Xposing ALL processes rather than only those selected

[RichardJohnAllen]

I am developing an Xposed module to detect malware running on Android. I first developed the module as research for a master’s degree.

You can find the paper here:
https://cronfa.swan.ac.uk/Record/cronfa59800
or here:
https://www.researchgate.net/publication/359948508_Runtime_Verification_For_Android_Security.

I used to use the original Xposed framework by rovo89, but I have progressed to Magisk and LSposed so that the module can run on the latest versions of Android. I tried EdExposed, but could not find any combination of components that worked - the modules list could not be found. LSPosed runs my module, but the problem is that LSPosed only hooks selected processes. I know it is a feature that was developed to improve performance, but for malware detection to be effective, I require the module to hook interesting methods called by all running processes. The original Xposed framework by rovo89 did just this. Can a setting be added to LSPosed to hook all processes?

Thanks.

[mywalkb]

With LSPosed this is not possible. With my mod mywalkb/LSPosed_mod, you can use CLI as root or API Module (no root required) for set scope all packages. You must manage event add package for add it to scope.
If think will be good for you, sure is better than nothing. API Module and CLI are very old TODO tasks never completed.

[RichardJohnAllen]

I'll have a look at that. Presently, my Xposed module is unchanged from when it ran under the original Xposed. The only thing that compromises it is the scope it runs under LSPosed. I am using LSPosed because it is the only thing that will run the module on the latest Android versions.

[mywalkb]

Also with my mod your module require changes, but at least it is possible to do it.
"All apps" if a feature request always refused by LSPosed team and I never implemented in my mod because I never needed it, but with API module you can manage your scope as you like.

[RichardJohnAllen]

I implement handleLoadPackage from IXposedHookLoadPackage.

[Rwadxvv]

Gf