From cde404a93b424e294a43dfd8095f9b8af60b5639 Mon Sep 17 00:00:00 2001 From: Nullptr Date: Sun, 14 Nov 2021 20:49:45 +0800 Subject: [PATCH] docs: update document --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 6bce08d..f4d535f 100644 --- a/README.md +++ b/README.md @@ -29,10 +29,12 @@ This module can work as an Xposed module to hide apps or reject app list request Maps refers to /proc/self/maps (See [Linux manpage](https://man7.org/linux/man-pages/man5/proc.5.html) for more information). When something such as an Xposed module or a Zygisk module injects into target app, it will show its path on /proc/\/maps. Though LSPosed and Riru did some work to make module maps info anonymous, if a module dlopen a native library by itself, the loaded so path will still be written on maps (Such module like QNotified). +How to use it: paths that contains configured strings will be filtered on /proc/self/maps Notice that under **MOST** circumstances you do not need to switch on this interception nor need to add any rule. ### Custom query params This refers to the string params of methods of [PackageManagerService](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java) +How to use it: pms methods whose string params contain configured strings will be intercepted Notice that under **MOST** circumstances you do not need to switch on this interception nor need to add any rule. ### How did HMA Magisk module work? HMA install inline hooks for syscall wrappers in libc and modify the results to make the app think there "isn't" suspicious files or directories.