Advanced Texture using miui.mqsas.IMQSNative

[MeowIce]

Recently, a new exploit found in service miui.mqsas.IMQSNative that allows the execution of root commands.
I have tried to enable Advanced Texture using this method, and the option does show up in Setitngs.

service call miui.mqsas.IMQSNative 21 i32 1 s16 "setprop" i32 1 s16 "persist.sys.computility.cpulevel 6" s16 "/storage/emulated/0/log.txt" i32 600
service call miui.mqsas.IMQSNative 21 i32 1 s16 "setprop" i32 1 s16 "persist.sys.computility.gpulevel 6" s16 "/storage/emulated/0/log.txt" i32 600
service call miui.mqsas.IMQSNative 21 i32 1 s16 "setprop" i32 1 s16 "persist.sys.advanced_visual_release 3" s16 "/storage/emulated/0/log.txt" i32 600
service call miui.mqsas.IMQSNative 21 i32 1 s16 "setprop" i32 1 s16 "persist.sys.background_blur_supported true" s16 "/storage/emulated/0/log.txt" i32 600
service call miui.mqsas.IMQSNative 21 i32 1 s16 "setprop" i32 1 s16 "ctl.restart surfaceflinger" s16 "/storage/emulated/0/log.txt" i32 600\

However there is a visual bug:

My device is Redmi Note 13 Pro+ 5G/OS3.0.2.0 Global.
What are the additional commands to fix this ? I also ran #$start_basic and #$start_bluron in all.prop but not working.

[ukriu]

Hi, this mainly happens when screenshot blur is enabled with advanced textures, you can find how I disable it here:

HyperUnlocked/overlay/com.android.systemui/res/values/bools.xml

Line 4 in d5ef8d2

<bool name="shade_screenshot_blur">false</bool>

Another fix for this might be replacing framework-res__nosdcard__auto_generated_characteristics_rro.apk in /product/overlay/ to one from another device but I haven't tried this out yet since it was reported to me from another person.

[MeowIce]

Hi, this mainly happens when screenshot blur is enabled with advanced textures, you can find how I disable it here:

HyperUnlocked/overlay/com.android.systemui/res/values/bools.xml

Line 4 in d5ef8d2
false

Another fix for this might be replacing framework-res__nosdcard__auto_generated_characteristics_rro.apk in /product/overlay/ to one from another device but I haven't tried this out yet since it was reported to me from another person.

Does the first solution require root ?
IIRC, since /product/overlay/ is EROFS (read-only) then how can I replace the APK ?

[ukriu]

Does the first solution require root ? IIRC, since /product/overlay/ is EROFS (read-only) then how can I replace the APK ?

Yes, having root will be optimal
But you can also just probably install HyperUnlocked/system/product/overlay/HyperUnlocked-com.android.systemui.apk from the latest release and run cmd overlay enable com.ukriu.hyperunlocked.systemui.overlay and maybe that will work too

[ukriu]

This is unrelated but Im keeping it up since its interesting, do lmk if enabling an overlay installed as an user app does work

[MeowIce]

Does the first solution require root ? IIRC, since /product/overlay/ is EROFS (read-only) then how can I replace the APK ?

Yes, having root will be optimal But you can also just probably install HyperUnlocked/system/product/overlay/HyperUnlocked-com.android.systemui.apk from the latest release and run cmd overlay enable com.ukriu.hyperunlocked.systemui.overlay and maybe that will work too

I got the following error when installing the APK:

[ukriu]

Does the first solution require root ? IIRC, since /product/overlay/ is EROFS (read-only) then how can I replace the APK ?

Yes, having root will be optimal But you can also just probably install HyperUnlocked/system/product/overlay/HyperUnlocked-com.android.systemui.apk from the latest release and run cmd overlay enable com.ukriu.hyperunlocked.systemui.overlay and maybe that will work too

I got the following error when installing the APK:

Yea the thing about this exploit is that we don't really have access to cmd overlay due to the selinux policy

`cmd -l` output

------ (cmd -l) in 60s ------
Currently running services:
  AmlMiuiWifiService
  SurfaceFlinger
  SurfaceFlingerAIDL
  activity
  activity_task
  alarm
  android.security.apc
  android.security.legacykeystore
  android.system.keystore2.IKeystoreService/default
  arm.mali.platform.ICompression/default
  batterystats
  connectivity
  connmetrics
  cpuinfo
  display
  dropbox
  ethernet
  gfxinfo
  greezer
  input
  input_method
  inputflinger
  jobscheduler
  media.camera
  meminfo
  miui.mqsas.IMQSNative
  miui.mqsas.MQSService
  netd_listener
  netpolicy
  netstats
  network_management
  network_stack
  network_watchlist
  package
  package_native
  permission
  power
  tethering
  turbosched
  vendor.xiaomi.hardware.misys.common.IMiSysImpl/default
  vpn_management
  wallpaper
  wifi
  wifip2p
  wifiscanner
  window
  xiaomi.system.hypsys.common.IHypSysSsi/default
  xiaomi.system.hypsys.common.IHypSysSsiIntl/default

So I dont think it'll work regardless
Your best bet right now is disabling selinux policy from fastboot (IF your phone is qcomm) and rooting with kernelsu late load mode so you can install the module itself
im pretty sure the jailbreak mode in ksu still allows for meta-overlayfs

[MeowIce]

I have found an interesting workaround:

• Remove the DevicesOverlay package: pm uninstall --user 0 com.miui.systemui.devices.overlay
• Reboot the device, or restart the surfaceflinger: service call miui.mqsas.IMQSNative 21 i32 1 s16 "setprop" i32 1 s16 "ctl.restart surfaceflinger" s16 "/storage/emulated/0/log.txt" i32 600
  The status bar will offset a bit to screen edges.
• Reinstall DevicesOverlay: pm install-existing --user 0 com.miui.systemui.devices.overlay
• Change small width to +-5 and change back to its original value.
  This will reload the overlay and align the statusbar correctly.