Skip to content

Refactor native modules and migrate to new Zygisk architecture#550

Merged
JingMatrix merged 24 commits intomasterfrom
refactor
Mar 6, 2026
Merged

Refactor native modules and migrate to new Zygisk architecture#550
JingMatrix merged 24 commits intomasterfrom
refactor

Conversation

@JingMatrix
Copy link
Copy Markdown
Owner

We replace the legacy magisk-loader and core JNI with a rewritten Zygisk module and a centralized native library.

Major changes:

  • Zygisk Module: Replaced magisk-loader with a rewritten Zygisk implementation in Kotlin and C++.
  • Native Migration: Moved ELF parsing, symbol caching, and hooking logic from core/jni to a standalone native module.
  • Anti-detection: Removed enforced parcel descriptors to evade heap-based string detection.
  • Scripting: Simplified Magisk module shell scripts (customize.sh, service.sh) and removed redundant utility functions.
  • Compatibility: Maintained zygisk.json and the lspd directory to ensure a smooth update path and database continuity.

@JingMatrix
Copy link
Copy Markdown
Owner Author

@Dev4Mod, @Stillhard, @ale5000-git, please test this refactor build and have a look at the code documentation I added.
You can preview the docs in the refactor branch, e.g., https://github.com/JingMatrix/LSPosed/blob/refactor/native/README.md, https://github.com/JingMatrix/LSPosed/blob/refactor/zygisk/README.md.

Leave your comments if you spot errors, or current docs / codes are still unclear for you.

@Dev4Mod
Copy link
Copy Markdown

Dev4Mod commented Mar 5, 2026

It failed on my device, and even crashed Zygisk
lspd-logs.zip

@JingMatrix
Copy link
Copy Markdown
Owner Author

It seems to be a symbol resolution problem. Please test the latest CI again and upload logs.
If the problem is not solved, please also upload logs of the debug version of v1.11.0 in GitHub Release for me to compare and locate the issue.

@huynhbaman

This comment was marked as outdated.

@huynhbaman
Copy link
Copy Markdown

Crash zygisk bro

@JingMatrix
Copy link
Copy Markdown
Owner Author

@huynhbaman If you can, please provide logs as described in #123.

@huynhbaman
Copy link
Copy Markdown

huynhbaman commented Mar 5, 2026

@huynhbaman If you can, please provide logs as described in #123.

Screenshot_20260305_220147_KernelSU Next.jpg

@JingMatrix
Copy link
Copy Markdown
Owner Author

@Dev4Mod @huynhbaman Please test again the latest CI buid: https://github.com/JingMatrix/LSPosed/actions/runs/22737067570

@Dev4Mod
Copy link
Copy Markdown

Dev4Mod commented Mar 5, 2026

Vector has now started normally, however there is a problem with my WAEnhancer module which uses XC_InitPackageResources to obtain resources.
See the logs, I also see other errors occurring silently in the parasite:
vector_logs.zip

@huynhbaman
Copy link
Copy Markdown

@Dev4Mod @huynhbaman Please test again the latest CI buid: https://github.com/JingMatrix/LSPosed/actions/runs/22737067570

It already fixed
Screenshot_20260306_051214_KernelSU Next.jpg

@JingMatrix
Copy link
Copy Markdown
Owner Author

@Dev4Mod Please test https://github.com/JingMatrix/LSPosed/actions/runs/22758702203 and upload logs if anything abnormal is observed.

@Dev4Mod
Copy link
Copy Markdown

Dev4Mod commented Mar 6, 2026

It's working fine now, with no error logs in Vector.

Note that the signature of rewriteXmlReferencesNative is changed to
separate sub-projects xposed and core.
Better to change it after database is redesigned
Java string created via NewStringUTF is detectable by searching the JVM heap.

Renaming `LSPosed` to another string, is stupid but can defeat detectors such as
https://github.com/RiRiRawrZ615/Known-Root-Detectors/blob/main/Risk%20Detector_1.6.apk

Of course, there are plenty of robust solutions to overcome this detection point.
This commit is just for fun, in the process of refactoring LSPosed into Vector.
Add more comments and simplify logic
1. Avoid hard-coding transaction codes for maintance convience.
2. No need to enforce descriptor, which only introduce detection point.
However, we should keep the file `zygisk.json` for smooth updating experience.
This part is replaced by the native module
Using bias_ comparison could be buggy
The Android dynamic linker (Bionic) restricts loading libraries from unauthorized paths via LD_PRELOAD. This causes the linker to reject the hook library with a "not accessible for the namespace" fatal error.

To bypass this restriction, we exploit a fallback in Bionic that explicitly skips the namespace accessibility check for files located on tmpfs. We use `memfd_create` to create an anonymous tmpfs-backed file descriptor, copy the library into it using `sendfile`, and pass the new memfd to LD_PRELOAD instead.

Reference: function `load_library` in https://cs.android.com/android/platform/superproject/main/+/main:bionic/linker/linker.cpp
Correct bugs in dynamical construction of XResources methods.
@JingMatrix JingMatrix merged commit bee5f2e into master Mar 6, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants