Riru

Riru is a very simple but useful thing. Only requires to replace one system file, it will provide the ability to Riru modules to run their code in apps' or system server's process.

The name Riru is from https://www.pixiv.net/member_illust.php?mode=medium&illust_id=56169989

中文说明

Requirements

Rooted Android 6.0+ devices
Magisk (use to replace system files, temporarily only provide Magisk zip)

How it works?

In short, replace a shared library which will be loaded by the zygote process.

First, we need to find that library. The library needs to be as simple as possible, so we found libmemtrack, with only 10 exported functions. Then we can provide a library named libmemtrack with all its functions, so the functionality will not be affected and we will able to in the zygote process.

Now the next question, how to know if we are in an app process or a system server process. We found some JNI functions (com.android.internal.os.Zygote#nativeForkAndSpecialize & com.android.internal.os.Zygote#nativeForkSystemServer) will be called when a app or system server is forked. So we just need to replace these functions to ours. This part is violent, just search method name in memory. In the end, JNINativeMethod of these methods can be found, then we can call RegisterNatives again to replace them.

Why Riru is made?

There is only one libmemtrack.so, if someone wants to do something by replacing it, others can't. So I made Riru occupy libmemtrack but provide the ability to make modules.

Build Requirements

Android NDK (add the directory with ndk-build to PATH)
zip to create the zip file (add to PATH)
(Windows only) Environment to run build.sh script

Build core

Run :riru-core:zip task in the command line (use gradlew) or Android Studio, zip will be saved to release

Build your own module

Copy riru-module-template and rename to your name
Change module name in riru-your-module/build.sh riru-your-module/template_override/module.prop riru-your-module/template_override/riru_module.prop riru-your-module/jni/main/Android.mk
Write your code
Run :riru-your-module:zip task in command line (use gradlew) or Android Studio, zip will be saved to release

Install

Current only support Magisk.

Install core zip in Magisk
Install module zip in Magisk

Modules

Riru-LocationReportEnabler (also a good example)

m8599399 / Riru