You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Zygisk-Loader** is a stealthy, high-performance Zygisk module written in **Rust**. It acts as a universal bridge that dynamically injects external shared libraries (`.so`) into specific Android application processes.
7
+
**Zygisk-Loader** is a stealthy, ultra-lightweight Zygisk module written in **Pure C**. It acts as a universal bridge that dynamically injects external shared libraries (`.so`) into specific Android application processes.
8
8
9
-
Unlike traditional modules that require rebuilding and rebooting, **Zygisk-Loader** enables a **"Hot-Swap" workflow**. You can recompile your instrumentation library, push it to the device, and simply restart the target app to apply changes instantly.
9
+
Rewritten from Rust to C, this module now boasts an incredibly small footprint (**< 20KB**) with zero runtime dependencies. Unlike traditional modules that require rebuilding and rebooting, **Zygisk-Loader** enables a **"Hot-Swap" workflow**. You can recompile your instrumentation library, push it to the device, and simply restart the target app to apply changes instantly.
10
10
11
11
## Key Features
12
12
13
13
***Hot-Swap Capable**: Update your payload (`.so`) and deploy instantly by just restarting the target app. No device reboot required.
14
+
***Ultra-Lightweight**: Built with **Pure C** and standard Android NDK libraries. The module binary is microscopic (<20KB), ensuring minimal memory usage and maximum performance.
14
15
***Robust Injection**: Uses a **RAM-Buffering Strategy**. The payload is read into memory with Root privileges, then written to the app's cache in the post-specialize phase. This ensures compatibility with strict SELinux policies and isolated processes.
15
16
***Stealthy (Self-Deleting)**: The payload is written to disk, loaded, and **immediately unlinked**. The file vanishes from the filesystem instantly, leaving minimal traces for file scanners.
16
17
***Zygisk API v5**: Utilizes the latest Zygisk API for maximum compatibility with Magisk, KernelSU, and APatch.
17
18
***Config-Driven**: Simple text-based configuration. No hardcoded package names.
18
-
***Rust-Powered**: Built with safety and performance in mind using the `jni` and `libc` crates.
@@ -99,7 +99,28 @@ am force-stop com.target.application
99
99
100
100
## Developing a Payload
101
101
102
-
Your payload does not need to know about Zygisk. It acts as a standard shared library. In Rust, we recommend using the `ctor` crate for automatic initialization.
102
+
Your payload does not need to know about Zygisk. It acts as a standard shared library. You can write your payload in **C, C++, or Rust**.
// This function runs automatically when dlopen() is called
114
+
__attribute__((constructor))
115
+
void init() {
116
+
LOGI("Hello from inside the target application!");
117
+
LOGI("I have been loaded and my file on disk is likely already gone.");
118
+
119
+
// Your hooking logic (e.g., Dobby, And64InlineHook) goes here
120
+
}
121
+
```
122
+
123
+
### Option B: Using Rust (ctor crate)
103
124
104
125
`Cargo.toml`:
105
126
```toml
@@ -126,19 +147,18 @@ fn init() {
126
147
127
148
// logic hooking start here
128
149
log::info!("Hello from inside the target application!");
129
-
log::info!("I have been loaded and my file on disk is already gone.");
130
150
}
131
151
```
132
152
133
153
## Technical Constraints
134
154
135
155
***SELinux Compatibility**: This module uses disk injection (Write-Load-Unlink) instead of `memfd` to ensure maximum compatibility across all Android versions and SELinux contexts. `memfd` often fails on `untrusted_app` domains due to `execmem` restrictions.
136
-
***Isolated Processes**: The loader automatically handles isolated processes (e.g., `:remote` services) by resolving the correct data directory path.
156
+
***Isolated Processes**: The loader automatically handles isolated processes (e.g., `:remote` services) by intelligently resolving the correct data directory path.
137
157
138
158
## Disclaimer
139
159
140
160
This tool is for **educational purposes and security research only**. The author is not responsible for any misuse of this software.
141
161
142
162
## License
143
163
144
-
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
164
+
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
0 commit comments