CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

What This Is

A self-contained patch kit that fixes LSPosed (JingMatrix fork v1.11.0 / Vector v2.0) crashing zygote64 on Android 16. Root cause: memcpy(&native_interface_hook_, env->functions, sizeof(JNINativeInterface)) uses a compile-time NDK 26 size; Android 16 ART extended JNINativeInterface with new function pointers, so the copy is truncated and ART calls garbage pointers → crash.

The fix reads the runtime table size from reserved0 (ART stores the actual byte count there) and heap-allocates the copy.

Files

• ipc_bridge.h / ipc_bridge.cpp — the already-patched source files. These are drop-in replacements for zygisk/src/main/cpp/{include/,} inside a cloned LSPosed repo.
• apply_a16_fix.sh — applies the patch via Python str.replace on a cloned repo (does exact string match; creates .bak backups). If LSPosed upstream changes those exact strings, the script will print a warning and skip.

Apply + Build + Deploy

# 1. Clone LSPosed
git clone --depth 1 --recursive https://github.com/JingMatrix/LSPosed.git
cd LSPosed

# 2. Apply patch (from this directory)
bash /path/to/apply_a16_fix.sh .

# 3. Build
export ANDROID_HOME=/path/to/android-sdk
./gradlew :zygisk:assembleRelease
# Output: zygisk/build/outputs/apk/release/zygisk-release.apk

# 4. Deploy
unzip -o zygisk-release.apk -d zygisk_out
adb push zygisk_out/lib/arm64-v8a/libzygisk.so /data/local/tmp/
adb shell su -c 'cp /data/local/tmp/libzygisk.so /data/adb/modules/zygisk_vector/zygisk/arm64-v8a.so'
adb shell su -c 'magisk --sqlite "INSERT OR REPLACE INTO settings (key,value) VALUES (\"zygisk\",1);"'
adb reboot

Verify After Reboot

adb shell su -c 'pidof lspd'                                                          # daemon alive
adb shell su -c 'cat /proc/$(pidof zygote64 | awk "{print \$1}")/maps | grep zygisk' # injected
adb shell su -c 'cat /proc/$(pidof com.xingin.xhs)/maps | grep xhshook'              # XHS module loaded

Context

This patch was developed during a reverse engineering session targeting XHS (com.xingin.xhs) on Android 16. The goal was MITM capture of xy-common-params (ECFAAF signatures) from edith.xiaohongshu.com, which uses Cronet with static BoringSSL — Frida Interceptor cannot hook static-linked symbols. LSPosed is needed to install a CertificatePinner bypass module (xhshook).