How PRoot Works: A Source-Level Walkthrough
How PRoot works under the hood, a source-level walkthrough of its ptrace-based syscall emulation that fakes a root filesystem without root, with the tools and offsets documented.
Tag: seccomp
Abyss: Intercepting SVC Syscalls on Android with BPF and Seccomp
Abyss: intercepting svc syscalls on Android with BPF and seccomp, a kernel-level approach to syscall hooking that leaves no userspace trace behind, and the code traced down to the core.
A Universal SVC Hook for Android Using seccomp + sigaction
A universal svc hook for Android using seccomp and sigaction, intercepting syscalls with BPF filters to trace or modify kernel calls globally, and the gotchas flagged along the way.
Big-Tech Device Fingerprinting, Part 2: Hunter's Environment Detection Explained
Explaining the Hunter environment-detection SDK used by big-tech anti-fraud: emulator detection, seccomp and binder checks, and how it spots Frida and sandboxes.
A ptrace+seccomp Sandbox for Inline SVC Hooks
Building a ptrace and seccomp sandbox for inline svc hooks, using BPF filters to intercept syscalls tracelessly and read their register arguments, so you can reproduce it yourself.
Frida-Seccomp: Generic svc Tracing and Hooking on Android
A generic Frida-based method to trace and hook svc syscalls on Android using seccomp, including the threading deadlock pitfall and the fix that avoids it.
Getting the MAC Address via netlink and Inline svc — Bypassing Android Permissions
Getting a device's MAC address on Android without any permissions, using a netlink socket and inline svc calls to sidestep the OS's access controls, including the pitfalls and the fix.