Root Managers, Zygisk & Root Hiding

Root management covers everything you need to install, run and maintain root on your Android device: root managers for Magisk, KernelSU and APatch, temporary root solutions for locked-bootloader devices, module managers and metamodules, the LSPosed/Xposed and Zygisk frameworks, and the tools that keep root hidden from apps (Play Integrity, SUSFS). Apps and modules live together here because they solve the same problem - controlling root access.

TIP

New to rooting? Read the Complete Rooting Guide first, then come back for the tools.

Root Managers

• ⭐ KernelSU - A Kernel based root solution for Android. FOSS
• ⭐ Magisk - Manage Magisk modules and root permissions. FOSS
• APatch - The patching of Android kernel and Android system. FOSS
• Aster - Root manager built on KernelPatch and continuing the APatch capability chain, with APM and KPM modules, a module repository and protected runtime operations. FOSS
• FolkPatch - A Root management tool focused on interface optimization and feature extension, based on APatch. FOSS
• KernelSU-next - An advanced Kernel based root solution for Android. FOSS
• QuestStack - Desktop workflow for Windows, Linux and macOS that roots Meta Quest 1 and Quest 2 headsets through the GhostLock chain and the CVE-2021-1931 ABL/fastboot bug, with temporary boot of a vulnerable ABL, verified backups, A/B slot handling and bootloader unlocking. FOSS
• ReSukiSU - Fork of SukiSU-Ultra with additional features. FOSS
• SukiSU-Ultra - A kernel-based root solution for Android devices, forked from KernelSU with some useful changes. FOSS
• YukiSU - Kernel-based root solution forked from SukiSU-Ultra with the userspace manager rewritten in C++, external MetaModule lifecycle and script integration, app profiles and dynamic manager support. FOSS

Temporary Root (Locked Bootloader)

What is temporary root (GhostLock)?

Exploits like GhostLock (CVE-2026-43499) - a 15-year-old Linux kernel bug - grant root in memory only, for the current boot. No bootloader unlock, no flashing, no Knox trip, no data wipe: reboot and the device is bone-stock again. The trade-offs: root doesn't survive reboots, you can't flash ROMs/recoveries, and it only works on specific devices running firmware up to ~the June 2026 patch level.

• ⭐ Root My Galaxy - One-tap temporary root for Snapdragon Galaxy flagships (S24/S25 series, S24 FE, A56...) via GhostLock; bootloader stays locked, Knox isn't tripped. FOSS
• DirtyFrag - Ephemeral root exploit for CVE-2026-43284 that grants in-memory root via page-cache and can load KernelSU without bootloader unlock. FOSS
• GhostLock - One-tap temporary root app using GhostLock CVE-2026-43499 to gain in-memory root and load KernelSU with bootloader locked. FOSS

TIP

Also check out Root Without Unlocking the Bootloader ↗ and Bootloader Mods & Temporary Root Solutions ↗

Bootloop Protection

• Anti bootloop - Restores the previous boot image if a module causes a bootloop. FOSS [M]
• AshReXcue - Bootloop Protector - Prevent boot loops caused by problematic modules installed via KernelSU or Magisk. FOSS [M] [K] [A]
• YetAnotherBootloopProtector - Monitor and fix potential Bootloops and SystemUI failures. FOSS [M] [A]

LSPosed & Xposed

NOTE

LSPosed allows you to use Xposed modules, that can modify or extend the functionality of your Android system and apps.

• ⭐ Vector - Open Source Fork of original LSPosed with dynamic module loading, and other improvements. FOSS [M]
• LSPosed - A Riru / Zygisk module that provides an ART hooking framework delivering consistent APIs with the OG Xposed, leveraging the LSPlant hooking framework. Proprietary

TIP

See our LSPosed installation guide ↗ for setup instructions.

Metamodules

NOTE

Metamodules provides the core mounting infrastructure for the module system. Unlike regular modules that modify system files, metamodules control how regular modules are installed and mounted.

• ⭐ Mountify - OverlayFS with tmpfs/ext4 sparse support for reduced detection, works on APatch/Magisk too. FOSS [M] [K] [A]
• ⭐ NoMount - Mountless module injection: kernel VFS path redirection with per-app UID isolation and a WebUI, so injected files never appear in /proc/mounts. Needs kernel integration; prebuilt modules cover GKI kernels. FOSS [K] [A]
• Magic Mount Metamodule - An implementation of a metamodule using Magic Mount, based on MKSU. FOSS [M] [K] [A]
• Meta-hybrid_mount - Three-engine mount orchestration (OverlayFS + Magic Mount + Kasumi LKM) with conflict monitor, SolidJS WebUI, auto-fallback, and EROFS storage backend support. FOSS [K] [A]
• NoMount Suite - Mountless module loading on the Prism kernel VFS engine, RRO theme overlays included, classifying every file under /data/adb/modules/ at boot and programming the kernel over netlink. Needs a custom kernel carrying the Prism driver; beta, and OnePlus/Oppo my_* partitions still take a visible bind mount. FOSS [M] [K] [A]
• ZeroMount - Mountless module loading with Kernel-level VFS path redirection & SUSFS integration, WebUI, bootloop guard, and strategy fallback. FOSS [M] [K] [A]

Module Managers

• ⭐ MMRL - An Android app that helps manage your own modules repository. FOSS [M] [K] [A]||
• KPatch Next Module - Standalone implementation of KPM (KernelSU Patch Module) support for Magisk/KernelSU with WebUI. FOSS [M] [K] [A]
• Magisk Manager for Recovery Mode - Easily manage your Magisk Modules from a terminal session in your custom recovery. FOSS [M]
• ScopeView - Shows which LSPosed modules target an app and updates installed modules individually or in batch. Proprietary [LSP]

Root Detection & Testing

• ⭐ Android-Native-Root-Detector - A tool for detecting root on android. FOSS
• ⭐ Duck Detector Fork - Duck Detector fork with additional features and improvements. FOSS
• Android-Device-Trust - Android device attestation and fingerprinting tool. FOSS
• Chunqiu Detector - Solutions, scripts, and modules for bypassing and troubleshooting Chunqiu Detector checks on rooted Android devices. FOSS
• Demo - Asks whether a library is injected into its address space, mounts are missing from its mount table, or a dirty SELinux policy is present; the detection target paired with NeoZygisk. FOSS
• DirtySepolicy - Queries the device SELinux policy from an app zygote and reports the dirty rules injected by userspace root and hooking solutions. FOSS
• Duck Detector - Android environment integrity inspection tool for root, hook, bootloader, SELinux, virtualization, and attestation signals. FOSS
• FOSS Root Checker - Root checker that shows the checks it runs, with an offline build that leaves out the update checker. FOSS
• GarudaDefender - RASP sample that reports root, hooking, emulator, debugger and memory-patch signals, shipped as an APK to test the framework's detection. Proprietary
• Key Attestation - Generates, saves, parses and verifies Android key and ID attestation certificate chains for self-testing and diagnostics. FOSS
• Kknd Root Detector - Deep root, hook framework, SELinux and system integrity detection combining native C++ and Kotlin checks. FOSS
• MagiskDetection - Collection of Some publicly Available POC Apps to Detect Root/Magisk presence. Proprietary
• PIF Detector - Native app designed to detect modifications, bypasses, or "fixes" applied to the Google Play Integrity API. FOSS [M] [K] [A]
• Play Integrity Alert - Get notified when an app calls the Play Integrity API. FOSS [LSP]
• Play Integrity API Checker - This app shows info about your device integrity as reported by Google Play Services. If any of this fails could mean your device is rooted or tampered in a way. FOSS|
• Securify - Yet Another Root Checker and Play Integrity API Application. FOSS
• TB Checker - Safety checker that reports root, hooking, Play Integrity and SafetyNet attestation results. Proprietary
• ZygoteNextProbe - Research probe that checks whether Android 17's zygote_next native isolated services leak a global mount view - potentially exposing Magisk/Zygisk/LSPosed mounts to apps. FOSS

Root Hiding & Play Integrity

What is Play Integrity?

A Google API that lets apps verify a device is "genuine" - unmodified, Play-certified, and bootloader-locked. Apps use it to block rooted/modified devices. Verdicts: MEETS_BASIC_INTEGRITY < MEETS_DEVICE_INTEGRITY < MEETS_STRONG_INTEGRITY.

Why hide root?

Banking, payment, and some streaming/game apps detect root and refuse to run. Hiding root lets them work on a rooted device.

What's realistic in 2026?

Since Google's mid-2025 changes, DEVICE_INTEGRITY requires a locked bootloader on Android 13+, and STRONG_INTEGRITY needs an unrevoked hardware keybox (increasingly scarce). For most rooted users, passing BASIC + DEVICE integrity (via PIF + TrickyStore) is the practical ceiling - chasing STRONG is a deep, often futile rabbit hole.

• ⭐ HMA-OSS - FOSS rewrite of Hide My Applist; hides your app list, settings, and package installers. FOSS [LSP]
• ⭐ Shamiko - Hides Magisk root from detection. Proprietary [M]
• ⭐ TEESimulator - Create a complete, software-based simulation of a hardware-backed Trusted Execution Environment (TEE) for Key Attestation. FOSS [M] [K] [A]
• Always Strong - Bundles TEESimulator-RS and PlayIntegrityFork into a single module for strong integrity on rooted devices. FOSS [M] [K] [A]
• AuditPatch - Hooks logd to replace sensitive SELinux contexts in the audit log, fixing AVC log leak detection without SUSFS or ZygiskNext. Proprietary [M] [K]
• DirtySepolicy Bypass - Bypasses new DirtySepolicy on rooted Android devices to keep apps working. FOSS [M] [K] [A]
• Duck ToolBox - KernelSU, APatch or Magisk module putting Android attestation tooling behind one WebUI: a Tricky Store, TEESimulator and OhMyKeymint configuration manager, a Remote Key Provisioning workbench that builds and verifies CSRs, and a Qualcomm Keymaster device ID provisioner. FOSS [M] [K] [A]
• Komodo Build Props - Spoofs your device as a Pixel 9 Pro XL (komodo). FOSS [M] [A]
• NoHello - Lightweight Zygisk module to hide root. FOSS [M] [A]
• OhMyKeymint - Custom keystore implementation for Android Keystore Spoofer. FOSS [M] [K]
• Play Integrity Fix (inject) - Actively maintained fork using injected GMS/Play Store spoofing with a WebUI. FOSS [M]
• Play Integrity Fork (PIF) - The most actively maintained PIF. Fixes DEVICE_INTEGRITY verdicts with custom fields/props. Recommended starting point after chiteroman's original was discontinued. FOSS [M] [A]
• PlaycurlNEXT - Fixes Play Integrity (and SafetyNet) verdicts with custom fields and props. FOSS [M] [K]
• ReZygisk's Treat Wheel - Hides Magisk/root traces exclusively for ReZygisk, acting as the best userspace root hiding tool. FOSS [M] [K] [A]
• Sensitive Props - Modifies system properties and applies device-specific fixes to bypass SafetyNet/Play Integrity. FOSS [M] [A]
• Specter - Unified Play Integrity and root hiding stack for Android. Successor of Yurikey. FOSS [M] [K] [A]
• TEESimulator-RS - Fork of TEESimulator with native Rust certificate generation, key persistence, and AOSP-compliant attestation behavior. FOSS [M] [K] [A]
• Tricky Addon – Update Target List - KSU WebUI to configure TrickyStore's target.txt. FOSS [K] [A]
• TrickyStore - Modifies the certificate chain for Android key attestation (keybox-based). The original/reference module. Proprietary [M] [K]
• TrickyStore OSS - Open-source alternative to TrickyStore. FOSS [M] [K]
• YuriKey - Systemless module to obtain strong integrity easily. FOSS [M] [K] [A]
• Zygisk Assistant - Zygisk module to hide root on KernelSU, Magisk, and APatch. FOSS [M] [A]

TIP

Combine these with a proper Zygisk implementation for best results.

NOTE

KernelSU hides earlier: unpermitted apps cannot see su, and SUSFS hides paths and mounts in the kernel. That is why the SUSFS tools below list [K] only.

---

Susfs

What is SUSFS?

SUSFS (Systemless User Space File System) is a kernel-level module that allows root-hiding and system modifications without altering the system partition. It provides a stealthy environment for modules to operate, making it harder for apps to detect root or modifications.

• ⭐ SUSFS for KernelSU - Add-on root-hiding service for SUSFS-patched kernels (KernelSU/Next). The core of modern KSU hiding setups. FOSS [K]
• BRENE - SUSFS/KernelSU module for patched kernels with enhanced root hiding & spoofing. FOSS [K]
• SUSFS LKM Loader - Loads SUSFS as a loadable kernel module through ksud, for GKI kernels that carry no SUSFS patches. FOSS [K]
• SUSFS LKM Module - KernelSU ZIP wrapper around a pinned inforcqb SUSFS LKM release, selecting the matching arm64 binary from /proc/sys/kernel/osrelease at install and every boot with no nearest-version fallback. Loader only: rules stay with FolkSU or another chosen configuration tool. FOSS [K]
• ReSuSFS: Removed on author's request

TIP

New to SUSFS? The SUSFS Root Hiding Guide covers requirements, patched kernels versus the loadable kernel module, configuration and verification. For metamodules that avoid mounts entirely, see NoMount.

---

Zygisk

What is Zygisk?

A feature that lets modules inject code into Android's Zygote process for system-level modifications like root hiding and app patching.

• ⭐ Zygisk Next The "Gold Standard" for detection evasion. It is a standalone Zygisk implementation that offers the most advanced stealth features, including a dedicated Zygote Monitor and dashboard. Proprietary [M] [K] [A]
• NeoZygisk A minimalist, high-stealth implementation using ptrace injection. It focuses on "trace cleaning," aiming to remove all injection artifacts from memory once modules are loaded. FOSS [M] [K] [A]
• OnyxZygisk - A ptrace-powered Zygisk implementation with a built-in WebUI, hot-swappable FN modules, and an advanced DenyList. FOSS [M] [K] [A]
• ReZygisk A high-performance implementation entirely rewritten in C. It introduces custom linkers to bypass modern linker-based detections, offering a WebUI for status monitoring and compatibility with Android 15 and 16. FOSS [M] [K] [A]
• VexZygisk - Standalone implementation of Zygisk for KernelSU and APatch. FOSS [M] [K] [A]
• YukiZygisk - A new kernel-level Zygisk implementation designed to explore better, cleaner, and more flexible ways of injecting. FOSS [M] [K] [A]

Comparison table

	Magisk Built-in	Zygisk Next	NeoZygisk	ReZygisk
Key Advantage	Official & simple	Detection evasion	Stealth / cleaning	Speed / open source
License	GPL-3.0	Proprietary	GPL-3.0	GPL-3.0 / AGPL-3.0
Root Support	Magisk only	Magisk, KSU, APatch	Magisk, KSU, KSU Next, APatch	Magisk, KSU, APatch
Hiding Approach	Basic DenyList	ZN Linker + anon memory + Shamiko	Ptrace injection + unmounting	Custom linker + maps hiding
Strengths	✅ Stable, well-documented ✅ Widest arch (incl. x86)	✅ Most feature-rich ✅ Largest community	✅ Hard to trace in memory ✅ Minimal & open	✅ Fastest (native C) ✅ Fully open & auditable
Trade-offs	❌ Magisk-only ❌ Easily detected	❌ Closed source ❌ ZN Linker experimental	❌ 64-bit only ❌ Smaller community	❌ RC phase ❌ Some compat issues