Xposed Framework

Xposed Framework

Screenshot The official installer for the Xposed framework
Original author(s)	Robert Vollmer (rovo89)
Initial release	March 31, 2012 (2012-03-31)
Final release	v89 / December 17, 2017 (2017-12-17)
Preview release	v90-beta3 / January 29, 2018 (2018-01-29)
Repository	github.com/rovo89/Xposed (Core) github.com/rovo89/XposedBridge (API) github.com/rovo89/XposedInstaller (Manager)
Written in	C++, Java
Engine
Operating system	Android
Platform	Android
Replaced by	EdXposed, LSPosed, Vector
License	Apache License 2.0
Website	https://api.xposed.info/

Search Xposed Framework on Amazon.

Xposed Framework is a free and open-source software hooking framework for rooted Android devices. It enables runtime modification of system and application behavior without altering original APK files or flashing custom ROMs. Modifications are delivered through "modules", which are separate apps that hook into Android system methods.

Created by rovo89 and first released in 2012, the framework became popular in Android modding for its modular design. Official development ended around Android Oreo due to increased security and platform restrictions, with successors like LSPosed continuing its functionality.

History

The Xposed Framework was first released on 31 March 2012, as a proof-of-concept on the XDA Developers forums.

In 2013, version 2.2 introduced an integrated module repository, allowing users to more easily discover and install modifications directly within the application.

In 2014, with the release of Android 5.0 (Lollipop), Google transitioned from the Dalvik runtime to the Android Runtime (ART). This caused major compatibility challenges for Xposed and required substantial redevelopment to remain functional.

Architecture

Android applications are launched from a system process called Zygote. Xposed hooks into this process so that every app spawned can be intercepted and modified.

Dalvik-based implementation

On older Android versions (up to 4.4), Xposed modified the system app-launching process by replacing the core system binary. This enabled it to load a custom bridge library during startup. Method hooking was implemented by intercepting Java method calls and redirecting them to Xposed's handler, which allowed module code to run before, after, or in place of the original method execution.

ART transition

From Android 5.0 onward, Android switched to the ART runtime, which compiles apps ahead-of-time into native code. This made the original approach unusable. Xposed was adapted to hook into ART's internal libraries, modifying method entry points or forcing interpreted execution paths to regain control over method calls.

Components

The framework is split into three distinct technical layers to ensure stability and ease of development:

1. Xposed: Written in C++, handles process injection and low-level runtime interaction.
2. XposedBridge: Java API used by developers to define hooks without dealing with native code.
3. Xposed Installer: Android application used to manage framework installation and modules.

Modules

Modules are independent Android applications that use the Xposed API to modify behavior of other apps or system components. They can alter UI elements, system features, permissions, or app logic without modifying the original application package.

Successors

Increasing restrictions in Android (notably SELinux enforcement, Verified Boot, and ART hardening) made direct modification of system partitions increasingly impractical. This led to a shift toward systemless implementations based on runtime injection frameworks integrated with Magisk.

EdXposed

EdXposed is a compatibility layer that provides Xposed module support on modern Android systems using Magisk and the Riru framework. It reimplements the Xposed API while avoiding direct modification of the system partition, enabling a systemless installation approach.

LSPosed

LSPosed is a successor to EdXposed and supports both Riru and Zygisk (Magisk's built-in replacement for Riru). It introduced the LSPlant hooking framework, enabling scoped injection so modules are loaded only into explicitly targeted applications rather than all processes, improving efficiency and isolation.

Vector

Vector is a fork of LSPosed focused exclusively on Zygisk-based environments. It continues the LSPosed ecosystem after its discontinuation in 2024 and is updated to support modern Android versions.

Non-root implementations

Several "Xposed-compliant" frameworks allow for module support without root access. These implementations operate at the application level rather than the system level, using virtualization or binary modification.

LSPatch

LSPatch is a non-root framework derived from LSPosed that enables Xposed module support by statically modifying Android apps to embed the Xposed loader, allowing modules to run when the app starts.

VirtualXposed

VirtualXposed is a non-root sandboxing solution that runs apps and Xposed modules inside an isolated environment. It applies hooks within this container so modules only affect virtualized apps.

See also

• Magisk (software)
• Rooting (Android)
• Android Runtime

External links

• Xposed Framework API
• XDA Forums: Xposed General
• Vector Framework
• Xposed Module Repository

This article "Xposed Framework" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Xposed Framework. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---