Repository files navigation

Patching and hooking the Linux kernel with only stripped Linux kernel image.

 _  __                    _ ____       _       _||/ /___ _ __ _ __   ___||  _\__ _||_ ___||__|' // _ \'__|'_ \ / _ \ | |_) / _` | __/ __|'_\|.\ __/|||||  __/|  __/ (_|||| (__|||||_|\_\___|_||_||_|\___|_|_|\__,_|\__\___|_||_|

• Obtain all symbol information without source code and symbol information.
• Inject arbitrary code into the kernel. (Static patching the kernel image or Runtime dynamic loading).
• Kernel function inline hook and syscall table hook are provided.
• Additional SU for Android.

If you are using Android,APatch would be a better choice.

CONFIG_KALLSYMS=y

Currently only supports arm64 architecture.

Linux 3.18 - 6.6 (theoretically)

Documentation

• vmlinux-to-elf: Some ideas for parsing kernel symbols.
• android-inline-hook: Some code for fixing arm64 inline hook instructions.
• tlsf: Memory allocator used for KPM. (Need another to allocate ROX memory.)

KernelPatch is licensed under theGNU General Public License (GPL) 2.0 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html).