The hidden API is called through reflection. The original code is complex and simplified to: new android.app.UiAutomation(new HandlerThread("name").getLooper(), new UiAutomationConnection()).connect();

adb shell "app_process64 ...'" works fine adb shell "su -c 'app_process64 ...'" working abnormally

Logcat: 2022-08-29 12:46:56.917 212-212/? E/JavaBinder: !!! FAILED BINDER TRANSACTION !!! (parcel size = 192)

--------- beginning of system

2022-08-29 12:46:56.917 212-212/? W/UiAutomationManager: Error initialized connection android.os.DeadObjectException: Transaction failed on small parcel; remote process probably died at android.os.BinderProxy.transactNative(Native Method) at android.os.BinderProxy.transact(BinderProxy.java:571) at android.accessibilityservice.IAccessibilityServiceClient$Stub$Proxy.init(IAccessibilityServiceClient.java:347) at com.android.server.accessibility.UiAutomationManager$UiAutomationService.lambda$connectServiceUnknownThread$0$UiAutomationManager$UiAutomationService(UiAutomationManager.java:281) at com.android.server.accessibility.UiAutomationManager$UiAutomationService$$ExternalSyntheticLambda0.run(Unknown Source:2) at android.os.Handler.handleCallback(Handler.java:938) at android.os.Handler.dispatchMessage(Handler.java:99) at android.os.Looper.loopOnce(Looper.java:201) at android.os.Looper.loop(Looper.java:288) at com.android.server.SystemServer.run(SystemServer.java:904) at com.android.server.SystemServer.main(SystemServer.java:611) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:981) 2022-08-29 12:46:56.918 212-212/? E/JavaBinder: !!! FAILED BINDER TRANSACTION !!! (parcel size = 192) 2022-08-29 12:47:01.943 4428-4445/? E/app: Java.Lang.RuntimeException: java.util.concurrent.TimeoutException: Timeout while connecting UiAutomation@22bf0d4[id=-1, flags=0] ---> Java.Util.Concurrent.TimeoutException: Timeout while connecting UiAutomation@22bf0d4[id=-1, flags=0]

  --- End of managed Java.Util.Concurrent.TimeoutException stack trace ---
java.util.concurrent.TimeoutException: Timeout while connecting UiAutomation@22bf0d4[id=-1, flags=0]
    at android.app.UiAutomation.connectWithTimeout(UiAutomation.java:346)
    at android.app.UiAutomation.connect(UiAutomation.java:276)

  --- End of managed Java.Util.Concurrent.TimeoutException stack trace ---
java.util.concurrent.TimeoutException: Timeout while connecting UiAutomation@22bf0d4[id=-1, flags=0]
    at android.app.UiAutomation.connectWithTimeout(UiAutomation.java:346)
    at android.app.UiAutomation.connect(UiAutomation.java:276)

dmesg: [ 4206.368888] audit: type=1400 audit(1661665816.648:152): avc: denied { getattr } for pid=1874 comm="sh" path="/system/bin/app_process64" dev="pmem0" ino=163 scontext=u:r:su:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=1 [ 4206.372815] audit: type=1400 audit(1661665816.648:153): avc: denied { execute } for pid=1874 comm="sh" name="app_process64" dev="pmem0" ino=163 scontext=u:r:su:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=1 [ 4206.375633] audit: type=1400 audit(1661665816.648:154): avc: denied { read open } for pid=1930 comm="sh" path="/system/bin/app_process64" dev="pmem0" ino=163 scontext=u:r:su:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=1 [ 4206.377713] audit: type=1400 audit(1661665816.648:155): avc: denied { execute_no_trans } for pid=1930 comm="sh" path="/system/bin/app_process64" dev="pmem0" ino=163 scontext=u:r:su:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=1 [ 4206.379807] audit: type=1400 audit(1661665816.648:156): avc: denied { map } for pid=1930 comm="app_process64" path="/system/bin/app_process64" dev="pmem0" ino=163 scontext=u:r:su:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file permissive=1 [ 4206.410895] audit: type=1400 audit(1661665816.688:157): avc: denied { read } for pid=1930 comm="app_process64" name="u:object_r:dalvik_runtime_prop:s0" dev="tmpfs" ino=85 scontext=u:r:su:s0 tcontext=u:object_r:dalvik_runtime_prop:s0 tclass=file permissive=1 [ 4206.416126] audit: type=1400 audit(1661665816.688:158): avc: denied { open } for pid=1930 comm="app_process64" path="/dev/properties/u:object_r:dalvik_runtime_prop:s0" dev="tmpfs" ino=85 scontext=u:r:su:s0 tcontext=u:object_r:dalvik_runtime_prop:s0 tclass=file permissive=1 [ 4206.419072] audit: type=1400 audit(1661665816.688:159): avc: denied { getattr } for pid=1930 comm="app_process64" path="/dev/properties/u:object_r:dalvik_runtime_prop:s0" dev="tmpfs" ino=85 scontext=u:r:su:s0 tcontext=u:object_r:dalvik_runtime_prop:s0 tclass=file permissive=1 [ 4206.421936] audit: type=1400 audit(1661665816.688:160): avc: denied { map } for pid=1930 comm="app_process64" path="/dev/properties/u:object_r:dalvik_runtime_prop:s0" dev="tmpfs" ino=85 scontext=u:r:su:s0 tcontext=u:object_r:dalvik_runtime_prop:s0 tclass=file permissive=1 [ 4206.425576] audit: type=1400 audit(1661665816.688:161): avc: denied { read } for pid=1930 comm="app_process64" name="u:object_r:dalvik_config_prop:s0" dev="tmpfs" ino=83 scontext=u:r:su:s0 tcontext=u:object_r:dalvik_config_prop:s0 tclass=file permissive=1 [ 4206.740184] binder: 598:598 transaction failed 29201/-1, size 192-16 line 2746 [ 4206.740820] binder: 598:598 transaction failed 29201/-1, size 192-0 line 2746

After setenforce 0, it can work normally

WSA：2206.40000.15.0_x64 Kernel: Linux version 5.10.110-windows-subsystem-for-android-20220617 (Ubuntu clang version 10.0.1-++20211003084855+ef32c611aa21-1~exp1~20211003085243.2, LLD 10.0.1)