System crashes when opening `Native Detector`

[abdullahO2]

Steps to reproduce/复现步骤

1. Install Vector (LSPosed by JingMatrix) with libxposed API 100 & 101 update
2. Ensure Vector is active
3. Open Native Detector
4. System immediately crashes
5. Device reboots into recovery mode or sometimes into safe mode

Expected behaviour/预期行为

Native Detector should open normally without causing system instability, reboot, or safe mode.

Actual behaviour/实际行为

When opening Native Detector while Vector (LSPosed by JingMatrix) is installed (libxposed API 100 & 101), the entire system crashes.

The device then:

• Reboots into recovery mode (most of the time), or
• Sometimes reboots into safe mode

After booting again:

• The system works normally
• Airplane mode is automatically enabled
• Disabling airplane mode restores everything to normal

Xposed Module List/Xposed 模块列表

-HMA-OSS
-Wa Enhancer

Root implementation/Root 方案

KernelSU 32457

System Module List/系统模块列表

- NeoZygisk
- Vector

LSPosed version/LSPosed 版本

Vector-v2.0-3021 And Vector-v2.0-3033

Android version/Android 版本

Device: Nothing Phone (2a) OS: Nothing OS 4.0 Android Version: Android 16

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

non

[JingMatrix]

Which version of Android Native Detector are you using ?

I cannot reproduce your issues, please upload the logs generated by manager after crash reboot.

Its latest release does introduce a new detection based on time side-channel of Vector deny machinism, which we will fix soon.

However, for your issues, something different could have happened, please upload debug logs.

[JingMatrix]

Please test if the CI has fixed the issue for you: https://github.com/JingMatrix/Vector/actions/runs/24304274410 .

[bagdasarov]

Same behavior during last several releases.

1. First run of Native Detector - ok.
2. Remove ND from memory
3. Run Native Detector again (second time) - reboot 100%

PS
In my case an ordinary crash and reboot into system (not recovery mode)
OnePlus 13 OOS 16 latest

[JingMatrix]

@bagdasarov The detector itself could be unstable.

In any case, upload logs to the thread #655

[abdullahO2]

Which version of Android Native Detector are you using ?

I cannot reproduce your issues, please upload the logs generated by manager after crash reboot.

Its latest release does introduce a new detection based on time side-channel of Vector deny machinism, which we will fix soon.

However, for your issues, something different could have happened, please upload debug logs.

I'm using the latest release v7.7.0, and I also tested the previous version v7.6.1.
Both versions result in the same issue.

[abdullahO2]

Please test if the CI has fixed the issue for you: https://github.com/JingMatrix/Vector/actions/runs/24304274410 .

I tested the CI build, but unfortunately the issue is still present.

[JingMatrix]

@abdullahO2 does this detector work on your device when Vector is disabled ?

As I have mentioned many times, upload your logs. The behavior on your device is not reproducible on my environment.

[JingMatrix]

From the logs of @abdullahO2 provided via telegram, here is crucial crashing logs:

[ 2026-04-12T18:16:02.949     1000:  1726:  1878 I/VectorLegacyBridge ] [HMA-OSS] [ INFO] 04-12 18:16:02 (PmsHookTarget34) @shouldFilterApplication: query from com.reveny.nativecheck
[ 2026-04-12T18:16:03.118     1000:  1726:  2075 D/Vector          ] Hook return type mismatch. Expected android.content.pm.ArchivedPackageParcel, got java.lang.Boolean
[ 2026-04-12T18:16:03.118     1000:  1726:  2075 E/Vector          ] Crash unexpectedly
java.lang.IncompatibleClassChangeError: Class 'java.lang.Boolean' does not implement interface 'android.os.Parcelable' in call to 'void android.os.Parcelable.writeToParcel(android.os.Parcel, int)' (declaration of 'android.os.Parcel' appears in /system/framework/framework.jar!classes3.dex)
	at android.os.Parcel.writeTypedObject(Parcel.java:2466)
	at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4643)
	at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6817)
	at android.os.Binder.execTransactInternal(Binder.java:1428)
	at android.os.Binder.execTransact(Binder.java:1372)
[ 2026-04-12T18:16:03.118     1000:  1726:  2075 E/AndroidRuntime  ] *** FATAL EXCEPTION IN SYSTEM PROCESS: binder:1726_6
java.lang.IncompatibleClassChangeError: Class 'java.lang.Boolean' does not implement interface 'android.os.Parcelable' in call to 'void android.os.Parcelable.writeToParcel(android.os.Parcel, int)' (declaration of 'android.os.Parcel' appears in /system/framework/framework.jar!classes3.dex)
	at android.os.Parcel.writeTypedObject(Parcel.java:2466)
	at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4643)
	at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6817)
	at android.os.Binder.execTransactInternal(Binder.java:1428)
	at android.os.Binder.execTransact(Binder.java:1372)

It seems to be a bug of HMA-OSS.

[ndv400]

Can confirm system crashes for me when using HMA-OSS randomly (and Vector version 3036).

[JingMatrix]

The upstream wrote the hook function of getArchivedPackageInternal correctly:
https://github.com/Dr-TSNG/Hide-My-Applist/blob/master/xposed/src/main/java/icu/nullptr/hidemyapplist/xposed/hook/PmsHookTarget34.kt,
while the following line written by @frknkrc44 caused the crash for you:
https://github.com/frknkrc44/HMA-OSS/blob/7a8c9ae0b0889a4a67bc67d679a0cf3909721d2a/xposed/src/main/java/icu/nullptr/hidemyapplist/xposed/hook/PmsHookTarget34.kt#L108