Implement MagiskHide through code injection

native/jni/magiskhide/hide_policy.cpp

@@ -77,7 +77,6 @@ static void lazy_unmount(const char* mountpoint) {
         LOGD("hide: Unmounted (%s)\n", mountpoint);
 }
 
-#if ENABLE_PTRACE_MONITOR
 void hide_daemon(int pid) {
     if (fork_dont_care() == 0) {
         hide_unmount(pid);
@@ -86,7 +85,6 @@ void hide_daemon(int pid) {
         _exit(0);
     }
 }
-#endif
 
 #define TMPFS_MNT(dir) (mentry->mnt_type == "tmpfs"sv && \
 strncmp(mentry->mnt_dir, "/" #dir, sizeof("/" #dir) - 1) == 0)

native/jni/magiskhide/hide_utils.cpp

@@ -274,7 +274,7 @@ int launch_magiskhide(bool late_props) {
     if (hide_state)
         return HIDE_IS_ENABLED;
 
-    if (access("/proc/1/ns/mnt", F_OK) != 0)
+    if (access("/proc/self/ns/mnt", F_OK) != 0)
         return HIDE_NO_NS;
 
     if (procfp == nullptr && (procfp = opendir("/proc")) == nullptr)
@@ -344,3 +344,36 @@ void test_proc_monitor() {
     proc_monitor();
 }
 #endif
+
+int check_uid_map(int client) {
+    mutex_guard lock(hide_state_lock);
+
+    if (!hide_state)
+        return 0;
+
+    int uid = read_int(client);
+    string process = read_string(client);
+
+    if (uid % 100000 > 90000) {
+        // Isolated process
+        auto it = uid_proc_map.find(-1);
+        if (it == uid_proc_map.end())
+            return 0;
+
+        for (auto &s : it->second) {
+            if (str_starts(process, s))
+                return 1;
+        }
+    } else {
+        auto it = uid_proc_map.find(uid);
+        if (it == uid_proc_map.end())
+            return 0;
+
+        for (auto &s : it->second) {
+            if (process == s)
+                return 1;
+        }
+    }
+
+    return 0;
+}

native/jni/magiskhide/magiskhide.cpp

@@ -27,7 +27,7 @@ using namespace std;
     exit(1);
 }
 
-void magiskhide_handler(int client) {
+void magiskhide_handler(int client, ucred *cred) {
     int req = read_int(client);
     int res = DAEMON_ERROR;
 
@@ -62,6 +62,15 @@ void magiskhide_handler(int client) {
     case HIDE_STATUS:
         res = hide_enabled() ? HIDE_IS_ENABLED : HIDE_NOT_ENABLED;
         break;
+    case REMOTE_CHECK_HIDE:
+        res = check_uid_map(client);
+        break;
+    case REMOTE_DO_HIDE:
+        kill(cred->pid, SIGSTOP);
+        write_int(client, 0);
+        hide_daemon(cred->pid);
+        close(client);
+        return;
     }
 
     write_int(client, res);
@@ -158,3 +167,26 @@ int magiskhide_main(int argc, char *argv[]) {
 return_code:
     return req == HIDE_STATUS ? (code == HIDE_IS_ENABLED ? 0 : 1) : code != DAEMON_SUCCESS;
 }
+
+int remote_check_hide(int uid, const char *process) {
+    int fd = connect_daemon();
+    write_int(fd, MAGISKHIDE);
+    write_int(fd, REMOTE_CHECK_HIDE);
+    write_int(fd, uid);
+    write_string(fd, process);
+    int res = read_int(fd);
+    close(fd);
+    return res;
+}
+
+void remote_request_hide() {
+    int fd = connect_daemon();
+    write_int(fd, MAGISKHIDE);
+    write_int(fd, REMOTE_DO_HIDE);
+
+    // Should receive SIGSTOP before reading anything
+    // During process stop, magiskd will cleanup our mount ns
+    read_int(fd);
+
+    close(fd);
+}

native/jni/magiskhide/magiskhide.hpp

@@ -15,7 +15,7 @@
 #define ISOLATED_MAGIC "isolated"
 
 // Global toggle for ptrace monitor
-#define ENABLE_PTRACE_MONITOR 1
+#define ENABLE_PTRACE_MONITOR 0
 
 // CLI entries
 int launch_magiskhide(bool late_props);
@@ -23,6 +23,7 @@ int stop_magiskhide();
 int add_list(int client);
 int rm_list(int client);
 void ls_list(int client);
+int check_uid_map(int client);
 
 #if ENABLE_PTRACE_MONITOR
 // Process monitoring
@@ -52,6 +53,8 @@ enum {
     RM_HIDELIST,
     LS_HIDELIST,
     HIDE_STATUS,
+    REMOTE_CHECK_HIDE,
+    REMOTE_DO_HIDE
 };
 
 enum {