Suspicious ^80% android Download

app_profile.c

Syscall hooking and credential manipulation

Code mentions syscall hookingLinux struct cred usage

SHA-2568ec3e7ca23ed2e22458d47ea506fda39e84c4605f086a4c4e29829a17ae8cca2

Evidence

Code mentions syscall hooking lines 15–17

15#include "selinux/selinux.h"
16#include "su_mount_ns.h"
17#include "syscall_hook_manager.h"

Linux struct cred usage lines 33–37

33 * still gets root — just without custom supplementary groups.
34 */
35void setup_groups(struct root_profile *profile, struct cred *cred)
36{
37    if (profile->groups_count > KSU_MAX_GROUPS) {

Linux task_struct usage line 74

74void seccomp_filter_release(struct task_struct *tsk);

prepare_creds primitive reference lines 123–125

  cred = prepare_creds();
  if (!cred) {
      pr_warn("prepare_creds failed!\n");

commit_creds primitive reference line 164

164    commit_creds(cred);