Another LSPosed disaster.. Hide My Applist, more widely known by its acronym — HMA — that later got closed source. However, before that happened, it became an essential part of the community as LSPosed usage grew. Then HMA-OSS appeared, fixing detection that targeted the LSPosed's creation rapidly, becoming an appealing alternative to the closed-source module.
But HMA-OSS, unlike the original, was developed towards hiding more properties at the
system_server level. Features are fun, but they come with a hefty price; wider surface for detection. Regardless of how careful they were, a detection appeared — and of course, in the *silliest* ways.With that, I'm here to document some more detections I found regarding HMA-OSS and HMA.
1. Keyboard apps and app list mismatch
Keyboard apps report themselves as one by using
BIND_INPUT_METHOD permission in their manifest. This allows the system to recognize such and display them as possible keyboards for the user to select and use.HMA-OSS introduced a feature that allowed users to hide non-system apps, as some apps have introduced detections against third-party keyboards. However, the applist was not taken in account.
This resulted in a mismatch between
InputMethodManager list and the app list, as an application with BIND_INPUT_METHOD permission would not appear as a input method/keyboard app.2. getPackageInfo timing
Both HMAs intercept
getPackageInfo with the purpose of spoofing an app as nonexistent. Hooks, however, are always problematic — well, not directly. Not because they leave traces — which here, they barely do, as we are in system_server, but because the code that you add will always add some overhead to the target function.By requesting
getPackageInfo 20000x, one for HMA(-OSS) app, and one for a nonexistent app, this allowed us to observe (with high-quality performance counters, when HMA is intercepting, a +20% overhead to the function.OBS:
getPackageInfo timing detection was recently discovered by third-parties. However, it was known to us back to December of 2025, and reported to HMA-OSS in January (which is the reason behind it not being detected through it).I know this wasn't the best one I could make. However, making a post for an almost foreign project, for a detection I made months ago, is hard. My goal here is to inform rather than make a "How To", hence, for this one, no URLs will be provided.
Learn not to be greedy. For the community, help Open Source. Closed-source? Hm..
Sincerely,
ThePedro.
I need a ris- rest.
Go around the clock, hear every tick.
No matter what, it goes on on quick.
Do not be useless, make it be worth.
Leave love behind, leave it for Earth.