This bundle ships only patches that successfully apply against GameHub 6.0. Every patch below appears as an individually-named, individually-toggleable entry in the published .rvp bundle (revanced-cli list-patches patches.rvp to enumerate; --include / --exclude to pick).

Bypass login

Skips the login screen entirely and makes the library system function under a synthetic identity. Six bytecode rewrites cooperate (the walkthrough below uses the 6.0.2 R8 letter names for historical continuity; every version's letters — including the current 6.0.9 mappings — are recorded in the per-patch source comments and the gamehub_reports/ maps. The patch mechanics are identical across versions — only the class letters differ.):

1. xle.i(gi0) and xle.r(gi0) — the navigator methods that gate Login routing. Original logic does iget Lxle;->b:Lct0; → invoke-interface Lct0;->a()Z → if-nez :skipLogin → otherwise build a Lsa0; Login navigation intent. Patch removes the invoke-interface/move-result pair and substitutes const/4 vN, 0x1 so the branch is always taken.
2. rr0.a(...) — a separate NavigationInterceptor (getOrder()==10) added in 6.0.1 that gates on Lct0;->a()Z independently of the navigator. Same iget+invoke-interface+if-nez pattern; bypassed identically with const/4 vN, 0x1.
3. it0.h() — the real DB-backed Lct0; implementation's isLoggedIn StateFlow<Boolean?>. Body replaced to return FakeStateFlow.boolTrue() (a host-compatible Lhzh; wrapping Ltjk;(Boolean.TRUE), built via reflection in the Java extension and cached) so every collector — NavHost.collectAsState, the listener, the analytics pipeline — sees a logged-in state.
4. it0.e() — the user-account StateFlow<fpm?>. Without an auth_token row in the DB this emits null and the library-list reader's flatMapLatest collapses to an empty Flow. Patch replaces the body with FakeStateFlow.userFlow() where the underlying value is FakeUserAccount.get(), a Java extension that reflectively constructs Lfpm; via Class.forName("fpm").getDeclaredConstructor(...), with a="99999" and every other field zeroed/empty. Result: the library reader's pipeline it0.e().flatMapLatest { fpm -> dao.subjectAllByUserId(fpm.a) } always queries with user_id="99999" and returns the imported rows.
5. uu7.e() — the GameLibraryRepository's user-id getter (was hp7.f() in 6.0.1; the method was renamed between minor versions). Returns "99999" directly so it matches the synthetic user account.
6. ct0.f() — the interface default method that returns the current kpm auth token. Body replaced to call FakeAuthToken.get(), a Java extension that reflectively constructs Lkpm; with a="99999" and b="". Several lambdas use this directly to read the user-id for network-prep and lambda capture; under the bypass they all see the same synthetic identity.

End-to-end consequence: a fresh install lands on the home screen, the Import dialog opens, picking an APK + metadata + tapping Save persists a row into /data/data/<pkg>/databases/db_game_library.db (t_game_library_base, t_game_launch_method), and the row appears in the library list immediately because the read pipeline is now keyed off the matching synthetic user-id.

Disable Firebase Crashlytics

Removes the Firebase Crashlytics initialisation block. Without this, GameHub 6.0 crashes on launch with VerifyError. Root cause: the upstream 5.x patch used goto to skip the Crashlytics call site, which in 6.0 leaves a join-point where the same register holds either String (goto path) or Boolean (fall-through path) and the ART verifier rejects it. The 6.0-compatible patch removes the three Crashlytics instructions in reverse index order (setCrashlyticsCollectionEnabled, move-result-object, invoke-static getInstance) so the intermediate const/4 v2, 0x0 redefines the register with a consistent Boolean type at the join point. Anchored on Lcom/xiaoji/egggame/BaseAndroidApp;->onCreate plus full Firebase class names, so it ports across versions without source change.

Mute UI sounds

Replaces the bundled UI feedback sounds (assets/composeResources/com.xiaoji.egggame.core/files/sound/*.wav) with silent PCM. Menu navigation and button taps stop clicking. The patch substitutes the resource at packaging time — no runtime audio routing is changed, so game audio is unaffected. The patch's resource lookup is anchored on a Kotlin object {} to give the classloader a stable handle (the alternative — anchoring on the patch class itself — fails when ReVanced's class loader can't see the patches module's resources from inside the runner JVM).

PC-accurate vibration ⭐ new in v1.1.0-604 · reworked preload-free in v1.3.0-604

Four bytecode hooks (GamepadServerManager.onRumble entry + per-controller dispatch + stop + Wine env-builder pre-launch trigger) route XInput rumble from Wine games into Android's VibratorManager with dual-motor independent dispatch on multi-motor pads, intensity blending on single-motor pads, sustained-hold keepalive, and instant release on let-go. The BhVibrationController Java extension owns the state machine (per-slot motor amplitudes, keepalive worker thread, mode dispatch: off/device/controller/both, per-game intensity scaling) and the preload-free winebus disk patcher (see below). Adapted from TideGear/GameHub-Vibration-Fix (GameNative PR #1214 lineage) with the author's permission; class-letter map derived for 6.0.4.

Preload-free sustained holds (replaces the former libevshim.so shim). Earlier builds shipped an arm64-v8a libevshim.so and LD_PRELOAD'd it into Wine via Hook 4. Mapping any extra .so into the Wine subprocess destabilises box64 under new-WoW64 and silently kills a class of x86_64/32-bit game launches (DiRT 3 → STATUS_INVALID_IMAGE_FORMAT c000007b; Shotgun King → ~700 ms exit). That shim, its LD_PRELOAD inject, the native/evshim/ C sources and the CI NDK build step are all removed. Instead, Hook 4 calls BhVibrationController.ensureWinebusDurationPatchOnce(ctx) once per app process — right before the env builder hands off to the Wine launcher — which scans the app files tree and rewrites every winebus.so's two non-zero SDL_JoystickRumble duration loads to 0xffffffff on disk (aarch64 ldur w3,[x29,#-0x14]→mov w3,#-1; x86_64 11-byte clang window → or ecx,-1), so SDL2's ~1 s rumble_expiration never fires. An AtomicBoolean gates repeat scans; an x86_64 pattern miss dumps <externalFilesDir>/winebus_dump_x86_64.so for re-derivation. No native shim, no LD_PRELOAD, nothing extra mapped into Wine.

Vibration settings activity ⭐ new in v1.1.0-604 · strict per-game store in v1.3.0-604

Registers com.xj.winemu.vibration.BhVibrationSettingsActivity in the patched manifest (exported="false", translucent theme). The activity hosts a programmatic dialog (mode picker: off / device / controller / both + intensity slider 0–100%) with explicit Save and Cancel buttons — a single atomic commit on Save, full discard on Cancel; no live-write on every spinner/slider change. Internal-only — no <intent-filter> — launched only by the menu-row patch below via explicit Intent.

Strict per-game storage (v1.3.0-604). The dialog (and the GPU Spoof / Legacy-renderer dialogs, which share this model) persists only to BannerHub's own bh_vibration_prefs SharedPreferences, keyed strictly per game (<base>__<gameId>). It never writes GameHub's own pc_g_setting<gameId> file (the host rewrites that, which silently reset our keys → "reverts to default on reopen") and keeps no global mirror and no global fallback (a per-game choice used to leak app-wide and into other games). A game with no saved setting yields the stock default, never another game's value; a one-time read-only migration adopts any legacy pc_g_setting/old-global value on first read. The gameId is resolved across the main↔:wine process boundary via the shared BhMenuGameId disk-bridge — WineActivity runs in android:process=":wine", so a Java static set in the UI process is invisible at launch; the captured id is mirrored to SharedPreferences (bh_menu_gameid) with a synchronous commit and read back launch-side. This same :wine boundary bit all three per-game features (GPU Spoof, Legacy renderer, vibration); each launch/clinit-time resolver now uses BhMenuGameId.getCaptured() first, never stack-sniff-only.

PC Vibration Settings menu row ⭐ new in v1.1.0-604

Injects a 5th row labelled PC Vibration Settings into both per-game popup menus in GameHub 6.0.4:

• Game-details "More Menu" — patched in Lx57.a() at the tail of the row-list builder. Each row is an Iae(icon, label, onClick) with Lpw6; (Function1) onClick.
• Library-tile 3-dot popup — patched in Lpzc.j0() by hooking the list's return. Each row is a Lz4e(Lell label, Lnw6 onClick, int) — different row class, different click-handler interface (Lnw6; = Function0), and the label is a Compose Multiplatform resource descriptor (Lell) not a raw String.

Both injections route through a single Java helper (BhMenuRowClick) that walks ActivityThread.mActivities to find the current top Activity and fires startActivity(BhVibrationSettingsActivity, gameId) — gameId captured via the shared BhMenuGameId helper (mirrored to disk for the :wine boundary, see Vibration settings activity above) so the dialog and the launch-time controller scope to the same game. Three architectural curiosities solved along the way:

• R8 renamed kotlin.jvm.functions.Function0/Function1 to Lnw6; / Lpw6; everywhere in the host APK. The extension's own implements Function1 is a different JVM class at runtime — fails pw6Cls.isInstance(). Fix: wrap each click handler in a java.lang.reflect.Proxy that actually implements the renamed interface.
• Lell is a Kotlin empty subclass of abstract Ltdi(String key, Set<String> locales) and declares zero constructors of its own. getDeclaredConstructor(...) returns nothing. Fix: sun.misc.Unsafe.allocateInstance skips ctor invocation; then reflect-set the inherited Ltdi.a (key) and Ltdi.b (locale set) fields.
• Lxd3.l1 resolver throws on unknown Compose resource keys — and the runtime requires a manifest registration the bare .cvr append doesn't provide. Fix: a third bytecode injection at the head of Lxd3.l1 short-circuits our sentinel key bh_pc_vibration_label and returns the literal string "PC Vibration Settings" before the stock resource lookup runs.

The 10-iteration debugging trail behind landing this patch is recorded in project_bannerhub_revanced_menu_injection_playbook.md (auto-memory) and PROGRESS_LOG.md. Future menu-row additions should start there.

PC Vibration Settings label resource ⭐ new in v1.1.0-604

Appends a bh_pc_vibration_label = "PC Vibration Settings" entry to features.home's Compose Multiplatform resource bundle (.cvr file). Documentation patch — the runtime resolution actually goes through the Lxd3.l1 short-circuit described above because Compose's resource manifest needs entries the bare .cvr doesn't register. Kept anyway so the resource is reachable by any future patch that goes through the proper manifest registration path.

GPU Spoof 🔒 6.0.4-only — not in the 607/608/609 build

Pinned to 6.0.4. GameHub 6.0.7, 6.0.8, and 6.0.9 ship a native GPU spoof of their own, so this patch is redundant there and is gated out (compatibleWith("6.0.4")) — the tile does not appear on the 607/608/609 Banner Tools grid. The description below applies to the -604 line.

Adds a GPU Spoof row to both per-game popup menus. The dialog offers Off (default), a preset GPU picker (a legacy NVIDIA/AMD/Intel list plus a modern RTX/RX/Arc set), or Custom (free vendor / device hex + name). GpuSpoofPatch ("GPU spoof DXVK plumbing") force-writes the chosen customVendorId/customDeviceId into a per-game dxvk.conf and points DXVK_CONFIG_FILE at it, injected after the Wine env builder's conditional DXVK block so the spoof always applies. No-ops entirely when the game's mode is Off. Fixes titles that hard-refuse an "unsupported video card" (CryEngine — Crysis 2). The BhGpuSpoofController owns mode state (Off / preset / custom); storage is the shared strict per-game store (see Strict per-game settings store below). Free-text adapter names go only to the dxvk.conf file, never the whitespace-splitting inline DXVK_CONFIG, so "NVIDIA GeForce RTX 4080" isn't truncated to "NVIDIA".

Legacy renderer (GLES2) toggle 🔒 6.0.4-only — not in the 607/608/609 build

Pinned to 6.0.4. The rewritten Vulkan X-server in 6.0.7/6.0.8/6.0.9 is incompatible with the old GLES2 libxserver.so / libwinemu.so pair — forcing the legacy path on 607/608/609 is a device-confirmed SIGABRT. The patch is gated out (compatibleWith("6.0.4")) and the Renderer tile does not appear on the 607/608/609 Banner Tools grid. The description below applies to the -604 line.

GameHub 6.0.4 rewrote its X-server renderer from GLES2 to Vulkan (libxserver.so). Some games regressed. A Renderer menu row + dialog adds a per-game choice: New (default — stock 6.0.4 Vulkan, zero patch effect) or Legacy (the proven 6.0.2 GLES2-era libxserver.so + libwinemu.so pair). RendererLibBundlePatch bundles the 6.0.2 libs under a non-clobbering name; RendererSwapPatch adds a setRenderingEnabled native and routes XServer's loadLibrary + setFlipEnabled call sites through BhRendererController so the swap is gated strictly per game — an unset game is pure stock, zero regression.

Strict per-game settings store ⭐ new in v1.4.0-604

GPU Spoof, the Legacy renderer toggle, and PC Vibration all share one per-game persistence model. Each setting is stored only in BannerHub's own bh_<feature>_prefs, keyed strictly per game (<base>__<gameId>). It never writes GameHub's own pc_g_setting<gameId> (the host rewrites that, silently resetting our keys) and keeps no global mirror and no global fallback (a per-game choice used to leak app-wide / into other games). An unset game yields the stock default — never another game's value; a one-time read-only migration adopts any legacy value on first read. Each settings dialog has explicit Save (single atomic commit) and Cancel (discard) buttons — no live-write on every spinner/slider change.

WineActivity runs in android:process=":wine", so a Java static set in the UI process is invisible to launch-time code. The shared BhMenuGameId helper mirrors the captured game id to SharedPreferences with a synchronous commit and reads it back launch-side, so every per-game feature resolves the right game across the process boundary.

Show PC Game Settings row ⭐ new in v1.2.0-604

Forces the PC Game Settings row to appear in the Explorer game-detail More Menu for every game type, including Steam-linked games where XiaoJi-native logic would normally hide it. The patch removes the single if-eqz gate immediately preceding the row's construction in Lx57;->a; every other row keeps its native gating untouched.

Show Game ID menu row ⭐ new in v1.5.0-604

Adds a Show Game ID row to both per-game popup menus and a third entry in the library-list popup (the 3-dot menu on each tile). Tapping it opens a small dialog that shows the active game's Local Game ID — the integer server_game_id GameHub assigns each row — with Close, Copy (when scoped to a specific game), and View All Games buttons.

The View All Games flow opens the GameHub library database (db_game_library.db Room, t_game_library_base table) read-only and renders the full library in a scrollable list — <game name> then ID: <server_game_id> (plus inline · Steam: <appid> / · Epic: <UUID> tags when those columns are populated), case-insensitive alphabetical. Tap any row → that game's id is copied to the clipboard with a toast. Pairs naturally with the External launcher (Beacon / ES-DE / Daijishou) support — users no longer need to grep logcat to find the id required by per-game external-launcher entries.

Structural sibling of PC Vibration Settings menu row / GPU Spoof / Renderer: three injection sites (Lx57;->a More Menu, Lted;->f library-tile popup, Lpzc;->j0 library-list popup), each hands row construction to a Java helper (BhGameIdDisplayMenuRowClick) via a single invoke-static. Reuses the single shared Lxd3;->l1 resolver hook the vibration patch already injects — one else if line is added to BhMenuRowClick.maybeResolveCustomLabel mapping "string:bh_gameid_label" → "Show Game ID". No new resolver head-block (a 2nd one ANRs MainActivity cold-start — established in earlier menu-row work).

DB access is safe alongside the host's live Room writer: SQLiteDatabase.OPEN_READONLY | NO_LOCALIZED_COLLATORS against getApplicationContext().getDatabasePath("db_game_library.db"), with full fail-safe behaviour — absent file / missing table / any SQLiteException toasts a friendly message rather than crashing the menu flow. Resolves correctly across every variant pkg (banner.hub, com.antutu.benchmark.full, gamehub.lite, etc.) since getDatabasePath keys off the running app's data dir.

Show Game ID label resource ⭐ new in v1.5.0-604

Companion to the menu-row patch — appends bh_gameid_label = "Show Game ID" to features.home's Compose Multiplatform .cvr resource bundle across the 6 locale variants. Mirrors PC Vibration Settings label resource exactly: kept so the resource is reachable through any future manifest-aware resolver, even though runtime lookup currently goes through the shared Lxd3;->l1 short-circuit.

Change app icon ⭐ new in v1.1.0-604

Replaces five in-APK drawables with BannerHub v6 branding:

• Launcher adaptive-icon foreground (res/drawable-xxxhdpi/ic_launcher_foreground.png) — 432×432 raster with BannerHub logo content in the inner 288×288 safe zone. The stock GameHub vector at res/drawable/ic_launcher_foreground.xml is deleted so the new raster wins on every device density (Android downsamples from xxxhdpi for lower buckets — imperceptible at icon sizes; without the delete, lower-density devices would silently fall back to the stock vector).
• In-app wine_logo (res/drawable-xxhdpi/wine_logo.png) — 240×72 rebrand, dimensions matching stock so any wrap_content ImageView measuring against the resource keeps its 80×24 dp intrinsic size.
• Auth-screen landscape logo (assets/composeResources/com.xiaoji.egggame.features.auth/drawable/features_auth_ic_logo_landscape.png) — 96×96 square (the "landscape" in the name refers to auth-screen orientation, not image aspect).
• Auth-screen overseas logo (.../features_auth_ic_logo_overseas.png) — 366×72 wide rectangle.
• Splash-screen banner (assets/composeResources/com.xiaoji.egggame.features.splash/drawable/splash_logo.png) — 996×200 with 2 px transparent top/bottom pad for aspect preservation; RGBA so a future splash-background change can bleed through cleanly.

Background drawable (res/drawable/ic_launcher_background.xml) and CN-locale variants are left untouched — most launchers mask the adaptive icon's foreground so the background only shows at the masked edge, and the CN drawables aren't displayed on overseas builds.

GOG integration ⭐ new in v1.6.0-604

A self-contained GOG client ported into the extension: WebView OAuth login, owned-library listing (embed.gog.com), multi-CDN download + install into the app data dir, and a programmatic bridge that writes the installed game into GameHub's library DB (t_game_library_base + t_game_launch_method, LaunchType.GogGameByPcEmulator) so it launches through the normal Wine pipeline like any PC game. Reached from the GOG Banner Tools tile and the Explore tab's GOG card — both open GogMainActivity. The library row is written on a foreign DB connection (GameHub uses Room's bundled SQLite driver), so a freshly added game appears after a GameHub restart; the add itself is verified on-device.

Explore tab hijack + Explore screen activity + Explore drawables ⭐ new in v1.6.0-604

Hijacks the unused bottom-nav Explore tab. A one-instruction guard at the head of the bottom-nav controller's tab-select dispatch (w1a.q(Lyw9;)V) detects the Explore tab (enum ordinal 0) and opens our own BannerExploreActivity instead of XiaoJi's server-driven discovery feed — falling through to the stock screen on any error (fail-safe), and covering both handheld and explore layout modes from the single shared controller. The screen is classic Android views (no Compose), immersive-fullscreen, populated from a bundled JSON manifest so it works fully offline, with a GOG card whose logo is copied into res/drawable by the companion Explore drawables resource patch. Cards route to BannerHub's own destinations, never the server feed.

Recording-compatible audio ⭐ new in v1.6.0-604

Global Banner Tools → Audio toggle that appends pm=0 to PulseAudio's module-aaudio-sink, routing audio through the system mixer instead of the AAudio MMAP fast-path so MediaProjection screen recorders capture in-game sound (otherwise recordings are silent). Off by default; in-game audio path is otherwise untouched.

Redirect catalog API

Patches the xrj environment enum's Online value so the catalog API's cnHost and overseaHost both point at the BannerHub Cloudflare Worker (bannerhub-api.the412banner.workers.dev) instead of landscape-api-{cn,oversea}.vgabc.com. The Worker:

• Serves a curated component catalog from the412banner.github.io/bannerhub-api/ for simulator/v2/* and other allowlisted paths (drivers, DXVK, VKD3D, FEX, Box64, Wine prefix, firmware metadata).
• Reshapes responses for 6.0's kotlinx-strict deserializer (wraps getAllComponentList data in EnvListData {list, page, page_size, total} instead of a bare array — without this the cast silently fails and the in-memory COMPONENT registry stays empty, breaking game launch at "Download Game Config").
• Token-injects + signature-regens forwards for any unallowlisted path back to landscape-api.vgabc.com so anything not curated still works against the original upstream.
• Branches 6.0-only response variants behind a /v6/ path prefix (see next patch); 5.x clients hitting the same Worker without the prefix get the upstream-shaped pass-through.

The Beta + Test enum values, the analytics hosts (landscape-api-*-*.vgabc.com/events), clientgsw.vgabc.com, and the bigeyes CDN are all intentionally untouched — only the curated-catalog hosts are swapped.

Side benefit (PC game settings orientation): the per-game PC game settings screen now renders correctly in both landscape and portrait orientation. Upstream's catalog response carried a constraint that the host honored by locking that screen to landscape only — the BannerHub Worker's payload doesn't include that constraint, so the picker is usable from a portrait-held phone for the first time. This is a behavioral byproduct of the catalog redirect, not a separate patch.

Prefix API path with /v6

Hooks vob.b(m7a builder, String path) — the single static Ktor URL-builder helper through which every relative GameHub API request flows — and prepends v6/ via the small V6PathPrefix.prefix() Java extension. The Worker strips the prefix and uses it as a feature gate so the same backend can serve 6.0 and 5.x clients side-by-side without divergent state:

• /v6/simulator/v2/getAllComponentList → EnvListData-wrapped response, reshaped for 6.0 (is_ui / gpu_range stripped, fileType / framework / framework_type / is_steam / status / blurb / upgrade_msg / sub_data / base injected, base.fileType=0).
• /simulator/v2/getAllComponentList (no prefix, from a 5.x client) → native upstream catalog passed through with is_ui / gpu_range preserved.
• /v6/simulator/v2/getImagefsDetail → firmware 1.3.5. Without prefix → firmware 1.3.3.

Full URLs (paths already starting with http:// or https://) are short-circuited by the helper and pass through untouched, so direct downloads from the catalog's download_url fields still resolve to the Worker-authored GitHub-release URLs without the prefix being injected into them.

Offline component picker — local list

Status: Working — device-confirmed on 6.0.4. Offline, every per-game picker (GPU driver, DXVK, VKD3D, FEXCore/Box64 translators, and the Wine/Proton container) lists the components the user has already downloaded, in the same order as online. Online behaviour is byte-identical. Fully fail-safe: any error falls back to the original code path, so the worst case is the pre-patch behaviour, never a crash. Supersedes the earlier Offline component cache fallback (an mci.a hook that was forensically proven inert on 6.0.4 — wrong subsystem entirely; removed).

The 6.0.4 pickers are fed by gof.a(ComponentType, …) (per-type components) and gof.c(Continuation) (containers) — the repository methods behind simulator/v2/getComponentList / getContainerList. Both run even offline; the network fetch simply fails and the picker shows only the server-recommended/built-in set. The user's downloaded components are on disk and catalogued in sp_winemu_unified_resources.xml, but nothing reads that for the picker offline.

This patch replaces gof.a's body with a delegate to OfflineComponentList.dispatch(...) and prepends a register-safe conditional short-circuit to gof.c:

1. Online (or any failure): reflectively invokes the original suspend impl (gof.b for components; the unmodified gof.c body for containers) and returns its value verbatim — coroutine suspension passes straight through, so online is unchanged.
2. Offline: synthesises the picker's exact return type — n55(List<EnvLayerEntity>), the uniform repo result zxf.a/zxf.c unwrap — from the on-device sp_winemu_unified_resources.xml catalog. COMPONENT: entries are filtered by ComponentType.type; CONTAINER: entries feed the Wine/Proton picker. Each EnvLayerEntity is built via Unsafe.allocateInstance + reflective field-set (the catalog's entry JSON keys are 1:1 with the Kotlin field names).
3. Ordering: entries are stable-sorted by OfflineComponentOrder — a generated map of the canonical catalog order (from the Worker's static simulator/v2/getComponentList) — so DXVK / GPU-driver (and the rest) appear in the identical order to online (oldest→newest, newest at the bottom, curated -async/-arm64ec interleaving preserved). Regenerate OfflineComponentOrder when the catalog changes (parse data.list names in array order).

Every step is guarded; on any failure the methods fall through to the original network path, so a missing/[malformed] catalog silently degrades to stock behaviour. A throwaway bh_offline_list.log breadcrumb (app-private files dir) records getList/getContainers built=N for support and can be stripped for a clean ship.

Debug logging

A diagnostic patch that:

• Sets android:debuggable="true" in the <application> manifest so Log.d / Log.v lines from the patched APK reach logcat.
• Inserts Log.i("GH600-DEBUG", ...) markers along the import code path: Save ENTRY/CATCH (now keyed on uu7.v — was xm7.u in 6.0.0/6.0.1), transaction body ENTRY (vs7.invokeSuspend — was el7.invokeSuspend), both Room DAO insert PRE markers (GameLaunchMethodDao.insert, GameLibraryBaseDao.insert), and per-call markers in FakeAuthToken.get(), FakeUserAccount.get(), and FakeStateFlow.{boolTrue,userFlow}().
• Hooks the global i86.e() Throwable swallower (was odb.e() in 6.0.0/6.0.1) to surface every exception that the app's Kotlin coroutine state machines would otherwise eat silently.

Kept in this release for ongoing device-side triage; safe to drop in a future release if you want a leaner build.

File manager access

Adds an exposed MTDataFiles content provider (Java extension class shipped in the patches .rve) so external file managers like MT Manager can browse GameHub's per-app data directory without needing root. The provider's android:authorities and the wake-up activity's android:taskAffinity are derived from packageNameOption.value so each variant gets its own values — required to avoid INSTALL_FAILED_CONFLICTING_PROVIDER when two variants are installed side-by-side.

Rewrite custom permissions per variant

Iterates the manifest's <permission> and <uses-permission> elements and rewrites any name starting com.xiaoji.egggame.permission. so the prefix matches the variant's package. The notable case is the Mob Push SDK's C2D_MESSAGE permission, which upstream declares directly. Without this rewrite, two installed variants both declaring com.xiaoji.egggame.permission.C2D_MESSAGE violate Android 7+'s rule against multiple packages declaring the same custom permission, and the second-installed variant gets rejected with INSTALL_FAILED_DUPLICATE_PERMISSION (UI surfaces this as the unhelpful "package conflicts with a current package" dialog). Reads packageNameOption.value directly rather than relying on patcher ordering against Change package name.

Change package name (per variant)

Rewrites the APK's <manifest package=…> and <application> references to the variant's value listed in the table above, plus rewrites compatibility receiver permissions and exported provider authorities so they don't collide with the upstream package. Driven by the packageName option, set per matrix entry in release.yml. The workflow also passes updatePermissions=true and updateProviders=true so the upstream-baked DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION and the 10 inherited provider authorities are renamed to the variant package as well.

Change app name (per variant)

Rewrites <application android:label=…> to the variant's value listed in the table above. Driven by the appName option, set per matrix entry.

Disabled-by-default options

A handful of generic patches from upstream patches/all/misc/ are included but use = false (must be opted in via revanced-cli -e <name>):

• Custom network security, Enable Android debugging, Override certificate pinning, plus the Change app name / Change package name patches we explicitly enable per variant.

Available for ad-hoc CLI use; have no effect on the released APKs unless explicitly enabled.