niqiuqiux

niqiuqiux / arm64_kernel_hook

Public

arm64 kernel inline hook form KernelPatch

20
8
69% credibility
Found May 02, 2026 at 20 stars -- GitGems finds repos before they trend. Get early access to the next one.
Sign Up Free
AI Analysis
C
AI Summary

This project lets advanced users experiment with monitoring and intercepting file operations inside Android phone kernels using custom loadable software.

How It Works

1
🔍 Discover kernel explorer

You stumble upon this project while looking for ways to peek inside your Android phone's file activity.

2
📱 Prepare your phone

Make sure your phone is connected to your computer and ready for custom tweaks.

3
💻 Build the watcher

Use simple instructions to create the special file that watches file opens on your phone.

4
🚀 Launch on phone

Send the file to your phone and start it with one easy command – feel the excitement as it activates!

5
📊 Check the magic

Watch your phone's messages light up with logs showing every file your apps try to open.

✅ Files revealed

Now you see exactly what's happening deep in your phone, safely experimenting with full control.

Sign up to see the full architecture

4 more

Sign Up Free

Star Growth

See how this repo grew from 20 to 20 stars Sign Up Free
Repurpose This Repo

Repurpose is a Pro feature

Generate ready-to-use prompts for X threads, LinkedIn posts, blog posts, YouTube scripts, and more -- with full repo context baked in.

Unlock Repurpose
AI-Generated Review

What is arm64_kernel_hook?

This C-based framework lets you hook ARM64 Linux kernel functions on Android devices, supporting inline hooks, function pointer interception, and chainable before/after callbacks for syscalls like openat or vfs_open. It solves the pain of patching arm64 kernel memory layouts by providing a module (hook_module.ko) and a Rust loader that resolves symbols from /proc/kallsyms and loads via init_module syscall. Users get adb-friendly deployment for arm64 github actions runners or ubuntu arm64 github actions, with params like enable_vfs_demo=1 for instant demos.

Why is it gaining traction?

It bypasses modern arm64 kernel protections like KCFI while handling text replication and little-endian 4k pages, making it reliable for debian arm64 kernel or linux kernel arm64 boot images. The Rust loader simplifies github arm64 runner private repo workflows—no manual insmod or symbol fixes needed. Developers dig the built-in self-tests for inline/fp/syscall hooks, cutting debug time on arm64 github hosted runners.

Who should use this?

ARM64 kernel devs building rootkits, custom drivers, or debug tools for Android phones. Reverse engineers hooking syscalls in arm64 linux kernel defconfig setups. Security researchers testing arm64 kernel head patches on github arm64 linux runner environments.

Verdict

Grab it if you're deep in arm64 kernel hooking—solid niche utility despite 18 stars and 0.699999988079071% credibility score signaling early maturity. Docs cover builds and loading well, but expect tweaks for production; self-tests boost confidence for prototypes.

(198 words)

Sign up to read the full AI review Sign Up Free

Similar repos coming soon.