Open-source alternatives to APatch

KernelSU-Next is a kernel-level framework designed to provide administrative privileges and granular access control on the Android operating system. By integrating directly into the kernel during the build process, the project enables superuser management and system-wide modifications through kernel-level patching and system call interception. The framework distinguishes itself by utilizing non-persistent file system overlays, which allow for system partition modifications and module injection without altering underlying read-only storage blocks. This approach facilitates dynamic functionalit

ZygiskNext is an Android rooting integration layer and system hooking framework. It functions as a code injector for the Android Zygote process, allowing for the modification of system behavior across various rooting environments and superuser managers. The project provides a specialized API to intercept and modify low-level system calls. This enables the injection of custom code into the base process that spawns applications, facilitating deep Android system customization and rooted development. The framework utilizes dynamic library loading, hook-based runtime modification, and Java Native

iii is a distributed service orchestrator and event-driven workflow engine designed to compose and manage cross-language functions and workers through a central execution engine. It functions as a multi-language service mesh and WebSocket service gateway, providing a persistent communication layer for remote service workers. The platform enables dynamic runtime extensions, allowing new workers and capabilities to be deployed and registered into a live environment without requiring system restarts. It distinguishes itself by offering machine-readable skill exposure and agent capability integra

This project is an AI voice assistant backend and gateway server designed to connect ESP32 hardware to large language models. It enables real-time conversational AI by processing streaming speech-to-text and text-to-speech interactions, allowing hardware devices to engage in natural language dialogue. The system is distinguished by a modular plugin framework that loads custom feature extensions at runtime and a retrieval-augmented generation engine that queries external knowledge bases for factual accuracy. It further personalizes interactions by using voiceprint mapping to identify individua

Kanidm is a centralized identity management server designed to handle authentication, authorization, and directory services across distributed infrastructure. It provides a comprehensive framework for managing human and service accounts, utilizing a schema-driven database to store identity records, group memberships, and system attributes. The platform supports a wide range of authentication methods, including passkeys, passwords, and standard protocols like OAuth2, OIDC, LDAP, and RADIUS. The system distinguishes itself through a granular access control engine that enforces security policies

Bun is a high-performance runtime environment designed to execute JavaScript and TypeScript applications with minimal latency and high throughput. Built on a native core implemented in Zig, it provides a unified execution engine that leverages JavaScriptCore for efficient memory management and low-latency startup. The project functions as an all-in-one toolchain, integrating a native bundler, transpiler, package manager, and test runner into a single command-line interface. What distinguishes Bun is its focus on native system integration and developer productivity. It features a high-performa

SukiSU-Ultra is a kernel-level privilege management tool for Android that grants and controls administrative access by patching kernel functions and loading custom modules. It functions as a kernel module framework that overwrites kernel function addresses to enhance system capabilities, and as a kernel patching utility for building device-specific rooted kernel images that preserve root access after system updates. The project enforces fine-grained superuser permission management directly in the kernel, with per-application root privilege locking that restricts elevated access to a controlle

Luma3DS is a custom firmware for the Nintendo 3DS that removes factory restrictions to enable the execution of unsigned homebrew and game modifications. It functions as a kernel-level system extension that hooks system calls to bypass hardware limitations and introduce new operating system capabilities. The project serves as a homebrew payload loader, using boot-time mechanisms to launch third-party software and custom firmware versions. It also provides a game modding framework capable of patching executable code and intercepting file requests to load custom assets and modified data. The en

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

CodeMirror is a browser-based code editor framework and modular extension system used to embed full-featured text editors into web pages. It functions as a syntax tree parsing engine and a language server protocol client, enabling structural language analysis and deep integration with external programming language services. The project is distinguished by its modular architecture, which uses a system of extensions and compartments for dynamic reconfiguration at runtime. It supports real-time collaborative editing and state synchronization through an operational transformation framework, allow

Joomla is an open-source content management system written in PHP that enables users to create, edit, and organise digital content for websites. At its core, it functions as a template-based publishing platform, separating content from presentation so site design can be changed by switching templates without altering underlying data. As a multi-user content manager, Joomla supports multiple authors and editors with granular permissions, making it suitable for collaborative editorial workflows. What distinguishes Joomla is its extension-friendly architecture: the core functionality can be exte

LSPosed is an Android runtime hooking framework and system modification tool. It enables the modification of application and system behavior in memory without altering original installation files, serving as a platform for distributing and managing community-created extension modules. The project provides a comprehensive suite for device and identity spoofing, including the ability to mask hardware identifiers, simulate geographic locations, and conceal root access or hooking frameworks to bypass security and integrity checks. It also functions as an application modder to unlock premium featu

This project is a kernel binary patching utility designed to facilitate administrative privilege escalation on Linux systems. It operates by modifying compiled kernel images directly, allowing for the injection of custom code and authorization keys without requiring access to the original source code. The framework distinguishes itself through its focus on stealth and system integrity. It employs non-mounting obfuscation techniques and side-channel execution paths to maintain an administrative presence while remaining invisible to standard security detection mechanisms and performance analysi

This project is an educational operating system kernel designed to demonstrate the fundamental architectural principles of memory paging and process management. It is implemented as a minimal kernel that serves as a practical reference for building a functioning system from the ground up. The implementation features a preemptive multitasking kernel that switches execution contexts between threads to share a single CPU. It includes an x86 virtual memory manager that uses paging to map virtual addresses to physical memory and isolate processes. The system covers low-level hardware interfacing

MediaWiki is an open-source wiki engine that serves as a collaborative content platform with full versioning, multilingual publishing, and extensibility. It is fundamentally a web-based system that enables multiple users to create, edit, and organize content together, while tracking every change through revision history for rollback. As an extensible web application and versioned content management system, MediaWiki provides the foundational capabilities for hosting wikis at any scale, from small team documentation to the world's largest collaborative reference sites. The platform distinguish

This project is a bare-metal operating system developed for ARM64 architecture. It serves as a low-level implementation of kernel engineering, focusing on the fundamental construction of an OS from the hardware level up. The system is distinguished by its comprehensive approach to ARM64 processor control, featuring a red-black tree task scheduler and a hierarchical page table system for virtual memory management. It implements a sophisticated privilege model that handles transitions between kernel and user modes, ensuring process isolation through address space splitting and exception level m

ReZygisk is an Android root module framework and Zygote process injector. It functions as a native hooking engine and linker redirection tool designed to inject custom code into the Android Zygote process so that modifications are inherited by all spawned applications. The project provides a decoupled abstraction layer and Zygisk API implementation, allowing system modules to operate independently of specific root management tools. This ensures that root modules remain stable and compatible across various kernel-level rooting solutions. The framework includes capabilities for system process

This project is an open-source 3D game engine designed for building high-fidelity games, simulations, and cinematic environments. It functions as a robotics simulation platform with native integration for ROS 2 to model robot controllers and sensors. The engine features a multi-threaded Forward+ physically based renderer that supports hardware-accelerated ray tracing and global illumination. The system is built on a modular extension architecture using Gems to add or replace features without modifying core binaries. It includes a native SDK for AWS cloud integration, enabling IAM authenticati

XposedInstaller is an Android system hooking tool designed to deploy the Xposed modification framework to a device. It serves as a rooted Android modification utility that enables the interception and modification of Android system and application methods to change native operating system behavior. The tool manages the installation of the framework to allow for deep system-level hooks and device behavior customization. It automates the deployment of the software required to alter how the Android operating system and its installed applications function. The installation process involves writi

Tiptap is a headless, modular framework designed for building custom rich-text editors. It provides a developer-focused abstraction layer over a structured document model, allowing for full control over the underlying schema through a plugin-based architecture. By separating document state management from the user interface, it enables the creation of tailored editing experiences that remain framework-agnostic. The project distinguishes itself through a robust collaborative engine that supports real-time multi-user editing, conflict resolution, and presence tracking. It integrates artificial

CanCan is an authorization library for Ruby on Rails applications that provides a declarative framework for defining user permissions. It functions as a role-based access control system that decouples security logic from controllers by centralizing all ability definitions in a single location. The library distinguishes itself by translating permission rules into database-driven filters. This allows the system to retrieve only the specific records a user is permitted to see based on attribute conditions and defined scopes, rather than verifying permissions after data has been loaded. The fram

JumpServer is a privileged access management platform designed to manage and audit secure access to SSH, RDP, Kubernetes, and database endpoints. It functions as a centralized gateway that brokers remote terminal and graphical sessions to isolate users from critical infrastructure. The system utilizes a web-based protocol gateway to translate remote connections into browser-compatible streams and a protocol-based proxy layer to isolate end-user devices from target assets. It incorporates security watermarking to deter unauthorized screen captures and provides a Kubernetes access gateway for c

Astron-agent is an orchestration platform for designing and executing complex agentic workflows that combine language models with external tools and business systems. It provides a production-ready environment for deploying AI services within private intranets using container orchestration for scalable management. The platform distinguishes itself by linking large language model decision-making with robotic process automation to execute tasks across enterprise applications. It further supports enterprise requirements through a multi-tenant infrastructure that utilizes isolated memory and iden

Hyperledger Fabric is a permissioned blockchain framework and enterprise blockchain platform designed for maintaining shared, immutable records of transactions across a network of authorized participants. It provides the infrastructure to build and manage private distributed ledgers that prioritize data confidentiality and scalability. The platform is distinguished by a modular architecture and a pluggable consensus engine. This design allows internal system implementations to be swapped with custom modules to adapt the ledger's behavior and consensus mechanisms to specific technical or indus

Authority is an authorization framework for Ruby on Rails applications that manages user permissions and access control policies. It provides a system for encapsulating complex security logic into dedicated classes, separating these concerns from core business models. The library enforces security rules by intercepting web requests at the controller level and validating actions against defined policies. It utilizes convention-based mapping to automatically associate models with their corresponding authorization classes, supporting both global checks and instance-aware validation for specific

Boundary is an identity-aware access proxy and privileged access management tool. It brokers secure network connections to infrastructure targets by mapping verified user identities to granular permissions, providing a gateway to servers and databases without the need for static credentials or VPNs. The system distinguishes itself through just-in-time connectivity and automated credential injection, delivering short-lived secrets to users during session initialization. It implements a composable security model using allow-only role-based access control and hierarchical resource scoping to iso

This project is an interactive educational platform and comprehensive curriculum designed to teach developers how to build, query, and integrate GraphQL APIs into full-stack applications. It provides a structured learning environment for mastering core concepts such as schema design, query execution, and the implementation of data-driven interfaces. The platform distinguishes itself by focusing on the practical application of real-time data synchronization and backend architecture. It guides users through the process of connecting frontend frameworks to relational databases, implementing role