777
Subscribers
+124 hours
+207 days
+8530 days
Posts Archive
777
NyaZygisk
Author: NkBe
Branch: master
Run: #ci_100
zygisk: abort direct zygote unmount when resource overlays are present Detaching the zygote from the mount namespace while a **font** or **/product** resource overlay is still mounted leaves the framework without those assets during early boot, leading to crashes on some devices. Detect such mounts in the trace list and fall back to the per-process setns path so the overlay remains visible until each app is specialized. While touching the code: * Swap the verbose `traces.size() == 0` test for the clearer `traces.empty()`. * Add `<algorithm>` and `<string_view>` to satisfy the new `std::any_of` and `std::string_view` uses explicitly, instead of relying on transitive includes. * Remove the now-redundant `saniti...Commit Workflow run
777
NyaZygisk
Author: NkBe
Branch: master
Run: #ci_99
Add banner image URL for KSUN module displayCommit Workflow run
777
NyaZygisk
Author: NkBe
Branch: master
Run: #ci_98
Refactor font workaround into fd-aware zygote detach Refactor the path-based workaround from 13879f572beaaf702f718afa4c9dfe23443f31f8 into fd-aware handling. Wire fds_to_close through AppSpecializeArgs, detect inherited zygote fds whose backing paths disappear after direct unmount, and mark them for detach before ReopenOrDetach. Also remove the product/font target denylist so direct zygote unmount no longer depends on brittle mount path heuristics.Commit Workflow run
777
NyaZygisk
Author: NkBe
Branch: master
Run: #ci_97
Harden anonymous memory remapping and shared cache ordering Anonymous module mappings were moved while backup pages were still write-only, leaving executable segments temporarily non-executable until mprotect restored their permissions. The toggle was also read after specialization, when app-domain path access could prevent config.prop from being opened. Apply final permissions before MREMAP_FIXED and capture the toggle before specialization. Strengthen the cross-process flag cache by pairing the reader validation fence with a writer-side release fence, avoiding exclusive Rust references to shared storage, and asserting the C++/Rust atomic layout assumptions at compile time.Commit Workflow run
777
NyaZygisk
Author: NkBe
Branch: master
Run: #ci_96
Fix Telegram upload caption formatting Added display of the main authorCommit Workflow run
777
httpAlso includes the following changes
Support BTI enabled devices During the entry point hijack phase on ARMv9 hardware with Branch Target Identification (BTI) enabled, dispatching remote calls to bionic functions (such as `dlopen`) resulted in an immediate Branch Target Exception (SIGILL). This crash is caused by a stale Branch Type (`BTYPE`) state. When the Android dynamic linker transfers control to the target's `AT_ENTRY`, it uses an indirect branch instruction (`BR`). This hardware action updates the CPU's `PSTATE` register, setting the `BTYPE` field to `0b11` (Indirect Jump). When the tracer pauses the process and redirects execution to `dlopen`, the CPU inherits this `PSTATE`. Modern Android bionic libraries are compiled with BTI and start with `PACIASP` or `BTI c` landing pads. These landing pads strictly require the incoming `BTYPE` to be `0b01` (Direct Call) or `0b10` (Indirect Call). Confronted with `0b11`, the CPU assumes a JOP (Jump-Oriented Programming) exploit and raises a SIGILL. This commit resolves the issue by clearing the `BTYPE` field (bits 10 and 11) in the `pstate` register structure prior to initiating any remote calls. Resetting the field to `0b00` prevents the hardware from enforcing BTI validation on the immediate next instruction. The original `PSTATE` is preserved in the register backup, ensuring that the target executable can securely validate its own BTI landing pad when execution is fully restored. References: https://developer.android.com/ndk/guides/abis#armv9_enabling_pac_and_bti_for_ccCommit
777
Also includes the following changes
Support BTI enabled devices During the entry point hijack phase on ARMv9 hardware with Branch Target Identification (BTI) enabled, dispatching remote calls to bionic functions (such as `dlopen`) resulted in an immediate Branch Target Exception (SIGILL). This crash is caused by a stale Branch Type (`BTYPE`) state. When the Android dynamic linker transfers control to the target's `AT_ENTRY`, it uses an indirect branch instruction (`BR`). This hardware action updates the CPU's `PSTATE` register, setting the `BTYPE` field to `0b11` (Indirect Jump). When the tracer pauses the process and redirects execution to `dlopen`, the CPU inherits this `PSTATE`. Modern Android bionic libraries are compiled with BTI and start with `PACIASP` or `BTI c` landing pads. These landing pads strictly require the incoming `BTYPE` to be `0b01` (Direct Call) or `0b10` (Indirect Call). Confronted with `0b11`, the CPU assumes a JOP (Jump-Oriented Programming) exploit and raises a SIGILL. This commit resolves the issue by clearing the `BTYPE` field (bits 10 and 11) in the `pstate` register structure prior to initiating any remote calls. Resetting the field to `0b00` prevents the hardware from enforcing BTI validation on the immediate next instruction. The original `PSTATE` is preserved in the register backup, ensuring that the target executable can securely validate its own BTI landing pad when execution is fully restored. References: https://developer.android.com/ndk/guides/abis#armv9_enabling_pac_and_bti_for_ccCommit
777
NyaZygisk
Branch: master
Run: #ci_95
Avoid leaking env TMP_PATH to app processes NeoZygisk used TMP_PATH both as internal loader state and as inherited process environment for zygiskd startup. That exposed a stable TMP_PATH marker inside injected zygote and app processes while also tying daemon bootstrap to inherited environment state. This change keeps TMP_PATH as internal loader state, removes TMP_PATH export from injected processes, and lets zygiskd take an explicit --workdir argument when the internal launcher needs to pass the daemon work directory without relying on environment inheritance. The default daemon entry path remains compatible, while internal socket and workdir resolution continue to use GetTmpPath(). Co-authored-by: JingMatrix <jingmatrix@gmail.com>Commit Workflow run
777
777
777
NyaZygisk
Branch: master
Run: #ci_91
Commit: 583cc32
Author: NkBe <nikobe918@outlook.com>
Artifact: NyaZygisk-v2.3-305-583cc32-release.zip
Commit message:
Add anonymous memory toggle
Commit: https://github.com/HSSkyBoy/NyaZygisk/commit/583cc32cd606c9e4807330106609a943960ef636
Workflow run: https://github.com/HSSkyBoy/NyaZygisk/actions/runs/27216684347
777
NyaZygisk
Branch: master
#ci_88
refactor(injector): enhance atexit array recompaction and sanity checks This update refactors the atexit array's recompaction and sanity validation logic to improve fault tolerance. By encapsulating state checks into isSane() and intercepting mprotect failures via boolean returns, the recompaction process is now treated as a best-effort operation, gracefully preventing potential segfaults caused by Android 16's strict memory page protections.Commit Workflow run
