Environment
- Waydroid 1.6.3 on NixOS 26.05 (x86_64), image
WayDroid-ATV/waydroid-builds a16-qpr0 (LineageOS 23, Android 16 / SDK 36, mainline vendor)
- Root: Kitsune Mask 26.3.1 / versionCode 26301 (
magisk -v → 0fe46c5a-delta:MAGISK:R), built-in Zygisk (zygisk=1 in magisk.db)
- Vector v2.2 (
Vector-v2.2-3080-Release.zip) installed with magisk --install-module; manager org.matrix.vector.manager installed with pm install (the same symptom was reproduced earlier with LSPosed v1.11.0-7209-zygisk-release.zip)
ro.dalvik.vm.native.bridge is not involved; libzygisk.so is present in zygote and in app processes
What works
The daemon and the system_server bridge are healthy — this is not a mangled manager/daemon setup:
I VectorDaemon : Vector daemon started: lateInject=false, proxy=serial
D VectorSystemServer: Registering bridge service for `system_server` with name `serial`.
I VectorNative(SS) : Got system server binder via serial on attempt 1.
I VectorNative(SS) : Manager binder from system_server: ...
I VectorDaemon : Successfully injected Vector framework into system_server.
I VectorDaemon : Successfully hooked Activity Supervisor for Manager redirection
I VectorZygiskBridge: onTransact: action=SEND_BINDER, callerUid=0
I VectorDaemon : Successfully injected Vector IPC binder for applications.
and, using the channel that does not depend on the app-side handoff:
$ waydroid shell -- sh /data/adb/modules/zygisk_vector/cli status
Framework Version: 2.2
Version Code: 3080
API Version: 102
Enabled Modules: 0
What fails
No app process is ever Zygisk-injected, so the manager can never obtain its binder:
W VectorManager: splash: no daemon binder after 2500ms, continuing unactivated
W VectorManager: java.lang.IllegalStateException: Daemon is not active
at org.matrix.vector.manager.ipc.DaemonClient$runIpc$2.invokeSuspend(DaemonClient.kt:39)
Evidence that it is the Zygisk layer, not Vector:
logcat after launching apps contains no VectorNative / VectorZygiskBridge lines for any app (only the single system_server one above) — i.e. the module's Zygisk companion never runs in app processes./proc/<manager-pid>/maps contains /system/lib64/libzygisk.so but no Vector native library, i.e. Zygisk injects its loader, and the module payload is never entered.- The same is true for every other app (no injection, no module logs), regardless of scopes.
Why (as far as I could trace it on Waydroid)
Two stacked problems, both Waydroid-specific:
- Zygisk on Waydroid needs the Kitsune Mask canary (the community
waydroid_magisk tool says so, and the "stable" Zygisk toggle is a no-op there). With the stable build above, the module companions simply never run in app processes.
- The canary cannot be installed on these images: its
--setup-sbin step aborts, e.g.
$ waydroid shell -- /system/etc/init/magisk/magisk64 --auto-selinux --setup-sbin /system/etc/init/magisk
clone_attr /sbin -> /root failed: No data available (os error 61)
rc=1
→ init: Could not start service 'magisk_late' ... Cannot find '/sbin/magisk'
(guest SELinux is Disabled; the old stable two-argument --setup-sbin <dir> <tmpdir> form still works, the canary's 1-argument Magisk 27 form does not; details in waydroid/waydroid#2433 — I filed it there since nitanmarcel/waydroid-magisk is archived).
- Vector's
--late-inject mode (proxy name serial_vector, which would side-step exactly the kind of service-name collisions seen on Android 16) needs the LATE_INJECT runtime flag, which (per the code comments) comes from NeoZygisk — and NeoZygisk/ZygiskNext all require Magisk versionCode >= 26402, which is unreachable for the same reason (the canary is the only build above 26401 and it will not install).
Question
- Is Waydroid supported at all by Vector, and if so what root/Zygisk stack do you recommend for it? (My reading is that today it is "not really possible", but I would rather be told than guess.)
- Would you accept a change that lets
--late-inject be forced without the NeoZygisk-provided runtime flag (e.g. via a config/db switch)? On Waydroid that flag is the only thing standing between the daemon and a working app-side channel, and the proxy name serial_vector avoids the collision entirely.
- If the answer is "fix your Zygisk first": is "Zygisk companion never runs in app processes even though
libzygisk.so is mapped everywhere" a known Waydroid symptom, and is there any diagnostic you would like from this image? It is a throwaway VM, so I can iterate freely.
Environment
WayDroid-ATV/waydroid-buildsa16-qpr0(LineageOS 23, Android 16 / SDK 36, mainline vendor)magisk -v→0fe46c5a-delta:MAGISK:R), built-in Zygisk (zygisk=1inmagisk.db)Vector-v2.2-3080-Release.zip) installed withmagisk --install-module; managerorg.matrix.vector.managerinstalled withpm install(the same symptom was reproduced earlier with LSPosedv1.11.0-7209-zygisk-release.zip)ro.dalvik.vm.native.bridgeis not involved;libzygisk.sois present in zygote and in app processesWhat works
The daemon and the system_server bridge are healthy — this is not a mangled manager/daemon setup:
and, using the channel that does not depend on the app-side handoff:
What fails
No app process is ever Zygisk-injected, so the manager can never obtain its binder:
Evidence that it is the Zygisk layer, not Vector:
logcatafter launching apps contains noVectorNative/VectorZygiskBridgelines for any app (only the single system_server one above) — i.e. the module's Zygisk companion never runs in app processes./proc/<manager-pid>/mapscontains/system/lib64/libzygisk.sobut no Vector native library, i.e. Zygisk injects its loader, and the module payload is never entered.Why (as far as I could trace it on Waydroid)
Two stacked problems, both Waydroid-specific:
waydroid_magisktool says so, and the "stable" Zygisk toggle is a no-op there). With the stable build above, the module companions simply never run in app processes.--setup-sbinstep aborts, e.g.(guest SELinux is
Disabled; the old stable two-argument--setup-sbin <dir> <tmpdir>form still works, the canary's 1-argument Magisk 27 form does not; details in waydroid/waydroid#2433 — I filed it there sincenitanmarcel/waydroid-magiskis archived).--late-injectmode (proxy nameserial_vector, which would side-step exactly the kind of service-name collisions seen on Android 16) needs theLATE_INJECTruntime flag, which (per the code comments) comes from NeoZygisk — and NeoZygisk/ZygiskNext all require MagiskversionCode >= 26402, which is unreachable for the same reason (the canary is the only build above 26401 and it will not install).Question
--late-injectbe forced without the NeoZygisk-provided runtime flag (e.g. via aconfig/db switch)? On Waydroid that flag is the only thing standing between the daemon and a working app-side channel, and the proxy nameserial_vectoravoids the collision entirely.libzygisk.sois mapped everywhere" a known Waydroid symptom, and is there any diagnostic you would like from this image? It is a throwaway VM, so I can iterate freely.