It is a LSPosed module for bypass Xiaobu Next beta verify
- Compile the module from source by yourself
- Install Xiaobu Next & the Bypass Module.
- Enable the Bypass Module in LSPosed and select Xiaobu Next.
- Force-stop Xiaobu Next and restart it.
- Enjoy!
- Bypassed Beta Verification in 170066 & higher version
Up to 170072 the obfuscated class names are stable enough to hard-code per
version. Starting with 170073 the whole controller package was renamed, so
the module resolves its hook targets at runtime with
DexKit instead: it anchors on string
literals that the obfuscator leaves untouched (for example
DUID access gate granted, device access check source=,
ro.boot.flash.locked) and derives the surrounding classes and their
signatures from those.
The DexKit pass rediscovers the 170071 layout exactly (gate g3, policy k2,
verdict h2, boot s4, viewmodel k1, cache accessor p -> l2), which is
why the same code path serves both the hard-coded and the resolved versions.
Resolved for 170073: gate w2, policy h2, verdict
BetaDeviceAccessPolicy$DeviceVerdict, boot z3, root probe ei.b,
viewmodel q1, idle state j1, cache accessor t -> i2.
Q: Where can I get Xiaobu Next?
A: Check here
Q: Not working on x.x.x version?
A: Please open an issue and upload the APK file.