Initial commit

root-module/META-INF/com/google/android/update-binary

@@ -0,0 +1,33 @@
+#!/sbin/sh
+
+#################
+# Initialization
+#################
+
+umask 022
+
+# echo before loading util_functions
+ui_print() { echo "$1"; }
+
+require_new_magisk() {
+  ui_print "*******************************"
+  ui_print " Please install Magisk v20.4+! "
+  ui_print "*******************************"
+  exit 1
+}
+
+#########################
+# Load util_functions.sh
+#########################
+
+OUTFD=$2
+ZIPFILE=$3
+
+mount /data 2>/dev/null
+
+[ -f /data/adb/magisk/util_functions.sh ] || require_new_magisk
+. /data/adb/magisk/util_functions.sh
+[ $MAGISK_VER_CODE -lt 20400 ] && require_new_magisk
+
+install_module
+exit 0

root-module/META-INF/com/google/android/updater-script

@@ -0,0 +1 @@
+#MAGISK

root-module/customize.sh

@@ -0,0 +1,39 @@
+#!/system/bin/sh
+# CamSwapper HAL Hook - Module installation customization
+# This script is SOURCED (not executed) by the Magisk/KernelSU installer
+# after files are extracted and default permissions applied.
+
+# Skip default unzip since our module files are at ZIP root
+# (no system/ directory to mount)
+SKIPUNZIP=0
+
+# Module doesn't modify /system, so skip mount
+# (we use LD_PRELOAD via wrap property instead)
+
+# Set permissions for scripts and library
+set_perm_recursive "$MODPATH" 0 0 0755 0644
+set_perm "$MODPATH/post-fs-data.sh" 0 0 0755
+set_perm "$MODPATH/service.sh" 0 0 0755
+set_perm "$MODPATH/uninstall.sh" 0 0 0755
+set_perm "$MODPATH/libcamera_hook.so" 0 0 0644
+
+# Create config directory for HAL hook runtime config
+mkdir -p /data/local/camera_magic
+chmod 755 /data/local/camera_magic
+
+# Create default config (virtual camera disabled by default)
+if [ ! -f /data/local/camera_magic/config.txt ]; then
+    echo "enabled=0" > /data/local/camera_magic/config.txt
+    echo "source_mode=file" >> /data/local/camera_magic/config.txt
+    echo "video_path=/data/local/camera_magic/video.mp4" >> /data/local/camera_magic/config.txt
+    echo "rtsp_url=" >> /data/local/camera_magic/config.txt
+    chmod 644 /data/local/camera_magic/config.txt
+fi
+
+ui_print "- Config directory: /data/local/camera_magic/"
+ui_print "- Default config created (HAL mode disabled)"
+ui_print ""
+ui_print "After reboot:"
+ui_print "  1. Enable HAL mode in CamSwapper app"
+ui_print "  2. Or edit /data/local/camera_magic/config.txt"
+ui_print "  3. Open any camera app to see virtual feed"

root-module/module.prop

@@ -0,0 +1,6 @@
+id=camera-hook
+name=CamSwapper HAL Hook
+version=1.0
+versionCode=1
+author=CamSwapper
+description=System-wide camera replacement via LD_PRELOAD hook into camera provider process. Compatible with Magisk and KernelSU. Injects virtual camera feed for all apps without per-app Xposed scoping.

root-module/post-fs-data.sh

@@ -0,0 +1,52 @@
+#!/system/bin/sh
+# CamSwapper HAL Hook - Root module post-fs-data script
+# Runs BEFORE class_start hal.
+# Strategy: Use wrap. property to inject LD_PRELOAD into cameraserver.
+# On Pixel devices, the camera HAL is loaded in-process by cameraserver,
+# not as a separate provider service.
+
+MODDIR="${0%/*}"
+HOOK_LIB="$MODDIR/libcamera_hook.so"
+CONFIG_DIR="/data/local/camera_magic"
+
+mkdir -p "$CONFIG_DIR"
+chmod 755 "$CONFIG_DIR"
+
+if [ ! -f "$CONFIG_DIR/config.txt" ]; then
+    echo "enabled=0" > "$CONFIG_DIR/config.txt"
+    echo "source_mode=file" >> "$CONFIG_DIR/config.txt"
+    echo "video_path=/data/local/camera_magic/video.mp4" >> "$CONFIG_DIR/config.txt"
+    echo "rtsp_url=" >> "$CONFIG_DIR/config.txt"
+    chmod 644 "$CONFIG_DIR/config.txt"
+fi
+
+if [ ! -f "$HOOK_LIB" ]; then
+    echo "CameraHook: ERROR - libcamera_hook.so not found" > /dev/kmsg
+    exit 1
+fi
+
+chmod 644 "$HOOK_LIB"
+
+cp "$HOOK_LIB" "$CONFIG_DIR/libcamera_hook.so"
+chmod 644 "$CONFIG_DIR/libcamera_hook.so"
+
+# Apply SELinux policy rules
+if command -v magiskpolicy >/dev/null 2>&1; then
+    magiskpolicy --live \
+        "allow hal_camera_default magisk_file file { read open execute execute_no_trans map }" \
+        "allow hal_camera_default system_data_file dir { search open read }" \
+        "allow hal_camera_default system_data_file file { read open getattr }" \
+        "allow hal_camera_default self memfd { create read write map }" \
+        "allow hal_camera_default ashmem_device chr_file { read write open ioctl map }" \
+        "allow hal_camera_default logd unix_dgram_socket { sendto write }" \
+        "allow hal_camera_default logdw sock_file { write }" \
+        "allow cameraserver magisk_file file { read open execute execute_no_trans map }" \
+        "allow cameraserver magisk_file dir { search open read }" \
+        "allow cameraserver system_data_file dir { search open read }" \
+        "allow cameraserver system_data_file file { read open getattr map }" 2>/dev/null
+    echo "CameraHook: SELinux policy applied" > /dev/kmsg
+else
+    echo "CameraHook: magiskpolicy not found, relying on sepolicy.rule" > /dev/kmsg
+fi
+
+echo "CameraHook: post-fs-data complete, hook lib ready at $CONFIG_DIR/libcamera_hook.so" > /dev/kmsg

root-module/sepolicy.rule

@@ -0,0 +1,34 @@
+# CamSwapper HAL Hook - SELinux Policy Rules
+# Compatible with Magisk (v24+) and KernelSU
+# File: sepolicy.rule (auto-loaded by Magisk/KernelSU at boot)
+#
+# Context: The camera HAL runs as a separate APEX process:
+#   Process: android.hardware.camera.provider@2.7-service-google
+#   SELinux context: u:r:hal_camera_default:s0
+#
+# Our hook library is in /data/adb/modules/ (magisk_file context)
+# Config is in /data/local/camera_magic/ (system_data_file context)
+
+# Allow camera provider process to load our hook library from module directory
+allow hal_camera_default magisk_file:file { read open execute execute_no_trans map };
+
+# Allow camera provider process to read config file
+allow hal_camera_default system_data_file:dir { search open read };
+allow hal_camera_default system_data_file:file { read open getattr };
+
+# Allow camera provider process to access memfd shared memory for buffer sharing
+allow hal_camera_default hal_camera_default:memfd { create read write map };
+allow hal_camera_default self:memfd { create read write map };
+
+# Allow camera provider process to use ashmem (fallback for buffer sharing)
+allow hal_camera_default ashmem_device:chr_file { read write open ioctl map };
+
+# Allow logging from our hook library
+allow hal_camera_default logd:unix_dgram_socket { sendto write };
+allow hal_camera_default logdw:sock_file { write };
+
+# Allow cameraserver to load our hook library (Pixel devices load HAL in-process)
+allow cameraserver magisk_file:file { read open execute execute_no_trans map };
+allow cameraserver magisk_file:dir { search open read };
+allow cameraserver system_data_file:dir { search open read };
+allow cameraserver system_data_file:file { read open getattr map };

root-module/service.sh

@@ -0,0 +1,44 @@
+#!/system/bin/sh
+MODDIR="${0%/*}"
+HOOK_LIB="$MODDIR/libcamera_hook.so"
+MODPROP="$MODDIR/module.prop"
+INJECTOR="/data/local/tmp/inject_dlopen"
+
+update_description() {
+    if [ -f "$MODPROP" ]; then
+        sed -i "s|^description=.*|description=$1|" "$MODPROP"
+    fi
+}
+
+update_description "Waiting for cameraserver..."
+
+if [ ! -f "$HOOK_LIB" ]; then
+    update_description "Error - libcamera_hook.so not found"
+    exit 1
+fi
+
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+    CS_PID=$(pidof cameraserver 2>/dev/null)
+    if [ -n "$CS_PID" ]; then
+        break
+    fi
+    sleep 1
+done
+
+if [ -z "$CS_PID" ]; then
+    update_description "Error - cameraserver not running"
+    exit 1
+fi
+
+sleep 2
+
+if [ -f "$INJECTOR" ]; then
+    "$INJECTOR" "$CS_PID" > /dev/kmsg 2>&1
+    sleep 1
+fi
+
+if grep -q "libcamera_hook.so" /proc/"$CS_PID"/maps 2>/dev/null; then
+    update_description "Active - hook loaded in cameraserver PID $CS_PID"
+else
+    update_description "cameraserver PID $CS_PID - injection attempted"
+fi

root-module/system.prop

@@ -0,0 +1,24 @@
+# CamSwapper HAL Hook - System Properties
+# Loaded automatically by Magisk/KernelSU at boot.
+# These properties persist across reboots.
+
+# LD_PRELOAD injection into camera provider process
+# The wrap. property causes Zygote to preload our hook library
+# when spawning the camera provider service process.
+wrap.android.hardware.camera.provider@2.7-service-google=LD_PRELOAD=/data/adb/modules/camera-hook/libcamera_hook.so
+
+# Pixel devices load HAL in-process via cameraserver
+wrap.cameraserver=LD_PRELOAD=/data/local/camera_magic/libcamera_hook.so
+
+# Virtual camera enable/disable (read by HAL hook at runtime)
+# 0 = passthrough (real camera), 1 = virtual camera active
+persist.camera_magic.virtual_camera=0
+
+# Video source mode: file or rtsp
+persist.camera_magic.source_mode=file
+
+# Video file path (used when source_mode=file)
+persist.camera_magic.video_path=/data/local/camera_magic/video.mp4
+
+# RTSP URL (used when source_mode=rtsp)
+persist.camera_magic.rtsp_url=

root-module/uninstall.sh

@@ -0,0 +1,9 @@
+#!/system/bin/sh
+# CamSwapper HAL Hook - Uninstall script
+
+PROVIDER_BIN="/apex/com.google.pixel.camera.hal/bin/hw/android.hardware.camera.provider@2.7-service-google"
+
+umount "$PROVIDER_BIN" 2>/dev/null
+rm -f /data/adb/camera-hook-wrapper.sh
+rm -f /data/adb/camera-provider-original
+rm -rf /data/local/camera_magic