Skip to content

Environment detection leaked via /apex/com.android.art/bin/dex2oat64 mount points #843

Description

@wellcoming

Steps to reproduce/复现步骤

  1. Install and enable the latest NeoZigisk and Vector.
  2. Install and launch Native Detector and Hunter (v6.58).
  3. Run the environment/root checks in both applications.

Expected behaviour/预期行为

The framework should sanitize, revert, or unmount the modified /apex/com.android.art/bin/dex2oat64 paths within the target application's isolated mount namespace. Reading /proc/mounts from within the target app should not leak these Zygisk/LSPosed modifications.

Actual behaviour/实际行为

  • Both Native Detector and Hunter (v6.58) successfully detect environment modifications by scanning /proc/mounts.
  • ​The applications explicitly expose the same leaked mount path: /dev/block/dm-64 /apex/com.android.art/bin/dex2oat64 f2fs, which triggers Zygisk and LSPosed detection warnings.

Xposed Module List/Xposed 模块列表

No module.

Root implementation/Root 方案

APatch

System Module List/系统模块列表

mountify v2.0.3
HMA-OSS oss-164
IntegrityBox v39
TEESimulator v3.2
Vector v2.1 3073
NeoZygisk v2.3

Vector version/Vector 版本

3073

Android version/Android 版本

16

Version requirement/版本要求

Logs/日志

vector-logs-20260802-184754.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions