PLEASE HELP With New Version of the Qin F21, Different Hardware and ROM

ars18 · December 21, 2025, 10:21pm

Yes, but please verify I did it right (been a while) by running an accessibility service and swiping app from recents. I might’ve removed it the amount of times I restarted.

I’ll check

dfrydman · December 21, 2025, 10:21pm

later - gotta go thank the borei oilam

ars18 · December 21, 2025, 10:22pm

Don’t know if all of them are, but some yes. I’ll upload all the patches for you to take a look.

ars18 · December 21, 2025, 10:23pm

It’s not there, adding it now

ars18 · December 21, 2025, 10:29pm

patch script

(everything we did, including background app kill)

#!/bin/bash

source $(dirname $(realpath "$0"))/_.sh

LIB='services.jar'

# PATCH 1: isOversea() - Always return true
PATCH_IDENTITY=adb_bypass_is_oversea_01
FILE="com/android/server/pm/PackageManagerShellCommand.smali"
REGEX='\.method private isOversea\(\)Z.*?\.locals 2\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x1
    return v0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 2: isAdbInstallDisallowed() - Always return false
PATCH_IDENTITY=adb_bypass_is_adb_disallowed_02
FILE="com/android/server/pm/Settings.smali"
REGEX='\.method static isAdbInstallDisallowed\(Lcom\/android\/server\/pm\/UserManagerService;I\)Z.*?\.locals 1\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
    return v0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 3: PackageInstallerService - Bypass no_install_apps check
PATCH_IDENTITY=adb_bypass_pkg_installer_03
FILE="com/android/server/pm/PackageInstallerService.smali"
REGEX='invoke-virtual \{v1, v12, v2\}, Lcom\/android\/server\/pm\/PackageManagerService;->isUserRestricted\(ILjava\/lang\/String;\)Z\n\n    move-result v1\n'
PATCH=$(cat << 'EOF'
    const/4 v1, 0x0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 4: PackageManagerService - Bypass no_install_apps check
PATCH_IDENTITY=adb_bypass_pkg_mgr_svc_04
FILE="com/android/server/pm/PackageManagerService.smali"
REGEX='invoke-virtual \{v8, v10, v0\}, Lcom\/android\/server\/pm\/PackageManagerService;->isUserRestricted\(ILjava\/lang\/String;\)Z\n\n    move-result v0\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 5: PackageManagerServiceUtils - Bypass enforceShellRestriction
PATCH_IDENTITY=adb_bypass_pkg_utils_05
FILE="com/android/server/pm/PackageManagerServiceUtils.smali"
REGEX='\.method public static enforceShellRestriction\(Landroid\/os\/UserManagerInternal;Ljava\/lang\/String;II\)V\n    \.locals 3\n    \.param p0, "userManager".*?\n    \.param p1, "restriction".*?\n    \.param p2, "callingUid".*?\n    \.param p3, "userHandle".*?\n\n'
PATCH=$(cat << 'EOF'
    return-void
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 6: UserController - Bypass enforceShellRestriction method
PATCH_IDENTITY=adb_bypass_user_ctrl_shell_06
FILE="com/android/server/am/UserController.smali"
REGEX='\.method private enforceShellRestriction\(Ljava\/lang\/String;I\)V\n    \.locals 3\n    \.param p1, "restriction".*?\n    \.param p2, "userId".*?\n\n'
PATCH=$(cat << 'EOF'
    return-void
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 7: UserController - Bypass inline no_debugging_features check
PATCH_IDENTITY=adb_bypass_user_ctrl_debug_07
FILE="com/android/server/am/UserController.smali"
REGEX='invoke-virtual \{v6, v0, v12\}, Lcom\/android\/server\/am\/UserController;->hasUserRestriction\(Ljava\/lang\/String;I\)Z\n\n    move-result v0\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 8: PackageManagerService - isUserRestricted() always return false
PATCH_IDENTITY=adb_bypass_is_user_restricted_08
FILE="com/android/server/pm/PackageManagerService.smali"
REGEX='\.method isUserRestricted\(ILjava\/lang\/String;\)Z\n    \.locals 3\n    \.param p1, "userId".*?\n    \.param p2, "restrictionKey".*?\n\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
    return v0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 9: UserManagerService$LocalService - hasUserRestriction() bypass for install restrictions
PATCH_IDENTITY=adb_bypass_local_svc_restriction_09
FILE="com/android/server/pm/UserManagerService\$LocalService.smali"
REGEX='\.method public hasUserRestriction\(Ljava\/lang\/String;I\)Z\n    \.locals 3\n    \.param p1, "restrictionKey".*?\n    \.param p2, "userId".*?\n\n'
PATCH=$(cat << 'EOF'
    const-string v0, "no_debugging_features"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_restriction
    const-string v0, "no_install_apps"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_restriction
    const-string v0, "no_install_unknown_sources"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_restriction
    const-string v0, "no_install_unknown_sources_globally"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_restriction
    goto :original_check
    :bypass_restriction
    const/4 v0, 0x0
    return v0
    :original_check
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 10: UserManagerService - hasUserRestriction() bypass for install restrictions
PATCH_IDENTITY=adb_bypass_um_svc_restriction_10
FILE="com/android/server/pm/UserManagerService.smali"
REGEX='\.method public hasUserRestriction\(Ljava\/lang\/String;I\)Z\n    \.locals 1\n    \.param p1, "restrictionKey".*?\n    \.param p2, "userId".*?\n\n'
PATCH=$(cat << 'EOF'
    const-string v0, "no_debugging_features"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_um
    const-string v0, "no_install_apps"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_um
    const-string v0, "no_install_unknown_sources"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_um
    const-string v0, "no_install_unknown_sources_globally"
    invoke-virtual {p1, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z
    move-result v0
    if-nez v0, :bypass_um
    goto :original_um_check
    :bypass_um
    const/4 v0, 0x0
    return v0
    :original_um_check
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 11: AdbService - Bypass Duoqin Guard check in systemReady()
PATCH_IDENTITY=adb_bypass_duoqin_guard_11
FILE="com/android/server/adb/AdbService.smali"
REGEX='invoke-static \{v0\}, Lcom\/duoqin\/guard\/Guard;->isDuoqinGuardEnable\(Landroid\/content\/ContentResolver;\)Z\n\n    move-result v0\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 12: AdbSettingsObserver - Bypass Duoqin Guard check in onChange()
PATCH_IDENTITY=adb_bypass_duoqin_observer_12
FILE="com/android/server/adb/AdbService\$AdbSettingsObserver.smali"
REGEX='invoke-static \{v0\}, Lcom\/duoqin\/guard\/Guard;->isDuoqinGuardEnable\(Landroid\/content\/ContentResolver;\)Z\n\n    move-result v0\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 13: ActivityTaskManagerService - isActivityDisabledByGuard() always return false
# This bypasses the Duoqin Guard activity blocking mechanism
PATCH_IDENTITY=adb_bypass_activity_guard_13
FILE="com/android/server/wm/ActivityTaskManagerService.smali"
REGEX='\.method isActivityDisabledByGuard\(Ljava\/lang\/String;\)Z\n    \.locals 1\n    \.param p1, "component".*?\n\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x0
    return v0
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 14: PackageManagerShellCommand.onCommand() - Bypass IS_DEBUGGABLE check
# This is the ROOT CAUSE - pm commands check Build.IS_DEBUGGABLE and reject all on user builds
# We insert const/4 v0, 0x1 right after sget-boolean, BEFORE the if-nez check
PATCH_IDENTITY=adb_bypass_debuggable_check_14
FILE="com/android/server/pm/PackageManagerShellCommand.smali"
REGEX='sget-boolean v0, Landroid\/os\/Build;->IS_DEBUGGABLE:Z\n\n    const\/4 v1, 0x1\n'
PATCH=$(cat << 'EOF'
    const/4 v0, 0x1
EOF
)
patch_insert_after "$PATCH_IDENTITY" "$LIB" "$REGEX" "$PATCH" "$FILE"

# PATCH 15: ActivityManagerService$LocalService - Replace killProcessesForRemovedTask method
PATCH_IDENTITY=kill_processes_fix_15
FILE="com/android/server/am/ActivityManagerService\$LocalService.smali"
METHOD_SIG=".method public killProcessesForRemovedTask(Ljava/util/ArrayList;)V"
NEW_METHOD=$(cat << 'ENDMETHOD'
.method public killProcessesForRemovedTask(Ljava/util/ArrayList;)V
    .locals 7
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "(",
            "Ljava/util/ArrayList<",
            "Ljava/lang/Object;",
            ">;)V"
        }
    .end annotation
    .line 19460
    iget-object v0, p0, Lcom/android/server/am/ActivityManagerService$LocalService;->this$0:Lcom/android/server/am/ActivityManagerService;
    monitor-enter v0
    :try_start_0
    invoke-static {}, Lcom/android/server/am/ActivityManagerService;->boostPriorityForLockedSection()V
    .line 19461
    const/4 v1, 0x0
    move v2, v1
    :goto_0
    invoke-virtual {p1}, Ljava/util/ArrayList;->size()I
    move-result v3
    if-ge v2, v3, :cond_1
    .line 19462
    nop
    .line 19463
    invoke-virtual {p1, v2}, Ljava/util/ArrayList;->get(I)Ljava/lang/Object;
    move-result-object v3
    check-cast v3, Lcom/android/server/wm/WindowProcessController;
    .line 19464
    iget-object v3, v3, Lcom/android/server/wm/WindowProcessController;->mOwner:Ljava/lang/Object;
    check-cast v3, Lcom/android/server/am/ProcessRecord;
    .line 19465
    iget v4, v3, Lcom/android/server/am/ProcessRecord;->setSchedGroup:I
    if-nez v4, :cond_0
    iget-object v4, v3, Lcom/android/server/am/ProcessRecord;->curReceivers:Landroid/util/ArraySet;
    .line 19466
    invoke-virtual {v4}, Landroid/util/ArraySet;->isEmpty()Z
    move-result v4
    if-eqz v4, :cond_0
    .line 19467
    const-string/jumbo v4, "remove task"
    const/16 v5, 0xa
    const/4 v6, 0x1
    invoke-virtual {v3, v4, v5, v1, v6}, Lcom/android/server/am/ProcessRecord;->kill(Ljava/lang/String;IIZ)V
    goto :goto_1
    .line 19472
    :cond_0
    const-string/jumbo v4, "remove task"
    iput-object v4, v3, Lcom/android/server/am/ProcessRecord;->waitingToKill:Ljava/lang/String;
    .line 19461
    :goto_1
    add-int/lit8 v2, v2, 0x1
    goto :goto_0
    .line 19475
    :cond_1
    monitor-exit v0
    :try_end_0
    .catchall {:try_start_0 .. :try_end_0} :catchall_0
    invoke-static {}, Lcom/android/server/am/ActivityManagerService;->resetPriorityAfterLockedSection()V
    .line 19476
    return-void
    .line 19475
    :catchall_0
    move-exception p1
    :try_start_1
    monitor-exit v0
    :try_end_1
    .catchall {:try_start_1 .. :try_end_1} :catchall_0
    invoke-static {}, Lcom/android/server/am/ActivityManagerService;->resetPriorityAfterLockedSection()V
    throw p1
.end method
ENDMETHOD
)
patch_replace_method "$PATCH_IDENTITY" "$LIB" "$METHOD_SIG" "$NEW_METHOD" "$FILE"

echo ""
echo "Complete"

_.sh

#!/bin/bash

patch_banner() {
    local identity=$1
    echo "    ##### jarpatcher:$identity"
}

patch_remove() {
    local identity="$1"
    local file="$2"
    local marker=$(patch_banner "$identity")
    perl -i -0777 -pe 's/('"\n$marker"'.*'"$marker\n\n"')//gs' "$file"
}

patch_insert_after() {
    local identity=$1
    local marker=$(patch_banner "$identity")
    local lib="$2"
    local regx="$3"
    local code=$(printf '%s' "$4" | sed 's/[][\.*^$(){}?+|\/]/\\&/g')
    local class="$5"

    SCRIPT_PATH=$(dirname $(realpath "$0"))
    LIB_PATH="$SCRIPT_PATH""/../$lib.smali"
    SMALI_PATH=$(find $LIB_PATH | grep "$class")
    file=$SMALI_PATH

    if [ ! -e "$file" ]; then
        echo "Could not find '$class' in '$lib' to apply patch '$identity'. Make sure '$lib' library pulled and decompiled!"
        return
    fi

    patch_remove "$identity" "$file"
    if grep -q $identity $file; then
        echo "Could not remove old patch '$identity'!"
        return
    fi

    perl -i -0777 -pe 's/('"$regx"')/$1'"\n$marker\n$code\n$marker\n\n"'/s' "$file"
    if grep -q $identity $file; then
        echo "Patch '$identity' successfully applied!"
    else
        echo "Patch '$identity' was not applied. Probably smali code was changed and do not match signature anymore."
    fi
}

# Replace an entire method with new content
# Uses temp file approach to avoid regex escaping issues
patch_replace_method() {
    local identity=$1
    local lib="$2"
    local method_sig="$3"  # e.g., ".method public killProcessesForRemovedTask"
    local new_method="$4"
    local class="$5"

    SCRIPT_PATH=$(dirname $(realpath "$0"))
    LIB_PATH="$SCRIPT_PATH""/../$lib.smali"
    SMALI_PATH=$(find $LIB_PATH | grep "$class")
    file=$SMALI_PATH

    if [ ! -e "$file" ]; then
        echo "Could not find '$class' in '$lib' to apply patch '$identity'. Make sure '$lib' library pulled and decompiled!"
        return
    fi

    # Write new method to temp file
    local tmp_method=$(mktemp)
    echo "$new_method" > "$tmp_method"

    # Use awk to replace the method
    awk -v sig="$method_sig" -v newfile="$tmp_method" '
    BEGIN { in_method = 0 }
    $0 ~ sig { in_method = 1; while ((getline line < newfile) > 0) print line; close(newfile) }
    in_method && /^\.end method/ { in_method = 0; next }
    !in_method { print }
    ' "$file" > "${file}.tmp" && mv "${file}.tmp" "$file"

    rm -f "$tmp_method"

    if grep -q "$method_sig" "$file"; then
        echo "Patch '$identity' successfully applied!"
    else
        echo "Patch '$identity' was not applied. Method not found after replacement."
    fi
}

# Method for logging some strings in logcat
# (be careful, some smali methods do not have v0 available)
android_logcat() {
    LOG_IDENTITY=$1
    RANDOM_NUMBER=$(( RANDOM % 100000 ))
    LABEL="99$RANDOM_NUMBER"
    CODE=$(cat << EOF
	:try_start_$LABEL
    const-string v0, "$LOG_IDENTITY"
    invoke-static {v0, v0}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I
    :try_end_$LABEL
    .catchall {:try_start_$LABEL .. :try_end_$LABEL} :catchall_$LABEL
    goto :try_exit_$LABEL
    :catchall_$LABEL
    move-exception v0
    :try_exit_$LABEL
EOF
    )
    echo "$CODE"
}

ars18 · December 21, 2025, 10:49pm

Btw, all done on termux. Powerful stuff, I love it.

dfrydman · December 21, 2025, 11:09pm

the app termux???

ars18 · December 21, 2025, 11:11pm

Yep, was too lazy to go to my pc, and once I started…

Let me know about app kill with newest v6 services.jar above.

dfrydman · December 21, 2025, 11:13pm

im cant even begin to undertsand how you did that on an app - dont tell me it was a qin

ars18 · December 21, 2025, 11:13pm

Nah OnePlus 12

Literally a mini computer, Qualcomm Snapdragon 8 Gen 3 16GB LPDDR5X RAM.

dfrydman · December 21, 2025, 11:15pm

kay im putting in the new services.jar - now i just got make it googled and then ill realease

ys770 · December 21, 2025, 11:15pm

You can run claude in there? Just wondering

ars18 · December 21, 2025, 11:15pm

Check app kill first, and make sure you pull super from phone, you already removed admin.

ars18 · December 21, 2025, 11:15pm

Yep

ys770 · December 21, 2025, 11:16pm

Ah cool

ars18 · December 21, 2025, 11:17pm

Look, I think this thread revealed how much of an ai junkie I am lol

Used to think it was useless.

It’s just so useful if you get yourself a nice workflow and actually plan ahead.

ars18 · December 21, 2025, 11:20pm

If I were you I’d pull super now before you Google it, in case something goes wrong. You don’t want to have to do all this again.

dfrydman · December 21, 2025, 11:21pm

i dont think device admin was an issue becuase i replaced the services.jar by flashing system_a which i had not done anything other than replace services.jar

ars18 · December 21, 2025, 11:22pm

And thanks, this will help alot of people that get these new phones, someone’s gotta take down the 1.1.1 guide lol

I posted this today on discord:

ars18 · December 21, 2025, 11:23pm

Maybe… But do you want a Chinese admin on your device?

Plus, you wouldn’t be able to activate an MDM.