OS/framework virtualization for running XPosed modules on rootless devices?

[IndiTheo]

Hello!

There are never-ending attempts to spin up XPosed in a container/"app VM" of any kind to be able to run modules on non-rooted devices. By virtualization I mean cloning parts of the AOSP framework to run in userspace (which parts to clone depends on the architecture).

I could find the following projects (not a promotion, be very careful before using any of those, beware of malware!):

• Twoyi - unmaintained
• VirtualAPP - went closed source
• SPatch / MetaWolf - looks shady/high chance of malware
• VMOS / VPhoneGaga - proprietary
• SandVXPosed - unmaintained
• VirtualXPosed - unmaintained
• BlackBox - taken down by VirtualApp for copyright infringement?
• Ananbox - possibly a promising POC? Though not even close to production
• ALEX5402/NewBlackbox - partially maintained, looks like a finished POC, shady publishing model through Telegram

And as usual their endless forks.

Also, there's a Snapdragon's Gunyah pKVM hypervisor for hardware virtualization and a DroidVM project that targets it for isolation.

It's incredibly complex to reason about all of these at the same time, but at a high level, there are two (at least) question to ask:

1. Are we close to running rooted apps in any kind of OS container?
2. Are we close to virtualizing Zygote to make Zygisk work in a sandbox?

I see interest in these techniques because they open more possibilities for rootless modding, and bridge the gap between moddability and security (such as GrapheneOS' firm non-root philosophy). Correct me if I'm wrong, but it looks like currently hooking is often favored over LSPatching just because package integrity. As one of the use case of such rootless XPosed would probably be patching our favorite messengers, integrity should probably be passed through the container boundaries...

I'd like to hear any opinions on the topic/links to any material that may be helpful.

Thank you for your valuable time!

[HSSkyBoy]

But what's the difference between this and Vector?

[IndiTheo]

Vector is applied to Zygisk on the host OS which requires root (obviously)

[JingMatrix]

Virtual environment will have its own detection points.

And due to security decision made by Google, mostly via SELinux, normal Android lack many important permissions, such as creating new mount namespace, to implement a container solution that most Linux distro could offer.