When I launch b3nac.injuredandroid.ExportedProtectedIntent while holding another Intent inside in order for it to launch b3nac.injuredandroid.FlagTwelveProtectedActivity I keep getting:
java.lang.SecurityException: Permission Denial: starting Intent { cmp=b3nac.injuredandroid/.FlagTwelveProtectedActivity (has extras) } from ProcessRecord{391b647 22147:com.example.tcmintentlauncher/u0a228} (pid=22147, uid=10228) not exported from uid 10227
Intent intent = new Intent();
intent.setClassName("b3nac.injuredandroid", "b3nac.injuredandroid.FlagTwelveProtectedActivity");
intent.putExtra("totally_secure", "https://something.com");
Intent launchIntent = new Intent();
launchIntent.setClassName("b3nac.injuredandroid", "b3nac.injuredandroid.ExportedProtectedIntent");
launchIntent.putExtra("access_protected_component", intent);
startActivity(intent);
I also tried using the setComponent function instead of setClassName. Same result.
Using flag11:// produced the same result as well.
I tried this on a rooted physical device (Android 8.0) and on an emulator as root (Android 9.0).
Unless I add exported="true" to FlagTwelveProtectedActivity in AndroidManifest.xml and then repack the app, this activity will not launch...