Projects sharing features with SKRoot LinuxKernelRoot

dirtyfrag is a proof-of-concept exploit for Linux kernel privilege escalation. It targets page-cache write vulnerabilities to elevate user permissions to administrative root levels. The project demonstrates a deterministic exploit chain that utilizes functional proofs-of-concept for vulnerabilities in the xfrm-ESP protocol implementation and the RxRPC mechanism. By chaining these memory corruption vulnerabilities, the exploit achieves root access without relying on timing-based race conditions. The tool covers kernel memory manipulation and the development of exploit chains to test local pri

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

ReVanced Manager is an Android application patcher designed to modify compiled mobile binaries. It enables users to inject custom features, alter runtime behavior, and remove interface elements without requiring access to original source code. The utility distinguishes itself by performing all operations locally on the user device, ensuring privacy by avoiding external server dependencies. It automates the entire modification lifecycle, including the retrieval of application files, the application of bytecode-level patches, and the generation of new cryptographic signatures to ensure the resu

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

APatch is a suite of utilities for Android designed to provide kernel-level root access, manage system modules, and inject custom code into the kernel. It functions as a root tool and system module loader that allows for administrative privileges and device customization. The project distinguishes itself by injecting root capabilities directly into the kernel space to increase stealth and system-level authority. It utilizes a key-based authorization system to manage high-privilege access and prevent unauthorized administrative control of the device. The system modifies operating system behav

Miasm is a Python reverse engineering framework designed for binary analysis, disassembly, and modification. It functions as a binary analysis framework that lifts machine code into an intermediate representation to enable platform-independent security research. The system operates as a binary emulation engine and modification toolkit, allowing for the execution of binary code in a virtual environment to track state changes without native hardware. It provides tools for binary patching to update and modify raw binary files across multiple CPU architectures and executable formats. The framewo

ExplorerPatcher is a system utility designed to modify the behavior of the Windows shell by injecting custom code into core operating system processes. It functions as a background patching tool that intercepts internal function calls and replaces modern interface components with legacy alternatives, allowing for the restoration of traditional taskbar, menu, and task switcher behaviors. The project distinguishes itself through its use of dynamic link library injection and side-by-side binary replacement to alter the desktop environment at runtime. By redirecting execution flow within the syst

The Linux Kernel Module Programming Guide is an educational resource that teaches how to write, compile, and manage loadable kernel modules for modern Linux kernels. It covers the complete lifecycle of kernel modules, from building and loading to unloading and debugging, with a focus on extending kernel functionality without recompiling the entire kernel. The guide provides comprehensive coverage of core kernel programming concepts including dynamic module loading, file-operation registration, interrupt handling, kernel-user data copying, concurrency control, and deferred task scheduling. It

dnSpy is a desktop application designed for the analysis, debugging, and modification of compiled .NET assemblies. It functions as an assembly analysis suite and decompiler, translating binary instruction streams back into readable source code to facilitate reverse engineering when original source files are unavailable. The tool distinguishes itself through an integrated binary patching engine and metadata editor, which allow for the direct modification of executable logic and internal metadata tables. It supports in-process debugging instrumentation, enabling users to inject runtime hooks, s

WeChatExtension-ForMac is a plugin for the macOS WeChat client that provides a suite of extensions for account management, messaging automation, and visual customization. Its primary purpose is to enable the simultaneous operation of multiple user profiles within a single session and to automate communication tasks. The project distinguishes itself through specialized tools for content recovery and group analytics, such as intercepting recalled messages and monitoring member activity or departures within group chats. It also includes technical inspection capabilities for accessing restricted

VirtualApp is an Android application virtualization engine and user-space sandbox that enables the execution of applications within an isolated environment. It allows for the running of multiple independent instances of the same application on a single device and supports private application installation without requiring system-level root access. The project features a comprehensive hooking framework for intercepting Java and native layer functions to modify application behavior. It includes tools for hardware simulation to spoof device models and system information, as well as a non-root pr

KernelSU-Next is a kernel-level framework designed to provide administrative privileges and granular access control on the Android operating system. By integrating directly into the kernel during the build process, the project enables superuser management and system-wide modifications through kernel-level patching and system call interception. The framework distinguishes itself by utilizing non-persistent file system overlays, which allow for system partition modifications and module injection without altering underlying read-only storage blocks. This approach facilitates dynamic functionalit

WeChatFerry is a platform-specific automation tool designed for programmatic account and conversation management. It enables the creation of bots and the integration of large language models to provide automated replies within a messaging interface. The project functions by using native API interception and memory-based hooking to capture incoming communication and send messages without an official API. It includes capabilities for binary data decryption to transform protected media files and database records into readable formats. The system covers a broad range of functional areas, includi

LSPosed is an Android runtime hooking framework and in-memory code modifier. It functions as a system hooking tool that intercepts and modifies system and application methods in memory to change behavior without altering original installation files. The project provides a standardized interface through the Xposed Module API, allowing for the development of plugins that alter the behavior of the Android operating system and installed applications. The framework covers a range of capabilities including runtime function interception, Android system debugging, and application customization. Thes

Mimalloc is a general purpose dynamic memory allocator for C and C++ designed to increase execution speed and reduce fragmentation. It functions as a scalable heap manager that replaces standard library allocation functions to improve performance and memory efficiency across applications. The project distinguishes itself as both a heap security hardener and a memory corruption detector. It employs randomized allocation, encrypted free lists, and sampled guard pages to mitigate heap exploits and identify buffer overflows or use-after-free errors during runtime. The allocator provides capabili

This project is an open source Linux GPU kernel driver implemented as a loadable kernel module. It functions as a GPU firmware loader, providing the low-level driver services necessary to enable direct communication between the operating system and graphics processing units. The driver utilizes a dual-module architecture that separates GPL-licensed kernel code from proprietary firmware blobs. This system extracts and links signed binary firmware images into the kernel modules at driver load time. The project provides driver support for Turing-architecture GPUs and all subsequent newer hardwa

PS2Recomp is a static recompiler for PlayStation 2 that translates machine instructions from executable binaries into source code to enable execution on modern hardware. It functions as a binary-to-source translator and a binary analysis tool designed to facilitate the preservation of legacy software. The project distinguishes itself through a hardware emulation runtime that manages memory models and register contexts, combined with a static binary patcher for replacing raw instructions and overriding function bindings. It utilizes a specialized vector unit instruction execution system that m

EQGRP is a remote access trojan framework and post-exploitation toolkit. It provides a centralized command and control infrastructure for deploying persistent implants and managing remote agents across diverse operating systems. The project includes tools for digital forensic evasion, such as modifying system logs and filesystem timestamps to remove execution traces. It features a network interception system for capturing and reconstructing data streams by hooking into the system root, as well as exploits designed for kernel privilege escalation to elevate process permissions to administrativ

HEUKMSActivator is a software license management tool designed to automate the registration and validation of product keys for operating systems and productivity software suites. It functions as a system configuration manager, modifying registry settings and service states to align software licensing status with specific deployment requirements. The utility distinguishes itself through low-level system manipulation, including the injection of signed drivers into memory to intercept license verification routines. It employs memory patching to bypass security checks without altering files on

RevokeMsgPatcher is a binary patching utility designed to modify the execution logic of desktop messaging applications. By applying low-level changes to compiled executable files and libraries, the tool enables functionality not natively supported by the original software, specifically focusing on message persistence and process management. The utility distinguishes itself through targeted binary instrumentation and control flow redirection. It identifies specific function patterns and memory offsets within proprietary software to inject custom assembly instructions. These modifications allow

Arpl is a bootloader manager and custom kernel loader for network attached storage devices. It provides a network boot environment to automate the fetching, flashing, and installation of modified operating systems and kernels onto hardware storage. The project distinguishes itself through a remote management suite that exposes bootloader controls via a web browser, secure shell connection, or local terminal. It utilizes RSS feeds to automate the retrieval of the latest system images and version metadata for online updates. The system handles hardware boot configuration by mapping network int

OpenWrt-Rpi is a firmware builder and embedded Linux build toolset designed to compile custom router operating system images for Raspberry Pi and NanoPi hardware. It utilizes a GitHub Actions CI pipeline to automate the generation of fresh firmware images from the latest source code via daily updates. The project maintains a custom package repository and local software sources for managing community plugins and kernel modules. This infrastructure is used to ensure version consistency and prevent dependency conflicts during the installation of network drivers and system extensions. The build

Nixpkgs is a comprehensive repository of declarative software definitions used to build and manage reproducible system environments. It functions as a framework for assembling operating system components and application dependencies into consistent, versioned, and verifiable software collections. By utilizing a functional derivation graph and a lazy evaluation model, the project ensures that software environments are defined as pure expressions, resulting in absolute reproducibility across different machines. The repository distinguishes itself through its ability to manage complex software l