Add standalone mode to trace command for late zygote injection

[JingMatrix]

This commit introduces the --standalone flag to the zygisk-ptrace64 binary, enabling the initialization of NeoZygisk after the zygote process has already started. This provides an alternative to relying strictly on Magisk's init phase injection.

To support injecting into an active, running process, several structural adjustments were made to the injection flow:

CLI and Daemon Initialization:

• The trace command now parses the --standalone flag, which is mutually exclusive with --restart.
• In standalone mode, the tracer resolves and changes the working directory to the module directory, then initializes the daemon controller prior to injection. This ensures the UNIX domain sockets are listening before the injected library attempts to connect.
• Added SIGINT and SIGTERM handlers to safely detach and send SIGCONT to zygote if the tracer is aborted by the user, preventing system lockups.

Ptrace Flow Adjustments:

• Omitted PTRACE_O_EXITKILL in standalone mode to ensure the zygote process is not terminated if the tracer exits unexpectedly.
• Updated the PTRACE_SEIZE strategy to explicitly issue PTRACE_INTERRUPT. Unlike standard Magisk mode where zygote is already suspended via SIGSTOP, a running process must be manually interrupted.
• Handled the resulting SIGTRAP stop and bypassed the SIGCONT wake-up sequence during detach, as a clean detach is sufficient to resume a process stopped via PTRACE_INTERRUPT.

Injection Logic:

• Extracted the remote code execution sequence (dlopen, dlsym, entry) into a shared function to maintain DRY principles.
• Created inject_standalone to bypass the AT_ENTRY stack parsing and memory hijacking. Since the dynamic linker is already initialized, the payload is invoked immediately.
• Implemented a cross-architecture syscall restart mitigation. Interrupting a tracee inside a blocking system call (e.g., epoll_wait) and altering the instruction pointer triggers the kernel's ERESTARTSYS rewind logic, causing the instruction pointer to jump into invalid padding and throw a SIGTRAP. This is resolved by clearing orig_rax (and architecture equivalents) in the temporary registers before the remote call, while preserving the actual system call state in the backup registers for a seamless resumption.

[huynhbaman]

All good, but still detect ptrace, Do u have plan to hide its , bro

[JingMatrix]

@huynhbaman ptrace is not detectable as you may imagine, and the purpose of this pull-request is not about hiding. This pull-request adds support for AOSP debug builds without installing any root solution, an advanced scenario that is out of the scope of most users.

Current hiding mechinism is already good. Please avoid commenting about something you don't truly understand. If you want to ask questions, open a thread in Discussions.