krenlol

btw on arm64, slow_avc_audit is also done via branch link. as long as you have kallsyms, it will be automatically patched and spoofed. I just no-op the manual hook

Theres that temp hack on sys_setgroups currently on the driver. It seems to me official ksu hasn't decided what to do as the PR is hanging still. the way it works is I just memmove user memory and erase gid 3009 from being applied. this is for that priv isolation exploit thingy https://github.com/backslashxx/KernelSU/commit/f35451b3255086376270879edbb8740076a0b5c8 this is applied even if youre on manual hooks. this is done via syscall table tampering which most of you should move on to.

trampoline that the kernel generates is straight up a function pointer call which is a bit of a loss on their side, couldve gone direct branch no idea on what gcc's codegen looks like on this since gcc has that ipa-ra meme, but seeing trampolines are function pointer calls, I don't think it can optimize at compile time. gcc treats function pointers are *volatile fn either that or I'll see something surprising again

calling convention is preserved registers used are x0 and w1, so 64-bit on 0th slot and then 32 bit on 1st which checks out since fn sig is static int selinux_file_permission(struct file *file, int mask) pointer + int

somehow on 7.x linux just changes those static call keys to straight up static call trampolines and those still kept calling convention which is nice current method of providing lsm on 6.8+ still works but yeah I'll likely have an ifdef to offer this properly, as this is cleaner and much more assured. https://github.com/backslashxx/KernelSU/commit/83d38c7 but then again theres no 7.x LTS yet, so it'll take timee same method - provide handler which has tail-called calls to traps - patch tail-call to call kernel func - patch callsite to call handler

krenlol pinned a photo

LineageOS 23.2 Unofficial, A16 QPR2 for Redmi Note 10, mojito/sunny changes from last build - Aug 2026 ASB - blur enabled, kawase2 - kernel: merged LOS sm8150 / sm6150 common https://github.com/ximi-mojito/mojito_manifests/releases/tag/20260805 #mojito #A16 #QPR2

real KSU on iPhone lmao

theres also this small change on branch link instead of using function pointers, we can generate stub functions that are basically just naked traps we just patch those stubs at runtime to call the kernel function back, removing the need for function pointers and completely avoid blr overhead. -- on its early state, I had it unoptimized which takes like 6~10 instructions then I had it down to 1 insn on clang and 2 on gcc https://github.com/backslashxx/KernelSU/commit/09f5a3c then yeah some guy on #gcc recommended the ff https://godbolt.org/z/PKEndcWso now it doesnt matter which compiler it is, stub will be one trap insn.

theres also this small change on branch link instead of using function pointers, we can generate stub functions that are basically just naked traps we just patch those stubs at runtime to call the kernel function back, removing the need for function pointers and completely avoid blr overhead. -- on its early state, I had it unoptimized which takes like 6~10 instructions then I had it down to 1 insn on clang and 2 on gcc https://github.com/backslashxx/KernelSU/commit/09f5a3c then yeah some guy on #gcc recommended the ff https://godbolt.org/z/PKEndcWso now it doesnt matter which compiler it is, stub will be one trap insn.

small change on the driver if youre building built-in and on AUDIT && ARM64 && KALLSYMS, the driver will now attempt to hijack slow_avc_audit via branch link. as for handling / choosing which fn prototype is apt for you kernel, this is done at buildtime by overloading fn typeof via C11's _Generic https://github.com/backslashxx/KernelSU/blob/master/kernel/downstream/slow_avc_audit_defs.h - this is actually my first time using this, quite neat. this can also be done on clang by overloading it like on C++, but yeah that is only usable on clang clang __attribute__((overloadable)) version https://github.com/backslashxx/KernelSU/blob/66db7b8/kernel/slow_avc_audit_defs.h

krenlol pinned «I updated kernels on these - daisy / Mi A2 Lite https://github.com/ximi-daisy/daisy_manifests/releases - i9300 / Samsung Galaxy S3 https://github.com/samsung-i9300/i9300_manifests/releases - libra / Mi 4C https://github.com/ximi-libra/libra_manifests/releases…»

I updated kernels on these - daisy / Mi A2 Lite https://github.com/ximi-daisy/daisy_manifests/releases - i9300 / Samsung Galaxy S3 https://github.com/samsung-i9300/i9300_manifests/releases - libra / Mi 4C https://github.com/ximi-libra/libra_manifests/releases - mojito / Redmi Note 10 https://github.com/ximi-mojito/mojito_manifests/releases Changes: - updated KSU 32567 - backported sys_faccessat2 on libra, daisy and mojito - branch link hook is used on libra, daisy and mojito

so I guess no issues in the foreseeable future. hooking will not be a problem for a while.