[Android 8.1] LSPosed detected by banking apps

[Ephemera42]

Steps to reproduce/复现步骤

1. Install LSPosed and reboot.
2. Open banking apps such as ICBC.
3. The apps crash immediately on launch.
4. Delete the system prop dalvik.vm.dex2oat-flags=--inline-max-code-units=0 manually.
5. The banking apps run normally.

Expected behaviour/预期行为

Banking apps should launch and run normally.

Actual behaviour/实际行为

LSPosed adds the system prop dalvik.vm.dex2oat-flags=--inline-max-code-units=0. Banking apps including Industrial and Commercial Bank of China (ICBC), China Construction Bank (CCB), Agricultural Bank of China (ABC), and Bank of Communications (BOCOM) detect this prop and crash immediately on startup. After manually deleting this prop, the same apps function normally without crashing.

Xposed Module List/Xposed 模块列表

Hide My Applist 3.3.1
AnyWebview 1.3
InxLocker 1.4

Root implementation/Root 方案

Magisk 30.6

System Module List/系统模块列表

bindhosts v2.1.1
Play Integrity Fix [INJECT] v4.4-inject-s
Zygisk - LSPosed v1.11.0 (7209)
Zygisk Next 1.3.2 (688-2c60cdd-release)

LSPosed version/LSPosed 版本

v1.11.0 (7209)

Android version/Android 版本

8.1

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

LSPosed_2026-02-10T23_26_28.338.zip

[JingMatrix]

What is the content of directory /apex/com.android.art/bin/ in Android 8.1 ?

[Ephemera42]

What is the content of directory /apex/com.android.art/bin/ in Android 8.1 ?

There is no /apex/ directory on Android 8.1.

trident:/ # ls -d */
acct/        config/ dev/ firmware/   mnt/     postinstall/ res/  sdcard/  system/
bt_firmware/ d/      dsp/ klogdump/   oem/     proc/        root/ storage/ vendor/
cache/       data/   etc/ lost+found/ persist/ ramdump/     sbin/ sys/

[JingMatrix]

There is no obvious way to keep dex2oat configuration on your devices without modifying system properties, and thus get detected, on Android 8.1. For Android 10+, we have used PLT hooking to avoid traces.

We configure dex2oat in this way to avoid method inlining, which implies that certain methods couldn't be hooked.

If your modules can work without this configuration of dex2oat (which is very possible), then you can safely detele the system property as you have done.

[Ephemera42]

There is no obvious way to keep dex2oat configuration on your devices without modifying system properties, and thus get detected, on Android 8.1. For Android 10+, we have used PLT hooking to avoid traces.

We configure dex2oat in this way to avoid method inlining, which implies that certain methods couldn't be hooked.

If your modules can work without this configuration of dex2oat (which is very possible), then you can safely detele the system property as you have done.

Thank you for the explanation.

Deleting the property works for me, and so far I have not observed any module malfunctions. If there's no alternative solution to avoid detection, feel free to close this issue.