feat(zygisk): support GrapheneOS secure app spawning - #34
Merged
Conversation
pixincreate
force-pushed
the
fix/grapheneos-exec-spawn-zygisk
branch
from
July 15, 2026 19:28
380caf0 to
e251a34
Compare
pixincreate
force-pushed
the
fix/grapheneos-exec-spawn-zygisk
branch
from
July 25, 2026 15:50
5323819 to
49a3728
Compare
pixincreate
force-pushed
the
fix/grapheneos-exec-spawn-zygisk
branch
from
July 29, 2026 09:01
49a3728 to
700bf4c
Compare
github-actions
Bot
force-pushed
the
master
branch
2 times, most recently
from
August 4, 2026 08:00
b859b9d to
c601cd4
Compare
pixincreate
force-pushed
the
fix/grapheneos-exec-spawn-zygisk
branch
from
August 7, 2026 10:10
700bf4c to
5ee7098
Compare
pixincreate
force-pushed
the
fix/grapheneos-exec-spawn-zygisk
branch
from
August 12, 2026 16:43
42caa73 to
f28a824
Compare
Add ZLOGI diagnostics at every critical point in the Zygisk bootstrap chain to identify why RegisterNatives fails for all JNI hook variants on GrapheneOS 17 (Android 17, SDK 37). Logging added at: - hook_plt(): CommitHook success/failure - dlclose hook: when it fires and with what handle - post_native_bridge_load(): runtime_callbacks pointer validity, native bridge reload path - register_jni_methods(): RegisterNatives return code + exception status for EACH variant (name + signature logged) - hook_jni_methods(): enumerate old_methods with signatures+fnPtrs, log hook_count, log each successful HOOKED match - hook_zygote_jni(): enumerate all Zygote native methods with signatures, log each name match (kForkApp/kSpecializeApp/ kForkServer), log final success/failure summary This is diagnostic only - no behavior changes. All logs are tagged with 'diag:' prefix for easy grep.
LOGD is compiled out in release builds (MAGISK_DEBUG=0), so the replay predicate and in-place markers were invisible in tester logs. Use LOGI so the markers survive release artifacts.
pixincreate
force-pushed
the
fix/grapheneos-exec-spawn-zygisk
branch
from
August 13, 2026 08:24
f28a824 to
1da659e
Compare
Runtime validation on Pixel Tablet / GrapheneOS 17 with secure app spawning enabled confirmed the replay path fires and completes (diag: replay true flags=0 fds=[-1,-1], in_place_pre entry, in_place_post specialized=true, no crashes). Strip the temporary instrumentation inserted to trace hook registration and the in-place replay branch so production builds don't spam logcat at INFO level on every GrapheneOS app launch.
pixincreate
changed the title
pixincreate
added a commit
that referenced
this pull request
Aug 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses #30 and #32.
Validation
python3 native/src/core/zygisk/test_grapheneos_exec_spawn.py(3 tests pass)jni_hooks.hppis deterministic and matchesgen_jni_hooks.pygit diff --check master...HEADBuild limitation
The normal native build cannot start because the existing
scripts/env.py:95contains an invalid nested-quote f-string. This PR does not modify that unrelated tooling bug. Device-level acceptance on GrapheneOS is still required.