Skip to content

feat(dex2oat): inject dex2oat instead of mount for anti-detection - #1041

Draft
VeryBaaad wants to merge 1 commit into
JingMatrix:masterfrom
VeryBaaad:feat/injectnotmount
Draft

VeryBaaad wants to merge 1 commit into
JingMatrix:masterfrom
VeryBaaad:feat/injectnotmount

Conversation

@VeryBaaad

Copy link
Copy Markdown

This is an optional feature, and it requires Zygisk Next API support rather than Zygisk API support.

Use an injection-based approach to resolve potential mount-related leaks involving the dex2oat wrapper on Android 17. Furthermore, employ injection exclusively on Android 10 and later versions to prevent kernel-timing side-channel detection that could arise from the use of mounts.

On Android 10–16, dex2oat is launched directly via fork+exec from installd; on Android 17 (as well as on Android 15+ and Android 14 with ART Service), it is initiated by artd using art_exec --keep-fds=... -- dex2oat....

For those who prefer not to use the closed-source ZygiskNext, ZNNext is an available alternative. Additionally, since this feature is optional, it will automatically disable itself if ZN API support is unavailable.

Tip: LSPosed Internal Test added this injection starting with version 7848-it.

@VeryBaaad
VeryBaaad force-pushed the feat/injectnotmount branch from 98cefb0 to 883bb01 Compare October 28, 2026 13:39
@VeryBaaad
VeryBaaad marked this pull request as draft October 28, 2026 14:49
@VeryBaaad VeryBaaad changed the title feat(dex2oat): inject dex2oat instead of mount to anti-detection feat(dex2oat): inject dex2oat instead of mount for anti-detection Oct 28, 2026
@VeryBaaad
VeryBaaad force-pushed the feat/injectnotmount branch from 883bb01 to 77b1e10 Compare October 28, 2026 15:10
@VeryBaaad
VeryBaaad marked this pull request as ready for review October 28, 2026 15:10
@VeryBaaad
VeryBaaad force-pushed the feat/injectnotmount branch from 77b1e10 to f19e7b8 Compare October 28, 2026 15:25
@sekaiacg

sekaiacg commented Nov 4, 2026

Copy link
Copy Markdown

Injection successful.
The status is mounted.
dex2oat has been detected.
Screenshot_2026-11-04-16-15-53-543_com android sh
Screenshot_2026-11-04-16-16-23-790_com resukisu r
Screenshot_2026-11-04-16-18-00-191_com eltavine d

Device: Xiaomi 17 Pro Max
Version: Android 17 / OS4
Env: Zygisk Next v1.5.2

@VeryBaaad
VeryBaaad marked this pull request as draft November 4, 2026 10:40
@VeryBaaad

Copy link
Copy Markdown
Author

Injection successful. The status is mounted. dex2oat has been detected. Screenshot_2026-11-04-16-15-53-543_com android sh Screenshot_2026-11-04-16-16-23-790_com resukisu r Screenshot_2026-11-04-16-18-00-191_com eltavine d

Device: Xiaomi 17 Pro Max Version: Android 17 / OS4 Env: Zygisk Next v1.5.2

Log

@sekaiacg

sekaiacg commented Nov 4, 2026

Copy link
Copy Markdown

@VeryBaaad
debug version:
Vector-logs-debug-20261104-200926.zip

@VeryBaaad
VeryBaaad force-pushed the feat/injectnotmount branch from f19e7b8 to da0fed4 Compare November 4, 2026 15:14
@VeryBaaad

Copy link
Copy Markdown
Author

@sekaiacg Try again

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants