Memory Injection: Call shared lib function inside remote process - Android Q&A, Help & Troubleshooting

Hello,
i'm currently able to call a function from a remote process by getting the PID, getting the base address in memory, copying the whole remote memory area into local memory area to find the function address by its signature and finally calling that function.
I've tested it successfully on my Samsung Galaxy S5 (32-bit + AOSP Bluetooth Stack), Sony Xperia X Compact (64-bit + AOSP Bluetooth Stack).
But on the OnePlus 7 Pro (64-bit + QTI Bluetooth Stack) the function returns 5.
I've set TRC_BTIF=5 in /system/etc/bluetooth/bt_stack.conf to see if the desired function is getting called because there should be a log output like:
Code:
06-25 21:19:33.024 1667 1667 D bt_btif : in, bd addr:, prop type:4, len:3
06-25 21:19:33.024 1667 1667 I bt_btif : btif_dm_get_adapter_property: type=0x4
Which isn't the case. So I assume the function is not getting called (correctly).
Here's the log output:
Code:
06-25 18:19:14.826 7409 7409 D bpp_qti : utils::getProcessId - Process found: com.android.bluetooth (pid: 7146)
06-25 18:19:14.828 7409 7409 D bpp_qti : injector::attach - Attached to process 7146
06-25 18:19:14.836 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9d4f0 with 6 arguments, return value is 7c786fe000
06-25 18:19:14.840 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9d4f0 with 6 arguments, return value is 7c786fd000
06-25 18:19:14.840 7409 7409 D bpp_qti : injector::write - Wrote 16 bytes to 0x7c786fd000 process 7146
06-25 18:19:14.845 7409 7409 D bpp_qti : utils::getRemoteFunctionAddress - Found remote function address: 7979928e3c
06-25 18:19:14.846 7146 7146 W bt_btif : bta_dm_act no entry for connected service cbs
06-25 18:19:14.846 7146 7146 E bt_btif : 00:00:00:00:00:00
06-25 18:19:14.847 7146 7177 D bt_btif : btif_hf_upstreams_evt: event=BTA_AG_CLOSE_EVT
06-25 18:19:14.847 7146 7177 E bt_btif : btif_hf_upstreams_evt: Invalid index 43613
06-25 18:19:14.847 7146 7146 E bt_btif : 00:00:00:00:00:00
06-25 18:19:14.847 7146 7146 D bt_btif : bta_ag_sco_event: index=0x0000, device=00:00:00:00:00:00, state=BTA_AG_SCO_SHUTDOWN_ST[0], event=BTA_AG_SCO_SHUTDOWN_E[6]
06-25 18:19:14.847 7146 7146 W bt_btif : bta_ag_sco_event: BTA_AG_SCO_SHUTDOWN_ST: Ignoring event BTA_AG_SCO_SHUTDOWN_E[6]
06-25 18:19:14.848 7146 7146 D bt_btif : BTA AG SCO State Change: [BTA_AG_SCO_SHUTDOWN_ST] -> [BTA_AG_SCO_SHUTDOWN_ST] after Event [BTA_AG_SCO_SHUTDOWN_E]
06-25 18:19:14.849 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7979928e3c with 1 arguments, return value is 5
06-25 18:19:14.853 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9cef0 with 2 arguments, return value is 0
06-25 18:19:14.856 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9cef0 with 2 arguments, return value is 0
06-25 18:19:14.857 7409 7409 D bpp_qti : injector::detach - Detached from process 7146
And here's the full code: https://github.com/TeamJCD/BluetoothPlusPlus/tree/native/app/src/main/cpp
libbluetooth_qti.so of the OnePlus 7 Pro is attached as well as the pre-compiled bpp_qti for aarch64.
I've got the signature by running: gdb -batch -ex "disassemble/r btif_storage_get_adapter_property" libbluetooth_qti.so | column -ts $'\t' | awk '{for (i=1;i<=NF;i++) if ($i~/^[a-f0-9]{2}$/) printf("\\x%s",$i)} END{print ORS}'
The executable can be pushed directly to the device (`adb push bpp_qti /data/local/tmp/`) and running `/data/local/tmp/bpp_qti get` as root should return the Bluetooth Device Class.
Maybe someone here has an idea why this isn't working on QTI bt stack devices (the ones for which this cpp code was made because Qualcomm is missing essential code to get/set the device class through Java API).
We also tried calling `btif_dm_get_adapter_property` directly to see if this is working. But it wasn't.
I'm really out of ideas now.