Zygote ptrace blocks other tools

[ciapatakoza]

Hi,
The new way (ptrace based) of watching for application spawn blocks usage of other ptrace based tools like frida as both tools need to ptrace zygote process.
The ptrace based spawn watch was introduces in Magisk 18.1 (proc_monitor.cpp:new_zygote).

Could you add kind of switch which could be used to choose which spawn watching function would be used?

# ./frida-server-12.4.7-android-arm64 Unable to preload: Unable to access process with pid 622 due to system restrictions; try sudo sysctl kernel.yama.ptrace_scope=0, or run Frida as root

# ps -AZ | grep 622 u:r:zygote:s0 root 622 1 4244388 71348 poll_schedule_timeout 725b9f0e34 S zygote64

# cat /proc/622/status Name: main State: S (sleeping) Tgid: 622 Pid: 622 PPid: 1 TracerPid: 609

# cat /proc/609/status Name: magiskd

[topjohnwu]

You just have to disable MagiskHide for that. A single process can only be traced by one tracer.

[nvx]

Is there a way to make frida and magisk hide cooperate? Sometimes it can be useful having the functionality of both at the same time.

[febryanasaperdana]

@nvx Try to take a look at Magisk-Frida module.