acidanthera/Lilu
Lilu
Lilu is a kernel patching engine and runtime code injection framework designed to modify kernel drivers and libraries in memory. It functions as an operating system customization framework that intercepts function calls and redirects execution flow within the kernel to resolve hardware compatibility issues and adjust system stability.
The project employs a modular platform that allows for the injection of code and the modification of system libraries during the boot process without altering files on disk. It utilizes a plugin-based extension architecture and a standardized API interface to load external modules for system customization.
Its capabilities cover low-level system modifications, including dynamic function hooking and in-memory code modification for both 64-bit and 32-bit architectures. The framework supports kernel-level execution redirection, runtime system customization, and the development of modular system extensions.
Features
- Kernel-Level Hooking - Serves as a framework for inserting custom code into the operating system kernel to modify its runtime behavior.
- In-Memory Modifications - Injects and modifies kernel extensions and libraries directly in volatile memory to change system behavior.
- Kernel Extension Loaders - Provides a system for dynamically injecting and altering the behavior of kernel extensions during the boot process.
- In-Memory Binary Patching - Modifies executable instructions directly in RAM during runtime to alter system behavior without disk changes.
- Kernel Code Injection - Implements the mechanism to insert and execute custom binary code within the kernel address space during startup.
- Execution Redirections - Redirects low-level operating system operations to custom handlers to resolve hardware compatibility and stability issues.
- Extension Patching - Provides the capability to inject and alter code within kernel extensions to change behavior without modifying disk files.
- OS Customization Frameworks - Provides a framework for resolving hardware compatibility and stability issues via runtime patching of the OS.
- Runtime System Customizations - Changes the behavior of system libraries and active processes in memory to resolve compatibility and stability issues.
- Kernel Patching Utilities - Functions as a framework for injecting code and modifying kernel extensions and system libraries in memory during boot.
- Function Hooking - Intercepts system calls and function executions to redirect control flow to custom handler logic.
- Patching Extension APIs - Provides a standardized set of programming interfaces for creating and loading custom kernel patching extensions.
- Patching binaire - Provides binary patching capabilities that operate across both 64-bit and 32-bit system architectures.
- User-Space Process Patching - Changes the behavior of user-space processes and libraries at runtime for both 64-bit and 32-bit architectures.
- Kernel Extension Development - Supports building modular plugins and drivers that interface with the kernel to add hardware support and system capabilities.
- Plugin-Based Architectures - Employs a modular architecture that allows extending kernel functionality through external plugins and modules.
- Kernel Internals - Kernel extension for arbitrary kernel and process patching.
