Does not work with apps that block screenshots about scrcpy

[rom1v]

I don't know.

FWIW, I think that the users should always be able to take screenshots or videos of ther screen (it's their own device). It's ok that app developers provide a hint that some screen should not be captured by default, but device users should always have the possibility to easily bypass this setting. (I know that this is not the current trend from Google or others.)

[CoolSpot]

Any updates on this issue? Is there any possibility to bypass it?

You can bypass it by decompiling the APK, disabling FLAG_SECURE for the main view, and recompiling the APK back.
It is very easy to do using "APKLab" extension for Visual Studio Code.

1. Open APK using APKLab, it decompiles it into a folder structure with smali files
2. in the resulting folder structure search for RegExp android/view/Window;->(set|add)Flag
3. Ignore all occurrences in androidx/* or any third-party namespaces
4. find (usually only one per app) occurrence that is preceded by setting register to 0x2000 like this:

    .line 143
    invoke-virtual {p0}, Landroid/app/Activity;->getWindow()Landroid/view/Window;

    move-result-object v0

    const/16 v1, 0x2000

    # invoke-virtual {v0, v1, v1}, Landroid/view/Window;->setFlags(II)V

5. comment out whole line calling addFlag/setFlags (as shown above)
6. rebuild&sign APK back by right clicking on the "apktool.yml" file and clicking "APKLab: Rebuild the APK"
7. install the APK on your device
8. enjoy

This approach has been tested on both RSA Authenticator and MS Athenticator apps running on Android 12.

[rom1v]

Since I added an entry in the FAQ, I'm closing.

[npes87184]

Now you can (on dev branch): 1fdde49

After Testing SafeInCloud and Enpass, I can confirm that it works.

[inxomnyaa]

Very great, thanks for fixing! I now can finally see the password field for paypal on my phone with broken screen ❤️

[rom1v]

Now you can (on dev branch): 1fdde49

[KaKi87]

In order to make a banking app work on a rooted device, you just have to add it to Magisk's DenyList.

[KaKi87]

Hello,

Rooted users can bypass FLAG_SECURE using this LSPosed plugin.

Just tested it successfully.

Thanks

[RiggiG]

Root users may also use this fork which simply runs the scrcpy-server as the system user: #3049 (comment)

[rom1v]

You can disable it in Silence settings → Privacy → Screen security.

Strangely enough, LineageOS's built-in screen recording app captures these applications without problems.

They probably modified the feature in the ROM, because on AOSP, even screenrecord do not display the screen content.

[abele17]

I really enjoy using scrcpy. I think that it's a great product. Unfortunately I am having the black screen issue mentioned above on some specific apps. I am new to coding so I apologize. I was wondering if someone could explain more in details how you fixed the issue so that I can do it myself.
Thanks for the help!

[rom1v]

The apps which remain black could not be mirrored with scrcpy (some drm prevent it to be captured).

[abele17]

Thank you. Great app.

[arekolek]

@rom1v Do you know if an app is able to detect the case when an app such as scrcpy is pretending to be a secure display even though it's not?

The problem I have is that scrcpy allows taking screenshots and screen recordings, even though it pretends to be a secure screen, which creates a security vulnerability.

Furthermore, even if scrcpy filtered out protected content from screenshots and recordings, it would be possible to record the whole screen on the computer, unless scrcpy would filter that too.

But even then, anybody could build scrcpy from source as it is currently and use it to take screenshots of content that was supposed to be protected. So do you know if it's possible to detect "fake" secure displays?

(I know that it's always possible to take a photo of the phone with an ordinary camera, but I don't need to worry about that, I just need to prevent taking screenshots)

[Rajssss]

I am having the same issue again with some banking app, which prevents taking screenshots too. I am using android 12. Tried the latest dev branch.

[kwanice]

any update onhow to bypass that? some Bank app are black..even on v 1.23
thanks for help

[rom1v]

It's not possible on Android >= 12. See #2129

[hmcomer]

Any updates on this issue? Is there any possibility to bypass it?

[rom1v]

Not since Android 12 #2129.

[Ddfulton]

Addendum to @CoolSpot's comment for Duo Mobile

From grepping android/view/Window;->(set|add)Flag I got five hits. None of them were prefixed with 0x2000. They were prefixed with other register addresses.

I just commented out all of them and it worked like a charm.

[ZwieslerLehrer]

Root users may also use this fork which simply runs the scrcpy-server as the system user: #3049 (comment)

Is there a non root version for some apps which do not run on rooted devices such as banking apps. Editing the banking app apk to remove the secure flag as suggested above does not seem advisable.