")
             and {
-                lessThan("until", nowSeconds.toString())
+                lessThan("until", TimeUnit.MILLISECONDS.toSeconds(now).toString())
             }
             or {
                 lessThan("until", "0")
             }
         }
-    }.ignoreElement()
+    }.commit()
 
-    fun delete(packageName: String) = query<Delete> {
+    suspend fun delete(packageName: String) = buildQuery<Delete> {
         condition {
             equals("package_name", packageName)
         }
-    }.ignoreElement()
+    }.commit()
 
-    fun delete(uid: Int) = query<Delete> {
+    suspend fun delete(uid: Int) = buildQuery<Delete> {
         condition {
             equals("uid", uid)
         }
-    }.ignoreElement()
+    }.commit()
 
-    fun fetch(uid: Int) = query<Select> {
+    suspend fun fetch(uid: Int) = buildQuery<Select> {
         condition {
             equals("uid", uid)
         }
-    }.map { it.first().toPolicySafe() }
+    }.query().first().toPolicyOrNull()
 
-    fun update(policy: MagiskPolicy) = query<Replace> {
+    suspend fun update(policy: SuPolicy) = buildQuery<Replace> {
         values(policy.toMap())
-    }.ignoreElement()
+    }.commit()
 
-    fun fetchAll() = query<Select> {
+    suspend fun <R: Any> fetchAll(mapper: (SuPolicy) -> R) = buildQuery<Select> {
         condition {
             equals("uid/100000", Const.USER_ID)
         }
-    }.map { it.mapNotNull { it.toPolicySafe() } }
+    }.query {
+        it.toPolicyOrNull()?.let(mapper)
+    }
 
-
-    private fun Map<String, String>.toPolicySafe(): MagiskPolicy? {
+    private fun Map<String, String>.toPolicyOrNull(): SuPolicy? {
         return runCatching { toPolicy(context.packageManager) }.getOrElse {
             Timber.e(it)
             if (it is PackageManager.NameNotFoundException) {
                 val uid = getOrElse("uid") { null } ?: return null
-                delete(uid).subscribe()
+                GlobalScope.launch {
+                    delete(uid.toInt())
+                }
             }
             null
         }

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/Query.kt

@@ -1,6 +1,12 @@
 package com.topjohnwu.magisk.core.magiskdb
 
 import androidx.annotation.StringDef
+import com.topjohnwu.magisk.ktx.await
+import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitAll
+import kotlinx.coroutines.withContext
 
 class Query(private val _query: String) {
     val query get() = "magisk --sqlite '$_query'"
@@ -9,6 +15,24 @@ class Query(private val _query: String) {
         val requestType: String
         var table: String
     }
+
+    suspend inline fun <R : Any> query(crossinline mapper: (Map<String, String>) -> R?): List<R> =
+        withContext(Dispatchers.Default) {
+            Shell.su(query).await().out.map { line ->
+                async {
+                    line.split("\\|".toRegex())
+                        .map { it.split("=", limit = 2) }
+                        .filter { it.size == 2 }
+                        .map { it[0] to it[1] }
+                        .toMap()
+                        .let(mapper)
+                }
+            }.awaitAll().filterNotNull()
+        }
+
+    suspend inline fun query() = query { it }
+
+    suspend inline fun commit() = Shell.su(query).to(null).await()
 }
 
 class Delete : Query.Builder {

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/SettingsDao.kt

@@ -4,17 +4,19 @@ class SettingsDao : BaseDao() {
 
     override val table = Table.SETTINGS
 
-    fun delete(key: String) = query<Delete> {
+    suspend fun delete(key: String) = buildQuery<Delete> {
         condition { equals("key", key) }
-    }.ignoreElement()
+    }.commit()
 
-    fun put(key: String, value: Int) = query<Replace> {
+    suspend fun put(key: String, value: Int) = buildQuery<Replace> {
         values("key" to key, "value" to value)
-    }.ignoreElement()
+    }.commit()
 
-    fun fetch(key: String, default: Int = -1) = query<Select> {
+    suspend fun fetch(key: String, default: Int = -1) = buildQuery<Select> {
         fields("value")
         condition { equals("key", key) }
-    }.map { it.firstOrNull()?.values?.firstOrNull()?.toIntOrNull() ?: default }
+    }.query {
+        it["value"]?.toIntOrNull()
+    }.firstOrNull() ?: default
 
 }

app/src/main/java/com/topjohnwu/magisk/core/magiskdb/StringDao.kt

@@ -4,17 +4,19 @@ class StringDao : BaseDao() {
 
     override val table = Table.STRINGS
 
-    fun delete(key: String) = query<Delete> {
+    suspend fun delete(key: String) = buildQuery<Delete> {
         condition { equals("key", key) }
-    }.ignoreElement()
+    }.commit()
 
-    fun put(key: String, value: String) = query<Replace> {
+    suspend fun put(key: String, value: String) = buildQuery<Replace> {
         values("key" to key, "value" to value)
-    }.ignoreElement()
+    }.commit()
 
-    fun fetch(key: String, default: String = "") = query<Select> {
+    suspend fun fetch(key: String, default: String = "") = buildQuery<Select> {
         fields("value")
         condition { equals("key", key) }
-    }.map { it.firstOrNull()?.values?.firstOrNull() ?: default }
+    }.query {
+        it["value"]
+    }.firstOrNull() ?: default
 
 }

app/src/main/java/com/topjohnwu/magisk/core/model/UpdateInfo.kt

@@ -35,8 +35,9 @@ data class ManagerJson(
     val note: String = ""
 ) : Parcelable
 
+@Parcelize
 @JsonClass(generateAdapter = true)
 data class StubJson(
     val versionCode: Int = -1,
     val link: String = ""
-)
+) : Parcelable

app/src/main/java/com/topjohnwu/magisk/core/model/module/Module.kt

@@ -1,9 +1,10 @@
 package com.topjohnwu.magisk.core.model.module
 
-import androidx.annotation.WorkerThread
 import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.io.SuFile
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
 
 class Module(path: String) : BaseModule() {
     override var id: String = ""
@@ -18,12 +19,13 @@ class Module(path: String) : BaseModule() {
     private val updateFile = SuFile(path, "update")
     private val ruleFile = SuFile(path, "sepolicy.rule")
 
-    val updated: Boolean = updateFile.exists()
+    val updated: Boolean get() = updateFile.exists()
 
-    var enable: Boolean = !disableFile.exists()
+    var enable: Boolean
+        get() = !disableFile.exists()
         set(enable) {
             val dir = "$PERSIST/$id"
-            field = if (enable) {
+            if (enable) {
                 Shell.su("mkdir -p $dir", "cp -af $ruleFile $dir").submit()
                 disableFile.delete()
             } else {
@@ -32,9 +34,10 @@ class Module(path: String) : BaseModule() {
             }
         }
 
-    var remove: Boolean = removeFile.exists()
+    var remove: Boolean
+        get() = removeFile.exists()
         set(remove) {
-            field = if (remove) {
+            if (remove) {
                 Shell.su("rm -rf $PERSIST/$id").submit()
                 removeFile.createNewFile()
             } else {
@@ -60,20 +63,15 @@ class Module(path: String) : BaseModule() {
 
     companion object {
 
-        private const val PERSIST = "/sbin/.magisk/mirror/persist/magisk"
+        private val PERSIST get() = "${Const.MAGISKTMP}/mirror/persist/magisk"
 
-        @WorkerThread
-        fun loadModules(): List<Module> {
-            val moduleList = mutableListOf<Module>()
-            val path = SuFile(Const.MAGISK_PATH)
-            val modules =
-                    path.listFiles { _, name -> name != "lost+found" && name != ".core" }.orEmpty()
-            for (file in modules) {
-                if (file.isFile) continue
-                val module = Module(Const.MAGISK_PATH + "/" + file.name)
-                moduleList.add(module)
-            }
-            return moduleList.sortedBy { it.name.toLowerCase() }
+        suspend fun installed() = withContext(Dispatchers.IO) {
+            SuFile(Const.MAGISK_PATH)
+                .listFiles { _, name -> name != "lost+found" && name != ".core" }
+                .orEmpty()
+                .filter { !it.isFile }
+                .map { Module("${Const.MAGISK_PATH}/${it.name}") }
+                .sortedBy { it.name.toLowerCase() }
         }
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/model/module/Repo.kt

@@ -5,8 +5,8 @@ import androidx.room.Entity
 import androidx.room.PrimaryKey
 import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.data.repository.StringRepository
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.legalFilename
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.legalFilename
 import kotlinx.android.parcel.Parcelize
 import java.text.DateFormat
 import java.util.*
@@ -31,22 +31,15 @@ data class Repo(
 
     val downloadFilename: String get() = "$name-$version($versionCode).zip".legalFilename()
 
-    val readme get() = stringRepo.getReadme(this)
+    suspend fun readme() = stringRepo.getReadme(this)
 
     val zipUrl: String get() = Const.Url.ZIP_URL.format(id)
 
     constructor(id: String) : this(id, "", "", "", -1, "", 0)
 
     @Throws(IllegalRepoException::class)
-    fun update() {
-        val props = runCatching {
-            stringRepo.getMetadata(this).blockingGet()
-                    .orEmpty().split("\\n".toRegex()).dropLastWhile { it.isEmpty() }
-        }.getOrElse {
-            throw IllegalRepoException("Repo [$id] module.prop download error: " + it.message)
-        }
-
-        props.runCatching {
+    private fun loadProps(props: String) {
+        props.split("\\n".toRegex()).dropLastWhile { it.isEmpty() }.runCatching {
             parseProps(this)
         }.onFailure {
             throw IllegalRepoException("Repo [$id] parse error: " + it.message)
@@ -58,14 +51,14 @@ data class Repo(
     }
 
     @Throws(IllegalRepoException::class)
-    fun update(lastUpdate: Date) {
-        last_update = lastUpdate.time
-        update()
+    suspend fun update(lastUpdate: Date? = null) {
+        lastUpdate?.let { last_update = it.time }
+        loadProps(stringRepo.getMetadata(this))
     }
 
     class IllegalRepoException(message: String) : Exception(message)
 
     companion object {
-        val dateFormat = DateFormat.getDateTimeInstance(DateFormat.MEDIUM, DateFormat.MEDIUM)!!
+        val dateFormat = DateFormat.getDateTimeInstance(DateFormat.MEDIUM, DateFormat.MEDIUM)
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/model/su/SuLog.kt

@@ -1,16 +1,15 @@
-package com.topjohnwu.magisk.model.entity
+package com.topjohnwu.magisk.core.model.su
 
 import androidx.room.Entity
 import androidx.room.Ignore
 import androidx.room.PrimaryKey
-import com.topjohnwu.magisk.core.model.MagiskPolicy
-import com.topjohnwu.magisk.core.model.MagiskPolicy.Companion.ALLOW
-import com.topjohnwu.magisk.extensions.now
-import com.topjohnwu.magisk.extensions.timeFormatTime
-import com.topjohnwu.magisk.extensions.toTime
+import com.topjohnwu.magisk.core.model.su.SuPolicy.Companion.ALLOW
+import com.topjohnwu.magisk.ktx.now
+import com.topjohnwu.magisk.ktx.timeFormatTime
+import com.topjohnwu.magisk.ktx.toTime
 
 @Entity(tableName = "logs")
-data class MagiskLog(
+data class SuLog(
     val fromUid: Int,
     val toUid: Int,
     val fromPid: Int,
@@ -24,8 +23,8 @@ data class MagiskLog(
     @Ignore val timeString = time.toTime(timeFormatTime)
 }
 
-fun MagiskPolicy.toLog(
+fun SuPolicy.toLog(
     toUid: Int,
     fromPid: Int,
     command: String
-) = MagiskLog(uid, toUid, fromPid, packageName, appName, command, policy == ALLOW, now)
+) = SuLog(uid, toUid, fromPid, packageName, appName, command, policy == ALLOW, now)

app/src/main/java/com/topjohnwu/magisk/core/model/su/SuPolicy.kt

@@ -1,20 +1,20 @@
-package com.topjohnwu.magisk.core.model
+package com.topjohnwu.magisk.core.model.su
 
-import android.content.pm.ApplicationInfo
 import android.content.pm.PackageManager
-import com.topjohnwu.magisk.core.model.MagiskPolicy.Companion.INTERACTIVE
-import com.topjohnwu.magisk.extensions.getLabel
+import android.graphics.drawable.Drawable
+import com.topjohnwu.magisk.core.model.su.SuPolicy.Companion.INTERACTIVE
+import com.topjohnwu.magisk.ktx.getLabel
 
 
-data class MagiskPolicy(
+data class SuPolicy(
     var uid: Int,
     val packageName: String,
     val appName: String,
+    val icon: Drawable,
     var policy: Int = INTERACTIVE,
     var until: Long = -1L,
     val logging: Boolean = true,
-    val notification: Boolean = true,
-    val applicationInfo: ApplicationInfo
+    val notification: Boolean = true
 ) {
 
     companion object {
@@ -25,7 +25,7 @@ data class MagiskPolicy(
 
 }
 
-fun MagiskPolicy.toMap() = mapOf(
+fun SuPolicy.toMap() = mapOf(
     "uid" to uid,
     "package_name" to packageName,
     "policy" to policy,
@@ -35,7 +35,7 @@ fun MagiskPolicy.toMap() = mapOf(
 )
 
 @Throws(PackageManager.NameNotFoundException::class)
-fun Map<String, String>.toPolicy(pm: PackageManager): MagiskPolicy {
+fun Map<String, String>.toPolicy(pm: PackageManager): SuPolicy {
     val uid = get("uid")?.toIntOrNull() ?: -1
     val packageName = get("package_name").orEmpty()
     val info = pm.getApplicationInfo(packageName, PackageManager.GET_UNINSTALLED_PACKAGES)
@@ -43,28 +43,28 @@ fun Map<String, String>.toPolicy(pm: PackageManager): MagiskPolicy {
     if (info.uid != uid)
         throw PackageManager.NameNotFoundException()
 
-    return MagiskPolicy(
+    return SuPolicy(
         uid = uid,
         packageName = packageName,
+        appName = info.getLabel(pm),
+        icon = info.loadIcon(pm),
         policy = get("policy")?.toIntOrNull() ?: INTERACTIVE,
         until = get("until")?.toLongOrNull() ?: -1L,
         logging = get("logging")?.toIntOrNull() != 0,
-        notification = get("notification")?.toIntOrNull() != 0,
-        applicationInfo = info,
-        appName = info.getLabel(pm)
+        notification = get("notification")?.toIntOrNull() != 0
     )
 }
 
 @Throws(PackageManager.NameNotFoundException::class)
-fun Int.toPolicy(pm: PackageManager, policy: Int = INTERACTIVE): MagiskPolicy {
+fun Int.toPolicy(pm: PackageManager, policy: Int = INTERACTIVE): SuPolicy {
     val pkg = pm.getPackagesForUid(this)?.firstOrNull()
         ?: throw PackageManager.NameNotFoundException()
     val info = pm.getApplicationInfo(pkg, PackageManager.GET_UNINSTALLED_PACKAGES)
-    return MagiskPolicy(
+    return SuPolicy(
         uid = info.uid,
         packageName = pkg,
-        policy = policy,
-        applicationInfo = info,
-        appName = info.getLabel(pm)
+        appName = info.getLabel(pm),
+        icon = info.loadIcon(pm),
+        policy = policy
     )
 }

app/src/main/java/com/topjohnwu/magisk/core/su/SuCallbackHandler.kt

@@ -11,18 +11,19 @@ import com.topjohnwu.magisk.ProviderCallHandler
 import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.intent
-import com.topjohnwu.magisk.core.model.MagiskPolicy
-import com.topjohnwu.magisk.core.model.toPolicy
-import com.topjohnwu.magisk.core.utils.Utils
+import com.topjohnwu.magisk.core.model.su.SuPolicy
+import com.topjohnwu.magisk.core.model.su.toLog
+import com.topjohnwu.magisk.core.model.su.toPolicy
 import com.topjohnwu.magisk.core.wrap
 import com.topjohnwu.magisk.data.repository.LogRepository
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.startActivity
-import com.topjohnwu.magisk.extensions.startActivityWithRoot
-import com.topjohnwu.magisk.extensions.subscribeK
-import com.topjohnwu.magisk.legacy.surequest.SuRequestActivity
-import com.topjohnwu.magisk.model.entity.toLog
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.startActivity
+import com.topjohnwu.magisk.ktx.startActivityWithRoot
+import com.topjohnwu.magisk.ui.surequest.SuRequestActivity
+import com.topjohnwu.magisk.utils.Utils
 import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
 import timber.log.Timber
 
 object SuCallbackHandler : ProviderCallHandler {
@@ -51,20 +52,8 @@ object SuCallbackHandler : ProviderCallHandler {
         }
 
         when (action) {
-            REQUEST -> {
-                val intent = context.intent<SuRequestActivity>()
-                    .setAction(action)
-                    .putExtras(data)
-                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                    .addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK)
-                if (Build.VERSION.SDK_INT >= 29) {
-                    // Android Q does not allow starting activity from background
-                    intent.startActivityWithRoot()
-                } else {
-                    intent.startActivity(context)
-                }
-            }
-            LOG -> handleLogs(context, data)
+            REQUEST -> handleRequest(context, data)
+            LOG -> handleLogging(context, data)
             NOTIFY -> handleNotify(context, data)
             TEST -> {
                 val mode = data.getInt("mode", 2)
@@ -78,13 +67,26 @@ object SuCallbackHandler : ProviderCallHandler {
 
     private fun Any?.toInt(): Int? {
         return when (this) {
-            is Int -> this
-            is Long -> this.toInt()
+            is Number -> this.toInt()
             else -> null
         }
     }
 
-    private fun handleLogs(context: Context, data: Bundle) {
+    private fun handleRequest(context: Context, data: Bundle) {
+        val intent = context.intent<SuRequestActivity>()
+            .setAction(REQUEST)
+            .putExtras(data)
+            .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            .addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK)
+        if (Build.VERSION.SDK_INT >= 29) {
+            // Android Q does not allow starting activity from background
+            intent.startActivityWithRoot()
+        } else {
+            intent.startActivity(context)
+        }
+    }
+
+    private fun handleLogging(context: Context, data: Bundle) {
         val fromUid = data["from.uid"].toInt() ?: return
         if (fromUid == Process.myUid())
             return
@@ -110,7 +112,9 @@ object SuCallbackHandler : ProviderCallHandler {
         )
 
         val logRepo = get<LogRepository>()
-        logRepo.insert(log).subscribeK(onError = { Timber.e(it) })
+        GlobalScope.launch {
+            logRepo.insert(log)
+        }
     }
 
     private fun handleNotify(context: Context, data: Bundle) {
@@ -128,9 +132,9 @@ object SuCallbackHandler : ProviderCallHandler {
         }
     }
 
-    private fun notify(context: Context, policy: MagiskPolicy) {
+    private fun notify(context: Context, policy: SuPolicy) {
         if (policy.notification && Config.suNotification == Config.Value.NOTIFICATION_TOAST) {
-            val resId = if (policy.policy == MagiskPolicy.ALLOW)
+            val resId = if (policy.policy == SuPolicy.ALLOW)
                 R.string.su_allow_toast
             else
                 R.string.su_deny_toast

app/src/main/java/com/topjohnwu/magisk/core/su/SuConnector.kt

@@ -1,57 +0,0 @@
-package com.topjohnwu.magisk.core.su
-
-import android.net.LocalSocket
-import android.net.LocalSocketAddress
-import androidx.collection.ArrayMap
-import timber.log.Timber
-import java.io.*
-
-abstract class SuConnector @Throws(IOException::class)
-protected constructor(name: String) {
-
-    private val socket: LocalSocket = LocalSocket()
-    protected var out: DataOutputStream
-    protected var input: DataInputStream
-
-    init {
-        socket.connect(LocalSocketAddress(name, LocalSocketAddress.Namespace.ABSTRACT))
-        out = DataOutputStream(BufferedOutputStream(socket.outputStream))
-        input = DataInputStream(BufferedInputStream(socket.inputStream))
-    }
-
-    private fun readString(): String {
-        val len = input.readInt()
-        val buf = ByteArray(len)
-        input.readFully(buf)
-        return String(buf, Charsets.UTF_8)
-    }
-
-    @Throws(IOException::class)
-    fun readRequest(): Map<String, String> {
-        val ret = ArrayMap<String, String>()
-        while (true) {
-            val name = readString()
-            if (name == "eof")
-                break
-            ret[name] = readString()
-        }
-        return ret
-    }
-
-    fun response() {
-        runCatching {
-            onResponse()
-            out.flush()
-        }.onFailure { Timber.e(it) }
-
-        runCatching {
-            input.close()
-            out.close()
-            socket.close()
-        }
-    }
-
-    @Throws(IOException::class)
-    protected abstract fun onResponse()
-
-}

app/src/main/java/com/topjohnwu/magisk/core/su/SuRequestHandler.kt

@@ -2,58 +2,35 @@ package com.topjohnwu.magisk.core.su
 
 import android.content.Intent
 import android.content.pm.PackageManager
-import android.os.CountDownTimer
+import android.net.LocalSocket
+import android.net.LocalSocketAddress
+import androidx.collection.ArrayMap
 import com.topjohnwu.magisk.BuildConfig
 import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.core.magiskdb.PolicyDao
-import com.topjohnwu.magisk.core.model.MagiskPolicy
-import com.topjohnwu.magisk.core.model.toPolicy
-import com.topjohnwu.magisk.extensions.now
+import com.topjohnwu.magisk.core.model.su.SuPolicy
+import com.topjohnwu.magisk.core.model.su.toPolicy
+import com.topjohnwu.magisk.ktx.now
+import kotlinx.coroutines.*
 import timber.log.Timber
+import java.io.*
 import java.util.concurrent.TimeUnit
+import java.util.concurrent.TimeUnit.SECONDS
 
-abstract class SuRequestHandler(
-    private val packageManager: PackageManager,
+class SuRequestHandler(
+    private val pm: PackageManager,
     private val policyDB: PolicyDao
-) {
-    protected var timer: CountDownTimer = object : CountDownTimer(
-        TimeUnit.MINUTES.toMillis(1), TimeUnit.MINUTES.toMillis(1)) {
-        override fun onFinish() {
-            respond(MagiskPolicy.DENY, 0)
-        }
-        override fun onTick(remains: Long) {}
-    }
-        set(value) {
-            field.cancel()
-            field = value
-            field.start()
-        }
+) : Closeable {
 
-    protected lateinit var policy: MagiskPolicy
+    private lateinit var output: DataOutputStream
+    lateinit var policy: SuPolicy
+        private set
 
-    private val cleanupTasks = mutableListOf<() -> Unit>()
-    private lateinit var connector: SuConnector
-
-    abstract fun onStart()
-    abstract fun onRespond()
-
-    fun start(intent: Intent): Boolean {
-        val socketName = intent.getStringExtra("socket") ?: return false
-
-        try {
-            connector = object : SuConnector(socketName) {
-                override fun onResponse() {
-                    out.writeInt(policy.policy)
-                }
-            }
-            val map = connector.readRequest()
-            val uid = map["uid"]?.toIntOrNull() ?: return false
-            policy = uid.toPolicy(packageManager)
-        } catch (e: Exception) {
-            Timber.e(e)
+    // Return true to indicate undetermined policy, require user interaction
+    suspend fun start(intent: Intent): Boolean {
+        if (!init(intent))
             return false
-        }
 
         // Never allow com.topjohnwu.magisk (could be malware)
         if (policy.packageName == BuildConfig.APPLICATION_ID)
@@ -61,28 +38,60 @@ abstract class SuRequestHandler(
 
         when (Config.suAutoReponse) {
             Config.Value.SU_AUTO_DENY -> {
-                respond(MagiskPolicy.DENY, 0)
-                return true
+                respond(SuPolicy.DENY, 0)
+                return false
             }
             Config.Value.SU_AUTO_ALLOW -> {
-                respond(MagiskPolicy.ALLOW, 0)
-                return true
+                respond(SuPolicy.ALLOW, 0)
+                return false
             }
         }
 
-        timer.start()
-        cleanupTasks.add {
-            timer.cancel()
-        }
-
-        onStart()
         return true
     }
 
-    private fun respond() {
-        connector.response()
-        cleanupTasks.forEach { it() }
-        onRespond()
+    private suspend fun <T> Deferred<T>.timedAwait() : T? {
+        return withTimeoutOrNull(SECONDS.toMillis(1)) {
+            await()
+        }
+    }
+
+    @Throws(IOException::class)
+    override fun close() {
+        if (::output.isInitialized)
+            output.close()
+    }
+
+    private class SuRequestError : IOException()
+
+    private suspend fun init(intent: Intent) = withContext(Dispatchers.IO) {
+        try {
+            val uid: Int
+            if (Const.Version.atLeast_21_0()) {
+                val name = intent.getStringExtra("fifo") ?: throw SuRequestError()
+                uid = intent.getIntExtra("uid", -1).also { if (it < 0) throw SuRequestError() }
+                output = DataOutputStream(FileOutputStream(name).buffered())
+            } else {
+                val name = intent.getStringExtra("socket") ?: throw SuRequestError()
+                val socket = LocalSocket()
+                socket.connect(LocalSocketAddress(name, LocalSocketAddress.Namespace.ABSTRACT))
+                output = DataOutputStream(BufferedOutputStream(socket.outputStream))
+                val input = DataInputStream(BufferedInputStream(socket.inputStream))
+                val map = async { input.readRequest() }.timedAwait() ?: throw SuRequestError()
+                uid = map["uid"]?.toIntOrNull() ?: throw SuRequestError()
+            }
+            policy = uid.toPolicy(pm)
+            true
+        } catch (e: Exception) {
+            when (e) {
+                is IOException, is PackageManager.NameNotFoundException -> {
+                    Timber.e(e)
+                    runCatching { close() }
+                    false
+                }
+                else -> throw e  // Unexpected error
+            }
+        }
     }
 
     fun respond(action: Int, time: Int) {
@@ -95,9 +104,36 @@ abstract class SuRequestHandler(
         policy.until = until
         policy.uid = policy.uid % 100000 + Const.USER_ID * 100000
 
-        if (until >= 0)
-            policyDB.update(policy).blockingAwait()
-
-        respond()
+        GlobalScope.launch(Dispatchers.IO) {
+            try {
+                output.writeInt(policy.policy)
+                output.flush()
+            } catch (e: IOException) {
+                Timber.e(e)
+            } finally {
+                runCatching { close() }
+                if (until >= 0)
+                    policyDB.update(policy)
+            }
+        }
     }
+
+    @Throws(IOException::class)
+    private fun DataInputStream.readRequest(): Map<String, String> {
+        fun readString(): String {
+            val len = readInt()
+            val buf = ByteArray(len)
+            readFully(buf)
+            return String(buf, Charsets.UTF_8)
+        }
+        val ret = ArrayMap<String, String>()
+        while (true) {
+            val name = readString()
+            if (name == "eof")
+                break
+            ret[name] = readString()
+        }
+        return ret
+    }
+
 }

app/src/main/java/com/topjohnwu/magisk/core/tasks/DTBPatch.kt

@@ -1,37 +0,0 @@
-package com.topjohnwu.magisk.core.tasks
-
-import android.content.Context
-import android.content.ContextWrapper
-import android.content.Intent
-import android.content.IntentFilter
-import com.topjohnwu.magisk.core.Const
-import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.core.base.BaseReceiver
-import com.topjohnwu.magisk.core.view.Notifications
-import com.topjohnwu.superuser.Shell
-import timber.log.Timber
-
-private const val DTB_PATCH_RESULT = "dtb_result"
-private const val DTB_PATCH_ACTION = "com.topjohnwu.magisk.DTBO_PATCH"
-
-private class DTBPatchReceiver : BaseReceiver() {
-    override fun onReceive(context: ContextWrapper, intent: Intent?) {
-        intent?.also {
-            val result = it.getIntExtra(DTB_PATCH_RESULT, 1)
-            Timber.d("result=[$result]")
-            if (result == 0)
-                Notifications.dtboPatched(context)
-        }
-        context.unregisterReceiver(this)
-    }
-}
-
-fun patchDTB(context: Context) {
-    if (Info.isNewReboot) {
-        val c = context.applicationContext
-        c.registerReceiver(DTBPatchReceiver(), IntentFilter(DTB_PATCH_ACTION))
-        val broadcastCmd = "am broadcast --user ${Const.USER_ID} -p ${c.packageName} " +
-                "-a $DTB_PATCH_ACTION --ei $DTB_PATCH_RESULT \$result"
-        Shell.su("mm_patch_dtb '$broadcastCmd'").submit()
-    }
-}

app/src/main/java/com/topjohnwu/magisk/core/tasks/FlashResultListener.kt

@@ -1,10 +0,0 @@
-package com.topjohnwu.magisk.core.tasks
-
-import androidx.annotation.MainThread
-
-interface FlashResultListener {
-
-    @MainThread
-    fun onResult(success: Boolean)
-
-}

app/src/main/java/com/topjohnwu/magisk/core/tasks/FlashZip.kt

@@ -2,25 +2,30 @@ package com.topjohnwu.magisk.core.tasks
 
 import android.content.Context
 import android.net.Uri
+import androidx.core.os.postDelayed
 import com.topjohnwu.magisk.core.Const
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.displayName
 import com.topjohnwu.magisk.core.utils.unzip
-import com.topjohnwu.magisk.extensions.fileName
-import com.topjohnwu.magisk.extensions.inject
-import com.topjohnwu.magisk.extensions.readUri
-import com.topjohnwu.magisk.extensions.subscribeK
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.inputStream
+import com.topjohnwu.magisk.ktx.writeTo
 import com.topjohnwu.superuser.Shell
-import io.reactivex.Single
+import com.topjohnwu.superuser.internal.UiThreadHandler
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.koin.core.KoinComponent
+import org.koin.core.inject
+import timber.log.Timber
 import java.io.File
 import java.io.FileNotFoundException
 import java.io.IOException
 
-abstract class FlashZip(
+open class FlashZip(
     private val mUri: Uri,
     private val console: MutableList<String>,
     private val logs: MutableList<String>
-) : FlashResultListener {
+): KoinComponent {
 
-    private val context: Context by inject()
+    val context: Context by inject()
     private val installFolder = File(context.cacheDir, "flash").apply {
         if (!exists()) mkdirs()
     }
@@ -43,9 +48,7 @@ abstract class FlashZip(
         console.add("- Copying zip to temp directory")
 
         runCatching {
-            context.readUri(mUri).use { input ->
-                tmpFile.outputStream().use { out -> input.copyTo(out) }
-            }
+            mUri.inputStream().writeTo(tmpFile)
         }.getOrElse {
             when (it) {
                 is FileNotFoundException -> console.add("! Invalid Uri")
@@ -66,7 +69,7 @@ abstract class FlashZip(
             return false
         }
 
-        console.add("- Installing ${mUri.fileName}")
+        console.add("- Installing ${mUri.displayName}")
 
         val parentFile = tmpFile.parent ?: return false
 
@@ -79,19 +82,37 @@ abstract class FlashZip(
             .exec().isSuccess
     }
 
-    fun exec() = Single
-        .fromCallable {
-            runCatching {
-                flash()
-            }.getOrElse {
-                it.printStackTrace()
+    open suspend fun exec() = withContext(Dispatchers.IO) {
+        try {
+            if (!flash()) {
+                console.add("! Installation failed")
                 false
-            }.apply {
-                Shell.su("cd /", "rm -rf ${tmpFile.parent} ${Const.TMP_FOLDER_PATH}")
-                    .submit()
+            } else {
+                true
             }
+        } catch (e: IOException) {
+            Timber.e(e)
+            false
+        } finally {
+            Shell.su("cd /", "rm -rf ${tmpFile.parent} ${Const.TMP_FOLDER_PATH}").submit()
         }
-        .subscribeK(onError = { onResult(false) }) { onResult(it) }
-        .let { Unit } // ignores result disposable
+    }
+
+    class Uninstall(
+        uri: Uri,
+        console: MutableList<String>,
+        log: MutableList<String>
+    ) : FlashZip(uri, console, log) {
+
+        override suspend fun exec(): Boolean {
+            val success = super.exec()
+            if (success) {
+                UiThreadHandler.handler.postDelayed(3000) {
+                    Shell.su("pm uninstall " + context.packageName).exec()
+                }
+            }
+            return success
+        }
+    }
 
 }

app/src/main/java/com/topjohnwu/magisk/core/tasks/Flashing.kt

@@ -1,51 +0,0 @@
-package com.topjohnwu.magisk.core.tasks
-
-import android.content.Context
-import android.net.Uri
-import androidx.core.os.postDelayed
-import com.topjohnwu.magisk.extensions.inject
-import com.topjohnwu.superuser.Shell
-import com.topjohnwu.superuser.internal.UiThreadHandler
-
-sealed class Flashing(
-    uri: Uri,
-    private val console: MutableList<String>,
-    log: MutableList<String>,
-    private val resultListener: FlashResultListener
-) : FlashZip(uri, console, log) {
-
-    override fun onResult(success: Boolean) {
-        if (!success) {
-            console.add("! Installation failed")
-        }
-
-        resultListener.onResult(success)
-    }
-
-    class Install(
-        uri: Uri,
-        console: MutableList<String>,
-        log: MutableList<String>,
-        resultListener: FlashResultListener
-    ) : Flashing(uri, console, log, resultListener)
-
-    class Uninstall(
-        uri: Uri,
-        console: MutableList<String>,
-        log: MutableList<String>,
-        resultListener: FlashResultListener
-    ) : Flashing(uri, console, log, resultListener) {
-
-        private val context: Context by inject()
-
-        override fun onResult(success: Boolean) {
-            if (success) {
-                UiThreadHandler.handler.postDelayed(3000) {
-                    Shell.su("pm uninstall " + context.packageName).exec()
-                }
-            }
-            super.onResult(success)
-        }
-    }
-
-}

app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstallImpl.kt

@@ -1,370 +0,0 @@
-package com.topjohnwu.magisk.core.tasks
-
-import android.content.Context
-import android.net.Uri
-import android.os.Build
-import android.text.TextUtils
-import androidx.annotation.WorkerThread
-import androidx.core.net.toUri
-import com.topjohnwu.magisk.core.Config
-import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.data.network.GithubRawServices
-import com.topjohnwu.magisk.di.Protected
-import com.topjohnwu.magisk.extensions.*
-import com.topjohnwu.signing.SignBoot
-import com.topjohnwu.superuser.Shell
-import com.topjohnwu.superuser.ShellUtils
-import com.topjohnwu.superuser.internal.NOPList
-import com.topjohnwu.superuser.io.SuFile
-import com.topjohnwu.superuser.io.SuFileInputStream
-import com.topjohnwu.superuser.io.SuFileOutputStream
-import io.reactivex.Single
-import org.kamranzafar.jtar.TarEntry
-import org.kamranzafar.jtar.TarHeader
-import org.kamranzafar.jtar.TarInputStream
-import org.kamranzafar.jtar.TarOutputStream
-import timber.log.Timber
-import java.io.File
-import java.io.FileOutputStream
-import java.io.IOException
-import java.io.InputStream
-import java.nio.ByteBuffer
-import java.util.zip.ZipEntry
-import java.util.zip.ZipInputStream
-
-abstract class MagiskInstallImpl : FlashResultListener {
-
-    protected lateinit var installDir: File
-    private lateinit var srcBoot: String
-    private lateinit var destFile: File
-    private lateinit var zipUri: Uri
-
-    private val console: MutableList<String>
-    private val logs: MutableList<String>
-    private var tarOut: TarOutputStream? = null
-
-    private val service: GithubRawServices by inject()
-    protected val context: Context by inject()
-
-    protected constructor() {
-        console = NOPList.getInstance()
-        logs = NOPList.getInstance()
-    }
-
-    constructor(zip: Uri, out: MutableList<String>, err: MutableList<String>) {
-        console = out
-        logs = err
-        zipUri = zip
-        installDir = File(get<Context>(Protected).filesDir.parent, "install")
-        "rm -rf $installDir".sh()
-        installDir.mkdirs()
-    }
-
-    private fun findImage(): Boolean {
-        srcBoot = "find_boot_image; echo \"\$BOOTIMAGE\"".fsh()
-        if (srcBoot.isEmpty()) {
-            console.add("! Unable to detect target image")
-            return false
-        }
-        console.add("- Target image: $srcBoot")
-        return true
-    }
-
-    private fun findSecondaryImage(): Boolean {
-        val slot = "echo \$SLOT".fsh()
-        val target = if (slot == "_a") "_b" else "_a"
-        console.add("- Target slot: $target")
-        srcBoot = arrayOf(
-                "SLOT=$target",
-                "find_boot_image",
-                "SLOT=$slot",
-                "echo \"\$BOOTIMAGE\"").fsh()
-        if (srcBoot.isEmpty()) {
-            console.add("! Unable to detect target image")
-            return false
-        }
-        console.add("- Target image: $srcBoot")
-        return true
-    }
-
-    private fun extractZip(): Boolean {
-        val arch: String
-        arch = if (Build.VERSION.SDK_INT >= 21) {
-            val abis = listOf(*Build.SUPPORTED_ABIS)
-            if (abis.contains("x86")) "x86" else "arm"
-        } else {
-            if (TextUtils.equals(Build.CPU_ABI, "x86")) "x86" else "arm"
-        }
-
-        console.add("- Device platform: " + Build.CPU_ABI)
-
-        try {
-            ZipInputStream(context.readUri(zipUri).buffered()).use { zi ->
-                lateinit var ze: ZipEntry
-                while (zi.nextEntry?.let { ze = it } != null) {
-                    if (ze.isDirectory)
-                        continue
-                    var name: String? = null
-                    val names = arrayOf("$arch/", "common/", "META-INF/com/google/android/update-binary")
-                    for (n in names) {
-                        ze.name.run {
-                            if (startsWith(n)) {
-                                name = substring(lastIndexOf('/') + 1)
-                            }
-                        }
-                        name ?: continue
-                        break
-                    }
-                    if (name == null && ze.name.startsWith("chromeos/"))
-                        name = ze.name
-                    if (name == null)
-                        continue
-                    val dest = if (installDir is SuFile)
-                        SuFile(installDir, name)
-                    else
-                        File(installDir, name)
-                    dest.parentFile!!.mkdirs()
-                    SuFileOutputStream(dest).use { zi.copyTo(it) }
-                }
-            }
-        } catch (e: IOException) {
-            console.add("! Cannot unzip zip")
-            Timber.e(e)
-            return false
-        }
-
-        val init64 = SuFile.open(installDir, "magiskinit64")
-        if (Build.VERSION.SDK_INT >= 21 && Build.SUPPORTED_64_BIT_ABIS.isNotEmpty()) {
-            init64.renameTo(SuFile.open(installDir, "magiskinit"))
-        } else {
-            init64.delete()
-        }
-        "cd $installDir; chmod 755 *".sh()
-        return true
-    }
-
-    private fun newEntry(name: String, size: Long): TarEntry {
-        console.add("-- Writing: $name")
-        return TarEntry(TarHeader.createHeader(name, size, 0, false, 420 /* 0644 */))
-    }
-
-    @Throws(IOException::class)
-    private fun handleTar(input: InputStream) {
-        console.add("- Processing tar file")
-        var vbmeta = false
-        val tarOut = TarOutputStream(destFile)
-        this.tarOut = tarOut
-        TarInputStream(input).use { tarIn ->
-            lateinit var entry: TarEntry
-            while (tarIn.nextEntry?.let { entry = it } != null) {
-                if (entry.name.contains("boot.img") || entry.name.contains("recovery.img")) {
-                    val name = entry.name
-                    console.add("-- Extracting: $name")
-                    val extract = File(installDir, name)
-                    FileOutputStream(extract).use { tarIn.copyTo(it) }
-                    if (name.contains(".lz4")) {
-                        console.add("-- Decompressing: $name")
-                        "./magiskboot decompress $extract".sh()
-                    }
-                } else if (entry.name.contains("vbmeta.img")) {
-                    vbmeta = true
-                    val buf = ByteBuffer.allocate(256)
-                    buf.put("AVB0".toByteArray())   // magic
-                    buf.putInt(1)                   // required_libavb_version_major
-                    buf.putInt(120, 2)              // flags
-                    buf.position(128)               // release_string
-                    buf.put("avbtool 1.1.0".toByteArray())
-                    tarOut.putNextEntry(newEntry("vbmeta.img", 256))
-                    tarOut.write(buf.array())
-                } else {
-                    console.add("-- Writing: " + entry.name)
-                    tarOut.putNextEntry(entry)
-                    tarIn.copyTo(tarOut)
-                }
-            }
-            val boot = SuFile.open(installDir, "boot.img")
-            val recovery = SuFile.open(installDir, "recovery.img")
-            if (vbmeta && recovery.exists() && boot.exists()) {
-                // Install Magisk to recovery
-                srcBoot = recovery.path
-                // Repack boot image to prevent restore
-                arrayOf(
-                        "./magiskboot unpack boot.img",
-                        "./magiskboot repack boot.img",
-                        "./magiskboot cleanup",
-                        "mv new-boot.img boot.img").sh()
-                SuFileInputStream(boot).use {
-                    tarOut.putNextEntry(newEntry("boot.img", boot.length()))
-                    it.copyTo(tarOut)
-                }
-                boot.delete()
-            } else {
-                if (!boot.exists()) {
-                    console.add("! No boot image found")
-                    throw IOException()
-                }
-                srcBoot = boot.path
-            }
-        }
-    }
-
-    private fun handleFile(uri: Uri): Boolean {
-        try {
-            context.readUri(uri).buffered().use {
-                it.mark(500)
-                val magic = ByteArray(5)
-                if (it.skip(257) != 257L || it.read(magic) != magic.size) {
-                    console.add("! Invalid file")
-                    return false
-                }
-                it.reset()
-                if (magic.contentEquals("ustar".toByteArray())) {
-                    destFile = File(Config.downloadDirectory, "magisk_patched.tar")
-                    handleTar(it)
-                } else {
-                    // Raw image
-                    srcBoot = File(installDir, "boot.img").path
-                    destFile = File(Config.downloadDirectory, "magisk_patched.img")
-                    console.add("- Copying image to cache")
-                    FileOutputStream(srcBoot).use { out -> it.copyTo(out) }
-                }
-            }
-        } catch (e: IOException) {
-            console.add("! Process error")
-            Timber.e(e)
-            return false
-        }
-
-        return true
-    }
-
-    private fun patchBoot(): Boolean {
-        var isSigned = false
-        try {
-            SuFileInputStream(srcBoot).use {
-                isSigned = SignBoot.verifySignature(it, null)
-                if (isSigned) {
-                    console.add("- Boot image is signed with AVB 1.0")
-                }
-            }
-        } catch (e: IOException) {
-            console.add("! Unable to check signature")
-            return false
-        }
-
-        if (!("KEEPFORCEENCRYPT=${Info.keepEnc} KEEPVERITY=${Info.keepVerity} " +
-                "RECOVERYMODE=${Info.recovery} sh update-binary " +
-                "sh boot_patch.sh $srcBoot").sh().isSuccess) {
-            return false
-        }
-
-        val job = Shell.sh(
-                "./magiskboot cleanup",
-                "mv bin/busybox busybox",
-                "rm -rf magisk.apk bin boot.img update-binary",
-                "cd /")
-
-        val patched = File(installDir, "new-boot.img")
-        if (isSigned) {
-            console.add("- Signing boot image with verity keys")
-            val signed = File(installDir, "signed.img")
-            try {
-                withStreams(SuFileInputStream(patched), signed.outputStream().buffered()) {
-                    input, out -> SignBoot.doSignature("/boot", input, out, null, null)
-                }
-            } catch (e: IOException) {
-                console.add("! Unable to sign image")
-                Timber.e(e)
-                return false
-            }
-
-            job.add("mv -f $signed $patched")
-        }
-        job.exec()
-        return true
-    }
-
-    private fun flashBoot(): Boolean {
-        if (!"direct_install $installDir $srcBoot".sh().isSuccess)
-            return false
-        arrayOf(
-            "(KEEPVERITY=${Info.keepVerity} patch_dtb_partitions)",
-            "run_migrations"
-        ).sh()
-        return true
-    }
-
-    private fun storeBoot(): Boolean {
-        val patched = SuFile.open(installDir, "new-boot.img")
-        try {
-            val os = tarOut?.let {
-                it.putNextEntry(newEntry(
-                    if (srcBoot.contains("recovery")) "recovery.img" else "boot.img",
-                    patched.length()))
-                tarOut = null
-                it
-            } ?: destFile.outputStream()
-            patched.suInputStream().use { it.copyTo(os); os.close() }
-        } catch (e: IOException) {
-            console.add("! Failed to output to $destFile")
-            Timber.e(e)
-            return false
-        }
-
-        patched.delete()
-        console.add("")
-        console.add("****************************")
-        console.add(" Output file is placed in ")
-        console.add(" $destFile ")
-        console.add("****************************")
-        return true
-    }
-
-    private fun postOTA(): Boolean {
-        val bootctl = SuFile("/data/adb/bootctl")
-        try {
-            withStreams(service.fetchBootctl().blockingGet().byteStream(), bootctl.suOutputStream()) {
-                input, out -> input.copyTo(out)
-            }
-        } catch (e: IOException) {
-            console.add("! Unable to download bootctl")
-            Timber.e(e)
-            return false
-        }
-
-        "post_ota ${bootctl.parent}".sh()
-
-        console.add("***************************************")
-        console.add(" Next reboot will boot to second slot!")
-        console.add("***************************************")
-        return true
-    }
-
-    private fun String.sh() = Shell.sh(this).to(console, logs).exec()
-    private fun Array<String>.sh() = Shell.sh(*this).to(console, logs).exec()
-    private fun String.fsh() = ShellUtils.fastCmd(this)
-    private fun Array<String>.fsh() = ShellUtils.fastCmd(*this)
-
-    protected fun doPatchFile(patchFile: Uri) =
-        extractZip() && handleFile(patchFile) && patchBoot() && storeBoot()
-
-    protected fun direct() = findImage() && extractZip() && patchBoot() && flashBoot()
-
-    protected fun secondSlot() =
-        findSecondaryImage() && extractZip() && patchBoot() && flashBoot() && postOTA()
-
-    protected fun fixEnv(zip: File): Boolean {
-        installDir = SuFile("/data/adb/magisk")
-        Shell.su("rm -rf /data/adb/magisk/*").exec()
-        zipUri = zip.toUri()
-        return extractZip() && Shell.su("fix_env").exec().isSuccess
-    }
-
-    @WorkerThread
-    protected abstract fun operations(): Boolean
-
-    fun exec() {
-        Single.fromCallable { operations() }.subscribeK { onResult(it) }
-    }
-
-}

app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt

@@ -1,71 +1,431 @@
 package com.topjohnwu.magisk.core.tasks
 
+import android.content.Context
 import android.content.Intent
 import android.net.Uri
+import android.os.Build
 import android.widget.Toast
+import androidx.annotation.WorkerThread
 import androidx.core.os.postDelayed
 import androidx.localbroadcastmanager.content.LocalBroadcastManager
 import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.core.utils.Utils
-import com.topjohnwu.magisk.extensions.reboot
-import com.topjohnwu.magisk.model.events.dialog.EnvFixDialog
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.inputStream
+import com.topjohnwu.magisk.core.utils.MediaStoreUtils.outputStream
+import com.topjohnwu.magisk.data.network.GithubRawServices
+import com.topjohnwu.magisk.di.Protected
+import com.topjohnwu.magisk.events.dialog.EnvFixDialog
+import com.topjohnwu.magisk.ktx.reboot
+import com.topjohnwu.magisk.ktx.withStreams
+import com.topjohnwu.magisk.utils.Utils
+import com.topjohnwu.signing.SignBoot
 import com.topjohnwu.superuser.Shell
+import com.topjohnwu.superuser.ShellUtils
+import com.topjohnwu.superuser.internal.NOPList
 import com.topjohnwu.superuser.internal.UiThreadHandler
-import java.io.File
+import com.topjohnwu.superuser.io.SuFile
+import com.topjohnwu.superuser.io.SuFileInputStream
+import com.topjohnwu.superuser.io.SuFileOutputStream
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.kamranzafar.jtar.TarEntry
+import org.kamranzafar.jtar.TarHeader
+import org.kamranzafar.jtar.TarInputStream
+import org.kamranzafar.jtar.TarOutputStream
+import org.koin.core.KoinComponent
+import org.koin.core.get
+import org.koin.core.inject
+import timber.log.Timber
+import java.io.*
+import java.util.zip.ZipEntry
+import java.util.zip.ZipInputStream
+
+abstract class MagiskInstallImpl : KoinComponent {
+
+    protected lateinit var installDir: File
+    private lateinit var srcBoot: String
+    private lateinit var zipUri: Uri
+
+    protected val console: MutableList<String>
+    private val logs: MutableList<String>
+    private var tarOut: TarOutputStream? = null
+
+    private val service: GithubRawServices by inject()
+    protected val context: Context by inject()
+
+    protected constructor() {
+        console = NOPList.getInstance()
+        logs = NOPList.getInstance()
+    }
+
+    protected constructor(zip: Uri, out: MutableList<String>, err: MutableList<String>) {
+        console = out
+        logs = err
+        zipUri = zip
+        installDir = File(get<Context>(Protected).filesDir.parent, "install")
+        "rm -rf $installDir".sh()
+        installDir.mkdirs()
+    }
+
+    private fun findImage(): Boolean {
+        srcBoot = "find_boot_image; echo \"\$BOOTIMAGE\"".fsh()
+        if (srcBoot.isEmpty()) {
+            console.add("! Unable to detect target image")
+            return false
+        }
+        console.add("- Target image: $srcBoot")
+        return true
+    }
+
+    private fun findSecondaryImage(): Boolean {
+        val slot = "echo \$SLOT".fsh()
+        val target = if (slot == "_a") "_b" else "_a"
+        console.add("- Target slot: $target")
+        srcBoot = arrayOf(
+            "SLOT=$target",
+            "find_boot_image",
+            "SLOT=$slot",
+            "echo \"\$BOOTIMAGE\"").fsh()
+        if (srcBoot.isEmpty()) {
+            console.add("! Unable to detect target image")
+            return false
+        }
+        console.add("- Target image: $srcBoot")
+        return true
+    }
+
+    @Suppress("DEPRECATION")
+    private fun extractZip(): Boolean {
+        val arch: String
+        arch = if (Build.VERSION.SDK_INT >= 21) {
+            val abis = listOf(*Build.SUPPORTED_ABIS)
+            if (abis.contains("x86")) "x86" else "arm"
+        } else {
+            if (Build.CPU_ABI == "x86") "x86" else "arm"
+        }
+
+        console.add("- Device platform: " + Build.CPU_ABI)
+
+        try {
+            ZipInputStream(zipUri.inputStream().buffered()).use { zi ->
+                lateinit var ze: ZipEntry
+                while (zi.nextEntry?.let { ze = it } != null) {
+                    if (ze.isDirectory)
+                        continue
+                    var name: String? = null
+                    val names = arrayOf("$arch/", "common/", "META-INF/com/google/android/update-binary")
+                    for (n in names) {
+                        ze.name.run {
+                            if (startsWith(n)) {
+                                name = substring(lastIndexOf('/') + 1)
+                            }
+                        }
+                        name ?: continue
+                        break
+                    }
+                    if (name == null && ze.name.startsWith("chromeos/"))
+                        name = ze.name
+                    name?.also {
+                        val dest = if (installDir is SuFile)
+                            SuFile(installDir, it)
+                        else
+                            File(installDir, it)
+                        dest.parentFile!!.mkdirs()
+                        SuFileOutputStream(dest).use { s -> zi.copyTo(s) }
+                    } ?: continue
+                }
+            }
+        } catch (e: IOException) {
+            console.add("! Cannot unzip zip")
+            Timber.e(e)
+            return false
+        }
+
+        val init64 = SuFile.open(installDir, "magiskinit64")
+        if (Build.VERSION.SDK_INT >= 21 && Build.SUPPORTED_64_BIT_ABIS.isNotEmpty()) {
+            init64.renameTo(SuFile.open(installDir, "magiskinit"))
+        } else {
+            init64.delete()
+        }
+        "cd $installDir; chmod 755 *".sh()
+        return true
+    }
+
+    private fun newEntry(name: String, size: Long): TarEntry {
+        console.add("-- Writing: $name")
+        return TarEntry(TarHeader.createHeader(name, size, 0, false, 420 /* 0644 */))
+    }
+
+    @Throws(IOException::class)
+    private fun handleTar(input: InputStream, output: OutputStream): OutputStream {
+        console.add("- Processing tar file")
+        val tarOut = TarOutputStream(output)
+        TarInputStream(input).use { tarIn ->
+            lateinit var entry: TarEntry
+            while (tarIn.nextEntry?.let { entry = it } != null) {
+                if (entry.name.contains("boot.img") ||
+                    (Config.recovery && entry.name.contains("recovery.img"))) {
+                    val name = entry.name
+                    console.add("-- Extracting: $name")
+                    val extract = File(installDir, name)
+                    FileOutputStream(extract).use { tarIn.copyTo(it) }
+                    if (name.contains(".lz4")) {
+                        console.add("-- Decompressing: $name")
+                        "./magiskboot decompress $extract".sh()
+                    }
+                } else {
+                    console.add("-- Copying: " + entry.name)
+                    tarOut.putNextEntry(entry)
+                    tarIn.copyTo(tarOut)
+                }
+            }
+            val boot = SuFile.open(installDir, "boot.img")
+            val recovery = SuFile.open(installDir, "recovery.img")
+            if (recovery.exists() && boot.exists()) {
+                // Install Magisk to recovery
+                srcBoot = recovery.path
+                // Repack boot image to prevent restore
+                arrayOf(
+                    "./magiskboot unpack boot.img",
+                    "./magiskboot repack boot.img",
+                    "./magiskboot cleanup",
+                    "mv new-boot.img boot.img").sh()
+                SuFileInputStream(boot).use {
+                    tarOut.putNextEntry(newEntry("boot.img", boot.length()))
+                    it.copyTo(tarOut)
+                }
+                boot.delete()
+            } else {
+                if (!boot.exists()) {
+                    console.add("! No boot image found")
+                    throw IOException()
+                }
+                srcBoot = boot.path
+            }
+        }
+        return tarOut
+    }
+
+    private fun handleFile(uri: Uri): Boolean {
+        val outStream: OutputStream
+        val outFile: MediaStoreUtils.UriFile
+
+        // Process input file
+        try {
+            uri.inputStream().buffered().use { src ->
+                src.mark(500)
+                val magic = ByteArray(5)
+                if (src.skip(257) != 257L || src.read(magic) != magic.size) {
+                    console.add("! Invalid input file")
+                    return false
+                }
+                src.reset()
+                outStream = if (magic.contentEquals("ustar".toByteArray())) {
+                    outFile = MediaStoreUtils.getFile("magisk_patched.tar")
+                    handleTar(src, outFile.uri.outputStream())
+                } else {
+                    // Raw image
+                    srcBoot = File(installDir, "boot.img").path
+                    console.add("- Copying image to cache")
+                    FileOutputStream(srcBoot).use { src.copyTo(it) }
+                    outFile = MediaStoreUtils.getFile("magisk_patched.img")
+                    outFile.uri.outputStream()
+                }
+            }
+        } catch (e: IOException) {
+            console.add("! Process error")
+            Timber.e(e)
+            return false
+        }
+
+        // Patch file
+        if (!patchBoot())
+            return false
+
+        // Output file
+        try {
+            val patched = SuFile.open(installDir, "new-boot.img")
+            if (outStream is TarOutputStream) {
+                val name = if (srcBoot.contains("recovery")) "recovery.img" else "boot.img"
+                outStream.putNextEntry(newEntry(name, patched.length()))
+            }
+            withStreams(SuFileInputStream(patched), outStream) { src, out -> src.copyTo(out) }
+            patched.delete()
+
+            console.add("")
+            console.add("****************************")
+            console.add(" Output file is written to ")
+            console.add(" $outFile ")
+            console.add("****************************")
+        } catch (e: IOException) {
+            console.add("! Failed to output to $outFile")
+            Timber.e(e)
+            return false
+        }
+
+        return true
+    }
+
+    private fun patchBoot(): Boolean {
+        var srcNand = ""
+        if ("[ -c $srcBoot ] && nanddump -f boot.img $srcBoot".sh().isSuccess) {
+            srcNand = srcBoot
+            srcBoot = File(installDir, "boot.img").path
+        }
+
+        var isSigned = false
+        try {
+            SuFileInputStream(srcBoot).use {
+                isSigned = SignBoot.verifySignature(it, null)
+                if (isSigned) {
+                    console.add("- Boot image is signed with AVB 1.0")
+                }
+            }
+        } catch (e: IOException) {
+            console.add("! Unable to check signature")
+            return false
+        }
+
+        if (!("KEEPFORCEENCRYPT=${Config.keepEnc} KEEPVERITY=${Config.keepVerity} " +
+                "RECOVERYMODE=${Config.recovery} sh update-binary " +
+                "sh boot_patch.sh $srcBoot").sh().isSuccess) {
+            return false
+        }
+
+        if (srcNand.isNotEmpty()) {
+            srcBoot = srcNand
+        }
+
+        val job = Shell.sh(
+            "./magiskboot cleanup",
+            "mv bin/busybox busybox",
+            "rm -rf magisk.apk bin boot.img update-binary",
+            "cd /")
+
+        val patched = File(installDir, "new-boot.img")
+        if (isSigned) {
+            console.add("- Signing boot image with verity keys")
+            val signed = File(installDir, "signed.img")
+            try {
+                withStreams(SuFileInputStream(patched), signed.outputStream().buffered()) {
+                    input, out -> SignBoot.doSignature("/boot", input, out, null, null)
+                }
+            } catch (e: IOException) {
+                console.add("! Unable to sign image")
+                Timber.e(e)
+                return false
+            }
+
+            job.add("mv -f $signed $patched")
+        }
+        job.exec()
+        return true
+    }
+
+    private fun flashBoot(): Boolean {
+        if (!"direct_install $installDir $srcBoot".sh().isSuccess)
+            return false
+        "run_migrations".sh()
+        return true
+    }
+
+    private suspend fun postOTA(): Boolean {
+        val bootctl = SuFile("/data/adb/bootctl")
+        try {
+            withStreams(service.fetchBootctl().byteStream(), SuFileOutputStream(bootctl)) {
+                it, out -> it.copyTo(out)
+            }
+        } catch (e: IOException) {
+            console.add("! Unable to download bootctl")
+            Timber.e(e)
+            return false
+        }
+
+        "post_ota ${bootctl.parent}".sh()
+
+        console.add("***************************************")
+        console.add(" Next reboot will boot to second slot!")
+        console.add("***************************************")
+        return true
+    }
+
+    private fun String.sh() = Shell.sh(this).to(console, logs).exec()
+    private fun Array<String>.sh() = Shell.sh(*this).to(console, logs).exec()
+    private fun String.fsh() = ShellUtils.fastCmd(this)
+    private fun Array<String>.fsh() = ShellUtils.fastCmd(*this)
+
+    protected fun doPatchFile(patchFile: Uri) = extractZip() && handleFile(patchFile)
+
+    protected fun direct() = findImage() && extractZip() && patchBoot() && flashBoot()
+
+    protected suspend fun secondSlot() =
+        findSecondaryImage() && extractZip() && patchBoot() && flashBoot() && postOTA()
+
+    protected fun fixEnv(zip: Uri): Boolean {
+        installDir = SuFile("/data/adb/magisk")
+        Shell.su("rm -rf /data/adb/magisk/*").exec()
+        zipUri = zip
+        return extractZip() && Shell.su("fix_env").exec().isSuccess
+    }
+
+    @WorkerThread
+    protected abstract suspend fun operations(): Boolean
+
+    open suspend fun exec() = withContext(Dispatchers.IO) { operations() }
+}
 
 sealed class MagiskInstaller(
     file: Uri,
-    private val console: MutableList<String>,
-    logs: MutableList<String>,
-    private val resultListener: FlashResultListener
+    console: MutableList<String>,
+    logs: MutableList<String>
 ) : MagiskInstallImpl(file, console, logs) {
 
-    override fun onResult(success: Boolean) {
+    override suspend fun exec(): Boolean {
+        val success = super.exec()
         if (success) {
             console.add("- All done!")
         } else {
             Shell.sh("rm -rf $installDir").submit()
             console.add("! Installation failed")
         }
-        resultListener.onResult(success)
+        return success
     }
 
     class Patch(
         file: Uri,
         private val uri: Uri,
         console: MutableList<String>,
-        logs: MutableList<String>,
-        resultListener: FlashResultListener
-    ) : MagiskInstaller(file, console, logs, resultListener) {
-        override fun operations() = doPatchFile(uri)
+        logs: MutableList<String>
+    ) : MagiskInstaller(file, console, logs) {
+        override suspend fun operations() = doPatchFile(uri)
     }
 
     class SecondSlot(
         file: Uri,
         console: MutableList<String>,
-        logs: MutableList<String>,
-        resultListener: FlashResultListener
-    ) : MagiskInstaller(file, console, logs, resultListener) {
-        override fun operations() = secondSlot()
+        logs: MutableList<String>
+    ) : MagiskInstaller(file, console, logs) {
+        override suspend fun operations() = secondSlot()
     }
 
     class Direct(
         file: Uri,
         console: MutableList<String>,
-        logs: MutableList<String>,
-        resultListener: FlashResultListener
-    ) : MagiskInstaller(file, console, logs, resultListener) {
-        override fun operations() = direct()
+        logs: MutableList<String>
+    ) : MagiskInstaller(file, console, logs) {
+        override suspend fun operations() = direct()
     }
 
 }
 
 class EnvFixTask(
-    private val zip: File
+    private val zip: Uri
 ) : MagiskInstallImpl() {
-    override fun operations() = fixEnv(zip)
+    override suspend fun operations() = fixEnv(zip)
 
-    override fun onResult(success: Boolean) {
+    override suspend fun exec(): Boolean {
+        val success = super.exec()
         LocalBroadcastManager.getInstance(context).sendBroadcast(Intent(EnvFixDialog.DISMISS))
         Utils.toast(
             if (success) R.string.reboot_delay_toast else R.string.setup_fail,
@@ -73,5 +433,6 @@ class EnvFixTask(
         )
         if (success)
             UiThreadHandler.handler.postDelayed(5000) { reboot() }
+        return success
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/tasks/PatchAPK.kt

@@ -0,0 +1,139 @@
+package com.topjohnwu.magisk.core.tasks
+
+import android.content.Context
+import android.os.Build.VERSION.SDK_INT
+import android.widget.Toast
+import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.Const
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.isRunningAsStub
+import com.topjohnwu.magisk.core.utils.AXML
+import com.topjohnwu.magisk.core.utils.Keygen
+import com.topjohnwu.magisk.data.network.GithubRawServices
+import com.topjohnwu.magisk.ktx.get
+import com.topjohnwu.magisk.ktx.writeTo
+import com.topjohnwu.magisk.utils.Utils
+import com.topjohnwu.magisk.view.Notifications
+import com.topjohnwu.signing.JarMap
+import com.topjohnwu.signing.SignApk
+import com.topjohnwu.superuser.Shell
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import timber.log.Timber
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+import java.security.SecureRandom
+
+object PatchAPK {
+
+    private const val ALPHA = "abcdefghijklmnopqrstuvwxyz"
+    private const val ALPHADOTS = "$ALPHA....."
+
+    private const val APP_ID = "com.topjohnwu.magisk"
+    private const val APP_NAME = "Magisk Manager"
+
+    // Some arbitrary limit
+    const val MAX_LABEL_LENGTH = 32
+
+    private fun genPackageName(): CharSequence {
+        val random = SecureRandom()
+        val len = 5 + random.nextInt(15)
+        val builder = StringBuilder(len)
+        var next: Char
+        var prev = 0.toChar()
+        for (i in 0 until len) {
+            next = if (prev == '.' || i == len - 1) {
+                ALPHA[random.nextInt(ALPHA.length)]
+            } else {
+                ALPHADOTS[random.nextInt(ALPHADOTS.length)]
+            }
+            builder.append(next)
+            prev = next
+        }
+        if (!builder.contains('.')) {
+            // Pick a random index and set it as dot
+            val idx = random.nextInt(len - 1)
+            builder[idx] = '.'
+        }
+        return builder
+    }
+
+    fun patch(
+        context: Context,
+        apk: String, out: String,
+        pkg: CharSequence, label: CharSequence
+    ): Boolean {
+        try {
+            val jar = JarMap.open(apk)
+            val je = jar.getJarEntry(Const.ANDROID_MANIFEST)
+            val xml = AXML(jar.getRawData(je))
+
+            if (!xml.findAndPatch(APP_ID to pkg.toString(), APP_NAME to label.toString()))
+                return false
+
+            // Write apk changes
+            jar.getOutputStream(je).write(xml.bytes)
+            val keys = Keygen(context)
+            SignApk.sign(keys.cert, keys.key, jar, FileOutputStream(out))
+        } catch (e: Exception) {
+            Timber.e(e)
+            return false
+        }
+
+        return true
+    }
+
+    private suspend fun patchAndHide(context: Context, label: String): Boolean {
+        val dlStub = !isRunningAsStub && SDK_INT >= 28 && Const.Version.atLeast_20_2()
+        val src = if (dlStub) {
+            val stub = File(context.cacheDir, "stub.apk")
+            val svc = get<GithubRawServices>()
+            try {
+                svc.fetchFile(Info.remote.stub.link).byteStream().use {
+                    it.writeTo(stub)
+                }
+            } catch (e: IOException) {
+                Timber.e(e)
+                return false
+            }
+            stub.path
+        } else {
+            context.packageCodePath
+        }
+
+        // Generate a new random package name and signature
+        val repack = File(context.cacheDir, "patched.apk")
+        val pkg = genPackageName()
+        Config.keyStoreRaw = ""
+
+        if (!patch(context, src, repack.path, pkg, label))
+            return false
+
+        // Install the application
+        if (!Shell.su("adb_pm_install $repack").exec().isSuccess)
+            return false
+
+        Config.suManager = pkg.toString()
+        Config.export()
+        Shell.su("pm uninstall $APP_ID").submit()
+
+        return true
+    }
+
+    fun hideManager(context: Context, label: String) {
+        val progress = Notifications.progress(context, context.getString(R.string.hide_manager_title))
+        Notifications.mgr.notify(Const.ID.HIDE_MANAGER_NOTIFICATION_ID, progress.build())
+        GlobalScope.launch {
+            val result = withContext(Dispatchers.IO) {
+                patchAndHide(context, label)
+            }
+            if (!result)
+                Utils.toast(R.string.hide_manager_fail_toast, Toast.LENGTH_LONG)
+            Notifications.mgr.cancel(Const.ID.HIDE_MANAGER_NOTIFICATION_ID)
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/tasks/RepoUpdater.kt

@@ -5,10 +5,8 @@ import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.core.model.module.Repo
 import com.topjohnwu.magisk.data.database.RepoDao
 import com.topjohnwu.magisk.data.network.GithubApiServices
-import io.reactivex.Completable
-import io.reactivex.Flowable
-import io.reactivex.rxkotlin.toFlowable
-import io.reactivex.schedulers.Schedulers
+import com.topjohnwu.magisk.ktx.synchronized
+import kotlinx.coroutines.*
 import timber.log.Timber
 import java.net.HttpURLConnection
 import java.text.SimpleDateFormat
@@ -19,69 +17,89 @@ class RepoUpdater(
     private val api: GithubApiServices,
     private val repoDB: RepoDao
 ) {
-    private fun loadRepos(repos: List<GithubRepoInfo>, cached: MutableSet<String>) =
-        repos.toFlowable().parallel().runOn(Schedulers.io()).map {
-            // Skip submission
-            if (it.id == "submission")
-                return@map
-            val repo = repoDB.getRepo(it.id)?.apply { cached.remove(it.id) } ?: Repo(it.id)
-            repo.runCatching {
-                update(it.pushDate)
-                repoDB.addRepo(this)
-            }.getOrElse(Timber::e)
-        }.sequential()
 
-    private fun loadPage(
-        cached: MutableSet<String>,
-        page: Int = 1,
-        etag: String = ""
-    ): Flowable<Unit> = api.fetchRepos(page, etag).flatMap {
-        it.error()?.also { throw it }
-        it.response()?.run {
-            if (code() == HttpURLConnection.HTTP_NOT_MODIFIED)
-                return@run Flowable.error<Unit>(CachedException())
+    private fun String.trimEtag() = substring(indexOf('\"'), lastIndexOf('\"') + 1)
 
-            if (page == 1)
-                repoDB.etagKey = headers()[Const.Key.ETAG_KEY].orEmpty().trimEtag()
-
-            val flow = loadRepos(body()!!, cached)
-            if (headers()[Const.Key.LINK_KEY].orEmpty().contains("next")) {
-                flow.mergeWith(loadPage(cached, page + 1))
-            } else {
-                flow
+    private suspend fun forcedReload(cached: MutableSet<String>) = coroutineScope {
+        cached.forEach {
+            launch {
+                val repo = repoDB.getRepo(it)!!
+                try {
+                    repo.update()
+                    repoDB.addRepo(repo)
+                } catch (e: Repo.IllegalRepoException) {
+                    Timber.e(e)
+                }
             }
         }
     }
 
-    private fun forcedReload(cached: MutableSet<String>) =
-        cached.toFlowable().parallel().runOn(Schedulers.io()).map {
-            runCatching {
-                Repo(it).update()
-            }.getOrElse(Timber::e)
-        }.sequential()
-
-    private fun String.trimEtag() = substring(indexOf('\"'), lastIndexOf('\"') + 1)
-
-    @Suppress("RedundantLambdaArrow")
-    operator fun invoke(forced: Boolean) : Completable {
-        return Flowable
-            .fromCallable { Collections.synchronizedSet(HashSet(repoDB.repoIDList)) }
-            .flatMap { cached ->
-                loadPage(cached, etag = repoDB.etagKey).doOnComplete {
-                    repoDB.removeRepos(cached)
-                }.onErrorResumeNext { it: Throwable ->
-                    if (it is CachedException) {
-                        if (forced)
-                            return@onErrorResumeNext forcedReload(cached)
-                    } else {
-                        Timber.e(it)
-                    }
-                    Flowable.empty()
+    private suspend fun loadRepos(
+        repos: List<GithubRepoInfo>,
+        cached: MutableSet<String>
+    ) = coroutineScope {
+        repos.forEach {
+            // Skip submission
+            if (it.id == "submission")
+                return@forEach
+            launch {
+                val repo = repoDB.getRepo(it.id)?.apply { cached.remove(it.id) } ?: Repo(it.id)
+                try {
+                    repo.update(it.pushDate)
+                    repoDB.addRepo(repo)
+                } catch (e: Repo.IllegalRepoException) {
+                    Timber.e(e)
                 }
-            }.ignoreElements()
+            }
+        }
     }
 
-    class CachedException : Exception()
+    private enum class PageResult {
+        SUCCESS,
+        CACHED,
+        ERROR
+    }
+
+    private suspend fun loadPage(
+        cached: MutableSet<String>,
+        page: Int = 1,
+        etag: String = ""
+    ): PageResult = coroutineScope {
+        runCatching {
+            val result = api.fetchRepos(page, etag)
+            result.run {
+                if (code() == HttpURLConnection.HTTP_NOT_MODIFIED)
+                    return@coroutineScope PageResult.CACHED
+
+                if (!isSuccessful)
+                    return@coroutineScope PageResult.ERROR
+
+                if (page == 1)
+                    repoDB.etagKey = headers()[Const.Key.ETAG_KEY].orEmpty().trimEtag()
+
+                val repoLoad = async { loadRepos(body()!!, cached) }
+                val next = if (headers()[Const.Key.LINK_KEY].orEmpty().contains("next")) {
+                    async { loadPage(cached, page + 1) }
+                } else {
+                    async { PageResult.SUCCESS }
+                }
+                repoLoad.await()
+                return@coroutineScope next.await()
+            }
+        }.getOrElse {
+            Timber.e(it)
+            PageResult.ERROR
+        }
+    }
+
+    suspend fun run(forced: Boolean) = withContext(Dispatchers.IO) {
+        val cached = HashSet(repoDB.repoIDList).synchronized()
+        when (loadPage(cached, etag = repoDB.etagKey)) {
+            PageResult.CACHED -> if (forced) forcedReload(cached)
+            PageResult.SUCCESS -> repoDB.removeRepos(cached)
+            PageResult.ERROR -> Unit
+        }
+    }
 }
 
 private val dateFormat: SimpleDateFormat =

app/src/main/java/com/topjohnwu/magisk/core/utils/AXML.kt

@@ -0,0 +1,132 @@
+package com.topjohnwu.magisk.core.utils
+
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+import java.nio.ByteOrder.LITTLE_ENDIAN
+import java.nio.charset.Charset
+import java.util.*
+
+class AXML(b: ByteArray) {
+
+    var bytes = b
+        private set
+
+    companion object {
+        private const val CHUNK_SIZE_OFF = 4
+        private const val STRING_INDICES_OFF = 7 * 4
+        private val UTF_16LE = Charset.forName("UTF-16LE")
+    }
+
+    /**
+     * String pool header:
+     * 0:  0x1C0001
+     * 1:  chunk size
+     * 2:  number of strings
+     * 3:  number of styles (assert as 0)
+     * 4:  flags
+     * 5:  offset to string data
+     * 6:  offset to style data (assert as 0)
+     *
+     * Followed by an array of uint32_t with size = number of strings
+     * Each entry points to an offset into the string data
+     */
+    fun findAndPatch(vararg patterns: Pair<String, String>): Boolean {
+        val buffer = ByteBuffer.wrap(bytes).order(LITTLE_ENDIAN)
+
+        fun findStringPool(): Int {
+            var offset = 8
+            while (offset < bytes.size) {
+                if (buffer.getInt(offset) == 0x1C0001)
+                    return offset
+                offset += buffer.getInt(offset + CHUNK_SIZE_OFF)
+            }
+            return -1
+        }
+
+        var patch = false
+        val start = findStringPool()
+        if (start < 0)
+            return false
+
+        // Read header
+        buffer.position(start + 4)
+        val intBuf = buffer.asIntBuffer()
+        val size = intBuf.get()
+        val count = intBuf.get()
+        intBuf.get()
+        intBuf.get()
+        val dataOff = start + intBuf.get()
+        intBuf.get()
+
+        val strings = ArrayList<String>(count)
+        // Read and patch all strings
+        loop@ for (i in 0 until count) {
+            val off = dataOff + intBuf.get()
+            val len = buffer.getShort(off)
+            val str = String(bytes, off + 2, len * 2, UTF_16LE)
+            for ((from, to) in patterns) {
+                if (str.contains(from)) {
+                    strings.add(str.replace(from, to))
+                    patch = true
+                    continue@loop
+                }
+            }
+            strings.add(str)
+        }
+
+        if (!patch)
+            return false
+
+        // Write everything before string data, will patch values later
+        val baos = RawByteStream()
+        baos.write(bytes, 0, dataOff)
+
+        // Write string data
+        val strList = IntArray(count)
+        for (i in 0 until count) {
+            strList[i] = baos.size() - dataOff
+            val str = strings[i]
+            baos.write(str.length.toShortBytes())
+            baos.write(str.toByteArray(UTF_16LE))
+            // Null terminate
+            baos.write(0)
+            baos.write(0)
+        }
+        baos.align()
+
+        val sizeDiff = baos.size() - start - size
+        val newBuffer = ByteBuffer.wrap(baos.buf).order(LITTLE_ENDIAN)
+
+        // Patch XML size
+        newBuffer.putInt(CHUNK_SIZE_OFF, buffer.getInt(CHUNK_SIZE_OFF) + sizeDiff)
+        // Patch string pool size
+        newBuffer.putInt(start + CHUNK_SIZE_OFF, size + sizeDiff)
+        // Patch index table
+        newBuffer.position(start + STRING_INDICES_OFF)
+        val newIntBuf = newBuffer.asIntBuffer()
+        strList.forEach { newIntBuf.put(it) }
+
+        // Write the rest of the chunks
+        val nextOff = start + size
+        baos.write(bytes, nextOff, bytes.size - nextOff)
+
+        bytes = baos.toByteArray()
+        return true
+    }
+
+    private fun Int.toShortBytes(): ByteArray {
+        val b = ByteBuffer.allocate(2).order(LITTLE_ENDIAN)
+        b.putShort(this.toShort())
+        return b.array()
+    }
+
+    private class RawByteStream : ByteArrayOutputStream() {
+        val buf: ByteArray get() = buf
+
+        fun align(alignment: Int = 4) {
+            val newCount = (count + alignment - 1) / alignment * alignment
+            for (i in 0 until (newCount - count))
+                write(0)
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/utils/IODispatcherExecutor.kt

@@ -0,0 +1,36 @@
+package com.topjohnwu.magisk.core.utils
+
+import kotlinx.coroutines.*
+import java.util.concurrent.*
+
+class IODispatcherExecutor : AbstractExecutorService() {
+
+    private val job = SupervisorJob().apply { invokeOnCompletion { future.run() } }
+    private val scope = CoroutineScope(job + Dispatchers.IO)
+    private val future = FutureTask(Callable { true })
+
+    override fun execute(command: Runnable) {
+        scope.launch {
+            command.run()
+        }
+    }
+
+    override fun shutdown() = job.cancel()
+
+    override fun shutdownNow(): List<Runnable> {
+        job.cancel()
+        return emptyList()
+    }
+
+    override fun isShutdown() = job.isCancelled
+
+    override fun isTerminated() = job.isCancelled && job.isCompleted
+
+    override fun awaitTermination(timeout: Long, unit: TimeUnit): Boolean {
+        return try {
+            future.get(timeout, unit)
+        } catch (e: TimeoutException) {
+            false
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/utils/Keygen.kt

@@ -5,7 +5,6 @@ import android.content.pm.PackageManager
 import android.util.Base64
 import android.util.Base64OutputStream
 import com.topjohnwu.magisk.core.Config
-import com.topjohnwu.magisk.core.utils.PatchAPK.ALPHANUM
 import com.topjohnwu.signing.CryptoUtils.readCertificate
 import com.topjohnwu.signing.CryptoUtils.readPrivateKey
 import org.bouncycastle.asn1.x500.X500Name
@@ -35,11 +34,12 @@ class Keygen(context: Context) : CertKeyProvider {
         private const val ALIAS = "magisk"
         private val PASSWORD get() = "magisk".toCharArray()
         private const val TESTKEY_CERT = "61ed377e85d386a8dfee6b864bd85b0bfaa5af81"
+        private const val DNAME = "C=US,ST=California,L=Mountain View,O=Google Inc.,OU=Android,CN=Android"
         private const val BASE64_FLAG = Base64.NO_PADDING or Base64.NO_WRAP
     }
 
-    private val start = Calendar.getInstance()
-    private val end = Calendar.getInstance().apply { add(Calendar.YEAR, 30) }
+    private val start = Calendar.getInstance().apply { add(Calendar.MONTH, -3) }
+    private val end = start.apply { add(Calendar.YEAR, 30) }
 
     override val cert get() = provider.cert
     override val key get() = provider.key
@@ -85,17 +85,6 @@ class Keygen(context: Context) : CertKeyProvider {
         }
     }
 
-    private fun randomString(): String {
-        val rand = kotlin.random.Random.Default
-        val len = rand.nextInt(5, 10)
-        val sb = StringBuilder(len)
-        for (i in 0..len) {
-            val idx = rand.nextInt(ALPHANUM.length)
-            sb.append(ALPHANUM[idx])
-        }
-        return sb.toString()
-    }
-
     private fun init(): KeyStore {
         val raw = Config.keyStoreRaw
         val ks = KeyStore.getInstance("PKCS12")
@@ -117,7 +106,7 @@ class Keygen(context: Context) : CertKeyProvider {
 
         // Generate new private key and certificate
         val kp = KeyPairGenerator.getInstance("RSA").apply { initialize(4096) }.genKeyPair()
-        val dname = X500Name("CN=${randomString()}")
+        val dname = X500Name(DNAME)
         val builder = JcaX509v3CertificateBuilder(dname, BigInteger(160, Random()),
             start.time, end.time, dname, kp.public)
         val signer = JcaContentSignerBuilder("SHA1WithRSA").build(kp.private)

app/src/main/java/com/topjohnwu/magisk/core/utils/Locales.kt

@@ -11,9 +11,10 @@ import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.ResMgr
 import com.topjohnwu.magisk.core.addAssetPath
-import com.topjohnwu.magisk.extensions.langTagToLocale
-import com.topjohnwu.magisk.extensions.toLangTag
-import io.reactivex.Single
+import com.topjohnwu.magisk.ktx.langTagToLocale
+import com.topjohnwu.magisk.ktx.toLangTag
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
 import java.util.*
 import kotlin.Comparator
 import kotlin.collections.ArrayList
@@ -23,7 +24,10 @@ var currentLocale: Locale = Locale.getDefault()
 @SuppressLint("ConstantLocale")
 val defaultLocale: Locale = Locale.getDefault()
 
-val availableLocales = Single.fromCallable {
+private var cachedLocales: Pair<Array<String>, Array<String>>? = null
+
+suspend fun availableLocales() = cachedLocales ?:
+withContext(Dispatchers.Default) {
     val compareId = R.string.app_changelog
 
     // Create a completely new resource to prevent cross talk over app's configs
@@ -56,8 +60,6 @@ val availableLocales = Single.fromCallable {
     res.updateConfiguration(config, metrics)
     val defName = res.getString(R.string.system_default)
 
-    Pair(locales, defName)
-}.map { (locales, defName) ->
     val names = ArrayList<String>(locales.size + 1)
     val values = ArrayList<String>(locales.size + 1)
 
@@ -69,8 +71,8 @@ val availableLocales = Single.fromCallable {
         values.add(locale.toLangTag())
     }
 
-    Pair(names.toTypedArray(), values.toTypedArray())
-}.cache()!!
+    (names.toTypedArray() to values.toTypedArray()).also { cachedLocales = it }
+}
 
 fun Resources.updateConfig(config: Configuration = configuration) {
     config.setLocale(currentLocale)

app/src/main/java/com/topjohnwu/magisk/core/utils/MediaStoreUtils.kt

@@ -0,0 +1,161 @@
+package com.topjohnwu.magisk.core.utils
+
+import android.annotation.SuppressLint
+import android.content.ContentResolver
+import android.content.ContentUris
+import android.content.ContentValues
+import android.content.Context
+import android.net.Uri
+import android.os.Build
+import android.os.Environment
+import android.provider.MediaStore
+import android.provider.OpenableColumns
+import androidx.annotation.RequiresApi
+import androidx.core.net.toFile
+import androidx.core.net.toUri
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.ktx.get
+import java.io.File
+import java.io.FileNotFoundException
+import java.io.IOException
+import java.io.OutputStream
+import java.security.MessageDigest
+import kotlin.experimental.and
+
+@Suppress("DEPRECATION")
+object MediaStoreUtils {
+
+    private val cr: ContentResolver by lazy { get<Context>().contentResolver }
+
+    @get:RequiresApi(api = 29)
+    private val tableUri
+        get() = MediaStore.Downloads.EXTERNAL_CONTENT_URI
+
+    private fun relativePath(name: String) =
+        if (name.isEmpty()) Environment.DIRECTORY_DOWNLOADS
+        else Environment.DIRECTORY_DOWNLOADS + File.separator + name
+
+    fun fullPath(name: String): String =
+        File(Environment.getExternalStorageDirectory(), relativePath(name)).canonicalPath
+
+    private val relativePath get() = relativePath(Config.downloadDir)
+
+    @RequiresApi(api = 29)
+    @Throws(IOException::class)
+    private fun insertFile(displayName: String): MediaStoreFile {
+        val values = ContentValues()
+        values.put(MediaStore.MediaColumns.RELATIVE_PATH, relativePath)
+        values.put(MediaStore.MediaColumns.DISPLAY_NAME, displayName)
+
+        // before Android 11, MediaStore can not rename new file when file exists,
+        // insert will return null. use newFile() instead.
+        val fileUri = cr.insert(tableUri, values) ?: throw IOException("Can't insert $displayName.")
+
+        val projection = arrayOf(MediaStore.MediaColumns._ID, MediaStore.MediaColumns.DATA)
+        cr.query(fileUri, projection, null, null, null)?.use { cursor ->
+            val idIndex = cursor.getColumnIndexOrThrow(MediaStore.MediaColumns._ID)
+            val dataColumn = cursor.getColumnIndexOrThrow(MediaStore.MediaColumns.DATA)
+            if (cursor.moveToFirst()) {
+                val id = cursor.getLong(idIndex)
+                val data = cursor.getString(dataColumn)
+                return MediaStoreFile(id, data)
+            }
+        }
+
+        throw IOException("Can't insert $displayName.")
+    }
+
+    private fun queryFile(displayName: String): UriFile? {
+        if (Build.VERSION.SDK_INT < 29) {
+            // Before official general purpose MediaStore API exists, fallback to file based I/O
+            val parent = File(Environment.getExternalStorageDirectory(), relativePath)
+            parent.mkdirs()
+            return LegacyUriFile(File(parent, displayName))
+        }
+
+        val projection = arrayOf(MediaStore.MediaColumns._ID, MediaStore.MediaColumns.DATA)
+        // Before Android 10, we wrote the DISPLAY_NAME field when insert, so it can be used.
+        val selection = "${MediaStore.MediaColumns.DISPLAY_NAME} == ?"
+        val selectionArgs = arrayOf(displayName)
+        val sortOrder = "${MediaStore.MediaColumns.DATE_ADDED} DESC"
+        cr.query(tableUri, projection, selection, selectionArgs, sortOrder)?.use { cursor ->
+            val idColumn = cursor.getColumnIndexOrThrow(MediaStore.MediaColumns._ID)
+            val dataColumn = cursor.getColumnIndexOrThrow(MediaStore.MediaColumns.DATA)
+            while (cursor.moveToNext()) {
+                val id = cursor.getLong(idColumn)
+                val data = cursor.getString(dataColumn)
+                if (data.endsWith(relativePath + File.separator + displayName)) {
+                    return MediaStoreFile(id, data)
+                }
+            }
+        }
+        return null
+    }
+
+    @SuppressLint("NewApi")
+    @Throws(IOException::class)
+    fun getFile(displayName: String): UriFile {
+        return queryFile(displayName) ?:
+        /* this code path will never happen pre 29 */ insertFile(displayName)
+    }
+
+    fun Uri.inputStream() = cr.openInputStream(this) ?: throw FileNotFoundException()
+
+    fun Uri.outputStream() = cr.openOutputStream(this) ?: throw FileNotFoundException()
+
+    val Uri.displayName: String get() {
+        if (scheme == "file") {
+            // Simple uri wrapper over file, directly get file name
+            return toFile().name
+        }
+        require(scheme == "content") { "Uri lacks 'content' scheme: $this" }
+        val projection = arrayOf(OpenableColumns.DISPLAY_NAME)
+        cr.query(this, projection, null, null, null)?.use { cursor ->
+            val displayNameColumn = cursor.getColumnIndexOrThrow(OpenableColumns.DISPLAY_NAME)
+            if (cursor.moveToFirst()) {
+                return cursor.getString(displayNameColumn)
+            }
+        }
+        return this.toString()
+    }
+
+    fun Uri.checkSum(alg: String, reference: String) = runCatching {
+        this.inputStream().use {
+            val digest = MessageDigest.getInstance(alg)
+            it.copyTo(object : OutputStream() {
+                override fun write(b: Int) {
+                    digest.update(b.toByte())
+                }
+
+                override fun write(b: ByteArray, off: Int, len: Int) {
+                    digest.update(b, off, len)
+                }
+            })
+            val sb = StringBuilder()
+            digest.digest().forEach { b -> sb.append("%02x".format(b and 0xff.toByte())) }
+            sb.toString() == reference
+        }
+    }.getOrElse { false }
+
+    interface UriFile {
+        val uri: Uri
+        fun delete(): Boolean
+    }
+
+    private class LegacyUriFile(private val file: File) : UriFile {
+        override val uri = file.toUri()
+        override fun delete() = file.delete()
+        override fun toString() = file.toString()
+    }
+
+    @RequiresApi(api = 29)
+    private class MediaStoreFile(private val id: Long, private val data: String) : UriFile {
+        override val uri = ContentUris.withAppendedId(tableUri, id)
+        override fun toString() = data
+        override fun delete(): Boolean {
+            val selection = "${MediaStore.MediaColumns._ID} == ?"
+            val selectionArgs = arrayOf(id.toString())
+            return cr.delete(uri, selection, selectionArgs) == 1
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/utils/PatchAPK.kt

@@ -1,155 +0,0 @@
-package com.topjohnwu.magisk.core.utils
-
-import android.content.Context
-import android.os.Build.VERSION.SDK_INT
-import android.widget.Toast
-import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.core.Config
-import com.topjohnwu.magisk.core.Const
-import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.core.isRunningAsStub
-import com.topjohnwu.magisk.core.view.Notifications
-import com.topjohnwu.magisk.data.network.GithubRawServices
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.magisk.extensions.subscribeK
-import com.topjohnwu.magisk.extensions.writeTo
-import com.topjohnwu.signing.JarMap
-import com.topjohnwu.signing.SignAPK
-import com.topjohnwu.superuser.Shell
-import io.reactivex.Single
-import timber.log.Timber
-import java.io.File
-import java.io.FileOutputStream
-import java.nio.ByteBuffer
-import java.nio.ByteOrder
-import java.security.SecureRandom
-
-object PatchAPK {
-
-    private const val ALPHA = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
-    private const val DIGITS = "0123456789"
-    const val ALPHANUM = ALPHA + DIGITS
-    private const val ALPHANUMDOTS = "$ALPHANUM............"
-
-    private const val APP_ID = "com.topjohnwu.magisk"
-    private const val APP_NAME = "Magisk Manager"
-
-    private fun genPackageName(prefix: String, length: Int): CharSequence {
-        val builder = StringBuilder(length)
-        builder.append(prefix)
-        val len = length - prefix.length
-        val random = SecureRandom()
-        var next: Char
-        var prev = prefix[prefix.length - 1]
-        for (i in 0 until len) {
-            next = if (prev == '.' || i == len - 1) {
-                ALPHA[random.nextInt(ALPHA.length)]
-            } else {
-                ALPHANUMDOTS[random.nextInt(ALPHANUMDOTS.length)]
-            }
-            builder.append(next)
-            prev = next
-        }
-        return builder
-    }
-
-    private fun findAndPatch(xml: ByteArray, from: CharSequence, to: CharSequence): Boolean {
-        if (to.length > from.length)
-            return false
-        val buf = ByteBuffer.wrap(xml).order(ByteOrder.LITTLE_ENDIAN).asCharBuffer()
-        val offList = mutableListOf<Int>()
-        var i = 0
-        loop@ while (i < buf.length - from.length) {
-            for (j in from.indices) {
-                if (buf.get(i + j) != from[j]) {
-                    ++i
-                    continue@loop
-                }
-            }
-            offList.add(i)
-            i += from.length
-        }
-        if (offList.isEmpty())
-            return false
-
-        val toBuf = to.toString().toCharArray().copyOf(from.length)
-        for (off in offList) {
-            buf.position(off)
-            buf.put(toBuf)
-        }
-        return true
-    }
-
-    fun patch(apk: String, out: String, pkg: CharSequence, label: CharSequence): Boolean {
-        try {
-            val jar = JarMap.open(apk)
-            val je = jar.getJarEntry(Const.ANDROID_MANIFEST)
-            val xml = jar.getRawData(je)
-
-            if (!findAndPatch(xml, APP_ID, pkg) ||
-                !findAndPatch(xml, APP_NAME, label))
-                return false
-
-            // Write apk changes
-            jar.getOutputStream(je).write(xml)
-            val keys = Keygen(get())
-            SignAPK.sign(keys.cert, keys.key, jar, FileOutputStream(out).buffered())
-        } catch (e: Exception) {
-            Timber.e(e)
-            return false
-        }
-
-        return true
-    }
-
-    private fun patchAndHide(context: Context, label: String): Boolean {
-        val dlStub = !isRunningAsStub && SDK_INT >= 28 &&
-                Info.env.magiskVersionCode >= Const.Version.PROVIDER_CONNECT
-        val src = if (dlStub) {
-            val stub = File(context.cacheDir, "stub.apk")
-            val svc = get<GithubRawServices>()
-            try {
-                svc.fetchFile(Info.remote.stub.link).blockingGet().byteStream().use {
-                    it.writeTo(stub)
-                }
-            } catch (e: Exception) {
-                Timber.e(e)
-                return false
-            }
-            stub.path
-        } else {
-            context.packageCodePath
-        }
-
-        // Generate a new random package name and signature
-        val repack = File(context.cacheDir, "patched.apk")
-        val pkg = genPackageName("com.", APP_ID.length)
-        Config.keyStoreRaw = ""
-
-        if (!patch(src, repack.path, pkg, label))
-            return false
-
-        // Install the application
-        repack.setReadable(true, false)
-        if (!Shell.su("force_pm_install $repack").exec().isSuccess)
-            return false
-
-        Config.suManager = pkg.toString()
-        Config.export()
-        Shell.su("pm uninstall $APP_ID").submit()
-
-        return true
-    }
-
-    fun hideManager(context: Context, label: String) {
-        val progress = Notifications.progress(context, context.getString(R.string.hide_manager_title))
-        Notifications.mgr.notify(Const.ID.HIDE_MANAGER_NOTIFICATION_ID, progress.build())
-        Single.fromCallable {
-            patchAndHide(context, label)
-        }.subscribeK {
-            if (!it)
-                Utils.toast(R.string.hide_manager_fail_toast, Toast.LENGTH_LONG)
-            Notifications.mgr.cancel(Const.ID.HIDE_MANAGER_NOTIFICATION_ID)
-        }
-    }
-}

app/src/main/java/com/topjohnwu/magisk/core/utils/ProgressInputStream.kt

@@ -1,6 +1,5 @@
 package com.topjohnwu.magisk.core.utils
 
-import com.topjohnwu.superuser.internal.UiThreadHandler
 import java.io.FilterInputStream
 import java.io.InputStream
 
@@ -16,7 +15,7 @@ class ProgressInputStream(
         val cur = System.currentTimeMillis()
         if (cur - lastUpdate > 1000) {
             lastUpdate = cur
-            UiThreadHandler.run { progressEmitter(bytesRead) }
+            progressEmitter(bytesRead)
         }
     }
 

app/src/main/java/com/topjohnwu/magisk/core/utils/RootInit.kt

@@ -1,14 +1,15 @@
 package com.topjohnwu.magisk.core.utils
 
 import android.content.Context
+import android.os.Build
 import com.topjohnwu.magisk.R
+import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.core.Info
 import com.topjohnwu.magisk.core.wrap
-import com.topjohnwu.magisk.extensions.rawResource
+import com.topjohnwu.magisk.ktx.rawResource
 import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.ShellUtils
-import com.topjohnwu.superuser.io.SuFile
 
 class RootInit : Shell.Initializer() {
 
@@ -17,29 +18,41 @@ class RootInit : Shell.Initializer() {
     }
 
     fun init(context: Context, shell: Shell): Boolean {
-        val job = shell.newJob()
-        job.add(context.rawResource(R.raw.manager))
-        if (shell.isRoot) {
-            job.add(context.rawResource(R.raw.util_functions))
-                .add("SHA1=`grep_prop SHA1 /sbin/.magisk/config`")
-            Const.MAGISK_DISABLE_FILE = SuFile("/cache/.disable_magisk")
-        }
+        shell.newJob().apply {
+            add("export SDK_INT=${Build.VERSION.SDK_INT}")
+            if (Const.Version.atLeast_20_4()) {
+                add("export MAGISKTMP=\$(magisk --path)/.magisk")
+            } else {
+                add("export MAGISKTMP=/sbin/.magisk")
+            }
+            if (Const.Version.atLeast_21_0()) {
+                add("export ASH_STANDALONE=1")
+                add("[ -x /data/adb/magisk/busybox ] && exec /data/adb/magisk/busybox sh")
+            } else {
+                add("export PATH=\"\$MAGISKTMP/busybox:\$PATH\"")
+            }
+            add(context.rawResource(R.raw.manager))
+            if (shell.isRoot) {
+                add(context.rawResource(R.raw.util_functions))
+            }
+            add("mm_init")
+        }.exec()
 
-        job.add(
-            "export BOOTMODE=true",
-            "mount_partitions",
-            "get_flags",
-            "run_migrations"
-        ).exec()
+        fun fastCmd(cmd: String) = ShellUtils.fastCmd(shell, cmd)
+        fun getVar(name: String) = fastCmd("echo \$$name")
+        fun getBool(name: String) = getVar(name).toBoolean()
 
-        fun getvar(name: String) = ShellUtils.fastCmd(shell, "echo \$$name").toBoolean()
+        Const.MAGISKTMP = getVar("MAGISKTMP")
+        Info.isSAR = getBool("SYSTEM_ROOT")
+        Info.ramdisk = getBool("RAMDISKEXIST")
+        Info.isAB = getBool("ISAB")
+        Info.crypto = getVar("CRYPTOTYPE")
+        Info.isPixel = fastCmd("getprop ro.product.brand") == "google"
 
-        Info.keepVerity = getvar("KEEPVERITY")
-        Info.keepEnc = getvar("KEEPFORCEENCRYPT")
-        Info.isSAR = getvar("SYSTEM_ROOT")
-        Info.ramdisk = shell.newJob().add("check_boot_ramdisk").exec().isSuccess
-        Info.recovery = getvar("RECOVERYMODE")
-        Info.isAB = getvar("ISAB")
+        // Default presets
+        Config.recovery = getBool("RECOVERYMODE")
+        Config.keepVerity = getBool("KEEPVERITY")
+        Config.keepEnc = getBool("KEEPFORCEENCRYPT")
 
         return true
     }

app/src/main/java/com/topjohnwu/magisk/core/utils/SafetyNetHelper.kt

@@ -1,21 +0,0 @@
-package com.topjohnwu.magisk.core.utils
-
-interface SafetyNetHelper {
-
-    val version: Int
-
-    fun attest()
-
-    interface Callback {
-        fun onResponse(responseCode: Int)
-    }
-
-    companion object {
-
-        const val RESPONSE_ERR = 0x01
-        const val CONNECTION_FAIL = 0x02
-
-        const val BASIC_PASS = 0x10
-        const val CTS_PASS = 0x20
-    }
-}

app/src/main/java/com/topjohnwu/magisk/core/utils/Utils.kt

@@ -1,78 +0,0 @@
-package com.topjohnwu.magisk.core.utils
-
-import android.content.Context
-import android.content.Intent
-import android.content.res.Resources
-import android.net.Uri
-import android.os.Environment
-import android.widget.Toast
-import androidx.work.*
-import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.core.Config
-import com.topjohnwu.magisk.core.Const
-import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.core.UpdateCheckService
-import com.topjohnwu.magisk.extensions.get
-import com.topjohnwu.superuser.internal.UiThreadHandler
-import java.io.File
-import java.util.concurrent.TimeUnit
-
-object Utils {
-
-    fun toast(msg: CharSequence, duration: Int) {
-        UiThreadHandler.run { Toast.makeText(get(), msg, duration).show() }
-    }
-
-    fun toast(resId: Int, duration: Int) {
-        UiThreadHandler.run { Toast.makeText(get(), resId, duration).show() }
-    }
-
-    fun dpInPx(dp: Int): Int {
-        val scale = get<Resources>().displayMetrics.density
-        return (dp * scale + 0.5).toInt()
-    }
-
-    fun showSuperUser(): Boolean {
-        return Info.env.isActive && (Const.USER_ID == 0
-                || Config.suMultiuserMode != Config.Value.MULTIUSER_MODE_OWNER_MANAGED)
-    }
-
-    fun scheduleUpdateCheck(context: Context) {
-        if (Config.checkUpdate) {
-            val constraints = Constraints.Builder()
-                .setRequiredNetworkType(NetworkType.CONNECTED)
-                .setRequiresDeviceIdle(true)
-                .build()
-            val request = PeriodicWorkRequest
-                .Builder(UpdateCheckService::class.java, 12, TimeUnit.HOURS)
-                .setConstraints(constraints)
-                .build()
-            WorkManager.getInstance(context).enqueueUniquePeriodicWork(
-                Const.ID.CHECK_MAGISK_UPDATE_WORKER_ID,
-                ExistingPeriodicWorkPolicy.REPLACE, request
-            )
-        } else {
-            WorkManager.getInstance(context)
-                .cancelUniqueWork(Const.ID.CHECK_MAGISK_UPDATE_WORKER_ID)
-        }
-    }
-
-    fun openLink(context: Context, link: Uri) {
-        val intent = Intent(Intent.ACTION_VIEW, link)
-        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-        if (intent.resolveActivity(context.packageManager) != null) {
-            context.startActivity(intent)
-        } else {
-            toast(
-                R.string.open_link_failed_toast,
-                Toast.LENGTH_SHORT
-            )
-        }
-    }
-
-    fun ensureDownloadPath(path: String) =
-        File(Environment.getExternalStorageDirectory(), path).run {
-            if ((exists() && isDirectory) || mkdirs()) this else null
-        }
-
-}

app/src/main/java/com/topjohnwu/magisk/core/utils/net/LollipopNetworkObserver.kt

@@ -0,0 +1,49 @@
+package com.topjohnwu.magisk.core.utils.net
+
+import android.annotation.TargetApi
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import androidx.collection.ArraySet
+
+@TargetApi(21)
+open class LollipopNetworkObserver(
+    context: Context,
+    callback: ConnectionCallback
+): NetworkObserver(context, callback) {
+
+    private val networkCallback = NetCallback()
+
+    init {
+        val request = NetworkRequest.Builder()
+            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+            .build()
+        manager.registerNetworkCallback(request, networkCallback)
+    }
+
+    @Suppress("DEPRECATION")
+    override fun getCurrentState() {
+        callback(manager.activeNetworkInfo?.isConnected ?: false)
+    }
+
+    override fun stopObserving() {
+        manager.unregisterNetworkCallback(networkCallback)
+    }
+
+    private inner class NetCallback : ConnectivityManager.NetworkCallback() {
+
+        private val activeList = ArraySet<Network>()
+
+        override fun onAvailable(network: Network) {
+            activeList.add(network)
+            callback(true)
+        }
+
+        override fun onLost(network: Network) {
+            activeList.remove(network)
+            callback(!activeList.isEmpty())
+        }
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/utils/net/MarshmallowNetworkObserver.kt

@@ -0,0 +1,53 @@
+@file:Suppress("DEPRECATION")
+
+package com.topjohnwu.magisk.core.utils.net
+
+import android.annotation.TargetApi
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.net.NetworkCapabilities
+import android.os.PowerManager
+import androidx.core.content.getSystemService
+
+@TargetApi(23)
+class MarshmallowNetworkObserver(
+    context: Context,
+    callback: ConnectionCallback
+): LollipopNetworkObserver(context, callback) {
+
+    private val receiver = IdleBroadcastReceiver()
+
+    init {
+        val filter = IntentFilter(PowerManager.ACTION_DEVICE_IDLE_MODE_CHANGED)
+        app.registerReceiver(receiver, filter)
+    }
+
+    override fun stopObserving() {
+        super.stopObserving()
+        app.unregisterReceiver(receiver)
+    }
+
+    override fun getCurrentState() {
+        callback(manager.getNetworkCapabilities(manager.activeNetwork)
+            ?.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) ?: false)
+    }
+
+    private inner class IdleBroadcastReceiver: BroadcastReceiver() {
+
+        private fun Context.isIdleMode(): Boolean {
+            val pwm = getSystemService<PowerManager>() ?: return true
+            val isIgnoringOptimizations = pwm.isIgnoringBatteryOptimizations(packageName)
+            return pwm.isDeviceIdleMode && !isIgnoringOptimizations
+        }
+
+        override fun onReceive(context: Context, intent: Intent) {
+            if (context.isIdleMode()) {
+                callback(false)
+            } else {
+                getCurrentState()
+            }
+        }
+    }
+}