Hook Android 17 Zygote signatures on GrapheneOS - #150
Merged
Conversation
GrapheneOS 17 reworked the app-specialize native methods: extraLongArgs moved from the last parameter to the first in both nativeForkAndSpecialize and nativeSpecializeAppProcess, and nativeForkAndSpecialize gained a use_fifo_ui boolean. The existing GrapheneOS entries encode the older layout with extraLongArgs last, so on 17 the descriptors no longer resolve. Both app-specialize hooks are then skipped and only nativeForkSystemServer stays hooked, which breaks injection into app processes (the USAP path in particular has no other interception point). Add the Android 17 variants for both methods, and warn when a Zygote fork/specialize method fails to resolve to any signature instead of skipping it silently.
HSSkyBoy
pushed a commit
to HSSkyBoy/NyaZygisk
that referenced
this pull request
Aug 2, 2026
GrapheneOS 17 reworked the app-specialize native methods: extraLongArgs moved from the last parameter to the first in both nativeForkAndSpecialize and nativeSpecializeAppProcess, and nativeForkAndSpecialize gained a use_fifo_ui boolean. The existing GrapheneOS entries encode the older layout with extraLongArgs last, so on 17 the descriptors no longer resolve. Both app-specialize hooks are then skipped and only nativeForkSystemServer stays hooked, which breaks injection into app processes (the USAP path in particular has no other interception point). Add the Android 17 variants for both methods, and warn when a Zygote fork/specialize method fails to resolve to any signature instead of skipping it silently.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GrapheneOS 17 reworked the app-specialize native methods.
extraLongArgsmoved from the last parameter to the first in bothnativeForkAndSpecializeandnativeSpecializeAppProcess, andnativeForkAndSpecializealso gained auseFifoUiboolean.Our existing GrapheneOS entries encode the older layout (
extraLongArgslast), so on 17 those descriptors no longer resolve.hook_jni_methodsthen skips both app-specialize methods, leaving onlynativeForkSystemServer(signature unchanged) hooked. Injection into app processes breaks — most visibly on the USAP path vianativeSpecializeAppProcess, which has no other interception point, so the process is specialized with no module callback and, for the parasitic manager, aborts on the SELinux context set.Changes
grapheneos_17variants ofnativeForkAndSpecializeandnativeSpecializeAppProcesstogen_jni_hooks.py(leadingextraLongArgs, plus the extrause_fifo_uiboolean on fork), and regeneratejni_hooks.hpp.hook_zygote_jniwhen none of a Zygote fork/specialize method's variants resolve, instead of skipping silently. A signature bump should surface as a log line, not as a downstream SIGABRT.Context: JingMatrix/Vector#786.