The Age of Zygote Injection

The talk introduces Zygote, the first process Android starts, which forks every application and applies SELinux restrictions during specialization. The speaker explains the pieces that matter for injection: the Android Runtime with its interpreter and ahead-of-time compiled code, the native bridge that loads inside Zygote, and two hooking approaches, PLT hooks and inline hooks on function prologues.

A proof-of-concept Magisk module swaps the native bridge entry at boot so a loader lands in Zygote. Hooks on the fork and specialization functions then run before and after SELinux policy is applied, so code executes inside each app as it launches. The demo rewrites a DEX method that returned true so it returns false, and replaces a string returned by a native library. A follow-on project bundles bypasses for root and debugger checks so an app that crashes on launch can be instrumented.

The main takeaway is that Zygote injection can be a stealthier alternative to Frida or debugger-based instrumentation, because it sidesteps many of the detections those tools trigger. In the Q&A, the speaker said the hooks bypassed dynamic checks, while Play Protect's checks focus on signatures and static patching. Static methods in DEX code were still unsupported.