diff --git a/daemon/src/main/java/org/lsposed/lspd/service/BridgeService.java b/daemon/src/main/java/org/lsposed/lspd/service/BridgeService.java
index c19e7cc1..6ff22c46 100644
--- a/daemon/src/main/java/org/lsposed/lspd/service/BridgeService.java
+++ b/daemon/src/main/java/org/lsposed/lspd/service/BridgeService.java
@@ -7,6 +7,8 @@ import android.os.IBinder;
 import android.os.Looper;
 import android.os.Parcel;
 import android.os.ServiceManager;
+import android.system.ErrnoException;
+import android.system.Os;
 import android.util.Log;
 
 import java.lang.reflect.Field;
@@ -69,72 +71,87 @@ public class BridgeService {
     };
 
     // For service
+    // This MUST run in main thread
     private static synchronized void sendToBridge(IBinder binder, boolean isRestart) {
-        do {
-            bridgeService = ServiceManager.getService(SERVICE_NAME);
-            if (bridgeService != null && bridgeService.pingBinder()) {
-                break;
-            }
-
-            Log.i(TAG, "service " + SERVICE_NAME + " is not started, wait 1s.");
-
-            try {
-                //noinspection BusyWait
-                Thread.sleep(1000);
-            } catch (Throwable e) {
-                Log.w(TAG, "sleep" + Log.getStackTraceString(e));
-            }
-        } while (true);
-
-        if (isRestart && listener != null) {
-            listener.onSystemServerRestarted();
-        }
-
+        assert Looper.myLooper() == Looper.getMainLooper();
         try {
-            bridgeService.linkToDeath(bridgeRecipient, 0);
-        } catch (Throwable e) {
-            Log.w(TAG, "linkToDeath " + Log.getStackTraceString(e));
-            var snapshot = bridgeService;
-            sendToBridge(binder, snapshot == null || !snapshot.isBinderAlive());
-            return;
+            Os.seteuid(0);
+        } catch (ErrnoException e) {
+            Log.e(TAG, "seteuid 0", e);
         }
+        try {
+            do {
+                bridgeService = ServiceManager.getService(SERVICE_NAME);
+                if (bridgeService != null && bridgeService.pingBinder()) {
+                    break;
+                }
+
+                Log.i(TAG, "service " + SERVICE_NAME + " is not started, wait 1s.");
+
+                try {
+                    //noinspection BusyWait
+                    Thread.sleep(1000);
+                } catch (Throwable e) {
+                    Log.w(TAG, "sleep" + Log.getStackTraceString(e));
+                }
+            } while (true);
+
+            if (isRestart && listener != null) {
+                listener.onSystemServerRestarted();
+            }
 
-        Parcel data = Parcel.obtain();
-        Parcel reply = Parcel.obtain();
-        boolean res = false;
-        // try at most three times
-        for (int i = 0; i < 3; i++) {
             try {
-                data.writeInterfaceToken(DESCRIPTOR);
-                data.writeInt(ACTION.ACTION_SEND_BINDER.ordinal());
-                Log.v(TAG, "binder " + binder.toString());
-                data.writeStrongBinder(binder);
-                if (bridgeService == null) break;
-                res = bridgeService.transact(TRANSACTION_CODE, data, reply, 0);
-                reply.readException();
+                bridgeService.linkToDeath(bridgeRecipient, 0);
             } catch (Throwable e) {
-                Log.e(TAG, "send binder " + Log.getStackTraceString(e));
+                Log.w(TAG, "linkToDeath " + Log.getStackTraceString(e));
                 var snapshot = bridgeService;
                 sendToBridge(binder, snapshot == null || !snapshot.isBinderAlive());
                 return;
-            } finally {
-                data.recycle();
-                reply.recycle();
             }
 
-            if (res) break;
+            Parcel data = Parcel.obtain();
+            Parcel reply = Parcel.obtain();
+            boolean res = false;
+            // try at most three times
+            for (int i = 0; i < 3; i++) {
+                try {
+                    data.writeInterfaceToken(DESCRIPTOR);
+                    data.writeInt(ACTION.ACTION_SEND_BINDER.ordinal());
+                    Log.v(TAG, "binder " + binder.toString());
+                    data.writeStrongBinder(binder);
+                    if (bridgeService == null) break;
+                    res = bridgeService.transact(TRANSACTION_CODE, data, reply, 0);
+                    reply.readException();
+                } catch (Throwable e) {
+                    Log.e(TAG, "send binder " + Log.getStackTraceString(e));
+                    var snapshot = bridgeService;
+                    sendToBridge(binder, snapshot == null || !snapshot.isBinderAlive());
+                    return;
+                } finally {
+                    data.recycle();
+                    reply.recycle();
+                }
 
-            Log.w(TAG, "no response from bridge, retry in 1s");
+                if (res) break;
 
+                Log.w(TAG, "no response from bridge, retry in 1s");
+
+                try {
+                    Thread.sleep(1000);
+                } catch (InterruptedException ignored) {
+                }
+            }
+
+            if (listener != null) {
+                listener.onResponseFromBridgeService(res);
+            }
+        } finally {
             try {
-                Thread.sleep(1000);
-            } catch (InterruptedException ignored) {
+                Os.seteuid(1000);
+            } catch (ErrnoException e) {
+                Log.e(TAG, "seteuid 1000", e);
             }
         }
-
-        if (listener != null) {
-            listener.onResponseFromBridgeService(res);
-        }
     }
 
     public static void send(LSPosedService service, Listener listener) {
diff --git a/daemon/src/main/java/org/lsposed/lspd/service/LSPNotificationManager.java b/daemon/src/main/java/org/lsposed/lspd/service/LSPNotificationManager.java
index 595f34e9..ab913fa1 100644
--- a/daemon/src/main/java/org/lsposed/lspd/service/LSPNotificationManager.java
+++ b/daemon/src/main/java/org/lsposed/lspd/service/LSPNotificationManager.java
@@ -54,7 +54,7 @@ public class LSPNotificationManager {
     private static final IBinder.DeathRecipient recipient = new IBinder.DeathRecipient() {
         @Override
         public void binderDied() {
-            Log.w(TAG, "nm is dead");
+            Log.w(TAG, "notificationManager is dead");
             binder.unlinkToDeath(this, 0);
             binder = null;
             notificationManager = null;
@@ -96,11 +96,16 @@ public class LSPNotificationManager {
 
     private static boolean hasNotificationChannelForSystem(
             INotificationManager nm, String channelId) throws RemoteException {
+        NotificationChannel channel;
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-            return nm.getNotificationChannelForPackage("android", 1000, channelId, null, false) != null;
+            channel = nm.getNotificationChannelForPackage("android", 1000, channelId, null, false);
         } else {
-            return nm.getNotificationChannelForPackage("android", 1000, channelId, false) != null;
+            channel = nm.getNotificationChannelForPackage("android", 1000, channelId, false);
         }
+        if(channel != null) {
+            Log.d(TAG, "hasNotificationChannelForSystem: " + channel);
+        }
+        return channel != null;
     }
 
     private static void createNotificationChannel(INotificationManager nm) throws RemoteException {
@@ -112,6 +117,7 @@ public class LSPNotificationManager {
                 NotificationManager.IMPORTANCE_HIGH);
         updated.setShowBadge(false);
         if (hasNotificationChannelForSystem(nm, UPDATED_CHANNEL_ID)) {
+            Log.d(TAG, "update notification channel: " + UPDATED_CHANNEL_ID);
             nm.updateNotificationChannelForPackage("android", 1000, updated);
         } else {
             list.add(updated);
@@ -122,6 +128,7 @@ public class LSPNotificationManager {
                 NotificationManager.IMPORTANCE_MIN);
         status.setShowBadge(false);
         if (hasNotificationChannelForSystem(nm, STATUS_CHANNEL_ID)) {
+            Log.d(TAG, "update notification channel: " + STATUS_CHANNEL_ID);
             nm.updateNotificationChannelForPackage("android", 1000, status);
         } else {
             list.add(status);
@@ -132,11 +139,13 @@ public class LSPNotificationManager {
                 NotificationManager.IMPORTANCE_HIGH);
         scope.setShowBadge(false);
         if (hasNotificationChannelForSystem(nm, SCOPE_CHANNEL_ID)) {
+            Log.d(TAG, "update notification channel: " + SCOPE_CHANNEL_ID);
             nm.updateNotificationChannelForPackage("android", 1000, scope);
         } else {
             list.add(scope);
         }
 
+        Log.d(TAG, "create notification channels for android: " + list);
         nm.createNotificationChannelsForPackage("android", 1000, new ParceledListSlice<>(list));
     }