Bump to 0.6.2

.gitmodules

@@ -1,6 +1,6 @@
-[submodule "loader/src/external/liblsplt"]
-	path = loader/src/external/liblsplt
-	url = https://github.com/LSPosed/LSPlt
+[submodule "loader/src/external/lsplt"]
+	path = loader/src/external/lsplt
+	url = https://github.com/LSPosed/lsplt
 [submodule "loader/src/external/parallel-hashmap"]
 	path = loader/src/external/parallel-hashmap
 	url = https://github.com/greg7mdp/parallel-hashmap

README.md

@@ -2,31 +2,25 @@
 
 Zygisk loader for KernelSU, allowing Zygisk modules to run without Magisk environment.
 
-Warning: The current version of Zygisksu is UNSTABLE. You may suffer boot loop or even data loss so use with caution.
+Also works as standalone loader for Magisk on purpose of getting rid of LD_PRELOAD.
 
 ## Requirements
 
-+ Minimal KernelSU version: 10575
-+ Minimal ksud version: 10200
-+ Full SELinux patch support (If non-gki kernel)
+### General
+
++ No multiple root implementation installed
+
+### KernelSU
+
++ Minimal KernelSU version: 10654
++ Minimal ksud version: 10670
++ Kernel has full SELinux patch support
+
+### Magisk
+
++ Minimal version: 25208
++ Original Zygisk turned off
 
 ## Compatibility
 
 Should work with everything except those rely on Magisk internal behaviors.
-
-## Development road map
-
-- [x] [Inject] Basic Zygisk loader
-- [x] [Inject] Stabilize injector
-- [x] [Inject] Unload
-- [x] [Daemon] Linker namespace
-- [x] [Daemon] Separate zygiskd process
-- [x] [Daemon] Handle 64 bit only devices
-- [ ] [Daemon] Handle zygote death
-
-## Running on Magisk
-
-It is possible to run Zygisksu on Magisk with a few steps:
-
-1. `mkdir /data/adb/ksu`
-2. `ln -s /data/adb/modules /data/adb/ksu/`

build.gradle.kts

@@ -31,14 +31,18 @@ val gitCommitHash = "git rev-parse --verify --short HEAD".execute()
 
 val moduleId by extra("zygisksu")
 val moduleName by extra("Zygisk on KernelSU")
-val verName by extra("v4-0.3.0")
+val verName by extra("v4-0.6.2")
 val verCode by extra(gitCommitCount)
+val minKsuVersion by extra(10654)
+val minKsudVersion by extra(10670)
+val maxKsuVersion by extra(20000)
+val minMagiskVersion by extra(25208)
 
 val androidMinSdkVersion by extra(29)
 val androidTargetSdkVersion by extra(33)
 val androidCompileSdkVersion by extra(33)
-val androidBuildToolsVersion by extra("33.0.1")
-val androidCompileNdkVersion by extra("25.1.8937393")
+val androidBuildToolsVersion by extra("33.0.2")
+val androidCompileNdkVersion by extra("25.2.9519653")
 val androidSourceCompatibility by extra(JavaVersion.VERSION_11)
 val androidTargetCompatibility by extra(JavaVersion.VERSION_11)
 

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.6-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.0-bin.zip
 distributionPath=wrapper/dists
 zipStorePath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME

loader/src/Android.mk

@@ -13,7 +13,7 @@ LOCAL_LDLIBS           := -llog
 include $(BUILD_STATIC_LIBRARY)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE           := zygiskloader
+LOCAL_MODULE           := zygisk_loader
 LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
 FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/loader))
 LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)
@@ -22,7 +22,7 @@ LOCAL_LDLIBS           := -llog
 include $(BUILD_SHARED_LIBRARY)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE           := injector
+LOCAL_MODULE           := zygisk_injector
 LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
 FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/injector))
 LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)

loader/src/common/daemon.cpp

@@ -58,6 +58,17 @@ namespace zygiskd {
         return socket_utils::read_string(fd);
     }
 
+    uint32_t GetProcessFlags(uid_t uid) {
+        UniqueFd fd = Connect(1);
+        if (fd == -1) {
+            PLOGE("GetProcessFlags");
+            return 0;
+        }
+        socket_utils::write_u8(fd, (uint8_t) SocketAction::GetProcessFlags);
+        socket_utils::write_u32(fd, uid);
+        return socket_utils::read_u32(fd);
+    }
+
     std::vector<Module> ReadModules() {
         std::vector<Module> modules;
         UniqueFd fd = Connect(1);

loader/src/common/socket_utils.cpp

@@ -90,6 +90,10 @@ namespace socket_utils {
         return read_exact_or<uint8_t>(fd, 0);
     }
 
+    uint32_t read_u32(int fd) {
+        return read_exact_or<uint32_t>(fd, 0);
+    }
+
     size_t read_usize(int fd) {
         return read_exact_or<size_t>(fd, 0);
     }
@@ -110,6 +114,10 @@ namespace socket_utils {
         return write_exact<uint8_t>(fd, val);
     }
 
+    bool write_u32(int fd, uint32_t val) {
+        return write_exact<uint32_t>(fd, val);
+    }
+
     bool write_string(int fd, std::string_view str) {
         return write_usize(fd, str.size()) && str.size() == xwrite(fd, str.data(), str.size());
     }

loader/src/external/Android.mk

@@ -3,14 +3,14 @@ LOCAL_PATH := $(call my-dir)
 # liblsplt.a
 include $(CLEAR_VARS)
 LOCAL_MODULE:= liblsplt
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/liblsplt/lsplt/src/main/jni/include
+LOCAL_C_INCLUDES := $(LOCAL_PATH)/lsplt/lsplt/src/main/jni/include
 LOCAL_EXPORT_C_INCLUDES := $(LOCAL_C_INCLUDES)
-LOCAL_CFLAGS := -Wall -Wextra -Werror -fvisibility=hidden
+LOCAL_CFLAGS := -Wall -Wextra -Werror -fvisibility=hidden -DLOG_DISABLED
 LOCAL_CPPFLAGS := -std=c++20
 LOCAL_STATIC_LIBRARIES := libcxx
 LOCAL_SRC_FILES := \
-	liblsplt/lsplt/src/main/jni/elf_util.cc \
-	liblsplt/lsplt/src/main/jni/lsplt.cc
+    lsplt/lsplt/src/main/jni/elf_util.cc \
+    lsplt/lsplt/src/main/jni/lsplt.cc
 include $(BUILD_STATIC_LIBRARY)
 
 # Header only library

loader/src/include/daemon.h

@@ -54,6 +54,7 @@ namespace zygiskd {
         PingHeartBeat,
         RequestLogcatFd,
         ReadNativeBridge,
+        GetProcessFlags,
         ReadModules,
         RequestCompanionSocket,
         GetModuleDir,
@@ -67,6 +68,8 @@ namespace zygiskd {
 
     std::vector<Module> ReadModules();
 
+    uint32_t GetProcessFlags(uid_t uid);
+
     int ConnectCompanion(size_t index);
 
     int GetModuleDir(size_t index);

loader/src/include/socket_utils.h

@@ -13,12 +13,16 @@ namespace socket_utils {
 
     uint8_t read_u8(int fd);
 
+    uint32_t read_u32(int fd);
+
     size_t read_usize(int fd);
 
     std::string read_string(int fd);
 
     bool write_u8(int fd, uint8_t val);
 
+    bool write_u32(int fd, uint32_t val);
+
     int recv_fd(int fd);
 
     bool write_usize(int fd, size_t val);

loader/src/injector/entry.cpp

@@ -18,16 +18,11 @@ static void zygisk_cleanup_wait() {
 
 extern "C" [[gnu::visibility("default")]]
 void entry(void *handle) {
+#ifdef NDEBUG
     logging::setfd(zygiskd::RequestLogcatFd());
+#endif
     self_handle = handle;
 
     LOGD("Load injector successfully");
     hook_functions();
 }
-
-// The following code runs in zygote/app process
-
-static inline bool should_load_modules(uint32_t flags) {
-    return (flags & UNMOUNT_MASK) != UNMOUNT_MASK &&
-           (flags & PROCESS_IS_MAGISK_APP) != PROCESS_IS_MAGISK_APP;
-}

loader/src/injector/files.cpp

@@ -0,0 +1,122 @@
+#include <sys/sysmacros.h>
+
+#include "files.hpp"
+#include "misc.hpp"
+
+using namespace std::string_view_literals;
+
+void file_readline(bool trim, FILE *fp, const std::function<bool(std::string_view)> &fn) {
+    size_t len = 1024;
+    char *buf = (char *) malloc(len);
+    char *start;
+    ssize_t read;
+    while ((read = getline(&buf, &len, fp)) >= 0) {
+        start = buf;
+        if (trim) {
+            while (read && "\n\r "sv.find(buf[read - 1]) != std::string::npos)
+                --read;
+            buf[read] = '\0';
+            while (*start == ' ')
+                ++start;
+        }
+        if (!fn(start))
+            break;
+    }
+    free(buf);
+}
+
+void file_readline(bool trim, const char *file, const std::function<bool(std::string_view)> &fn) {
+    if (auto fp = open_file(file, "re"))
+        file_readline(trim, fp.get(), fn);
+}
+void file_readline(const char *file, const std::function<bool(std::string_view)> &fn) {
+    file_readline(false, file, fn);
+}
+
+std::vector<mount_info> parse_mount_info(const char *pid) {
+    char buf[PATH_MAX] = {};
+    snprintf(buf, sizeof(buf), "/proc/%s/mountinfo", pid);
+    std::vector<mount_info> result;
+
+    file_readline(buf, [&result](std::string_view line) -> bool {
+        int root_start = 0, root_end = 0;
+        int target_start = 0, target_end = 0;
+        int vfs_option_start = 0, vfs_option_end = 0;
+        int type_start = 0, type_end = 0;
+        int source_start = 0, source_end = 0;
+        int fs_option_start = 0, fs_option_end = 0;
+        int optional_start = 0, optional_end = 0;
+        unsigned int id, parent, maj, min;
+        sscanf(line.data(),
+               "%u "           // (1) id
+               "%u "           // (2) parent
+               "%u:%u "        // (3) maj:min
+               "%n%*s%n "      // (4) mountroot
+               "%n%*s%n "      // (5) target
+               "%n%*s%n"       // (6) vfs options (fs-independent)
+               "%n%*[^-]%n - " // (7) optional fields
+               "%n%*s%n "      // (8) FS type
+               "%n%*s%n "      // (9) source
+               "%n%*s%n",      // (10) fs options (fs specific)
+               &id, &parent, &maj, &min, &root_start, &root_end, &target_start,
+               &target_end, &vfs_option_start, &vfs_option_end,
+               &optional_start, &optional_end, &type_start, &type_end,
+               &source_start, &source_end, &fs_option_start, &fs_option_end);
+
+        auto root = line.substr(root_start, root_end - root_start);
+        auto target = line.substr(target_start, target_end - target_start);
+        auto vfs_option =
+                line.substr(vfs_option_start, vfs_option_end - vfs_option_start);
+        ++optional_start;
+        --optional_end;
+        auto optional = line.substr(
+                optional_start,
+                optional_end - optional_start > 0 ? optional_end - optional_start : 0);
+
+        auto type = line.substr(type_start, type_end - type_start);
+        auto source = line.substr(source_start, source_end - source_start);
+        auto fs_option =
+                line.substr(fs_option_start, fs_option_end - fs_option_start);
+
+        unsigned int shared = 0;
+        unsigned int master = 0;
+        unsigned int propagate_from = 0;
+        if (auto pos = optional.find("shared:"); pos != std::string_view::npos) {
+            shared = parse_int(optional.substr(pos + 7));
+        }
+        if (auto pos = optional.find("master:"); pos != std::string_view::npos) {
+            master = parse_int(optional.substr(pos + 7));
+        }
+        if (auto pos = optional.find("propagate_from:");
+                pos != std::string_view::npos) {
+            propagate_from = parse_int(optional.substr(pos + 15));
+        }
+
+        result.emplace_back(mount_info {
+                .id = id,
+                .parent = parent,
+                .device = static_cast<dev_t>(makedev(maj, min)),
+                .root {root},
+                .target {target},
+                .vfs_option {vfs_option},
+                .optional {
+                        .shared = shared,
+                        .master = master,
+                        .propagate_from = propagate_from,
+                },
+                .type {type},
+                .source {source},
+                .fs_option {fs_option},
+        });
+        return true;
+    });
+    return result;
+}
+
+sDIR make_dir(DIR *dp) {
+    return sDIR(dp, [](DIR *dp){ return dp ? closedir(dp) : 1; });
+}
+
+sFILE make_file(FILE *fp) {
+    return sFILE(fp, [](FILE *fp){ return fp ? fclose(fp) : 1; });
+}

loader/src/injector/files.hpp

@@ -0,0 +1,56 @@
+#include <dirent.h>
+#include <functional>
+#include <string>
+#include <vector>
+
+struct mount_info {
+    unsigned int id;
+    unsigned int parent;
+    dev_t device;
+    std::string root;
+    std::string target;
+    std::string vfs_option;
+    struct {
+        unsigned int shared;
+        unsigned int master;
+        unsigned int propagate_from;
+    } optional;
+    std::string type;
+    std::string source;
+    std::string fs_option;
+};
+
+void file_readline(bool trim, FILE *fp, const std::function<bool(std::string_view)> &fn);
+void file_readline(bool trim, const char *file, const std::function<bool(std::string_view)> &fn);
+void file_readline(const char *file, const std::function<bool(std::string_view)> &fn);
+
+std::vector<mount_info> parse_mount_info(const char *pid);
+
+using sFILE = std::unique_ptr<FILE, decltype(&fclose)>;
+using sDIR = std::unique_ptr<DIR, decltype(&closedir)>;
+sDIR make_dir(DIR *dp);
+sFILE make_file(FILE *fp);
+
+static inline sDIR open_dir(const char *path) {
+    return make_dir(opendir(path));
+}
+
+static inline sDIR xopen_dir(const char *path) {
+    return make_dir(opendir(path));
+}
+
+static inline sDIR xopen_dir(int dirfd) {
+    return make_dir(fdopendir(dirfd));
+}
+
+static inline sFILE open_file(const char *path, const char *mode) {
+    return make_file(fopen(path, mode));
+}
+
+static inline sFILE xopen_file(const char *path, const char *mode) {
+    return make_file(fopen(path, mode));
+}
+
+static inline sFILE xopen_file(int fd, const char *mode) {
+    return make_file(fdopen(fd, mode));
+}

loader/src/injector/hide.cpp

@@ -1,22 +0,0 @@
-#include <sys/mount.h>
-
-#include "logging.h"
-#include "misc.hpp"
-#include "zygisk.hpp"
-
-using namespace std::string_view_literals;
-
-static void lazy_unmount(const char* mountpoint) {
-    if (umount2(mountpoint, MNT_DETACH) != -1)
-        LOGD("Unmounted (%s)", mountpoint);
-}
-
-void revert_unmount() {
-    parse_mnt("/proc/self/mounts", [](mntent* mentry) {
-        if (mentry->mnt_fsname == "/data/adb/ksu/modules"sv ||
-            std::string_view(mentry->mnt_opts).find("/data/adb/ksu/modules") != std::string_view::npos) {
-            lazy_unmount(mentry->mnt_fsname);
-        }
-        return true;
-    });
-}

loader/src/injector/hook.cpp

@@ -17,7 +17,7 @@
 #include "zygisk.hpp"
 #include "memory.hpp"
 #include "module.hpp"
-#include "misc.hpp"
+#include "files.hpp"
 
 using namespace std;
 using jni_hook::hash_map;
@@ -112,8 +112,8 @@ hash_map<xstring, tree_map<xstring, tree_map<xstring, void *>>> *jni_method_map;
 
 // Current context
 HookContext *g_ctx;
-const JNINativeInterface *old_functions;
-JNINativeInterface *new_functions;
+const JNINativeInterface *old_functions = nullptr;
+JNINativeInterface *new_functions = nullptr;
 
 } // namespace
 
@@ -143,15 +143,8 @@ if (methods[i].name == #method##sv) {
 
 namespace {
 
-jclass gClassRef;
-jmethodID class_getName;
 string get_class_name(JNIEnv *env, jclass clazz) {
-    if (!gClassRef) {
-        jclass cls = env->FindClass("java/lang/Class");
-        gClassRef = (jclass) env->NewGlobalRef(cls);
-        env->DeleteLocalRef(cls);
-        class_getName = env->GetMethodID(gClassRef, "getName", "()Ljava/lang/String;");
-    }
+    static auto class_getName = env->GetMethodID(env->FindClass("java/lang/Class"), "getName", "()Ljava/lang/String;");
     auto nameRef = (jstring) env->CallObjectMethod(clazz, class_getName);
     const char *name = env->GetStringUTFChars(nameRef, nullptr);
     string className(name);
@@ -172,11 +165,44 @@ jint env_RegisterNatives(
     return old_functions->RegisterNatives(env, clazz, newMethods.get() ?: methods, numMethods);
 }
 
-DCL_HOOK_FUNC(int, jniRegisterNativeMethods,
-        JNIEnv *env, const char *className, const JNINativeMethod *methods, int numMethods) {
-    LOGV("jniRegisterNativeMethods [%s]\n", className);
-    auto newMethods = hookAndSaveJNIMethods(className, methods, numMethods);
-    return old_jniRegisterNativeMethods(env, className, newMethods.get() ?: methods, numMethods);
+DCL_HOOK_FUNC(void, androidSetCreateThreadFunc, void* func) {
+    LOGD("androidSetCreateThreadFunc\n");
+    do {
+        auto get_created_java_vms = reinterpret_cast<jint (*)(JavaVM **, jsize, jsize *)>(
+                dlsym(RTLD_DEFAULT, "JNI_GetCreatedJavaVMs"));
+        if (!get_created_java_vms) {
+            for (auto &map: lsplt::MapInfo::Scan()) {
+                if (!map.path.ends_with("/libnativehelper.so")) continue;
+                void *h = dlopen(map.path.data(), RTLD_LAZY);
+                if (!h) {
+                    LOGW("cannot dlopen libnativehelper.so: %s\n", dlerror());
+                    break;
+                }
+                get_created_java_vms = reinterpret_cast<decltype(get_created_java_vms)>(dlsym(h, "JNI_GetCreatedJavaVMs"));
+                dlclose(h);
+                break;
+            }
+            if (!get_created_java_vms) {
+                LOGW("JNI_GetCreatedJavaVMs not found\n");
+                break;
+            }
+        }
+        JavaVM *vm = nullptr;
+        jsize num = 0;
+        jint res = get_created_java_vms(&vm, 1, &num);
+        if (res != JNI_OK || vm == nullptr) break;
+        JNIEnv *env = nullptr;
+        res = vm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6);
+        if (res != JNI_OK || env == nullptr) break;
+        default_new(new_functions);
+        memcpy(new_functions, env->functions, sizeof(*new_functions));
+        new_functions->RegisterNatives = &env_RegisterNatives;
+
+        // Replace the function table in JNIEnv to hook RegisterNatives
+        old_functions = env->functions;
+        env->functions = new_functions;
+    } while (false);
+    old_androidSetCreateThreadFunc(func);
 }
 
 // Skip actual fork and return cached result if applicable
@@ -193,7 +219,11 @@ DCL_HOOK_FUNC(int, unshare, int flags) {
         // Simply avoid doing any unmounts for SysUI to avoid potential issues.
         (g_ctx->info_flags & PROCESS_IS_SYS_UI) == 0) {
         if (g_ctx->flags[DO_REVERT_UNMOUNT]) {
-            revert_unmount();
+            if (g_ctx->info_flags & PROCESS_ROOT_IS_KSU) {
+                revert_unmount_ksu();
+            } else if (g_ctx->info_flags & PROCESS_ROOT_IS_MAGISK) {
+                revert_unmount_magisk();
+            }
         }
 
         /* Zygisksu changed: No umount app_process */
@@ -225,58 +255,6 @@ DCL_HOOK_FUNC(int, selinux_android_setcontext,
     return old_selinux_android_setcontext(uid, isSystemServer, seinfo, pkgname);
 }
 
-// -----------------------------------------------------------------
-
-// The original android::AppRuntime virtual table
-void **gAppRuntimeVTable;
-
-// This method is a trampoline for hooking JNIEnv->RegisterNatives
-void onVmCreated(void *self, JNIEnv* env) {
-    LOGD("AppRuntime::onVmCreated\n");
-
-    // Restore virtual table
-    auto new_table = *reinterpret_cast<void***>(self);
-    *reinterpret_cast<void***>(self) = gAppRuntimeVTable;
-    delete[] new_table;
-
-    new_functions = new JNINativeInterface();
-    memcpy(new_functions, env->functions, sizeof(*new_functions));
-    new_functions->RegisterNatives = &env_RegisterNatives;
-
-    // Replace the function table in JNIEnv to hook RegisterNatives
-    old_functions = env->functions;
-    env->functions = new_functions;
-}
-
-template<int N>
-void vtable_entry(void *self, JNIEnv* env) {
-    // The first invocation will be onVmCreated. It will also restore the vtable.
-    onVmCreated(self, env);
-    // Call original function
-    reinterpret_cast<decltype(&onVmCreated)>(gAppRuntimeVTable[N])(self, env);
-}
-
-/* Zygisksu changed: AndroidRuntime setArgv0 before native bridge loaded */
-void hookVirtualTable(void *self) {
-    LOGD("hook AndroidRuntime virtual table\n");
-
-    // We don't know which entry is onVmCreated, so overwrite every one
-    // We also don't know the size of the vtable, but 8 is more than enough
-    auto new_table = new void*[8];
-    new_table[0] = reinterpret_cast<void*>(&vtable_entry<0>);
-    new_table[1] = reinterpret_cast<void*>(&vtable_entry<1>);
-    new_table[2] = reinterpret_cast<void*>(&vtable_entry<2>);
-    new_table[3] = reinterpret_cast<void*>(&vtable_entry<3>);
-    new_table[4] = reinterpret_cast<void*>(&vtable_entry<4>);
-    new_table[5] = reinterpret_cast<void*>(&vtable_entry<5>);
-    new_table[6] = reinterpret_cast<void*>(&vtable_entry<6>);
-    new_table[7] = reinterpret_cast<void*>(&vtable_entry<7>);
-
-    // Swizzle C++ vtable to hook virtual function
-    gAppRuntimeVTable = *reinterpret_cast<void***>(self);
-    *reinterpret_cast<void***>(self) = new_table;
-}
-
 #undef DCL_HOOK_FUNC
 
 // -----------------------------------------------------------------
@@ -312,7 +290,7 @@ void hookJniNativeMethods(JNIEnv *env, const char *clz, JNINativeMethod *methods
     if (hooks.empty())
         return;
 
-    old_jniRegisterNativeMethods(env, clz, hooks.data(), hooks.size());
+    old_functions->RegisterNatives(env, env->FindClass(clz), hooks.data(), static_cast<int>(hooks.size()));
 }
 
 ZygiskModule::ZygiskModule(int id, void *handle, void *entry)
@@ -501,11 +479,11 @@ void HookContext::sanitize_fds() {
             if (exempted_fds.empty())
                 return nullptr;
 
-            jintArray array = env->NewIntArray(off + exempted_fds.size());
+            jintArray array = env->NewIntArray(static_cast<int>(off + exempted_fds.size()));
             if (array == nullptr)
                 return nullptr;
 
-            env->SetIntArrayRegion(array, off, exempted_fds.size(), exempted_fds.data());
+            env->SetIntArrayRegion(array, off, static_cast<int>(exempted_fds.size()), exempted_fds.data());
             for (int fd : exempted_fds) {
                 if (fd >= 0 && fd < MAX_FD_SIZE) {
                     allowed_fds[fd] = true;
@@ -592,15 +570,13 @@ void HookContext::run_modules_post() {
 /* Zygisksu changed: Load module fds */
 void HookContext::app_specialize_pre() {
     flags[APP_SPECIALIZE] = true;
+    info_flags = zygiskd::GetProcessFlags(g_ctx->args.app->uid);
     run_modules_pre();
 }
 
 
 void HookContext::app_specialize_post() {
     run_modules_post();
-    if (info_flags & PROCESS_IS_MAGISK_APP) {
-        setenv("ZYGISK_ENABLED", "1", 1);
-    }
 
     // Cleanups
     env->ReleaseStringUTFChars(args.app->nice_name, process);
@@ -739,35 +715,16 @@ void hook_functions() {
 
     PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, fork);
     PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, unshare);
-    PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, jniRegisterNativeMethods);
     PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, selinux_android_setcontext);
+    PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, androidSetCreateThreadFunc);
     PLT_HOOK_REGISTER_SYM(android_runtime_dev, android_runtime_inode, "__android_log_close", android_log_close);
     hook_commit();
 
     // Remove unhooked methods
     plt_hook_list->erase(
             std::remove_if(plt_hook_list->begin(), plt_hook_list->end(),
-            [](auto &t) { return *std::get<3>(t) == nullptr;}),
+                           [](auto &t) { return *std::get<3>(t) == nullptr;}),
             plt_hook_list->end());
-
-    /* Zygisksu changed: AndroidRuntime setArgv0 before native bridge loaded */
-    if (old_jniRegisterNativeMethods == nullptr) {
-        do {
-            LOGD("jniRegisterNativeMethods not hooked, using fallback\n");
-            constexpr char sig[] = "_ZN7android14AndroidRuntime10getRuntimeEv";
-            auto *GetRuntime = (void*(*)()) dlsym(RTLD_DEFAULT, sig);
-            if (GetRuntime == nullptr) {
-                LOGE("GetRuntime is nullptr");
-                break;
-            }
-            hookVirtualTable(GetRuntime());
-        } while (false);
-
-        // We still need old_jniRegisterNativeMethods as other code uses it
-        // android::AndroidRuntime::registerNativeMethods(_JNIEnv*, const char*, const JNINativeMethod*, int)
-        constexpr char sig[] = "_ZN7android14AndroidRuntime21registerNativeMethodsEP7_JNIEnvPKcPK15JNINativeMethodi";
-        *(void **) &old_jniRegisterNativeMethods = dlsym(RTLD_DEFAULT, sig);
-    }
 }
 
 static bool unhook_functions() {
@@ -776,17 +733,14 @@ static bool unhook_functions() {
     // Restore JNIEnv
     if (g_ctx->env->functions == new_functions) {
         g_ctx->env->functions = old_functions;
-        if (gClassRef) {
-            g_ctx->env->DeleteGlobalRef(gClassRef);
-            gClassRef = nullptr;
-            class_getName = nullptr;
-        }
+        delete new_functions;
     }
 
     // Unhook JNI methods
     for (const auto &[clz, methods] : *jni_hook_list) {
-        if (!methods.empty() && old_jniRegisterNativeMethods(
-                g_ctx->env, clz.data(), methods.data(), methods.size()) != 0) {
+        if (!methods.empty() && g_ctx->env->RegisterNatives(
+                g_ctx->env->FindClass(clz.data()), methods.data(),
+                static_cast<int>(methods.size())) != 0) {
             LOGE("Failed to restore JNI hook of class [%s]\n", clz.data());
             success = false;
         }

loader/src/injector/misc.cpp

@@ -23,22 +23,27 @@ int parse_int(std::string_view s) {
     return val;
 }
 
-void parse_mnt(const char* file, const std::function<bool(mntent*)>& fn) {
-    auto fp = sFILE(setmntent(file, "re"), endmntent);
-    if (fp) {
-        mntent mentry{};
-        char buf[PATH_MAX];
-        while (getmntent_r(fp.get(), &mentry, buf, sizeof(buf))) {
-            if (!fn(&mentry))
-                break;
+std::list<std::string> split_str(std::string_view s, std::string_view delimiter) {
+    std::list<std::string> ret;
+    size_t pos = 0;
+    while (pos < s.size()) {
+        auto next = s.find(delimiter, pos);
+        if (next == std::string_view::npos) {
+            ret.emplace_back(s.substr(pos));
+            break;
         }
+        ret.emplace_back(s.substr(pos, next - pos));
+        pos = next + delimiter.size();
     }
+    return ret;
 }
 
-sDIR make_dir(DIR *dp) {
-    return sDIR(dp, [](DIR *dp){ return dp ? closedir(dp) : 1; });
-}
-
-sFILE make_file(FILE *fp) {
-    return sFILE(fp, [](FILE *fp){ return fp ? fclose(fp) : 1; });
+std::string join_str(const std::list<std::string>& list, std::string_view delimiter) {
+    std::string ret;
+    for (auto& s : list) {
+        if (!ret.empty())
+            ret += delimiter;
+        ret += s;
+    }
+    return ret;
 }

loader/src/injector/misc.hpp

@@ -1,11 +1,9 @@
 #pragma once
 
-#include <dirent.h>
-#include <functional>
+#include <list>
 #include <memory>
-#include <mntent.h>
 #include <pthread.h>
-#include <stdio.h>
+#include <string>
 #include <string_view>
 
 #include "logging.h"
@@ -34,6 +32,10 @@ private:
 using thread_entry = void *(*)(void *);
 int new_daemon_thread(thread_entry entry, void *arg);
 
+static inline bool str_contains(std::string_view s, std::string_view ss) {
+    return s.find(ss) != std::string_view::npos;
+}
+
 template<typename T, typename Impl>
 class stateless_allocator {
 public:
@@ -49,33 +51,23 @@ public:
     bool operator!=(const stateless_allocator&) { return false; }
 };
 
-using sFILE = std::unique_ptr<FILE, decltype(&fclose)>;
-using sDIR = std::unique_ptr<DIR, decltype(&closedir)>;
-sDIR make_dir(DIR *dp);
-sFILE make_file(FILE *fp);
+template <typename T>
+class reversed_container {
+public:
+    reversed_container(T &base) : base(base) {}
+    decltype(std::declval<T>().rbegin()) begin() { return base.rbegin(); }
+    decltype(std::declval<T>().crbegin()) begin() const { return base.crbegin(); }
+    decltype(std::declval<T>().crbegin()) cbegin() const { return base.crbegin(); }
+    decltype(std::declval<T>().rend()) end() { return base.rend(); }
+    decltype(std::declval<T>().crend()) end() const { return base.crend(); }
+    decltype(std::declval<T>().crend()) cend() const { return base.crend(); }
+private:
+    T &base;
+};
 
-static inline sDIR open_dir(const char *path) {
-    return make_dir(opendir(path));
-}
-
-static inline sDIR xopen_dir(const char *path) {
-    return make_dir(opendir(path));
-}
-
-static inline sDIR xopen_dir(int dirfd) {
-    return make_dir(fdopendir(dirfd));
-}
-
-static inline sFILE open_file(const char *path, const char *mode) {
-    return make_file(fopen(path, mode));
-}
-
-static inline sFILE xopen_file(const char *path, const char *mode) {
-    return make_file(fopen(path, mode));
-}
-
-static inline sFILE xopen_file(int fd, const char *mode) {
-    return make_file(fdopen(fd, mode));
+template <typename T>
+reversed_container<T> reversed(T &base) {
+    return reversed_container<T>(base);
 }
 
 template<class T>
@@ -95,7 +87,9 @@ struct StringCmp {
  */
 int parse_int(std::string_view s);
 
-void parse_mnt(const char* file, const std::function<bool(mntent*)>& fn);
+std::list<std::string> split_str(std::string_view s, std::string_view delimiter);
+
+std::string join_str(const std::list<std::string>& list, std::string_view delimiter);
 
 template <typename T>
 static inline T align_to(T v, int a) {

loader/src/injector/module.hpp

@@ -111,12 +111,11 @@ namespace {
         PROCESS_GRANTED_ROOT = zygisk::StateFlag::PROCESS_GRANTED_ROOT,
         PROCESS_ON_DENYLIST = zygisk::StateFlag::PROCESS_ON_DENYLIST,
 
-        PROCESS_IS_SYS_UI = (1u << 29),
-        DENYLIST_ENFORCING = (1u << 30),
-        PROCESS_IS_MAGISK_APP = (1u << 31),
+        PROCESS_ROOT_IS_KSU = (1u << 29),
+        PROCESS_ROOT_IS_MAGISK = (1u << 30),
+        PROCESS_IS_SYS_UI = (1u << 31),
 
-        UNMOUNT_MASK = (PROCESS_ON_DENYLIST | DENYLIST_ENFORCING),
-        PRIVATE_MASK = (PROCESS_IS_SYS_UI | DENYLIST_ENFORCING | PROCESS_IS_MAGISK_APP)
+        PRIVATE_MASK = PROCESS_IS_SYS_UI
     };
 
     struct api_abi_base {

loader/src/injector/unmount.cpp

@@ -0,0 +1,122 @@
+#include <mntent.h>
+#include <sys/mount.h>
+
+#include "files.hpp"
+#include "logging.h"
+#include "misc.hpp"
+#include "zygisk.hpp"
+
+using namespace std::string_view_literals;
+
+namespace {
+    constexpr auto MODULE_DIR = "/data/adb/modules";
+
+    struct overlay_backup {
+        std::string target;
+        std::string vfs_option;
+        std::string fs_option;
+    };
+
+    void lazy_unmount(const char* mountpoint) {
+        if (umount2(mountpoint, MNT_DETACH) != -1) {
+            LOGD("Unmounted (%s)", mountpoint);
+        } else {
+            PLOGE("Unmount (%s)", mountpoint);
+        }
+    }
+}
+
+#define PARSE_OPT(name, flag)   \
+    if (opt == (name)) {        \
+        flags |= (flag);        \
+        return true;            \
+    }
+
+void revert_unmount_ksu() {
+    std::string ksu_loop;
+    std::vector<std::string> targets;
+    std::list<overlay_backup> backups;
+
+    // Unmount ksu module dir last
+    targets.emplace_back(MODULE_DIR);
+
+    for (auto& info: parse_mount_info("self")) {
+        if (info.target == MODULE_DIR) {
+            ksu_loop = info.source;
+            continue;
+        }
+        // Unmount everything on /data/adb except ksu module dir
+        if (info.target.starts_with("/data/adb")) {
+            targets.emplace_back(info.target);
+        }
+        // Unmount ksu overlays
+        if (info.type == "overlay") {
+            if (str_contains(info.fs_option, MODULE_DIR)) {
+                targets.emplace_back(info.target);
+            } else {
+                auto backup = overlay_backup{
+                        .target = info.target,
+                        .vfs_option = info.vfs_option,
+                        .fs_option = info.fs_option,
+                };
+                backups.emplace_back(backup);
+            }
+        }
+    }
+    for (auto& info: parse_mount_info("self")) {
+        // Unmount everything from ksu loop except ksu module dir
+        if (info.source == ksu_loop && info.target != MODULE_DIR) {
+            targets.emplace_back(info.target);
+        }
+    }
+
+    // Do unmount
+    for (auto& s: reversed(targets)) {
+        lazy_unmount(s.data());
+    }
+
+    // Affirm unmounted system overlays
+    for (auto& info: parse_mount_info("self")) {
+        if (info.type == "overlay") {
+            backups.remove_if([&](overlay_backup& mnt) {
+                return mnt.target == info.target && mnt.fs_option == info.fs_option;
+            });
+        }
+    }
+
+    // Restore system overlays
+    for (auto& mnt: backups) {
+        auto opts = split_str(mnt.vfs_option, ",");
+        opts.splice(opts.end(), split_str(mnt.fs_option, ","));
+        unsigned long flags = 0;
+        opts.remove_if([&](auto& opt) {
+            PARSE_OPT(MNTOPT_RO, MS_RDONLY)
+            PARSE_OPT(MNTOPT_NOSUID, MS_NOSUID)
+            PARSE_OPT("relatime", MS_RELATIME)
+            return false;
+        });
+        auto mnt_data = join_str(opts, ",");
+        if (mount("overlay", mnt.target.data(), "overlay", flags, mnt_data.data()) != -1) {
+            LOGD("Remounted (%s)", mnt.target.data());
+        } else {
+            PLOGE("Remount (%s, %s)", mnt.target.data(), mnt.fs_option.data());
+        }
+    }
+}
+
+void revert_unmount_magisk() {
+    std::vector<std::string> targets;
+
+    // Unmount dummy skeletons and MAGISKTMP
+    // since mirror nodes are always mounted under skeleton, we don't have to specifically unmount
+    for (auto& info: parse_mount_info("self")) {
+        if (info.source == "magisk" || info.source == "worker" || // magisktmp tmpfs
+            info.root.starts_with("/adb/modules")) { // bind mount from data partition
+            targets.push_back(info.target);
+        }
+    }
+
+    for (auto& s: reversed(targets)) {
+        lazy_unmount(s.data());
+    }
+}

loader/src/injector/zygisk.hpp

@@ -8,4 +8,7 @@ extern void *self_handle;
 
 void hook_functions();
 
-void revert_unmount();
+void revert_unmount_ksu();
+
+void revert_unmount_magisk();
+

loader/src/loader/loader.cpp

@@ -13,7 +13,7 @@ uint8_t NativeBridgeItf[sizeof(NativeBridgeCallbacks<__ANDROID_API_R__>) * 2]{0}
 
 namespace {
     constexpr auto kZygoteProcesses = {"zygote", "zygote32", "zygote64", "usap32", "usap64"};
-    constexpr auto kInjector = "/system/" LP_SELECT("lib", "lib64") "/libinjector.so";
+    constexpr auto kInjector = "/system/" LP_SELECT("lib", "lib64") "/libzygisk_injector.so";
 
     void* sOriginalBridge = nullptr;
 }
@@ -43,9 +43,9 @@ void Constructor() {
     std::string native_bridge;
     do {
         if (!zygiskd::PingHeartbeat()) break;
-
+#ifdef NDEBUG
         logging::setfd(zygiskd::RequestLogcatFd());
-
+#endif
         LOGI("Read native bridge");
         native_bridge = zygiskd::ReadNativeBridge();
 
@@ -70,13 +70,13 @@ void Constructor() {
         LOGI("Load original native bridge: %s", native_bridge.data());
         sOriginalBridge = dlopen(native_bridge.data(), RTLD_NOW);
         if (sOriginalBridge == nullptr) {
-            LOGE("dlopen failed: %s", dlerror());
+            LOGE("%s", dlerror());
             break;
         }
 
         auto* original_native_bridge_itf = dlsym(sOriginalBridge, "NativeBridgeItf");
         if (original_native_bridge_itf == nullptr) {
-            LOGE("dlsym failed: %s", dlerror());
+            LOGE("%s", dlerror());
             break;
         }
 

module/build.gradle.kts

@@ -11,6 +11,10 @@ val moduleId: String by rootProject.extra
 val moduleName: String by rootProject.extra
 val verCode: Int by rootProject.extra
 val verName: String by rootProject.extra
+val minKsuVersion: Int by rootProject.extra
+val minKsudVersion: Int by rootProject.extra
+val maxKsuVersion: Int by rootProject.extra
+val minMagiskVersion: Int by rootProject.extra
 
 android.buildFeatures {
     androidResources = false
@@ -34,7 +38,7 @@ androidComponents.onVariants { variant ->
         into(moduleDir)
         from("${rootProject.projectDir}/README.md")
         from("$projectDir/src") {
-            exclude("module.prop", "customize.sh", "daemon.sh")
+            exclude("module.prop", "customize.sh", "service.sh")
             filter<FixCrLfFilter>("eol" to FixCrLfFilter.CrLf.newInstance("lf"))
         }
         from("$projectDir/src") {
@@ -47,9 +51,13 @@ androidComponents.onVariants { variant ->
             )
         }
         from("$projectDir/src") {
-            include("customize.sh", "daemon.sh")
+            include("customize.sh", "service.sh")
             val tokens = mapOf(
-                "DEBUG" to if (buildTypeLowered == "debug") "true" else "false"
+                "DEBUG" to if (buildTypeLowered == "debug") "true" else "false",
+                "MIN_KSU_VERSION" to "$minKsuVersion",
+                "MIN_KSUD_VERSION" to "$minKsudVersion",
+                "MAX_KSU_VERSION" to "$maxKsuVersion",
+                "MIN_MAGISK_VERSION" to "$minMagiskVersion",
             )
             filter<ReplaceTokens>("tokens" to tokens)
             filter<FixCrLfFilter>("eol" to FixCrLfFilter.CrLf.newInstance("lf"))
@@ -106,7 +114,7 @@ androidComponents.onVariants { variant ->
     val installMagiskTask = task<Exec>("installMagisk$variantCapped") {
         group = "module"
         dependsOn(pushTask)
-        commandLine("adb", "shell", "su", "-c", "KSU=true magisk --install-module /data/local/tmp/$zipFileName")
+        commandLine("adb", "shell", "su", "-c", "magisk --install-module /data/local/tmp/$zipFileName")
     }
 
     task<Exec>("installKsuAndReboot$variantCapped") {

module/src/customize.sh

@@ -1,31 +1,61 @@
 # shellcheck disable=SC2034
 SKIPUNZIP=1
 
-if [ $BOOTMODE ] && [ "$KSU" == "true" ]; then
+DEBUG=@DEBUG@
+MIN_KSU_VERSION=@MIN_KSU_VERSION@
+MIN_KSUD_VERSION=@MIN_KSUD_VERSION@
+MAX_KSU_VERSION=@MAX_KSU_VERSION@
+MIN_MAGISK_VERSION=@MIN_MAGISK_VERSION@
+
+if [ "$BOOTMODE" ] && [ "$KSU" ]; then
   ui_print "- Installing from KernelSU app"
+  ui_print "- KernelSU version: $KSU_KERNEL_VER_CODE (kernel) + $KSU_VER_CODE (ksud)"
+  if ! [ "$KSU_KERNEL_VER_CODE" ] || [ "$KSU_KERNEL_VER_CODE" -lt "$MIN_KSU_VERSION" ]; then
+    ui_print "*********************************************************"
+    ui_print "! KernelSU version is too old!"
+    ui_print "! Please update KernelSU to latest version"
+    abort    "*********************************************************"
+  elif [ "$KSU_KERNEL_VER_CODE" -ge "$MAX_KSU_VERSION" ]; then
+    ui_print "*********************************************************"
+    ui_print "! KernelSU version abnormal!"
+    ui_print "! Please integrate KernelSU into your kernel"
+    ui_print "  as submodule instead of copying the source code"
+    abort    "*********************************************************"
+  fi
+  if ! [ "$KSU_VER_CODE" ] || [ "$KSU_VER_CODE" -lt "$MIN_KSUD_VERSION" ]; then
+    ui_print "*********************************************************"
+    ui_print "! ksud version is too old!"
+    ui_print "! Please update KernelSU Manager to latest version"
+    abort    "*********************************************************"
+  fi
+  if [ "$(which magisk)" ]; then
+    ui_print "*********************************************************"
+    ui_print "! Multiple root implementation is NOT supported!"
+    ui_print "! Please uninstall Magisk before installing Zygisksu"
+    abort    "*********************************************************"
+  fi
+elif [ "$BOOTMODE" ] && [ "$MAGISK_VER_CODE" ]; then
+  ui_print "- Installing from Magisk app"
+  if [ "$MAGISK_VER_CODE" -lt "$MIN_MAGISK_VERSION" ]; then
+    ui_print "*********************************************************"
+    ui_print "! Magisk version is too old!"
+    ui_print "! Please update Magisk to latest version"
+    abort    "*********************************************************"
+  fi
 else
   ui_print "*********************************************************"
-  ui_print "! Install from recovery or Magisk is NOT supported"
-  ui_print "! Please install from KernelSU app"
-  abort "*********************************************************"
+  ui_print "! Install from recovery is not supported"
+  ui_print "! Please install from KernelSU or Magisk app"
+  abort    "*********************************************************"
 fi
 
 VERSION=$(grep_prop version "${TMPDIR}/module.prop")
 ui_print "- Installing Zygisksu $VERSION"
 
-# check KernelSU
-ui_print "- KernelSU version: $KSU_VER ($KSU_VER_CODE)"
-if [ "$KSU_VER_CODE" -lt 10200 ]; then
-  ui_print "*********************************************************"
-  ui_print "! KernelSU version is too old!"
-  ui_print "! Please update KernelSU to latest version"
-  abort    "*********************************************************"
-fi
-
 # check android
 if [ "$API" -lt 29 ]; then
   ui_print "! Unsupported sdk: $API"
-  abort "! Minimal supported sdk is 29 (Android 10.0)"
+  abort "! Minimal supported sdk is 29 (Android 10)"
 else
   ui_print "- Device sdk: $API"
 fi
@@ -50,20 +80,25 @@ extract "$ZIPFILE" 'customize.sh'  "$TMPDIR/.vunzip"
 extract "$ZIPFILE" 'verify.sh'     "$TMPDIR/.vunzip"
 extract "$ZIPFILE" 'sepolicy.rule' "$TMPDIR"
 
-ui_print "- Checking SELinux patches"
-if ! /data/adb/ksud sepolicy check "$TMPDIR/sepolicy.rule"; then
-  ui_print "*********************************************************"
-  ui_print "! Unable to apply SELinux patches!"
-  ui_print "! Your kernel may not support SELinux patch fully"
-  abort    "*********************************************************"
+if [ "$KSU" ]; then
+  ui_print "- Checking SELinux patches"
+  if [ "$(getprop ro.product.first_api_level)" -lt 31 ]; then
+    echo "allow zygote appdomain_tmpfs file *" >> "$TMPDIR/sepolicy.rule"
+    echo "allow zygote appdomain_tmpfs dir *"  >> "$TMPDIR/sepolicy.rule"
+  fi
+  if ! check_sepolicy "$TMPDIR/sepolicy.rule"; then
+    ui_print "*********************************************************"
+    ui_print "! Unable to apply SELinux patches!"
+    ui_print "! Your kernel may not support SELinux patch fully"
+    abort    "*********************************************************"
+  fi
 fi
 
 ui_print "- Extracting module files"
-extract "$ZIPFILE" 'daemon.sh'       "$MODPATH"
 extract "$ZIPFILE" 'module.prop'     "$MODPATH"
 extract "$ZIPFILE" 'post-fs-data.sh' "$MODPATH"
-extract "$ZIPFILE" 'sepolicy.rule'   "$MODPATH"
 extract "$ZIPFILE" 'service.sh'      "$MODPATH"
+mv "$TMPDIR/sepolicy.rule" "$MODPATH"
 
 HAS32BIT=false && [ -d "/system/lib" ] && HAS32BIT=true
 HAS64BIT=false && [ -d "/system/lib64" ] && HAS64BIT=true
@@ -78,8 +113,8 @@ if [ "$ARCH" = "x86" ] || [ "$ARCH" = "x64" ]; then
     ui_print "- Extracting x86 libraries"
     extract "$ZIPFILE" 'bin/x86/zygiskd' "$MODPATH/bin" true
     mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd32"
-    extract "$ZIPFILE" 'lib/x86/libinjector.so' "$MODPATH/system/lib" true
-    extract "$ZIPFILE" 'lib/x86/libzygiskloader.so' "$MODPATH/system/lib" true
+    extract "$ZIPFILE" 'lib/x86/libzygisk_injector.so' "$MODPATH/system/lib" true
+    extract "$ZIPFILE" 'lib/x86/libzygisk_loader.so' "$MODPATH/system/lib" true
     ln -sf "zygiskd32" "$MODPATH/bin/zygiskwd"
   fi
 
@@ -87,8 +122,8 @@ if [ "$ARCH" = "x86" ] || [ "$ARCH" = "x64" ]; then
     ui_print "- Extracting x64 libraries"
     extract "$ZIPFILE" 'bin/x86_64/zygiskd' "$MODPATH/bin" true
     mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd64"
-    extract "$ZIPFILE" 'lib/x86_64/libinjector.so' "$MODPATH/system/lib64" true
-    extract "$ZIPFILE" 'lib/x86_64/libzygiskloader.so' "$MODPATH/system/lib64" true
+    extract "$ZIPFILE" 'lib/x86_64/libzygisk_injector.so' "$MODPATH/system/lib64" true
+    extract "$ZIPFILE" 'lib/x86_64/libzygisk_loader.so' "$MODPATH/system/lib64" true
     ln -sf "zygiskd64" "$MODPATH/bin/zygiskwd"
   fi
 else
@@ -96,8 +131,8 @@ else
     ui_print "- Extracting arm libraries"
     extract "$ZIPFILE" 'bin/armeabi-v7a/zygiskd' "$MODPATH/bin" true
     mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd32"
-    extract "$ZIPFILE" 'lib/armeabi-v7a/libinjector.so' "$MODPATH/system/lib" true
-    extract "$ZIPFILE" 'lib/armeabi-v7a/libzygiskloader.so' "$MODPATH/system/lib" true
+    extract "$ZIPFILE" 'lib/armeabi-v7a/libzygisk_injector.so' "$MODPATH/system/lib" true
+    extract "$ZIPFILE" 'lib/armeabi-v7a/libzygisk_loader.so' "$MODPATH/system/lib" true
     ln -sf "zygiskd32" "$MODPATH/bin/zygiskwd"
   fi
 
@@ -105,23 +140,25 @@ else
     ui_print "- Extracting arm64 libraries"
     extract "$ZIPFILE" 'bin/arm64-v8a/zygiskd' "$MODPATH/bin" true
     mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd64"
-    extract "$ZIPFILE" 'lib/arm64-v8a/libinjector.so' "$MODPATH/system/lib64" true
-    extract "$ZIPFILE" 'lib/arm64-v8a/libzygiskloader.so' "$MODPATH/system/lib64" true
+    extract "$ZIPFILE" 'lib/arm64-v8a/libzygisk_injector.so' "$MODPATH/system/lib64" true
+    extract "$ZIPFILE" 'lib/arm64-v8a/libzygisk_loader.so' "$MODPATH/system/lib64" true
     ln -sf "zygiskd64" "$MODPATH/bin/zygiskwd"
   fi
 fi
 
-ui_print "- Hex patching"
-SOCKET_PATCH=$(tr -dc 'a-f0-9' </dev/urandom | head -c 18)
-if [ "$HAS32BIT" = true ]; then
-  sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/bin/zygiskd32"
-  sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib/libinjector.so"
-  sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib/libzygiskloader.so"
-fi
-if [ "$HAS64BIT" = true ]; then
-  sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/bin/zygiskd64"
-  sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib64/libinjector.so"
-  sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib64/libzygiskloader.so"
+if [ $DEBUG = false ]; then
+  ui_print "- Hex patching"
+  SOCKET_PATCH=$(tr -dc 'a-f0-9' </dev/urandom | head -c 18)
+  if [ "$HAS32BIT" = true ]; then
+    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/bin/zygiskd32"
+    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib/libzygisk_injector.so"
+    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib/libzygisk_loader.so"
+  fi
+  if [ "$HAS64BIT" = true ]; then
+    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/bin/zygiskd64"
+    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib64/libzygisk_injector.so"
+    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib64/libzygisk_loader.so"
+  fi
 fi
 
 ui_print "- Setting permissions"

module/src/daemon.sh

@@ -1,12 +0,0 @@
-#!/system/bin/sh
-
-DEBUG=@DEBUG@
-MODDIR=${0%/*}
-
-# shellcheck disable=SC2155
-export NATIVE_BRIDGE=$(getprop ro.dalvik.vm.native.bridge)
-[ "$DEBUG" = true ] && export RUST_BACKTRACE=1
-
-log -p i -t "zygisksu" "Start watchdog"
-resetprop ro.dalvik.vm.native.bridge libzygiskloader.so
-exec "$MODDIR/bin/zygiskwd" "watchdog" >/dev/null 2>&1

module/src/post-fs-data.sh

@@ -1,5 +1,23 @@
 #!/system/bin/sh
 
 MODDIR=${0%/*}
-export NATIVE_BRIDGE=$(getprop ro.dalvik.vm.native.bridge)
-unshare -m sh -c "$MODDIR/daemon.sh $@&"
+if [ "$ZYGISK_ENABLED" ]; then
+  exit 0
+fi
+
+cd "$MODDIR"
+getprop ro.dalvik.vm.native.bridge > /dev/.native_bridge
+resetprop ro.dalvik.vm.native.bridge libzygisk_loader.so
+
+if [ "$(which magisk)" ]; then
+  for file in ../*; do
+    if [ -d "$file" ] && [ -d "$file/zygisk" ] && ! [ -f "$file/disable" ]; then
+      if [ -f "$file/post-fs-data.sh" ]; then
+        cd "$file"
+        log -p i -t "zygisksu" "Manually trigger post-fs-data.sh for $file"
+        sh "$(realpath ./post-fs-data.sh)"
+        cd "$MODDIR"
+      fi
+    fi
+  done
+fi

module/src/sepolicy.rule

@@ -10,3 +10,7 @@ allow * magisk_file lnk_file *
 allow * magisk_file sock_file *
 
 allow system_server system_server process execmem
+allow zygote adb_data_file dir search
+allow zygote mnt_vendor_file dir search
+allow zygote system_file dir mounton
+allow zygote labeledfs filesystem mount

module/src/service.sh

@@ -1 +1,29 @@
 #!/system/bin/sh
+
+DEBUG=@DEBUG@
+
+MODDIR=${0%/*}
+if [ "$ZYGISK_ENABLED" ]; then
+  exit 0
+fi
+
+cd "$MODDIR"
+export NATIVE_BRIDGE=$(cat /dev/.native_bridge)
+rm /dev/.native_bridge
+
+if [ "$(which magisk)" ]; then
+  for file in ../*; do
+    if [ -d "$file" ] && [ -d "$file/zygisk" ] && ! [ -f "$file/disable" ]; then
+      if [ -f "$file/service.sh" ]; then
+        cd "$file"
+        log -p i -t "zygisksu" "Manually trigger service.sh for $file"
+        sh "$(realpath ./service.sh)"
+        cd "$MODDIR"
+      fi
+    fi
+  done
+fi
+
+log -p i -t "zygisksu" "Start watchdog"
+[ "$DEBUG" = true ] && export RUST_BACKTRACE=1
+exec "bin/zygiskwd" "watchdog" >/dev/null 2>&1

settings.gradle.kts

@@ -7,8 +7,8 @@ pluginManagement {
         gradlePluginPortal()
     }
     plugins {
-        id("com.android.library") version "7.4.0"
-        id("com.android.application") version "7.4.0"
+        id("com.android.library") version "7.4.1"
+        id("com.android.application") version "7.4.1"
     }
 }
 

zygiskd/Cargo.toml

@@ -6,17 +6,22 @@ edition = "2021"
 rust-version = "1.67"
 
 [dependencies]
-android_logger = "0.12.0"
+android_logger = "0.13.0"
 anyhow = { version = "1.0.68", features = ["backtrace"] }
 clap = { version = "4.1.4", features = ["derive"] }
 const_format = "0.2.5"
+konst = "0.3.4"
+lazy_static = "1.4.0"
 log = "0.4.17"
 memfd = "0.6.2"
 nix = "0.26.2"
 num_enum = "0.5.9"
+once_cell = "1.17.1"
 passfd = "0.1.5"
 rand = "0.8.5"
 
+binder = { git = "https://github.com/Kernel-SU/binder_rs" }
+
 [profile.release]
 strip = true
 opt-level = "z"

zygiskd/build.gradle.kts

@@ -5,6 +5,9 @@ plugins {
 
 val verName: String by rootProject.extra
 val verCode: Int by rootProject.extra
+val minKsuVersion: Int by rootProject.extra
+val maxKsuVersion: Int by rootProject.extra
+val minMagiskVersion: Int by rootProject.extra
 
 android.buildFeatures {
     androidResources = false
@@ -20,7 +23,11 @@ cargo {
     val isDebug = gradle.startParameter.taskNames.any { it.toLowerCase().contains("debug") }
     profile = if (isDebug) "debug" else "release"
     exec = { spec, _ ->
+        spec.environment("ANDROID_NDK_HOME", android.ndkDirectory.path)
         spec.environment("VERSION_CODE", verCode)
         spec.environment("VERSION_NAME", verName)
+        spec.environment("MIN_KSU_VERSION", minKsuVersion)
+        spec.environment("MAX_KSU_VERSION", maxKsuVersion)
+        spec.environment("MIN_MAGISK_VERSION", minMagiskVersion)
     }
 }

zygiskd/src/constants.rs

@@ -1,36 +1,40 @@
 use const_format::concatcp;
+use konst::primitive::parse_i32;
+use konst::unwrap_ctx;
 use log::LevelFilter;
 use num_enum::TryFromPrimitive;
 
 pub const VERSION_NAME: &str = env!("VERSION_NAME");
 pub const VERSION_CODE: &str = env!("VERSION_CODE");
 pub const VERSION_FULL: &str = concatcp!(VERSION_NAME, " (", VERSION_CODE, ")");
+pub const MIN_KSU_VERSION: i32 = unwrap_ctx!(parse_i32(env!("MIN_KSU_VERSION")));
+pub const MAX_KSU_VERSION: i32 = unwrap_ctx!(parse_i32(env!("MAX_KSU_VERSION")));
+pub const MIN_MAGISK_VERSION: i32 = unwrap_ctx!(parse_i32(env!("MIN_MAGISK_VERSION")));
 
 #[cfg(debug_assertions)]
 pub const MAX_LOG_LEVEL: LevelFilter = LevelFilter::Trace;
 #[cfg(not(debug_assertions))]
 pub const MAX_LOG_LEVEL: LevelFilter = LevelFilter::Info;
 
-#[cfg(target_pointer_width = "64")]
-#[macro_export]
-macro_rules! lp_select {
-    ($lp32:expr, $lp64:expr) => { $lp64 };
-}
-#[cfg(target_pointer_width = "32")]
-#[macro_export]
-macro_rules! lp_select {
-    ($lp32:expr, $lp64:expr) => { $lp32 };
-}
-
 pub const PROP_NATIVE_BRIDGE: &str = "ro.dalvik.vm.native.bridge";
+pub const PROP_CTL_RESTART: &str = "ctl.restart";
+pub const ZYGISK_LOADER: &str = "libzygisk_loader.so";
 
 pub const SOCKET_PLACEHOLDER: &str = "socket_placeholder";
 
-pub const PATH_KSU_MODULE_DIR: &str = "/data/adb/ksu/modules";
-pub const PATH_ZYGISKSU_DIR: &str = concatcp!(PATH_KSU_MODULE_DIR, "/zygisksu");
-pub const PATH_ZYGISKD32: &str = concatcp!(PATH_ZYGISKSU_DIR, "/bin/zygiskd32");
-pub const PATH_ZYGISKD64: &str = concatcp!(PATH_ZYGISKSU_DIR, "/bin/zygiskd64");
-pub const PATH_DAEMON_LOCK: &str = concatcp!(PATH_ZYGISKSU_DIR, "/zygiskd.lock");
+pub const PATH_MODULES_DIR: &str = "..";
+pub const PATH_MODULE_PROP: &str = "module.prop";
+pub const PATH_ZYGISKD32: &str = "bin/zygiskd32";
+pub const PATH_ZYGISKD64: &str = "bin/zygiskd64";
+pub const PATH_TMP_DIR: &str = concatcp!("/dev/", SOCKET_PLACEHOLDER);
+pub const PATH_TMP_PROP: &str = concatcp!("/dev/", SOCKET_PLACEHOLDER, "/module.prop");
+
+pub const STATUS_LOADED: &str = "😋 Zygisksu is loaded";
+pub const STATUS_CRASHED: &str = "❌ Zygiskd has crashed";
+pub const STATUS_ROOT_IMPL_NONE: &str = "❌ Unknown root implementation";
+pub const STATUS_ROOT_IMPL_TOO_OLD: &str = "❌ Root implementation version too old";
+pub const STATUS_ROOT_IMPL_ABNORMAL: &str = "❌ Abnormal root implementation version";
+pub const STATUS_ROOT_IMPL_MULTIPLE: &str = "❌ Multiple root implementations installed";
 
 #[derive(Debug, Eq, PartialEq, TryFromPrimitive)]
 #[repr(u8)]
@@ -38,7 +42,15 @@ pub enum DaemonSocketAction {
     PingHeartbeat,
     RequestLogcatFd,
     ReadNativeBridge,
+    GetProcessFlags,
     ReadModules,
     RequestCompanionSocket,
     GetModuleDir,
 }
+
+// Zygisk process flags
+pub const PROCESS_GRANTED_ROOT: u32 = 1 << 0;
+pub const PROCESS_ON_DENYLIST: u32 = 1 << 1;
+pub const PROCESS_ROOT_IS_KSU: u32 = 1 << 29;
+pub const PROCESS_ROOT_IS_MAGISK: u32 = 1 << 30;
+pub const PROCESS_IS_SYSUI: u32 = 1 << 31;

zygiskd/src/dl.rs

@@ -76,7 +76,7 @@ pub unsafe fn dlopen(path: &str, flags: i32) -> Result<*mut c_void> {
     let result = android_dlopen_ext(filename, flags, &info);
     if result.is_null() {
         let e = std::ffi::CStr::from_ptr(libc::dlerror()).to_string_lossy();
-        bail!("dlopen failed: {}", e);
+        bail!(e);
     }
     Ok(result)
 }

zygiskd/src/main.rs

@@ -3,10 +3,12 @@
 mod companion;
 mod constants;
 mod dl;
+mod root_impl;
 mod utils;
 mod watchdog;
 mod zygiskd;
 
+use anyhow::Result;
 use clap::{Subcommand, Parser};
 
 #[derive(Parser, Debug)]
@@ -35,19 +37,23 @@ fn init_android_logger(tag: &str) {
     );
 }
 
+fn start() -> Result<()> {
+    root_impl::setup();
+    let cli = Args::parse();
+    match cli.command {
+        Commands::Watchdog => watchdog::entry()?,
+        Commands::Daemon => zygiskd::entry()?,
+        Commands::Companion { fd } => companion::entry(fd)?,
+    };
+    Ok(())
+}
+
 fn main() {
     let process = std::env::args().next().unwrap();
     let nice_name = process.split('/').last().unwrap();
     init_android_logger(nice_name);
 
-    let cli = Args::parse();
-    let result = match cli.command {
-        Commands::Watchdog => watchdog::entry(),
-        Commands::Daemon => zygiskd::entry(),
-        Commands::Companion { fd } => companion::entry(fd),
-    };
-
-    if let Err(e) = &result {
+    if let Err(e) = start() {
         log::error!("Crashed: {}\n{}", e, e.backtrace());
     }
 }

zygiskd/src/root_impl/kernelsu.rs

@@ -0,0 +1,41 @@
+use nix::libc::prctl;
+use crate::constants::{MIN_KSU_VERSION, MAX_KSU_VERSION};
+
+const KERNEL_SU_OPTION: i32 = 0xdeadbeefu32 as i32;
+
+const CMD_GET_VERSION: usize = 2;
+const CMD_GET_ALLOW_LIST: usize = 5;
+const CMD_GET_DENY_LIST: usize = 6;
+
+pub enum Version {
+    Supported,
+    TooOld,
+    Abnormal,
+}
+
+pub fn get_kernel_su() -> Option<Version> {
+    let mut version = 0;
+    unsafe { prctl(KERNEL_SU_OPTION, CMD_GET_VERSION, &mut version as *mut i32) };
+    match version {
+        0 => None,
+        MIN_KSU_VERSION..=MAX_KSU_VERSION => Some(Version::Supported),
+        1..=MIN_KSU_VERSION => Some(Version::TooOld),
+        _ => Some(Version::Abnormal)
+    }
+}
+
+pub fn uid_on_allowlist(uid: i32) -> bool {
+    let mut size = 1024u32;
+    let mut uids = vec![0; size as usize];
+    unsafe { prctl(KERNEL_SU_OPTION, CMD_GET_ALLOW_LIST, uids.as_mut_ptr(), &mut size as *mut u32) };
+    uids.resize(size as usize, 0);
+    uids.contains(&uid)
+}
+
+pub fn uid_on_denylist(uid: i32) -> bool {
+    let mut size = 1024u32;
+    let mut uids = vec![0; size as usize];
+    unsafe { prctl(KERNEL_SU_OPTION, CMD_GET_DENY_LIST, uids.as_mut_ptr(), &mut size as *mut u32) };
+    uids.resize(size as usize, 0);
+    uids.contains(&uid)
+}

zygiskd/src/root_impl/magisk.rs

@@ -0,0 +1,46 @@
+use std::process::{Command, Stdio};
+use crate::constants::MIN_MAGISK_VERSION;
+
+pub enum Version {
+    Supported,
+    TooOld,
+}
+
+pub fn get_magisk() -> Option<Version> {
+    let version: Option<i32> = Command::new("magisk")
+        .arg("-V")
+        .stdout(Stdio::piped())
+        .spawn().ok()
+        .and_then(|child| child.wait_with_output().ok())
+        .and_then(|output| String::from_utf8(output.stdout).ok())
+        .and_then(|output| output.trim().parse().ok());
+    version.map(|version| {
+        if version >= MIN_MAGISK_VERSION {
+            Version::Supported
+        } else {
+            Version::TooOld
+        }
+    })
+}
+
+pub fn uid_on_allowlist(uid: i32) -> bool {
+    let output: Option<String> = Command::new("magisk")
+        .arg("--sqlite")
+        .arg("select uid from policies where policy=2")
+        .stdout(Stdio::piped())
+        .spawn().ok()
+        .and_then(|child| child.wait_with_output().ok())
+        .and_then(|output| String::from_utf8(output.stdout).ok());
+    let lines = match &output {
+        Some(output) => output.lines(),
+        None => return false,
+    };
+    lines.into_iter().any(|line| {
+        line.trim().strip_prefix("uid=").and_then(|uid| uid.parse().ok()) == Some(uid)
+    })
+}
+
+pub fn uid_on_denylist(uid: i32) -> bool {
+    // TODO: uid_on_denylist
+    return false;
+}

zygiskd/src/root_impl/mod.rs

@@ -0,0 +1,61 @@
+mod kernelsu;
+mod magisk;
+
+pub enum RootImpl {
+    None,
+    TooOld,
+    Abnormal,
+    Multiple,
+    KernelSU,
+    Magisk,
+}
+
+// FIXME: OnceCell bugs on 32 bit
+static mut ROOT_IMPL: RootImpl = RootImpl::None;
+
+pub fn setup() {
+    let ksu_version = kernelsu::get_kernel_su();
+    let magisk_version = magisk::get_magisk();
+
+    let impl_ = match (ksu_version, magisk_version) {
+        (None, None) => RootImpl::None,
+        (Some(_), Some(_)) => RootImpl::Multiple,
+        (Some(ksu_version), None) => {
+            match ksu_version {
+                kernelsu::Version::Supported => RootImpl::KernelSU,
+                kernelsu::Version::TooOld => RootImpl::TooOld,
+                kernelsu::Version::Abnormal => RootImpl::Abnormal,
+            }
+        }
+        (None, Some(magisk_version)) => {
+            match magisk_version {
+                magisk::Version::Supported => RootImpl::Magisk,
+                magisk::Version::TooOld => RootImpl::TooOld,
+            }
+        }
+    };
+    unsafe { ROOT_IMPL = impl_; }
+}
+
+pub fn get_impl() -> &'static RootImpl {
+    unsafe { &ROOT_IMPL }
+}
+
+// FIXME: Without #[inline(never)], this function will lag forever
+#[inline(never)]
+pub fn uid_on_allowlist(uid: i32) -> bool {
+    match get_impl() {
+        RootImpl::KernelSU => kernelsu::uid_on_allowlist(uid),
+        RootImpl::Magisk => magisk::uid_on_allowlist(uid),
+        _ => unreachable!(),
+    }
+}
+
+#[inline(never)]
+pub fn uid_on_denylist(uid: i32) -> bool {
+    match get_impl() {
+        RootImpl::KernelSU => kernelsu::uid_on_denylist(uid),
+        RootImpl::Magisk => magisk::uid_on_denylist(uid),
+        _ => unreachable!(),
+    }
+}

zygiskd/src/utils.rs

@@ -1,12 +1,23 @@
-use crate::constants;
 use anyhow::Result;
 use nix::unistd::gettid;
 use std::{fs, io::{Read, Write}, os::unix::net::UnixStream, process::Command};
+use std::ffi::c_char;
 use std::os::fd::FromRawFd;
 use std::os::unix::net::UnixListener;
 use nix::sys::socket::{AddressFamily, SockFlag, SockType, UnixAddr};
 use rand::distributions::{Alphanumeric, DistString};
 
+#[cfg(target_pointer_width = "64")]
+#[macro_export]
+macro_rules! lp_select {
+    ($lp32:expr, $lp64:expr) => { $lp64 };
+}
+#[cfg(target_pointer_width = "32")]
+#[macro_export]
+macro_rules! lp_select {
+    ($lp32:expr, $lp64:expr) => { $lp32 };
+}
+
 pub fn random_string() -> String {
     Alphanumeric.sample_string(&mut rand::thread_rng(), 8)
 }
@@ -27,10 +38,28 @@ pub fn get_native_bridge() -> String {
     std::env::var("NATIVE_BRIDGE").unwrap_or_default()
 }
 
-pub fn restore_native_bridge() -> Result<()> {
+pub fn log_raw(level: i32, tag: &str, message: &str) -> Result<()> {
+    let tag = std::ffi::CString::new(tag)?;
+    let message = std::ffi::CString::new(message)?;
+    unsafe {
+        __android_log_print(level as i32, tag.as_ptr(), message.as_ptr());
+    }
+    Ok(())
+}
+
+pub fn get_property(name: &str) -> Result<String> {
+    let name = std::ffi::CString::new(name)?;
+    let mut buf = vec![0u8; 92];
+    unsafe {
+        __system_property_get(name.as_ptr(), buf.as_mut_ptr() as *mut c_char);
+    }
+    Ok(String::from_utf8(buf)?)
+}
+
+pub fn set_property(name: &str, value: &str) -> Result<()> {
     Command::new("resetprop")
-        .arg(constants::PROP_NATIVE_BRIDGE)
-        .arg(get_native_bridge())
+        .arg(name)
+        .arg(value)
         .spawn()?.wait()?;
     Ok(())
 }
@@ -41,6 +70,7 @@ pub trait UnixStreamExt {
     fn read_usize(&mut self) -> Result<usize>;
     fn read_string(&mut self) -> Result<String>;
     fn write_u8(&mut self, value: u8) -> Result<()>;
+    fn write_u32(&mut self, value: u32) -> Result<()>;
     fn write_usize(&mut self, value: usize) -> Result<()>;
     fn write_string(&mut self, value: &str) -> Result<()>;
 }
@@ -76,6 +106,11 @@ impl UnixStreamExt for UnixStream {
         Ok(())
     }
 
+    fn write_u32(&mut self, value: u32) -> Result<()> {
+        self.write_all(&value.to_ne_bytes())?;
+        Ok(())
+    }
+
     fn write_usize(&mut self, value: usize) -> Result<()> {
         self.write_all(&value.to_ne_bytes())?;
         Ok(())
@@ -97,3 +132,8 @@ pub fn abstract_namespace_socket(name: &str) -> Result<UnixListener> {
     let listener = unsafe { UnixListener::from_raw_fd(socket) };
     Ok(listener)
 }
+
+extern "C" {
+    fn __android_log_print(prio: i32, tag: *const c_char, fmt: *const c_char, ...) -> i32;
+    fn __system_property_get(name: *const c_char, value: *mut c_char) -> u32;
+}

zygiskd/src/watchdog.rs

@@ -1,21 +1,35 @@
-use crate::{constants, utils};
+use crate::{constants, root_impl, utils};
 use anyhow::{bail, Result};
-use nix::fcntl::{flock, FlockArg};
-use nix::unistd::{getgid, getuid};
-use std::os::unix::prelude::AsRawFd;
+use nix::unistd::{getgid, getuid, Pid};
 use std::process::{Child, Command};
 use std::sync::mpsc;
-use std::{fs, thread};
-use std::path::Path;
+use std::{fs, io, thread};
+use std::ffi::CString;
+use std::io::{BufRead, Write};
+use std::os::unix::net::UnixListener;
 use std::time::Duration;
+use binder::IBinder;
+use nix::errno::Errno;
+use nix::libc;
+use nix::sys::signal::{kill, Signal};
+use once_cell::sync::OnceCell;
 
-static mut LOCK_FILE: Option<fs::File> = None;
+static LOCK: OnceCell<UnixListener> = OnceCell::new();
+static PROP_SECTIONS: OnceCell<[String; 2]> = OnceCell::new();
 
 pub fn entry() -> Result<()> {
     log::info!("Start zygisksu watchdog");
     check_permission()?;
     ensure_single_instance()?;
-    spawn_daemon()
+    mount_prop()?;
+    if check_and_set_hint()? == false {
+        log::warn!("Requirements not met, exiting");
+        utils::set_property(constants::PROP_NATIVE_BRIDGE, &utils::get_native_bridge())?;
+        return Ok(());
+    }
+    let end = spawn_daemon();
+    set_prop_hint(constants::STATUS_CRASHED)?;
+    end
 }
 
 fn check_permission() -> Result<()> {
@@ -32,7 +46,6 @@ fn check_permission() -> Result<()> {
 
     let context = fs::read_to_string("/proc/self/attr/current")?;
     let context = context.trim_end_matches('\0');
-    //TODO: remove magisk context after debug finished
     if context != "u:r:su:s0" && context != "u:r:magisk:s0" {
         bail!("SELinux context incorrect: {context}");
     }
@@ -42,54 +55,138 @@ fn check_permission() -> Result<()> {
 
 fn ensure_single_instance() -> Result<()> {
     log::info!("Ensure single instance");
-    let metadata = fs::metadata(constants::PATH_ZYGISKSU_DIR);
-    if metadata.is_err() || !metadata.unwrap().is_dir() {
-        bail!("Zygisksu is not installed");
-    }
-    unsafe {
-        match fs::File::create(constants::PATH_DAEMON_LOCK) {
-            Ok(file) => LOCK_FILE = Some(file),
-            Err(e) => bail!("Failed to open lock file: {e}"),
-        };
-        let fd = LOCK_FILE.as_ref().unwrap().as_raw_fd();
-        if let Err(e) = flock(fd, FlockArg::LockExclusiveNonblock) {
-            bail!("Failed to acquire lock: {e}. Maybe another instance is running?");
-        }
+    let name = String::from("zygiskwd") + constants::SOCKET_PLACEHOLDER;
+    match utils::abstract_namespace_socket(&name) {
+        Ok(socket) => { let _ = LOCK.set(socket); }
+        Err(e) => bail!("Failed to acquire lock: {e}. Maybe another instance is running?")
     }
     Ok(())
 }
 
-fn spawn_daemon() -> Result<()> {
-    let daemon32 = Command::new(constants::PATH_ZYGISKD32).arg("daemon").spawn();
-    let daemon64 = Command::new(constants::PATH_ZYGISKD64).arg("daemon").spawn();
-    let (sender, receiver) = mpsc::channel();
-    let mut waiting = vec![];
-    let mut spawn = |mut daemon: Child, socket: &'static str| {
-        waiting.push(socket);
-        let sender = sender.clone();
-        thread::spawn(move || {
-            let result = daemon.wait().unwrap();
-            log::error!("Daemon process {} died: {}", daemon.id(), result);
-            drop(daemon);
-            sender.send(()).unwrap();
-        });
+fn mount_prop() -> Result<()> {
+    let module_prop = if let root_impl::RootImpl::Magisk = root_impl::get_impl() {
+        let magisk_path = Command::new("magisk").arg("--path").output()?;
+        let mut magisk_path = String::from_utf8(magisk_path.stdout)?;
+        magisk_path.pop(); // Removing '\n'
+        let cwd = std::env::current_dir()?;
+        let dir = cwd.file_name().unwrap().to_string_lossy();
+        format!("{magisk_path}/.magisk/modules/{dir}/{}", constants::PATH_MODULE_PROP)
+    } else {
+        constants::PATH_MODULE_PROP.to_string()
     };
-    if let Ok(it) = daemon32 { spawn(it, "/dev/socket/zygote_secondary") }
-    if let Ok(it) = daemon64 { spawn(it, "/dev/socket/zygote") }
+    log::info!("Mount {module_prop}");
+    let module_prop_file = fs::File::open(&module_prop)?;
+    let mut section = 0;
+    let mut sections: [String; 2] = [String::new(), String::new()];
+    let lines = io::BufReader::new(module_prop_file).lines();
+    for line in lines {
+        let line = line?;
+        if line.starts_with("description=") {
+            sections[0].push_str("description=");
+            sections[1].push_str(line.trim_start_matches("description="));
+            sections[1].push('\n');
+            section = 1;
+        } else {
+            sections[section].push_str(&line);
+            sections[section].push('\n');
+        }
+    }
+    let _ = PROP_SECTIONS.set(sections);
 
-    waiting.into_iter().for_each(|socket| wait_zygote(socket));
-    log::info!("Zygote ready, restore native bridge");
-    utils::restore_native_bridge()?;
+    fs::create_dir(constants::PATH_TMP_DIR)?;
+    fs::File::create(constants::PATH_TMP_PROP)?;
 
-    let _ = receiver.recv();
-    bail!("Daemon process died");
+    // FIXME: sys_mount cannot be compiled on 32 bit
+    unsafe {
+        let r = libc::mount(
+            CString::new(constants::PATH_TMP_PROP)?.as_ptr(),
+            CString::new(module_prop)?.as_ptr(),
+            std::ptr::null(),
+            libc::MS_BIND,
+            std::ptr::null(),
+        );
+        Errno::result(r)?;
+    }
+
+    Ok(())
 }
 
-fn wait_zygote(socket: &str) -> () {
-    let path = Path::new(socket);
+fn set_prop_hint(hint: &str) -> Result<()> {
+    let mut file = fs::File::create(constants::PATH_TMP_PROP)?;
+    let sections = PROP_SECTIONS.get().unwrap();
+    file.write_all(sections[0].as_bytes())?;
+    file.write_all(b"[")?;
+    file.write_all(hint.as_bytes())?;
+    file.write_all(b"] ")?;
+    file.write_all(sections[1].as_bytes())?;
+    Ok(())
+}
+
+fn check_and_set_hint() -> Result<bool> {
+    let root_impl = root_impl::get_impl();
+    match root_impl {
+        root_impl::RootImpl::None => set_prop_hint(constants::STATUS_ROOT_IMPL_NONE)?,
+        root_impl::RootImpl::TooOld => set_prop_hint(constants::STATUS_ROOT_IMPL_TOO_OLD)?,
+        root_impl::RootImpl::Abnormal => set_prop_hint(constants::STATUS_ROOT_IMPL_ABNORMAL)?,
+        root_impl::RootImpl::Multiple => set_prop_hint(constants::STATUS_ROOT_IMPL_MULTIPLE)?,
+        _ => {
+            set_prop_hint(constants::STATUS_LOADED)?;
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+fn spawn_daemon() -> Result<()> {
+    let mut lives = 5;
     loop {
-        if path.exists() { return; }
-        log::debug!("{socket} not exists, wait for 1s...");
-        thread::sleep(Duration::from_secs(1));
+        let daemon32 = Command::new(constants::PATH_ZYGISKD32).arg("daemon").spawn();
+        let daemon64 = Command::new(constants::PATH_ZYGISKD64).arg("daemon").spawn();
+        let mut child_ids = vec![];
+        let (sender, receiver) = mpsc::channel();
+        let mut spawn = |mut daemon: Child| {
+            child_ids.push(daemon.id());
+            let sender = sender.clone();
+            thread::spawn(move || {
+                let result = daemon.wait().unwrap();
+                log::error!("Daemon process {} died: {}", daemon.id(), result);
+                drop(daemon);
+                let _ = sender.send(());
+            });
+        };
+        if let Ok(it) = daemon32 { spawn(it) }
+        if let Ok(it) = daemon64 { spawn(it) }
+
+        let mut binder = loop {
+            if receiver.try_recv().is_ok() {
+                bail!("Daemon died before system server ready");
+            }
+            match binder::get_service("activity") {
+                Some(binder) => break binder,
+                None => {
+                    log::trace!("System server not ready, wait for 1s...");
+                    thread::sleep(Duration::from_secs(1));
+                }
+            };
+        };
+        log::info!("System server ready, restore native bridge");
+        utils::set_property(constants::PROP_NATIVE_BRIDGE, &utils::get_native_bridge())?;
+
+        loop {
+            if receiver.try_recv().is_ok() || binder.ping_binder().is_err() { break; }
+            thread::sleep(Duration::from_secs(1))
+        }
+        for child in child_ids {
+            let _ = kill(Pid::from_raw(child as i32), Signal::SIGKILL);
+        }
+
+        lives -= 1;
+        if lives == 0 {
+            bail!("Too many crashes, abort");
+        }
+
+        log::error!("Restarting zygote...");
+        utils::set_property(constants::PROP_NATIVE_BRIDGE, constants::ZYGISK_LOADER)?;
+        utils::set_property(constants::PROP_CTL_RESTART, "zygote")?;
     }
 }

zygiskd/src/zygiskd.rs

@@ -1,6 +1,6 @@
 use crate::constants::DaemonSocketAction;
 use crate::utils::UnixStreamExt;
-use crate::{constants, lp_select, utils};
+use crate::{constants, lp_select, root_impl, utils};
 use anyhow::{bail, Result};
 use memfd::Memfd;
 use nix::{
@@ -10,7 +10,6 @@ use nix::{
 use passfd::FdPassingExt;
 use std::sync::{Arc, Mutex};
 use std::thread;
-use std::ffi::c_char;
 use std::fs;
 use std::os::unix::{
     net::{UnixListener, UnixStream},
@@ -64,20 +63,19 @@ pub fn entry() -> Result<()> {
 }
 
 fn get_arch() -> Result<&'static str> {
-    let output = Command::new("getprop").arg("ro.product.cpu.abi").output()?;
-    let system_arch = String::from_utf8(output.stdout)?;
+    let system_arch = utils::get_property("ro.product.cpu.abi")?;
     if system_arch.contains("arm") {
-        return Ok(lp_select!("armeabi-v7a", "arm64-v8a"))
+        return Ok(lp_select!("armeabi-v7a", "arm64-v8a"));
     }
     if system_arch.contains("x86") {
-        return Ok(lp_select!("x86", "x86_64"))
+        return Ok(lp_select!("x86", "x86_64"));
     }
     bail!("Unsupported system architecture: {}", system_arch);
 }
 
 fn load_modules(arch: &str) -> Result<Vec<Module>> {
     let mut modules = Vec::new();
-    let dir = match fs::read_dir(constants::PATH_KSU_MODULE_DIR) {
+    let dir = match fs::read_dir(constants::PATH_MODULES_DIR) {
         Ok(dir) => dir,
         Err(e) => {
             log::warn!("Failed reading modules directory: {}", e);
@@ -93,7 +91,7 @@ fn load_modules(arch: &str) -> Result<Vec<Module>> {
             continue;
         }
         log::info!("  Loading module `{name}`...");
-        let memfd = match create_memfd(&name, &so_path) {
+        let memfd = match create_memfd(&so_path) {
             Ok(memfd) => memfd,
             Err(e) => {
                 log::warn!("  Failed to create memfd for `{name}`: {e}");
@@ -116,10 +114,9 @@ fn load_modules(arch: &str) -> Result<Vec<Module>> {
     Ok(modules)
 }
 
-fn create_memfd(name: &str, so_path: &PathBuf) -> Result<Memfd> {
+fn create_memfd(so_path: &PathBuf) -> Result<Memfd> {
     let opts = memfd::MemfdOptions::default().allow_sealing(true);
-    let memfd = opts.create(name)?;
-
+    let memfd = opts.create("jit-cache")?;
     let file = fs::File::open(so_path)?;
     let mut reader = std::io::BufReader::new(file);
     let mut writer = memfd.as_file();
@@ -137,8 +134,8 @@ fn create_memfd(name: &str, so_path: &PathBuf) -> Result<Memfd> {
 
 fn create_daemon_socket() -> Result<UnixListener> {
     utils::set_socket_create_context("u:r:zygote:s0")?;
-    let suffix = lp_select!("zygiskd32", "zygiskd64");
-    let name = String::from(suffix) + constants::SOCKET_PLACEHOLDER;
+    let prefix = lp_select!("zygiskd32", "zygiskd64");
+    let name = String::from(prefix) + constants::SOCKET_PLACEHOLDER;
     let listener = utils::abstract_namespace_socket(&name)?;
     log::debug!("Daemon socket: {name}");
     Ok(listener)
@@ -182,17 +179,30 @@ fn handle_daemon_action(mut stream: UnixStream, context: &Context) -> Result<()>
                     Err(_) => break,
                 };
                 let tag = stream.read_string()?;
-                let tag = std::ffi::CString::new(tag)?;
                 let message = stream.read_string()?;
-                let message = std::ffi::CString::new(message)?;
-                unsafe {
-                    __android_log_print(level as i32, tag.as_ptr(), message.as_ptr());
-                }
+                utils::log_raw(level as i32, &tag, &message)?;
             }
         }
         DaemonSocketAction::ReadNativeBridge => {
             stream.write_string(&context.native_bridge)?;
         }
+        DaemonSocketAction::GetProcessFlags => {
+            let uid = stream.read_u32()? as i32;
+            let mut flags = 0u32;
+            if root_impl::uid_on_allowlist(uid) {
+                flags |= constants::PROCESS_GRANTED_ROOT;
+            }
+            if root_impl::uid_on_denylist(uid) {
+                flags |= constants::PROCESS_ON_DENYLIST;
+            }
+            match root_impl::get_impl() {
+                root_impl::RootImpl::KernelSU => flags |= constants::PROCESS_ROOT_IS_KSU,
+                root_impl::RootImpl::Magisk => flags |= constants::PROCESS_ROOT_IS_MAGISK,
+                _ => ()
+            }
+            // TODO: PROCESS_IS_SYSUI?
+            stream.write_u32(flags)?;
+        }
         DaemonSocketAction::ReadModules => {
             stream.write_usize(context.modules.len())?;
             for module in context.modules.iter() {
@@ -221,14 +231,10 @@ fn handle_daemon_action(mut stream: UnixStream, context: &Context) -> Result<()>
         DaemonSocketAction::GetModuleDir => {
             let index = stream.read_usize()?;
             let module = &context.modules[index];
-            let dir = format!("{}/{}", constants::PATH_KSU_MODULE_DIR, module.name);
+            let dir = format!("{}/{}", constants::PATH_MODULES_DIR, module.name);
             let dir = fs::File::open(dir)?;
             stream.send_fd(dir.as_raw_fd())?;
         }
     }
     Ok(())
 }
-
-extern "C" {
-    fn __android_log_print(prio: i32, tag: *const c_char, fmt: *const c_char, ...) -> i32;
-}