# CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

## What This Is

A self-contained patch kit that fixes LSPosed (JingMatrix fork v1.11.0 / Vector v2.0) crashing zygote64 on Android 16. Root cause: `memcpy(&native_interface_hook_, env->functions, sizeof(JNINativeInterface))` uses a compile-time NDK 26 size; Android 16 ART extended `JNINativeInterface` with new function pointers, so the copy is truncated and ART calls garbage pointers → crash.

The fix reads the runtime table size from `reserved0` (ART stores the actual byte count there) and heap-allocates the copy.

## Files

- `ipc_bridge.h` / `ipc_bridge.cpp` — the **already-patched** source files. These are drop-in replacements for `zygisk/src/main/cpp/{include/,}` inside a cloned LSPosed repo.
- `apply_a16_fix.sh` — applies the patch via Python `str.replace` on a cloned repo (does exact string match; creates `.bak` backups). If LSPosed upstream changes those exact strings, the script will print a warning and skip.

## Apply + Build + Deploy

```bash
# 1. Clone LSPosed
git clone --depth 1 --recursive https://github.com/JingMatrix/LSPosed.git
cd LSPosed

# 2. Apply patch (from this directory)
bash /path/to/apply_a16_fix.sh .

# 3. Build
export ANDROID_HOME=/path/to/android-sdk
./gradlew :zygisk:assembleRelease
# Output: zygisk/build/outputs/apk/release/zygisk-release.apk

# 4. Deploy
unzip -o zygisk-release.apk -d zygisk_out
adb push zygisk_out/lib/arm64-v8a/libzygisk.so /data/local/tmp/
adb shell su -c 'cp /data/local/tmp/libzygisk.so /data/adb/modules/zygisk_vector/zygisk/arm64-v8a.so'
adb shell su -c 'magisk --sqlite "INSERT OR REPLACE INTO settings (key,value) VALUES (\"zygisk\",1);"'
adb reboot
```

## Verify After Reboot

```bash
adb shell su -c 'pidof lspd'                                                          # daemon alive
adb shell su -c 'cat /proc/$(pidof zygote64 | awk "{print \$1}")/maps | grep zygisk' # injected
adb shell su -c 'cat /proc/$(pidof com.xingin.xhs)/maps | grep xhshook'              # XHS module loaded
```

## Context

This patch was developed during a reverse engineering session targeting XHS (`com.xingin.xhs`) on Android 16. The goal was MITM capture of `xy-common-params` (ECFAAF signatures) from `edith.xiaohongshu.com`, which uses Cronet with static BoringSSL — Frida Interceptor cannot hook static-linked symbols. LSPosed is needed to install a CertificatePinner bypass module (`xhshook`).