(legacy) modules don't recieve root in Android 17

[heinrich26]

Steps to reproduce/复现步骤

try to use Pixelify-Google-Photos on (Stock) Android 17.

1. Problem: after install, the app doesn't get root or asks for root, as it did on Android 14 + Vector 2.0 (3021)
   Instead it says: module not activated. I've tried many things to get it to request root, from disabling denylist, using Magisk Zygisk, etc., which all did not work.
   Even after granting root through some random coincidence (you can modify the magisk database, I only learned that afterwards), the following issue persists:
2. it seems as tho all calls to XposedHelpers.setStaticObjectField (see here) fail, most likely because of missing permissions:

[ 2026-07-30T16:21:05.204 10234: 6124: 6124 E/VectorLegacyBridge ] java.lang.IllegalAccessException: Cannot set public static final field java.lang.String android.os.Build.FINGERPRINT of class java.lang.Class<android.os.Build>
at java.lang.reflect.Field.set(Native Method)
at LvJQctZbgMPXUf.fdeZEgO.XposedHelpers.setStaticObjectField(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:6)
at balti.xposed.pixelifygooglephotos.DeviceSpoofer.handleLoadPackage(DeviceSpoofer.kt:94)
at LvJQctZbgMPXUf.fdeZEgO.IXposedHookLoadPackage$Wrapper.handleLoadPackage(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:3)
at LvJQctZbgMPXUf.fdeZEgO.callbacks.XC_LoadPackage.call(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:7)
at LvJQctZbgMPXUf.fdeZEgO.callbacks.XCallback.callAll(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:27)
at w.intercept(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:402)
at j2.a(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:41)
at j2.proceed(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:1)
at y2.callback(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:105)
at Vector_.createOrUpdateClassLoaderLocked(Dobby:11)
at android.app.LoadedApk.getClassLoader(LoadedApk.java:1283)
at android.app.LoadedApk.getResourcesInner(LoadedApk.java:1564)
at android.app.LoadedApk.getResources(LoadedApk.java:1542)
at android.app.ContextImpl.createAppContext(ContextImpl.java:3679)
at android.app.ContextImpl.createAppContext(ContextImpl.java:3669)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:8168)
at android.app.ActivityThread.-$$Nest$mhandleBindApplication(ActivityThread.java:0)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2761)
at android.os.Handler.dispatchMessageImpl(Handler.java:142)
at android.os.Handler.dispatchMessage(Handler.java:125)
at android.os.Looper.loopOnce(Looper.java:296)
at android.os.Looper.loop(Looper.java:397)
at android.app.ActivityThread.main(ActivityThread.java:9523)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:575)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:939)
[ 2026-07-30T16:21:05.204 10234: 6124: 6124 E/VectorLegacyBridge ] java.lang.IllegalAccessError: Cannot set public static final field java.lang.String android.os.Build.FINGERPRINT of class java.lang.Class<android.os.Build>
at LvJQctZbgMPXUf.fdeZEgO.XposedHelpers.setStaticObjectField(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:22)
at balti.xposed.pixelifygooglephotos.DeviceSpoofer.handleLoadPackage(DeviceSpoofer.kt:94)
at LvJQctZbgMPXUf.fdeZEgO.IXposedHookLoadPackage$Wrapper.handleLoadPackage(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:3)
at LvJQctZbgMPXUf.fdeZEgO.callbacks.XC_LoadPackage.call(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:7)
at LvJQctZbgMPXUf.fdeZEgO.callbacks.XCallback.callAll(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:27)
at w.intercept(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:402)
at j2.a(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:41)
at j2.proceed(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:1)
at y2.callback(r8-map-id-4fa1873efe2390be91854903b7ca4e4a4f0cef67aa792d34dd18ccd67ba7077c:105)
at Vector_.createOrUpdateClassLoaderLocked(Dobby:11)
at android.app.LoadedApk.getClassLoader(LoadedApk.java:1283)
at android.app.LoadedApk.getResourcesInner(LoadedApk.java:1564)
at android.app.LoadedApk.getResources(LoadedApk.java:1542)
at android.app.ContextImpl.createAppContext(ContextImpl.java:3679)
at android.app.ContextImpl.createAppContext(ContextImpl.java:3669)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:8168)
at android.app.ActivityThread.-$$Nest$mhandleBindApplication(ActivityThread.java:0)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2761)
at android.os.Handler.dispatchMessageImpl(Handler.java:142)
at android.os.Handler.dispatchMessage(Handler.java:125)
at android.os.Looper.loopOnce(Looper.java:296)
at android.os.Looper.loop(Looper.java:397)
at android.app.ActivityThread.main(ActivityThread.java:9523)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:575)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:939)

Expected behaviour/预期行为

Method should run and modify that field.

If there's a "new way" to do this static field modification with the new api, please let me know. I could implement that in a custom build.

Actual behaviour/实际行为

hooking/patching fails

Xposed Module List/Xposed 模块列表

[Pixelify Google Photos](https://github.com/BaltiApps/Pixelify-Google-Photos/tree/main)
Reddidn'tInstaEclipsePixel Xpert(Rediddnt and InstaEclipse are working fine; I've tested with only Pixelify Gphotos enabled, didn't change anything)

Root implementation/Root 方案

Magisk 30.7

System Module List/系统模块列表

Zygisk Next (latest)
zygisk-detach
Vector
(with and without PixelXpert)

LSPosed version/LSPosed 版本

3044, but tested latests and between

Android version/Android 版本

17

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

LSPosed_2026-07-30T16_37_03.088749.zip (there's are also crashes from PixelXpert in there, which complains about missing root in a similar fashion, but the module seems to work anyway... In the PixelXpert case the Hooker even crashes 🤷)

[JingMatrix]

This is a technical discussion, not issue, and is thus moving there...

I think you may have forgot to make the field accessible ? Feel free to use my fork of this module.

[JingMatrix]

My fork link: https://github.com/JingMatrix/Pixelify-Google-Photos

[heinrich26]

This is a technical discussion, not issue, and is thus moving there...

I think you may have forgot to make the field accessible ? Feel free to use my fork of this module.

The problem persists with your version, only now failing on android.os.build.BOARD instead of PLATFORM or what it was previously…

[JingMatrix]

I reproduced this on my own Pixel on Android 17, and it turns out to have nothing to do with Build or with the framework: reflection there refuses to write any static final field, including one in a test class of my own, even though setAccessible(true) is accepted and isAccessible() returns true afterwards. Clearing Field.accessFlags still flips getModifiers() but the write throws anyway, and a VarHandle from privateLookupIn throws UnsupportedOperationException. Instance final fields are untouched, so it is only the static case that closed.

JNI is still allowed, though — I set Build.FINGERPRINT from a small native library and Java read the spoofed value back. So there is no new way to do it from a module in Java, but I can let XposedHelpers.setStaticObjectField fall back to a native write, which fixes every legacy module at once without anyone changing their module. I will do that, so no custom build needed on your side.

The root prompt is a separate matter: the module shells out to su itself to force-stop Google Photos, so that grant is Magisk's rather than ours. And if the "not activated" notice is still there on a build past 3053, that is a regression of mine that #819 fixes.

[JingMatrix]

Source for the above, since it is worth having: the check is ThrowIAEIfFieldIsNotOverwritable in runtime/native/java_lang_reflect_Field.cc, which Field_set calls before it looks at the accessible flag, and the rule it applies is ArtField::IsUnmodifiable. Both are in the android-17.0.0_r1 tag and in neither case on main, which is why the file reads as it always did if you look there.

Two things in that rule are worth knowing. A static final is still writable when the process targets SDK 36 or lower, so whether this bites depends on the target SDK of the app being hooked, not on the module. And android.os.Build and android.os.Build$VERSION are singled out as write-protected — which spares them from JNI but not from reflection.

That last part is why the fix does not go through JNI: EnsureModifiable is LOG(FATAL), so a JNI write to a static final outside that carve-out takes the process down rather than throwing. #821 clears the field's final flag where ART reads it and lets reflection do the write instead.

[heinrich26]

Ouhh, that was really fast!

It seams to work, except now I can't seem to get root with PixelifyGPhotos once again (tested with your Fork, app keeps complaining even after granting root via sqlite3…)

At least the Module is running now, does the unlimited Upload work for you, because it doesn't for me right now. I dont have set up an elaborate Root Hiding scheme on my Android 17, but neither did I denylist Gphotos in Android 14…

[JingMatrix]

Sadly, the unlimited upload is not working for me neither...

[heinrich26]

After some pulling my hair out, i found that they only show the "this image doesn't consume any space on your drive"-note for newly synced photos and not even in the subsettings anymore.

I retested your app, and somehow now it is working, even showing the note in the settings (Profile > Settings > Sync). (The app stil won't open, but doesnt really matter, with the settings copied to the right place, altho default settings should do and root granted via sqlite3, not sure if root isn't just needed to kill Gphotos tho)

What absolutely worked for me was this zygisk module. They also discovered our bug.
In the issue they wrote that GPhotos now checks new flags which they added to that module, but im not too sure if they were needed after getting your app to work once again…