diff --git a/injector.cpp b/injector.cpp
index 494e0eaf7..a497c9dad 100644
--- a/injector.cpp
+++ b/injector.cpp
@@ -1,10 +1,6 @@
 /**
- * injector.cpp – Android arm64 纯 ptrace 注入器（无 SELinux 操作）
+ * injector.cpp – 带诊断的注入器
  * 编译: aarch64-linux-android-clang++ -static -std=c++17 -O2 injector.cpp -o injector
- * 用法:
- *   无参数: 默认 /data/1/libMyMenu.so + com.tencent.jkchess
- *   带参数: injector <so_path> [package_name|pid]
- * 注意: 运行前请执行 setenforce 0 关闭 SELinux
  */
 
 #include <stdio.h>
@@ -60,7 +56,7 @@ int find_pid_by_name(const char* proc_name) {
     return pid;
 }
 
-// ---------- ptrace 读写内存 ----------
+// ---------- ptrace 读写 ----------
 long ptrace_readdata(int pid, unsigned long addr, void* buffer, size_t size) {
     for (size_t i = 0; i < size; i += sizeof(long)) {
         long data = ptrace(PTRACE_PEEKDATA, pid, addr + i, 0);
@@ -82,7 +78,7 @@ long ptrace_writedata(int pid, unsigned long addr, const void* buffer, size_t si
     return 0;
 }
 
-// ---------- 执行系统调用 ----------
+// ---------- 执行系统调用（带错误诊断） ----------
 int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = nullptr) {
     struct iovec iov = { &regs, sizeof(regs) };
     if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
@@ -121,6 +117,7 @@ int remote_syscall(int pid, struct user_pt_regs& regs, unsigned long* result = n
 
 // ---------- 注入主函数 ----------
 int inject_so(int pid, const char* so_path) {
+    // 1. 附加
     if (ptrace(PTRACE_ATTACH, pid, 0, 0) == -1) {
         perror("ptrace attach");
         return -1;
@@ -133,6 +130,18 @@ int inject_so(int pid, const char* so_path) {
         return -1;
     }
 
+    // 2. 测试 ptrace 读写能力（读取进程的第一个字节，通常可读）
+    unsigned long test_addr = 0x1000; // 尝试读取低地址
+    char test_buf[1];
+    if (ptrace_readdata(pid, test_addr, test_buf, 1) == -1) {
+        printf("[!] Warning: ptrace_readdata failed at 0x%lx, errno=%d. Maybe ptrace is restricted.\n", test_addr, errno);
+        printf("[!] Please ensure SELinux is Permissive and Yama ptrace_scope=0.\n");
+        ptrace(PTRACE_DETACH, pid, 0, 0);
+        return -1;
+    }
+    printf("[+] ptrace read test passed.\n");
+
+    // 3. 备份寄存器
     struct user_pt_regs orig_regs, regs;
     struct iovec iov = { &orig_regs, sizeof(orig_regs) };
     if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &iov) == -1) {
@@ -142,29 +151,53 @@ int inject_so(int pid, const char* so_path) {
     }
     regs = orig_regs;
 
-    // mmap 分配内存
+    // 4. mmap 分配内存（尝试两次，第一次普通，第二次固定地址）
     size_t path_len = strlen(so_path) + 1;
-    regs.regs[0] = 0;
-    regs.regs[1] = path_len;
-    regs.regs[2] = PROT_READ | PROT_WRITE;
-    regs.regs[3] = MAP_PRIVATE | MAP_ANONYMOUS;
-    regs.regs[4] = -1;
-    regs.regs[5] = 0;
-    regs.regs[8] = 222;  // __NR_mmap (arm64)
-
     unsigned long remote_addr = 0;
-    if (remote_syscall(pid, regs, &remote_addr) != 0) {
-        fprintf(stderr, "remote_syscall mmap failed\n");
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
-    if (remote_addr == 0 || remote_addr == (unsigned long)-1) {
-        fprintf(stderr, "mmap returned invalid: 0x%lx, errno=%d\n", remote_addr, errno);
-        ptrace(PTRACE_DETACH, pid, 0, 0);
-        return -1;
-    }
+    int retry = 0;
+    do {
+        regs = orig_regs; // 恢复
+        regs.regs[0] = (retry == 0) ? 0 : 0x10000000; // 第二次指定地址
+        regs.regs[1] = path_len;
+        regs.regs[2] = PROT_READ | PROT_WRITE;
+        regs.regs[3] = (retry == 0) ? (MAP_PRIVATE | MAP_ANONYMOUS) : (MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED);
+        regs.regs[4] = -1;
+        regs.regs[5] = 0;
+        regs.regs[8] = 222;  // __NR_mmap
+
+        if (remote_syscall(pid, regs, &remote_addr) != 0) {
+            fprintf(stderr, "remote_syscall mmap failed\n");
+            ptrace(PTRACE_DETACH, pid, 0, 0);
+            return -1;
+        }
+        if (remote_addr == 0 || remote_addr == (unsigned long)-1) {
+            fprintf(stderr, "mmap returned invalid: 0x%lx (retry=%d)\n", remote_addr, retry);
+            if (retry == 0) {
+                retry++;
+                continue;
+            } else {
+                ptrace(PTRACE_DETACH, pid, 0, 0);
+                return -1;
+            }
+        }
+        // 检查地址是否可写（尝试写入一个字节）
+        char tmp = 0;
+        if (ptrace_writedata(pid, remote_addr, &tmp, 1) == -1) {
+            printf("[!] mmap address 0x%lx not writable (errno=%d), retrying with fixed address...\n", remote_addr, errno);
+            if (retry == 0) {
+                retry++;
+                continue;
+            } else {
+                ptrace(PTRACE_DETACH, pid, 0, 0);
+                return -1;
+            }
+        }
+        break; // 成功
+    } while (retry < 2);
+
     printf("[+] Allocated remote memory at 0x%lx\n", remote_addr);
 
+    // 5. 写入 SO 路径
     if (ptrace_writedata(pid, remote_addr, so_path, path_len) == -1) {
         fprintf(stderr, "ptrace_writedata failed, errno=%d\n", errno);
         ptrace(PTRACE_DETACH, pid, 0, 0);
@@ -172,7 +205,7 @@ int inject_so(int pid, const char* so_path) {
     }
     printf("[+] Wrote SO path\n");
 
-    // 计算远程 dlopen
+    // 6. 计算远程 dlopen
     void* local_dlopen = (void*)dlopen;
     unsigned long local_libdl_base = 0;
     FILE* fp = fopen("/proc/self/maps", "r");
@@ -220,12 +253,12 @@ int inject_so(int pid, const char* so_path) {
     unsigned long remote_dlopen = remote_libdl_base + dlopen_offset;
     printf("[+] Remote dlopen: 0x%lx\n", remote_dlopen);
 
-    // 执行 dlopen
+    // 7. 执行 dlopen
     regs = orig_regs;
     regs.regs[0] = remote_addr;
     regs.regs[1] = RTLD_LAZY;
     regs.pc = remote_dlopen;
-    regs.regs[30] = 0x0;  // LR=0 → segfault
+    regs.regs[30] = 0x0;
 
     iov.iov_base = &regs; iov.iov_len = sizeof(regs);
     if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &iov) == -1) {