zygisk: make built-in Zygisk work on Meta Quest (lazy per-trust partition zygotes)

Meta Quest (Horizon OS) does not start the zygote the normal way: ro.zygote=
zygote64_stub32 launches /system/bin/stub_zygote, which forks a separate
app_process64 zygote PER security partition (system/trusted vs untrusted-app),
driven by hzos_security_zygote_partitioning_policy. The untrusted-app partition
zygote -- the one that forks 3rd-party apps and the Magisk manager -- is spawned
LAZILY, after boot-complete.

magiskd sets ro.dalvik.vm.native.bridge=libzygisk.so during boot but clears it
again at boot-complete (ZygiskState::reset). On a normal device every zygote has
already started by then, so clearing it is harmless. On Quest the untrusted-app
partition zygote reads the (now cleared) property when it finally execve's
app_process64, never loads libzygisk.so, so 3rd-party apps + the Magisk manager
are never injected -> "Zygisk: N/A".

Fix (daemon.rs): on the boot-complete reset(restore=true) path, reset the crash
counter but KEEP native.bridge set (set_prop) instead of clearing it
(restore_prop); only the >3-crash rollback path still clears. The lazily-spawned
partition zygotes then load the loader when they start.

Also (hook.cpp), robustness fixes the loader needs on this device:
 - Wrap hook_zygote_jni()'s JNI locals in PushLocalFrame(64)/PopLocalFrame so
   leaking locals can't trip ART's "non-empty local reference table" abort, and
   bail if GetEnv returns no env.
 - Make the strdup(ZygoteInit) trigger a substring match + add an idempotency
   guard so the zygote hooks install exactly once per process.

Verified on Quest 3 (Android 14): system_server + every app fork is intercepted
and LSPosed loads end-to-end.

Author: xAstroBoy

native/src/core/zygisk/daemon.rs

@@ -107,19 +107,21 @@ impl ZygiskState {
         Ok(())
     }
 
-    pub fn reset(&mut self, mut restore: bool) {
+    pub fn reset(&mut self, restore: bool) {
         if restore {
+            // boot-complete: reset the crash counter but KEEP the native bridge prop set, so that
+            // zygote partitions that spawn lazily AFTER boot-complete (e.g. Meta Quest's
+            // per-trust-level partition zygotes, which fork untrusted apps) still load the zygisk
+            // loader. Clearing it here is why untrusted apps were never injected on such devices.
             self.start_count = 1;
-        } else {
-            self.sockets = (None, None);
-            self.start_count += 1;
-            if self.start_count > 3 {
-                warn!("zygote crashed too many times, rolling-back");
-                restore = true;
-            }
+            self.set_prop();
+            return;
         }
 
-        if restore {
+        self.sockets = (None, None);
+        self.start_count += 1;
+        if self.start_count > 3 {
+            warn!("zygote crashed too many times, rolling-back");
             self.restore_prop();
         } else {
             self.set_prop();

native/src/core/zygisk/hook.cpp

@@ -103,6 +103,11 @@ struct HookContext : JniHookDefinitions {
     const NativeBridgeRuntimeCallbacks *runtime_callbacks = nullptr;
     void *self_handle = nullptr;
     bool should_unmap = false;
+    // Guards against hooking the zygote JNI methods more than once. On lazy-native-bridge
+    // devices both the post_native_bridge_load path and the strdup("ZygoteInit") trigger can
+    // fire; a second pass corrupts the JNI registration (nulls fnPtrs) and unregisters
+    // nativeForkSystemServer -> UnsatisfiedLinkError -> zygote dies.
+    bool jni_hooked = false;
 
     void hook_plt();
     void hook_unloader();
@@ -142,7 +147,11 @@ ret (*old_##func)(__VA_ARGS__);       \
 ret new_##func(__VA_ARGS__)
 
 DCL_HOOK_FUNC(static char *, strdup, const char * str) {
-    if (strcmp(kZygoteInit, str) == 0) {
+    // The runtime hands the "com.android.internal.os.ZygoteInit" class name to strdup at the correct
+    // point (after the Zygote natives are (re)registered, before ZygoteInit#main forks), which is when
+    // hook_zygote_jni() must arm. Match as a substring (rather than exact) so a wrapped/prefixed name
+    // still triggers — harmless on standard devices, and it is what fires reliably on Meta Quest.
+    if (str && strstr(str, kZygoteInit)) {
         g_hook->hook_zygote_jni();
     }
     return old_strdup(str);
@@ -378,6 +387,11 @@ void HookContext::post_native_bridge_load(void *handle) {
         arg.load_native_bridge(nb.c_str() + len, arg.callbacks);
     }
     runtime_callbacks = arg.callbacks;
+    // NOTE: do NOT hook the zygote JNI methods here. The native bridge loads before the runtime
+    // finishes registering (and later re-registers) the Zygote natives, so a hook installed now is
+    // overwritten by the runtime and never takes effect. The strdup("com.android.internal.os.ZygoteInit")
+    // PLT hook fires at the correct time (after registration, before ZygoteInit#main forks), and it
+    // does fire on Meta Quest too, so let it arm hook_zygote_jni().
 }
 
 // -----------------------------------------------------------------
@@ -532,6 +546,10 @@ void HookContext::hook_jni_methods(JNIEnv *env, const char *clz, JNIMethods meth
 }
 
 void HookContext::hook_zygote_jni() {
+    // Idempotent: only replace the zygote JNI methods once per process.
+    if (jni_hooked) {
+        return;
+    }
     using method_sig = jint(*)(JavaVM **, jsize, jsize *);
     auto get_created_vms = reinterpret_cast<method_sig>(
             dlsym(RTLD_DEFAULT, "JNI_GetCreatedJavaVMs"));
@@ -564,8 +582,14 @@ void HookContext::hook_zygote_jni() {
     res = vm->GetEnv(reinterpret_cast<void **>(&env), JNI_VERSION_1_6);
     if (res != JNI_OK || env == nullptr) {
         ZLOGW("JNIEnv not found\n");
+        return;
     }
 
+    // Contain every JNI local reference we create (FindClass, ExceptionOccurred, ...) in an
+    // explicit frame. Depending on the exact caller/timing this may run outside a managed JNI
+    // transition, and leaking locals trips ART's "non-empty local reference table" check -> abort.
+    bool local_frame = env->PushLocalFrame(64) == JNI_OK;
+
     JNINativeMethod missing_method{};
     bool replaced_fork_app = false;
     bool replaced_specialize_app = false;
@@ -606,6 +630,13 @@ void HookContext::hook_zygote_jni() {
         ranges::for_each(specialize_app_methods, [](auto &m) { m.fnPtr = nullptr; });
         ranges::for_each(fork_server_methods, [](auto &m) { m.fnPtr = nullptr; });
     }
+    // Only mark as hooked when the full set was replaced cleanly, so that a premature/failed
+    // call does not permanently block a later well-timed trigger from installing the hooks.
+    if (missing_method.name == nullptr && replaced_fork_app && replaced_specialize_app &&
+        replaced_fork_server) {
+        jni_hooked = true;
+    }
+    if (local_frame) env->PopLocalFrame(nullptr);
 }
 
 void HookContext::restore_zygote_hook(JNIEnv *env) {