add README.md

feat:使用原来的so名称注入
feat:增加自定义linker注入
2025-06-26 21:18:00 +08:00 · 2025-06-26 20:14:54 +08:00 · 2025-06-26 19:59:33 +08:00 · 2025-06-25 23:15:37 +08:00 · 2025-06-25 23:06:03 +08:00
46 changed files with 2289 additions and 282 deletions
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -1,153 +0,0 @@
-name: Build and Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version tag (e.g., v1.0.0)'
-        required: true
-        default: 'v1.0.0'
-      branch:
-        description: 'Branch to build from'
-        required: false
-        default: 'main'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        submodules: 'recursive'
-    
-    - name: Set up JDK 17
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'temurin'
-        java-version: '17'
-    
-    - name: Cache Gradle dependencies
-      uses: actions/cache@v4
-      with:
-        path: |
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-        key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-
-    
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-    
-    - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
-      
-    - name: Install NDK and CMake
-      run: |
-        echo "y" | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager "ndk;25.2.9519653"
-        echo "y" | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager "cmake;3.22.1"
-    
-    - name: Build ConfigApp
-      run: |
-        cd configapp
-        ../gradlew assembleDebug
-        cd ..
-        
-    - name: Build Module
-      run: |
-        cd module
-        ../gradlew assembleRelease
-        cd ..
-    
-    - name: Package Module
-      run: |
-        # 获取版本信息
-        if [ "${{ github.event_name }}" == "push" ]; then
-          VERSION="${GITHUB_REF#refs/tags/}"
-        else
-          VERSION="${{ github.event.inputs.version }}"
-        fi
-        VERSION_CODE=$(echo $VERSION | sed 's/[^0-9]//g')
-        
-        # 创建临时目录
-        TEMP_DIR="build/magisk_module"
-        rm -rf $TEMP_DIR
-        mkdir -p $TEMP_DIR
-        
-        # 创建 module.prop
-        cat > $TEMP_DIR/module.prop << EOF
-        id=zygisk-myinjector
-        name=Zygisk MyInjector
-        version=$VERSION
-        versionCode=$VERSION_CODE
-        author=jiqiu2022
-        description=A Zygisk module for dynamic library injection with ConfigApp
-        EOF
-        
-        # 复制文件
-        cp module/service.sh $TEMP_DIR/
-        chmod 755 $TEMP_DIR/service.sh
-        
-        # 创建 zygisk 目录并复制 so 文件
-        mkdir -p $TEMP_DIR/zygisk
-        for arch in armeabi-v7a arm64-v8a x86 x86_64; do
-          SO_PATH="module/build/intermediates/stripped_native_libs/release/out/lib/$arch/libmyinjector.so"
-          if [ -f "$SO_PATH" ]; then
-            cp "$SO_PATH" "$TEMP_DIR/zygisk/$arch.so"
-          fi
-        done
-        
-        # 复制 ConfigApp APK
-        cp configapp/build/outputs/apk/debug/configapp-debug.apk $TEMP_DIR/configapp.apk
-        
-        # 创建 META-INF 目录
-        mkdir -p $TEMP_DIR/META-INF/com/google/android
-        touch $TEMP_DIR/META-INF/com/google/android/update-binary
-        touch $TEMP_DIR/META-INF/com/google/android/updater-script
-        
-        # 打包
-        cd $TEMP_DIR
-        zip -r ../../zygisk-myinjector-$VERSION.zip *
-        cd ../..
-        
-        # 列出文件内容
-        echo "Module contents:"
-        unzip -l zygisk-myinjector-$VERSION.zip
-        
-        # 重命名 APK 以包含版本号
-        cp configapp/build/outputs/apk/debug/configapp-debug.apk ./ConfigApp-$VERSION.apk
-        
-    - name: Create Release
-      id: create_release
-      uses: softprops/action-gh-release@v2
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        tag_name: ${{ github.event_name == 'push' && github.ref || github.event.inputs.version }}
-        name: Release ${{ github.event_name == 'push' && github.ref || github.event.inputs.version }}
-        body: |
-          ## Zygisk MyInjector Release
-          
-          ### 功能特性
-          - 动态 SO 注入
-          - 图形化配置界面
-          - 支持 Riru Hide
-          - 自动安装配置应用
-          
-          ### 安装说明
-          1. 下载 `zygisk-myinjector-*.zip`
-          2. 在 Magisk Manager 中安装模块
-          3. 重启设备
-          4. ConfigApp 会自动安装
-          
-          ### 更新日志
-          请查看 [commits](https://github.com/${{ github.repository }}/commits/${{ github.sha }})
-        draft: false
-        prerelease: false
-        files: |
-          ./zygisk-myinjector-*.zip
-          ./ConfigApp-*.apk
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,27 +0,0 @@
-name: Build
-on:
-  workflow_dispatch:
-      inputs:
-        package_name:
-          description: "Package name of the game:"
-          required: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-java@v3
-      with:
-        distribution: temurin
-        java-version: 11
-        cache: gradle
-    - run: |
-        chmod +x ./gradlew
-        sed -i 's/moduleDescription = "/moduleDescription = "(${{ github.event.inputs.package_name }}) /g' module.gradle
-        sed -i "s/com.game.packagename/${{ github.event.inputs.package_name }}/g" module/src/main/cpp/game.h
-        ./gradlew :module:assembleRelease
-    - uses: actions/upload-artifact@v4
-      with:
-        name: zygisk-il2cppdumper
-        path: out/magisk_module_release/
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,24 @@ on:
  pull_request:
    branches: [ main, develop, master ]
  workflow_dispatch:  # 允许手动触发
+    inputs:
+      create_release:
+        description: 'Create a release after build'
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+      release_tag:
+        description: 'Release tag (only if creating release)'
+        required: false
+        default: 'ci-latest'
+
+permissions:
+  contents: write  # 允许创建 release
+  packages: write  # 允许上传包
+  actions: read    # 允许读取 actions

 jobs:
  build:
@@ -116,3 +134,46 @@ jobs:
        name: configapp-ci-${{ github.sha }}
        path: configapp/build/outputs/apk/debug/configapp-debug.apk
        retention-days: 7
+    
+    - name: Prepare Release Files
+      if: github.event_name == 'workflow_dispatch' && github.event.inputs.create_release == 'true'
+      run: |
+        # 准备发布文件
+        mkdir -p release-files
+        cp zygisk-myinjector-ci.zip release-files/zygisk-myinjector-${{ github.event.inputs.release_tag }}.zip
+        cp configapp/build/outputs/apk/debug/configapp-debug.apk release-files/ConfigApp-${{ github.event.inputs.release_tag }}.apk
+        
+        echo "Release files:"
+        ls -la release-files/
+    
+    - name: Create Release
+      if: github.event_name == 'workflow_dispatch' && github.event.inputs.create_release == 'true'
+      uses: softprops/action-gh-release@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        tag_name: ${{ github.event.inputs.release_tag }}
+        name: CI Release ${{ github.event.inputs.release_tag }}
+        body: |
+          ## CI Build Release
+          
+          - **Build Type**: Manual CI Release
+          - **Commit**: ${{ github.sha }}
+          - **Branch**: ${{ github.ref_name }}
+          - **Run ID**: ${{ github.run_id }}
+          
+          ### 下载
+          - 模块文件: `zygisk-myinjector-${{ github.event.inputs.release_tag }}.zip`
+          - 配置应用: `ConfigApp-${{ github.event.inputs.release_tag }}.apk`
+          
+          ### 安装说明
+          1. 在 Magisk Manager 中安装模块 ZIP
+          2. 重启设备
+          3. ConfigApp 会自动安装
+          
+          ---
+          *这是一个 CI 构建版本，可能不稳定*
+        draft: false
+        prerelease: true
+        files: |
+          release-files/zygisk-myinjector-*.zip
+          release-files/ConfigApp-*.apk
--- a/README.md
+++ b/README.md
@@ -1,65 +1,187 @@
-# [Zygisk-MyInjector](https://github.com/jiqiu2022/Zygisk-MyInjector)
+# Zygisk注入器 - 动动手指轻松注入并隐藏你的SO文件

+## 前言

+作者在去年发布了[Zygisk注入模块的实现](https://bbs.kanxue.com/thread-283790.htm)，成功实现了模块的自动注入和Riru隐藏功能。

-最新开发进度：**多模块注入完成，maps隐藏注入完成**（并且修复了riru内存泄漏问题）     现在仍然面临soinfo链表遍历无法隐藏的情况
+然而，每次更换目标应用都需要重新编译，操作繁琐，导致用户采用率不高。为了解决这个问题，作者对项目进行了全面重构，带来了以下改进：

-我会初步进行框架层面的hook进行隐藏，进一步使用自定义linker来伪装成系统库的加载。
+- **图形化界面**：告别命令行，操作更直观
+- **一键安装**：面具模块快速部署
+- **配套管理APP**：轻松管理注入配置

-原项目https://github.com/Perfare/Zygisk-Il2CppDumper
+项目已完全开源，包含面具模块、管理APP以及所有打包脚本，并配置了GitHub CI自动构建。欢迎各位开发者贡献代码，提交PR。

-本项目在原项目基础上做局部更改，请支持原项目作者劳动成果
+### 版本规划

-1. 安装[Magisk](https://github.com/topjohnwu/Magisk) v24以上版本并开启Zygisk
+- **v1.x**：专注功能添加，暂不考虑反检测
+- **v2.x**：实现各种检测绕过，达到100%无痕注入

-2. 生成模块
-   - GitHub Actions
-     1. Fork这个项目
-     2. 在你fork的项目中选择**Actions**选项卡
-     3. 在左边的侧边栏中，单击**Build**
-     4. 选择**Run workflow**
-     5. 输入游戏包名并点击**Run workflow**
-     6. 等待操作完成并下载
-   - Android Studio
-     1. 下载源码
-     2. 编辑`game.h`, 修改`GamePackageName`为游戏包名
-     3. 使用Android Studio运行gradle任务`:module:assembleRelease`编译，zip包会生成在`out`文件夹下
+## 致谢

-3. 在Magisk里安装模块
+**项目地址**：[https://github.com/jiqiu2022/Zygisk-MyInjector](https://github.com/jiqiu2022/Zygisk-MyInjector)

-4. 将要注入的so放入到/data/local/tmp下修改为test.so
+特别感谢以下项目和开发者（按时间顺序）：

-   (部分手机第一次注入不会成功，请重启，再之后的注入会成功)
+- [Zygisk-Il2CppDumper](https://github.com/Perfare/Zygisk-Il2CppDumper) - 提供最原始的注入思路
+- Riru - 提供隐藏思路
+- 小佳大佬 - 提供App界面化的思路
+- [soLoader](https://github.com/SoyBeanMilkx/soLoader) - 提供自定义linker注入的全部逻辑，期待认识作者和作者一起继续完善

-多模块注入已经开发完成：
+如果对自定义linker感兴趣的大佬，推荐soLoader作者的文章https://yuuki.cool/2025/06/15/CustomLinker/
+
+## 使用教程
+
+### 步骤一：下载并安装面具模块
+
+1. 前往 [GitHub Release](https://github.com/jiqiu2022/Zygisk-MyInjector/tags) 页面下载最新版本的面具模块
+   
+   本教程以 [v1.1.0](https://github.com/jiqiu2022/Zygisk-MyInjector/releases/tag/v1.1.0) 版本为例
+
+2. 下载模块文件（如下图所示）：
+
+   ![CleanShot_2025_06_26_at_20_33_37](assets/CleanShot_2025_06_26_at_20_33_37-20250626203353-mvarjy3.png)
+
+3. 安装到手机，支持所有面具模块相关的APP（如 KernelSU、APatch 等）
+
+> **注意**：如果您的APP不支持Zygisk注入，请额外安装 Zygisk-Next 模块，否则可能导致注入失败。
+
+### 步骤二：准备SO文件并配置
+
+#### 1. 添加SO文件
+
+进入"SO文件管理"，点击"增加SO文件"：
+
+![CleanShot_2025_06_26_at_20_36_35](assets/CleanShot_2025_06_26_at_20_36_35-20250626203644-vum10yb.png)
+
+选择要注入的SO文件：
+
+![CleanShot_2025_06_26_at_20_37_10](assets/CleanShot_2025_06_26_at_20_37_10-20250626203718-fx50ptc.png)
+
+本教程使用以下两个SO文件进行测试：
+- `libmylib.so`（全注入测试）
+- `libgadget.so`（普通注入方式）
+
+> **提示**：后文将解释为什么自定义linker无法注入 `libgadget.so`。
+
+#### 2. 处理原文件
+
+选择SO后，系统会询问是否删除原文件：
+
+![CleanShot_2025_06_26_at_20_38_42](assets/CleanShot_2025_06_26_at_20_38_42-20250626203859-532f217.png)
+
+> **设计理念**：此功能可防止某些APP扫描tmp目录中的SO文件进行风控检测。
+
+添加成功后，SO管理界面会显示已添加的文件：
+
+![CleanShot_2025_06_26_at_20_39_38](assets/CleanShot_2025_06_26_at_20_39_38-20250626204000-p3oe63m.png)
+
+### 步骤三：配置目标APP
+
+本教程以珍惜大佬的Hunter为例演示配置过程。
+
+1. 点击空白处，配置注入参数：
+
+   ![CleanShot_2025_06_26_at_20_40_50](assets/CleanShot_2025_06_26_at_20_40_50-20250626204056-cn1613i.png)
+
+2. 保存配置后，开启注入开关：
+
+   ![CleanShot_2025_06_26_at_20_41_17](assets/CleanShot_2025_06_26_at_20_41_17-20250626204121-6k6wqym.png)
+
+### 步骤四：验证注入效果
+
+打开目标APP，查看日志输出：
+
+![CleanShot_2025_06_26_at_20_42_17](assets/CleanShot_2025_06_26_at_20_42_17-20250626204224-gylrvtd.png)
+
+成功打印"我已经成功加载"，表明注入成功。
+
+#### 测试Gadget注入
+
+切换到gadget进行测试：
+
+![CleanShot_2025_06_26_at_20_43_27](assets/CleanShot_2025_06_26_at_20_43_27-20250626204331-wse9zyb.png)
+
+> **特性**：本注入模块支持同时注入多个SO文件。
+
+![CleanShot_2025_06_26_at_20_44_09](assets/CleanShot_2025_06_26_at_20_44_09-20250626204414-lov146o.png)
+
+注入成功：
+
+![CleanShot_2025_06_26_at_20_44_19](assets/CleanShot_2025_06_26_at_20_44_19-20250626204426-2ubkjyi.png)
+
+> **说明**：由于使用的Hunter版本较旧，可能无法检测到注入。建议使用新版本进行测试。
+
+#### 测试其他注入方式
+
+测试Riru Hide功能：
+
+![CleanShot_2025_06_26_at_20_46_07](assets/CleanShot_2025_06_26_at_20_46_07-20250626204610-d2o279q.png)
+
+> **提示**：修改配置后，建议先关闭再开启注入开关，确保新配置生效。
+
+![CleanShot_2025_06_26_at_20_46_45](assets/CleanShot_2025_06_26_at_20_46_45-20250626204649-sj0w84k.png)
+
+Riru Hide成功生效。
+
+测试自定义Linker加载：
+
+![CleanShot_2025_06_26_at_20_47_19](assets/CleanShot_2025_06_26_at_20_47_19-20250626204724-7dtm624.png)
+
+加载成功：
+
+![CleanShot_2025_06_26_at_20_47_34](assets/CleanShot_2025_06_26_at_20_47_34-20250626204744-v9hdf53.png)
+
+## 编译指南
+
+### 自动编译
+
+参考项目中的 [CI配置文件](https://github.com/jiqiu2022/Zygisk-MyInjector/blob/main/.github/workflows/ci.yml)。
+
+如果您fork了本项目，只需在本地修改代码并push，云端将自动编译。
+
+### 本地编译
+
+使用项目提供的 `build_all.sh` 脚本进行编译。
+
+> **环境要求**：需要Java 17环境。
+
+## 工作原理
+
+### 注入流程详解
+
+1. **SO文件管理**
+   - 用户选择SO文件后，APP自动将其复制到 `/data/adb/modules/module-name` 目录下进行统一管理
+2. **配置生成**
+   - 完成APP配置后，管理器在 `/data/adb/modules/module-name` 下创建config文件
+   - 面具模块启动时读取此配置，执行SO加载
+3. **注入激活**
+   - 开启注入时：APP将管理器中的SO复制到目标APP目录，并将config状态设置为开启
+   - 关闭注入时：APP自动删除已复制的SO文件，将config状态设置为关闭
+## 为什么自定义linker不能注入gadget

 ```
-void hack_start(const char *game_data_dir,JavaVM *vm) {
-    load_so(game_data_dir,vm,"test");
-    //如果要注入多个so，那么就在这里不断的添加load_so函数即可
-}
+frida_KjnwyG_detect_location: assertion failed: (our_range != null)
+Bail out! Frida:ERROR:../lib/KjnwyG/KjnwyG.vala:809:frida_KjnwyG_detect_location: assertion failed: (our_range != null)
+Aborted
 ```

+因为gadget的init_array里面其中有一个函数，尝试使用maps和soinfo获取到自己模块的信息，防止递归调用。
+
+但是自定义linker的soinfo和内存段都是自己分配的，导致gadget找不到自己，发生了断言失败，我们可以简单的去掉断言，但是可能造成其他bug，后续作者会和小佳一起修复。
+
+当然还有一种复杂的方法，就是用注入的so的soinfo，替换成要注入的so的，多见于360等壳子，等后续作者会实现。


-目前正在开发的分支：

-	1. 使用Java的System.load加载so
+## 后续更新计划

-	2. 注入多个so的分支(已完成)
-
-计划开发：
-
-1. 第一步，仿照Riru，将注入的so进行内存上的初步隐藏（可以对抗部分业务检测，游戏安全相关已经补齐，建议不要尝试）（已经开发完成）
-2. 第二步，实现一个自定义的linker，进行更深层次的注入隐藏
-3. 第三步，搭配对应配套手机的内核模块对注入的模块进行进一步完美擦除，达到完美注入的目的
-
-以此项目为脚手架的计划开发：
-
-1. 一个全新的Frida框架，保留大部分原生api，并可以过任何相关注入检测
-
-2. 一个全新的Trace框架，高性能Trace，速度是Stallker的60倍，并且支持更全面的信息打印。（具体效果可以参考看雪帖子）
-
-3. 一个全新的无痕调试框架，支持像GDB一样调试，没有ptrace痕迹，两种思路进行无痕调试（基于硬件断点以及基于VM）
+- **深度隐藏**：联动面具模块，提供maps等更深层次的隐藏功能
+- **用户体验优化**：
+  - 增加gadget配置一键生成功能
+  - 提供更友好的界面交互
+  - 支持批量配置管理

+---

+欢迎关注项目进展，期待您的贡献！
--- a/assets/CleanShot_2025_06_26_at_20_33_37-20250626203353-mvarjy3.png
+++ b/assets/CleanShot_2025_06_26_at_20_33_37-20250626203353-mvarjy3.png
--- a/assets/CleanShot_2025_06_26_at_20_36_35-20250626203644-vum10yb.png
+++ b/assets/CleanShot_2025_06_26_at_20_36_35-20250626203644-vum10yb.png
--- a/assets/CleanShot_2025_06_26_at_20_37_10-20250626203718-fx50ptc.png
+++ b/assets/CleanShot_2025_06_26_at_20_37_10-20250626203718-fx50ptc.png
--- a/assets/CleanShot_2025_06_26_at_20_38_42-20250626203859-532f217.png
+++ b/assets/CleanShot_2025_06_26_at_20_38_42-20250626203859-532f217.png
--- a/assets/CleanShot_2025_06_26_at_20_39_38-20250626204000-p3oe63m.png
+++ b/assets/CleanShot_2025_06_26_at_20_39_38-20250626204000-p3oe63m.png
--- a/assets/CleanShot_2025_06_26_at_20_40_50-20250626204056-cn1613i.png
+++ b/assets/CleanShot_2025_06_26_at_20_40_50-20250626204056-cn1613i.png
--- a/assets/CleanShot_2025_06_26_at_20_41_17-20250626204121-6k6wqym.png
+++ b/assets/CleanShot_2025_06_26_at_20_41_17-20250626204121-6k6wqym.png
--- a/assets/CleanShot_2025_06_26_at_20_42_17-20250626204224-gylrvtd.png
+++ b/assets/CleanShot_2025_06_26_at_20_42_17-20250626204224-gylrvtd.png
--- a/assets/CleanShot_2025_06_26_at_20_43_27-20250626204331-wse9zyb.png
+++ b/assets/CleanShot_2025_06_26_at_20_43_27-20250626204331-wse9zyb.png
--- a/assets/CleanShot_2025_06_26_at_20_44_09-20250626204414-lov146o.png
+++ b/assets/CleanShot_2025_06_26_at_20_44_09-20250626204414-lov146o.png
--- a/assets/CleanShot_2025_06_26_at_20_44_19-20250626204426-2ubkjyi.png
+++ b/assets/CleanShot_2025_06_26_at_20_44_19-20250626204426-2ubkjyi.png
--- a/assets/CleanShot_2025_06_26_at_20_46_07-20250626204610-d2o279q.png
+++ b/assets/CleanShot_2025_06_26_at_20_46_07-20250626204610-d2o279q.png
--- a/assets/CleanShot_2025_06_26_at_20_46_45-20250626204649-sj0w84k.png
+++ b/assets/CleanShot_2025_06_26_at_20_46_45-20250626204649-sj0w84k.png
--- a/assets/CleanShot_2025_06_26_at_20_47_19-20250626204724-7dtm624.png
+++ b/assets/CleanShot_2025_06_26_at_20_47_19-20250626204724-7dtm624.png
--- a/assets/CleanShot_2025_06_26_at_20_47_34-20250626204744-v9hdf53.png
+++ b/assets/CleanShot_2025_06_26_at_20_47_34-20250626204744-v9hdf53.png
--- a/configapp/build.gradle
+++ b/configapp/build.gradle
@@ -29,8 +29,8 @@ android {
        }
    }
    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
        coreLibraryDesugaringEnabled false
    }
 }
--- a/configapp/src/main/java/com/jiqiu/configapp/AppListFragment.java
+++ b/configapp/src/main/java/com/jiqiu/configapp/AppListFragment.java
@@ -13,6 +13,8 @@ import android.widget.ProgressBar;
 import android.app.Dialog;
 import android.widget.CheckBox;
 import android.widget.ImageView;
+import android.widget.RadioButton;
+import android.widget.RadioGroup;
 import android.widget.TextView;

 import androidx.annotation.NonNull;
@@ -134,15 +136,24 @@ public class AppListFragment extends Fragment implements AppListAdapter.OnAppTog
        TextView packageName = dialogView.findViewById(R.id.packageName);
        RecyclerView soListRecyclerView = dialogView.findViewById(R.id.soListRecyclerView);
        TextView emptyText = dialogView.findViewById(R.id.emptyText);
-        SwitchMaterial switchHideInjection = dialogView.findViewById(R.id.switchHideInjection);
+        RadioGroup injectionMethodGroup = dialogView.findViewById(R.id.injectionMethodGroup);
+        RadioButton radioStandardInjection = dialogView.findViewById(R.id.radioStandardInjection);
+        RadioButton radioRiruInjection = dialogView.findViewById(R.id.radioRiruInjection);
+        RadioButton radioCustomLinkerInjection = dialogView.findViewById(R.id.radioCustomLinkerInjection);
        
        appIcon.setImageDrawable(appInfo.getAppIcon());
        appName.setText(appInfo.getAppName());
        packageName.setText(appInfo.getPackageName());
        
        // Load current config
-        boolean hideInjection = configManager.getHideInjection();
-        switchHideInjection.setChecked(hideInjection);
+        String injectionMethod = configManager.getAppInjectionMethod(appInfo.getPackageName());
+        if ("custom_linker".equals(injectionMethod)) {
+            radioCustomLinkerInjection.setChecked(true);
+        } else if ("riru".equals(injectionMethod)) {
+            radioRiruInjection.setChecked(true);
+        } else {
+            radioStandardInjection.setChecked(true);
+        }
        
        // Setup SO list
        List<ConfigManager.SoFile> globalSoFiles = configManager.getAllSoFiles();
@@ -165,8 +176,16 @@ public class AppListFragment extends Fragment implements AppListAdapter.OnAppTog
                .setTitle("配置注入")
                .setView(dialogView)
                .setPositiveButton("保存", (dialog, which) -> {
-                    // Save hide injection setting
-                    configManager.setHideInjection(switchHideInjection.isChecked());
+                    // Save injection method
+                    String selectedMethod;
+                    if (radioCustomLinkerInjection.isChecked()) {
+                        selectedMethod = "custom_linker";
+                    } else if (radioRiruInjection.isChecked()) {
+                        selectedMethod = "riru";
+                    } else {
+                        selectedMethod = "standard";
+                    }
+                    configManager.setAppInjectionMethod(appInfo.getPackageName(), selectedMethod);
                    
                    // Save SO selection
                    if (soListRecyclerView.getAdapter() != null) {
--- a/configapp/src/main/java/com/jiqiu/configapp/ConfigManager.java
+++ b/configapp/src/main/java/com/jiqiu/configapp/ConfigManager.java
@@ -151,9 +151,17 @@ public class ConfigManager {
            config.globalSoFiles = new ArrayList<>();
        }
        
-        // Generate unique filename
+        // Keep original filename
        String fileName = new File(originalPath).getName();
-        String storedPath = SO_STORAGE_DIR + "/" + System.currentTimeMillis() + "_" + fileName;
+        String storedPath = SO_STORAGE_DIR + "/" + fileName;
+        
+        // Check if file already exists with same name
+        for (SoFile existing : config.globalSoFiles) {
+            if (existing.name.equals(fileName)) {
+                Log.w(TAG, "SO file with same name already exists: " + fileName);
+                return;
+            }
+        }
        
        // Copy SO file to our storage
        Shell.Result result = Shell.cmd("cp \"" + originalPath + "\" \"" + storedPath + "\"").exec();
@@ -227,6 +235,24 @@ public class ConfigManager {
        saveConfig();
    }
    
+    public String getAppInjectionMethod(String packageName) {
+        AppConfig appConfig = config.perAppConfig.get(packageName);
+        if (appConfig == null) {
+            return "standard"; // Default to standard
+        }
+        return appConfig.injectionMethod != null ? appConfig.injectionMethod : "standard";
+    }
+    
+    public void setAppInjectionMethod(String packageName, String method) {
+        AppConfig appConfig = config.perAppConfig.get(packageName);
+        if (appConfig == null) {
+            appConfig = new AppConfig();
+            config.perAppConfig.put(packageName, appConfig);
+        }
+        appConfig.injectionMethod = method;
+        saveConfig();
+    }
+    
    // Copy SO files directly to app's data directory
    private void deploySoFilesToApp(String packageName) {
        AppConfig appConfig = config.perAppConfig.get(packageName);
@@ -270,9 +296,8 @@ public class ConfigManager {
        
        // Copy each SO file configured for this app
        for (SoFile soFile : appConfig.soFiles) {
-            // Extract mapped filename
-            String mappedName = new File(soFile.storedPath).getName();
-            String destPath = filesDir + "/" + mappedName;
+            // Use original filename
+            String destPath = filesDir + "/" + soFile.name;
            
            // Check if source file exists
            Shell.Result checkResult = Shell.cmd("test -f \"" + soFile.storedPath + "\" && echo 'exists'").exec();
@@ -336,8 +361,8 @@ public class ConfigManager {
        
        // Only delete the SO files we deployed, not the entire directory
        for (SoFile soFile : appConfig.soFiles) {
-            String mappedName = new File(soFile.storedPath).getName();
-            String filePath = filesDir + "/" + mappedName;
+            // Use original filename
+            String filePath = filesDir + "/" + soFile.name;
            
            Log.i(TAG, "Cleaning up: " + filePath);
            
@@ -384,6 +409,7 @@ public class ConfigManager {
    public static class AppConfig {
        public boolean enabled = false;
        public List<SoFile> soFiles = new ArrayList<>();
+        public String injectionMethod = "standard"; // "standard", "riru" or "custom_linker"
    }
    
    public static class SoFile {
--- a/configapp/src/main/res/layout/dialog_app_config.xml
+++ b/configapp/src/main/res/layout/dialog_app_config.xml
@@ -77,12 +77,42 @@
        android:textColor="?android:attr/textColorTertiary"
        android:visibility="gone" />

-    <com.google.android.material.switchmaterial.SwitchMaterial
-        android:id="@+id/switchHideInjection"
+    <TextView
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="注入方式"
+        android:textSize="14sp"
+        android:textColor="?android:attr/textColorSecondary"
+        android:layout_marginTop="16dp"
+        android:layout_marginBottom="8dp" />
+
+    <RadioGroup
+        android:id="@+id/injectionMethodGroup"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
-        android:text="隐藏注入"
-        android:layout_marginTop="8dp" />
+        android:orientation="vertical">
+
+        <RadioButton
+            android:id="@+id/radioStandardInjection"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="标准注入"
+            android:checked="true" />
+
+        <TextView
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_marginStart="32dp"
+            android:layout_marginBottom="8dp"
+            android:text="使用标准dlopen方式注入"
+            android:textColor="?android:attr/textColorSecondary"
+            android:textSize="12sp" />
+
+        <RadioButton
+            android:id="@+id/radioRiruInjection"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="Riru注入" />

        <TextView
            android:layout_width="wrap_content"
@@ -90,7 +120,23 @@
            android:text="使用Riru Hide隐藏注入的SO文件"
            android:textSize="12sp"
            android:textColor="?android:attr/textColorSecondary"
-        android:layout_marginStart="56dp"
-        android:layout_marginTop="4dp" />
+            android:layout_marginStart="32dp"
+            android:layout_marginBottom="8dp" />
+
+        <RadioButton
+            android:id="@+id/radioCustomLinkerInjection"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="自定义Linker注入" />
+
+        <TextView
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:text="使用自定义ELF加载器进行注入"
+            android:textSize="12sp"
+            android:textColor="?android:attr/textColorSecondary"
+            android:layout_marginStart="32dp" />
+
+    </RadioGroup>

 </LinearLayout>
--- a/module/src/main/cpp/CMakeLists.txt
+++ b/module/src/main/cpp/CMakeLists.txt
@@ -29,10 +29,14 @@ set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} ${LINKER_FLAGS}")

 include_directories(
        xdl/include
+        mylinker/include
 )

 aux_source_directory(xdl xdl-src)

+# Build mylinker as a subdirectory
+add_subdirectory(mylinker)
+
 add_library(${MODULE_NAME} SHARED
        main.cpp
        hack_new.cpp
@@ -40,7 +44,7 @@ add_library(${MODULE_NAME} SHARED
        newriruhide.cpp
        pmparser.cpp
        ${xdl-src})
-target_link_libraries(${MODULE_NAME} log)
+target_link_libraries(${MODULE_NAME} log mylinker)

 if (NOT CMAKE_BUILD_TYPE STREQUAL "Debug")
    add_custom_command(TARGET ${MODULE_NAME} POST_BUILD
--- a/module/src/main/cpp/config.cpp
+++ b/module/src/main/cpp/config.cpp
@@ -43,6 +43,16 @@ namespace Config {
        std::string enabledStr = extractValue(appJson, "enabled");
        appConfig.enabled = (enabledStr == "true");
        
+        // Parse injection method
+        std::string methodStr = extractValue(appJson, "injectionMethod");
+        if (methodStr == "2" || methodStr == "custom_linker") {
+            appConfig.injectionMethod = InjectionMethod::CUSTOM_LINKER;
+        } else if (methodStr == "1" || methodStr == "riru") {
+            appConfig.injectionMethod = InjectionMethod::RIRU;
+        } else {
+            appConfig.injectionMethod = InjectionMethod::STANDARD;
+        }
+        
        // Parse soFiles array
        size_t soFilesPos = appJson.find("\"soFiles\"");
        if (soFilesPos != std::string::npos) {
@@ -76,8 +86,10 @@ namespace Config {
        }
        
        g_config.perAppConfig[packageName] = appConfig;
-        LOGD("Loaded config for app: %s, enabled: %d, SO files: %zu", 
-             packageName.c_str(), appConfig.enabled, appConfig.soFiles.size());
+        const char* methodName = appConfig.injectionMethod == InjectionMethod::CUSTOM_LINKER ? "custom_linker" :
+                                 appConfig.injectionMethod == InjectionMethod::RIRU ? "riru" : "standard";
+        LOGD("Loaded config for app: %s, enabled: %d, method: %s, SO files: %zu", 
+             packageName.c_str(), appConfig.enabled, methodName, appConfig.soFiles.size());
    }
    
    ModuleConfig readConfig() {
@@ -188,4 +200,16 @@ namespace Config {
        }
        return g_config.hideInjection;
    }
+    
+    InjectionMethod getAppInjectionMethod(const std::string& packageName) {
+        if (!g_configLoaded) {
+            readConfig();
+        }
+        
+        auto it = g_config.perAppConfig.find(packageName);
+        if (it != g_config.perAppConfig.end()) {
+            return it->second.injectionMethod;
+        }
+        return InjectionMethod::STANDARD;
+    }
 }
--- a/module/src/main/cpp/config.h
+++ b/module/src/main/cpp/config.h
@@ -13,8 +13,15 @@ namespace Config {
        std::string originalPath;
    };
    
+    enum class InjectionMethod {
+        STANDARD = 0,
+        RIRU = 1,
+        CUSTOM_LINKER = 2
+    };
+    
    struct AppConfig {
        bool enabled = false;
+        InjectionMethod injectionMethod = InjectionMethod::STANDARD;
        std::vector<SoFile> soFiles;
    };
    
@@ -35,6 +42,9 @@ namespace Config {
    
    // Get hide injection setting
    bool shouldHideInjection();
+    
+    // Get injection method for specific app
+    InjectionMethod getAppInjectionMethod(const std::string& packageName);
 }

 #endif // CONFIG_H
--- a/module/src/main/cpp/hack.h
+++ b/module/src/main/cpp/hack.h
@@ -6,7 +6,8 @@
 #define ZYGISK_IL2CPPDUMPER_HACK_H

 #include <stddef.h>
+#include <jni.h>

-void hack_prepare(const char *game_data_dir, const char *package_name, void *data, size_t length);
+void hack_prepare(const char *game_data_dir, const char *package_name, void *data, size_t length, JavaVM *vm);

 #endif //ZYGISK_IL2CPPDUMPER_HACK_H
--- a/module/src/main/cpp/hack_new.cpp
+++ b/module/src/main/cpp/hack_new.cpp
@@ -1,6 +1,7 @@
 #include "hack.h"
 #include "config.h"
 #include "log.h"
+#include "mylinker.h"
 #include <cstring>
 #include <thread>
 #include <dlfcn.h>
@@ -8,22 +9,15 @@
 #include <unistd.h>
 #include <sys/stat.h>
 #include <errno.h>
+#include <jni.h>

 // External function from newriruhide.cpp
 extern "C" void riru_hide(const char *name);

-void load_so_file(const char *game_data_dir, const Config::SoFile &soFile) {
-    // Extract the mapped filename from storedPath (e.g., "1750851324251_libmylib.so")
-    const char *mapped_name = strrchr(soFile.storedPath.c_str(), '/');
-    if (!mapped_name) {
-        mapped_name = soFile.storedPath.c_str();
-    } else {
-        mapped_name++; // Skip the '/'
-    }
-    
-    // The file should already be in app's files directory
+void load_so_file_standard(const char *game_data_dir, const Config::SoFile &soFile) {
+    // Use original filename
    char so_path[512];
-    snprintf(so_path, sizeof(so_path), "%s/files/%s", game_data_dir, mapped_name);
+    snprintf(so_path, sizeof(so_path), "%s/files/%s", game_data_dir, soFile.name.c_str());
    
    // Check if file exists
    if (access(so_path, F_OK) != 0) {
@@ -31,42 +25,105 @@ void load_so_file(const char *game_data_dir, const Config::SoFile &soFile) {
        return;
    }
    
-    // Load the SO file
+    // Load the SO file using standard dlopen (no hiding)
    void *handle = dlopen(so_path, RTLD_NOW | RTLD_LOCAL);
    if (handle) {
-        LOGI("Successfully loaded SO: %s (mapped: %s)", soFile.name.c_str(), mapped_name);
-        
-        // Hide if configured
-        if (Config::shouldHideInjection()) {
-            // Hide using the mapped name since that's what we loaded
-            riru_hide(mapped_name);
-            LOGI("Applied riru_hide to: %s", mapped_name);
-        }
+        LOGI("Successfully loaded SO via standard dlopen: %s", soFile.name.c_str());
    } else {
-        LOGE("Failed to load SO: %s - %s", so_path, dlerror());
+        LOGE("Failed to load SO via standard dlopen: %s - %s", so_path, dlerror());
    }
 }

-void hack_thread_func(const char *game_data_dir, const char *package_name) {
+void load_so_file_riru(const char *game_data_dir, const Config::SoFile &soFile) {
+    // Use original filename
+    char so_path[512];
+    snprintf(so_path, sizeof(so_path), "%s/files/%s", game_data_dir, soFile.name.c_str());
+    
+    // Check if file exists
+    if (access(so_path, F_OK) != 0) {
+        LOGE("SO file not found: %s", so_path);
+        return;
+    }
+    
+    // Load the SO file using dlopen (Riru method)
+    void *handle = dlopen(so_path, RTLD_NOW | RTLD_LOCAL);
+    if (handle) {
+        LOGI("Successfully loaded SO via Riru: %s", soFile.name.c_str());
+        
+        // Hide if configured
+        if (Config::shouldHideInjection()) {
+            // Hide using the original name
+            riru_hide(soFile.name.c_str());
+            LOGI("Applied riru_hide to: %s", soFile.name.c_str());
+        }
+    } else {
+        LOGE("Failed to load SO via Riru: %s - %s", so_path, dlerror());
+    }
+}
+
+void load_so_file_custom_linker(const char *game_data_dir, const Config::SoFile &soFile, JavaVM *vm) {
+    // Use original filename
+    char so_path[512];
+    snprintf(so_path, sizeof(so_path), "%s/files/%s", game_data_dir, soFile.name.c_str());
+    
+    // Check if file exists
+    if (access(so_path, F_OK) != 0) {
+        LOGE("SO file not found: %s", so_path);
+        return;
+    }
+    
+    // Load the SO file using custom linker
+    if (mylinker_load_library(so_path, vm)) {
+        LOGI("Successfully loaded SO via custom linker: %s", soFile.name.c_str());
+        
+        // Custom linker doesn't appear in maps, so no need to hide
+        if (Config::shouldHideInjection()) {
+            LOGI("Custom linker injection is inherently hidden");
+        }
+    } else {
+        LOGE("Failed to load SO via custom linker: %s", so_path);
+    }
+}
+
+void hack_thread_func(const char *game_data_dir, const char *package_name, JavaVM *vm) {
    LOGI("Hack thread started for package: %s", package_name);
    
    // Wait a bit for app to initialize and files to be copied
    sleep(2);
    
+    // Get injection method for this app
+    Config::InjectionMethod method = Config::getAppInjectionMethod(package_name);
+    const char* methodName = method == Config::InjectionMethod::CUSTOM_LINKER ? "Custom Linker" :
+                             method == Config::InjectionMethod::RIRU ? "Riru" : "Standard";
+    LOGI("Using injection method: %s", methodName);
+    
    // Get SO files for this app
    auto soFiles = Config::getAppSoFiles(package_name);
    LOGI("Found %zu SO files to load", soFiles.size());
    
-    // Load each SO file
+    // Load each SO file using the configured method
    for (const auto &soFile : soFiles) {
        LOGI("Loading SO: %s (stored as: %s)", soFile.name.c_str(), soFile.storedPath.c_str());
-        load_so_file(game_data_dir, soFile);
+        
+        if (method == Config::InjectionMethod::CUSTOM_LINKER) {
+            load_so_file_custom_linker(game_data_dir, soFile, vm);
+        } else if (method == Config::InjectionMethod::RIRU) {
+            load_so_file_riru(game_data_dir, soFile);
+        } else {
+            load_so_file_standard(game_data_dir, soFile);
+        }
+    }
+    
+    // Cleanup custom linker resources when done (if used)
+    if (method == Config::InjectionMethod::CUSTOM_LINKER) {
+        // Keep libraries loaded, don't cleanup
+        LOGI("Custom linker injection completed, libraries remain loaded");
    }
 }

-void hack_prepare(const char *game_data_dir, const char *package_name, void *data, size_t length) {
+void hack_prepare(const char *game_data_dir, const char *package_name, void *data, size_t length, JavaVM *vm) {
    LOGI("hack_prepare called for package: %s, dir: %s", package_name, game_data_dir);
    
-    std::thread hack_thread(hack_thread_func, game_data_dir, package_name);
+    std::thread hack_thread(hack_thread_func, game_data_dir, package_name, vm);
    hack_thread.detach();
 }
--- a/module/src/main/cpp/main.cpp
+++ b/module/src/main/cpp/main.cpp
@@ -42,9 +42,15 @@ public:

    void postAppSpecialize(const AppSpecializeArgs *) override {
        if (enable_hack) {
-            // Then start hack thread
-            std::thread hack_thread(hack_prepare, _data_dir, _package_name, data, length);
+            // Get JavaVM
+            JavaVM *vm = nullptr;
+            if (env->GetJavaVM(&vm) == JNI_OK) {
+                // Then start hack thread with JavaVM
+                std::thread hack_thread(hack_prepare, _data_dir, _package_name, data, length, vm);
                hack_thread.detach();
+            } else {
+                LOGE("Failed to get JavaVM");
+            }
        }
    }

--- a/module/src/main/cpp/mylinker/CMakeLists.txt
+++ b/module/src/main/cpp/mylinker/CMakeLists.txt
@@ -0,0 +1,29 @@
+cmake_minimum_required(VERSION 3.18.1)
+project(ElfLoader)
+
+set(CMAKE_CXX_STANDARD 17)
+
+include_directories(include)
+
+set(SOURCES
+        mylinker.cpp
+        elf_loader.cpp
+        elf_reader.cpp
+        memory_manager.cpp
+        relocator.cpp
+        soinfo_manager.cpp
+        utils.cpp
+)
+
+find_library(log-lib log)
+
+# Build as shared library
+add_library(mylinker SHARED ${SOURCES})
+
+target_link_libraries(mylinker ${log-lib})
+
+# Only build executable for standalone testing
+if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+    add_executable(elf_loader_test main.cpp elf_loader.cpp elf_reader.cpp memory_manager.cpp relocator.cpp soinfo_manager.cpp utils.cpp)
+    target_link_libraries(elf_loader_test ${log-lib})
+endif()
--- a/module/src/main/cpp/mylinker/elf_loader.cpp
+++ b/module/src/main/cpp/mylinker/elf_loader.cpp
@@ -0,0 +1,187 @@
+#include "elf_loader.h"
+
+ElfLoader::ElfLoader() : loaded_si_(nullptr) {
+    reader_ = std::make_unique<ElfReader>();
+    memory_manager_ = std::make_unique<MemoryManager>();
+    soinfo_manager_ = std::make_unique<SoinfoManager>();
+    relocator_ = std::make_unique<Relocator>();
+}
+
+ElfLoader::~ElfLoader() {
+}
+
+bool ElfLoader::LoadLibrary(const char* path) {
+    LOGI("Loading library: %s", path);
+
+    if (!reader_->Open(path)) {
+        LOGE("Failed to open %s", path);
+        return false;
+    }
+
+    if (!reader_->Read()) {
+        LOGE("Failed to read ELF file");
+        return false;
+    }
+
+    if (!memory_manager_->ReserveAddressSpace(reader_->GetProgramHeaders(),
+                                              reader_->GetProgramHeaderCount())) {
+        LOGE("Failed to reserve address space");
+        return false;
+    }
+
+    if (!memory_manager_->LoadSegments(reader_->GetProgramHeaders(),
+                                       reader_->GetProgramHeaderCount(),
+                                       reader_->GetMappedAddr(),
+                                       reader_->GetFileSize())) {
+        LOGE("Failed to load segments");
+        return false;
+    }
+
+    if (!memory_manager_->FindPhdr(reader_->GetProgramHeaders(),
+                                   reader_->GetProgramHeaderCount())) {
+        LOGE("Failed to find program headers");
+        return false;
+    }
+
+    const char* basename = strrchr(path, '/');
+    basename = basename ? basename + 1 : path;
+    loaded_si_ = soinfo_manager_->GetOrCreateSoinfo(basename);
+
+    if (!soinfo_manager_->UpdateSoinfo(loaded_si_, memory_manager_.get(), reader_.get())) {
+        LOGE("Failed to update soinfo");
+        return false;
+    }
+
+    if (!soinfo_manager_->PrelinkImage(loaded_si_)) {
+        LOGE("Failed to prelink image");
+        return false;
+    }
+
+    if (!memory_manager_->ProtectSegments(reader_->GetProgramHeaders(),
+                                          reader_->GetProgramHeaderCount())) {
+        LOGE("Failed to protect segments");
+        return false;
+    }
+
+    if (!relocator_->LinkImage(loaded_si_)) {
+        LOGE("Failed to link image");
+        return false;
+    }
+
+    reader_->Close();
+
+    LOGI("Successfully loaded %s", path);
+    return true;
+}
+
+void ElfLoader::CallConstructors() {
+    if (loaded_si_ == nullptr) {
+        return;
+    }
+
+    LOGD("Constructors already called during linking");
+}
+
+void* ElfLoader::GetSymbol(const char* name) {
+    if (loaded_si_ == nullptr) {
+        LOGE("loaded_si_ is null");
+        return nullptr;
+    }
+
+    if (name == nullptr) {
+        LOGE("Symbol name is null");
+        return nullptr;
+    }
+
+    LOGD("Looking for symbol: %s", name);
+    LOGD("soinfo state: symtab=%p, strtab=%p, gnu_bucket=%p, bucket=%p",
+         loaded_si_->symtab, loaded_si_->strtab, loaded_si_->gnu_bucket, loaded_si_->bucket);
+
+    if (loaded_si_->symtab != nullptr) {
+        if (loaded_si_->gnu_bucket != nullptr) {
+            LOGD("Trying GNU hash lookup for %s", name);
+            uint32_t hash = relocator_->gnu_hash(name);
+            LOGD("GNU hash for %s: 0x%x", name, hash);
+
+            ElfW(Sym)* sym = relocator_->gnu_lookup(hash, name, loaded_si_);
+            if (sym != nullptr && sym->st_shndx != SHN_UNDEF) {
+                ElfW(Addr) addr = sym->st_value + loaded_si_->load_bias;
+                LOGD("Found symbol %s via GNU hash: st_value=0x%llx, load_bias=0x%llx, final_addr=0x%llx",
+                     name, (unsigned long long)sym->st_value, (unsigned long long)loaded_si_->load_bias, (unsigned long long)addr);
+
+                if (addr >= loaded_si_->base && addr < loaded_si_->base + loaded_si_->size) {
+                    return reinterpret_cast<void*>(addr);
+                } else {
+                    LOGE("Symbol %s address 0x%llx out of range [0x%llx, 0x%llx)",
+                         name, (unsigned long long)addr, (unsigned long long)loaded_si_->base, 
+                         (unsigned long long)(loaded_si_->base + loaded_si_->size));
+                }
+            } else {
+                LOGD("Symbol %s not found via GNU hash", name);
+            }
+        }
+
+        if (loaded_si_->bucket != nullptr) {
+            LOGD("Trying ELF hash lookup for %s", name);
+            unsigned hash = relocator_->elf_hash(name);
+            LOGD("ELF hash for %s: 0x%x", name, hash);
+
+            ElfW(Sym)* sym = relocator_->elf_lookup(hash, name, loaded_si_);
+            if (sym != nullptr && sym->st_shndx != SHN_UNDEF) {
+                ElfW(Addr) addr = sym->st_value + loaded_si_->load_bias;
+                LOGD("Found symbol %s via ELF hash: st_value=0x%llx, load_bias=0x%llx, final_addr=0x%llx",
+                     name, (unsigned long long)sym->st_value, (unsigned long long)loaded_si_->load_bias, (unsigned long long)addr);
+
+                if (addr >= loaded_si_->base && addr < loaded_si_->base + loaded_si_->size) {
+                    return reinterpret_cast<void*>(addr);
+                } else {
+                    LOGE("Symbol %s address 0x%llx out of range [0x%llx, 0x%llx)",
+                         name, (unsigned long long)addr, (unsigned long long)loaded_si_->base, 
+                         (unsigned long long)(loaded_si_->base + loaded_si_->size));
+                }
+            } else {
+                LOGD("Symbol %s not found via ELF hash", name);
+            }
+        }
+
+        if (loaded_si_->gnu_bucket == nullptr && loaded_si_->bucket == nullptr) {
+            LOGD("No hash tables available, trying linear search");
+
+            if (loaded_si_->strtab != nullptr) {
+                size_t sym_count = 0;
+                if (loaded_si_->nchain > 0) {
+                    sym_count = loaded_si_->nchain;
+                } else {
+                    LOGD("Cannot determine symbol table size");
+                    return nullptr;
+                }
+
+                LOGD("Trying linear search with %zu symbols", sym_count);
+                for (size_t i = 0; i < sym_count; ++i) {
+                    ElfW(Sym)* sym = &loaded_si_->symtab[i];
+                    if (sym->st_name != 0 && sym->st_shndx != SHN_UNDEF) {
+                        const char* sym_name = loaded_si_->strtab + sym->st_name;
+                        if (strcmp(sym_name, name) == 0) {
+                            ElfW(Addr) addr = sym->st_value + loaded_si_->load_bias;
+                            LOGD("Found symbol %s via linear search: st_value=0x%llx, load_bias=0x%llx, final_addr=0x%llx",
+                                 name, (unsigned long long)sym->st_value, (unsigned long long)loaded_si_->load_bias, (unsigned long long)addr);
+
+                            if (addr >= loaded_si_->base && addr < loaded_si_->base + loaded_si_->size) {
+                                return reinterpret_cast<void*>(addr);
+                            } else {
+                                LOGE("Symbol %s address 0x%llx out of range [0x%llx, 0x%llx)",
+                                     name, (unsigned long long)addr, (unsigned long long)loaded_si_->base, (unsigned long long)(loaded_si_->base + loaded_si_->size));
+                            }
+                        }
+                    }
+                }
+                LOGD("Symbol %s not found via linear search", name);
+            }
+        }
+    } else {
+        LOGE("Symbol table is null");
+    }
+
+    LOGE("Symbol %s not found in any method", name);
+    return nullptr;
+}
--- a/module/src/main/cpp/mylinker/elf_reader.cpp
+++ b/module/src/main/cpp/mylinker/elf_reader.cpp
@@ -0,0 +1,149 @@
+#include "elf_reader.h"
+#include <sys/types.h>
+
+ElfReader::ElfReader() : fd_(-1), file_size_(0), file_offset_(0),
+                         mapped_file_(nullptr), phdr_table_(nullptr), phdr_num_(0) {
+    memset(&header_, 0, sizeof(header_));
+}
+
+ElfReader::~ElfReader() {
+    Close();
+}
+
+bool ElfReader::Open(const char* path) {
+    path_ = path;
+
+    struct stat sb;
+    fd_ = open(path, O_RDONLY | O_CLOEXEC);
+    if (fd_ < 0) {
+        LOGE("Cannot open %s: %s", path, strerror(errno));
+        return false;
+    }
+
+    if (fstat(fd_, &sb) < 0) {
+        LOGE("Cannot stat %s: %s", path, strerror(errno));
+        close(fd_);
+        fd_ = -1;
+        return false;
+    }
+
+    file_size_ = sb.st_size;
+
+    // 映射整个文件到内存
+    mapped_file_ = mmap(nullptr, file_size_, PROT_READ, MAP_PRIVATE, fd_, 0);
+    if (mapped_file_ == MAP_FAILED) {
+        LOGE("Cannot mmap %s: %s", path, strerror(errno));
+        close(fd_);
+        fd_ = -1;
+        return false;
+    }
+
+    return true;
+}
+
+bool ElfReader::Read() {
+    if (!ReadElfHeader()) {
+        return false;
+    }
+
+    if (!VerifyElfHeader()) {
+        return false;
+    }
+
+    if (!ReadProgramHeaders()) {
+        return false;
+    }
+
+    return true;
+}
+
+void ElfReader::Close() {
+    if (mapped_file_ != nullptr && mapped_file_ != MAP_FAILED) {
+        munmap(mapped_file_, file_size_);
+        mapped_file_ = nullptr;
+    }
+
+    if (fd_ >= 0) {
+        close(fd_);
+        fd_ = -1;
+    }
+
+    if (phdr_table_ != nullptr) {
+        free(phdr_table_);
+        phdr_table_ = nullptr;
+    }
+}
+
+bool ElfReader::ReadElfHeader() {
+    if (file_size_ < sizeof(ElfW(Ehdr))) {
+        LOGE("File too small for ELF header");
+        return false;
+    }
+
+    memcpy(&header_, mapped_file_, sizeof(header_));
+    return true;
+}
+
+bool ElfReader::VerifyElfHeader() {
+    if (memcmp(header_.e_ident, ELFMAG, SELFMAG) != 0) {
+        LOGE("Invalid ELF magic");
+        return false;
+    }
+
+    if (header_.e_ident[EI_CLASS] != ELFCLASS64) {
+        LOGE("Not a 64-bit ELF file");
+        return false;
+    }
+
+    if (header_.e_machine != EM_AARCH64) {
+        LOGE("Not an ARM64 ELF file");
+        return false;
+    }
+
+    if (header_.e_version != EV_CURRENT) {
+        LOGE("Invalid ELF version");
+        return false;
+    }
+
+    if (header_.e_type != ET_DYN) {
+        LOGE("Not a shared object");
+        return false;
+    }
+
+    LOGD("ELF Header: type=%d, machine=%d, entry=0x%llx, phoff=0x%llx, phnum=%d",
+         header_.e_type, header_.e_machine, (unsigned long long)header_.e_entry,
+         (unsigned long long)header_.e_phoff, header_.e_phnum);
+
+    return true;
+}
+
+bool ElfReader::ReadProgramHeaders() {
+    phdr_num_ = header_.e_phnum;
+
+    if (phdr_num_ == 0) {
+        LOGE("No program headers");
+        return false;
+    }
+
+    if (header_.e_phentsize != sizeof(ElfW(Phdr))) {
+        LOGE("Invalid program header size");
+        return false;
+    }
+
+    size_t size = phdr_num_ * sizeof(ElfW(Phdr));
+
+    if (header_.e_phoff + size > file_size_) {
+        LOGE("Program headers out of file bounds");
+        return false;
+    }
+
+    phdr_table_ = static_cast<ElfW(Phdr)*>(malloc(size));
+    if (phdr_table_ == nullptr) {
+        LOGE("Cannot allocate memory for program headers");
+        return false;
+    }
+
+    memcpy(phdr_table_, static_cast<char*>(mapped_file_) + header_.e_phoff, size);
+
+    return true;
+}
--- a/module/src/main/cpp/mylinker/include/common.h
+++ b/module/src/main/cpp/mylinker/include/common.h
@@ -0,0 +1,47 @@
+#pragma once
+
+#include <android/log.h>
+#include <elf.h>
+#include <link.h>
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <cerrno>
+#include <cstring>
+#include <cstdlib>
+#include <cstdio>
+#include <cstdint>
+
+#include <string>
+#include <vector>
+#include <unordered_map>
+#include <memory>
+
+#define LOG_TAG "CustomLinker"
+#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__)
+#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)
+#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)
+
+#if defined(__LP64__)
+#define ELFW(what) ELF64_ ## what
+#else
+#define ELFW(what) ELF32_ ## what
+#endif
+
+#define PAGE_SIZE 4096
+#define PAGE_MASK (~(PAGE_SIZE - 1))
+#define PAGE_START(addr) ((addr) & PAGE_MASK)
+#define PAGE_END(addr) PAGE_START((addr) + PAGE_SIZE - 1)
+#define PAGE_OFFSET(addr) ((addr) & (PAGE_SIZE - 1))
+
+// 权限标志转换
+#define PFLAGS_TO_PROT(x) (((x) & PF_R) ? PROT_READ : 0) | \
+                          (((x) & PF_W) ? PROT_WRITE : 0) | \
+                          (((x) & PF_X) ? PROT_EXEC : 0)
+
+struct soinfo;
+class ElfReader;
+class MemoryManager;
+class Relocator;
--- a/module/src/main/cpp/mylinker/include/elf_loader.h
+++ b/module/src/main/cpp/mylinker/include/elf_loader.h
@@ -0,0 +1,27 @@
+#pragma once
+
+#include "common.h"
+#include "elf_reader.h"
+#include "memory_manager.h"
+#include "soinfo_manager.h"
+#include "relocator.h"
+
+class ElfLoader {
+public:
+    ElfLoader();
+    ~ElfLoader();
+
+    bool LoadLibrary(const char* path);
+
+    void CallConstructors();
+
+    void* GetSymbol(const char* name);
+
+private:
+    std::unique_ptr<ElfReader> reader_;
+    std::unique_ptr<MemoryManager> memory_manager_;
+    std::unique_ptr<SoinfoManager> soinfo_manager_;
+    std::unique_ptr<Relocator> relocator_;
+
+    soinfo* loaded_si_;
+};
--- a/module/src/main/cpp/mylinker/include/elf_reader.h
+++ b/module/src/main/cpp/mylinker/include/elf_reader.h
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "common.h"
+
+class ElfReader {
+public:
+    ElfReader();
+    ~ElfReader();
+
+    bool Open(const char* path);
+    bool Read();
+    void Close();
+
+    const ElfW(Ehdr)* GetHeader() const { return &header_; }
+    const ElfW(Phdr)* GetProgramHeaders() const { return phdr_table_; }
+    size_t GetProgramHeaderCount() const { return phdr_num_; }
+
+    const char* GetPath() const { return path_.c_str(); }
+    int GetFd() const { return fd_; }
+    size_t GetFileSize() const { return file_size_; }
+    void* GetMappedAddr() const { return mapped_file_; }
+
+private:
+    bool ReadElfHeader();
+    bool ReadProgramHeaders();
+    bool VerifyElfHeader();
+
+    std::string path_;
+    int fd_;
+    size_t file_size_;
+    off64_t file_offset_;
+
+    void* mapped_file_; 
+
+    ElfW(Ehdr) header_;
+    ElfW(Phdr)* phdr_table_;
+    size_t phdr_num_;
+};
--- a/module/src/main/cpp/mylinker/include/memory_manager.h
+++ b/module/src/main/cpp/mylinker/include/memory_manager.h
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "common.h"
+
+class MemoryManager {
+public:
+    MemoryManager();
+    ~MemoryManager();
+
+    bool ReserveAddressSpace(const ElfW(Phdr)* phdr_table, size_t phdr_num);
+
+    bool LoadSegments(const ElfW(Phdr)* phdr_table, size_t phdr_num,
+                      void* mapped_file, size_t file_size);
+
+    bool FindPhdr(const ElfW(Phdr)* phdr_table, size_t phdr_num);
+
+    bool ProtectSegments(const ElfW(Phdr)* phdr_table, size_t phdr_num);
+
+    void* GetLoadStart() const { return load_start_; }
+    size_t GetLoadSize() const { return load_size_; }
+    ElfW(Addr) GetLoadBias() const { return load_bias_; }
+    const ElfW(Phdr)* GetLoadedPhdr() const { return loaded_phdr_; }
+
+private:
+    bool CheckPhdr(ElfW(Addr) loaded, const ElfW(Phdr)* phdr_table, size_t phdr_num);
+    size_t phdr_table_get_load_size(const ElfW(Phdr)* phdr_table,
+                                    size_t phdr_count,
+                                    ElfW(Addr)* min_vaddr);
+
+    void* load_start_;
+    size_t load_size_;
+    ElfW(Addr) load_bias_;
+    const ElfW(Phdr)* loaded_phdr_;
+};
--- a/module/src/main/cpp/mylinker/include/mylinker.h
+++ b/module/src/main/cpp/mylinker/include/mylinker.h
@@ -0,0 +1,17 @@
+#pragma once
+
+#include <jni.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+__attribute__((visibility("default"))) bool mylinker_load_library(const char* library_path, JavaVM* vm);
+
+__attribute__((visibility("default"))) void* mylinker_get_symbol(const char* library_path, const char* symbol_name);
+
+__attribute__((visibility("default"))) void mylinker_cleanup();
+
+#ifdef __cplusplus
+}
+#endif
--- a/module/src/main/cpp/mylinker/include/relocator.h
+++ b/module/src/main/cpp/mylinker/include/relocator.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include "common.h"
+#include "soinfo_manager.h"
+
+class Relocator {
+public:
+    Relocator();
+    ~Relocator();
+
+    bool RelocateImage(soinfo* si);
+
+    bool LinkImage(soinfo* si);
+
+    uint32_t gnu_hash(const char* name);
+    unsigned elf_hash(const char* name);
+
+    ElfW(Sym)* gnu_lookup(uint32_t hash, const char* name, soinfo* si);
+    ElfW(Sym)* elf_lookup(unsigned hash, const char* name, soinfo* si);
+
+private:
+    bool ProcessRelaRelocation(soinfo* si, const ElfW(Rela)* rela);
+
+    ElfW(Addr) FindSymbolAddress(const char* name, soinfo* si);
+};
--- a/module/src/main/cpp/mylinker/include/soinfo_manager.h
+++ b/module/src/main/cpp/mylinker/include/soinfo_manager.h
@@ -0,0 +1,75 @@
+#pragma once
+
+#include "common.h"
+
+// soinfo结构体定义(简化版)
+struct soinfo {
+    const char* name;
+    ElfW(Addr) base;
+    size_t size;
+    ElfW(Addr) load_bias;
+
+    const ElfW(Phdr)* phdr;
+    size_t phnum;
+
+    ElfW(Addr) entry;
+
+    // Dynamic段信息
+    ElfW(Dyn)* dynamic;
+    size_t dynamic_count;
+
+    // 符号表相关
+    const char* strtab;
+    ElfW(Sym)* symtab;
+    size_t nbucket;
+    size_t nchain;
+    uint32_t* bucket;
+    uint32_t* chain;
+
+    // 重定位相关
+    ElfW(Rela)* plt_rela;
+    size_t plt_rela_count;
+    ElfW(Rela)* rela;
+    size_t rela_count;
+
+    // GNU hash
+    size_t gnu_nbucket;
+    uint32_t* gnu_bucket;
+    uint32_t* gnu_chain;
+    uint32_t gnu_maskwords;
+    uint32_t gnu_shift2;
+    ElfW(Addr)* gnu_bloom_filter;
+
+    // 初始化函数
+    void (*init_func)();
+    void (**init_array)();
+    size_t init_array_count;
+    void (**fini_array)();
+    size_t fini_array_count;
+
+    // 依赖库
+    std::vector<std::string> needed_libs;
+
+    uint32_t flags;
+};
+
+class SoinfoManager {
+public:
+    SoinfoManager();
+    ~SoinfoManager();
+
+    soinfo* GetOrCreateSoinfo(const char* name);
+
+    bool UpdateSoinfo(soinfo* si, MemoryManager* mm, ElfReader* reader);
+
+    bool PrelinkImage(soinfo* si);
+
+    soinfo* FindSoinfo(const char* name);
+    soinfo* GetCurrentSoinfo();
+
+private:
+    bool ParseDynamic(soinfo* si);
+    void ApplyRelaSections(soinfo* si);
+
+    std::unordered_map<std::string, std::unique_ptr<soinfo>> soinfo_map_;
+};
--- a/module/src/main/cpp/mylinker/include/utils.h
+++ b/module/src/main/cpp/mylinker/include/utils.h
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "common.h"
+
+namespace Utils {
+    bool safe_add(off64_t* out, off64_t a, size_t b);
+
+    soinfo* get_soinfo(const char* so_name);
+
+    void* getMapData(int fd, off64_t base_offset, size_t elf_offset, size_t size);
+
+    ElfW(Addr) get_export_func(const char* path, const char* func_name);
+
+    inline size_t page_start(size_t addr) {
+        return addr & ~(PAGE_SIZE - 1);
+    }
+
+    inline size_t page_offset(size_t addr) {
+        return addr & (PAGE_SIZE - 1);
+    }
+}
--- a/module/src/main/cpp/mylinker/main.cpp
+++ b/module/src/main/cpp/mylinker/main.cpp
@@ -0,0 +1,49 @@
+#include "elf_loader.h"
+
+int (*yuuki_test_func) (int, int) = nullptr;
+
+int main(int argc, char* argv[]) {
+
+    if (argc < 2) {
+        printf("Usage: %s <so_file_path>\n", argv[0]);
+        return 1;
+    }
+
+    LOGI("Starting custom linker for: %s", argv[1]);
+
+    // 检查文件是否存在
+    if (access(argv[1], F_OK) != 0) {
+        LOGE("File does not exist: %s", argv[1]);
+        return 1;
+    }
+
+    if (access(argv[1], R_OK) != 0) {
+        LOGE("File is not readable: %s", argv[1]);
+        return 1;
+    }
+
+    ElfLoader loader;
+    if (loader.LoadLibrary(argv[1])) {
+        printf("Successfully loaded %s\n", argv[1]);
+
+        void* test_func = loader.GetSymbol("yuuki_test");
+        if (test_func) {
+            printf("Found yuuki_test function at %p\n", test_func);
+            yuuki_test_func = (int (*)(int, int)) test_func;
+
+            // 测试函数调用
+            printf("Testing function call: 1 + 1 = %d\n", yuuki_test_func(1, 1));
+            printf("Testing function call: 5 + 3 = %d\n", yuuki_test_func(5, 3));
+        } else {
+            printf("Failed to find yuuki_test function\n");
+        }
+
+        return 0;
+    } else {
+        printf("Failed to load %s\n", argv[1]);
+        return 1;
+    }
+}
+// logcat | grep "CustomLinker"
+// logcat | grep "TEST_SO"
+// ./data/local/tmp/elf_loader /storage/emulated/0/yuuki/test.so
--- a/module/src/main/cpp/mylinker/memory_manager.cpp
+++ b/module/src/main/cpp/mylinker/memory_manager.cpp
@@ -0,0 +1,241 @@
+#include "memory_manager.h"
+
+MemoryManager::MemoryManager() : load_start_(nullptr), load_size_(0),
+                                 load_bias_(0), loaded_phdr_(nullptr) {
+}
+
+MemoryManager::~MemoryManager() {
+}
+
+bool MemoryManager::ReserveAddressSpace(const ElfW(Phdr)* phdr_table, size_t phdr_num) {
+    ElfW(Addr) min_vaddr;
+    load_size_ = phdr_table_get_load_size(phdr_table, phdr_num, &min_vaddr);
+
+    if (load_size_ == 0) {
+        LOGE("No loadable segments");
+        return false;
+    }
+
+    LOGD("Load size: 0x%zx, min_vaddr: 0x%llx", load_size_, (unsigned long long)min_vaddr);
+
+    void* start = mmap(nullptr, load_size_, PROT_NONE,
+                       MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    if (start == MAP_FAILED) {
+        LOGE("Cannot reserve %zu bytes: %s", load_size_, strerror(errno));
+        return false;
+    }
+
+    load_start_ = start;
+    load_bias_ = reinterpret_cast<ElfW(Addr)>(start) - min_vaddr;
+
+    LOGD("Reserved address space at %p, bias: 0x%llx", start, (unsigned long long)load_bias_);
+
+    return true;
+}
+
+bool MemoryManager::LoadSegments(const ElfW(Phdr)* phdr_table, size_t phdr_num,
+                                 void* mapped_file, size_t file_size) {
+    LOGD("Starting LoadSegments: phdr_num=%zu, file_size=%zu", phdr_num, file_size);
+
+    for (size_t i = 0; i < phdr_num; ++i) {
+        const ElfW(Phdr)* phdr = &phdr_table[i];
+
+        if (phdr->p_type != PT_LOAD) {
+            continue;
+        }
+
+        LOGD("Processing LOAD segment %zu: vaddr=0x%llx, memsz=0x%llx, filesz=0x%llx, offset=0x%llx",
+             i, (unsigned long long)phdr->p_vaddr, (unsigned long long)phdr->p_memsz, 
+             (unsigned long long)phdr->p_filesz, (unsigned long long)phdr->p_offset);
+
+        ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
+        ElfW(Addr) seg_end = seg_start + phdr->p_memsz;
+
+        ElfW(Addr) seg_page_start = PAGE_START(seg_start);
+        ElfW(Addr) seg_page_end = PAGE_END(seg_end);
+
+        ElfW(Addr) seg_file_end = seg_start + phdr->p_filesz;
+
+        ElfW(Addr) file_start = phdr->p_offset;
+        ElfW(Addr) file_end = file_start + phdr->p_filesz;
+
+        ElfW(Addr) file_page_start = PAGE_START(file_start);
+
+        if (file_end > file_size) {
+            LOGE("Invalid file size: file_end=0x%llx > file_size=0x%zx", (unsigned long long)file_end, file_size);
+            return false;
+        }
+
+        if (phdr->p_filesz > 0) {
+            void* seg_addr = reinterpret_cast<void*>(seg_page_start);
+            size_t seg_size = seg_page_end - seg_page_start;
+
+            if (mprotect(seg_addr, seg_size, PROT_READ | PROT_WRITE) < 0) {
+                LOGE("Cannot mprotect for loading: %s", strerror(errno));
+                return false;
+            }
+
+            void* src = static_cast<char*>(mapped_file) + phdr->p_offset;
+            void* dst = reinterpret_cast<void*>(seg_start);
+
+            LOGD("Copying segment %zu: src=%p (offset=0x%llx), dst=%p, size=0x%llx",
+                 i, src, (unsigned long long)phdr->p_offset, dst, (unsigned long long)phdr->p_filesz);
+
+            if (static_cast<char*>(src) + phdr->p_filesz > static_cast<char*>(mapped_file) + file_size) {
+                LOGE("Source copy would exceed file bounds");
+                return false;
+            }
+
+            if (reinterpret_cast<ElfW(Addr)>(dst) + phdr->p_filesz > seg_page_end) {
+                LOGE("Destination copy would exceed segment bounds");
+                return false;
+            }
+
+            memcpy(dst, src, phdr->p_filesz);
+
+            LOGD("Successfully copied segment %zu", i);
+        }
+
+        if (phdr->p_memsz > phdr->p_filesz) {
+            ElfW(Addr) bss_start = seg_start + phdr->p_filesz;
+            ElfW(Addr) bss_end = seg_start + phdr->p_memsz;
+            size_t bss_size = bss_end - bss_start;
+
+            LOGD("Zeroing BSS: start=0x%llx, size=0x%zx", (unsigned long long)bss_start, bss_size);
+            memset(reinterpret_cast<void*>(bss_start), 0, bss_size);
+        }
+
+        ElfW(Addr) aligned_file_end = PAGE_END(seg_file_end);
+        if (seg_page_end > aligned_file_end) {
+            size_t zeromap_size = seg_page_end - aligned_file_end;
+            void* zeromap = mmap(reinterpret_cast<void*>(aligned_file_end),
+                                 zeromap_size,
+                                 PROT_READ | PROT_WRITE,  
+                                 MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE,
+                                 -1, 0);
+            if (zeromap == MAP_FAILED) {
+                LOGE("Cannot zero fill gap: %s", strerror(errno));
+                return false;
+            }
+            LOGD("Zero-filled gap: addr=%p, size=0x%zx", zeromap, zeromap_size);
+        }
+    }
+
+    LOGD("LoadSegments complete");
+    return true;
+}
+
+bool MemoryManager::FindPhdr(const ElfW(Phdr)* phdr_table, size_t phdr_num) {
+    const ElfW(Phdr)* phdr_limit = phdr_table + phdr_num;
+
+    for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_limit; ++phdr) {
+        if (phdr->p_type == PT_PHDR) {
+            return CheckPhdr(load_bias_ + phdr->p_vaddr, phdr_table, phdr_num);
+        }
+    }
+
+    for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_limit; ++phdr) {
+        if (phdr->p_type == PT_LOAD) {
+            if (phdr->p_offset == 0) {
+                ElfW(Addr) elf_addr = load_bias_ + phdr->p_vaddr;
+                const ElfW(Ehdr)* ehdr = reinterpret_cast<const ElfW(Ehdr)*>(elf_addr);
+                ElfW(Addr) offset = ehdr->e_phoff;
+                return CheckPhdr(reinterpret_cast<ElfW(Addr)>(ehdr) + offset, phdr_table, phdr_num);
+            }
+            break;
+        }
+    }
+
+    LOGD("Using original phdr_table as loaded_phdr");
+    loaded_phdr_ = phdr_table;
+    return true;
+}
+
+bool MemoryManager::ProtectSegments(const ElfW(Phdr)* phdr_table, size_t phdr_num) {
+    for (size_t i = 0; i < phdr_num; ++i) {
+        const ElfW(Phdr)* phdr = &phdr_table[i];
+
+        if (phdr->p_type != PT_LOAD) {
+            continue;
+        }
+
+        ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
+        ElfW(Addr) seg_page_start = PAGE_START(seg_start);
+        ElfW(Addr) seg_page_end = PAGE_END(seg_start + phdr->p_memsz);
+
+        int prot = PFLAGS_TO_PROT(phdr->p_flags);
+
+        if (mprotect(reinterpret_cast<void*>(seg_page_start),
+                     seg_page_end - seg_page_start, prot) < 0) {
+            LOGE("Cannot protect segment %zu: %s", i, strerror(errno));
+            return false;
+        }
+
+        LOGD("Protected segment %zu: 0x%llx-0x%llx, prot: %d",
+             i, (unsigned long long)seg_page_start, (unsigned long long)seg_page_end, prot);
+    }
+
+    return true;
+}
+
+bool MemoryManager::CheckPhdr(ElfW(Addr) loaded, const ElfW(Phdr)* phdr_table, size_t phdr_num) {
+    const ElfW(Phdr)* phdr_limit = phdr_table + phdr_num;
+    ElfW(Addr) loaded_end = loaded + (phdr_num * sizeof(ElfW(Phdr)));
+
+    for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_limit; ++phdr) {
+        if (phdr->p_type != PT_LOAD) {
+            continue;
+        }
+
+        ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
+        ElfW(Addr) seg_end = phdr->p_filesz + seg_start;
+
+        if (seg_start <= loaded && loaded_end <= seg_end) {
+            loaded_phdr_ = reinterpret_cast<const ElfW(Phdr)*>(loaded);
+            return true;
+        }
+    }
+
+    LOGE("Loaded phdr %p not in loadable segment", reinterpret_cast<void*>(loaded));
+    return false;
+}
+
+size_t MemoryManager::phdr_table_get_load_size(const ElfW(Phdr)* phdr_table,
+                                               size_t phdr_count,
+                                               ElfW(Addr)* min_vaddr) {
+    ElfW(Addr) min_addr = UINTPTR_MAX;
+    ElfW(Addr) max_addr = 0;
+
+    bool found_pt_load = false;
+
+    for (size_t i = 0; i < phdr_count; ++i) {
+        const ElfW(Phdr)* phdr = &phdr_table[i];
+
+        if (phdr->p_type != PT_LOAD) {
+            continue;
+        }
+
+        found_pt_load = true;
+
+        if (phdr->p_vaddr < min_addr) {
+            min_addr = phdr->p_vaddr;
+        }
+
+        if (phdr->p_vaddr + phdr->p_memsz > max_addr) {
+            max_addr = phdr->p_vaddr + phdr->p_memsz;
+        }
+    }
+
+    if (!found_pt_load) {
+        return 0;
+    }
+
+    min_addr = PAGE_START(min_addr);
+    max_addr = PAGE_END(max_addr);
+
+    if (min_vaddr != nullptr) {
+        *min_vaddr = min_addr;
+    }
+
+    return max_addr - min_addr;
+}
--- a/module/src/main/cpp/mylinker/mylinker.cpp
+++ b/module/src/main/cpp/mylinker/mylinker.cpp
@@ -0,0 +1,61 @@
+#include "mylinker.h"
+#include "elf_loader.h"
+#include "common.h"
+#include <unordered_map>
+#include <memory>
+#include <string>
+
+static std::unordered_map<std::string, std::unique_ptr<ElfLoader>> loaded_libraries;
+
+bool mylinker_load_library(const char* library_path, JavaVM* vm) {
+    if (!library_path) {
+        LOGE("Invalid library path");
+        return false;
+    }
+
+    std::string path(library_path);
+    
+    if (loaded_libraries.find(path) != loaded_libraries.end()) {
+        LOGI("Library already loaded: %s", library_path);
+        return true;
+    }
+
+    auto loader = std::make_unique<ElfLoader>();
+    if (!loader->LoadLibrary(library_path)) {
+        LOGE("Failed to load library: %s", library_path);
+        return false;
+    }
+
+    JNIEnv* env = nullptr;
+    if (vm && vm->GetEnv((void**)&env, JNI_VERSION_1_6) == JNI_OK) {
+        typedef jint (*JNI_OnLoad_t)(JavaVM*, void*);
+        auto jni_onload = reinterpret_cast<JNI_OnLoad_t>(loader->GetSymbol("JNI_OnLoad"));
+        if (jni_onload) {
+            LOGI("Calling JNI_OnLoad");
+            jni_onload(vm, nullptr);
+        }
+    }
+
+    loaded_libraries[path] = std::move(loader);
+    LOGI("Successfully loaded library: %s", library_path);
+    return true;
+}
+
+void* mylinker_get_symbol(const char* library_path, const char* symbol_name) {
+    if (!library_path || !symbol_name) {
+        return nullptr;
+    }
+
+    auto it = loaded_libraries.find(library_path);
+    if (it == loaded_libraries.end()) {
+        LOGE("Library not loaded: %s", library_path);
+        return nullptr;
+    }
+
+    return it->second->GetSymbol(symbol_name);
+}
+
+void mylinker_cleanup() {
+    loaded_libraries.clear();
+    LOGI("Cleaned up all loaded libraries");
+}
--- a/module/src/main/cpp/mylinker/relocator.cpp
+++ b/module/src/main/cpp/mylinker/relocator.cpp
@@ -0,0 +1,342 @@
+#include "relocator.h"
+
+// Only define if not already defined
+#ifndef R_AARCH64_NONE
+#define R_AARCH64_NONE            0
+#endif
+#ifndef R_AARCH64_ABS64
+#define R_AARCH64_ABS64         257
+#endif
+#ifndef R_AARCH64_GLOB_DAT
+#define R_AARCH64_GLOB_DAT      1025
+#endif
+#ifndef R_AARCH64_JUMP_SLOT
+#define R_AARCH64_JUMP_SLOT     1026
+#endif
+#ifndef R_AARCH64_RELATIVE
+#define R_AARCH64_RELATIVE      1027
+#endif
+#ifndef R_AARCH64_TLS_TPREL64
+#define R_AARCH64_TLS_TPREL64   1030
+#endif
+#ifndef R_AARCH64_TLS_DTPREL32
+#define R_AARCH64_TLS_DTPREL32  1031
+#endif
+#ifndef R_AARCH64_IRELATIVE
+#define R_AARCH64_IRELATIVE     1032
+#endif
+
+Relocator::Relocator() {
+}
+
+Relocator::~Relocator() {
+}
+
+bool Relocator::RelocateImage(soinfo* si) {
+    LOGD("Starting relocation for %s", si->name);
+
+    if (!si) {
+        LOGE("soinfo is null");
+        return false;
+    }
+
+    if (si->rela != nullptr && si->rela_count > 0) {
+        LOGD("Processing %zu RELA relocations", si->rela_count);
+
+        if (si->rela_count > 100000) {
+            LOGE("RELA count too large: %zu", si->rela_count);
+            return false;
+        }
+
+        for (size_t i = 0; i < si->rela_count; ++i) {
+            if (!ProcessRelaRelocation(si, &si->rela[i])) {
+                LOGE("Failed to process RELA relocation %zu", i);
+                // 继续处理其他重定位，不要因为一个失败就退出
+                // return false;
+            }
+        }
+    } else {
+        LOGD("No RELA relocations to process");
+    }
+
+    if (si->plt_rela != nullptr && si->plt_rela_count > 0) {
+        LOGD("Processing %zu PLT RELA relocations", si->plt_rela_count);
+
+        if (si->plt_rela_count > 10000) {
+            LOGE("PLT RELA count too large: %zu", si->plt_rela_count);
+            return false;
+        }
+
+        for (size_t i = 0; i < si->plt_rela_count; ++i) {
+            if (!ProcessRelaRelocation(si, &si->plt_rela[i])) {
+                LOGE("Failed to process PLT RELA relocation %zu", i);
+                // 继续处理其他重定位
+                // return false;
+            }
+        }
+    } else {
+        LOGD("No PLT RELA relocations to process");
+    }
+
+    LOGD("Relocation complete for %s", si->name);
+    return true;
+}
+
+bool Relocator::LinkImage(soinfo* si) {
+    if (!si) {
+        LOGE("soinfo is null in LinkImage");
+        return false;
+    }
+
+    if (!RelocateImage(si)) {
+        LOGE("Failed to relocate image");
+        return false;
+    }
+
+    if (si->init_func != nullptr) {
+        LOGD("Calling init function at %p", si->init_func);
+        si->init_func();
+    }
+
+    if (si->init_array != nullptr && si->init_array_count > 0) {
+        LOGD("Calling %zu init_array functions", si->init_array_count);
+
+        if (si->init_array_count > 1000) {
+            LOGE("init_array_count too large: %zu", si->init_array_count);
+            return false;
+        }
+
+        for (size_t i = 0; i < si->init_array_count; ++i) {
+            void (*func)() = si->init_array[i];
+            if (func != nullptr) {
+                LOGD("Calling init_array[%zu] at %p", i, func);
+                func();
+            }
+        }
+    }
+
+    return true;
+}
+
+bool Relocator::ProcessRelaRelocation(soinfo* si, const ElfW(Rela)* rela) {
+    if (!si || !rela) {
+        LOGE("Invalid parameters in ProcessRelaRelocation");
+        return false;
+    }
+
+    ElfW(Addr) reloc = static_cast<ElfW(Addr)>(rela->r_offset + si->load_bias);
+    ElfW(Word) type = ELFW(R_TYPE)(rela->r_info);
+    ElfW(Word) sym = ELFW(R_SYM)(rela->r_info);
+
+    LOGD("Processing relocation: offset=0x%llx, type=%d, sym=%d, addend=0x%llx",
+         (unsigned long long)rela->r_offset, type, sym, (long long)rela->r_addend);
+
+    if (reloc < si->base || reloc >= si->base + si->size) {
+        LOGE("Relocation address 0x%llx out of range [0x%llx, 0x%llx)",
+             (unsigned long long)reloc, (unsigned long long)si->base, (unsigned long long)(si->base + si->size));
+        return false;
+    }
+
+    ElfW(Addr) sym_addr = 0;
+    const char* sym_name = nullptr;
+
+    if (sym != 0) {
+        if (!si->symtab) {
+            LOGE("Symbol table is null");
+            return false;
+        }
+
+        const ElfW(Sym)* s = &si->symtab[sym];
+
+        if (si->strtab && s->st_name != 0) {
+            sym_name = si->strtab + s->st_name;
+            LOGD("Symbol name: %s", sym_name);
+        }
+
+        if (s->st_shndx != SHN_UNDEF) {
+            sym_addr = s->st_value + si->load_bias;
+            LOGD("Local symbol: addr=0x%llx", (unsigned long long)sym_addr);
+        } else if (sym_name) {
+            sym_addr = FindSymbolAddress(sym_name, si);
+            if (sym_addr == 0) {
+                LOGD("Cannot find symbol: %s (may be optional)", sym_name);
+            }
+        }
+    }
+
+    void* page_start = reinterpret_cast<void*>(PAGE_START(reloc));
+    size_t page_size = PAGE_SIZE;
+
+    int old_prot = PROT_READ | PROT_WRITE;
+    if (mprotect(page_start, page_size, old_prot) != 0) {
+        LOGD("mprotect failed for relocation, trying anyway: %s", strerror(errno));
+    }
+
+    switch (type) {
+        case R_AARCH64_NONE:
+            LOGD("R_AARCH64_NONE");
+            break;
+
+        case R_AARCH64_ABS64:
+            LOGD("R_AARCH64_ABS64: writing 0x%llx to 0x%llx", 
+                 (unsigned long long)(sym_addr + rela->r_addend), (unsigned long long)reloc);
+            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+            break;
+
+        case R_AARCH64_GLOB_DAT:
+            LOGD("R_AARCH64_GLOB_DAT: writing 0x%llx to 0x%llx", 
+                 (unsigned long long)(sym_addr + rela->r_addend), (unsigned long long)reloc);
+            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+            break;
+
+        case R_AARCH64_JUMP_SLOT:
+            LOGD("R_AARCH64_JUMP_SLOT: writing 0x%llx to 0x%llx", 
+                 (unsigned long long)(sym_addr + rela->r_addend), (unsigned long long)reloc);
+            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+            break;
+
+        case R_AARCH64_RELATIVE:
+            LOGD("R_AARCH64_RELATIVE: writing 0x%llx to 0x%llx", 
+                 (unsigned long long)(si->load_bias + rela->r_addend), (unsigned long long)reloc);
+            *reinterpret_cast<ElfW(Addr)*>(reloc) = si->load_bias + rela->r_addend;
+            break;
+
+        case R_AARCH64_IRELATIVE:
+        {
+            ElfW(Addr) resolver = si->load_bias + rela->r_addend;
+            LOGD("R_AARCH64_IRELATIVE: resolver at 0x%llx", (unsigned long long)resolver);
+
+            if (resolver < si->base || resolver >= si->base + si->size) {
+                LOGE("Invalid resolver address: 0x%llx", (unsigned long long)resolver);
+                return false;
+            }
+
+            ElfW(Addr) resolved = ((ElfW(Addr) (*)())resolver)();
+            *reinterpret_cast<ElfW(Addr)*>(reloc) = resolved;
+            LOGD("R_AARCH64_IRELATIVE: resolved to 0x%llx", (unsigned long long)resolved);
+        }
+            break;
+
+        default:
+            LOGD("Unknown relocation type %d, skipping", type);
+            break;
+    }
+
+    return true;
+}
+
+ElfW(Addr) Relocator::FindSymbolAddress(const char* name, soinfo* si) {
+    if (!name || !si) {
+        return 0;
+    }
+
+    if (si->symtab != nullptr) {
+        if (si->gnu_bucket != nullptr) {
+            uint32_t hash = gnu_hash(name);
+            ElfW(Sym)* sym = gnu_lookup(hash, name, si);
+            if (sym != nullptr && sym->st_shndx != SHN_UNDEF) {
+                ElfW(Addr) addr = sym->st_value + si->load_bias;
+                LOGD("Found symbol %s in current SO at 0x%llx", name, (unsigned long long)addr);
+                return addr;
+            }
+        }
+
+        if (si->bucket != nullptr) {
+            unsigned hash = elf_hash(name);
+            ElfW(Sym)* sym = elf_lookup(hash, name, si);
+            if (sym != nullptr && sym->st_shndx != SHN_UNDEF) {
+                ElfW(Addr) addr = sym->st_value + si->load_bias;
+                LOGD("Found symbol %s in current SO at 0x%llx", name, (unsigned long long)addr);
+                return addr;
+            }
+        }
+    }
+
+    for (const auto& lib : si->needed_libs) {
+        void* handle = dlopen(lib.c_str(), RTLD_NOW | RTLD_NOLOAD);
+        if (handle != nullptr) {
+            void* addr = dlsym(handle, name);
+            if (addr != nullptr) {
+                LOGD("Found symbol %s in %s at %p", name, lib.c_str(), addr);
+                dlclose(handle);
+                return reinterpret_cast<ElfW(Addr)>(addr);
+            }
+            dlclose(handle);
+        }
+    }
+
+    void* addr = dlsym(RTLD_DEFAULT, name);
+    if (addr != nullptr) {
+        LOGD("Found symbol %s globally at %p", name, addr);
+        return reinterpret_cast<ElfW(Addr)>(addr);
+    }
+
+    LOGD("Symbol %s not found", name);
+    return 0;
+}
+
+ElfW(Sym)* Relocator::gnu_lookup(uint32_t hash, const char* name, soinfo* si) {
+    if (!si->gnu_bucket || !si->gnu_chain || !si->symtab || !si->strtab) {
+        return nullptr;
+    }
+
+    uint32_t h2 = hash >> si->gnu_shift2;
+
+    uint32_t bloom_mask_bits = sizeof(ElfW(Addr)) * 8;
+    uint32_t word_num = (hash / bloom_mask_bits) & si->gnu_maskwords;
+    ElfW(Addr) bloom_word = si->gnu_bloom_filter[word_num];
+
+    if ((1 & (bloom_word >> (hash % bloom_mask_bits)) &
+         (bloom_word >> (h2 % bloom_mask_bits))) == 0) {
+        return nullptr;
+    }
+
+    uint32_t n = si->gnu_bucket[hash % si->gnu_nbucket];
+
+    if (n == 0) {
+        return nullptr;
+    }
+
+    do {
+        ElfW(Sym)* s = si->symtab + n;
+        if (((si->gnu_chain[n] ^ hash) >> 1) == 0 &&
+            strcmp(si->strtab + s->st_name, name) == 0) {
+            return s;
+        }
+    } while ((si->gnu_chain[n++] & 1) == 0);
+
+    return nullptr;
+}
+
+ElfW(Sym)* Relocator::elf_lookup(unsigned hash, const char* name, soinfo* si) {
+    if (!si->bucket || !si->chain || !si->symtab || !si->strtab) {
+        return nullptr;
+    }
+
+    for (unsigned n = si->bucket[hash % si->nbucket]; n != 0; n = si->chain[n]) {
+        ElfW(Sym)* s = si->symtab + n;
+        if (s->st_name != 0 && strcmp(si->strtab + s->st_name, name) == 0) {
+            return s;
+        }
+    }
+    return nullptr;
+}
+
+uint32_t Relocator::gnu_hash(const char* name) {
+    uint32_t h = 5381;
+    for (const uint8_t* c = reinterpret_cast<const uint8_t*>(name); *c != '\0'; c++) {
+        h += (h << 5) + *c;
+    }
+    return h;
+}
+
+unsigned Relocator::elf_hash(const char* name) {
+    unsigned h = 0, g;
+    for (const unsigned char* p = reinterpret_cast<const unsigned char*>(name); *p; p++) {
+        h = (h << 4) + *p;
+        g = h & 0xf0000000;
+        h ^= g;
+        h ^= g >> 24;
+    }
+    return h;
+}
--- a/module/src/main/cpp/mylinker/soinfo_manager.cpp
+++ b/module/src/main/cpp/mylinker/soinfo_manager.cpp
@@ -0,0 +1,312 @@
+#include "soinfo_manager.h"
+#include "utils.h"
+#include "memory_manager.h"
+#include "elf_reader.h"
+
+SoinfoManager::SoinfoManager() {
+}
+
+SoinfoManager::~SoinfoManager() {
+}
+
+soinfo* SoinfoManager::GetOrCreateSoinfo(const char* name) {
+    auto it = soinfo_map_.find(name);
+    if (it != soinfo_map_.end()) {
+        return it->second.get();
+    }
+
+    auto si = std::make_unique<soinfo>();
+    memset(si.get(), 0, sizeof(soinfo));
+    si->name = strdup(name);
+
+    soinfo* result = si.get();
+    soinfo_map_[name] = std::move(si);
+
+    return result;
+}
+
+bool SoinfoManager::UpdateSoinfo(soinfo* si, MemoryManager* mm, ElfReader* reader) {
+    if (!si || !mm || !reader) {
+        return false;
+    }
+
+    si->base = reinterpret_cast<ElfW(Addr)>(mm->GetLoadStart());
+    si->size = mm->GetLoadSize();
+    si->load_bias = mm->GetLoadBias();
+
+    const ElfW(Phdr)* loaded_phdr = mm->GetLoadedPhdr();
+    if (loaded_phdr != nullptr) {
+        si->phdr = loaded_phdr;
+    } else {
+        si->phdr = reader->GetProgramHeaders();
+        LOGD("Using original program headers");
+    }
+
+    si->phnum = reader->GetProgramHeaderCount();
+
+    const ElfW(Ehdr)* header = reader->GetHeader();
+    si->entry = si->load_bias + header->e_entry;
+
+    LOGD("Updated soinfo: base=0x%llx, size=0x%zx, bias=0x%llx, entry=0x%llx, phdr=%p",
+         (unsigned long long)si->base, si->size, (unsigned long long)si->load_bias, 
+         (unsigned long long)si->entry, si->phdr);
+
+    return true;
+}
+
+bool SoinfoManager::PrelinkImage(soinfo* si) {
+    LOGD("Starting PrelinkImage for %s", si->name);
+
+    if (!ParseDynamic(si)) {
+        LOGE("Failed to parse dynamic section");
+        return false;
+    }
+
+    if (si->strtab != nullptr && si->dynamic != nullptr) {
+        for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
+            if (d->d_tag == DT_NEEDED && si->needed_libs.empty()) {
+                const char* needed = si->strtab + d->d_un.d_val;
+                si->needed_libs.push_back(needed);
+                LOGD("Processing deferred DT_NEEDED: %s", needed);
+            }
+        }
+    }
+
+    ApplyRelaSections(si);
+
+    LOGD("PrelinkImage complete for %s", si->name);
+    return true;
+}
+
+soinfo* SoinfoManager::FindSoinfo(const char* name) {
+    auto it = soinfo_map_.find(name);
+    if (it != soinfo_map_.end()) {
+        return it->second.get();
+    }
+    return nullptr;
+}
+
+soinfo* SoinfoManager::GetCurrentSoinfo() {
+    return Utils::get_soinfo("libcustom_linker.so");
+}
+
+bool SoinfoManager::ParseDynamic(soinfo* si) {
+    if (!si || !si->phdr) {
+        LOGE("Invalid soinfo or phdr is null");
+        return false;
+    }
+
+    LOGD("Starting ParseDynamic: phdr=%p, phnum=%zu", si->phdr, si->phnum);
+
+    const ElfW(Phdr)* phdr_limit = si->phdr + si->phnum;
+    bool found_dynamic = false;
+
+    for (const ElfW(Phdr)* phdr = si->phdr; phdr < phdr_limit; ++phdr) {
+        if (phdr->p_type == PT_DYNAMIC) {
+            si->dynamic = reinterpret_cast<ElfW(Dyn)*>(si->load_bias + phdr->p_vaddr);
+            si->dynamic_count = phdr->p_memsz / sizeof(ElfW(Dyn));
+            found_dynamic = true;
+            LOGD("Found PT_DYNAMIC at vaddr=0x%llx, memsz=0x%llx", 
+                 (unsigned long long)phdr->p_vaddr, (unsigned long long)phdr->p_memsz);
+            break;
+        }
+    }
+
+    if (!found_dynamic || !si->dynamic) {
+        LOGE("No PT_DYNAMIC segment found");
+        return false;
+    }
+
+    LOGD("Dynamic section at %p, count=%zu", si->dynamic, si->dynamic_count);
+
+    if (si->dynamic_count == 0 || si->dynamic_count > 1000) {
+        LOGE("Invalid dynamic count: %zu", si->dynamic_count);
+        return false;
+    }
+
+    size_t dyn_count = 0;
+    for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL && dyn_count < si->dynamic_count; ++d, ++dyn_count) {
+
+        LOGD("Processing dynamic entry %zu: tag=0x%llx, val/ptr=0x%llx",
+             dyn_count, (unsigned long long)d->d_tag, (unsigned long long)d->d_un.d_val);
+
+        switch (d->d_tag) {
+            case DT_SYMTAB:
+                si->symtab = reinterpret_cast<ElfW(Sym)*>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_SYMTAB: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->symtab);
+                break;
+
+            case DT_STRTAB:
+                si->strtab = reinterpret_cast<const char*>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_STRTAB: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->strtab);
+                break;
+
+            case DT_STRSZ:
+                LOGD("DT_STRSZ: %lu", (unsigned long)d->d_un.d_val);
+                break;
+
+            case DT_HASH: {
+                uint32_t* hash = reinterpret_cast<uint32_t*>(si->load_bias + d->d_un.d_ptr);
+                si->nbucket = hash[0];
+                si->nchain = hash[1];
+                si->bucket = hash + 2;
+                si->chain = si->bucket + si->nbucket;
+                LOGD("DT_HASH: raw_ptr=0x%llx, nbucket=%zu, nchain=%zu",
+                     (unsigned long long)d->d_un.d_ptr, si->nbucket, si->nchain);
+                break;
+            }
+
+            case DT_GNU_HASH: {
+                uint32_t* hash = reinterpret_cast<uint32_t*>(si->load_bias + d->d_un.d_ptr);
+                si->gnu_nbucket = hash[0];
+                uint32_t symbias = hash[1];
+                si->gnu_maskwords = hash[2];
+                si->gnu_shift2 = hash[3];
+                si->gnu_bloom_filter = reinterpret_cast<ElfW(Addr)*>(hash + 4);
+                si->gnu_bucket = reinterpret_cast<uint32_t*>(si->gnu_bloom_filter + si->gnu_maskwords);
+                si->gnu_chain = si->gnu_bucket + si->gnu_nbucket - symbias;
+                LOGD("DT_GNU_HASH: raw_ptr=0x%llx, nbucket=%zu, symbias=%u",
+                     (unsigned long long)d->d_un.d_ptr, si->gnu_nbucket, symbias);
+                break;
+            }
+
+            case DT_JMPREL:
+                si->plt_rela = reinterpret_cast<ElfW(Rela)*>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_JMPREL: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->plt_rela);
+                break;
+
+            case DT_PLTRELSZ:
+                si->plt_rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
+                LOGD("DT_PLTRELSZ: raw_val=%lu, count=%zu",
+                     (unsigned long)d->d_un.d_val, si->plt_rela_count);
+                break;
+
+            case DT_PLTREL:
+                LOGD("DT_PLTREL: %lu", (unsigned long)d->d_un.d_val);
+                break;
+
+            case DT_RELA:
+                si->rela = reinterpret_cast<ElfW(Rela)*>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_RELA: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->rela);
+                break;
+
+            case DT_RELASZ:
+                si->rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
+                LOGD("DT_RELASZ: raw_val=%lu, count=%zu",
+                     (unsigned long)d->d_un.d_val, si->rela_count);
+                break;
+
+            case DT_RELAENT:
+                LOGD("DT_RELAENT: %lu", (unsigned long)d->d_un.d_val);
+                break;
+
+            case DT_INIT:
+                si->init_func = reinterpret_cast<void (*)()>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_INIT: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->init_func);
+                break;
+
+            case DT_INIT_ARRAY:
+                si->init_array = reinterpret_cast<void (**)()>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_INIT_ARRAY: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->init_array);
+                break;
+
+            case DT_INIT_ARRAYSZ:
+                si->init_array_count = d->d_un.d_val / sizeof(void*);
+                LOGD("DT_INIT_ARRAYSZ: raw_val=%lu, count=%zu",
+                     (unsigned long)d->d_un.d_val, si->init_array_count);
+                break;
+
+            case DT_FINI:
+                LOGD("DT_FINI: 0x%llx", (unsigned long long)d->d_un.d_ptr);
+                break;
+
+            case DT_FINI_ARRAY:
+                si->fini_array = reinterpret_cast<void (**)()>(si->load_bias + d->d_un.d_ptr);
+                LOGD("DT_FINI_ARRAY: raw_ptr=0x%llx, final_addr=%p",
+                     (unsigned long long)d->d_un.d_ptr, si->fini_array);
+                break;
+
+            case DT_FINI_ARRAYSZ:
+                si->fini_array_count = d->d_un.d_val / sizeof(void*);
+                LOGD("DT_FINI_ARRAYSZ: raw_val=%lu, count=%zu",
+                     (unsigned long)d->d_un.d_val, si->fini_array_count);
+                break;
+
+            case DT_FLAGS:
+                si->flags = d->d_un.d_val;
+                LOGD("DT_FLAGS: 0x%x", si->flags);
+                break;
+
+            case DT_FLAGS_1:
+                LOGD("DT_FLAGS_1: 0x%llx", (unsigned long long)d->d_un.d_val);
+                break;
+
+            case DT_SONAME:
+                LOGD("DT_SONAME: offset=%lu", (unsigned long)d->d_un.d_val);
+                break;
+
+            case DT_RUNPATH:
+                LOGD("DT_RUNPATH: offset=%lu", (unsigned long)d->d_un.d_val);
+                break;
+
+            case DT_NEEDED:
+                // 跳过，稍后处理
+                LOGD("DT_NEEDED: offset=%lu (deferred)", (unsigned long)d->d_un.d_val);
+                break;
+
+            default:
+                LOGD("Unknown dynamic tag: 0x%llx, value=0x%llx",
+                     (unsigned long long)d->d_tag, (unsigned long long)d->d_un.d_val);
+                break;
+        }
+
+        // 添加安全检查，防止无限循环
+        if (dyn_count > si->dynamic_count) {
+            LOGE("Dynamic parsing exceeded expected count");
+            break;
+        }
+    }
+
+    if (si->symtab == nullptr) {
+        LOGD("Warning: DT_SYMTAB not found or is null");
+    }
+
+    if (si->strtab == nullptr) {
+        LOGD("Warning: DT_STRTAB not found or is null");
+    }
+
+    if (si->strtab != nullptr) {
+        dyn_count = 0;
+        for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL && dyn_count < si->dynamic_count; ++d, ++dyn_count) {
+            if (d->d_tag == DT_NEEDED) {
+                if (d->d_un.d_val < 65536) {
+                    const char* needed = si->strtab + d->d_un.d_val;
+                    if (strlen(needed) > 0 && strlen(needed) < 256) {
+                        si->needed_libs.push_back(needed);
+                        LOGD("DT_NEEDED: %s", needed);
+                    } else {
+                        LOGD("DT_NEEDED: invalid string at offset %lu", (unsigned long)d->d_un.d_val);
+                    }
+                } else {
+                    LOGD("DT_NEEDED: offset too large: %lu", (unsigned long)d->d_un.d_val);
+                }
+            }
+        }
+    }
+
+    LOGD("Dynamic parsing complete: symtab=%p, strtab=%p, needed_libs=%zu",
+         si->symtab, si->strtab, si->needed_libs.size());
+
+    return true;
+}
+
+void SoinfoManager::ApplyRelaSections(soinfo* si) {
+    LOGD("RELA sections: rela_count=%zu, plt_rela_count=%zu",
+         si->rela_count, si->plt_rela_count);
+}
--- a/module/src/main/cpp/mylinker/utils.cpp
+++ b/module/src/main/cpp/mylinker/utils.cpp
@@ -0,0 +1,157 @@
+#include "utils.h"
+
+namespace Utils {
+
+    bool safe_add(off64_t* out, off64_t a, size_t b) {
+        if (a < 0 || __builtin_add_overflow(a, b, out)) {
+            return false;
+        }
+        return true;
+    }
+
+    soinfo* get_soinfo(const char* so_name) {
+        typedef soinfo* (*FunctionPtr)(ElfW(Addr));
+
+        char line[1024];
+        ElfW(Addr) linker_base = 0;
+        ElfW(Addr) so_addr = 0;
+
+        FILE* fp = fopen("/proc/self/maps", "r");
+        if (!fp) {
+            LOGE("Cannot open /proc/self/maps");
+            return nullptr;
+        }
+
+        while (fgets(line, sizeof(line), fp)) {
+            if (strstr(line, "linker64") && !linker_base) {
+                char* addr = strtok(line, "-");
+                linker_base = strtoull(addr, nullptr, 16);
+            } else if (strstr(line, so_name) && !so_addr) {
+                char* addr = strtok(line, "-");
+                so_addr = strtoull(addr, nullptr, 16);
+            }
+
+            if (linker_base && so_addr) {
+                break;
+            }
+        }
+
+        fclose(fp);
+
+        if (!linker_base || !so_addr) {
+            LOGE("Cannot find addresses");
+            return nullptr;
+        }
+
+        ElfW(Addr) func_offset = get_export_func("/system/bin/linker64", "find_containing_library");
+        if (!func_offset) {
+            LOGE("Cannot find find_containing_library");
+            return nullptr;
+        }
+
+        ElfW(Addr) find_containing_library_addr = linker_base + func_offset;
+        FunctionPtr find_containing_library = reinterpret_cast<FunctionPtr>(find_containing_library_addr);
+
+        return find_containing_library(so_addr);
+    }
+
+    void* getMapData(int fd, off64_t base_offset, size_t elf_offset, size_t size) {
+        off64_t offset;
+        if (!safe_add(&offset, base_offset, elf_offset)) {
+            return nullptr;
+        }
+
+        off64_t page_min = page_start(offset);
+        off64_t end_offset;
+        if (!safe_add(&end_offset, offset, size)) {
+            return nullptr;
+        }
+        if (!safe_add(&end_offset, end_offset, page_offset(offset))) {
+            return nullptr;
+        }
+
+        size_t map_size = static_cast<size_t>(end_offset - page_min);
+
+        uint8_t* map_start = static_cast<uint8_t*>(
+                mmap(nullptr, map_size, PROT_READ, MAP_PRIVATE, fd, page_min));
+
+        if (map_start == MAP_FAILED) {
+            return nullptr;
+        }
+
+        return map_start + page_offset(offset);
+    }
+
+    ElfW(Addr) get_export_func(const char* path, const char* func_name) {
+        struct stat sb;
+        int fd = open(path, O_RDONLY);
+        if (fd < 0) {
+            return 0;
+        }
+
+        if (fstat(fd, &sb) < 0) {
+            close(fd);
+            return 0;
+        }
+
+        void* base = mmap(nullptr, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+        if (base == MAP_FAILED) {
+            close(fd);
+            return 0;
+        }
+
+        ElfW(Ehdr) header;
+        memcpy(&header, base, sizeof(header));
+
+        size_t shdr_size = header.e_shnum * sizeof(ElfW(Shdr));
+        ElfW(Shdr)* shdr_table = static_cast<ElfW(Shdr)*>(malloc(shdr_size));
+        memcpy(shdr_table, static_cast<char*>(base) + header.e_shoff, shdr_size);
+
+        char* shstrtab = static_cast<char*>(base) + shdr_table[header.e_shstrndx].sh_offset;
+
+        void* symtab = nullptr;
+        char* strtab = nullptr;
+        uint32_t symtab_size = 0;
+
+        for (size_t i = 0; i < header.e_shnum; ++i) {
+            const ElfW(Shdr)* shdr = &shdr_table[i];
+            char* section_name = shstrtab + shdr->sh_name;
+
+            if (strcmp(section_name, ".symtab") == 0) {
+                symtab = static_cast<char*>(base) + shdr->sh_offset;
+                symtab_size = shdr->sh_size;
+            }
+            if (strcmp(section_name, ".strtab") == 0) {
+                strtab = static_cast<char*>(base) + shdr->sh_offset;
+            }
+
+            if (strtab && symtab) {
+                break;
+            }
+        }
+
+        ElfW(Addr) result = 0;
+
+        if (symtab && strtab) {
+            ElfW(Sym)* sym_table = static_cast<ElfW(Sym)*>(symtab);
+            int sym_num = symtab_size / sizeof(ElfW(Sym));
+
+            for (int i = 0; i < sym_num; i++) {
+                const ElfW(Sym)* sym = &sym_table[i];
+                char* sym_name = strtab + sym->st_name;
+
+                if (strstr(sym_name, func_name)) {
+                    result = sym->st_value;
+                    break;
+                }
+            }
+        }
+
+        free(shdr_table);
+        munmap(base, sb.st_size);
+        close(fd);
+
+        return result;
+    }
+
+}
Author	SHA1	Message	Date
jiqiu2021	7b7f6de828	add README.md	2025-06-26 21:18:00 +08:00
jiqiu2021	680a93cba8	feat:使用原来的so名称注入	2025-06-26 20:14:54 +08:00
jiqiu2021	d793712a13	feat:增加自定义linker注入	2025-06-26 19:59:33 +08:00
jiqiu2021	eb41d924b4	Merge branch 'main' into config_app - Remove .github/workflows/build.yml	2025-06-25 23:15:37 +08:00
jiqiu2021	f5bfc60f46	fix: merge ci	2025-06-25 23:06:03 +08:00