AUZM Runtime Design

AUZM means Android Use Zygisk Module. Runtime AUZM components are Rust shared libraries loaded into matching app processes.

AndroidUse separates control, loading, and app-local behavior:

• MCP server: root-module control plane.
• AUZM loader: packaged Zygisk loader under zygisk/arm64-v8a.so.
• AUZM payload: Rust .so loaded inside the target process.

Registry

/data/adb/modules/AndroidUse/.config/androiduse/auzm.d/<module-id>/
├── enabled
├── name
├── scope
├── path
└── payload.so

Loader Flow

preAppSpecialize
  -> read AUZM registry as root/Zygote
  -> select enabled modules whose scope matches current process
  -> buffer payload bytes

postAppSpecialize
  -> write payload to target app cache
  -> dlopen payload
  -> unlink cache file
  -> expose ANDROIDUSE_PROCESS_NAME and ANDROIDUSE_APP_DATA_DIR

If the registry is empty, the loader falls back to the older single-payload contract:

.config/androiduse/zygisk-target
.config/androiduse/payload.so

Dynamic Tool Bridge

MCP client
  -> AndroidUse MCP server on phone
  -> request under .state/dynamic-tools/requests/
  -> AUZM payload sees app-local bridge request
  -> payload runs app-internal path
  -> response under .state/dynamic-tools/responses/

The response must include target-specific proof or a clear not-ready reason.