diff --git a/core/src/main/cpp/main/src/service.cpp b/core/src/main/cpp/main/src/service.cpp
index 00148f13..d4c57355 100644
--- a/core/src/main/cpp/main/src/service.cpp
+++ b/core/src/main/cpp/main/src/service.cpp
@@ -22,6 +22,7 @@
 //
 
 #include <dobby.h>
+#include <thread>
 #include "base/object.h"
 #include "service.h"
 #include "context.h"
@@ -199,10 +200,22 @@ namespace lspd {
             return {env, nullptr};
         }
         auto bridgeServiceName = env->NewStringUTF(SYSTEM_SERVER_BRIDGE_SERVICE_NAME.data());
-        auto binder = JNI_CallStaticObjectMethod(env, service_manager_class_,
-                                                 get_service_method_, bridgeServiceName);
+        ScopedLocalRef<jobject> binder{env, nullptr};
+        for (int i = 0; i < 3; ++i) {
+            binder = JNI_CallStaticObjectMethod(env, service_manager_class_,
+                                                get_service_method_, bridgeServiceName);
+            if (binder) {
+                LOGD("Got binder for system server");
+                break;
+            } else {
+                LOGI("Fail to get binder for system server, try again in 1s");
+                using namespace std::chrono_literals;
+                std::this_thread::sleep_for(1s);
+            }
+
+        }
         if (!binder) {
-            LOGD("Fail to get binder for system server");
+            LOGW("Fail to get binder for system server");
             return {env, nullptr};
         }
         auto method = JNI_GetStaticMethodID(env, bridge_service_class_,
diff --git a/core/src/main/java/org/lsposed/lspd/service/BridgeService.java b/core/src/main/java/org/lsposed/lspd/service/BridgeService.java
index f0eb6844..ebcd24e8 100644
--- a/core/src/main/java/org/lsposed/lspd/service/BridgeService.java
+++ b/core/src/main/java/org/lsposed/lspd/service/BridgeService.java
@@ -265,7 +265,7 @@ public class BridgeService {
                 try {
                     String processName = data.readString();
                     IBinder heartBeat = data.readStrongBinder();
-                    var applicationService = service.requestApplicationService(Binder.getCallingUid(), Binder.getCallingPid(), processName, heartBeat);
+                    var applicationService = service == null ? null : service.requestApplicationService(Binder.getCallingUid(), Binder.getCallingPid(), processName, heartBeat);
                     if (applicationService != null) binder = applicationService.asBinder();
                 } catch (RemoteException e) {
                     Log.e(TAG, Log.getStackTraceString(e));