Thread by @MishaalRahman

Last week, @Wander1236 and I teased "something incredible" we found in Android 12. We were being vague on purpose because it takes advantage of a flaw we found in an undocumented API. Now, we're ready to share details on this finding, as well as an app that takes advantage of it!

For some background, Android 8.0 Oreo introduced a command-line interface for Android's Overlay Manager Service (OMS). OMS is an API that lets specially-crafted APKs called "overlays" substitute the resource value of any given app with its own. xda-developers.com/android-oreo-c…

Google intended for overlays to only be used by OEMs for modifying system and framework values on-the-fly. Indeed, Razer's theme engine used OMS, and Google's own Pixel Themes also used overlays to change the accent color, point to a different font, and tweak the icon shape.

However, XDA did what XDA does best and found a loophole. Since Android didn't check if an overlay was installed by the system or the user, you could install custom overlays that did a number of things, like theme apps or tweak the system UI layout. xda-developers.com/andromeda-subs…

Google closed this loophole in Android 9 by requiring that overlays be signed with the platform cert, and there's no way around that requirement. Fortunately, when they added an API in Android 12 that makes overlays on-the-fly, they didn't properly check the perms of the caller.

In other words: Rootless theming is back in Android 12, kind of. With this discovery, you can generate overlays that tweak the colors of apps. You can also make overlays that tweak various system UI and framework properties, of which there are a lot to mess with.

This works due to Android 12's Fabricate Overlay API. This API generates a Fabricated Runtime Resource Overlay (FRRO), an overlay generated at runtime rather than being precompiled. This means you can generate an overlay on the device and install it without rebooting the device.

FRROs don't support every resource (like arrays or strings), but you can overlay things like ints, colors, dimens, and bools in any app, so there's still some fun things you can still do. The CLI for this API, called via 'cmd overlay fabricate', requires the caller to be root.

However, Zachary discovered that the actual Fabricate Overlay API doesn't require root - the caller only needs to be as privileged as the shell user. This is easily met through using the Shizuku library. This article explains the library in more detail: xda-developers.com/implementing-s…

Using this knowledge, Zachary created an app that directly calls this API to fabricate overlays. And thanks to Shizuku, which can be activated on-device through wireless ADB, you can use Zachary's app to fabricate overlays on-device without root access!

You can download Zachary's app from GitHub: github.com/zacharee/Fabri…. The app is pretty barebones - we just wanted to get this out quickly after I tested it. You're free to overlay whatever resource you want with whatever value you want, but be careful before you do!

We relayed one cool potential use of this discovery to @kdrag0n. He may be able to turn his custom 'monet' impl into an app, as he can fab overlays that target the color values exposed by the system to apps. Monet is only available on Pixels, so this would be exciting if true!

Oh, and just so we're clear: This isn't a major security flaw or anything. You have to jump through a few hoops to grant Zachary's app the privilege it needs to call the API. Though thanks to wireless ADB and Shizuku, that's pretty easy for users to do.

Given the nature of this loophole and Google's history of closing down overlay access, this will be fixed in a future release. We don't know if it's already fixed in Google's internal master, and we don't know if Google will backport the fix in an ASB for Android 12.

But we suspect it'll stay open until Android 13 or 12.1 at the earliest. Since it takes a long time for OS updates to propagate, we'll probably be able to enjoy this loophole for a few good months if not longer.

FRRO commit: android.googlesource.com/platform/frame…
Zachary's FabricateOverlay app: github.com/zacharee/Fabri…
Article on XDA: xda-developers.com/android-12-the…

I'm looking forward to seeing how the community takes advantage of this to tweak things.

android.googlesource.com/platform/frame…

android.googlesource.com/platform/frame…

Some of the values you can tweak are documented in AOSP, but not all. Zachary's app exposes all possible values you can overlay, but YMMV.

As an aside, what kickstarted the Andromeda/Substratum idea in Android 8.0 Oreo was me telling Nicholas Chum to look into the CLI and how Koush's Helium app elevated itself to shell privileges.

This new finding is thus pretty nostalgic for me!

Sorry, I don't know why the article link pointed to that, it should be this instead: xda-developers.com/android-12s-fa…

Kdrag0n works way faster than I thought lol:

https://twitter.com/kdrag0n/status/1447677291941666819