Ive been tweaking shit lately
and actually for 4.14 I can now remove ALL manual hooks
kernel: offer syscall table tampering for sucompat https://github.com/backslashxx/KernelSU/commit/ea2515605b70dba789754e5be9e5773ed6287e2b
- tested on 3.10 to 4.14, arm64.
- tested on 4.19, fails, tested on 5.4, kernel panics.
kernel: ksud: replace input hook with an input handler
https://github.com/backslashxx/KernelSU/commit/e5c239eb6e5cf9bc17482906c489baba34c958d8
- should be fine on everything. I just copied rfkill's code.
- tested on 3.0 ~ 6.1, up to mainline in theory
input hook deprecated.
- guide updated
https://github.com/backslashxx/KernelSU/issues/5
-- reposted
and actually for 4.14 I can now remove ALL manual hooks
kernel: offer syscall table tampering for sucompat https://github.com/backslashxx/KernelSU/commit/ea2515605b70dba789754e5be9e5773ed6287e2b
- tested on 3.10 to 4.14, arm64.
- tested on 4.19, fails, tested on 5.4, kernel panics.
kernel: ksud: replace input hook with an input handler
https://github.com/backslashxx/KernelSU/commit/e5c239eb6e5cf9bc17482906c489baba34c958d8
- should be fine on everything. I just copied rfkill's code.
- tested on 3.0 ~ 6.1, up to mainline in theory
input hook deprecated.
- guide updated
https://github.com/backslashxx/KernelSU/issues/5
-- reposted
GitHub
kernel: offer syscall table tampering for sucompat ยท backslashxx/KernelSU@ea25156
this offers another way to hook syscalls, using good ole syscall table hijacking.
for 3.10 ~ 4.14 aarch64 (tested) this replaces manual hook for:
- sys_reboot
- sys_execve
- sys_faccessat
- sys_ne...
for 3.10 ~ 4.14 aarch64 (tested) this replaces manual hook for:
- sys_reboot
- sys_execve
- sys_faccessat
- sys_ne...
๐3โค1๐ฅ1
for those people that tried syscall table hijacking
I figured out the failure on 32-bit on rezygisk (boo ๐)
this is because rezygisk is also calling sys_reboot on 32-bit.
and yeah the syscall number is different.
arm64-aarch64, sys_reboot is syscall 142 on sys_call_table
arm64-aarch32, sys_reboot is syscall 88 on compat_sys_call_table
https://github.com/backslashxx/KernelSU/commit/bab218ed789d5af201dc470a534d065169d73d04
I figured out the failure on 32-bit on rezygisk (boo ๐)
this is because rezygisk is also calling sys_reboot on 32-bit.
and yeah the syscall number is different.
arm64-aarch64, sys_reboot is syscall 142 on sys_call_table
arm64-aarch32, sys_reboot is syscall 88 on compat_sys_call_table
https://github.com/backslashxx/KernelSU/commit/bab218ed789d5af201dc470a534d065169d73d04
GitHub
hook 32-bit counterparts, cleanup compat handling ยท backslashxx/KernelSU@bab218e
arm64-v8a, armeabi-v7a. no LKM support. upstream compliant driver for Linux 3.0 to 5.4+. check issues for guides - hook 32-bit counterparts, cleanup compat handling ยท backslashxx/KernelSU@bab218e
โค2๐ฅ1๐1
WestCoast.xx_4.14.356+13_32267-260110.zip
16.6 MB
#mojito #sunny
Mirror: https://github.com/ximi-mojito-test/mojito_manifests/releases/tag/20250913
+ ksu 32267
+ new allowlist
+ sys_call_table hook
+ compat_sys_call_table hook
KSU Manager:
material - https://t.me/kowsu_build
miuix - https://github.com/backslashxx/KernelSU/releases
Mirror: https://github.com/ximi-mojito-test/mojito_manifests/releases/tag/20250913
+ ksu 32267
+ new allowlist
+ sys_call_table hook
+ compat_sys_call_table hook
KSU Manager:
material - https://t.me/kowsu_build
miuix - https://github.com/backslashxx/KernelSU/releases
KSU_libra_3.10.108+32267-260110.zip
14.2 MB
kernel
+ same shit as last time
KernelSU
+ v3.0.0+ (32267)
+ new allowlist
+ sys_call_table hook
+ compat_sys_call_table hook
Mirror: https://github.com/ximi-libra-test/libra_manifests/releases/tag/20251012
KSU Manager:
material - https://t.me/kowsu_build
miuix - https://github.com/backslashxx/KernelSU/releases
#libra #aqua #a11 #ultralegacy #ksuv3
+ same shit as last time
KernelSU
+ v3.0.0+ (32267)
+ new allowlist
+ sys_call_table hook
+ compat_sys_call_table hook
Mirror: https://github.com/ximi-libra-test/libra_manifests/releases/tag/20251012
KSU Manager:
material - https://t.me/kowsu_build
miuix - https://github.com/backslashxx/KernelSU/releases
#libra #aqua #a11 #ultralegacy #ksuv3
A16_daikura-4.9.337+66_32267-260110.zip
14.3 MB
kernel
+ few picks from 4.19.325-cip126
+ raised modem temp limit, +8 C
KernelSU
+ v3.0.0+ (32267)
+ hybridized build
+ new allowlist
+ sys_call_table hook
+ compat_sys_call_table hook
Tested on:
- crDroid 12.1 / A16
- LOS 23.0 / A16
- EvoX A16 (mahmud's)
Mirror: https://github.com/ximi-daisy-test/daisy_manifests/releases/tag/20251227
Manager:
material - https://t.me/kowsu_build
miuix - https://github.com/backslashxx/KernelSU/releases/
#daisy #a16 #fuse #bpf #ksuv3
+ few picks from 4.19.325-cip126
+ raised modem temp limit, +8 C
KernelSU
+ v3.0.0+ (32267)
+ hybridized build
+ new allowlist
+ sys_call_table hook
+ compat_sys_call_table hook
Tested on:
- crDroid 12.1 / A16
- LOS 23.0 / A16
- EvoX A16 (mahmud's)
Mirror: https://github.com/ximi-daisy-test/daisy_manifests/releases/tag/20251227
Manager:
material - https://t.me/kowsu_build
miuix - https://github.com/backslashxx/KernelSU/releases/
#daisy #a16 #fuse #bpf #ksuv3
โค1๐ฅ1
for ksu, theres a new hook
this is mostly useless for now as I doubt you have android canary
this was merged last night
upstream:
https://github.com/tiann/KernelSU/commit/df640917d11dd0eff1b34ea53ec3c0dc49667002
guide updated
https://github.com/backslashxx/KernelSU/issues/5
PS: if you have CONFIG_KSU_TAMPER_SYSCALL_TABLE=y or CONFIG_KSU_KPROBES_KSUD=y, dont worry about this.
this is mostly useless for now as I doubt you have android canary
this was merged last night
upstream:
https://github.com/tiann/KernelSU/commit/df640917d11dd0eff1b34ea53ec3c0dc49667002
guide updated
https://github.com/backslashxx/KernelSU/issues/5
PS: if you have CONFIG_KSU_TAMPER_SYSCALL_TABLE=y or CONFIG_KSU_KPROBES_KSUD=y, dont worry about this.
GitHub
scope-minimized manual hooks v1.7 ยท Issue #5 ยท backslashxx/KernelSU
This refactors original KSU hooks to replace deep kernel function hooks with targeted hooks. This backports KernelSU pr#1657 and having pr#2084 elements (32-bit sucompat). It reduces the scope of k...
โค1๐ฅฐ1
I now also removed the need for removing .val on ksu source for 3.10 and older.
HACK: kernel: bypass tf out of uid_t/gid_t strict type checks
https://github.com/backslashxx/KernelSU/commit/9d9304c077577617b9c5818af738e8790b90a93f
I also removed the need for selinux hook on 4.9 and older
(recommended with CONFIG_KSU_TAMPER_SYSCALL_TABLE=y)
kernel: syscall_table_hook: escape init ksud call to root
https://github.com/backslashxx/KernelSU/commit/6bcd41ce421520e404c4d49c4af55129f886e8ea
so now you can build 4.4 ~ 4.14 basically hookless.
HACK: kernel: bypass tf out of uid_t/gid_t strict type checks
https://github.com/backslashxx/KernelSU/commit/9d9304c077577617b9c5818af738e8790b90a93f
I also removed the need for selinux hook on 4.9 and older
(recommended with CONFIG_KSU_TAMPER_SYSCALL_TABLE=y)
kernel: syscall_table_hook: escape init ksud call to root
https://github.com/backslashxx/KernelSU/commit/6bcd41ce421520e404c4d49c4af55129f886e8ea
so now you can build 4.4 ~ 4.14 basically hookless.
GitHub
HACK: kernel: bypass tf out of uid_t/gid_t strict type checks ยท backslashxx/KernelSU@9d9304c
now CONFIG_UIDGID_STRICT_TYPE_CHECKS kconf wont matter on ultra legacy.
since these are like
typedef struct {
uid_t val;
} kuid_t;
typedef struct {
gid_t val;
} kgid_t;
and then
typedef __ke...
since these are like
typedef struct {
uid_t val;
} kuid_t;
typedef struct {
gid_t val;
} kgid_t;
and then
typedef __ke...
๐5
still though, nobody else did 3.0 yet
maybe someday. challenge is getting a working 3.0 device nowadays.
maybe someday. challenge is getting a working 3.0 device nowadays.
manual security hooks now also NOT needed for 3.x kernels
we perform a small hack instead on selinux_ops
as long as this is exposed, "LSM stacking" can be done.
ref:
kernel: core_hook: introduce selinux_ops LSM tampering for < 4.2
https://github.com/backslashxx/KernelSU/commit/055acc939e7af7ff0b22ae05e42f0b0a9896c307
guide updated
https://github.com/backslashxx/KernelSU/issues/20
we perform a small hack instead on selinux_ops
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5808,7 +5808,7 @@
-static struct security_operations selinux_ops = {
+struct security_operations selinux_ops = {
.name = "selinux",
as long as this is exposed, "LSM stacking" can be done.
ref:
kernel: core_hook: introduce selinux_ops LSM tampering for < 4.2
https://github.com/backslashxx/KernelSU/commit/055acc939e7af7ff0b22ae05e42f0b0a9896c307
guide updated
https://github.com/backslashxx/KernelSU/issues/20
GitHub
kernel: core_hook: introduce selinux_ops LSM tampering for < 4.2 ยท backslashxx/KernelSU@055acc9
since 3.x kernels doesnt have the same capability as > 4.1 to stack LSM's
we introduce a way to "stack" hooks on top of selinux LSM.
security_operations is just a ...
we introduce a way to "stack" hooks on top of selinux LSM.
security_operations is just a ...
๐ฅ2โค1