[Bug? / Feature request] Zygisk detectability

[Unb0rn]

Latest Native Test (v25) is capable of detecting ReZygisk running in the system - "Found injection"
At the same time, latest official ZygiskNext (v1.1.0) is hidden successfully. I think it may be related to these changes, but I may be wrong.
Running A14 with Kernel 5.4, KernelSU 0.9.5

I am unsure if it makes sense to create an issue as Zygisk hiding may be out of scope for this project

[ThePedroo]

Their move was simply killing for us. We're working on it, but there's NO promises or even big hopes of it. They already had the material needed to help fix that (Native Test) where we don't. Unless 5ec1cff (Zygisk Next maintainer) wants to contribute and sends us the patches, HAHAHA.

Jokes aside, that's it, not much to say. And if anyone that is experient in RE area, please join our Telegram or Discord and DM me.

[tuyie78]

[Microwwbin]

@ThePedroo I guess there are three check points of it.
1.pls looks #41
2.Native Test has some magic to perceive umount event. If you umount something, it would show "futile hide". ZygiskNext has mounted something in debug_ramdisk, if you umount it, "found injection" & "futile hide" would show.
3.Looks like relating to dlclose. If you comment out hook.cpp#L194, "found injection" won't show.

So, apply #41, comment out hook.cpp#L194, and do not umount anything, "found injection" won't show, but zygisk works good.

[ThePedroo]

Do you have Telegram/Signal/Discord? I'd like to speak directly with you, I have some interesting information you might want to know

[ThePedroo]

Sadly, standalonely, in KSU, this is not true, and the removal of dlclose causes even further "silly" detections points. (Same for umount)
However, as you are in a device that seems that it is being able to pass NT, you could try to call syscalls directly with syscall(...)

[Microwwbin]

@ThePedroo Regretfully, I test in KSU with LineageOS 14, it is not work, but Magisk 27.0 with EvolutionX 13 works. I know we must close zygisk lib and umount bind mount/overlayfs(otherwise, it is easy to be detected), but NT looks like to know what we umount.
Could you help me to test #41 in Magisk with A13? To be honest, I also think the variables on the stack will be overwritten soon and hard to be detected, but there are indeed some behaviors that point here.

[ThePedroo]

but NT looks like to know what we umount.
Hence why using syscall(...) function with umount (dlclose won`t work here, it is not a syscall) could fix that.

Could you please join PerformanC Telegram or Discord?

[Microwwbin]

but NT looks like to know what we umount.
Hence why using syscall(...) function with umount (dlclose won`t work here, it is not a syscall) could fix that.

Could you please join PerformanC Telegram or Discord?

I have joined Discord. But I could not open private chat to u.