WaEnhancer Community 0.0.24

WaEnhancer Community 0.0.24

SHA-256: 399b5cc720a60ce5b3919cad35c213f97a98bd515f675f51f7d9fcfc5b6810a5

Changes since v0.0.23.

What's changed

• #96 Remove system hooks and confine authenticated file/preferences IPC

Full changelog

This section compiles the descriptions of the pull requests included in this release.

#96 — Remove system hooks and confine authenticated file/preferences IPC

Merged by contribution from @igorcv88.

Result

Keep WhatsApp, Business and Community companion as the only Xposed processes; remove system_server/SettingsProvider/PackageManager hooks, downgrade/update interception and optional spoof runtime. No merge or public release.

Security fixes

• Replace arbitrary file paths with canonical primary shared-storage capabilities: seven actual media output categories with supported extensions, read-only theme/selected-wallpaper images and write-only media outputs. Reject private files, shared_prefs, databases, traversal, Android app storage, sibling-prefix paths and symlink escapes. Use O_NOFOLLOW and revalidate the opened regular-file descriptor before returning it or truncating an output. Deny generic enumeration; no production consumer uses listFiles.
• Keep UID authentication at provider acquisition and every Binder transaction. Configured download/wallpaper paths cannot authorize module-private storage.
• Restrict preference write/remove to known non-secret Store.PUBLIC keys; validate the type tag and actual Bundle value against PreferenceSchema before editing. No private-write exceptions. Embedded private settings use the existing open-in-companion editor row. Existing named transcription/Tasker secret operations remain; generic reads/file access cannot expose private storage.
• Remove all three obsolete spoof controls from the raw injected settings map as well as prior XML/search removal.
• Retry failed preference hydration/observer registration on subsequent reads with a monotonic 500 ms limit. Preserve throttled invalidation and cached data during outages. Startup-only hooks can still require a host restart after an initial configuration outage.

Evidence and remaining build

Four local test methods pass. Actual entrypoint, auth, file Binder, provider, schema/policies, client and deferred/provider preferences are compiled/executed against host Android stubs. Coverage includes all 26 private keys, valid/malformed public values, canonical paths, private files/DBs, traversal/symlink/prefix attacks, access modes, rejection before truncate, cold-start failure/retry, settings changes and companion loss/recovery. Real host temporary files exercise canonical/symlink behavior; Android Binder/Os/provider behavior is substituted. This is not a complete Android build or physical API-37 security/functionality validation.

Full LAB compilation, existing JVM suite, signed APK and packaged Manifest/scope/DEX gates remain required before merge/installation. No phone changes or browser use in this follow-up. Audit and current handoff updated.

Manual LAB execution

Workflow: Build APK Release (build-apk-release.yml)
Branch: review/app-only-no-system-server-20261022
Inputs: mode=lab, channel=beta, expected_sha=f726edc852bd11aa1932c4e30275f111468eb533.
The previous 887b659... expected_sha/APK no longer represents the current security fixes. LAB uploads signed APK + SHA-256 + source SHA without tagging or creating a GitHub Release.

See docs/APP_ONLY_REVIEW_2026-10-22.md for capabilities, remaining device tests and rollback.