[VeryBaaad]

This is an optional feature, and it requires Zygisk Next API support rather than Zygisk API support.

Use an injection-based approach to resolve potential mount-related leaks involving the dex2oat wrapper on Android 17. Furthermore, employ injection exclusively on Android 10 and later versions to prevent kernel-timing side-channel detection that could arise from the use of mounts.

On Android 10–16, dex2oat is launched directly via fork+exec from installd; on Android 17 (as well as on Android 15+ and Android 14 with ART Service), it is initiated by artd using art_exec --keep-fds=... -- dex2oat....

For those who prefer not to use the closed-source ZygiskNext, ZNNext is an available alternative. Additionally, since this feature is optional, it will automatically disable itself if ZN API support is unavailable.

Tip: LSPosed Internal Test added this injection starting with version 7848-it.

[sekaiacg]

Injection successful.
The status is mounted.
dex2oat has been detected.

Device: Xiaomi 17 Pro Max
Version: Android 17 / OS4
Env: Zygisk Next v1.5.2

[VeryBaaad]

Injection successful. The status is mounted. dex2oat has been detected.

Device: Xiaomi 17 Pro Max Version: Android 17 / OS4 Env: Zygisk Next v1.5.2

Log

[sekaiacg]

@VeryBaaad
debug version:
Vector-logs-debug-20261104-200926.zip

[VeryBaaad]

@sekaiacg Try again

[sekaiacg]

@VeryBaaad

dex2oat has been injected; no mounts were detected.

A new problem has emerged:

11-05 10:11:54.367 20635 20635 W VectorNative: dex2oat injection: the hook library is unreadable
11-05 10:11:54.367 20635 20635 I VectorNative: dex2oat injection: armed in artd
11-05 10:11:54.368  4391 20638 I VectorNative: dex2oat injection: reporting status on /data/adb/lspd/dex2oat_monitor_artd

Vector-logs-debug-20261105-101234.zip

[VeryBaaad]

@sekaiacg 好了吗

[sekaiacg]

@sekaiacg 好了吗

log中没有看到报错，也没有VectorDex2Oat的日志

11-05 20:51:29.191 18688 18688 I VectorNative: dex2oat injection: armed in artd
11-05 20:51:29.192  3447 18691 I VectorNative: dex2oat injection: reporting status on /data/adb/lspd/dex2oat_monitor_artd
11-05 20:51:29.212 18688 18693 I artd    : Running dex2oat: /apex/com.android.art/bin/art_exec --drop-capabilities --set-task-profile=Dex2OatBootComplete --set-priority=background --keep-fds=5:6:10:11 -- /apex/com.android.art/bin/dex2oat64 --zip-fd=5 --zip-location=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/base.apk --oat-fd=6 --oat-location=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/oat/arm64/base.odex --output-vdex-fd=10 --swap-fd=11 --class-loader-context=PCL[] --classpath-dir=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=oryon --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:35 --runtime-arg -Xhidden-api-policy:enabled --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --runtime-arg -Xms64m --runtime-arg -Xmx512m --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999
11-05 20:51:29.237 18696 18696 I dex2oat64: dex2oat: IsAppImageRelRoStringEnabled = false
11-05 20:51:29.237 18696 18696 I dex2oat64: Sdm file location : /data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/base.arm64.sdm
11-05 20:51:29.237 18696 18696 W dex2oat64: Could not open SecureDexMetadata archive Failed to open '/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/base.arm64.sdm': File not found
11-05 20:51:29.237 18696 18696 I dex2oat64: /apex/com.android.art/bin/dex2oat64 --output-vdex-fd=10 --class-loader-context=PCL[] --classpath-dir=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ== --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999
11-05 20:51:29.239 18696 18696 I dex2oat64: Using generational CollectorTypeCC GC.
11-05 20:51:29.269 18696 18702 I dex2oat64: Priority-to-niceness mapping: 19, 16, 13, 10, 0, -2, -4, -5, -6, -8
11-05 20:51:29.270 18696 18696 I dex2oat64: dex2oat took 33.472ms (29.682ms cpu) (threads: 6) arena alloc=0B (0B) java alloc=96KB (98512B) native alloc=2726KB (2791664B) free=1119KB (1146176B)
11-05 20:51:29.272 18688 18693 I artd    : dex2oat returned code 

liboat_hook.so可能没效果....
Vector-logs-debug-20261105-205453.zip

[VeryBaaad]

@sekaiacg 好了吗

log中没有看到报错，也没有VectorDex2Oat的日志

11-05 20:51:29.191 18688 18688 I VectorNative: dex2oat injection: armed in artd
11-05 20:51:29.192  3447 18691 I VectorNative: dex2oat injection: reporting status on /data/adb/lspd/dex2oat_monitor_artd
11-05 20:51:29.212 18688 18693 I artd    : Running dex2oat: /apex/com.android.art/bin/art_exec --drop-capabilities --set-task-profile=Dex2OatBootComplete --set-priority=background --keep-fds=5:6:10:11 -- /apex/com.android.art/bin/dex2oat64 --zip-fd=5 --zip-location=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/base.apk --oat-fd=6 --oat-location=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/oat/arm64/base.odex --output-vdex-fd=10 --swap-fd=11 --class-loader-context=PCL[] --classpath-dir=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=oryon --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:35 --runtime-arg -Xhidden-api-policy:enabled --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --runtime-arg -Xms64m --runtime-arg -Xmx512m --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999
11-05 20:51:29.237 18696 18696 I dex2oat64: dex2oat: IsAppImageRelRoStringEnabled = false
11-05 20:51:29.237 18696 18696 I dex2oat64: Sdm file location : /data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/base.arm64.sdm
11-05 20:51:29.237 18696 18696 W dex2oat64: Could not open SecureDexMetadata archive Failed to open '/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ==/base.arm64.sdm': File not found
11-05 20:51:29.237 18696 18696 I dex2oat64: /apex/com.android.art/bin/dex2oat64 --output-vdex-fd=10 --class-loader-context=PCL[] --classpath-dir=/data/app/~~T-FGp8VxIRFWeIlkdP-GsA==/com.bit747.clipboardfilter-lKMl7AqS4eyANEsyocYdaQ== --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999
11-05 20:51:29.239 18696 18696 I dex2oat64: Using generational CollectorTypeCC GC.
11-05 20:51:29.269 18696 18702 I dex2oat64: Priority-to-niceness mapping: 19, 16, 13, 10, 0, -2, -4, -5, -6, -8
11-05 20:51:29.270 18696 18696 I dex2oat64: dex2oat took 33.472ms (29.682ms cpu) (threads: 6) arena alloc=0B (0B) java alloc=96KB (98512B) native alloc=2726KB (2791664B) free=1119KB (1146176B)
11-05 20:51:29.272 18688 18693 I artd    : dex2oat returned code 

liboat_hook.so可能没效果.... Vector-logs-debug-20261105-205453.zip

log看起来挺正常的 VectorDex2Oat在verbose日志中
鸭子没问题应该就没事

没问题的话我ready for review了

[sekaiacg]

@VeryBaaad
dex2oat_inject的作用是拦截artd/installd，给真正执行的dex2oat中注入liboat_hook.so

liboat_hook.so的作用是移除dex2oat写入到odex文件参数列表中的：--inline-max-code-units=0
dex2oat_inject并没有给dex2oat中添加--inline-max-code-units=0参数

Vector/dex2oat/src/main/cpp/dex2oat.cpp

Line 196 in 093ea59

exec_argv.push_back("--inline-max-code-units=0");

我修改dex2oat_inject添加参数后发现，liboat_hook.so没有工作(没有日志输出)

修改后的dex2oat_inject日志正常，参数正确添加

11-06 11:32:25.060 29630 29630 I VectorNative: dex2oat injection: armed in artd
11-06 11:32:25.075 29630 29634 I artd    : Running dex2oat: /apex/com.android.art/bin/art_exec --drop-capabilities --set-task-profile=Dex2OatBootComplete --set-priority=background --keep-fds=5:6:10:11 -- /apex/com.android.art/bin/dex2oat64 --zip-fd=5 --zip-location=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/base.apk --oat-fd=6 --oat-location=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/oat/arm64/base.odex --output-vdex-fd=10 --swap-fd=11 --class-loader-context=PCL[] --classpath-dir=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=oryon --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:35 --runtime-arg -Xhidden-api-policy:enabled --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --runtime-arg -Xms64m --runtime-arg -Xmx512m --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999
11-06 11:32:25.087 29636 29636 I dex2oat64: dex2oat: IsAppImageRelRoStringEnabled = false
11-06 11:32:25.088 29636 29636 I dex2oat64: Sdm file location : /data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/base.arm64.sdm
11-06 11:32:25.088 29636 29636 W dex2oat64: Could not open SecureDexMetadata archive Failed to open '/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/base.arm64.sdm': File not found
11-06 11:32:25.088 29636 29636 I dex2oat64: /apex/com.android.art/bin/dex2oat64 --output-vdex-fd=10 --class-loader-context=PCL[] --classpath-dir=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ== --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999 --inline-max-code-units=0
11-06 11:32:25.089 29636 29636 I dex2oat64: Using generational CollectorTypeCC GC.
11-06 11:32:25.112 29636 29642 I dex2oat64: Priority-to-niceness mapping: 19, 16, 13, 10, 0, -2, -4, -5, -6, -8
11-06 11:32:25.113 29636 29636 I dex2oat64: dex2oat took 26.224ms (24.906ms cpu) (threads: 6) arena alloc=0B (0B) java alloc=112KB (114896B) native alloc=2462KB (2521200B) free=1119KB (1146304B)
11-06 11:32:25.118 29630 29634 I artd    : dex2oat returned code 0
11-06 11:32:25.121  4087 21726 I ArtService: Dexopt result: [packageName = com.bit747.clipboardfilter] DexContainerFileDexoptResult{dexContainerFile=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/base.apk, primaryAbi=true, abi=arm64-v8a, actualCompilerFilter=verify, status=PERFORMED, dex2oatWallTimeMillis=42, dex2oatCpuTimeMillis=30, sizeBytes=18248, sizeBeforeBytes=0, extendedStatusFlags=[]}

查看odex文件内容，参数没有被移除

strings /data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/oat/arm64/base.odex

dex2oat-cmdline
/apex/com.android.art/bin/dex2oat64 --zip-fd=5 --zip-location=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/base.apk --oat-fd=6 --oat-location=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ==/oat/arm64/base.odex --output-vdex-fd=10 --swap-fd=11 --class-loader-context=PCL[] --classpath-dir=/data/app/~~Z9acVL9A_LEyzUqPM5T7SA==/com.bit747.clipboardfilter-E5JhQcqt_p0FbpknFB-ehQ== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=oryon --compiler-filter=verify --compilation-reason=install --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:35 --runtime-arg -Xhidden-api-policy:enabled --assume-value=Landroid/os/Build$VERSION;->SDK_INT:37 --no-allow-profile-code -j6 --runtime-arg -Xms64m --runtime-arg -Xmx512m --cpu-set=0,1,2,3,4,5,6,7 --comments=app-name:com.bit747.clipboardfilter,app-version-name:2.0,app-version-code:20,art-version:370399999 --inline-max-code-units=0