Update CI

* Add back 32 bit support & some fix

* fix system server crash on android 10

* Refine code

---------

Co-authored-by: Nullptr <noreply@nullptr.icu>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,73 @@
+name: Bug report/反馈 Bug
+description: Report errors or unexpected behavior./反馈错误或异常行为。
+labels: [bug]
+title: "[Bug] Short description/简单描述"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting issues for Zygisk Next!
+        To make it easier for us to help you please enter detailed information below.
+        Note: We will **NEVER** handle any issue related to root detection or writable system.
+
+        感谢给 Zygisk Next 汇报问题！
+        为了使我们更好地帮助你，请提供以下信息。
+        为了防止重复汇报，标题请务必使用英文。
+        请注意：我们**不会**处理任何有关 root 检测和 system 分区可写相关的问题。
+  - type: textarea
+    attributes:
+      label: Steps to reproduce/复现步骤
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Expected behaviour/预期行为
+      placeholder: Tell us what should happen/正常情况下应该发生什么
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Actual behaviour/实际行为
+      placeholder: Tell us what happens instead/实际上发生了什么
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: KernelSU Module List/KernelSU 模块列表
+      render: Shell
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: Zygisk Next version/Zygisk Next 版本
+      description: Don't use 'latest'. Specify actual version, otherwise your issue will be closed./不要填用“最新版”。给出具体版本号，不然 issue 会被关闭。
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: Android version/Android 版本
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: KernelSU version/KernelSU 版本
+    validations:
+      required: true
+  - type: checkboxes
+    id: latest
+    attributes:
+      label: Version requirement/版本要求
+      options:
+        - label: I am using latest debug CI version of Zygisk Next and enable verbose log/我正在使用最新 CI 调试版本 Zygisk Next 且启用详细日志
+          required: true
+  - type: textarea
+    attributes:
+      label: Logs/日志
+      description: For usage issues, please provide the log zip saved from KernelSU manager; for activation issues, please provide [bugreport](https://developer.android.com/studio/debug/bug-report). Without logs zip, the issue will be closed. /使用问题请提供从 KernelSU 管理器保存的日志压缩包；激活问题请提供 [bugreport](https://developer.android.google.cn/studio/debug/bug-report?hl=zh-cn) 日志。没有日志附件的问题会被关闭。
+      placeholder: Upload logs zip by clicking the bar on the bottom. Upload logs to other websites or using external links is prohibited. /点击文本框底栏上传日志压缩包，禁止上传到其它网站或使用外链提供日志。
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request/新特性请求
+description: Suggest an idea./提出建议
+labels: [enhancement]
+title: "[Feature Request] Short description/简单描述"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Note: We will **NEVER** handle any issue related to root detection or writable system.
+        
+        请注意：我们**不会**处理任何有关 root 检测和 system 分区可写相关的问题。
+  - type: textarea
+    attributes:
+      label: Is your feature request related to a problem?/你的请求是否与某个问题相关？
+      placeholder: A clear and concise description of what the problem is./请清晰准确表述该问题。
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Describe the solution you'd like/描述你想要的解决方案
+      placeholder: A clear and concise description of what you want to happen./请清晰准确描述新特性的预期行为
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Additional context/其他信息
+      placeholder: Add any other context or screenshots about the feature request here./其他关于新特性的信息或者截图
+    validations:
+      required: false

.github/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ master ]
+    tags: [ v* ]
+  pull_request:
+  merge_group:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      CCACHE_COMPILERCHECK: "%compiler% -dumpmachine; %compiler% -dumpversion"
+      CCACHE_NOHASHDIR: "true"
+      CCACHE_HARDLINK: "true"
+      CCACHE_BASEDIR: "${{ github.workspace }}"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          submodules: "recursive"
+          fetch-depth: 0
+
+      - name: Setup Java
+        uses: actions/setup-java@v3
+        with:
+          distribution: "temurin"
+          java-version: "17"
+
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@v2
+        with:
+          gradle-home-cache-cleanup: true
+
+      - name: Setup rust-cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: zygiskd/src -> ../build/intermediates/rust
+          cache-targets: false
+          
+      - name: Setup Rust
+        run: |
+          rustup override set nightly
+          rustup target add aarch64-linux-android
+          rustup target add x86_64-linux-android
+          rustup target add i686-linux-android
+          rustup target add armv7-linux-androideabi
+
+      - name: Set up ccache
+        uses: hendrikmuhs/ccache-action@v1.2
+        with:
+          max-size: 2G
+          key: ${{ runner.os }}
+          restore-keys: ${{ runner.os }}
+          save: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+
+      - name: Build with Gradle
+        run: |
+          echo 'org.gradle.parallel=true' >> gradle.properties
+          echo 'org.gradle.vfs.watch=true' >> gradle.properties
+          echo 'org.gradle.jvmargs=-Xmx2048m' >> gradle.properties
+          echo 'android.native.buildOutput=verbose' >> gradle.properties
+          sed -i 's/org.gradle.unsafe.configuration-cache=true//g' gradle.properties
+          ./gradlew zipRelease
+          ./gradlew zipDebug
+
+      - name: Prepare artifact
+        if: success()
+        id: prepareArtifact
+        run: |
+          releaseName=`ls module/build/outputs/release/Zygisk-Next-v*-release.zip | awk -F '(/|.zip)' '{print $5}'` && echo "releaseName=$releaseName" >> $GITHUB_OUTPUT
+          debugName=`ls module/build/outputs/release/Zygisk-Next-v*-debug.zip | awk -F '(/|.zip)' '{print $5}'` && echo "debugName=$debugName" >> $GITHUB_OUTPUT
+          unzip module/build/outputs/release/Zygisk-Next-v*-release.zip -d zksu-release
+          unzip module/build/outputs/release/Zygisk-Next-v*-debug.zip -d zksu-debug
+
+      - name: Upload release
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ steps.prepareArtifact.outputs.releaseName }}
+          path: "./zksu-release/*"
+
+      - name: Upload debug
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ steps.prepareArtifact.outputs.debugName }}
+          path: "./zksu-debug/*"

.github/workflows/issue_moderator.yml

@@ -0,0 +1,23 @@
+name: Issue moderator
+
+on:
+  issues:
+    types: [opened, edited, reopened]
+
+jobs:
+  autoclose:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check issue
+        uses: tachiyomiorg/issue-moderator-action@v1
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          auto-close-rules: |
+            [
+              {
+                "type": "title",
+                "regex": ".*(Short description|简单描述).*",
+                "message": "You did not fill out the description in the title/你没有填写标题"
+              }
+            ]
+          auto-close-ignore-label: do-not-autoclose

README.md

@@ -1,26 +1,27 @@
-# Zygisk on KernelSU
+# Zygisk Next
 
-Zygisk loader for KernelSU, allowing Zygisk modules to run without Magisk environment.
-
-Also works as standalone loader for Magisk on purpose of getting rid of LD_PRELOAD.
+Standalone implementation of Zygisk, providing Zygisk API support for KernelSU and a replacement of Magisk's built-in Zygisk.
 
 ## Requirements
 
 ### General
 
 + No multiple root implementation installed
++ SELinux enforcing: Zygisk Next rely on SELinux to prevent `vold` from aborting our fuse connection
 
 ### KernelSU
 
-+ Minimal KernelSU version: 10654
-+ Minimal ksud version: 10670
++ Minimal KernelSU version: 10940
++ Minimal ksud version: 10942
 + Kernel has full SELinux patch support
 
 ### Magisk
 
-+ Minimal version: 25208
-+ Original Zygisk turned off
++ Minimal version: 26300
++ Built-in Zygisk turned off
 
 ## Compatibility
 
-Should work with everything except those rely on Magisk internal behaviors.
+`PROCESS_ON_DENYLIST` cannot be flagged correctly for isolated processes on Magisk DenyList currently.
+
+Zygisk Next only guarantees the same behavior of Zygisk API, but will NOT ensure Magisk's internal features.

build.gradle.kts

@@ -2,18 +2,7 @@ import com.android.build.gradle.LibraryExtension
 import java.io.ByteArrayOutputStream
 
 plugins {
-    id("com.android.application") apply false
-    id("com.android.library") apply false
-}
-
-buildscript {
-    repositories {
-        maven("https://plugins.gradle.org/m2/")
-    }
-    dependencies {
-        classpath("org.eclipse.jgit:org.eclipse.jgit:6.4.0.202211300538-r")
-        classpath("org.mozilla.rust-android-gradle:plugin:0.9.3")
-    }
+    alias(libs.plugins.agp.lib) apply false
 }
 
 fun String.execute(currentWorkingDir: File = file("./")): String {
@@ -30,19 +19,20 @@ val gitCommitCount = "git rev-list HEAD --count".execute().toInt()
 val gitCommitHash = "git rev-parse --verify --short HEAD".execute()
 
 val moduleId by extra("zygisksu")
-val moduleName by extra("Zygisk on KernelSU")
-val verName by extra("v4-0.6.2")
+val moduleName by extra("Zygisk Next")
+val verName by extra("v4-0.8.1")
 val verCode by extra(gitCommitCount)
-val minKsuVersion by extra(10654)
-val minKsudVersion by extra(10670)
+val commitHash by extra(gitCommitHash)
+val minKsuVersion by extra(10940)
+val minKsudVersion by extra(10942)
 val maxKsuVersion by extra(20000)
-val minMagiskVersion by extra(25208)
+val minMagiskVersion by extra(26300)
 
 val androidMinSdkVersion by extra(29)
-val androidTargetSdkVersion by extra(33)
-val androidCompileSdkVersion by extra(33)
-val androidBuildToolsVersion by extra("33.0.2")
-val androidCompileNdkVersion by extra("25.2.9519653")
+val androidTargetSdkVersion by extra(34)
+val androidCompileSdkVersion by extra(34)
+val androidBuildToolsVersion by extra("34.0.0")
+val androidCompileNdkVersion by extra("26.0.10792818")
 val androidSourceCompatibility by extra(JavaVersion.VERSION_11)
 val androidTargetCompatibility by extra(JavaVersion.VERSION_11)
 
@@ -52,7 +42,7 @@ tasks.register("Delete", Delete::class) {
 
 fun Project.configureBaseExtension() {
     extensions.findByType(LibraryExtension::class)?.run {
-        namespace = "icu.nullptr.zygisksu"
+        namespace = "icu.nullptr.zygisk.next"
         compileSdk = androidCompileSdkVersion
         ndkVersion = androidCompileNdkVersion
         buildToolsVersion = androidBuildToolsVersion

gradle.properties

@@ -20,4 +20,4 @@ kotlin.code.style=official
 # Enables namespacing of each library's R class so that its R class includes only the
 # resources declared in the library itself and none from the library's dependencies,
 # thereby reducing the size of the R class for that library
-android.nonTransitiveRClass=true
+android.nonTransitiveRClass=true

gradle/libs.versions.toml

@@ -0,0 +1,9 @@
+[versions]
+agp = "8.1.2"
+kotlin = "1.9.10"
+
+[plugins]
+agp-lib = { id = "com.android.library", version.ref = "agp" }
+kotlin = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
+lsplugin-jgit = { id = "org.lsposed.lsplugin.jgit", version = "1.1" }
+rust-android = { id = "org.mozilla.rust-android-gradle.rust-android", version = "0.9.3" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.0-bin.zip
 distributionPath=wrapper/dists
-zipStorePath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

loader/build.gradle.kts

@@ -1,5 +1,24 @@
+import java.nio.file.Paths
+import org.gradle.internal.os.OperatingSystem
+
 plugins {
-    id("com.android.library")
+    alias(libs.plugins.agp.lib)
+}
+
+fun Project.findInPath(executable: String, property: String): String? {
+    val pathEnv = System.getenv("PATH")
+    return pathEnv.split(File.pathSeparator).map { folder ->
+        Paths.get("${folder}${File.separator}${executable}${if (OperatingSystem.current().isWindows) ".exe" else ""}")
+            .toFile()
+    }.firstOrNull { path ->
+        path.exists()
+    }?.absolutePath ?: properties.getOrDefault(property, null) as? String?
+}
+
+val ccachePatch by lazy {
+    project.findInPath("ccache", "ccache.path")?.also {
+        println("loader: Use ccache: $it")
+    }
 }
 
 android {
@@ -12,6 +31,16 @@ android {
     externalNativeBuild.ndkBuild {
         path("src/Android.mk")
     }
+
+    defaultConfig {
+        externalNativeBuild {
+            ndkBuild {
+                ccachePatch?.let {
+                    arguments += "NDK_CCACHE=$it"
+                }
+            }
+        }
+    }
 }
 
 dependencies {

loader/src/Android.mk

@@ -13,16 +13,7 @@ LOCAL_LDLIBS           := -llog
 include $(BUILD_STATIC_LIBRARY)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE           := zygisk_loader
-LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
-FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/loader))
-LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)
-LOCAL_STATIC_LIBRARIES := cxx common
-LOCAL_LDLIBS           := -llog
-include $(BUILD_SHARED_LIBRARY)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE           := zygisk_injector
+LOCAL_MODULE           := zygisk
 LOCAL_C_INCLUDES       := $(LOCAL_PATH)/include
 FILE_LIST              := $(filter %.cpp, $(call walk, $(LOCAL_PATH)/injector))
 LOCAL_SRC_FILES        := $(FILE_LIST:COMMON_FILE_LIST:$(LOCAL_PATH)/%=%)

loader/src/common/daemon.cpp

@@ -14,13 +14,13 @@ namespace zygiskd {
                 .sun_family = AF_UNIX,
                 .sun_path={0},
         };
-        strncpy(addr.sun_path + 1, kZygiskSocket.data(), kZygiskSocket.size());
-        socklen_t socklen = sizeof(sa_family_t) + strlen(addr.sun_path + 1) + 1;
+        strcpy(addr.sun_path, kCPSocketPath);
+        socklen_t socklen = sizeof(addr);
 
         while (retry--) {
             int r = connect(fd, reinterpret_cast<struct sockaddr*>(&addr), socklen);
             if (r == 0) return fd;
-            LOGW("retrying to connect to zygiskd, sleep 1s");
+            LOGW("Retrying to connect to zygiskd, sleep 1s");
             sleep(1);
         }
 
@@ -48,16 +48,6 @@ namespace zygiskd {
         return fd;
     }
 
-    std::string ReadNativeBridge() {
-        UniqueFd fd = Connect(1);
-        if (fd == -1) {
-            PLOGE("ReadNativeBridge");
-            return "";
-        }
-        socket_utils::write_u8(fd, (uint8_t) SocketAction::ReadNativeBridge);
-        return socket_utils::read_string(fd);
-    }
-
     uint32_t GetProcessFlags(uid_t uid) {
         UniqueFd fd = Connect(1);
         if (fd == -1) {
@@ -97,6 +87,7 @@ namespace zygiskd {
         if (socket_utils::read_u8(fd) == 1) {
             return fd;
         } else {
+            close(fd);
             return -1;
         }
     }

loader/src/common/dl.cpp

@@ -44,8 +44,17 @@ void* DlopenExt(const char* path, int flags) {
     return handle;
 }
 
-void* DlopenMem(int memfd, int flags) {
-    char path[PATH_MAX];
-    sprintf(path, "/proc/self/fd/%d", memfd);
-    return DlopenExt(path, flags);
+void* DlopenMem(int fd, int flags) {
+    auto info = android_dlextinfo{
+        .flags = ANDROID_DLEXT_USE_LIBRARY_FD,
+        .library_fd = fd
+    };
+
+    auto* handle = android_dlopen_ext("/jit-cache", flags, &info);
+    if (handle) {
+        LOGD("dlopen fd %d: %p", fd, handle);
+    } else {
+        LOGE("dlopen fd %d: %s", fd, dlerror());
+    }
+    return handle;
 }

loader/src/external/Android.mk

@@ -16,5 +16,6 @@ include $(BUILD_STATIC_LIBRARY)
 # Header only library
 include $(CLEAR_VARS)
 LOCAL_MODULE:= libphmap
+LOCAL_CFLAGS := -Wno-unused-value
 LOCAL_EXPORT_C_INCLUDES := $(LOCAL_PATH)/parallel-hashmap
 include $(BUILD_STATIC_LIBRARY)

loader/src/include/api.hpp

@@ -26,14 +26,40 @@
 #define ZYGISK_API_VERSION 4
 
 /*
+
+***************
+* Introduction
+***************
+
+On Android, all app processes are forked from a special daemon called "Zygote".
+For each new app process, zygote will fork a new process and perform "specialization".
+This specialization operation enforces the Android security sandbox on the newly forked
+process to make sure that 3rd party application code is only loaded after it is being
+restricted within a sandbox.
+
+On Android, there is also this special process called "system_server". This single
+process hosts a significant portion of system services, which controls how the
+Android operating system and apps interact with each other.
+
+The Zygisk framework provides a way to allow developers to build modules and run custom
+code before and after system_server and any app processes' specialization.
+This enable developers to inject code and alter the behavior of system_server and app processes.
+
+Please note that modules will only be loaded after zygote has forked the child process.
+THIS MEANS ALL OF YOUR CODE RUNS IN THE APP/SYSTEM_SERVER PROCESS, NOT THE ZYGOTE DAEMON!
+
+*********************
+* Development Guide
+*********************
+
 Define a class and inherit zygisk::ModuleBase to implement the functionality of your module.
 Use the macro REGISTER_ZYGISK_MODULE(className) to register that class to Zygisk.
-Please note that modules will only be loaded after zygote has forked the child process.
-THIS MEANS ALL OF YOUR CODE RUNS IN THE APP/SYSTEM SERVER PROCESS, NOT THE ZYGOTE DAEMON!
+
 Example code:
+
 static jint (*orig_logger_entry_max)(JNIEnv *env);
 static jint my_logger_entry_max(JNIEnv *env) { return orig_logger_entry_max(env); }
-static void example_handler(int socket) { ... }
+
 class ExampleModule : public zygisk::ModuleBase {
 public:
     void onLoad(zygisk::Api *api, JNIEnv *env) override {
@@ -51,8 +77,26 @@ private:
     zygisk::Api *api;
     JNIEnv *env;
 };
+
 REGISTER_ZYGISK_MODULE(ExampleModule)
+
+-----------------------------------------------------------------------------------------
+
+Since your module class's code runs with either Zygote's privilege in pre[XXX]Specialize,
+or runs in the sandbox of the target process in post[XXX]Specialize, the code in your class
+never runs in a true superuser environment.
+
+If your module require access to superuser permissions, you can create and register
+a root companion handler function. This function runs in a separate root companion
+daemon process, and an Unix domain socket is provided to allow you to perform IPC between
+your target process and the root companion process.
+
+Example code:
+
+static void example_handler(int socket) { ... }
+
 REGISTER_ZYGISK_COMPANION(example_handler)
+
 */
 
 namespace zygisk {
@@ -84,7 +128,7 @@ namespace zygisk {
 
         // This method is called after the app process is specialized.
         // At this point, the process has all sandbox restrictions enabled for this application.
-        // This means that this method runs as the same privilege of the app's own code.
+        // This means that this method runs with the same privilege of the app's own code.
         virtual void postAppSpecialize([[maybe_unused]] const AppSpecializeArgs *args) {}
 
         // This method is called before the system server process is specialized.
@@ -219,7 +263,16 @@ namespace zygisk {
         // will be set to nullptr.
         void hookJniNativeMethods(JNIEnv *env, const char *className, JNINativeMethod *methods, int numMethods);
 
-        // For ELFs loaded in memory matching `inode`, replace function `symbol` with `newFunc`.
+        // Hook functions in the PLT (Procedure Linkage Table) of ELFs loaded in memory.
+        //
+        // Parsing /proc/[PID]/maps will give you the memory map of a process. As an example:
+        //
+        //       <address>       <perms>  <offset>   <dev>  <inode>           <pathname>
+        // 56b4346000-56b4347000  r-xp    00002000   fe:00    235       /system/bin/app_process64
+        // (More details: https://man7.org/linux/man-pages/man5/proc.5.html)
+        //
+        // The `dev` and `inode` pair uniquely identifies a file being mapped into memory.
+        // For matching ELFs loaded in memory, replace function `symbol` with `newFunc`.
         // If `oldFunc` is not nullptr, the original function pointer will be saved to `oldFunc`.
         void pltHookRegister(dev_t dev, ino_t inode, const char *symbol, void *newFunc, void **oldFunc);
 
@@ -243,11 +296,11 @@ void zygisk_module_entry(zygisk::internal::api_table *table, JNIEnv *env) { \
 //
 // The function runs in a superuser daemon process and handles a root companion request from
 // your module running in a target process. The function has to accept an integer value,
-// which is a socket that is connected to the target process.
+// which is a Unix domain socket that is connected to the target process.
 // See Api::connectCompanion() for more info.
 //
 // NOTE: the function can run concurrently on multiple threads.
-// Be aware of race conditions if you have a globally shared resource.
+// Be aware of race conditions if you have globally shared resources.
 
 #define REGISTER_ZYGISK_COMPANION(func) \
 void zygisk_companion_entry(int client) { func(client); }

loader/src/include/daemon.h

@@ -10,7 +10,8 @@
 #else
 # define LP_SELECT(lp32, lp64) lp32
 #endif
-constexpr std::string_view kZygiskSocket = LP_SELECT("zygiskd32", "zygiskd64") "socket_placeholder";
+
+constexpr auto kCPSocketPath = "/dev/zygisk/" LP_SELECT("cp32", "cp64") ".sock";
 
 class UniqueFd {
     using Fd = int;
@@ -19,7 +20,7 @@ public:
 
     UniqueFd(Fd fd) : fd_(fd) {}
 
-    ~UniqueFd() { close(fd_); }
+    ~UniqueFd() { if (fd_ >= 0) close(fd_); }
 
     // Disallow copy
     UniqueFd(const UniqueFd&) = delete;
@@ -53,7 +54,6 @@ namespace zygiskd {
     enum class SocketAction {
         PingHeartBeat,
         RequestLogcatFd,
-        ReadNativeBridge,
         GetProcessFlags,
         ReadModules,
         RequestCompanionSocket,
@@ -64,8 +64,6 @@ namespace zygiskd {
 
     int RequestLogcatFd();
 
-    std::string ReadNativeBridge();
-
     std::vector<Module> ReadModules();
 
     uint32_t GetProcessFlags(uid_t uid);

loader/src/include/logging.h

@@ -6,19 +6,12 @@
 
 #ifndef LOG_TAG
 #if defined(__LP64__)
-# define LOG_TAG "zygisksu64"
+# define LOG_TAG "zygisk-core64"
 #else
-# define LOG_TAG "zygisksu32"
+# define LOG_TAG "zygisk-core32"
 #endif
 #endif
 
-#ifdef LOG_DISABLED
-#define LOGD(...)
-#define LOGV(...)
-#define LOGI(...)
-#define LOGW(...)
-#define LOGE(...)
-#else
 #ifndef NDEBUG
 #define LOGD(...)  logging::log(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)
 #define LOGV(...)  logging::log(ANDROID_LOG_VERBOSE, LOG_TAG, __VA_ARGS__)
@@ -31,7 +24,6 @@
 #define LOGE(...)  logging::log(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)
 #define LOGF(...)  logging::log(ANDROID_LOG_FATAL, LOG_TAG, __VA_ARGS__)
 #define PLOGE(fmt, args...) LOGE(fmt " failed with %d: %s", ##args, errno, strerror(errno))
-#endif
 
 namespace logging {
     void setfd(int fd);

loader/src/injector/entry.cpp

@@ -7,22 +7,20 @@ using namespace std;
 
 void *self_handle = nullptr;
 
-[[gnu::destructor]] [[maybe_unused]]
-static void zygisk_cleanup_wait() {
-    if (self_handle) {
-        // Wait 10us to make sure none of our code is executing
-        timespec ts = { .tv_sec = 0, .tv_nsec = 10000L };
-        nanosleep(&ts, nullptr);
-    }
-}
-
 extern "C" [[gnu::visibility("default")]]
-void entry(void *handle) {
+void entry(void* handle) {
+    LOGI("Zygisk library injected");
+    self_handle = handle;
+
+    if (!zygiskd::PingHeartbeat()) {
+        LOGE("Zygisk daemon is not running");
+        return;
+    }
+
 #ifdef NDEBUG
     logging::setfd(zygiskd::RequestLogcatFd());
 #endif
-    self_handle = handle;
 
-    LOGD("Load injector successfully");
+    LOGD("Start hooking");
     hook_functions();
 }

loader/src/injector/hook.cpp

@@ -24,7 +24,9 @@ using jni_hook::hash_map;
 using jni_hook::tree_map;
 using xstring = jni_hook::string;
 
-static bool unhook_functions();
+static void hook_unloader();
+static void unhook_functions();
+static void restore_jni_env(JNIEnv *env);
 
 namespace {
 
@@ -34,7 +36,6 @@ enum {
     APP_SPECIALIZE,
     SERVER_FORK_AND_SPECIALIZE,
     DO_REVERT_UNMOUNT,
-    CAN_UNLOAD_ZYGISK,
     SKIP_FD_SANITIZATION,
 
     FLAG_MAX
@@ -46,6 +47,11 @@ void name##_post();
 
 #define MAX_FD_SIZE 1024
 
+struct HookContext;
+
+// Current context
+HookContext *g_ctx;
+
 struct HookContext {
     JNIEnv *env;
     union {
@@ -79,8 +85,17 @@ struct HookContext {
     vector<RegisterInfo> register_info;
     vector<IgnoreInfo> ignore_info;
 
-    HookContext() : env(nullptr), args{nullptr}, process(nullptr), pid(-1), info_flags(0),
-    hook_info_lock(PTHREAD_MUTEX_INITIALIZER) {}
+    HookContext(JNIEnv *env, void *args) :
+    env(env), args{args}, process(nullptr), pid(-1), info_flags(0),
+    hook_info_lock(PTHREAD_MUTEX_INITIALIZER) {
+        static bool restored_env = false;
+        if (!restored_env) {
+            restore_jni_env(env);
+            restored_env = true;
+        }
+        g_ctx = this;
+    }
+    ~HookContext();
 
     /* Zygisksu changed: Load module fds */
     void run_modules_pre();
@@ -91,9 +106,9 @@ struct HookContext {
     DCL_PRE_POST(nativeSpecializeAppProcess)
     DCL_PRE_POST(nativeForkSystemServer)
 
-    void unload_zygisk();
     void sanitize_fds();
     bool exempt_fd(int fd);
+    bool is_child() const { return pid <= 0; }
 
     // Compatibility shim
     void plt_hook_register(const char *regex, const char *symbol, void *fn, void **backup);
@@ -109,9 +124,8 @@ struct HookContext {
 vector<tuple<dev_t, ino_t, const char *, void **>> *plt_hook_list;
 map<string, vector<JNINativeMethod>, StringCmp> *jni_hook_list;
 hash_map<xstring, tree_map<xstring, tree_map<xstring, void *>>> *jni_method_map;
+bool should_unmap_zygisk = false;
 
-// Current context
-HookContext *g_ctx;
 const JNINativeInterface *old_functions = nullptr;
 JNINativeInterface *new_functions = nullptr;
 
@@ -153,10 +167,6 @@ string get_class_name(JNIEnv *env, jclass clazz) {
     return className;
 }
 
-#define DCL_HOOK_FUNC(ret, func, ...) \
-ret (*old_##func)(__VA_ARGS__);       \
-ret new_##func(__VA_ARGS__)
-
 jint env_RegisterNatives(
         JNIEnv *env, jclass clazz, const JNINativeMethod *methods, jint numMethods) {
     auto className = get_class_name(env, clazz);
@@ -165,46 +175,50 @@ jint env_RegisterNatives(
     return old_functions->RegisterNatives(env, clazz, newMethods.get() ?: methods, numMethods);
 }
 
-DCL_HOOK_FUNC(void, androidSetCreateThreadFunc, void* func) {
-    LOGD("androidSetCreateThreadFunc\n");
-    do {
-        auto get_created_java_vms = reinterpret_cast<jint (*)(JavaVM **, jsize, jsize *)>(
-                dlsym(RTLD_DEFAULT, "JNI_GetCreatedJavaVMs"));
-        if (!get_created_java_vms) {
-            for (auto &map: lsplt::MapInfo::Scan()) {
-                if (!map.path.ends_with("/libnativehelper.so")) continue;
-                void *h = dlopen(map.path.data(), RTLD_LAZY);
-                if (!h) {
-                    LOGW("cannot dlopen libnativehelper.so: %s\n", dlerror());
-                    break;
-                }
-                get_created_java_vms = reinterpret_cast<decltype(get_created_java_vms)>(dlsym(h, "JNI_GetCreatedJavaVMs"));
-                dlclose(h);
-                break;
-            }
-            if (!get_created_java_vms) {
-                LOGW("JNI_GetCreatedJavaVMs not found\n");
+void replace_jni_methods() {
+    auto get_created_java_vms = reinterpret_cast<jint (*)(JavaVM **, jsize, jsize *)>(
+            dlsym(RTLD_DEFAULT, "JNI_GetCreatedJavaVMs"));
+    if (!get_created_java_vms) {
+        for (auto &map: lsplt::MapInfo::Scan()) {
+            if (!map.path.ends_with("/libnativehelper.so")) continue;
+            void *h = dlopen(map.path.data(), RTLD_LAZY);
+            if (!h) {
+                LOGW("cannot dlopen libnativehelper.so: %s\n", dlerror());
                 break;
             }
+            get_created_java_vms = reinterpret_cast<decltype(get_created_java_vms)>(dlsym(h, "JNI_GetCreatedJavaVMs"));
+            dlclose(h);
+            break;
         }
-        JavaVM *vm = nullptr;
-        jsize num = 0;
-        jint res = get_created_java_vms(&vm, 1, &num);
-        if (res != JNI_OK || vm == nullptr) break;
-        JNIEnv *env = nullptr;
-        res = vm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6);
-        if (res != JNI_OK || env == nullptr) break;
-        default_new(new_functions);
-        memcpy(new_functions, env->functions, sizeof(*new_functions));
-        new_functions->RegisterNatives = &env_RegisterNatives;
+        if (!get_created_java_vms) {
+            LOGW("JNI_GetCreatedJavaVMs not found\n");
+            return;
+        }
+    }
+    JavaVM *vm = nullptr;
+    jsize num = 0;
+    jint res = get_created_java_vms(&vm, 1, &num);
+    if (res != JNI_OK || vm == nullptr) return;
+    JNIEnv *env = nullptr;
+    res = vm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6);
+    if (res != JNI_OK || env == nullptr) return;
+    default_new(new_functions);
+    memcpy(new_functions, env->functions, sizeof(*new_functions));
+    new_functions->RegisterNatives = &env_RegisterNatives;
 
-        // Replace the function table in JNIEnv to hook RegisterNatives
-        old_functions = env->functions;
-        env->functions = new_functions;
-    } while (false);
-    old_androidSetCreateThreadFunc(func);
+    // Replace the function table in JNIEnv to hook RegisterNatives
+    old_functions = env->functions;
+    env->functions = new_functions;
+
+    // Re-run register_com_android_internal_os_Zygote to hook JNI methods
+    auto register_zygote = dlsym(RTLD_DEFAULT, "_ZN7android39register_com_android_internal_os_ZygoteEP7_JNIEnv");
+    reinterpret_cast<void (*)(JNIEnv *)>(register_zygote)(env);
 }
 
+#define DCL_HOOK_FUNC(ret, func, ...) \
+ret (*old_##func)(__VA_ARGS__);       \
+ret new_##func(__VA_ARGS__)
+
 // Skip actual fork and return cached result if applicable
 DCL_HOOK_FUNC(int, fork) {
     return (g_ctx && g_ctx->pid >= 0) ? g_ctx->pid : old_fork();
@@ -246,13 +260,28 @@ DCL_HOOK_FUNC(void, android_log_close) {
     old_android_log_close();
 }
 
-// Last point before process secontext changes
-DCL_HOOK_FUNC(int, selinux_android_setcontext,
-        uid_t uid, int isSystemServer, const char *seinfo, const char *pkgname) {
-    if (g_ctx) {
-        g_ctx->flags[CAN_UNLOAD_ZYGISK] = unhook_functions();
+// We cannot directly call `dlclose` to unload ourselves, otherwise when `dlclose` returns,
+// it will return to our code which has been unmapped, causing segmentation fault.
+// Instead, we hook `pthread_attr_destroy` which will be called when VM daemon threads start.
+DCL_HOOK_FUNC(int, pthread_attr_destroy, void *target) {
+    int res = old_pthread_attr_destroy((pthread_attr_t *)target);
+
+    // Only perform unloading on the main thread
+    if (gettid() != getpid())
+        return res;
+
+    LOGD("pthread_attr_destroy\n");
+    if (should_unmap_zygisk) {
+        unhook_functions();
+        if (should_unmap_zygisk) {
+            // Because both `pthread_attr_destroy` and `dlclose` have the same function signature,
+            // we can use `musttail` to let the compiler reuse our stack frame and thus
+            // `dlclose` will directly return to the caller of `pthread_attr_destroy`.
+            [[clang::musttail]] return dlclose(self_handle);
+        }
     }
-    return old_selinux_android_setcontext(uid, isSystemServer, seinfo, pkgname);
+
+    return res;
 }
 
 #undef DCL_HOOK_FUNC
@@ -331,6 +360,7 @@ bool ZygiskModule::RegisterModuleImpl(ApiTable *api, long *module) {
         api->v2.getFlags = [](auto) { return ZygiskModule::getFlags(); };
     }
     if (api_version >= 4) {
+        api->v4.pltHookCommit = lsplt::CommitHook;
         api->v4.pltHookRegister = [](dev_t dev, ino_t inode, const char *symbol, void *fn, void **backup) {
             if (dev == 0 || inode == 0 || symbol == nullptr || fn == nullptr)
                 return;
@@ -448,7 +478,6 @@ int sigmask(int how, int signum) {
 }
 
 void HookContext::fork_pre() {
-    g_ctx = this;
     // Do our own fork before loading any 3rd party code
     // First block SIGCHLD, unblock after original fork is done
     sigmask(SIG_BLOCK, SIGCHLD);
@@ -530,7 +559,6 @@ void HookContext::fork_post() {
     // Unblock SIGCHLD in case the original method didn't
     sigmask(SIG_UNBLOCK, SIGCHLD);
     g_ctx = nullptr;
-    unload_zygisk();
 }
 
 /* Zygisksu changed: Load module fds */
@@ -584,22 +612,6 @@ void HookContext::app_specialize_post() {
     logging::setfd(-1);
 }
 
-void HookContext::unload_zygisk() {
-    if (flags[CAN_UNLOAD_ZYGISK]) {
-        // Do NOT call the destructor
-        operator delete(jni_method_map);
-        // Directly unmap the whole memory block
-        jni_hook::memory_block::release();
-
-        // Strip out all API function pointers
-        for (auto &m : modules) {
-            m.clearApi();
-        }
-
-        new_daemon_thread(reinterpret_cast<thread_entry>(&dlclose), self_handle);
-    }
-}
-
 bool HookContext::exempt_fd(int fd) {
     if (flags[POST_SPECIALIZE] || flags[SKIP_FD_SANITIZATION])
         return true;
@@ -614,7 +626,6 @@ bool HookContext::exempt_fd(int fd) {
 void HookContext::nativeSpecializeAppProcess_pre() {
     process = env->GetStringUTFChars(args.app->nice_name, nullptr);
     LOGV("pre  specialize [%s]\n", process);
-    g_ctx = this;
     // App specialize does not check FD
     flags[SKIP_FD_SANITIZATION] = true;
     app_specialize_pre();
@@ -623,7 +634,6 @@ void HookContext::nativeSpecializeAppProcess_pre() {
 void HookContext::nativeSpecializeAppProcess_post() {
     LOGV("post specialize [%s]\n", process);
     app_specialize_post();
-    unload_zygisk();
 }
 
 /* Zygisksu changed: No system_server status write back */
@@ -673,8 +683,45 @@ void HookContext::nativeForkAndSpecialize_post() {
     fork_post();
 }
 
+HookContext::~HookContext() {
+    // This global pointer points to a variable on the stack.
+    // Set this to nullptr to prevent leaking local variable.
+    // This also disables most plt hooked functions.
+    g_ctx = nullptr;
+
+    if (!is_child())
+        return;
+
+    should_unmap_zygisk = true;
+
+    // Unhook JNI methods
+    for (const auto &[clz, methods] : *jni_hook_list) {
+        if (!methods.empty() && env->RegisterNatives(
+                env->FindClass(clz.data()), methods.data(),
+                static_cast<int>(methods.size())) != 0) {
+            LOGE("Failed to restore JNI hook of class [%s]\n", clz.data());
+            should_unmap_zygisk = false;
+        }
+    }
+    delete jni_hook_list;
+    jni_hook_list = nullptr;
+
+    // Strip out all API function pointers
+    for (auto &m : modules) {
+        m.clearApi();
+    }
+
+    hook_unloader();
+}
+
 } // namespace
 
+static void restore_jni_env(JNIEnv *env) {
+    env->functions = old_functions;
+    delete new_functions;
+    new_functions = nullptr;
+}
+
 static bool hook_commit() {
     if (lsplt::CommitHook()) {
         return true;
@@ -715,8 +762,6 @@ void hook_functions() {
 
     PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, fork);
     PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, unshare);
-    PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, selinux_android_setcontext);
-    PLT_HOOK_REGISTER(android_runtime_dev, android_runtime_inode, androidSetCreateThreadFunc);
     PLT_HOOK_REGISTER_SYM(android_runtime_dev, android_runtime_inode, "__android_log_close", android_log_close);
     hook_commit();
 
@@ -725,40 +770,36 @@ void hook_functions() {
             std::remove_if(plt_hook_list->begin(), plt_hook_list->end(),
                            [](auto &t) { return *std::get<3>(t) == nullptr;}),
             plt_hook_list->end());
+
+    replace_jni_methods();
 }
 
-static bool unhook_functions() {
-    bool success = true;
+static void hook_unloader() {
+    ino_t art_inode = 0;
+    dev_t art_dev = 0;
 
-    // Restore JNIEnv
-    if (g_ctx->env->functions == new_functions) {
-        g_ctx->env->functions = old_functions;
-        delete new_functions;
-    }
-
-    // Unhook JNI methods
-    for (const auto &[clz, methods] : *jni_hook_list) {
-        if (!methods.empty() && g_ctx->env->RegisterNatives(
-                g_ctx->env->FindClass(clz.data()), methods.data(),
-                static_cast<int>(methods.size())) != 0) {
-            LOGE("Failed to restore JNI hook of class [%s]\n", clz.data());
-            success = false;
+    for (auto &map : lsplt::MapInfo::Scan()) {
+        if (map.path.ends_with("/libart.so")) {
+            art_inode = map.inode;
+            art_dev = map.dev;
+            break;
         }
     }
-    delete jni_hook_list;
 
+    PLT_HOOK_REGISTER(art_dev, art_inode, pthread_attr_destroy);
+    hook_commit();
+}
+
+static void unhook_functions() {
     // Unhook plt_hook
     for (const auto &[dev, inode, sym, old_func] : *plt_hook_list) {
         if (!lsplt::RegisterHook(dev, inode, sym, *old_func, nullptr)) {
             LOGE("Failed to register plt_hook [%s]\n", sym);
-            success = false;
         }
     }
     delete plt_hook_list;
     if (!hook_commit()) {
         LOGE("Failed to restore plt_hook\n");
-        success = false;
+        should_unmap_zygisk = false;
     }
-
-    return success;
 }

loader/src/injector/jni_hooks.hpp

@@ -5,9 +5,7 @@ namespace {
 void *nativeForkAndSpecialize_orig = nullptr;
 [[clang::no_stack_protector]] jint nativeForkAndSpecialize_l(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jstring nice_name, jintArray fds_to_close, jstring instruction_set, jstring app_data_dir) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_l)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, fds_to_close, instruction_set, app_data_dir
@@ -18,9 +16,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
 [[clang::no_stack_protector]] jint nativeForkAndSpecialize_o(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jstring nice_name, jintArray fds_to_close, jintArray fds_to_ignore, jstring instruction_set, jstring app_data_dir) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.fds_to_ignore = &fds_to_ignore;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_o)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, fds_to_close, fds_to_ignore, instruction_set, app_data_dir
@@ -32,9 +28,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.fds_to_ignore = &fds_to_ignore;
     args.is_child_zygote = &is_child_zygote;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_p)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, fds_to_close, fds_to_ignore, is_child_zygote, instruction_set, app_data_dir
@@ -47,9 +41,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
     args.fds_to_ignore = &fds_to_ignore;
     args.is_child_zygote = &is_child_zygote;
     args.is_top_app = &is_top_app;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_q_alt)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, fds_to_close, fds_to_ignore, is_child_zygote, instruction_set, app_data_dir, is_top_app
@@ -66,9 +58,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
     args.whitelisted_data_info_list = &whitelisted_data_info_list;
     args.mount_data_dirs = &mount_data_dirs;
     args.mount_storage_dirs = &mount_storage_dirs;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_r)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, fds_to_close, fds_to_ignore, is_child_zygote, instruction_set, app_data_dir, is_top_app, pkg_data_info_list, whitelisted_data_info_list, mount_data_dirs, mount_storage_dirs
@@ -78,9 +68,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
 }
 [[clang::no_stack_protector]] jint nativeForkAndSpecialize_samsung_m(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jint _0, jint _1, jstring nice_name, jintArray fds_to_close, jstring instruction_set, jstring app_data_dir) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_samsung_m)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, _0, _1, nice_name, fds_to_close, instruction_set, app_data_dir
@@ -90,9 +78,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
 }
 [[clang::no_stack_protector]] jint nativeForkAndSpecialize_samsung_n(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jint _2, jint _3, jstring nice_name, jintArray fds_to_close, jstring instruction_set, jstring app_data_dir, jint _4) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_samsung_n)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, _2, _3, nice_name, fds_to_close, instruction_set, app_data_dir, _4
@@ -103,9 +89,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
 [[clang::no_stack_protector]] jint nativeForkAndSpecialize_samsung_o(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jint _5, jint _6, jstring nice_name, jintArray fds_to_close, jintArray fds_to_ignore, jstring instruction_set, jstring app_data_dir) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.fds_to_ignore = &fds_to_ignore;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_samsung_o)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, _5, _6, nice_name, fds_to_close, fds_to_ignore, instruction_set, app_data_dir
@@ -117,9 +101,7 @@ void *nativeForkAndSpecialize_orig = nullptr;
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.fds_to_ignore = &fds_to_ignore;
     args.is_child_zygote = &is_child_zygote;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkAndSpecialize_pre();
     reinterpret_cast<decltype(&nativeForkAndSpecialize_samsung_p)>(nativeForkAndSpecialize_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, _7, _8, nice_name, fds_to_close, fds_to_ignore, is_child_zygote, instruction_set, app_data_dir
@@ -180,9 +162,7 @@ void *nativeSpecializeAppProcess_orig = nullptr;
 [[clang::no_stack_protector]] void nativeSpecializeAppProcess_q(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jstring nice_name, jboolean is_child_zygote, jstring instruction_set, jstring app_data_dir) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.is_child_zygote = &is_child_zygote;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeSpecializeAppProcess_pre();
     reinterpret_cast<decltype(&nativeSpecializeAppProcess_q)>(nativeSpecializeAppProcess_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, is_child_zygote, instruction_set, app_data_dir
@@ -193,9 +173,7 @@ void *nativeSpecializeAppProcess_orig = nullptr;
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.is_child_zygote = &is_child_zygote;
     args.is_top_app = &is_top_app;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeSpecializeAppProcess_pre();
     reinterpret_cast<decltype(&nativeSpecializeAppProcess_q_alt)>(nativeSpecializeAppProcess_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, is_child_zygote, instruction_set, app_data_dir, is_top_app
@@ -210,9 +188,7 @@ void *nativeSpecializeAppProcess_orig = nullptr;
     args.whitelisted_data_info_list = &whitelisted_data_info_list;
     args.mount_data_dirs = &mount_data_dirs;
     args.mount_storage_dirs = &mount_storage_dirs;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeSpecializeAppProcess_pre();
     reinterpret_cast<decltype(&nativeSpecializeAppProcess_r)>(nativeSpecializeAppProcess_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, is_child_zygote, instruction_set, app_data_dir, is_top_app, pkg_data_info_list, whitelisted_data_info_list, mount_data_dirs, mount_storage_dirs
@@ -222,9 +198,7 @@ void *nativeSpecializeAppProcess_orig = nullptr;
 [[clang::no_stack_protector]] void nativeSpecializeAppProcess_samsung_q(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jint _9, jint _10, jstring nice_name, jboolean is_child_zygote, jstring instruction_set, jstring app_data_dir) {
     AppSpecializeArgs_v3 args(uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, nice_name, instruction_set, app_data_dir);
     args.is_child_zygote = &is_child_zygote;
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeSpecializeAppProcess_pre();
     reinterpret_cast<decltype(&nativeSpecializeAppProcess_samsung_q)>(nativeSpecializeAppProcess_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, mount_external, se_info, _9, _10, nice_name, is_child_zygote, instruction_set, app_data_dir
@@ -258,9 +232,7 @@ constexpr int nativeSpecializeAppProcess_methods_num = std::size(nativeSpecializ
 void *nativeForkSystemServer_orig = nullptr;
 [[clang::no_stack_protector]] jint nativeForkSystemServer_l(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jlong permitted_capabilities, jlong effective_capabilities) {
     ServerSpecializeArgs_v1 args(uid, gid, gids, runtime_flags, permitted_capabilities, effective_capabilities);
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkSystemServer_pre();
     reinterpret_cast<decltype(&nativeForkSystemServer_l)>(nativeForkSystemServer_orig)(
         env, clazz, uid, gid, gids, runtime_flags, rlimits, permitted_capabilities, effective_capabilities
@@ -270,9 +242,7 @@ void *nativeForkSystemServer_orig = nullptr;
 }
 [[clang::no_stack_protector]] jint nativeForkSystemServer_samsung_q(JNIEnv *env, jclass clazz, jint uid, jint gid, jintArray gids, jint runtime_flags, jint _11, jint _12, jobjectArray rlimits, jlong permitted_capabilities, jlong effective_capabilities) {
     ServerSpecializeArgs_v1 args(uid, gid, gids, runtime_flags, permitted_capabilities, effective_capabilities);
-    HookContext ctx;
-    ctx.env = env;
-    ctx.args = { &args };
+    HookContext ctx(env, &args);
     ctx.nativeForkSystemServer_pre();
     reinterpret_cast<decltype(&nativeForkSystemServer_samsung_q)>(nativeForkSystemServer_orig)(
         env, clazz, uid, gid, gids, runtime_flags, _11, _12, rlimits, permitted_capabilities, effective_capabilities

loader/src/injector/unmount.cpp

@@ -10,32 +10,24 @@ using namespace std::string_view_literals;
 
 namespace {
     constexpr auto MODULE_DIR = "/data/adb/modules";
-
-    struct overlay_backup {
-        std::string target;
-        std::string vfs_option;
-        std::string fs_option;
-    };
+    constexpr auto KSU_OVERLAY_SOURCE = "KSU";
+    constexpr auto ZYGISK_FUSE_SOURCE = "zygisk";
+    const std::vector<std::string> KSU_PARTITIONS{"/system", "/vendor", "/product", "/system_ext", "/odm", "/oem"};
 
     void lazy_unmount(const char* mountpoint) {
         if (umount2(mountpoint, MNT_DETACH) != -1) {
             LOGD("Unmounted (%s)", mountpoint);
         } else {
+#ifndef NDEBUG
             PLOGE("Unmount (%s)", mountpoint);
+#endif
         }
     }
 }
 
-#define PARSE_OPT(name, flag)   \
-    if (opt == (name)) {        \
-        flags |= (flag);        \
-        return true;            \
-    }
-
 void revert_unmount_ksu() {
     std::string ksu_loop;
     std::vector<std::string> targets;
-    std::list<overlay_backup> backups;
 
     // Unmount ksu module dir last
     targets.emplace_back(MODULE_DIR);
@@ -45,22 +37,19 @@ void revert_unmount_ksu() {
             ksu_loop = info.source;
             continue;
         }
-        // Unmount everything on /data/adb except ksu module dir
+        // Unmount everything mounted to /data/adb
         if (info.target.starts_with("/data/adb")) {
             targets.emplace_back(info.target);
         }
         // Unmount ksu overlays
-        if (info.type == "overlay") {
-            if (str_contains(info.fs_option, MODULE_DIR)) {
-                targets.emplace_back(info.target);
-            } else {
-                auto backup = overlay_backup{
-                        .target = info.target,
-                        .vfs_option = info.vfs_option,
-                        .fs_option = info.fs_option,
-                };
-                backups.emplace_back(backup);
-            }
+        if (info.type == "overlay"
+            && info.source == KSU_OVERLAY_SOURCE
+            && std::find(KSU_PARTITIONS.begin(), KSU_PARTITIONS.end(), info.target) != KSU_PARTITIONS.end()) {
+            targets.emplace_back(info.target);
+        }
+        // Unmount fuse
+        if (info.type == "fuse" && info.source == ZYGISK_FUSE_SOURCE) {
+            targets.emplace_back(info.target);
         }
     }
     for (auto& info: parse_mount_info("self")) {
@@ -74,34 +63,6 @@ void revert_unmount_ksu() {
     for (auto& s: reversed(targets)) {
         lazy_unmount(s.data());
     }
-
-    // Affirm unmounted system overlays
-    for (auto& info: parse_mount_info("self")) {
-        if (info.type == "overlay") {
-            backups.remove_if([&](overlay_backup& mnt) {
-                return mnt.target == info.target && mnt.fs_option == info.fs_option;
-            });
-        }
-    }
-
-    // Restore system overlays
-    for (auto& mnt: backups) {
-        auto opts = split_str(mnt.vfs_option, ",");
-        opts.splice(opts.end(), split_str(mnt.fs_option, ","));
-        unsigned long flags = 0;
-        opts.remove_if([&](auto& opt) {
-            PARSE_OPT(MNTOPT_RO, MS_RDONLY)
-            PARSE_OPT(MNTOPT_NOSUID, MS_NOSUID)
-            PARSE_OPT("relatime", MS_RELATIME)
-            return false;
-        });
-        auto mnt_data = join_str(opts, ",");
-        if (mount("overlay", mnt.target.data(), "overlay", flags, mnt_data.data()) != -1) {
-            LOGD("Remounted (%s)", mnt.target.data());
-        } else {
-            PLOGE("Remount (%s, %s)", mnt.target.data(), mnt.fs_option.data());
-        }
-    }
 }
 
 void revert_unmount_magisk() {
@@ -114,6 +75,14 @@ void revert_unmount_magisk() {
             info.root.starts_with("/adb/modules")) { // bind mount from data partition
             targets.push_back(info.target);
         }
+        // Unmount everything mounted to /data/adb
+        if (info.target.starts_with("/data/adb")) {
+            targets.emplace_back(info.target);
+        }
+        // Unmount fuse
+        if (info.type == "fuse" && info.source == ZYGISK_FUSE_SOURCE) {
+            targets.emplace_back(info.target);
+        }
     }
 
     for (auto& s: reversed(targets)) {

loader/src/loader/loader.cpp

@@ -1,100 +0,0 @@
-#include <string_view>
-#include <sys/system_properties.h>
-#include <unistd.h>
-#include <array>
-
-#include "daemon.h"
-#include "dl.h"
-#include "logging.h"
-#include "native_bridge_callbacks.h"
-
-extern "C" [[gnu::visibility("default")]]
-uint8_t NativeBridgeItf[sizeof(NativeBridgeCallbacks<__ANDROID_API_R__>) * 2]{0};
-
-namespace {
-    constexpr auto kZygoteProcesses = {"zygote", "zygote32", "zygote64", "usap32", "usap64"};
-    constexpr auto kInjector = "/system/" LP_SELECT("lib", "lib64") "/libzygisk_injector.so";
-
-    void* sOriginalBridge = nullptr;
-}
-
-__used __attribute__((destructor))
-void Destructor() {
-    if (sOriginalBridge) {
-        dlclose(sOriginalBridge);
-    }
-}
-
-__used __attribute__((constructor))
-void Constructor() {
-    if (getuid() != 0) {
-        return;
-    }
-
-    std::string_view cmdline = getprogname();
-    if (std::none_of(
-            kZygoteProcesses.begin(), kZygoteProcesses.end(),
-            [&](const char* p) { return cmdline == p; }
-    )) {
-        LOGW("Not started as zygote (cmdline=%s)", cmdline.data());
-        return;
-    }
-
-    std::string native_bridge;
-    do {
-        if (!zygiskd::PingHeartbeat()) break;
-#ifdef NDEBUG
-        logging::setfd(zygiskd::RequestLogcatFd());
-#endif
-        LOGI("Read native bridge");
-        native_bridge = zygiskd::ReadNativeBridge();
-
-        LOGI("Load injector");
-        auto handle = DlopenExt(kInjector, RTLD_NOW);
-        if (handle == nullptr) {
-            LOGE("Failed to dlopen injector: %s", dlerror());
-            break;
-        }
-        auto entry = dlsym(handle, "entry");
-        if (entry == nullptr) {
-            LOGE("Failed to dlsym injector entry: %s", dlerror());
-            dlclose(handle);
-            break;
-        }
-        reinterpret_cast<void (*)(void*)>(entry)(handle);
-    } while (false);
-
-    do {
-        if (native_bridge.empty() || native_bridge == "0") break;
-
-        LOGI("Load original native bridge: %s", native_bridge.data());
-        sOriginalBridge = dlopen(native_bridge.data(), RTLD_NOW);
-        if (sOriginalBridge == nullptr) {
-            LOGE("%s", dlerror());
-            break;
-        }
-
-        auto* original_native_bridge_itf = dlsym(sOriginalBridge, "NativeBridgeItf");
-        if (original_native_bridge_itf == nullptr) {
-            LOGE("%s", dlerror());
-            break;
-        }
-
-        long sdk = 0;
-        char value[PROP_VALUE_MAX + 1];
-        if (__system_property_get("ro.build.version.sdk", value) > 0) {
-            sdk = strtol(value, nullptr, 10);
-        }
-
-        auto callbacks_size = 0;
-        if (sdk >= __ANDROID_API_R__) {
-            callbacks_size = sizeof(NativeBridgeCallbacks<__ANDROID_API_R__>);
-        } else if (sdk == __ANDROID_API_Q__) {
-            callbacks_size = sizeof(NativeBridgeCallbacks<__ANDROID_API_Q__>);
-        }
-
-        memcpy(NativeBridgeItf, original_native_bridge_itf, callbacks_size);
-    } while (false);
-
-    logging::setfd(-1);
-}

module/build.gradle.kts

@@ -4,7 +4,7 @@ import org.apache.tools.ant.filters.ReplaceTokens
 import org.apache.tools.ant.filters.FixCrLfFilter
 
 plugins {
-    id("com.android.library")
+    alias(libs.plugins.agp.lib)
 }
 
 val moduleId: String by rootProject.extra
@@ -15,6 +15,7 @@ val minKsuVersion: Int by rootProject.extra
 val minKsudVersion: Int by rootProject.extra
 val maxKsuVersion: Int by rootProject.extra
 val minMagiskVersion: Int by rootProject.extra
+val commitHash: String by rootProject.extra
 
 android.buildFeatures {
     androidResources = false
@@ -27,7 +28,7 @@ androidComponents.onVariants { variant ->
     val buildTypeLowered = variant.buildType?.toLowerCase()
 
     val moduleDir = "$buildDir/outputs/module/$variantLowered"
-    val zipFileName = "$moduleName-$verName-$verCode-$buildTypeLowered.zip".replace(' ', '-')
+    val zipFileName = "$moduleName-$verName-$verCode-$commitHash-$buildTypeLowered.zip".replace(' ', '-')
 
     val prepareModuleFilesTask = task<Sync>("prepareModuleFiles$variantCapped") {
         group = "module"
@@ -38,7 +39,7 @@ androidComponents.onVariants { variant ->
         into(moduleDir)
         from("${rootProject.projectDir}/README.md")
         from("$projectDir/src") {
-            exclude("module.prop", "customize.sh", "service.sh")
+            exclude("module.prop", "customize.sh", "post-fs-data.sh", "service.sh")
             filter<FixCrLfFilter>("eol" to FixCrLfFilter.CrLf.newInstance("lf"))
         }
         from("$projectDir/src") {
@@ -46,12 +47,12 @@ androidComponents.onVariants { variant ->
             expand(
                 "moduleId" to moduleId,
                 "moduleName" to moduleName,
-                "versionName" to "$verName ($verCode)",
-                "versionCode" to verCode,
+                "versionName" to "$verName ($verCode-$commitHash-$variantLowered)",
+                "versionCode" to verCode
             )
         }
         from("$projectDir/src") {
-            include("customize.sh", "service.sh")
+            include("customize.sh", "post-fs-data.sh", "service.sh")
             val tokens = mapOf(
                 "DEBUG" to if (buildTypeLowered == "debug") "true" else "false",
                 "MIN_KSU_VERSION" to "$minKsuVersion",

module/src/customize.sh

@@ -31,7 +31,7 @@ if [ "$BOOTMODE" ] && [ "$KSU" ]; then
   if [ "$(which magisk)" ]; then
     ui_print "*********************************************************"
     ui_print "! Multiple root implementation is NOT supported!"
-    ui_print "! Please uninstall Magisk before installing Zygisksu"
+    ui_print "! Please uninstall Magisk before installing Zygisk Next"
     abort    "*********************************************************"
   fi
 elif [ "$BOOTMODE" ] && [ "$MAGISK_VER_CODE" ]; then
@@ -50,7 +50,7 @@ else
 fi
 
 VERSION=$(grep_prop version "${TMPDIR}/module.prop")
-ui_print "- Installing Zygisksu $VERSION"
+ui_print "- Installing Zygisk Next $VERSION"
 
 # check android
 if [ "$API" -lt 29 ]; then
@@ -80,12 +80,13 @@ extract "$ZIPFILE" 'customize.sh'  "$TMPDIR/.vunzip"
 extract "$ZIPFILE" 'verify.sh'     "$TMPDIR/.vunzip"
 extract "$ZIPFILE" 'sepolicy.rule' "$TMPDIR"
 
+if [ "$DEBUG" = true ]; then
+  ui_print "- Add debug SELinux policy"
+  echo "allow crash_dump adb_data_file dir search" >> "$TMPDIR/sepolicy.rule"
+fi
+
 if [ "$KSU" ]; then
   ui_print "- Checking SELinux patches"
-  if [ "$(getprop ro.product.first_api_level)" -lt 31 ]; then
-    echo "allow zygote appdomain_tmpfs file *" >> "$TMPDIR/sepolicy.rule"
-    echo "allow zygote appdomain_tmpfs dir *"  >> "$TMPDIR/sepolicy.rule"
-  fi
   if ! check_sepolicy "$TMPDIR/sepolicy.rule"; then
     ui_print "*********************************************************"
     ui_print "! Unable to apply SELinux patches!"
@@ -101,69 +102,52 @@ extract "$ZIPFILE" 'service.sh'      "$MODPATH"
 mv "$TMPDIR/sepolicy.rule" "$MODPATH"
 
 HAS32BIT=false && [ -d "/system/lib" ] && HAS32BIT=true
-HAS64BIT=false && [ -d "/system/lib64" ] && HAS64BIT=true
 
 mkdir "$MODPATH/bin"
 mkdir "$MODPATH/system"
+mkdir "$MODPATH/system/lib64"
 [ "$HAS32BIT" = true ] && mkdir "$MODPATH/system/lib"
-[ "$HAS64BIT" = true ] && mkdir "$MODPATH/system/lib64"
 
 if [ "$ARCH" = "x86" ] || [ "$ARCH" = "x64" ]; then
   if [ "$HAS32BIT" = true ]; then
     ui_print "- Extracting x86 libraries"
     extract "$ZIPFILE" 'bin/x86/zygiskd' "$MODPATH/bin" true
     mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd32"
-    extract "$ZIPFILE" 'lib/x86/libzygisk_injector.so' "$MODPATH/system/lib" true
-    extract "$ZIPFILE" 'lib/x86/libzygisk_loader.so' "$MODPATH/system/lib" true
-    ln -sf "zygiskd32" "$MODPATH/bin/zygiskwd"
+    extract "$ZIPFILE" 'lib/x86/libzygisk.so' "$MODPATH/system/lib" true
+    ln -sf "zygiskd32" "$MODPATH/bin/zygisk-cp32"
+    ln -sf "zygiskd32" "$MODPATH/bin/zygisk-ptrace32"
   fi
 
-  if [ "$HAS64BIT" = true ]; then
-    ui_print "- Extracting x64 libraries"
-    extract "$ZIPFILE" 'bin/x86_64/zygiskd' "$MODPATH/bin" true
-    mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd64"
-    extract "$ZIPFILE" 'lib/x86_64/libzygisk_injector.so' "$MODPATH/system/lib64" true
-    extract "$ZIPFILE" 'lib/x86_64/libzygisk_loader.so' "$MODPATH/system/lib64" true
-    ln -sf "zygiskd64" "$MODPATH/bin/zygiskwd"
-  fi
+  ui_print "- Extracting x64 libraries"
+  extract "$ZIPFILE" 'bin/x86_64/zygiskd' "$MODPATH/bin" true
+  mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd64"
+  extract "$ZIPFILE" 'lib/x86_64/libzygisk.so' "$MODPATH/system/lib64" true
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-wd"
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-fuse"
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-cp64"
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-ptrace64"
 else
   if [ "$HAS32BIT" = true ]; then
     ui_print "- Extracting arm libraries"
     extract "$ZIPFILE" 'bin/armeabi-v7a/zygiskd' "$MODPATH/bin" true
     mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd32"
-    extract "$ZIPFILE" 'lib/armeabi-v7a/libzygisk_injector.so' "$MODPATH/system/lib" true
-    extract "$ZIPFILE" 'lib/armeabi-v7a/libzygisk_loader.so' "$MODPATH/system/lib" true
-    ln -sf "zygiskd32" "$MODPATH/bin/zygiskwd"
+    extract "$ZIPFILE" 'lib/armeabi-v7a/libzygisk.so' "$MODPATH/system/lib" true
+    ln -sf "zygiskd32" "$MODPATH/bin/zygisk-cp32"
+    ln -sf "zygiskd32" "$MODPATH/bin/zygisk-ptrace32"
   fi
 
-  if [ "$HAS64BIT" = true ]; then
-    ui_print "- Extracting arm64 libraries"
-    extract "$ZIPFILE" 'bin/arm64-v8a/zygiskd' "$MODPATH/bin" true
-    mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd64"
-    extract "$ZIPFILE" 'lib/arm64-v8a/libzygisk_injector.so' "$MODPATH/system/lib64" true
-    extract "$ZIPFILE" 'lib/arm64-v8a/libzygisk_loader.so' "$MODPATH/system/lib64" true
-    ln -sf "zygiskd64" "$MODPATH/bin/zygiskwd"
-  fi
-fi
-
-if [ $DEBUG = false ]; then
-  ui_print "- Hex patching"
-  SOCKET_PATCH=$(tr -dc 'a-f0-9' </dev/urandom | head -c 18)
-  if [ "$HAS32BIT" = true ]; then
-    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/bin/zygiskd32"
-    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib/libzygisk_injector.so"
-    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib/libzygisk_loader.so"
-  fi
-  if [ "$HAS64BIT" = true ]; then
-    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/bin/zygiskd64"
-    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib64/libzygisk_injector.so"
-    sed -i "s/socket_placeholder/$SOCKET_PATCH/g" "$MODPATH/system/lib64/libzygisk_loader.so"
-  fi
+  ui_print "- Extracting arm64 libraries"
+  extract "$ZIPFILE" 'bin/arm64-v8a/zygiskd' "$MODPATH/bin" true
+  mv "$MODPATH/bin/zygiskd" "$MODPATH/bin/zygiskd64"
+  extract "$ZIPFILE" 'lib/arm64-v8a/libzygisk.so' "$MODPATH/system/lib64" true
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-wd"
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-fuse"
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-cp64"
+  ln -sf "zygiskd64" "$MODPATH/bin/zygisk-ptrace64"
 fi
 
 ui_print "- Setting permissions"
-chmod 0744 "$MODPATH/daemon.sh"
-set_perm_recursive "$MODPATH/bin" 0 2000 0755 0755
+set_perm_recursive "$MODPATH/bin" 0 0 0755 0755
 set_perm_recursive "$MODPATH/system/lib" 0 0 0755 0644 u:object_r:system_lib_file:s0
 set_perm_recursive "$MODPATH/system/lib64" 0 0 0755 0644 u:object_r:system_lib_file:s0
 

module/src/module.prop

@@ -3,4 +3,5 @@ name=${moduleName}
 version=${versionName}
 versionCode=${versionCode}
 author=Nullptr, 5ec1cff
-description=Run Zygisk on KernelSU.
+description=Standalone implementation of Zygisk.
+updateJson=https://api.nullptr.icu/android/zygisk-next/static/update.json

module/src/post-fs-data.sh

@@ -6,18 +6,19 @@ if [ "$ZYGISK_ENABLED" ]; then
 fi
 
 cd "$MODDIR"
-getprop ro.dalvik.vm.native.bridge > /dev/.native_bridge
-resetprop ro.dalvik.vm.native.bridge libzygisk_loader.so
 
 if [ "$(which magisk)" ]; then
   for file in ../*; do
     if [ -d "$file" ] && [ -d "$file/zygisk" ] && ! [ -f "$file/disable" ]; then
       if [ -f "$file/post-fs-data.sh" ]; then
         cd "$file"
-        log -p i -t "zygisksu" "Manually trigger post-fs-data.sh for $file"
+        log -p i -t "zygisk-sh" "Manually trigger post-fs-data.sh for $file"
         sh "$(realpath ./post-fs-data.sh)"
         cd "$MODDIR"
       fi
     fi
   done
 fi
+
+[ "$DEBUG" = true ] && export RUST_BACKTRACE=1
+unshare -m sh -c "bin/zygisk-fuse &"

module/src/sepolicy.rule

@@ -1,4 +1,8 @@
+deny vold fusectlfs file write
+
 allow * tmpfs * *
+allow zygote appdomain_tmpfs dir *
+allow zygote appdomain_tmpfs file *
 
 type magisk_file file_type
 typeattribute magisk_file mlstrustedobject
@@ -14,3 +18,4 @@ allow zygote adb_data_file dir search
 allow zygote mnt_vendor_file dir search
 allow zygote system_file dir mounton
 allow zygote labeledfs filesystem mount
+allow zygote fs_type filesystem unmount

module/src/service.sh

@@ -8,15 +8,13 @@ if [ "$ZYGISK_ENABLED" ]; then
 fi
 
 cd "$MODDIR"
-export NATIVE_BRIDGE=$(cat /dev/.native_bridge)
-rm /dev/.native_bridge
 
 if [ "$(which magisk)" ]; then
   for file in ../*; do
     if [ -d "$file" ] && [ -d "$file/zygisk" ] && ! [ -f "$file/disable" ]; then
       if [ -f "$file/service.sh" ]; then
         cd "$file"
-        log -p i -t "zygisksu" "Manually trigger service.sh for $file"
+        log -p i -t "zygisk-sh" "Manually trigger service.sh for $file"
         sh "$(realpath ./service.sh)"
         cd "$MODDIR"
       fi
@@ -24,6 +22,5 @@ if [ "$(which magisk)" ]; then
   done
 fi
 
-log -p i -t "zygisksu" "Start watchdog"
 [ "$DEBUG" = true ] && export RUST_BACKTRACE=1
-exec "bin/zygiskwd" "watchdog" >/dev/null 2>&1
+unshare -m sh -c "bin/zygisk-wd &"

settings.gradle.kts

@@ -6,10 +6,6 @@ pluginManagement {
         mavenCentral()
         gradlePluginPortal()
     }
-    plugins {
-        id("com.android.library") version "7.4.1"
-        id("com.android.application") version "7.4.1"
-    }
 }
 
 dependencyResolutionManagement {
@@ -20,7 +16,7 @@ dependencyResolutionManagement {
     }
 }
 
-rootProject.name = "ZygiskOnKernelSU"
+rootProject.name = "ZygiskNext"
 include(
     ":loader",
     ":module",

zygiskd/Cargo.toml

@@ -3,24 +3,29 @@ name = "zygiskd"
 authors = ["Nullptr"]
 version = "1.0.0"
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.69"
 
 [dependencies]
-android_logger = "0.13.0"
-anyhow = { version = "1.0.68", features = ["backtrace"] }
-clap = { version = "4.1.4", features = ["derive"] }
-const_format = "0.2.5"
-konst = "0.3.4"
-lazy_static = "1.4.0"
-log = "0.4.17"
-memfd = "0.6.2"
-nix = "0.26.2"
-num_enum = "0.5.9"
-once_cell = "1.17.1"
-passfd = "0.1.5"
-rand = "0.8.5"
+android_logger = "0.13"
+anyhow = { version = "1.0", features = ["backtrace"] }
+bitflags = { version = "2.3" }
+const_format = "0.2"
+futures = "0.3"
+konst = "0.3"
+lazy_static = "1.4"
+libc = "0.2"
+log = "0.4"
+memfd = "0.6"
+num_enum = "0.5"
+passfd = "0.1"
+proc-maps = "0.3"
 
-binder = { git = "https://github.com/Kernel-SU/binder_rs" }
+rustix = { version = "0.38", features = [ "fs", "process", "mount", "net", "thread"] }
+tokio = { version = "1.28", features = ["full"] }
+
+binder = { git = "https://github.com/Kernel-SU/binder_rs", rev = "c9f2b62d6a744fd2264056c638c1b061a6a2932d" }
+fuser = { git = "https://github.com/Dr-TSNG/fuser", default-features = false }
+ptrace-do = { git = "https://github.com/5ec1cff/ptrace-do" }
 
 [profile.release]
 strip = true

zygiskd/build.gradle.kts

@@ -1,10 +1,8 @@
 plugins {
-    id("com.android.library")
-    id("org.mozilla.rust-android-gradle.rust-android")
+    alias(libs.plugins.agp.lib)
+    alias(libs.plugins.rust.android)
 }
 
-val verName: String by rootProject.extra
-val verCode: Int by rootProject.extra
 val minKsuVersion: Int by rootProject.extra
 val maxKsuVersion: Int by rootProject.extra
 val minMagiskVersion: Int by rootProject.extra
@@ -24,8 +22,6 @@ cargo {
     profile = if (isDebug) "debug" else "release"
     exec = { spec, _ ->
         spec.environment("ANDROID_NDK_HOME", android.ndkDirectory.path)
-        spec.environment("VERSION_CODE", verCode)
-        spec.environment("VERSION_NAME", verName)
         spec.environment("MIN_KSU_VERSION", minKsuVersion)
         spec.environment("MAX_KSU_VERSION", maxKsuVersion)
         spec.environment("MIN_MAGISK_VERSION", minMagiskVersion)

zygiskd/src/companion.rs

@@ -1,61 +0,0 @@
-use std::ffi::c_void;
-use std::os::fd::{FromRawFd, RawFd};
-use std::os::unix::net::UnixStream;
-use std::thread;
-use anyhow::Result;
-use nix::libc;
-use passfd::FdPassingExt;
-use crate::utils::UnixStreamExt;
-use crate::dl;
-
-type ZygiskCompanionEntryFn = unsafe extern "C" fn(i32);
-
-pub fn entry(fd: i32) -> Result<()> {
-    unsafe { libc::prctl(libc::PR_SET_PDEATHSIG, libc::SIGKILL) };
-    let mut stream = unsafe { UnixStream::from_raw_fd(fd) };
-    let name = stream.read_string()?;
-    let library = stream.recv_fd()?;
-    let entry = load_module(library)?;
-    unsafe { libc::close(library) };
-
-    let entry = match entry {
-        Some(entry) => {
-            log::debug!("Companion process created for `{name}`");
-            stream.write_u8(1)?;
-            entry
-        }
-        None => {
-            log::debug!("No companion entry for `{name}`");
-            stream.write_u8(0)?;
-            return Ok(());
-        }
-    };
-
-    loop {
-        let fd = stream.recv_fd()?;
-        log::trace!("New companion request from module `{name}`");
-        thread::spawn(move || {
-            unsafe {
-                let mut s = UnixStream::from_raw_fd(fd);
-                match s.write_u8(1) { // Ack
-                    Ok(_) => entry(fd),
-                    Err(_) => log::warn!("Ack failed?"),
-                }
-            };
-        });
-    }
-}
-
-fn load_module(fd: RawFd) -> Result<Option<ZygiskCompanionEntryFn>> {
-    unsafe {
-        let path = format!("/proc/self/fd/{fd}");
-        let handle = dl::dlopen(&path, libc::RTLD_NOW)?;
-        let symbol = std::ffi::CString::new("zygisk_companion_entry")?;
-        let entry = libc::dlsym(handle, symbol.as_ptr());
-        if entry.is_null() {
-            return Ok(None);
-        }
-        let fnptr = std::mem::transmute::<*mut c_void, ZygiskCompanionEntryFn>(entry);
-        Ok(Some(fnptr))
-    }
-}

zygiskd/src/constants.rs

@@ -1,12 +1,11 @@
+use bitflags::bitflags;
 use const_format::concatcp;
 use konst::primitive::parse_i32;
 use konst::unwrap_ctx;
 use log::LevelFilter;
 use num_enum::TryFromPrimitive;
+use crate::lp_select;
 
-pub const VERSION_NAME: &str = env!("VERSION_NAME");
-pub const VERSION_CODE: &str = env!("VERSION_CODE");
-pub const VERSION_FULL: &str = concatcp!(VERSION_NAME, " (", VERSION_CODE, ")");
 pub const MIN_KSU_VERSION: i32 = unwrap_ctx!(parse_i32(env!("MIN_KSU_VERSION")));
 pub const MAX_KSU_VERSION: i32 = unwrap_ctx!(parse_i32(env!("MAX_KSU_VERSION")));
 pub const MIN_MAGISK_VERSION: i32 = unwrap_ctx!(parse_i32(env!("MIN_MAGISK_VERSION")));
@@ -16,21 +15,26 @@ pub const MAX_LOG_LEVEL: LevelFilter = LevelFilter::Trace;
 #[cfg(not(debug_assertions))]
 pub const MAX_LOG_LEVEL: LevelFilter = LevelFilter::Info;
 
-pub const PROP_NATIVE_BRIDGE: &str = "ro.dalvik.vm.native.bridge";
 pub const PROP_CTL_RESTART: &str = "ctl.restart";
-pub const ZYGISK_LOADER: &str = "libzygisk_loader.so";
 
-pub const SOCKET_PLACEHOLDER: &str = "socket_placeholder";
+pub const PATH_PCL: &str = "/system/etc/preloaded-classes";
+pub const PATH_ZYGISK_LIB: &str = concatcp!(lp_select!("/system/lib", "/system/lib64"), "/libzygisk.so");
+pub const PATH_WORK_DIR: &str = "/dev/zygisk"; // TODO: Replace with /debug_ramdisk/zygisk
+pub const PATH_PROP_OVERLAY: &str = concatcp!(PATH_WORK_DIR, "/module.prop");
+pub const PATH_CP_SOCKET: &str = concatcp!(PATH_WORK_DIR, lp_select!("/cp32.sock", "/cp64.sock"));
+pub const PATH_FUSE_DIR: &str = concatcp!(PATH_WORK_DIR, "/fuse");
+pub const PATH_FUSE_PCL: &str = concatcp!(PATH_FUSE_DIR, "/preloaded-classes");
 
 pub const PATH_MODULES_DIR: &str = "..";
 pub const PATH_MODULE_PROP: &str = "module.prop";
-pub const PATH_ZYGISKD32: &str = "bin/zygiskd32";
-pub const PATH_ZYGISKD64: &str = "bin/zygiskd64";
-pub const PATH_TMP_DIR: &str = concatcp!("/dev/", SOCKET_PLACEHOLDER);
-pub const PATH_TMP_PROP: &str = concatcp!("/dev/", SOCKET_PLACEHOLDER, "/module.prop");
+pub const PATH_CP_BIN32: &str = "bin/zygisk-cp32";
+pub const PATH_CP_BIN64: &str = "bin/zygisk-cp64";
+pub const PATH_PTRACE_BIN32: &str = "bin/zygisk-ptrace32";
+pub const PATH_PTRACE_BIN64: &str = "bin/zygisk-ptrace64";
 
-pub const STATUS_LOADED: &str = "😋 Zygisksu is loaded";
-pub const STATUS_CRASHED: &str = "❌ Zygiskd has crashed";
+
+pub const STATUS_LOADED: &str = "😋 Zygisk Next is loaded";
+pub const STATUS_CRASHED: &str = "❌ Zygisk Next has crashed";
 pub const STATUS_ROOT_IMPL_NONE: &str = "❌ Unknown root implementation";
 pub const STATUS_ROOT_IMPL_TOO_OLD: &str = "❌ Root implementation version too old";
 pub const STATUS_ROOT_IMPL_ABNORMAL: &str = "❌ Abnormal root implementation version";
@@ -41,7 +45,6 @@ pub const STATUS_ROOT_IMPL_MULTIPLE: &str = "❌ Multiple root implementations i
 pub enum DaemonSocketAction {
     PingHeartbeat,
     RequestLogcatFd,
-    ReadNativeBridge,
     GetProcessFlags,
     ReadModules,
     RequestCompanionSocket,
@@ -49,8 +52,13 @@ pub enum DaemonSocketAction {
 }
 
 // Zygisk process flags
-pub const PROCESS_GRANTED_ROOT: u32 = 1 << 0;
-pub const PROCESS_ON_DENYLIST: u32 = 1 << 1;
-pub const PROCESS_ROOT_IS_KSU: u32 = 1 << 29;
-pub const PROCESS_ROOT_IS_MAGISK: u32 = 1 << 30;
-pub const PROCESS_IS_SYSUI: u32 = 1 << 31;
+bitflags! {
+    #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+    pub struct ProcessFlags: u32 {
+        const PROCESS_GRANTED_ROOT = 1 << 0;
+        const PROCESS_ON_DENYLIST = 1 << 1;
+        const PROCESS_ROOT_IS_KSU = 1 << 29;
+        const PROCESS_ROOT_IS_MAGISK = 1 << 30;
+        const PROCESS_IS_SYSUI = 1 << 31;
+    }
+}

zygiskd/src/dl.rs

@@ -1,18 +1,17 @@
 use anyhow::{bail, Result};
 use std::ffi::{c_char, c_void};
-use nix::libc;
 
-const ANDROID_NAMESPACE_TYPE_SHARED: u64 = 0x2;
-const ANDROID_DLEXT_USE_NAMESPACE: u64 = 0x200;
+pub const ANDROID_NAMESPACE_TYPE_SHARED: u64 = 0x2;
+pub const ANDROID_DLEXT_USE_NAMESPACE: u64 = 0x200;
 
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
-struct AndroidNamespace {
+pub struct AndroidNamespace {
     _unused: [u8; 0],
 }
 
 #[repr(C)]
-struct AndroidDlextinfo {
+pub struct AndroidDlextinfo {
     pub flags: u64,
     pub reserved_addr: *mut c_void,
     pub reserved_size: libc::size_t,
@@ -23,7 +22,7 @@ struct AndroidDlextinfo {
 }
 
 extern "C" {
-    fn android_dlopen_ext(
+    pub fn android_dlopen_ext(
         filename: *const c_char,
         flags: libc::c_int,
         extinfo: *const AndroidDlextinfo,

zygiskd/src/fuse.rs

@@ -0,0 +1,205 @@
+use std::cmp::min;
+use anyhow::{bail, Result};
+use std::ffi::OsStr;
+use std::{fs, thread};
+use std::io::Read;
+use std::process::{Command, Stdio};
+use std::sync::{mpsc, Mutex};
+use std::time::{Duration, SystemTime};
+use fuser::{FileAttr, Filesystem, FileType, ReplyAttr, ReplyData, ReplyDirectory, ReplyEntry, ReplyOpen, Request};
+use libc::ENOENT;
+use log::{error, info};
+use rustix::fs::UnmountFlags;
+use rustix::mount::{mount_bind, unmount};
+use rustix::path::Arg;
+use crate::constants;
+use crate::utils::LateInit;
+
+pub struct DelegateFilesystem;
+
+const fn attr(inode: u64, size: u64, kind: FileType) -> FileAttr {
+    FileAttr {
+        ino: inode,
+        size,
+        blocks: 0,
+        atime: SystemTime::UNIX_EPOCH,
+        mtime: SystemTime::UNIX_EPOCH,
+        ctime: SystemTime::UNIX_EPOCH,
+        crtime: SystemTime::UNIX_EPOCH,
+        kind,
+        perm: 0o644,
+        nlink: 0,
+        uid: 0,
+        gid: 0,
+        rdev: 0,
+        blksize: 0,
+        flags: 0,
+    }
+}
+
+const INO_DIR: u64 = 1;
+const INO_PCL: u64 = 2;
+
+static ATTR_DIR: FileAttr = attr(INO_DIR, 0, FileType::Directory);
+static ATTR_PCL: LateInit<FileAttr> = LateInit::new();
+
+static PCL_CONTENT: LateInit<Vec<u8>> = LateInit::new();
+
+const ENTRIES: &[(u64, FileType, &str)] = &[
+    (INO_DIR, FileType::Directory, "."),
+    (INO_DIR, FileType::Directory, ".."),
+    (INO_PCL, FileType::RegularFile, "preloaded-classes"),
+];
+
+const TTL: Duration = Duration::from_secs(1);
+
+fn ptrace_zygote64(pid: u32) -> Result<()> {
+    static LAST: Mutex<u32> = Mutex::new(0);
+
+    let mut last = LAST.lock().unwrap();
+    if *last == pid {
+        return Ok(());
+    }
+    *last = pid;
+    let (sender, receiver) = mpsc::channel::<()>();
+
+    let worker = move || -> Result<()> {
+        let mut child = Command::new(constants::PATH_PTRACE_BIN64).stdout(Stdio::piped()).arg(format!("{}", pid)).spawn()?;
+        child.stdout.as_mut().unwrap().read_exact(&mut [0u8; 1])?;
+        info!("child attached");
+        sender.send(())?;
+        let result = child.wait()?;
+        info!("ptrace64 process status {}", result);
+        Ok(())
+    };
+
+    thread::spawn(move || {
+        if let Err(e) = worker() {
+            error!("Crashed: {:?}", e);
+        }
+    });
+
+    receiver.recv()?;
+    Ok(())
+}
+
+fn ptrace_zygote32(pid: u32) -> Result<()> {
+    static LAST: Mutex<u32> = Mutex::new(0);
+
+    let mut last = LAST.lock().unwrap();
+    if *last == pid {
+        return Ok(());
+    }
+    *last = pid;
+    let (sender, receiver) = mpsc::channel::<()>();
+
+    let worker = move || -> Result<()> {
+        let mut child = Command::new(constants::PATH_PTRACE_BIN32).stdout(Stdio::piped()).arg(format!("{}", pid)).spawn()?;
+        child.stdout.as_mut().unwrap().read_exact(&mut [0u8; 1])?;
+        info!("child attached");
+        sender.send(())?;
+        let result = child.wait()?;
+        info!("ptrace32 process status {}", result);
+        Ok(())
+    };
+
+    thread::spawn(move || {
+        if let Err(e) = worker() {
+            error!("Crashed: {:?}", e);
+        }
+    });
+
+    receiver.recv()?;
+    Ok(())
+}
+
+impl Filesystem for DelegateFilesystem {
+    fn lookup(&mut self, _req: &Request<'_>, parent: u64, name: &OsStr, reply: ReplyEntry) {
+        if parent != INO_DIR {
+            reply.error(ENOENT);
+            return;
+        }
+        match name.as_str().unwrap() {
+            "preloaded-classes" => reply.entry(&TTL, &ATTR_PCL, 0),
+            _ => reply.error(ENOENT),
+        }
+    }
+
+    fn getattr(&mut self, _req: &Request<'_>, ino: u64, reply: ReplyAttr) {
+        match ino {
+            INO_DIR => reply.attr(&TTL, &ATTR_DIR),
+            INO_PCL => reply.attr(&TTL, &ATTR_PCL),
+            _ => reply.error(ENOENT),
+        }
+    }
+
+    fn open(&mut self, req: &Request<'_>, ino: u64, _flags: i32, reply: ReplyOpen) {
+        if ino == INO_PCL {
+            let pid = req.pid();
+            let process = format!("/proc/{}/cmdline", pid);
+            let process = fs::read_to_string(process).unwrap();
+            let process = &process[..process.find('\0').unwrap()];
+            info!("Process {} is reading preloaded-classes", process);
+            match process {
+                "zygote64" => ptrace_zygote64(pid).unwrap(),
+                "zygote" => ptrace_zygote32(pid).unwrap(),
+                _ => (),
+            }
+        }
+        reply.opened(0, 0);
+    }
+
+    fn read(&mut self, _req: &Request<'_>, ino: u64, _fh: u64, offset: i64, size: u32, _flags: i32, _lock_owner: Option<u64>, reply: ReplyData) {
+        let offset = offset as usize;
+        let size = size as usize;
+        if ino == INO_PCL {
+            let len = PCL_CONTENT.len();
+            if offset >= len {
+                reply.data(&[]);
+            } else {
+                let end = min(offset + size, len);
+                reply.data(&PCL_CONTENT[offset..end]);
+            }
+        } else {
+            reply.error(ENOENT);
+        }
+    }
+
+    fn readdir(&mut self, _req: &Request<'_>, ino: u64, _fh: u64, offset: i64, mut reply: ReplyDirectory) {
+        if ino != INO_DIR {
+            reply.error(ENOENT);
+            return;
+        }
+        for (i, entry) in ENTRIES.iter().enumerate().skip(offset as usize) {
+            if reply.add(entry.0, (i + 1) as i64, entry.1, entry.2) {
+                break;
+            }
+        }
+        reply.ok();
+    }
+}
+
+pub fn main() -> Result<()> {
+    info!("Start zygisk fuse");
+    fs::create_dir(constants::PATH_WORK_DIR)?;
+    fs::create_dir(constants::PATH_FUSE_DIR)?;
+    PCL_CONTENT.init(fs::read(constants::PATH_PCL)?);
+    ATTR_PCL.init(attr(INO_PCL, PCL_CONTENT.len() as u64, FileType::RegularFile));
+    let options = [
+        fuser::MountOption::FSName(String::from("zygisk")),
+        fuser::MountOption::AllowOther,
+        fuser::MountOption::RO,
+    ];
+    let session = fuser::spawn_mount2(
+        DelegateFilesystem,
+        constants::PATH_FUSE_DIR,
+        &options,
+    )?;
+    mount_bind(constants::PATH_FUSE_PCL, constants::PATH_PCL)?;
+    let crash = session.guard.join();
+    unmount(constants::PATH_PCL, UnmountFlags::DETACH)?;
+    match crash {
+        Err(e) => bail!("Fuse mount crashed: {:?}", e),
+        _ => bail!("Fuse mount exited unexpectedly"),
+    }
+}

zygiskd/src/main.rs

@@ -1,33 +1,14 @@
-#![allow(dead_code)]
-
-mod companion;
 mod constants;
 mod dl;
+mod fuse;
+mod ptrace;
 mod root_impl;
 mod utils;
 mod watchdog;
 mod zygiskd;
 
+use std::future::Future;
 use anyhow::Result;
-use clap::{Subcommand, Parser};
-
-#[derive(Parser, Debug)]
-#[command(author, version = constants::VERSION_FULL, about, long_about = None)]
-struct Args {
-    #[command(subcommand)]
-    command: Commands,
-}
-
-#[derive(Subcommand, Debug)]
-enum Commands {
-    /// Start zygisk watchdog
-    Watchdog,
-    /// Start zygisk daemon
-    Daemon,
-    /// Start zygisk companion
-    Companion { fd: i32 },
-}
-
 
 fn init_android_logger(tag: &str) {
     android_logger::init_once(
@@ -37,14 +18,21 @@ fn init_android_logger(tag: &str) {
     );
 }
 
-fn start() -> Result<()> {
+fn async_start<F: Future>(future: F) -> F::Output {
+    let async_runtime = tokio::runtime::Runtime::new().unwrap();
+    async_runtime.block_on(future)
+}
+
+fn start(name: &str) -> Result<()> {
+    utils::switch_mount_namespace(1)?;
     root_impl::setup();
-    let cli = Args::parse();
-    match cli.command {
-        Commands::Watchdog => watchdog::entry()?,
-        Commands::Daemon => zygiskd::entry()?,
-        Commands::Companion { fd } => companion::entry(fd)?,
-    };
+    match name.trim_start_matches("zygisk-") {
+        "wd" => async_start(watchdog::main())?,
+        "fuse" => fuse::main()?,
+        lp_select!("cp32", "cp64") => zygiskd::main()?,
+        lp_select!("ptrace32", "ptrace64") => ptrace::main()?,
+        _ => println!("Available commands: wd, fuse, cp, ptrace"),
+    }
     Ok(())
 }
 
@@ -53,7 +41,7 @@ fn main() {
     let nice_name = process.split('/').last().unwrap();
     init_android_logger(nice_name);
 
-    if let Err(e) = start() {
+    if let Err(e) = start(nice_name) {
         log::error!("Crashed: {}\n{}", e, e.backtrace());
     }
 }

zygiskd/src/ptrace.rs

@@ -0,0 +1,233 @@
+use log::{debug, info};
+use std::ffi::CString;
+use std::env;
+use std::io::Write;
+use rustix::path::Arg;
+use proc_maps::{get_process_maps, MapRange, Pid};
+use ptrace_do::{RawProcess, TracedProcess};
+use rustix::process::getpid;
+use crate::{constants, lp_select};
+use anyhow::{bail, Result};
+
+const ANDROID_LIBC: &str = "bionic/libc.so";
+const ANDROID_LIBDL: &str = "bionic/libdl.so";
+
+fn find_module_for_pid(pid: Pid, library: &str) -> Result<MapRange> {
+    let maps = get_process_maps(pid)?;
+    for map in maps.into_iter() {
+        if let Some(p) = map.filename() {
+            if p.as_str()?.contains(library) {
+                return Ok(map);
+            }
+        }
+    }
+    bail!("Cannot find module {library} for pid {pid}");
+}
+
+fn find_remote_procedure(
+    pid: Pid,
+    library: &str,
+    local_addr: usize,
+) -> Result<usize> {
+    let local_module = find_module_for_pid(getpid().as_raw_nonzero().get(), library)?;
+    debug!(
+        "Identifed local range {library} ({:?}) at {:x}",
+        local_module.filename(),
+        local_module.start()
+    );
+
+    let remote_module = find_module_for_pid(pid, library)?;
+    debug!(
+        "Identifed remote range {library} ({:?}) at {:x}",
+        remote_module.filename(),
+        remote_module.start()
+    );
+
+    Ok(local_addr - local_module.start() + remote_module.start())
+}
+
+fn ptrace_zygote(pid: u32) -> Result<()> {
+    info!("Injecting into pid {}", pid);
+    let zygisk_lib = CString::new(constants::PATH_ZYGISK_LIB)?;
+    let libc_base = find_module_for_pid(pid as i32, ANDROID_LIBC)?.start();
+    let mmap_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBC,
+        libc::mmap as usize,
+    )?;
+    let munmap_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBC,
+        libc::munmap as usize,
+    )?;
+    let dlopen_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBDL,
+        libc::dlopen as usize,
+    )?;
+    let dlsym_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBDL,
+        libc::dlsym as usize,
+    )?;
+    let errno_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBC,
+        libc::__errno as usize,
+    )?;
+    let dlerror_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBDL,
+        libc::dlerror as usize,
+    )?;
+    let strlen_remote = find_remote_procedure(
+        pid as i32,
+        ANDROID_LIBC,
+        libc::strlen as usize,
+    )?;
+
+    let tracer = TracedProcess::attach(RawProcess::new(pid as i32))?;
+    std::io::stdout().write(b"1")?;
+    info!("attached process {}", pid);
+    std::io::stdout().flush()?;
+    let frame = tracer.next_frame()?;
+    debug!("Waited for a frame");
+
+    // Map a buffer in the remote process
+    debug!("remote mmap addr {:x}", mmap_remote);
+    let mmap_params: [usize; 6] = [
+        0,
+        0x1000,
+        (libc::PROT_READ | libc::PROT_WRITE) as usize,
+        (libc::MAP_ANONYMOUS | libc::MAP_PRIVATE) as usize,
+        0,
+        0,
+    ];
+    let mut arr: Vec<u8> = Vec::new();
+    for p in mmap_params {
+        arr.extend_from_slice(&p.to_le_bytes());
+    }
+    arr.as_slice();
+    let (regs, mut frame) = frame.invoke_remote(
+        mmap_remote,
+        libc_base,
+        &mmap_params,
+    )?;
+    let buf_addr = regs.return_value();
+    debug!("remote stopped at addr {:x}", regs.program_counter());
+    if regs.program_counter() != libc_base {
+        let data = std::mem::MaybeUninit::<libc::siginfo_t>::uninit();
+        let siginfo = unsafe {
+            libc::ptrace(libc::PTRACE_GETSIGINFO, pid, 0, &data);
+            data.assume_init()
+        };
+        bail!(
+            "stopped at unexpected addr {:x} signo {} si_code {} si_addr {:?}",
+            regs.program_counter(),
+            siginfo.si_signo,
+            siginfo.si_code,
+            unsafe { siginfo.si_addr() },
+        );
+    }
+    if buf_addr == usize::MAX {
+        debug!("errno remote {:x}", errno_remote);
+        let (regs, frame) = frame.invoke_remote(
+            errno_remote,
+            libc_base,
+            &[],
+        )?;
+        debug!("errno called");
+        if regs.program_counter() != libc_base {
+            bail!("stopped at unexpected addr {:x} when getting errno", regs.program_counter());
+        }
+        let err_addr = regs.return_value();
+        let mut buf = [0u8; 4];
+        frame.read_memory_mut(err_addr, &mut buf)?;
+        let err = i32::from_le_bytes(buf);
+        bail!("remote failed with {}", err);
+    }
+    debug!("Buffer addr: {:x}", buf_addr);
+
+    // Load zygisk into remote process
+    frame.write_memory(buf_addr, zygisk_lib.as_bytes_with_nul())?;
+    let (regs, mut frame) = frame.invoke_remote(
+        dlopen_remote,
+        libc_base,
+        &[buf_addr, libc::RTLD_NOW as usize],
+    )?;
+    let handle = regs.return_value();
+    debug!("Load zygisk into remote process: {:x}", handle);
+    if regs.program_counter() != libc_base {
+        let data = std::mem::MaybeUninit::<libc::siginfo_t>::uninit();
+        let siginfo = unsafe {
+            libc::ptrace(libc::PTRACE_GETSIGINFO, pid, 0, &data);
+            data.assume_init()
+        };
+        bail!(
+            "stopped at unexpected addr {:x} signo {} si_code {} si_addr {:?}",
+            regs.program_counter(),
+            siginfo.si_signo,
+            siginfo.si_code,
+            unsafe { siginfo.si_addr() },
+        );
+    }
+    if handle == 0 {
+        debug!("got handle 0");
+        let (regs, frame) = frame.invoke_remote(
+            dlerror_remote,
+            libc_base,
+            &[],
+        )?;
+        let err_addr = regs.return_value();
+        if err_addr == 0 {
+            bail!("dlerror err addr 0");
+        }
+        debug!("err addr {:x}", err_addr);
+        let (regs, frame) = frame.invoke_remote(
+            strlen_remote,
+            libc_base,
+            &[err_addr],
+        )?;
+        let len = regs.return_value();
+        if len == 0 {
+            bail!("dlerror len 0");
+        }
+        debug!("err len {}", len);
+        let mut buf = vec![0u8; len];
+        frame.read_memory_mut(err_addr, buf.as_mut_slice())?;
+        bail!("err {:?}", buf);
+    }
+
+    let entry = CString::new("entry")?;
+    frame.write_memory(buf_addr, entry.as_bytes_with_nul())?;
+    let (regs, frame) = frame.invoke_remote(
+        dlsym_remote,
+        libc_base,
+        &[handle, buf_addr],
+    )?;
+    let entry = regs.return_value();
+    debug!("Call zygisk entry: {:x}", entry);
+    let (_, frame) = frame.invoke_remote(
+        entry,
+        libc_base,
+        &[handle],
+    )?;
+
+    // Cleanup
+    let _ = frame.invoke_remote(
+        munmap_remote,
+        libc_base,
+        &[buf_addr],
+    )?;
+    debug!("Cleaned up");
+    Ok(())
+}
+
+pub fn main() -> Result<()> {
+    info!("Start zygisk ptrace");
+    let args: Vec<String> = env::args().collect();
+    let pid = args[1].parse::<u32>().unwrap();
+    info!("ptracing {} pid {}", lp_select!("zygote32", "zygote64"), pid);
+    ptrace_zygote(pid)?;
+    Ok(())
+}

zygiskd/src/root_impl/kernelsu.rs

@@ -1,11 +1,10 @@
-use nix::libc::prctl;
-use crate::constants::{MIN_KSU_VERSION, MAX_KSU_VERSION};
+use crate::constants::{MAX_KSU_VERSION, MIN_KSU_VERSION};
 
-const KERNEL_SU_OPTION: i32 = 0xdeadbeefu32 as i32;
+const KERNEL_SU_OPTION: u32 = 0xdeadbeefu32;
 
 const CMD_GET_VERSION: usize = 2;
-const CMD_GET_ALLOW_LIST: usize = 5;
-const CMD_GET_DENY_LIST: usize = 6;
+const CMD_UID_GRANTED_ROOT: usize = 12;
+const CMD_UID_SHOULD_UMOUNT: usize = 13;
 
 pub enum Version {
     Supported,
@@ -15,27 +14,55 @@ pub enum Version {
 
 pub fn get_kernel_su() -> Option<Version> {
     let mut version = 0;
-    unsafe { prctl(KERNEL_SU_OPTION, CMD_GET_VERSION, &mut version as *mut i32) };
+    unsafe {
+        libc::prctl(
+            KERNEL_SU_OPTION as i32,
+            CMD_GET_VERSION,
+            &mut version as *mut i32,
+            0,
+            0,
+        )
+    };
     match version {
         0 => None,
         MIN_KSU_VERSION..=MAX_KSU_VERSION => Some(Version::Supported),
         1..=MIN_KSU_VERSION => Some(Version::TooOld),
-        _ => Some(Version::Abnormal)
+        _ => Some(Version::Abnormal),
     }
 }
 
-pub fn uid_on_allowlist(uid: i32) -> bool {
-    let mut size = 1024u32;
-    let mut uids = vec![0; size as usize];
-    unsafe { prctl(KERNEL_SU_OPTION, CMD_GET_ALLOW_LIST, uids.as_mut_ptr(), &mut size as *mut u32) };
-    uids.resize(size as usize, 0);
-    uids.contains(&uid)
+pub fn uid_granted_root(uid: i32) -> bool {
+    let mut result: u32 = 0;
+    let mut granted = false;
+    unsafe {
+        libc::prctl(
+            KERNEL_SU_OPTION as i32,
+            CMD_UID_GRANTED_ROOT,
+            uid,
+            &mut granted as *mut bool,
+            &mut result as *mut u32,
+        )
+    };
+    if result != KERNEL_SU_OPTION {
+        log::warn!("uid_granted_root failed");
+    }
+    granted
 }
 
-pub fn uid_on_denylist(uid: i32) -> bool {
-    let mut size = 1024u32;
-    let mut uids = vec![0; size as usize];
-    unsafe { prctl(KERNEL_SU_OPTION, CMD_GET_DENY_LIST, uids.as_mut_ptr(), &mut size as *mut u32) };
-    uids.resize(size as usize, 0);
-    uids.contains(&uid)
+pub fn uid_should_umount(uid: i32) -> bool {
+    let mut result: u32 = 0;
+    let mut umount = false;
+    unsafe {
+        libc::prctl(
+            KERNEL_SU_OPTION as i32,
+            CMD_UID_SHOULD_UMOUNT,
+            uid,
+            &mut umount as *mut bool,
+            &mut result as *mut u32,
+        )
+    };
+    if result != KERNEL_SU_OPTION {
+        log::warn!("uid_granted_root failed");
+    }
+    umount
 }

zygiskd/src/root_impl/magisk.rs

@@ -23,24 +23,41 @@ pub fn get_magisk() -> Option<Version> {
     })
 }
 
-pub fn uid_on_allowlist(uid: i32) -> bool {
-    let output: Option<String> = Command::new("magisk")
+pub fn uid_granted_root(uid: i32) -> bool {
+    Command::new("magisk")
         .arg("--sqlite")
-        .arg("select uid from policies where policy=2")
+        .arg(format!("select 1 from policies where uid={uid} and policy=2 limit 1"))
+        .stdout(Stdio::piped())
+        .spawn().ok()
+        .and_then(|child| child.wait_with_output().ok())
+        .and_then(|output| String::from_utf8(output.stdout).ok())
+        .map(|output| output.is_empty()) == Some(false)
+}
+
+pub fn uid_should_umount(uid: i32) -> bool {
+    let output = Command::new("pm")
+        .args(["list", "packages", "--uid", &uid.to_string()])
         .stdout(Stdio::piped())
         .spawn().ok()
         .and_then(|child| child.wait_with_output().ok())
         .and_then(|output| String::from_utf8(output.stdout).ok());
-    let lines = match &output {
-        Some(output) => output.lines(),
+    let line = match output {
+        Some(line) => line,
         None => return false,
     };
-    lines.into_iter().any(|line| {
-        line.trim().strip_prefix("uid=").and_then(|uid| uid.parse().ok()) == Some(uid)
-    })
-}
-
-pub fn uid_on_denylist(uid: i32) -> bool {
-    // TODO: uid_on_denylist
-    return false;
+    let pkg = line
+        .strip_prefix("package:")
+        .and_then(|line| line.split(' ').next());
+    let pkg = match pkg {
+        Some(pkg) => pkg,
+        None => return false,
+    };
+    Command::new("magisk")
+        .arg("--sqlite")
+        .arg(format!("select 1 from denylist where package_name=\"{pkg}\" limit 1"))
+        .stdout(Stdio::piped())
+        .spawn().ok()
+        .and_then(|child| child.wait_with_output().ok())
+        .and_then(|output| String::from_utf8(output.stdout).ok())
+        .map(|output| output.is_empty()) == Some(false)
 }

zygiskd/src/root_impl/mod.rs

@@ -10,7 +10,6 @@ pub enum RootImpl {
     Magisk,
 }
 
-// FIXME: OnceCell bugs on 32 bit
 static mut ROOT_IMPL: RootImpl = RootImpl::None;
 
 pub fn setup() {
@@ -41,21 +40,18 @@ pub fn get_impl() -> &'static RootImpl {
     unsafe { &ROOT_IMPL }
 }
 
-// FIXME: Without #[inline(never)], this function will lag forever
-#[inline(never)]
-pub fn uid_on_allowlist(uid: i32) -> bool {
+pub fn uid_granted_root(uid: i32) -> bool {
     match get_impl() {
-        RootImpl::KernelSU => kernelsu::uid_on_allowlist(uid),
-        RootImpl::Magisk => magisk::uid_on_allowlist(uid),
+        RootImpl::KernelSU => kernelsu::uid_granted_root(uid),
+        RootImpl::Magisk => magisk::uid_granted_root(uid),
         _ => unreachable!(),
     }
 }
 
-#[inline(never)]
-pub fn uid_on_denylist(uid: i32) -> bool {
+pub fn uid_should_umount(uid: i32) -> bool {
     match get_impl() {
-        RootImpl::KernelSU => kernelsu::uid_on_denylist(uid),
-        RootImpl::Magisk => magisk::uid_on_denylist(uid),
+        RootImpl::KernelSU => kernelsu::uid_should_umount(uid),
+        RootImpl::Magisk => magisk::uid_should_umount(uid),
         _ => unreachable!(),
     }
 }

zygiskd/src/utils.rs

@@ -1,11 +1,12 @@
 use anyhow::Result;
-use nix::unistd::gettid;
-use std::{fs, io::{Read, Write}, os::unix::net::UnixStream, process::Command};
-use std::ffi::c_char;
-use std::os::fd::FromRawFd;
+use std::{fs, io::{Read, Write}, os::unix::net::UnixStream};
+use std::ffi::{c_char, CStr, CString};
+use std::os::fd::AsFd;
 use std::os::unix::net::UnixListener;
-use nix::sys::socket::{AddressFamily, SockFlag, SockType, UnixAddr};
-use rand::distributions::{Alphanumeric, DistString};
+use std::process::Command;
+use std::sync::OnceLock;
+use rustix::net::{AddressFamily, bind_unix, listen, socket, SocketAddrUnix, SocketType};
+use rustix::thread::gettid;
 
 #[cfg(target_pointer_width = "64")]
 #[macro_export]
@@ -18,8 +19,36 @@ macro_rules! lp_select {
     ($lp32:expr, $lp64:expr) => { $lp32 };
 }
 
-pub fn random_string() -> String {
-    Alphanumeric.sample_string(&mut rand::thread_rng(), 8)
+#[cfg(debug_assertions)]
+#[macro_export]
+macro_rules! debug_select {
+    ($debug:expr, $release:expr) => { $debug };
+}
+#[cfg(not(debug_assertions))]
+#[macro_export]
+macro_rules! debug_select {
+    ($debug:expr, $release:expr) => { $release };
+}
+
+pub struct LateInit<T> {
+    cell: OnceLock<T>,
+}
+
+impl<T> LateInit<T> {
+    pub const fn new() -> Self {
+        LateInit { cell: OnceLock::new() }
+    }
+
+    pub fn init(&self, value: T) {
+        assert!(self.cell.set(value).is_ok())
+    }
+}
+
+impl<T> std::ops::Deref for LateInit<T> {
+    type Target = T;
+    fn deref(&self) -> &T {
+        self.cell.get().unwrap()
+    }
 }
 
 pub fn set_socket_create_context(context: &str) -> Result<()> {
@@ -27,40 +56,51 @@ pub fn set_socket_create_context(context: &str) -> Result<()> {
     match fs::write(path, context) {
         Ok(_) => Ok(()),
         Err(_) => {
-            let path = format!("/proc/self/task/{}/attr/sockcreate", gettid().as_raw());
+            let path = format!("/proc/self/task/{}/attr/sockcreate", gettid().as_raw_nonzero());
             fs::write(path, context)?;
             Ok(())
         }
     }
 }
 
-pub fn get_native_bridge() -> String {
-    std::env::var("NATIVE_BRIDGE").unwrap_or_default()
+pub fn chcon(path: &str, context: &str) -> Result<()> {
+    Command::new("chcon").arg(context).arg(path).status()?;
+    Ok(())
 }
 
 pub fn log_raw(level: i32, tag: &str, message: &str) -> Result<()> {
-    let tag = std::ffi::CString::new(tag)?;
-    let message = std::ffi::CString::new(message)?;
+    let tag = CString::new(tag)?;
+    let message = CString::new(message)?;
     unsafe {
-        __android_log_print(level as i32, tag.as_ptr(), message.as_ptr());
+        __android_log_print(level, tag.as_ptr(), message.as_ptr());
     }
     Ok(())
 }
 
 pub fn get_property(name: &str) -> Result<String> {
-    let name = std::ffi::CString::new(name)?;
+    let name = CString::new(name)?;
     let mut buf = vec![0u8; 92];
-    unsafe {
+    let prop = unsafe {
         __system_property_get(name.as_ptr(), buf.as_mut_ptr() as *mut c_char);
-    }
-    Ok(String::from_utf8(buf)?)
+        CStr::from_bytes_until_nul(&buf)?
+    };
+    Ok(prop.to_string_lossy().to_string())
 }
 
 pub fn set_property(name: &str, value: &str) -> Result<()> {
-    Command::new("resetprop")
-        .arg(name)
-        .arg(value)
-        .spawn()?.wait()?;
+    let name = CString::new(name)?;
+    let value = CString::new(value)?;
+    unsafe {
+        __system_property_set(name.as_ptr(), value.as_ptr());
+    }
+    Ok(())
+}
+
+pub fn switch_mount_namespace(pid: i32) -> Result<()> {
+    let cwd = std::env::current_dir()?;
+    let mnt = fs::File::open(format!("/proc/{}/ns/mnt", pid))?;
+    rustix::thread::move_into_link_name_space(mnt.as_fd(), None)?;
+    std::env::set_current_dir(cwd)?;
     Ok(())
 }
 
@@ -123,17 +163,18 @@ impl UnixStreamExt for UnixStream {
     }
 }
 
-// TODO: Replace with SockAddrExt::from_abstract_name when it's stable
-pub fn abstract_namespace_socket(name: &str) -> Result<UnixListener> {
-    let addr = UnixAddr::new_abstract(name.as_bytes())?;
-    let socket = nix::sys::socket::socket(AddressFamily::Unix, SockType::Stream, SockFlag::empty(), None)?;
-    nix::sys::socket::bind(socket, &addr)?;
-    nix::sys::socket::listen(socket, 2)?;
-    let listener = unsafe { UnixListener::from_raw_fd(socket) };
-    Ok(listener)
+pub fn unix_listener_from_path(path: &str) -> Result<UnixListener> {
+    let _ = fs::remove_file(path);
+    let addr = SocketAddrUnix::new(path)?;
+    let socket = socket(AddressFamily::UNIX, SocketType::STREAM, None)?;
+    bind_unix(&socket, &addr)?;
+    listen(&socket, 2)?;
+    chcon(path, "u:object_r:magisk_file:s0")?;
+    Ok(UnixListener::from(socket))
 }
 
 extern "C" {
     fn __android_log_print(prio: i32, tag: *const c_char, fmt: *const c_char, ...) -> i32;
     fn __system_property_get(name: *const c_char, value: *mut c_char) -> u32;
+    fn __system_property_set(name: *const c_char, value: *const c_char) -> u32;
 }

zygiskd/src/watchdog.rs

@@ -1,46 +1,50 @@
 use crate::{constants, root_impl, utils};
 use anyhow::{bail, Result};
-use nix::unistd::{getgid, getuid, Pid};
-use std::process::{Child, Command};
-use std::sync::mpsc;
-use std::{fs, io, thread};
-use std::ffi::CString;
-use std::io::{BufRead, Write};
-use std::os::unix::net::UnixListener;
+use std::fs;
+use std::future::Future;
+use std::io::{BufRead, BufReader, Write};
+use std::pin::Pin;
 use std::time::Duration;
 use binder::IBinder;
-use nix::errno::Errno;
-use nix::libc;
-use nix::sys::signal::{kill, Signal};
-use once_cell::sync::OnceCell;
+use futures::stream::FuturesUnordered;
+use futures::StreamExt;
+use log::{debug, error, info};
+use rustix::mount::mount_bind;
+use rustix::process::{getgid, getuid, kill_process, Pid, Signal};
+use tokio::process::{Child, Command};
+use crate::utils::LateInit;
 
-static LOCK: OnceCell<UnixListener> = OnceCell::new();
-static PROP_SECTIONS: OnceCell<[String; 2]> = OnceCell::new();
+static PROP_SECTIONS: LateInit<[String; 2]> = LateInit::new();
 
-pub fn entry() -> Result<()> {
-    log::info!("Start zygisksu watchdog");
+pub async fn main() -> Result<()> {
+    let result = run().await;
+    if result.is_err() {
+        set_prop_hint(constants::STATUS_CRASHED)?;
+    }
+    result
+}
+
+async fn run() -> Result<()> {
+    info!("Start zygisk watchdog");
     check_permission()?;
-    ensure_single_instance()?;
-    mount_prop()?;
+    mount_prop().await?;
     if check_and_set_hint()? == false {
         log::warn!("Requirements not met, exiting");
-        utils::set_property(constants::PROP_NATIVE_BRIDGE, &utils::get_native_bridge())?;
         return Ok(());
     }
-    let end = spawn_daemon();
-    set_prop_hint(constants::STATUS_CRASHED)?;
-    end
+    spawn_daemon().await?;
+    Ok(())
 }
 
 fn check_permission() -> Result<()> {
-    log::info!("Check permission");
+    info!("Check permission");
     let uid = getuid();
-    if uid.as_raw() != 0 {
+    if !uid.is_root() {
         bail!("UID is not 0");
     }
 
     let gid = getgid();
-    if gid.as_raw() != 0 {
+    if !gid.is_root() {
         bail!("GID is not 0");
     }
 
@@ -53,32 +57,11 @@ fn check_permission() -> Result<()> {
     Ok(())
 }
 
-fn ensure_single_instance() -> Result<()> {
-    log::info!("Ensure single instance");
-    let name = String::from("zygiskwd") + constants::SOCKET_PLACEHOLDER;
-    match utils::abstract_namespace_socket(&name) {
-        Ok(socket) => { let _ = LOCK.set(socket); }
-        Err(e) => bail!("Failed to acquire lock: {e}. Maybe another instance is running?")
-    }
-    Ok(())
-}
-
-fn mount_prop() -> Result<()> {
-    let module_prop = if let root_impl::RootImpl::Magisk = root_impl::get_impl() {
-        let magisk_path = Command::new("magisk").arg("--path").output()?;
-        let mut magisk_path = String::from_utf8(magisk_path.stdout)?;
-        magisk_path.pop(); // Removing '\n'
-        let cwd = std::env::current_dir()?;
-        let dir = cwd.file_name().unwrap().to_string_lossy();
-        format!("{magisk_path}/.magisk/modules/{dir}/{}", constants::PATH_MODULE_PROP)
-    } else {
-        constants::PATH_MODULE_PROP.to_string()
-    };
-    log::info!("Mount {module_prop}");
-    let module_prop_file = fs::File::open(&module_prop)?;
+async fn mount_prop() -> Result<()> {
+    let module_prop_file = fs::File::open(constants::PATH_MODULE_PROP)?;
     let mut section = 0;
     let mut sections: [String; 2] = [String::new(), String::new()];
-    let lines = io::BufReader::new(module_prop_file).lines();
+    let lines = BufReader::new(module_prop_file).lines();
     for line in lines {
         let line = line?;
         if line.starts_with("description=") {
@@ -91,34 +74,21 @@ fn mount_prop() -> Result<()> {
             sections[section].push('\n');
         }
     }
-    let _ = PROP_SECTIONS.set(sections);
-
-    fs::create_dir(constants::PATH_TMP_DIR)?;
-    fs::File::create(constants::PATH_TMP_PROP)?;
-
-    // FIXME: sys_mount cannot be compiled on 32 bit
-    unsafe {
-        let r = libc::mount(
-            CString::new(constants::PATH_TMP_PROP)?.as_ptr(),
-            CString::new(module_prop)?.as_ptr(),
-            std::ptr::null(),
-            libc::MS_BIND,
-            std::ptr::null(),
-        );
-        Errno::result(r)?;
-    }
+    PROP_SECTIONS.init(sections);
 
+    info!("Mount {} -> {}", constants::PATH_PROP_OVERLAY, constants::PATH_MODULE_PROP);
+    fs::File::create(constants::PATH_PROP_OVERLAY)?;
+    mount_bind(constants::PATH_PROP_OVERLAY, constants::PATH_MODULE_PROP)?;
     Ok(())
 }
 
 fn set_prop_hint(hint: &str) -> Result<()> {
-    let mut file = fs::File::create(constants::PATH_TMP_PROP)?;
-    let sections = PROP_SECTIONS.get().unwrap();
-    file.write_all(sections[0].as_bytes())?;
+    let mut file = fs::File::create(constants::PATH_PROP_OVERLAY)?;
+    file.write_all(PROP_SECTIONS[0].as_bytes())?;
     file.write_all(b"[")?;
     file.write_all(hint.as_bytes())?;
     file.write_all(b"] ")?;
-    file.write_all(sections[1].as_bytes())?;
+    file.write_all(PROP_SECTIONS[1].as_bytes())?;
     Ok(())
 }
 
@@ -137,47 +107,55 @@ fn check_and_set_hint() -> Result<bool> {
     Ok(false)
 }
 
-fn spawn_daemon() -> Result<()> {
+async fn spawn_daemon() -> Result<()> {
     let mut lives = 5;
     loop {
-        let daemon32 = Command::new(constants::PATH_ZYGISKD32).arg("daemon").spawn();
-        let daemon64 = Command::new(constants::PATH_ZYGISKD64).arg("daemon").spawn();
+        let mut futures = FuturesUnordered::<Pin<Box<dyn Future<Output=Result<()>>>>>::new();
         let mut child_ids = vec![];
-        let (sender, receiver) = mpsc::channel();
-        let mut spawn = |mut daemon: Child| {
-            child_ids.push(daemon.id());
-            let sender = sender.clone();
-            thread::spawn(move || {
-                let result = daemon.wait().unwrap();
-                log::error!("Daemon process {} died: {}", daemon.id(), result);
-                drop(daemon);
-                let _ = sender.send(());
-            });
-        };
-        if let Ok(it) = daemon32 { spawn(it) }
-        if let Ok(it) = daemon64 { spawn(it) }
-
-        let mut binder = loop {
-            if receiver.try_recv().is_ok() {
-                bail!("Daemon died before system server ready");
-            }
-            match binder::get_service("activity") {
-                Some(binder) => break binder,
-                None => {
-                    log::trace!("System server not ready, wait for 1s...");
-                    thread::sleep(Duration::from_secs(1));
-                }
-            };
-        };
-        log::info!("System server ready, restore native bridge");
-        utils::set_property(constants::PROP_NATIVE_BRIDGE, &utils::get_native_bridge())?;
-
-        loop {
-            if receiver.try_recv().is_ok() || binder.ping_binder().is_err() { break; }
-            thread::sleep(Duration::from_secs(1))
+        let daemon32 = Command::new(constants::PATH_CP_BIN32).arg("daemon").spawn();
+        let daemon64 = Command::new(constants::PATH_CP_BIN64).arg("daemon").spawn();
+        async fn spawn_daemon(mut daemon: Child) -> Result<()> {
+            let result = daemon.wait().await?;
+            log::error!("Daemon process {} died: {}", daemon.id().unwrap(), result);
+            Ok(())
         }
+        if let Ok(it) = daemon32 {
+            child_ids.push(it.id().unwrap());
+            futures.push(Box::pin(spawn_daemon(it)));
+        }
+        if let Ok(it) = daemon64 {
+            child_ids.push(it.id().unwrap());
+            futures.push(Box::pin(spawn_daemon(it)));
+        }
+
+        async fn binder_listener() -> Result<()> {
+            let mut binder = loop {
+                match binder::get_service("activity") {
+                    Some(binder) => break binder,
+                    None => {
+                        log::trace!("System server not ready, wait for 1s...");
+                        tokio::time::sleep(Duration::from_secs(1)).await;
+                    }
+                };
+            };
+
+            info!("System server ready");
+
+            loop {
+                if binder.ping_binder().is_err() { break; }
+                tokio::time::sleep(Duration::from_secs(1)).await;
+            }
+            bail!("System server died");
+        }
+        futures.push(Box::pin(binder_listener()));
+
+        if let Err(e) = futures.next().await.unwrap() {
+            error!("{}", e);
+        }
+
         for child in child_ids {
-            let _ = kill(Pid::from_raw(child as i32), Signal::SIGKILL);
+            debug!("Killing child process {}", child);
+            let _ = kill_process(Pid::from_raw(child as i32).unwrap(), Signal::Kill);
         }
 
         lives -= 1;
@@ -185,8 +163,7 @@ fn spawn_daemon() -> Result<()> {
             bail!("Too many crashes, abort");
         }
 
-        log::error!("Restarting zygote...");
-        utils::set_property(constants::PROP_NATIVE_BRIDGE, constants::ZYGISK_LOADER)?;
+        error!("Restarting zygote...");
         utils::set_property(constants::PROP_CTL_RESTART, "zygote")?;
     }
 }

zygiskd/src/zygiskd.rs

@@ -1,37 +1,36 @@
-use crate::constants::DaemonSocketAction;
+use std::ffi::c_void;
+use crate::constants::{DaemonSocketAction, ProcessFlags};
 use crate::utils::UnixStreamExt;
-use crate::{constants, lp_select, root_impl, utils};
+use crate::{constants, dl, lp_select, root_impl, utils};
 use anyhow::{bail, Result};
-use memfd::Memfd;
-use nix::{
-    fcntl::{fcntl, FcntlArg, FdFlag},
-    libc::self,
-};
 use passfd::FdPassingExt;
-use std::sync::{Arc, Mutex};
+use std::sync::Arc;
 use std::thread;
 use std::fs;
+use std::os::fd::OwnedFd;
 use std::os::unix::{
     net::{UnixListener, UnixStream},
     prelude::AsRawFd,
 };
-use std::os::unix::process::CommandExt;
 use std::path::PathBuf;
-use std::process::Command;
+use rustix::fs::fstat;
+use rustix::process::{set_parent_process_death_signal, Signal};
+
+type ZygiskCompanionEntryFn = unsafe extern "C" fn(i32);
 
 struct Module {
     name: String,
-    memfd: Memfd,
-    companion: Mutex<Option<UnixStream>>,
+    lib_fd: OwnedFd,
+    entry: Option<ZygiskCompanionEntryFn>,
 }
 
 struct Context {
-    native_bridge: String,
     modules: Vec<Module>,
 }
 
-pub fn entry() -> Result<()> {
-    unsafe { libc::prctl(libc::PR_SET_PDEATHSIG, libc::SIGKILL) };
+pub fn main() -> Result<()> {
+    log::info!("Start zygisk companion");
+    set_parent_process_death_signal(Some(Signal::Kill))?;
 
     let arch = get_arch()?;
     log::debug!("Daemon architecture: {arch}");
@@ -40,7 +39,6 @@ pub fn entry() -> Result<()> {
     let modules = load_modules(arch)?;
 
     let context = Context {
-        native_bridge: utils::get_native_bridge(),
         modules,
     };
     let context = Arc::new(context);
@@ -82,8 +80,8 @@ fn load_modules(arch: &str) -> Result<Vec<Module>> {
             return Ok(modules);
         }
     };
-    for entry_result in dir.into_iter() {
-        let entry = entry_result?;
+    for entry in dir.into_iter() {
+        let entry = entry?;
         let name = entry.file_name().into_string().unwrap();
         let so_path = entry.path().join(format!("zygisk/{arch}.so"));
         let disabled = entry.path().join("disable");
@@ -91,30 +89,28 @@ fn load_modules(arch: &str) -> Result<Vec<Module>> {
             continue;
         }
         log::info!("  Loading module `{name}`...");
-        let memfd = match create_memfd(&so_path) {
-            Ok(memfd) => memfd,
+        let lib_fd = match create_library_fd(&so_path) {
+            Ok(fd) => fd,
             Err(e) => {
                 log::warn!("  Failed to create memfd for `{name}`: {e}");
                 continue;
             }
         };
-        let companion = match spawn_companion(&name, &memfd) {
-            Ok(companion) => companion,
-            Err(e) => {
-                log::warn!("  Failed to spawn companion for `{name}`: {e}");
-                continue;
-            }
-        };
-
-        let companion = Mutex::new(companion);
-        let module = Module { name, memfd, companion };
+        let entry = resolve_module(&so_path.to_string_lossy())?;
+        let module = Module { name, lib_fd, entry };
         modules.push(module);
     }
 
     Ok(modules)
 }
 
-fn create_memfd(so_path: &PathBuf) -> Result<Memfd> {
+#[cfg(debug_assertions)]
+fn create_library_fd(so_path: &PathBuf) -> Result<OwnedFd> {
+    Ok(OwnedFd::from(fs::File::open(so_path)?))
+}
+
+#[cfg(not(debug_assertions))]
+fn create_library_fd(so_path: &PathBuf) -> Result<OwnedFd> {
     let opts = memfd::MemfdOptions::default().allow_sealing(true);
     let memfd = opts.create("jit-cache")?;
     let file = fs::File::open(so_path)?;
@@ -129,38 +125,26 @@ fn create_memfd(so_path: &PathBuf) -> Result<Memfd> {
     seals.insert(memfd::FileSeal::SealSeal);
     memfd.add_seals(&seals)?;
 
-    Ok(memfd)
+    Ok(OwnedFd::from(memfd.into_file()))
 }
 
 fn create_daemon_socket() -> Result<UnixListener> {
     utils::set_socket_create_context("u:r:zygote:s0")?;
-    let prefix = lp_select!("zygiskd32", "zygiskd64");
-    let name = String::from(prefix) + constants::SOCKET_PLACEHOLDER;
-    let listener = utils::abstract_namespace_socket(&name)?;
-    log::debug!("Daemon socket: {name}");
+    log::debug!("Daemon socket: {}", constants::PATH_CP_SOCKET);
+    let listener = utils::unix_listener_from_path(constants::PATH_CP_SOCKET)?;
     Ok(listener)
 }
 
-fn spawn_companion(name: &str, memfd: &Memfd) -> Result<Option<UnixStream>> {
-    let (mut daemon, companion) = UnixStream::pair()?;
-    // Remove FD_CLOEXEC flag
-    fcntl(companion.as_raw_fd(), FcntlArg::F_SETFD(FdFlag::empty()))?;
-
-    let process = std::env::args().next().unwrap();
-    let nice_name = process.split('/').last().unwrap();
-    Command::new(&process)
-        .arg0(format!("{}-{}", nice_name, name))
-        .arg("companion")
-        .arg(format!("{}", companion.as_raw_fd()))
-        .spawn()?;
-    drop(companion);
-
-    daemon.write_string(name)?;
-    daemon.send_fd(memfd.as_raw_fd())?;
-    match daemon.read_u8()? {
-        0 => Ok(None),
-        1 => Ok(Some(daemon)),
-        _ => bail!("Invalid companion response"),
+fn resolve_module(path: &str) -> Result<Option<ZygiskCompanionEntryFn>> {
+    unsafe {
+        let handle = dl::dlopen(path, libc::RTLD_NOW)?;
+        let symbol = std::ffi::CString::new("zygisk_companion_entry")?;
+        let entry = libc::dlsym(handle, symbol.as_ptr());
+        if entry.is_null() {
+            return Ok(None);
+        }
+        let fnptr = std::mem::transmute::<*mut c_void, ZygiskCompanionEntryFn>(entry);
+        Ok(Some(fnptr))
     }
 }
 
@@ -183,48 +167,52 @@ fn handle_daemon_action(mut stream: UnixStream, context: &Context) -> Result<()>
                 utils::log_raw(level as i32, &tag, &message)?;
             }
         }
-        DaemonSocketAction::ReadNativeBridge => {
-            stream.write_string(&context.native_bridge)?;
-        }
         DaemonSocketAction::GetProcessFlags => {
             let uid = stream.read_u32()? as i32;
-            let mut flags = 0u32;
-            if root_impl::uid_on_allowlist(uid) {
-                flags |= constants::PROCESS_GRANTED_ROOT;
+            let mut flags = ProcessFlags::empty();
+            if root_impl::uid_granted_root(uid) {
+                flags |= ProcessFlags::PROCESS_GRANTED_ROOT;
             }
-            if root_impl::uid_on_denylist(uid) {
-                flags |= constants::PROCESS_ON_DENYLIST;
+            if root_impl::uid_should_umount(uid) {
+                flags |= ProcessFlags::PROCESS_ON_DENYLIST;
             }
             match root_impl::get_impl() {
-                root_impl::RootImpl::KernelSU => flags |= constants::PROCESS_ROOT_IS_KSU,
-                root_impl::RootImpl::Magisk => flags |= constants::PROCESS_ROOT_IS_MAGISK,
-                _ => ()
+                root_impl::RootImpl::KernelSU => flags |= ProcessFlags::PROCESS_ROOT_IS_KSU,
+                root_impl::RootImpl::Magisk => flags |= ProcessFlags::PROCESS_ROOT_IS_MAGISK,
+                _ => unreachable!(),
             }
-            // TODO: PROCESS_IS_SYSUI?
-            stream.write_u32(flags)?;
+            log::trace!("Uid {} granted root: {}", uid, flags.contains(ProcessFlags::PROCESS_GRANTED_ROOT));
+            log::trace!("Uid {} on denylist: {}", uid, flags.contains(ProcessFlags::PROCESS_ON_DENYLIST));
+            stream.write_u32(flags.bits())?;
         }
         DaemonSocketAction::ReadModules => {
             stream.write_usize(context.modules.len())?;
             for module in context.modules.iter() {
                 stream.write_string(&module.name)?;
-                stream.send_fd(module.memfd.as_raw_fd())?;
+                stream.send_fd(module.lib_fd.as_raw_fd())?;
             }
         }
         DaemonSocketAction::RequestCompanionSocket => {
             let index = stream.read_usize()?;
             let module = &context.modules[index];
-            let mut companion = module.companion.lock().unwrap();
-            match companion.as_ref() {
-                Some(sock) => {
-                    if let Err(_) = sock.send_fd(stream.as_raw_fd()) {
-                        log::error!("Companion of module `{}` crashed", module.name);
-                        companion.take();
-                        stream.write_u8(0)?;
-                    }
-                    // Ok: Send by companion
-                }
+            match module.entry {
                 None => {
                     stream.write_u8(0)?;
+                    return Ok(());
+                }
+                Some(companion) => {
+                    stream.write_u8(1)?;
+                    let st0 = fstat(&stream)?;
+                    unsafe { companion(stream.as_raw_fd()); }
+                    // Only close client if it is the same file so we don't
+                    // accidentally close a re-used file descriptor.
+                    // This check is required because the module companion
+                    // handler could've closed the file descriptor already.
+                    if let Ok(st1) = fstat(&stream) {
+                        if st0.st_dev != st1.st_dev || st0.st_ino != st1.st_ino {
+                            std::mem::forget(stream);
+                        }
+                    }
                 }
             }
         }