What Is Zygisk? ReZygisk & Zygote Injection Explained (2026)

By the PrivacyPortal team — current as of June 2026.

If you have ever flashed a root module and wondered how it runs code inside other apps, the answer is almost always Zygisk. The name is a blend of "Zygote" and "Magisk", and it describes the framework that lets Magisk and its modules hook into Android's app-spawning process. Knowing what Zygisk is — and how Zygote injection actually works — is the key to everything from running LSPosed to hiding root from fussy apps. In this guide we cover what Zygisk does, the three implementations you can pick from (built-in Magisk Zygisk, Zygisk Next and ReZygisk), and a real, follow-along install you can try on your own device today.

Before you touch anything: rooting and modifying system behaviour can brick your phone, break over-the-air (OTA) updates, void your warranty and trip Play Integrity — which can stop banking apps and Google Wallet from working. Back up everything first, and remember that unlocking the bootloader wipes the device completely. Nothing here defeats any specific bank's checks; treat all of it as you modifying your own hardware, at your own risk.

What is Zygisk? Zygote plus Magisk, explained

To understand Zygisk, you first have to understand Zygote — one of the most important processes in Android.

What is the Zygote process?

When Android boots, it starts a process called Zygote. Zygote preloads the Android Runtime (ART) along with the common framework classes and libraries that almost every app needs, then sits idle, waiting. Each time you open an app, the system does not start from scratch — it forks (clones) Zygote, and the new copy becomes your app's process, inheriting everything Zygote already loaded. That is why apps launch quickly, and it is why the process is named after the single cell that everything else divides from. Zygote is part of the Android Open Source Project's runtime architecture.

How Zygisk injects code into Zygote

Here is the clever part. Because every app process is a child of Zygote, anything injected into Zygote can run inside every app that launches afterwards. Zygisk is Magisk's official API for doing exactly that — loading small native modules into Zygote, and therefore into individual app processes. It arrived in Magisk v24.0, replacing the older Riru method, and it is described in Magisk's official documentation. In practice, Zygisk is what lets a module alter how an app behaves, change what an app sees, or quietly unmount Magisk's modifications before a security-conscious app goes looking for them.

How Zygisk injects a module into each app process forked from the Zygote template.

What Zygisk is actually used for

On its own, Zygisk does nothing visible — it is plumbing. The value comes from Zygisk modules that use the API. The most common ones you will meet are:

• LSPosed — runs the Xposed framework on modern Android, so you can hook and tweak app behaviour without editing each app.
• Hiding modules such as Shamiko, NoHello or Treat Wheel — these reduce the traces that root leaves behind in selected apps.
• Play Integrity Fix / Play Integrity Fork — used to help a device report a sensible state to Google's Play Integrity API.

The Zygisk DenyList

The Zygisk DenyList is a built-in Magisk feature that tells Zygisk to revert its modifications and avoid loading into the processes of apps you choose — typically banking and payment apps. In practice the DenyList is a baseline, not an invisibility cloak: simpler checks are satisfied, but more sophisticated detection still sees clues. That gap is exactly why dedicated hiding modules and alternative Zygisk implementations exist.

The three Zygisk implementations compared

This is where most confusion starts. "Zygisk" is not a single thing any more — there are three implementations (plus a newer alternative), and choosing the right one depends on your root manager.

• Built-in Magisk Zygisk — the original, toggled on in Magisk's settings. Convenient, but the easiest of the three for apps to detect.
• Zygisk Next — a standalone, closed-source module (maintained by Dr-TSNG) that brings Zygisk to Magisk, KernelSU and APatch. Long the community default, though some banking apps have started detecting it.
• ReZygisk — an open-source implementation by PerformanC that supports every major root manager and hides its traces more aggressively.
• NeoZygisk (by JingMatrix) — a newer open-source alternative in the same spirit as ReZygisk.

Implementation	Maintainer	Open source	Works with	Hides root	Use this hider
Built-in Magisk Zygisk	topjohnwu	Yes	Magisk only	Weak — easily detected	Shamiko
Zygisk Next	Dr-TSNG	No	Magisk, KernelSU, APatch	Moderate — some detection now	Shamiko
ReZygisk	PerformanC	Yes	Magisk, KSU-Next, APatch, SukiSU	Strong	NoHello / Treat Wheel
NeoZygisk	JingMatrix	Yes	Magisk, KernelSU, APatch	Strong	NoHello

A root manager's Modules screen showing a standalone Zygisk implementation installed and active.

ReZygisk vs Zygisk Next: which should you use?

There is no single winner — it depends on your stack. Here is the decision framework we actually use:

• You run Magisk and mainly want LSPosed plus light hiding: built-in Zygisk or Zygisk Next, paired with Shamiko, is the simplest route.
• You run KernelSU-Next, APatch or SukiSU Ultra: use ReZygisk (or NeoZygisk). Zygisk Next works too, but ReZygisk is built with these managers in mind.
• You are on a SUSFS-patched kernel: ReZygisk is the better-behaved choice.
• Zygisk Next has started getting detected for you: switch to ReZygisk, which hides Zygisk traces more aggressively so apps are fooled into thinking no Zygisk is present.

The single most important compatibility rule: Shamiko does not work with ReZygisk. If you choose ReZygisk, use NoHello or Treat Wheel instead — mixing Shamiko with ReZygisk is the classic cause of "my hiding suddenly broke". For the bigger picture, see our guide to passing Play Integrity on a rooted phone.

How to install ReZygisk (step-by-step)

This walkthrough installs ReZygisk, the implementation most worth knowing in 2026. The exact files are linked in the Modules, apps & files to try section at the end of this article, so download them from there rather than hunting around.

Prerequisites

• An unlocked bootloader and a working root manager already installed — Magisk, KernelSU-Next, APatch or SukiSU Ultra. (New to this? Start with our Magisk rooting guide.)
• A current backup of anything you cannot lose.
• The ReZygisk module. v1.0.0-rc.2 is a known-working release; the newer CI builds are distributed via the project's Telegram channel rather than GitHub Releases, so check the files section below for the right link.
• A compatible hiding module — NoHello or Treat Wheel (not Shamiko).

The steps

1. Back up first. Take a fresh backup before changing anything.
2. Disable any existing Zygisk. If you use Magisk, open it and turn off the built-in Zygisk toggle in Settings. If you previously installed Zygisk Next, remove it. You must never run two Zygisk implementations at once.
3. Download ReZygisk from the files section below, choosing the build that matches your setup.
4. Flash the module. In your root manager, go to Modules → Install from storage and select the ReZygisk ZIP.
5. Reboot. Zygisk changes only take effect after a restart.
6. Verify it is running. Reopen your root manager, go to Modules, and check the ReZygisk card — it should report that the daemon is active and list your device's architecture(s). This is the step most people skip, and it is the one that tells you whether Zygisk is genuinely live.
7. Add your hiding module. Flash NoHello or Treat Wheel, then reboot again.
8. Do a functional test. Install a Zygisk module such as LSPosed and confirm it loads — if it does, Zygote injection is working end to end.

The ReZygisk module card after a reboot, showing the daemon running and the detected device architectures.

What actually happens if it goes wrong: on some Magisk builds, ReZygisk modules silently refuse to load. The community fix is to hide (rename) the Magisk app from Magisk's settings, then reboot — this resolves module loading surprisingly often. If you are on Magisk Alpha, expect the occasional rough edge with ReZygisk; it works, but it is less seamless than KernelSU-Next.

Common Zygisk pitfalls (and how to avoid them)

• Running two Zygisks at once. Built-in Magisk Zygisk plus ReZygisk (or Zygisk Next) will fight each other. Disable the built-in one first.
• Pairing Shamiko with ReZygisk. They are incompatible. Use NoHello or Treat Wheel with ReZygisk.
• Looking for ReZygisk on GitHub Releases. The freshest builds come from the project's CI channel on Telegram; the tagged v1.0.0-rc.2 is your fallback.
• Enabling Magisk's "enforce DenyList" alongside Shamiko. In some setups these clash — turning the enforce option on can break Shamiko's hiding.
• Forgetting to reboot. Almost every Zygisk problem report turns out to be a missing reboot.
• Expecting magic. No Zygisk setup guarantees a given banking app will work; detection is a moving target and the cat-and-mouse never truly ends.

Frequently asked questions

What is Zygisk in simple terms?

Zygisk is the part of Magisk that lets root modules run code inside other apps, by hooking into Android's Zygote process — the template that every app is cloned from. No Zygisk, no LSPosed and no modern root hiding.

Do I need Zygisk?

Only if you want features that depend on it: the Xposed framework via LSPosed, advanced root hiding, or Play Integrity fixes. If you simply want root for a file manager or ad-blocker, you can leave Zygisk off.

Is Zygisk safe?

Zygisk itself is mature, but it increases your attack surface and only loads the modules you give it. Install modules from sources you trust, keep backups, and remember that root plus Zygisk can affect device integrity checks. Treat every module as code running inside your apps — because it is.

ReZygisk vs Zygisk Next — what is the real difference?

Zygisk Next is closed-source and has been the default for Magisk users; ReZygisk is open-source, supports more root managers, and currently hides Zygisk traces more aggressively. The catch is that ReZygisk does not work with Shamiko, so you move to NoHello or Treat Wheel.

Can I use Zygisk without Magisk?

Yes. Standalone implementations like ReZygisk, Zygisk Next and NeoZygisk bring the Zygisk API to KernelSU-Next, APatch and SukiSU Ultra, so you are not tied to Magisk to use Zygisk modules.

Will Zygisk make my banking app work again?

Maybe, maybe not — and we will not pretend otherwise. Detection methods change constantly, and we cannot promise any setup defeats a specific bank's checks. If staying off the treadmill appeals, a de-Googled phone sidesteps Google's services entirely rather than trying to hide from them.

Zygisk is the quiet engine behind most of what makes a modern rooted Android phone powerful. Learn how Zygote injection works once, pick the implementation that matches your root manager, and the rest of the ecosystem — modules, hiding, integrity — finally makes sense. Grab the files below and try it on your own device.