Loadable kernel modules for Android reversing and debugging on controlled systems and emulators.
Android LKMs is a collection of loadable kernel modules for Android that enable security researchers to hook and monitor kernel-level functions. It helps with reversing native applications, tracking file access by malware, and protecting against certain anti-reverse engineering techniques. The modules are designed for use in controlled environments like emulators for safe analysis.
Security researchers and reverse engineers who need to analyze Android malware or application behavior at the kernel level in controlled testing environments.
It provides ready-to-use kernel modules for common reversing tasks, saving researchers time compared to building custom solutions from scratch. The modules are specifically tailored for Android's kernel environment and common security analysis scenarios.
Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Modules like antiptrace hook ptrace functions to prevent debugging detection, specifically aiding in reversing native Android applications as per the key features.
The open-read-write module monitors file operations to track malware file access, useful for forensic analysis described in the README.
Antiunlink module protects against DexProtector's file unlinking, targeting common anti-reverse engineering techniques in controlled environments.
Designed for controlled qemu testing with functionality prioritized over polish, making it ideal for safe research scenarios as stated in the philosophy.
The README warns that modules may cause slowdowns and unexpected results in emulators due to inefficient kernel operations, limiting reliability.
Requires editing Makefile, kernel compilation, and sys_call_table extraction, which assumes specific environments and can be error-prone for non-experts.
Admitted to be tested only in personal qemu environments, making it unsuitable for real devices or diverse systems without further validation.