Detecting Zygisk Injection via the dlclose soinfo Gap
Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.
Tag: zygisk
A Discussion of Android Injection Techniques, and an Open-Source Injection Module
A survey of Android injection techniques plus an open-source injection module, comparing ptrace, Zygote, and other routes to load code into a process.
Automating Android System-Level Device Fingerprint Countermeasures
Automating system-level device fingerprint countermeasures on Android, using Magisk, Zygisk, APatch, and ptrace to spoof fingerprints at scale, with the algorithm recovered in detail.