Awesome GitHub RepositoriesKernel-Level Hooking

VirtualApp is an Android application virtualization engine and user-space sandbox that enables the execution of applications within an isolated environment. It allows for the running of multiple independent instances of the same application on a single device and supports private application installation without requiring system-level root access. The project features a comprehensive hooking framework for intercepting Java and native layer functions to modify application behavior. It includes tools for hardware simulation to spoof device models and system information, as well as a non-root pr

APatch is a suite of utilities for Android designed to provide kernel-level root access, manage system modules, and inject custom code into the kernel. It functions as a root tool and system module loader that allows for administrative privileges and device customization. The project distinguishes itself by injecting root capabilities directly into the kernel space to increase stealth and system-level authority. It utilizes a key-based authorization system to manage high-privilege access and prevent unauthorized administrative control of the device. The system modifies operating system behav

Luma3DS is a custom firmware for the Nintendo 3DS that removes factory restrictions to enable the execution of unsigned homebrew and game modifications. It functions as a kernel-level system extension that hooks system calls to bypass hardware limitations and introduce new operating system capabilities. The project serves as a homebrew payload loader, using boot-time mechanisms to launch third-party software and custom firmware versions. It also provides a game modding framework capable of patching executable code and intercepting file requests to load custom assets and modified data. The en

Tetragon 是一个基于 eBPF 的运行时安全和可观测性工具集，专为 Linux 和 Kubernetes 环境设计。它作为安全策略管理器、可观测性代理和执行引擎，通过 Hook 内核函数和跟踪点来检测权限提升、容器逃逸和未经授权的系统活动。 该项目的独特之处在于其执行实时内核内（in-kernel）强制执行的能力，允许在系统调用完成前同步终止恶意进程或修改函数返回值。它通过同步容器身份并将底层内核事件直接映射到 Pod 和命名空间，提供了深度的 Kubernetes 集成。 其更广泛的功能涵盖了全面的系统调用审计、网络连接跟踪和文件完整性监控。系统支持动态策略管理，并提供用于监控 BPF 性能和资源利用率的诊断工具。 部署支持通过 Helm Chart 在 Kubernetes 集群中进行，也支持通过独立容器和原生操作系统包进行部署。

EQGRP 是一个远程访问木马框架和后渗透工具包。它提供了一个集中式命令与控制基础设施，用于部署持久化植入物并管理跨不同操作系统的远程智能体。 该项目包括用于数字取证规避的工具，例如修改系统日志和文件系统时间戳以删除执行痕迹。它具有一个网络拦截系统，用于通过挂钩系统根目录来捕获和重构数据流，以及专为内核权限提升而设计的漏洞利用，以将进程权限提升为管理根权限。 该工具包涵盖了广泛的功能，包括远程代码执行、用于签名规避的 Shellcode 打包，以及移动设备日志和电信记录的渗出与解析。它还提供用于绑定网络端口和浏览解密归档的工具。

GodEye is a runtime instrumentation tool and observability framework for Swift mobile applications. It functions as a mobile application debugger and in-process diagnostic overlay, providing a visual interface rendered directly over active applications to monitor metrics and inspect system states without requiring changes to the original source code. The framework enables real-time analysis through a suite of debugging workflows. It captures diagnostic data using method swizzling and system-level hooking to intercept function calls and monitor internal application behavior. The tool covers s

Lilu is a kernel patching engine and runtime code injection framework designed to modify kernel drivers and libraries in memory. It functions as an operating system customization framework that intercepts function calls and redirects execution flow within the kernel to resolve hardware compatibility issues and adjust system stability. The project employs a modular platform that allows for the injection of code and the modification of system libraries during the boot process without altering files on disk. It utilizes a plugin-based extension architecture and a standardized API interface to lo

KernelSU-Next is a kernel-level framework designed to provide administrative privileges and granular access control on the Android operating system. By integrating directly into the kernel during the build process, the project enables superuser management and system-wide modifications through kernel-level patching and system call interception. The framework distinguishes itself by utilizing non-persistent file system overlays, which allow for system partition modifications and module injection without altering underlying read-only storage blocks. This approach facilitates dynamic functionalit

Kernel-Bridge is a C++ framework designed for Windows kernel-mode development, providing a comprehensive toolkit for building drivers, hypervisors, and system-level monitoring tools. It serves as a foundational environment for managing low-level operating system interactions, including memory management, process control, and cross-layer communication. The project distinguishes itself by offering specialized primitives for hypervisor construction and hardware-assisted memory isolation. It facilitates advanced system manipulation through techniques such as direct kernel object modification, asy