ReShift

A high-performance Android instrumentation and security research toolkit. It integrates Frida and Zygisk into a unified, mobile-first interface for dynamic analysis, reversing, and stealthy app research.

Features

Dual-Engine Injection

- Zygisk Loader: a custom C++ module that injects frida-gadget at process spawn, ideal for early-stage hooks and bypassing detection that triggers post-startup. - Frida-Server / CLI: full support for standard Frida instrumentation, with one-tap management of frida-server, frida-inject, and frida-cli binaries.

Advanced Stealth and Anti-Detection

- Dynamic binary renaming to evade process name checks. - Stealth pathing from root-only directories. - Randomised communication ports to avoid standard Frida port detection. - Integrated management for SELinux (Enforcing or Permissive) and ptrace_scope configuration.

Research and Debugging Arsenal

- Memory Inspector: browse, dump, and modify process memory in real time via a dedicated RPC bridge. - Stalker Toolbox: instruction-level tracing and execution flow analysis. - Il2Cpp Helpers: utilities for analysing and hooking Unity games with the Il2Cpp scripting backend. - Live Overlays: monitor Logcat and Frida script output over the target application.

Ecosystem Integration

- GitHub and CodeShare Browser: access community scripts from Frida CodeShare and curated GitHub repositories. - Multi-Script Loader: merge multiple scripts into a single deployment with priority-based execution and a shared registry. - Built-in Editor: syntax-highlighted script editor for on-device adjustments.

Architecture

- App: Android application built with Jetpack Compose for UI, script management, and RPC communication. - Zygisk Module: native C++ module for Magisk or Zygisk that facilitates early-stage injection. - Magisk Module: distribution package containing Frida binaries, startup scripts, and configuration templates.

RPC Bridge API

ReShift injects a global utility registry into scripts, enabling methods such as:

- listRegisteredHooks() - getMemoryDump(address, size) - listModules() - toggleHook(hookName)

Stealth Configuration

Managed via StealthConfigManager, generating a config.sh used by Magisk boot scripts for environment consistency across reboots.

Requirements

- Rooted device with Magisk, KSU, or KSU Next. - Zygisk enabled. - Target apps selected in the ReShift UI.

Note

This project is for educational and research purposes only. Reverse engineering apps may violate their Terms of Service. Use responsibly.

License

MIT