1# Android Hidden Api Bypass 2 3[](https://github.com/LSPosed/AndroidHiddenApiBypass/actions/workflows/android.yml) 4 5 6 7Bypass restrictions on non-SDK interfaces. 8 9## Why HiddenApiBypass? 10 11- Pure Java: no native code used. 12- Reliable: does not rely on specific behaviors, so it will not be blocked like meta-reflection or `dexfile`. 13- Stable: does not rely on internal ART structures on Android 10+. `Unsafe` and `setHiddenApiExemptions` are stable APIs. 14 15## And LSPass? 16 17- Fast: no I/O, initializing faster than HiddenApiBypass. 18- Safe: no `Unsafe`. 19- Unreliable: can be blocked as easily as meta-reflection. 20 21## How it works 22 23HiddenApiBypass: [Unsafe](https://lovesykun.cn/archives/android-hidden-api-bypass.html) 24 25LSPass: [Property.of()](https://github.com/michalbednarski/LeakValue?tab=readme-ov-file#putting-it-all-together) 26 27## Integration 28 29Gradle: 30 31```gradle 32repositories { 33 mavenCentral() 34} 35dependencies { 36 implementation 'org.lsposed.hiddenapibypass:hiddenapibypass:+' 37} 38``` 39 40## Usage 41 42This library has two variants of bypassing, they have the same API. 43When initializing, LSPass is faster than HiddenApiBypass, but LSPass maybe blocked in future Android releases. 44Replace `HiddenApiBypass` with `LSPass` if you do not want to use `Unsafe`. 45 461. Invoke a restricted method: 47 ```java 48 HiddenApiBypass.invoke(ApplicationInfo.class, new ApplicationInfo(), "usesNonSdkApi"/*, args*/) 49 ``` 501. Invoke restricted constructor: 51 ```java 52 Object instance = HiddenApiBypass.newInstance(Class.forName("android.app.IActivityManager$Default")/*, args*/); 53 ``` 541. Get all methods including restricted ones from a class: 55 ```java 56 var allMethods = HiddenApiBypass.getDeclaredMethods(ApplicationInfo.class); 57 ((Method).stream(allMethods).filter(e -> e.getName().equals("usesNonSdkApi")).findFirst().get()).invoke(new ApplicationInfo()); 58 ``` 591. Get all non-static fields including restricted ones from a class: 60 ```java 61 var allInstanceFields = HiddenApiBypass.getInstanceFields(ApplicationInfo.class); 62 ((Method).stream(allInstanceFields).filter(e -> e.getName().equals("longVersionCode")).findFirst().get()).get(new ApplicationInfo()); 63 ``` 641. Get all static fields including restricted ones from a class: 65 ```java 66 var allStaticFields = HiddenApiBypass.getStaticFields(ApplicationInfo.class); 67 ((Method).stream(allStaticFields).filter(e -> e.getName().equals("HIDDEN_API_ENFORCEMENT_DEFAULT")).findFirst().get()).get(null); 68 ``` 691. Get specific class method or class constructor 70 ```java 71 var ctor = HiddenApiBypass.getDeclaredConstructor(ClipDrawable.class /*, args */); 72 var method = HiddenApiBypass.getDeclaredMethod(ApplicationInfo.class, "getHiddenApiEnforcementPolicy" /*, args */); 73 ``` 741. Add a class to exemption list: 75 ```java 76 HiddenApiBypass.addHiddenApiExemptions( 77 "Landroid/content/pm/ApplicationInfo;", // one specific class 78 "Ldalvik/system" // all classes in packages dalvik.system 79 "Lx" // all classes whose full name is started with x 80 ); 81 ``` 82 if you are going to add all classes to exemption list, just leave an empty prefix: 83 ```java 84 HiddenApiBypass.addHiddenApiExemptions(""); 85 ``` 86## License 87 88 Copyright 2021-2025 LSPosed 89 90 Licensed under the Apache License, Version 2.0 (the "License"); 91 you may not use this file except in compliance with the License. 92 You may obtain a copy of the License at 93 94 https://www.apache.org/licenses/LICENSE-2.0 95 96 Unless required by applicable law or agreed to in writing, software 97 distributed under the License is distributed on an "AS IS" BASIS, 98 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 99 See the License for the specific language governing permissions and 100 limitations under the License. 101
){kind=link}
){kind=link}
){kind=link}