Hook SurfaceControl setSecure

Author: Howard20181

app/src/main/java/io/github/lsposed/disableflagsecure/DisableFlagSecure.java

@@ -126,6 +126,14 @@ public void onSystemServerLoaded(@NonNull SystemServerLoadedParam param) {
             log("hook WindowState failed", t);
         }
 
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            try {
+                hookSurfaceControl(classLoader);
+            } catch (Throwable t) {
+                log("hook SurfaceControl failed", t);
+            }
+        }
+
         // oplus dumpsys
         // dumpsys window screenshot systemQuickTileScreenshotOut display_id=0
         try {
@@ -228,6 +236,13 @@ private void hookWindowState(ClassLoader classLoader) throws ClassNotFoundExcept
         hook(isSecureLockedMethod, SecureLockedHooker.class);
     }
 
+    private void hookSurfaceControl(ClassLoader classLoader) throws ClassNotFoundException, NoSuchMethodException {
+        var windowStateClazz = classLoader.loadClass("android.view.SurfaceControl$Transaction");
+        @SuppressLint("SoonBlockedPrivateApi")
+        var setSecureMethod = windowStateClazz.getDeclaredMethod("setSecure", SurfaceControl.class, boolean.class);
+        hook(setSecureMethod, SetSecureHooker.class);
+    }
+
     private static Field captureSecureLayersField;
 
     private void hookScreenCapture(ClassLoader classLoader) throws ClassNotFoundException, NoSuchFieldException {
@@ -381,7 +396,7 @@ public static void before(@NonNull BeforeHookCallback callback) {
             if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
                 var uid = android.os.Process.myUid();
                 // cannot bypass hasCaptureBlackoutContentPermission() in SurfaceFlinger.cpp
-                // skipping this hook for S~T before implement native hook
+                // skipping this hook for S~T
                 if (uid != 1000 && uid != 1003) {
                     return;
                 }
@@ -450,6 +465,17 @@ public static void before(@NonNull BeforeHookCallback callback) {
         }
     }
 
+    @XposedHooker
+    private static class SetSecureHooker implements Hooker {
+        @BeforeInvocation
+        public static void before(@NonNull BeforeHookCallback callback) {
+            var isSecure = callback.getArgs()[1];
+            if (isSecure instanceof Boolean) {
+                callback.getArgs()[1] = false;
+            }
+        }
+    }
+
     @XposedHooker
     private static class ReturnTrueHooker implements Hooker {
         @BeforeInvocation