Riru Core

Riru only does one thing, inject into zygote in order to allow modules to run their codes in apps or the system server.

Contents show

Requirements

Android 6.0+ devices rooted with Magisk

Guide

Install

  • From Magisk Manager
    1. Search “Riru” in Magisk Manager
    2. Install the module named “Riru”The Magisk version requirement is enforced by Magisk Manager. You can check Magisk’s module installer script.
  • Manually
    1. Download the zip from the downloads section.
    2. Install in Magisk Manager (Modules – Install from storage – Select downloaded zip)

Common problems

How Riru works?

  • How to inject into the zygote process?Before v22.0, we use the method of replacing a system library (libmemtrack) that will be loaded by zygote. However, it seems to cause some weird problems. Maybe because libmemtrack is used by something else.Then we found a super easy way, the “native bridge” (ro.dalvik.vm.native.bridge). The specific “so” file will be automatically “dlopen-ed” and “dlclose-ed” by the system. This way is from here.
  • How to know if we are in an app process or a system server process?Some JNI functions (com.android.internal.os.Zygote#nativeForkAndSpecialize & com.android.internal.os.Zygote#nativeForkSystemServer) is to fork the app process or the system server process. So, we need to replace these functions with ours. This part is simple, hook jniRegisterNativeMethods since all Java native methods in libandroid_runtime.so is registered through this function. Then we can call the original jniRegisterNativeMethods again to replace them.

How does Hide works?

From v22.0, Riru provides a hidden mechanism (idea from Haruue Icymoon), make the memory of Riru and module to anonymous memory to hide from “/proc/maps string scanning”.

Build

Gradle tasks:

  • :riru:assembleDebug/ReleaseGenerate Magisk module zip to out.
  • :riru:pushDebug/ReleasePush the zip with adb to /data/local/tmp.
  • :riru:flashDebug/ReleaseFlash the zip with adb shell su -c magisk --install-module.
  • :riru:flashAndRebootDebug/ReleaseFlash the zip and reboot the device.

Download Riru Core Magisk Module

You can get the latest version of Riru Core by clicking the below link:

Latest Version

v26.1.7

v26.1.7 (2022-09-11)

  • THIS IS THE LAST RELEASE. MODULES AND USERS SHOULD MIGRATE TO ZYGISK.
  • Skip stack protector after fork from Zygote

v26.1.6 (2022-05-20)

  • THIS IS THE LAST RELEASE. MODULES AND USERS SHOULD MIGRATE TO ZYGISK.
  • Fix some parameter of nativeSpecializeAppProcess cannot be modified

v26.1.5 (2022-02-02)

  • THIS IS THE LAST RELEASE. MODULES AND USERS SHOULD MIGRATE TO ZYGISK.
  • Fix description hint

Just one last dance Before we say goodbye When we sway and turn round and round and round It's like the first time

Here’s all the available versions:

v26.1.7

v26.1.7 (2022-09-11)

  • THIS IS THE LAST RELEASE. MODULES AND USERS SHOULD MIGRATE TO ZYGISK.
  • Skip stack protector after fork from Zygote

v26.1.6 (2022-05-20)

  • THIS IS THE LAST RELEASE. MODULES AND USERS SHOULD MIGRATE TO ZYGISK.
  • Fix some parameter of nativeSpecializeAppProcess cannot be modified

v26.1.5 (2022-02-02)

  • THIS IS THE LAST RELEASE. MODULES AND USERS SHOULD MIGRATE TO ZYGISK.
  • Fix description hint

Just one last dance Before we say goodbye When we sway and turn round and round and round It's like the first time

26.1.4

v26.1.4 (2021-12-15)

  • Skip launching Rirud when Zygisk is enabled
  • Fix sonext update during hiding

26.1.3

v26.1.3 (2021-10-08)

  • Call android_create_namespace on Android 8.0+

26.1.2

v26.1.2 (2021-09-04)

  • Speedup Rirud launch
  • Warning about incorrect SELinux policy
  • No warning about Rirud socket closed
  • Use getprogname to detect zygote

26.1.1

v26.1.1 (2021-08-18)

  • Fix reset native bridge

26.1.0

v26.1.0 (2021-08-16)

  • Preload modules parallelly to speedup startup
  • Fix status showing after a soft reboot
  • Fix riru is not loading after a soft reboot
  • Prevent modules from using internal interfaces
  • Stricter authorization of Rirud
  • More accurate loaded status
  • Fix status showing on Huawei and Samsung devices
  • Unshare Rirud

v26.0.5

v26.0.5 (2021-08-01)

  • Fix killing parent process

v26.0.4 (2021-07-30)

  • Fix flock not working on some devices

    This is a bug from Magisk's busybox and it will be fixed here. As a workaround, we set SHELL in the script manually.

v26.0.3 (2021-07-27)

  • Reset SELinux context for module files when necessary

    This will not always work since on ROMs with incorrect SELinux rules, the system will reset module file to the incorrect one at the same time

v26.0.2 (2021-07-27)

  • Report if the SELinux context of the module files are incorrect
  • Use Resources for i18n

v26.0.1 (2021-07-18)

  • Remove support for pre-v24 modules (it has been more than 4 months and all live modules have upgraded to v24+)
  • Display status on module description in Magisk (app is removed because of this)
  • Combine rirud with rirud_java
  • Refactor codes

v25.4.4

  • Fix in rare cases "soft boot" causes Riru not working
  • Fix keep allow_install_app flag (#225)

v25.4.3

  • Exit service.sh script
  • Use uid 0 to install the app

v25.4.2

  • "Fix" system server injection does not work on Huawei devices by setting ro.maple.enable to 0

v25.4.1

  • Report and abort installation if the ROM has incorrect SELinux rules [1]
  • Bundle app with the module (Create file /data/adb/modules/riru-core/allow_install_app to allow the module to install the app)

[1] https://github.com/RikkaApps/Riru/wiki/Explanation-about-incorrect-SELinux-rules-from-third-party-ROMs-cause-Riru-not-working

v25.3.4

  • Unload API 25+ modules in the app process if the module does not provide related functions
  • Fix possible crash caused by pmparser.c (#202)
  • Use self-compiled libcxx (https://github.com/topjohnwu/libcxx)

v25.3.3

  • Fix crash on Android 8.0 again

v25.3.2

Important changes from the last stable version (v23.9)

  • Unify the Riru API version and Riru version, Riru 25 stands for API version 25
  • For modules that have adapted Riru API 24+, lib files are loaded from the Magisk path directly, they don't need to be mounted to /system anymore
  • Support unload self and modules, leaving no trace for unrelated processes (requires module changes)
  • Support remove self and modules from dl_iterate_phdr
  • /data/adb/riru/modules is no longer used, you can remove it when all modules are updated to Riru API 24+

25.3.2 changes

  • New way to get realpath on old systems
  • Fix next offset on Android 9

v23.9

  • Fix crash when JVM reuses reference index on devices with libnativehelper_lazy (libnativehelper_lazy may come in Android 12 DP2 or later) (by LSPosed devs)

v23.8

  • Fix a problem that only exists on 32-bit devices

Requirements

Installation