Riru is a very simple but useful thing. Only requires to replace one system file, it will provide the ability to Riru modules to run their code in apps' or system server's process.
The name Riru is from https://www.pixiv.net/member_illust.php?mode=medium&illust_id=56169989
- Rooted Android 6.0+ devices
- Magisk (use to replace system files, temporarily only provide Magisk zip)
In short, replace a shared library which will be loaded by the zygote process.
First, we need to find that library. The library needs to be as simple as possible, so we found libmemtrack, with only 10 exported functions. Then we can provide a library named libmemtrack with all its functions, so the functionality will not be affected and we will able to in the zygote process.
Now the next question, how to know if we are in an app process or a system server process.
We found some JNI functions (com.android.internal.os.Zygote#nativeForkAndSpecialize
& com.android.internal.os.Zygote#nativeForkSystemServer
) will be called when a app or system server is forked.
So we just need to replace these functions to ours. This part is simple, just hook jniRegisterNativeMethods
since all Java native method in libandroid_runtime is registered with this function.
Then we can call RegisterNatives
again to replace them.
There is only one libmemtrack.so
, if someone wants to do something by replacing it, others can't. So I made Riru occupy libmemtrack but provide the ability to make modules.
- Android NDK (add the directory with
ndk-build
toPATH
) zip
to create the zip file (add toPATH
)- (Windows only) Environment to run
build.sh
script
Run :riru-core:zip
task in the command line (use gradlew
) or Android Studio, zip will be saved to release
- Copy
riru-module-template
and rename to your name - Change module name in
riru-your-module/build.sh
riru-your-module/template_override/module.prop
riru-your-module/template_override/riru_module.prop
riru-your-module/jni/main/Android.mk
- Write your code
- Run
:riru-your-module:zip
task in command line (usegradlew
) or Android Studio, zip will be saved torelease
From v8, core starts to providing some APIs, see riru.h.
- To ensure your hook is not being overwritten by other modules, use API from core
- DO NOT overwrite
jniRegisterNativeMethods
hook in core in yourattribute constructor
func (orLOCAL_LDFLAGS -init
) (To get JNI method address, useriru_get_native_method_func
) - DO NOT overwrite
android.os.SystemProperties#native_set
in core, or your data may be wiped (Detail info) (If you really need to hook this, remember to clear exception) - DO NO print log (
__android_log_print
) innativeForkAndSpecialize(Pre/Post)
nativeForkSystemServer(Pre/Post)
when in zygote process, or it may cause zygote not work (magic not confirmed, Detail info)
#include "riru.h"
your_hook_func(func, new_func, &old_func);
if (riru_get_version() >= 8) { // determine riru version first
void *f = riru_get_func("func"); // if f is not null, other module has set it
if (f) old_func = f; // set your old_func as f (new_func in last module) to ensure last module's hook not being overwritten
riru_set_func("func", new_func); // set new_func to let next module get correct old_func
}
Current only support Magisk.
- Install core zip in Magisk
- Install module zip in Magisk
Riru-LocationReportEnabler (also a good example)