Ok, so one of our developers has pulled the framework files and reverse engineered the package manager code.
Here is the code blocking the install
try {
boolean equals = "userdebug".equals(SystemProperties.get("ro.build.type", ""));
if (!this.mIsEndurance && (!this.mGflip6Gc || !equals)) {
int i8 = Settings.System.getInt(this.mContext.getContentResolver(), INSTALL_ENABLE, 1);
this.mIntallSecretCode = i8;
if (!this.mIsAllowInstall) {
this.mIsAllowInstall = i8 == 0;
}
Log.i(TAG, "mIsAllowInstall= " + this.mIsAllowInstall + ",APK_INSTALL_FINISH" + this.APK_INSTALL_FINISH);
if (this.APK_INSTALL_FINISH) {
if (this.mIsMPBranch) {
packageInstalledInfo.setError(-22, "App forbidden installation " + parsePackage.getPackageName());
throw new PrepareFailure(-116, "App forbidden installation " + parsePackage.getPackageName());
} else if (!this.mIsAllowInstall) {
packageInstalledInfo.setError(-22, "App forbidden installation " + parsePackage.getPackageName());
throw new PrepareFailure(-116, "App forbidden installation " + parsePackage.getPackageName());
}
}
}