# rikkaapps/riru

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/rikkaapps-riru).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

5,139 stars · 597 forks · C++ · archived

## Links

- GitHub: https://github.com/RikkaApps/Riru
- awesome-repositories: https://awesome-repositories.com/repository/rikkaapps-riru.md

## Topics

`android` `riru`

## Description

Riru is an Android zygote injection framework and system process modifier. It allows for the insertion of custom code into the Android zygote process, enabling the execution of logic within all spawned applications and the system server.

The tool provides memory masking capabilities to hide strings and module signatures from process memory scanners. This is achieved by converting named memory segments and core memory into anonymous pages, modifying the process address space layout to obfuscate the presence of injected modules.

The framework also covers low-level system integration, including dynamic library loading and the interception of internal system server functions to modify core operating system behavior.

## Tags

### Mobile Development

- [Zygote Injection Frameworks](https://awesome-repositories.com/f/mobile-development/android-ecosystem/android-rooting-frameworks/zygote-injection-frameworks.md) — Provides a framework for injecting custom code into the Android Zygote process for system-wide modifications.
- [Zygote Code Injectors](https://awesome-repositories.com/f/mobile-development/android-ecosystem/android-rooting-frameworks/zygote-code-injectors.md) — Implements specialized tools for injecting custom machine code into the Android Zygote process. ([source](https://github.com/rikkaapps/riru#readme))
- [System Server Injections](https://awesome-repositories.com/f/mobile-development/android-ecosystem/android-rooting-frameworks/zygote-injection-frameworks/system-server-injections.md) — Provides injections into the system_server process to modify system-level services and behaviors.
- [System Process Hooks](https://awesome-repositories.com/f/mobile-development/system-hooking/system-process-hooks.md) — Injects custom code into system-level Android processes to modify behavior without altering binaries.

### Operating Systems & Systems Programming

- [Android System Process Injectors](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management/process-lifecycle-orchestrators/process-injection-wrappers/process-injection-frameworks/android-system-process-injectors.md) — Injects custom code into Android system processes to modify behavior without modifying system binaries.
- [Process Memory Hiding](https://awesome-repositories.com/f/operating-systems-systems-programming/process-memory-hiding.md) — Provides techniques to conceal modified process memory from system integrity scanners and detection tools.
- [Dynamic Library Loading](https://awesome-repositories.com/f/operating-systems-systems-programming/dynamic-library-loading.md) — Implements mechanisms for loading native binary modules into a running process at runtime.

### Security & Cryptography

- [Android Anti-Detection](https://awesome-repositories.com/f/security-cryptography/android-anti-detection.md) — Prevents security tools and scanners from detecting unauthorized modifications within process memory maps.
- [Address Space Obfuscation](https://awesome-repositories.com/f/security-cryptography/safe-memory-manipulation/memory-mappings/address-space-obfuscation.md) — Modifies the process address space layout to obfuscate the presence of injected code and third party modules.