Fix late injection bugs and drop dead code

handle_trace's standalone branch declared `auto pid = fork()`, shadowing the
tracee PID it had just parsed, and reported a failed fork with `return false`
-- which is 0, i.e. EXIT_SUCCESS -- from a function returning int. The child
also left its failure paths on `return`, so instead of exiting it unwound back
into main; had monitor.run() ever returned, it would have fallen through and
attached to zygote a second time. Name the fork result, return EXIT_FAILURE,
and terminate the child with _exit() on every path. The child additionally
inherited handle_interrupt with g_traced_pid already armed, so a stray SIGTERM
made it detach a process it never attached to; clear it after the fork.

Scripts: quote the pidof substitutions -- an empty result silently shifted argv
and fed `trace --standalone` a missing pid -- pick the tracer binary once
instead of hardcoding zygisk-ptrace64 in service.sh, and bail with a log line
when no zygote or no tracer is found. The 32-bit branch looked for "zygote32",
but app_process only ever names itself "zygote64" or "zygote".

Dead code: drop the commented-out copy_to_temp call site along with the use_temp
plumbing that could never fire, and the commented-out libart lookup in
JniAttachment that RTLD_DEFAULT already covers. Keep copy_to_temp itself, marked
maybe_unused, documented as a debugging aid. Restore the DeleteLocalRef on the
gids array. Also fix the --spwan usage typo, `sucess`, "No moniter handler
actived", a missing newline, and replace the local PROP_VALUE_MAX define with
the bionic header that defines it.

Author: JingMatrix

loader/src/include/trace.hpp

@@ -6,4 +6,3 @@ enum TraceMode {
     STANDALONE = 2,
     SYSTEM_SERVER = 3,
 };
-

loader/src/injector/hook.cpp

@@ -5,6 +5,7 @@
 #include <sys/mman.h>
 #include <sys/mount.h>
 #include <sys/resource.h>
+#include <sys/system_properties.h>
 #include <unistd.h>
 #include <unwind.h>
 
@@ -15,8 +16,6 @@
 #include "module.hpp"
 #include "zygisk.hpp"
 
-#define PROP_VALUE_MAX 92
-
 using namespace std;
 
 // *********************

loader/src/injector/system_server.cpp

@@ -21,27 +21,10 @@ namespace {
 class JniAttachment {
 public:
     JniAttachment() {
-        // auto cached_map_infos = lsplt::MapInfo::Scan();
-        // void* libart;
-        // for (auto& map : cached_map_infos) {
-        //     if (map.path.ends_with("/libart.so")) {
-        //         LOGV("found path %s", map.path.data());
-        //         libart = dlopen(map.path.data(), RTLD_NOLOAD | RTLD_NOW);
-        //         if (!libart) {
-        //             libart = dlopen("libart.so", RTLD_NOW);
-        //         }
-        //         break;
-        //     }
-        // }
-
-        // if (!libart) {
-        //     LOGE("failed to get libart.so handle");
-        //     return;
-        // }
-
         using JNI_GetCreatedJavaVMs_t = jint (*)(JavaVM**, jsize, jsize*);
 
-        // Pass RTLD_DEFAULT instead of a specific library handle
+        // RTLD_DEFAULT searches the global scope, which already contains libart in a
+        // running system_server, so there is no need to locate and dlopen it ourselves.
         auto get_vms =
             reinterpret_cast<JNI_GetCreatedJavaVMs_t>(dlsym(RTLD_DEFAULT, "JNI_GetCreatedJavaVMs"));
 
@@ -167,7 +150,7 @@ void trigger_system_server_hooks() {
     ctx.server_specialize_post();
 
     // 5. Clean up the local JNI reference to prevent memory leaks in the ART
-    // if (gids) {
-    //     env->DeleteLocalRef(gids);
-    // }
+    if (gids) {
+        env->DeleteLocalRef(gids);
+    }
 }

loader/src/ptracer/main.cpp

@@ -151,7 +151,8 @@ static void print_usage(const char *tool_name) {
     fprintf(stderr, "NeoZygisk Tracer %s\n", ZKSU_VERSION);
     fprintf(
         stderr,
-        "usage: %s monitor | trace <pid> [--spwan | --standalone | --system_server] | ctl <start|stop|exit> | version\n",
+        "usage: %s monitor | trace <pid> [--spawn | --standalone | --system_server] | ctl "
+        "<start|stop|exit> | version\n",
         tool_name);
 }
 
@@ -223,28 +224,47 @@ static int handle_trace(int argc, char **argv) {
     } else if (mode == TraceMode::STANDALONE) {
         printf("standalone mode: preparing injection and starting daemon...\n");
 
-        auto pid = fork();
-        if (pid < 0) {
-            PLOGE("init_monitor");
-            return false;
-        } else if (pid == 0) {
-            // Change directory to $MODDIR BEFORE preparing the injection
+        // Fork off the daemon supervisor. The child never returns from this branch: it
+        // owns the control socket and the zygiskd process for the rest of the session,
+        // while the parent falls through to inject into the already-running zygote.
+        auto supervisor_pid = fork();
+        if (supervisor_pid < 0) {
+            PLOGE("fork daemon supervisor");
+            return EXIT_FAILURE;
+        }
+        if (supervisor_pid == 0) {
+            // The parent armed handle_interrupt with the tracee's PID before forking.
+            // We are not the tracer, so disown it to keep the child from detaching a
+            // process it never attached to.
+            g_traced_pid = 0;
+
+            // prepare_environment() reads ./module.prop and ZygoteAbiManager execs
+            // ./bin/zygiskd*, so both need $MODDIR as the working directory.
             cd_to_moddir();
             AppMonitor monitor;
             if (!monitor.prepare_environment()) {
-                exit(1);
+                fprintf(stderr, "error: failed to prepare the monitor environment\n");
+                _exit(EXIT_FAILURE);
             }
             if (monitor.get_abi_manager().check_and_prepare_injection() == nullptr) {
                 fprintf(stderr, "error: failed to start daemon and prepare injector\n");
-                return EXIT_FAILURE;
+                _exit(EXIT_FAILURE);
             }
+            // Socket loop only: standalone mode does no ptrace supervision.
             monitor.run(true, false);
+            _exit(EXIT_SUCCESS);
         }
     } else if (mode == TraceMode::SYSTEM_SERVER) {
         target = "system_server";
-        printf("injecting into system_server");
+        printf("injecting into system_server\n");
     }
 
+    // Note on standalone ordering: nothing synchronises the supervisor fork above with
+    // the injection below, so the tracee may reach zygiskd::PingHeartbeat() before the
+    // daemon has bound the control socket. This is covered by the retry budget in
+    // zygiskd::Connect() -- PingHeartbeat uses Connect(5), i.e. four one-second retries
+    // -- which comfortably outlasts a fork+exec of zygiskd. The retries run inside the
+    // ptrace-stopped tracee, so the only cost of losing the race is a short stall.
     if (!trace_target(pid, mode)) {
         if (mode == TraceMode::SPAWN) {
             fprintf(stderr, "error: failed to trace zygote, killing process %d\n", pid);

loader/src/ptracer/monitor_impl.cpp

@@ -134,7 +134,7 @@ bool AppMonitor::prepare_environment() {
 
 void AppMonitor::run(bool socket_loop, bool ptrace_loop) {
     if (!socket_loop && !ptrace_loop) {
-        LOGD("No moniter handler actived, exiting...");
+        LOGD("no monitor handler active, exiting...");
         return;
     }
     event_loop_.Init();

loader/src/ptracer/ptracer.cpp

@@ -363,7 +363,7 @@ bool inject_after_start(int pid, const char *lib_path, TraceMode mode) {
 #endif
 
     // Execute the shared remote injection logic
-    bool sucess = execute_remote_injection(pid, regs, lib_path, mode);
+    bool success = execute_remote_injection(pid, regs, lib_path, mode);
 
     // Restore State directly.
     // The instruction pointer (REG_IP) is already correct in the backup.
@@ -373,7 +373,7 @@ bool inject_after_start(int pid, const char *lib_path, TraceMode mode) {
         return false;
     }
 
-    return sucess;
+    return success;
 }
 
 // Macro helper to check for specific ptrace stop events.
@@ -392,10 +392,17 @@ static bool wait_for_process(int pid, int *status) {
 
 /**
  * @brief Copies the library to a world-readable temporary file to bypass DAC restrictions.
- * @param src_path The original path (e.g., /data/adb/neozygisk/lib64/libzygisk.so)
+ *
+ * Kept for debugging: when the work directory is somewhere the target cannot read, point
+ * perform_injection() at this instead of the packaged library to find out whether a failed
+ * injection is a permission problem or something else. It is deliberately not wired into
+ * the normal path -- it only relocates the library, while the control socket stays where it
+ * is, so it cannot on its own make an unreachable work directory usable.
+ *
+ * @param src_path The original path (e.g., /data/system/neozygisk/lib64/libzygisk.so)
  * @return The path to the temporary file, or an empty string on failure.
  */
-static std::string copy_to_temp(const std::string &src_path) {
+[[maybe_unused]] static std::string copy_to_temp(const std::string &src_path) {
     char tmp_path[] = "/data/local/tmp/zygisk_XXXXXX.so";
 
     // mkstemps securely creates the file with a random 6-character string replacing XXXXXX.
@@ -449,32 +456,10 @@ static bool perform_injection(int pid, TraceMode mode) {
     lib_path += "/lib" LP_SELECT("", "64") "/libzygisk.so";
     bool process_started = mode == TraceMode::STANDALONE || mode == TraceMode::SYSTEM_SERVER;
 
-    std::string inject_path = lib_path;
-    bool use_temp = false;
-
-    // if (mode == TraceMode::SYSTEM_SERVER) {
-    //     inject_path = copy_to_temp(lib_path);
-    //     if (inject_path.empty()) {
-    //         LOGE("aborting injection: could not create accessible library copy");
-    //         return false;
-    //     }
-    //     use_temp = true;
-    // }
-
-    bool success = false;
-
     if (process_started) {
-        success = inject_after_start(pid, inject_path.c_str(), mode);
-    } else {
-        success = inject_before_start(pid, inject_path.c_str(), mode);
-    }
-
-    if (use_temp) {
-        LOGV("cleaning up temporary library: %s", inject_path.c_str());
-        unlink(inject_path.c_str());
+        return inject_after_start(pid, lib_path.c_str(), mode);
     }
-
-    return success;
+    return inject_before_start(pid, lib_path.c_str(), mode);
 }
 
 /**

module/src/post-fs-data.sh

@@ -51,16 +51,29 @@ fi
 
 [ "$DEBUG" = true ] && export RUST_BACKTRACE=1
 
-if [ -z $(pidof system_server) ]; then
-	if [ -f $MODDIR/bin/zygisk-ptrace64 ]; then
-		$MODDIR/bin/zygisk-ptrace64 monitor &
-	elif [ -f $MODDIR/bin/zygisk-ptrace32 ]; then
-		$MODDIR/bin/zygisk-ptrace32 monitor &
-	fi
+# app_process names itself "zygote64" when built LP64 and "zygote" otherwise, so the
+# 32-bit branch only applies to 32-bit-only devices. On a 64/32 device the secondary
+# 32-bit zygote is not covered by the standalone path; only the monitor path sees it.
+if [ -f "$MODDIR/bin/zygisk-ptrace64" ]; then
+	TRACER="$MODDIR/bin/zygisk-ptrace64"
+	ZYGOTE="zygote64"
+elif [ -f "$MODDIR/bin/zygisk-ptrace32" ]; then
+	TRACER="$MODDIR/bin/zygisk-ptrace32"
+	ZYGOTE="zygote"
+else
+	log -p e -t "zygisk-sh" "No tracer binary found in $MODDIR/bin"
+	exit 1
+fi
+
+if [ -z "$(pidof system_server)" ]; then
+	# Normal boot: supervise zygote from the start and inject as it spawns.
+	"$TRACER" monitor &
 else
-	if [ -f $MODDIR/bin/zygisk-ptrace64 ]; then
-		$MODDIR/bin/zygisk-ptrace64 trace $(pidof zygote64) --standalone &
-	elif [ -f $MODDIR/bin/zygisk-ptrace32 ]; then
-		$MODDIR/bin/zygisk-ptrace32 trace $(pidof zygote32) --standalone &
+	# Late injection: the system is already up, so attach to the running zygote.
+	ZYGOTE_PID="$(pidof "$ZYGOTE")"
+	if [ -z "$ZYGOTE_PID" ]; then
+		log -p e -t "zygisk-sh" "Cannot inject: no running $ZYGOTE found"
+		exit 1
 	fi
+	"$TRACER" trace "$ZYGOTE_PID" --standalone &
 fi

module/src/service.sh

@@ -17,7 +17,7 @@ if [ "$(which magisk)" ]; then
 			if [ -f "$file/service.sh" ]; then
 				cd "$file"
 				log -p i -t "zygisk-sh" "Manually trigger service.sh for $file"
-				if [ -z $system_server_pid ]; then
+				if [ -z "$system_server_pid" ]; then
 					sh "$(realpath ./service.sh)" &
 				else
 					sh "$(realpath ./service.sh)" --late-inject &
@@ -28,7 +28,15 @@ if [ "$(which magisk)" ]; then
 	done
 fi
 
-if [ ! -z $system_server_pid ]; then
-	log -p i -t "zygisk-sh" "Maually inject into system_server $system_server_pid"
-	./bin/zygisk-ptrace64 trace $system_server_pid --system_server
+if [ -n "$system_server_pid" ]; then
+	if [ -f "$MODDIR/bin/zygisk-ptrace64" ]; then
+		TRACER="$MODDIR/bin/zygisk-ptrace64"
+	elif [ -f "$MODDIR/bin/zygisk-ptrace32" ]; then
+		TRACER="$MODDIR/bin/zygisk-ptrace32"
+	else
+		log -p e -t "zygisk-sh" "No tracer binary found in $MODDIR/bin"
+		exit 1
+	fi
+	log -p i -t "zygisk-sh" "Manually inject into system_server $system_server_pid"
+	"$TRACER" trace "$system_server_pid" --system_server
 fi