Contents
Start with zygote
On Android, almost every app process is created by forking a parent process called zygote. Zygote has already loaded the Android framework, so forking it is much faster than starting each app from scratch. Most devices run a 64-bit zygote and often a 32-bit one for older apps.
So what is Zygisk?
Zygisk = Zygote + Magisk. It's a mechanism, first built into Magisk, that loads module code into zygote. Because every app is forked from zygote, a Zygisk module can then run inside chosen app processes. That's how Xposed-style frameworks hook apps and how some hiding tools change what apps can see.
Zygisk vs Magisk vs Zygisk Next
- Magisk is a root solution. It includes its own Zygisk, which you switch on in settings.
- Zygisk is the API and mechanism for running module code in app processes.
- Zygisk Next is a standalone Zygisk implementation. It works on KernelSU and APatch (which have no built-in Zygisk) and on Magisk as a replacement for Magisk's own.
What can Zygisk modules do?
Common uses include running Xposed-style frameworks such as LSPosed, changing what specific apps can detect about the device, tweaking app behaviour, and research or debugging work that needs code inside a running app. Zygisk itself does nothing visible. It's the platform modules build on.
Is Zygisk risky?
Zygisk is a tool, and its risk depends on what you load into it. A trusted module from a well-known author is low risk. An unknown module from a random download site can run code inside every app it targets, including banking apps. Stick to modules with public reputations, official sources and active maintenance, and keep the list short.
Zygisk vs Riru
Before Zygisk, a project called Riru did a similar job. Zygisk largely replaced it with a standard API maintained alongside Magisk, so module authors could target one interface.
Why standalone Zygisk exists
| Root solution | Built-in Zygisk? | Standalone option |
|---|---|---|
| Magisk | Yes | Zygisk Next can replace it |
| KernelSU | No | Zygisk Next, ReZygisk, NeoZygisk |
| APatch | No | Zygisk Next, NeoZygisk (ReZygisk listed as work in progress) |
Zygisk Next provides the same API outside Magisk, so KernelSU and APatch users can run Zygisk modules too.
Denylists, unmounting and Shamiko
Some apps behave differently, or refuse to run, when they detect root modifications. A denylist marks apps that should see an unmodified environment. Shamiko was a popular module that handled this kind of hiding. Since Zygisk Next 1.3.0, most of Shamiko's features are built into Zygisk Next, including an "unmount only" mode, and Shamiko itself is no longer maintained.
No hiding method is guaranteed. Banking and game apps change their detection often.
A short history of root and injection
- Xposed (classic): modified the system to hook apps. Powerful, but hard to hide.
- Riru: loaded code into zygote via a system property trick, and powered early EdXposed and LSPosed.
- Zygisk (in Magisk): made zygote injection a standard part of Magisk with a stable API.
- Standalone Zygisk: Zygisk Next, then ReZygisk and NeoZygisk, brought the API to KernelSU and APatch.
Glossary
- Zygote: Android's parent process that forks app processes.
- Zygisk API: the interface modules use to run code in app processes.
- Denylist: apps excluded from module changes and mounts.
- Unmount: reverting mount changes so an app sees a stock-looking system.
- ZN linker: Zygisk Next's own loader for Zygisk modules.
- znctl: Zygisk Next's command-line control tool.
Frequently asked questions
Is Zygisk the same as root?
No. Root gives superuser access. Zygisk is a mechanism that lets modules run code inside app processes. You need root first, then Zygisk on top.
Is Zygisk still supported in Magisk?
Yes. Magisk includes Zygisk, which you enable in its settings. Standalone implementations like Zygisk Next exist mainly for KernelSU and APatch, and for Magisk users who prefer their extra features.
Does Zygisk slow down my phone?
Zygisk on its own has very little impact. Noticeable slowdowns usually come from heavy modules that act on many apps.
Can apps detect Zygisk?
Some can try. Hiding tools and denylist settings reduce what apps see, but detection methods keep changing and no setup is guaranteed to stay hidden.
Is Riru still used?
Riru has largely been replaced by Zygisk. Most modern modules target the Zygisk API instead.
Do you need Zygisk at all?
Only if a module you want requires it. Plenty of root uses, like ad blocking via hosts files or system tweaks, don't need Zygisk. Install a Zygisk implementation when your modules call for one. Ready? Follow How to install Zygisk Next.
Get ZygiskNext 1.5.2
Official release ZIP (6.4 MB) from the developers' GitHub. You stay on this page.