Patching and hooking the Linux kernel with only a stripped kernel image.
_ __ _ ____ _ _
| |/ /___ _ __ _ __ ___| | _ \ __ _| |_ ___| |__
| ' // _ \ '__| '_ \ / _ \ | |_) / _` | __/ __| '_ \
| . \ __/ | | | | | __/ | __/ (_| | || (__| | | |
|_|\_\___|_| |_| |_|\___|_|_| \__,_|\__\___|_| |_|
KernelPatch is a framework for patching and extending the Linux kernel at runtime, without requiring kernel source code or debug symbols.
- Symbol resolution — Obtain all kernel symbol addresses from a stripped kernel image.
- Code injection — Inject arbitrary code into the kernel (static image patching or runtime dynamic loading).
- Inline hook — Hook any kernel function via hotpatch + relocation + trampoline.
- Syscall table hook — Intercept system calls (function-pointer or inline fallback).
- SuperCall — A custom authenticated system call providing privileged operations to userspace.
- KPM (KernelPatch Module) — Load, run, and unload relocatable ARM64 ELF modules in kernel space.
- Android SU — Root access for Android via
sucompatand SuperKey authentication.
For Android users: APatch integrates KernelPatch with a user-friendly manager app and Magisk-compatible module support.
| Details | |
|---|---|
| Architecture | ARM64 only |
| Linux kernel | 3.18 – 6.12 |
| Requirement | CONFIG_KALLSYMS=y (required), CONFIG_KALLSYMS_ALL=y (recommended) |
KernelPatch/
├── kernel/ # kpimg — kernel-side patch image
│ ├── base/ # Core: hook engine, memory, symbol resolver, boot setup
│ └── patch/ # Android-specific patches, syscall hooks, KPM loader, su
├── tools/ # kptools — host/Android tool for patching kernel images
├── kpms/ # Example KernelPatch Modules
│ ├── demo-hello/ # Hello world KPM
│ ├── demo-inlinehook/# Inline hook example
│ └── demo-syscallhook/# Syscall hook example
├── user/ # Userspace headers for SuperCall integration
├── user_deprecated/ # Legacy kpatch utility (compat only)
└── doc/ # Documentation (en + zh-CN)
| Document | Description |
|---|---|
| Documentation Index | Entry point for all docs |
| Architecture Overview | Project structure, components, data flow |
| Build Guide (EN) | How to build kpimg, kptools, KPMs |
| Build Guide (中文, authoritative) | 权威构建指南（含 APatch 同步） |
| How It Works | High-level overview of kptools + kpimg |
| SuperCall / Super Syscall | Custom syscall design and safety model |
| Inline Hook | Kernel function inline hook API |
| Syscall Hook | Syscall table hook API |
| KPM (Module) | KernelPatch Module development |
| Super Command | Android supercmd via truncate |
| Troubleshooting | Common issues and solutions |
| 文档 | 说明 |
|---|---|
| 构建指南 (权威) | 构建、同步到 APatch、一致性校验 |
| 工程护栏 | 开发规范与质量底线 |
| Super Syscall | 超级系统调用设计与安全模型 |
| KPM 模块 | KernelPatch 模块开发 |
| App Profile | 应用配置档 |
| Hook 最小化 | Hook 开销优化 |
| 性能 Fastpath | 热路径性能优化 |
| Syscall Tracepoint | Syscall tracepoint 方案 |
| 侧信道加固 | 反检测与侧信道防护 |
| MOF 偏移检测 | MOF 结构体偏移自动检测 |
export TARGET_COMPILE=aarch64-none-elf-
cd kernel
export ANDROID=1
make clean && makecd tools
make clean && make./tools/kptools -p -i /path/to/kernel_image -o /path/to/patched_image -s "YourSuperKey"export TARGET_COMPILE=aarch64-none-elf-
cd kpms/demo-hello
make clean && makeFor full build instructions (including Android NDK cross-compilation and APatch sync), see the Build Guide.
- Issues: GitHub Issues
- Contributing: See CONTRIBUTING.md
- APatch (Android): github.com/bmax121/APatch
- vmlinux-to-elf: Ideas for parsing kernel symbols.
- android-inline-hook: ARM64 inline hook instruction fixing.
- tlsf: Memory allocator used for KPM runtime.
KernelPatch is licensed under the GNU General Public License (GPL) 2.0 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html).