• topjohnwu's avatar
    Switch to Zygote ptrace-ing · b278d07b
    topjohnwu authored
    No matter if we use the old, buggy, error prone am_proc_start monitoring,
    or the new APK inotify method, both methods rely on MagiskHide 'reacting'
    fast enough to hijack the process before any detection has been done.
    
    However, this is not reliable and practical. There are apps that utilize
    native libraries to start detects and register SIGCONT signal handlers
    to mitigate all existing MagiskHide process monitoring mechanism. So
    our only solution is to hijack an app BEFORE it is started.
    
    All Android apps' process is forked from zygote, so it is easily the
    target to be monitored. All forks will be notified, and subsequent
    thread spawning (Android apps are heaviliy multithreaded) from children
    are also closely monitored to find the earliest possible point to
    identify what the process will eventually be (before am_proc_bound).
    
    ptrace is extremely complicated and very difficult to get right. The
    current code is heaviliy tested on a stock Android 9.0 Pixel system,
    so in theory it should work fine on most devices, but more tests and
    potentially fixes are expected to follow this commit.
    b278d07b
Name
Last commit
Last update
..
applets.cpp Loading commit data...
bootstages.cpp Loading commit data...
daemon.cpp Loading commit data...
db.cpp Loading commit data...
init.cpp Loading commit data...
magisk.cpp Loading commit data...
magiskrc.h Loading commit data...
scripting.cpp Loading commit data...
socket.cpp Loading commit data...