Projects sharing features with KernelSU Next

KernelSU is a kernel-based root management framework for Android that provides administrative access to applications by operating directly within the operating system kernel. By integrating management logic into the kernel source, it enables system-wide permission control through syscall interception and function patching. This approach allows for the enforcement of fine-grained mandatory access control, assigning custom security domains to root processes to restrict their capabilities and prevent unauthorized actions. The project distinguishes itself through a systemless modification archite

This project is an Android password manager application that provides an end-to-end encrypted vault for storing and synchronizing login credentials, secure notes, and identities. It functions as a secure storage system using zero-knowledge encryption to ensure that only the user can decrypt their stored data. The application integrates directly with the Android system to provide an autofill service that populates usernames and passwords into mobile apps and browser login fields. It also serves as a passkey management wallet for FIDO2 cryptographic passkeys and a time-based one-time password a

MagiskOnWSALocal is a toolkit and set of scripts designed to integrate root access and Google Apps into the Windows Subsystem for Android. It functions as a customization utility to provide administrative control over the virtualized Android environment. The project enables the installation of Magisk root binaries and the integration of Google Play Store services. It includes capabilities for removing default application marketplaces and modifying system settings to customize the subsystem. The toolset manages subsystem maintenance through version updates that preserve user data. It also pro

Sui is an Android root management framework and superuser manager designed to control root permissions and provide applications with elevated access to restricted system APIs and internal services. It functions as a communication bridge that allows non-root applications to execute system functions via a privileged root process. The framework utilizes a typed interface root bridge to map system functions to strongly typed interfaces, removing the need to parse raw text from shell commands. It incorporates a root shell environment for executing manual system commands and administrative scripts

ReZygisk is an Android root module framework and Zygote process injector. It functions as a native hooking engine and linker redirection tool designed to inject custom code into the Android Zygote process so that modifications are inherited by all spawned applications. The project provides a decoupled abstraction layer and Zygisk API implementation, allowing system modules to operate independently of specific root management tools. This ensures that root modules remain stable and compatible across various kernel-level rooting solutions. The framework includes capabilities for system process

This project is a static site project homepage and software distribution website. It serves as an Android modification portal and a central web portal for downloading official releases and accessing documentation for Android system modifications. The site functions as a markdown-based documentation site and an open source project hosting platform. It provides a central location for technical references and guides regarding the Android system framework, while distributing stable software versions and installation guides to the developer community. The website is built using static site genera

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

seL4 is a formally verified microkernel whose C implementation is backed by machine-checked mathematical proofs of correctness, confidentiality, integrity, and availability. It enforces strict isolation between processes through hardware-enforced address space separation and a capability-based access control system, where each process holds explicit rights only to the resources it has been granted. The kernel exposes hardware resources through a minimal API of system calls that manage threads, address spaces, and inter-process communication, with synchronous IPC supporting sender-identifying b

Lilu is a kernel patching engine and runtime code injection framework designed to modify kernel drivers and libraries in memory. It functions as an operating system customization framework that intercepts function calls and redirects execution flow within the kernel to resolve hardware compatibility issues and adjust system stability. The project employs a modular platform that allows for the injection of code and the modification of system libraries during the boot process without altering files on disk. It utilizes a plugin-based extension architecture and a standardized API interface to lo

Luma3DS is a custom firmware for the Nintendo 3DS that removes factory restrictions to enable the execution of unsigned homebrew and game modifications. It functions as a kernel-level system extension that hooks system calls to bypass hardware limitations and introduce new operating system capabilities. The project serves as a homebrew payload loader, using boot-time mechanisms to launch third-party software and custom firmware versions. It also provides a game modding framework capable of patching executable code and intercepting file requests to load custom assets and modified data. The en

This platform is a low-code database system that combines the flexibility of a spreadsheet interface with the structured power of a relational database. It serves as a collaborative workspace for managing complex datasets, building custom business applications, and automating operational workflows without requiring traditional software development. The platform distinguishes itself through deep integration of artificial intelligence, which enables users to query databases using natural language, generate content, and deploy custom conversational agents trained on internal data. It supports re

Azkaban is a distributed workflow manager and DAG-based job orchestrator designed as an enterprise batch processor. It serves as a Java-based workflow engine that schedules and executes complex job sequences across a cluster of executor servers, with specific functionality for managing big data workloads on Hadoop clusters. The system distinguishes itself through a distributed executor model that coordinates state via a shared database to ensure high availability. It employs a plugin-based architecture that allows for custom job types and system functionality extensions, including the ability

Gauzy is an open business management platform and multi-tenant enterprise resource planning system. It provides a modular business framework designed to manage core organizational operations through a unified web interface or as a headless business API. The platform is distinguished by its integration with the Model Context Protocol, allowing it to act as a server that exposes business data and system functions as tools for AI assistants. It utilizes a dynamic plugin architecture and a dedicated marketplace to extend core business entities and services. The system covers a broad range of ope

LSPosed is an Android runtime hooking framework and system modification tool. It enables the modification of application and system behavior in memory without altering original installation files, serving as a platform for distributing and managing community-created extension modules. The project provides a comprehensive suite for device and identity spoofing, including the ability to mask hardware identifiers, simulate geographic locations, and conceal root access or hooking frameworks to bypass security and integrity checks. It also functions as an application modder to unlock premium featu

SpiceDB is a distributed permission store and relationship-based access control system. It provides a scalable database for storing and querying fine-grained authorization relationships, implementing a consistency model inspired by Google Zanzibar to manage access rights across large-scale applications. The system uses a dedicated schema language to define the rules and logic governing how relationships translate into permissions independently of application code. It functions as a pluggable authorization engine that persists relationship tuples in external relational databases such as Postgr

Zdir is a self-hosted file management server that indexes local and remote directories to build organized, browsable storage catalogues with global search and sharing links. It provides a web-based interface for file manipulation and online media previews, enabling users to view images, documents, and videos directly in the browser without local downloads. The platform integrates standard WebDAV file management endpoints to allow external clients to mount storage directories and edit documents remotely. It includes background downloading capabilities that fetch files directly from external UR

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Keygen is a software licensing and distribution API platform designed to validate product keys, manage user entitlements, and enforce device activation policies. It provides a comprehensive set of identity and licensing services that enable software vendors to control access to desktop and server applications while tracking usage limits and seat counts across hardware machines. The platform includes enterprise identity provider integration using standard SAML protocols, single sign-on authentication, and role-based access control with granular permission restrictions to secure system operatio

Capnweb is a distributed object communication library and Cap'n Proto RPC framework. It enables type-safe remote procedure calls between clients and servers using shared schemas and generated stubs to invoke methods on remote objects as if they were local. The project utilizes an object-capability security model to govern access to remote resources through unforgeable tokens. It provides a bidirectional network layer that multiplexes asynchronous calls and data streams over persistent WebSocket connections and includes a remote resource lifecycle manager that uses reference counting to automa

This project is a kernel binary patching utility designed to facilitate administrative privilege escalation on Linux systems. It operates by modifying compiled kernel images directly, allowing for the injection of custom code and authorization keys without requiring access to the original source code. The framework distinguishes itself through its focus on stealth and system integrity. It employs non-mounting obfuscation techniques and side-channel execution paths to maintain an administrative presence while remaining invisible to standard security detection mechanisms and performance analysi

Fastsocket is a high-performance Linux socket implementation designed for linear scalability on multicore systems. It functions as a TCP throughput optimizer and a multicore packet steering engine that reduces system call overhead and lock contention to increase total network processing capacity. The project distinguishes itself through a network system call interceptor that uses a shared library to redirect standard socket calls to optimized interfaces without requiring changes to application binaries. It employs active connection steering by encoding CPU core IDs into source ports and utili

deepstream.io is an open-source realtime server that synchronizes JSON records, events, and remote procedure calls across clients and backend services. It functions as a realtime data sync server, event pub/sub server, record database server, and RPC server, all within a single platform. The server authenticates and authorizes every message using multiple strategies including JWT, HTTP, and file-based credentials, with a declarative permission language controlling access to records, events, and RPCs at a granular level. The platform distinguishes itself through its combination of realtime dat

NetBox is a network infrastructure source of truth, acting as a centralized database for modeling and documenting the intended state of network devices, IP addresses, and cabling. It functions as a data center infrastructure management tool, an IP address management system, and a network automation platform. The system provides a programmable interface and a validated data model designed to drive external network configuration and provisioning tools. It enables the maintenance of records for network circuits, devices, and logical connections with full change auditing. Capabilities include ne

django-guardian is a Django object permission library that enables the assignment of fine-grained access rights to individual database records. This system provides object-level access control, allowing users or groups to be granted permissions for specific model instances rather than applying a single global rule to an entire data model. The library includes a permission manager for the Django administrative interface, which provides a visual dashboard to assign and audit these instance-specific security rules. It also features an anonymous access controller to define and verify permissions

This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization. The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time. Capability areas include filesystem access management using glob-patte

Eladmin is a backend management system and administrative framework built with Spring Boot and Vue. It provides a complete infrastructure for creating administration panels, combining a Java Persistence API backend scaffold with a management interface to monitor system performance and log user activities. The project features automated code generation to produce frontend and backend source code and CRUD operations. It employs a role-based access control system to manage users and organizational structures, while utilizing dynamic route management to update navigation menus from the backend wi

Apostrophe is an open-source Node.js headless content management system that delivers structured content through REST APIs while providing a visual in-context page editor for live editing. It is built on a module-based plugin architecture that extends CMS functionality through reusable modules, each encapsulating logic, configuration, and templates. The system uses schema-driven content modeling to define data structures and validation rules through configurable schemas and custom field types, with all content stored as flexible JSON-like documents in MongoDB. The platform distinguishes itsel