|
| 1 | +# ⚡ Zygisk-Loader |
| 2 | + |
| 3 | + |
| 4 | + |
| 5 | + |
| 6 | +**Zygisk-Loader** is a lightweight, high-performance Zygisk module written in **Rust**. It acts as a universal "bridge" that dynamically loads external shared libraries (`.so`) into specific Android application processes at runtime (during the `postAppSpecialize` phase). |
| 7 | + |
| 8 | +Unlike traditional Zygisk modules that require rebuilding and rebooting the device to update code, **Zygisk-Loader** enables a **"Hot-Swap" workflow**. You can recompile your instrumentation library, push it to the device, and simply restart the target app to apply changes instantly. |
| 9 | + |
| 10 | +## Key Features |
| 11 | + |
| 12 | +* **Dynamic Injection**: Inject any native library (`.so`) into any app without modifying the APK. |
| 13 | +* **No Reboot Required**: Update your payloads and target configurations instantly. |
| 14 | +* **Rust-Powered**: Built with safety and performance in mind using the `jni` and `libc` crates. |
| 15 | +* **Zygisk API v5**: Utilizes the latest Zygisk API for maximum compatibility with Magisk, KernelSU, and APatch. |
| 16 | +* **Config-Driven**: Target applications via a simple text file (`active_config.txt`). |
| 17 | +* **Stealthy**: Injection occurs early in the process memory (before `MainActivity`), making it ideal for bypassing SSL Pinning or anti-tamper mechanisms. |
| 18 | + |
| 19 | +## Architecture |
| 20 | + |
| 21 | +Zygisk-Loader separates the **Injector** (The Module) from the **Payload** (The Logic). |
| 22 | + |
| 23 | +```mermaid |
| 24 | +flowchart TD |
| 25 | + %% Subgraph untuk File System (Host Side) |
| 26 | + subgraph Storage ["/data/adb/modules/geoink/"] |
| 27 | + style Storage fill:#f9f9f9,stroke:#333,stroke-width:2px |
| 28 | + Config["active_config.txt"] |
| 29 | + PayloadBin["payload.so (Rust/C++)"] |
| 30 | + end |
| 31 | +
|
| 32 | + %% Subgraph untuk Proses Aplikasi (Runtime) |
| 33 | + subgraph Runtime ["Android Application Process"] |
| 34 | + style Runtime fill:#e1f5fe,stroke:#0277bd,stroke-width:2px |
| 35 | +
|
| 36 | + AppStart((App Start)) --> ZygiskHook[Zygisk Framework] |
| 37 | + ZygiskHook --> Loader["Zygisk-Loader (Resident)"] |
| 38 | +
|
| 39 | + Loader -->|Read /proc/self/cmdline| CheckName{Is Target?} |
| 40 | + Loader -.->|Read| Config |
| 41 | +
|
| 42 | + CheckName -- No --> Ignore[Do Nothing / Exit] |
| 43 | + CheckName -- Yes --> Inject[dlopen / Inject] |
| 44 | +
|
| 45 | + Inject -->|Load Dynamic Lib| PayloadBin |
| 46 | + PayloadBin -.->|Map into Memory| RunningPayload["Running Payload\n(Hooks / SSL Unpinning)"] |
| 47 | + end |
| 48 | +
|
| 49 | + %% External Interaction |
| 50 | + Synapse[Synapse CLI / User] -->|1. Write Target| Config |
| 51 | + Synapse -->|2. Deploy Lib| PayloadBin |
| 52 | + Synapse -->|3. Restart App| AppStart |
| 53 | +
|
| 54 | + %% Styling |
| 55 | + style Loader fill:#dea,stroke:#869D05,stroke-width:2px |
| 56 | + style RunningPayload fill:#ffccbc,stroke:#bf360c,stroke-width:2px,stroke-dasharray: 5 5 |
| 57 | + style Synapse fill:#333,stroke:#fff,color:#fff |
| 58 | +``` |
| 59 | + |
| 60 | +## Usage |
| 61 | + |
| 62 | +### 1. Installation |
| 63 | +1. Download the latest release `.zip`. |
| 64 | +2. Flash via Magisk / KernelSU / APatch. |
| 65 | +3. Reboot device once. |
| 66 | + |
| 67 | +### 2. Configuration & Deployment |
| 68 | +You don't need to touch the module anymore. Control everything via ADB or a shell manager (like **Synapse** [TODO]): |
| 69 | + |
| 70 | +**A. Set Target:** |
| 71 | +Write the package name of the target application to the config file: |
| 72 | +```bash |
| 73 | +echo "com.target.application" > /data/adb/modules/zygisk-loader/active_config.txt |
| 74 | +``` |
| 75 | + |
| 76 | +**B. Deploy Payload:** |
| 77 | +Copy your compiled Rust/C++ library to the module folder: |
| 78 | +```bash |
| 79 | +cp libpayload.so /data/adb/modules/zygisk-loader/payload.so |
| 80 | +chmod 755 /data/adb/modules/zygisk-loader/payload.so |
| 81 | +``` |
| 82 | + |
| 83 | +**C. Apply:** |
| 84 | +Force stop the target application. The next time it launches, your payload will be loaded. |
| 85 | +```bash |
| 86 | +am force-stop com.target.application |
| 87 | +``` |
| 88 | + |
| 89 | +## Developing a Payload (Rust) |
| 90 | + |
| 91 | +Your payload does not need to know about Zygisk. It just needs a constructor entry point. We recommend using the `ctor` crate. |
| 92 | + |
| 93 | +`Cargo.toml`: |
| 94 | +```toml |
| 95 | +[lib] |
| 96 | +crate-type = ["cdylib"] |
| 97 | + |
| 98 | +[dependencies] |
| 99 | +ctor = "0.2" |
| 100 | +android_logger = "0.13" |
| 101 | +log = "0.4" |
| 102 | +``` |
| 103 | + |
| 104 | +`src/lib.rs`: |
| 105 | +```rust |
| 106 | +use ctor::ctor; |
| 107 | +use log::LevelFilter; |
| 108 | +use android_logger::Config; |
| 109 | + |
| 110 | +#[ctor] |
| 111 | +fn init() { |
| 112 | + android_logger::init_once( |
| 113 | + Config::default().with_max_level(LevelFilter::Info).with_tag("MyPayload") |
| 114 | + ); |
| 115 | + log::info!("Hello from inside the target application!"); |
| 116 | + |
| 117 | + // Initialize your hooks (Dobby, Android-Mem-Kit) here... |
| 118 | +} |
| 119 | +``` |
| 120 | + |
| 121 | +## Disclaimer |
| 122 | + |
| 123 | +This tool is for **educational purposes and security research only**. The author is not responsible for any misuse of this software, including game modification in violation of ToS or bypassing security controls on systems you do not own. |
| 124 | + |
| 125 | +## License |
| 126 | + |
| 127 | +This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details. |
0 commit comments