Motivation

Many apps now detect Xposed's classes for security issues. EdXposed now provides an app list function to prevent hooking undesired apps. However, the classloader persists even if the app is blacklisted. The reason is that EdXposed load its java bridge and do some preliminary hooks in the zygote process and all subprocesses inherit them! Since both YAHFA and SandHook do not support unhooking, all the java bridge will be preserved in the process memory even if we remove all global references (SandHook and YAHFA hold some handling global references). Apps, therefore, can detect Xposed by checking the classloaders and the Xposed Bridge. To prevent such detection, one way is to load the Java bridge in the target process instead of the zygote process if the app is whitelisted.

Implementation

To finish this mission, we should do as least things as possible in the zygote process, and do most of the jobs after forking. In the zygote process, we should not load any Java codes and do things purely in c++. Things that must be done in the zygote process are those that require special permission: reading the java bridge from the filesystem and loading configs. I, therefore, initialize the config manager in the zygote function and load dex files into byte arrays (but not loading them in ART).
After forking, if the target process is not blacklisted, load the dex files into ART by using InMemoryDexClassloader and load all the modules from the preloaded list by absolute Apk paths. Otherwise, release all the memories in the c++ part inherit from the zygote process.

Side effect

• Hooks are loaded later, some modules that require zygote permission will no longer work.
• InitZygote's are called on every process. This behavior exists in EdXposed but is not desired by the original Xposed.
• The one plus workaround hook is removed. One Plus devices might not work.
• Slower launch if the app is hooked.

Testing

Tested YAHFA in Mi10 AndroidQ MIUI and in x86 AndoirdR emulator. Tested and passed Xposed Detector. Some apps detecting Xposed like Deemo, China Mobile, and BOCHK are working.
More tests are requried.