Skip to content

Clean Zygote traces for multiple times#129

Open
JingMatrix wants to merge 2 commits intomasterfrom
traces
Open

Clean Zygote traces for multiple times#129
JingMatrix wants to merge 2 commits intomasterfrom
traces

Conversation

@JingMatrix
Copy link
Copy Markdown
Owner

For users with many modules installed, a single pass of Zygote trace cleaning could be insufficient to discover all mounting traces due to timing issue.

We add field zygote_unmounted_times to unmount up to 5 rounds in nativeForkAndSpecialize_pre.

We implement a connection check to bypass process flag retrieval and module execution for isolated processes when the zygisk daemon is unreachable.
For users with many modules installed, a single pass of Zygote trace cleaning could be insufficient to discover all mounting traces due to timing issue.

We add field `zygote_unmounted_times` to unmount up to 5 rounds in `nativeForkAndSpecialize_pre`.
@JingMatrix JingMatrix linked an issue Apr 13, 2026 that may be closed by this pull request
1 task
@JingMatrix
Copy link
Copy Markdown
Owner Author

Below is the user log of @zukdying1
verbose_2026-04-17T21:49:26.351026.log
Unfortunately, the second clean only starts for a zygote isolated process:

[ 2026-04-17T22:04:45.387        0:  1825:  1825 V/zygisk-core64   ] pre specialize [com.reveny.nativecheck]
[ 2026-04-17T22:04:45.388        0:  2129:  2129 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: GetProcessFlags
[ 2026-04-17T22:04:45.392        0:  2129:  1827 V/zygiskd64       ] zygiskd::zygiskd: Flags for UID 10431: ProcessFlags(PROCESS_ON_DENYLIST | PROCESS_ROOT_IS_APATCH)
[ 2026-04-17T22:04:45.392        0:  1825:  1825 I/zygisk-core64   ] [com.reveny.nativecheck] is on the denylist
[ 2026-04-17T22:04:45.392        0:  2129:  2129 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: ReadModules
[ 2026-04-17T22:04:45.395        0:  1825:  1825 V/zygisk-core64   ] dlopen_ext from fd 83 succeeded: handle 0x5027e421a52c37a3
[ 2026-04-17T22:04:45.443    10431:  1825:  1825 V/zygisk-core64   ] post specialize [com.reveny.nativecheck]
[ 2026-04-17T22:04:45.448    10431:  1825:  1825 V/zygisk-core64   ] modules unloaded: 1/1
[ 2026-04-17T22:04:45.451    10431:  1825:  1825 V/zygisk-core64   ] found modern atexit symbol '_ZL7g_array.0' at 0x7eebb71238
[ 2026-04-17T22:04:45.451    10431:  1825:  1825 V/zygisk-core64   ] successfully validated atexit array at 0x7eebb71238 with size: 3473
[ 2026-04-17T22:04:45.451    10431:  1825:  1825 V/zygisk-core64   ] needs_recompaction returns false
[ 2026-04-17T22:04:45.451    10431:  1825:  1825 V/zygisk-core64   ] g_array after recompact: 
--- Live AtexitArray Snapshot State ---
	(this pointer):  0x7eebb71238
	array_:          0x7efa5ac000
	size_:           3473 (0xd91)
	extracted_count_: 0 (0x0)
	capacity_:       5461 (0x1555)
	total_appends_:  3473 (0xd91)
---------------------------------------
[ 2026-04-17T22:04:45.451    10431:  1825:  1825 V/zygisk-core64   ] cleaning linker trace for path jit-cache-zygisk
[ 2026-04-17T22:04:45.452    10431:  1825:  1825 V/zygisk-core64   ] reset g_module_load_counter: [446 -> 445]
[ 2026-04-17T22:04:45.452    10431:  1825:  1825 V/zygisk-core64   ] reset g_module_unload_counter: [1 -> 0]
[ 2026-04-17T22:04:45.452    10431:  1825:  1825 V/zygisk-core64   ] replaced com/android/internal/os/Zygote!nativeForkAndSpecialize @0x7e4df3d1f8
[ 2026-04-17T22:04:45.452    10431:  1825:  1825 V/zygisk-core64   ] replaced com/android/internal/os/Zygote!nativeSpecializeAppProcess @0x7e4df3e14c
[ 2026-04-17T22:04:45.452    10431:  1825:  1825 V/zygisk-core64   ] replaced com/android/internal/os/Zygote!nativeForkSystemServer @0x7e4df3e6f0
[ 2026-04-17T22:04:45.456    10431:  1825:  1825 V/zygisk-core64   ] unmap libzygisk.so loaded at 0x7e4de9b000 with size 1417216
[ 2026-04-17T22:04:45.911        0:  2128:  2128 V/zygisk-core64   ] pre forkAndSpecialize [com.reveny.nativecheck_zygote]
[ 2026-04-17T22:04:45.911        0:  2129:  2129 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: GetProcessFlags
[ 2026-04-17T22:04:45.912        0:  2129:  1891 V/zygiskd64       ] zygiskd::zygiskd: Flags for UID 10431: ProcessFlags(PROCESS_ON_DENYLIST | PROCESS_ROOT_IS_APATCH)
[ 2026-04-17T22:04:45.923        0:  2128:  2128 V/zygisk-core64   ] found 1 mounting traces in zygote [round: 1].
[ 2026-04-17T22:04:45.923        0:  2128:  2128 V/zygisk-core64   ] unmounting /system/etc/hosts (mnt_id: 23097)
[ 2026-04-17T22:04:45.937        0:  1893:  1893 I/zygisk-core64   ] [com.reveny.nativecheck_zygote] is on the denylist
[ 2026-04-17T22:04:45.938        0:  2129:  2129 V/zygiskd64       ] zygiskd::zygiskd: New daemon action: ReadModules
[ 2026-04-17T22:04:45.940        0:  1893:  1893 V/zygisk-core64   ] dlopen_ext from fd 83 succeeded: handle 0x91399d63196394d7
[ 2026-04-17T22:04:45.986    10431:  1893:  1893 V/zygisk-core64   ] post forkAndSpecialize [com.reveny.nativecheck_zygote]
[ 2026-04-17T22:04:45.987    10431:  1893:  1893 V/zygisk-core64   ] modules unloaded: 1/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Detected hosts mounting trace

1 participant