Zygote is being detected by Securify

[FobyCool]

Sorey

Steps to reproduce/复现步骤

1. Switch Denylist policy from Enfroced to something else in ZygiskNext
2. Enable Vector ( if it isn't )

Expected behaviour/预期行为

All must be clean.

Actual behaviour/实际行为

Leaves some traces behind so it gets detected.

Xposed Module List/Xposed 模块列表

All disabled but

CaptureSposed
HMA-OSS
Oplus Assistant Hook
Shutify

Root implementation/Root 方案

KernelSU Next + WildKernel

System Module List/系统模块列表

Hybrid Mount
PIF [Inject]
Susfs
TEESimulator-RS
Zygisk Next (latest version)
HMA-OSS Zygisk
Vector

LSPosed version/LSPosed 版本

3043

Android version/Android 版本

16, ColorOS 16.0.5.703

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

So I wanted to fix "Zygote is injected" detection and I started disabling modules one by one. Then it got fixed after disabling Vector. I had disabled all XPosed modules and enabled module but it still was detected.

vector_zygote.zip

[JingMatrix]

Try NeoZygisk, plus using release bug for maximal hiding.

[FobyCool]

Try NeoZygisk, plus using release bug for maximal hiding.

Tried using NeoZygisk, still dont work. Also release version of Vector doesn't fix anything...

[JingMatrix]

What is the package name of Security ?
Please upload your logs with NeoZygisk, both NeoZygisk and Vector should be debug versions.

[yashikada]

plus using release bug for maximal hiding.

Please, could you explain this better?
I thought that with LSPosed/Vector it was impossible to hide the zygote injection. I was wrong?
I use all your projects, I only have those now.

[JingMatrix]

@yashikada I don't have the problem of Zygisk injection detection. If you have this detection, it is most likely your configuration issue. Also, be precise on which app detects what.

Certain app could detect logging, and release builds have these logging disabled.

[yashikada]

Also, be precise on which app detects what.

I use Native Detector.
On the latest version of LSPosed it detect only "Found Injection" and in details show "Found Zygote pid xxxx".
I tested now with Vector and detect LSPosed and Injection.
In Vector I have 2 modules, one module hook specific apps but not Native Detector, while another module hook System Framework. No module hooks on native dector.
In details of "Detected LSPosed" I see the path of Native Dector base.odex.
However I didn't want to go OT, I will try again by installing the latest debug versions of NeoZygisk and Vector and try again.
For me detect isn't a problem, it was just a nicety.

[FobyCool]

What is the package name of Security ?

It's named as ' io.github.rabehx.securify '.

Please upload your logs with NeoZygisk, both NeoZygisk and Vector should be debug versions.

Here it is Vector_2026-05-09.zip. Also I'm using NeoZygisk from actions.

[FobyCool]

Also, be precise on which app detects what.

I use Native Detector. On the latest version of LSPosed it detect only "Found Injection" and in details show "Found Zygote pid xxxx".

Same issue in Native Detector, but with no info given. I haven't seen this issue with ZygiskNext.