Zygisk-Assistant

Overview

Developed by snake-4, Zygisk Assistant was created to provide a modern, fully open-source, auditable root-hiding companion for rooted Android devices.

As enterprise and banking security suites (like Promon SHIELD, AppSealing, and ThreatMetrix) began scanning for known closed-source hiding tools, community demand grew for a transparent, auditable Zygisk module. Zygisk Assistant intercepts filesystem, mount, and environment queries, providing robust root cloaking without opaque proprietary blobs.

Technical Architecture & How It Works

Userspace Syscall & C Library Interception

1. Zygote Fork Hook: When a sandboxed application is forked from the Zygote process, Zygisk Assistant checks whether the target package is configured for hiding.
2. Mount Table Scrubbing: The module intercepts calls to read and fopen when accessing /proc/mounts, /proc/self/mountinfo, and /proc/self/mountstats. It dynamically filters out all loop mount records, Magisk mirror directories, and overlayfs tokens.
3. Property Masking: It intercepts Android properties related to development and debugging:
   • ro.debuggable: Forced to 0
   • ro.secure: Forced to 1
   • ro.build.type: Forced to user
   • persist.sys.usb.config: Strips adb
4. Binary Cloaking: Filesystem calls querying /system/bin/su, /data/adb/, or root manager packages are routed to return standard “Not Found” error codes (ENOENT).

Installation & Setup

1. Open your root manager (Magisk, KernelSU, or APatch).
2. Download and flash the latest Zygisk-Assistant-vX.zip.
3. In Magisk, go to Settings $\rightarrow$ Configure DenyList $\rightarrow$ select the applications you want to hide root from.
4. Ensure Enforce DenyList is toggled OFF (so Zygisk Assistant can inject its companion library into the process).
5. Reboot your device.