Detecting Zygisk Injection via the dlclose soinfo Gap
Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.
Tag: magisk
Bypassing a Korean Game's Anti-Debugging, Layer by Layer
Bypassing a Korean game's anti-debugging, walking through its ptrace and timing checks and patching them to keep the debugger attached, and the gotchas flagged along the way.
A Discussion of Android Injection Techniques, and an Open-Source Injection Module
A survey of Android injection techniques plus an open-source injection module, comparing ptrace, Zygote, and other routes to load code into a process.
Automating Android System-Level Device Fingerprint Countermeasures
Automating system-level device fingerprint countermeasures on Android, using Magisk, Zygisk, APatch, and ptrace to spoof fingerprints at scale, with the algorithm recovered in detail.
Compiling rwProcMem33 into the Android Kernel
Compiling rwProcMem33 into the Android kernel to get hardware-breakpoint-driven read and write of process memory, built into a Pixel AOSP image, and the mechanism explained clearly.
AOSP Source Build, Part 4: Customizing and Erasing Root Fingerprints
Part four of an AOSP source-build series: customizing the ROM and erasing root fingerprints from build.prop and Magisk so detection apps can't spot your device.
Disabling Android Verified Boot (AVB 2.0) by Patching vbmeta.img
Disabling Android Verified Boot 2.0 by patching vbmeta.img, with the exact flags and steps needed to keep root and Magisk working on a locked-down device.