Hook fails due to mismatched type

[salvogiangri]

I'm trying to hook a method inside services.jar (generateKeyPair(AttestParameterSpec)), my goal is to modify a field in the instance passed when calling the method. This is the hook code I ended up with:

"com.samsung.android.security.keystore.AttestationUtils".toClass().resolve()
    .firstMethod {
        name = "generateKeyPair"
        parameterCount = 1
        returnType = KeyPair::class
    }.hook {
        before {
            "com.samsung.android.security.keystore.AttestParameterSpec".toClass().resolve()
                .firstField {
                    name = "mVerifiableIntegrity"
                    type = Boolean::class
                }.of(args(0)).set(true)
            }
    }

The reason behind this hook is to maintain compatibility between different Android versions due to R8:

One UI 7.0	One UI 8.5
The mVerifiableIntegrity field is part of the class constructor.	The constructor is inlined inside the method where it gets called.

However, the hook fails to apply due to this error:

[ 2026-06-24T05:40:06.199     1000:  2777:  6528 I/VectorLegacyBridge ] [KnoxPatch][E][android] Try to hook [public final java.security.KeyPair com.samsung.android.security.keystore.AttestationUtils.generateKeyPair(com.samsung.android.security.keystore.AttestParameterSpec)] got an exception
[ 2026-06-24T05:40:06.199     1000:  2777:  6528 E/VectorLegacyBridge ] java.lang.IllegalArgumentException: Expected receiver of type com.samsung.android.security.keystore.AttestParameterSpec, but got com.highcapable.yukihookapi.hook.param.HookParam$ArgsModifyer
	at java.lang.reflect.Field.set(Native Method)
	at com.highcapable.kavaref.resolver.FieldResolver.set(FieldResolver.kt:90)
	at io.mesalabs.knoxpatch.hooks.SystemHooks.applySAKHooks$lambda$3$lambda$2(SystemHooks.kt:75)
	at io.mesalabs.knoxpatch.hooks.SystemHooks$$ExternalSyntheticLambda0.invoke(D8$$SyntheticClass:0)
	at com.highcapable.yukihookapi.hook.core.YukiMemberHookCreator$MemberHookCreator$hook$beforeAfterHook$1.beforeHookedMember$yukihookapi_core_release(YukiMemberHookCreator.kt:510)
	at com.highcapable.yukihookapi.hook.core.api.factory.YukiHookDelegateFactoryKt.callBeforeHookedMember(YukiHookDelegateFactory.kt:91)
	at com.highcapable.yukihookapi.hook.core.api.compat.HookCompatHelper$compat$9.beforeHookedMethod(HookCompatHelper.kt:81)
	at de.robv.android.xposed.XposedBridge$LegacyApiSupport.handleBefore(XposedBridge.java:384)
	at org.matrix.vector.legacy.LegacyDelegateImpl.processLegacyHook(LegacyDelegateImpl.java:70)
	at org.matrix.vector.impl.hooks.VectorNativeHooker.callback$lambda$0(VectorNativeHooker.kt:89)
	at org.matrix.vector.impl.hooks.VectorNativeHooker.$r8$lambda$Gv0h3YyBQ5fX_R8flOBlfNtiIu0(Unknown Source:0)
	at org.matrix.vector.impl.hooks.VectorNativeHooker$$ExternalSyntheticLambda1.invoke(D8$$SyntheticClass:0)
	at org.matrix.vector.impl.hooks.VectorChain.internalProceed(VectorChain.kt:59)
	at org.matrix.vector.impl.hooks.VectorChain.proceed(VectorChain.kt:45)
	at org.matrix.vector.impl.hooks.VectorNativeHooker.callback(VectorNativeHooker.kt:99)
	at Vector_.generateKeyPair(Unknown Source:11)
	at com.android.server.knox.dar.DarManagerService.isKnoxKeyInstallable(qb/99307496 096dbdff87cbfd3b358bae5582c7320310f693c6f41fef9f4210f949041151d0:91)
	at com.android.server.pm.UserManagerService.createUserInternalUncheckedNoTracing(qb/99307496 096dbdff87cbfd3b358bae5582c7320310f693c6f41fef9f4210f949041151d0:990)
	at com.android.server.pm.UserManagerService.createUserInternalUnchecked(qb/99307496 096dbdff87cbfd3b358bae5582c7320310f693c6f41fef9f4210f949041151d0:93)
	at com.android.server.pm.UserManagerService.createUserInternal(qb/99307496 096dbdff87cbfd3b358bae5582c7320310f693c6f41fef9f4210f949041151d0:108)
	at com.android.server.pm.UserManagerService.createProfileForUserWithThrow(qb/99307496 096dbdff87cbfd3b358bae5582c7320310f693c6f41fef9f4210f949041151d0:4)
	at android.os.IUserManager$Stub.onTransact(IUserManager.java:959)
	at android.os.Binder.execTransactInternal(Binder.java:1536)
	at android.os.Binder.execTransact(Binder.java:1480)

Is my code faulty or is there something else going on?

---

Logs (provided in salvogiangri/KnoxPatch#150 (comment)): Vector.LSPosed_2026-06-24T05_40_16.039658.zip
services.jar from One UI 7.0: services-7.0.zip
services.jar from One UI 8.5: services-8.5.zip

[fankes]

See https://highcapable.github.io/YukiHookAPI/en/api/public/com/highcapable/yukihookapi/hook/param/HookParam#argsmodifyer-class

You need to use args(0).cast<Some>(), or you don't care about it's type, just use args(0).any().

[salvogiangri]

Thanks for pointing this out, sorry for the inconvenience😅