Root Management

Root management covers everything you need to install, run and maintain root on your Android device: root managers for Magisk, KernelSU and APatch, temporary root solutions for locked-bootloader devices, module managers and metamodules, the LSPosed/Xposed and Zygisk frameworks, and the tools that keep root hidden from apps (Play Integrity, SUSFS). Apps and modules live together here because they solve the same problem - controlling root access.

TIP

New to rooting? Read the Complete Rooting Guide first, then come back for the tools.

Root Managers

• ⭐ KernelSU - A Kernel based root solution for Android. FOSS
• ⭐ Magisk - Manage Magisk modules and root permissions. FOSS
• APatch - The patching of Android kernel and Android system. FOSS|
• FolkPatch - A Root management tool focused on interface optimization and feature extension, based on APatch. FOSS
• KernelSU-next - An advanced Kernel based root solution for Android. FOSS
• ReSukiSU - Fork of SukiSU-Ultra with additional features. FOSS
• SukiSU-Ultra - A kernel-based root solution for Android devices, forked from KernelSU with some useful changes. FOSS

Temporary Root (Locked Bootloader)

What is temporary root (GhostLock)?

Exploits like GhostLock (CVE-2026-43499) - a 15-year-old Linux kernel bug - grant root in memory only, for the current boot. No bootloader unlock, no flashing, no Knox trip, no data wipe: reboot and the device is bone-stock again. The trade-offs: root doesn't survive reboots, you can't flash ROMs/recoveries, and it only works on specific devices running firmware up to ~the June 2026 patch level.

• ⭐ Root My Galaxy - One-tap temporary root for Snapdragon Galaxy flagships (S24/S25 series, S24 FE, A56...) via GhostLock; bootloader stays locked, Knox isn't tripped. FOSS
• GhostLock App - One-tap execution app for the GhostLock (CVE-2026-43499) exploit. FOSS
• GhostLock-5.10 - GhostLock kernel root exploit for some 5.X-kernel devices, mostly Amazon (from the Kaeru/Fenrir developer). FOSS
• GhostLock-Galaxy - GhostLock app for the Samsung Galaxy Z Fold6 (kernel 6.1); stages via Shizuku or adb shell with per-kernel offset matching. FOSS
• ghostlock-oneplus - GhostLock kernel exploit for OnePlus/OPPO/realme (and some Xiaomi) devices with locked bootloader; installs KernelSU with runtime kernel auto-detection. FOSS
• IonStack-S22U - Full CVE-2026-43499 exploit chain for the Samsung Galaxy S22 Ultra (5.10 kernel). FOSS
• iQOO Z9 5G / vivo T3 5G Root - One-tap root app and payloads for the iQOO Z9 5G and vivo T3 5G (Dimensity 7200, kernel 5.15). FOSS
• oppo-ghostlock - GhostLock exploit adaptation for the OPPO Find N2. FOSS
• pixel-ksu-root - ADB-driven KernelSU loader for stock Pixels; temporary kernel R/W via GhostLock, then late-loads a signature-matched kernelsu.ko. Manager-agnostic. FOSS
• QuestStack - Unlocks the Meta Quest 1 bootloader and gains root using GhostLock + CVE-2021-1931. FOSS
• Root My Device - Community fork of Root My Galaxy generalized beyond Samsung, with its own payload feed. FOSS
• Root-My-Galaxy-Payloads - Signed device profiles, exploit payloads, and KernelSU artifacts that Root My Galaxy fetches at runtime. FOSS
• Root My Pixel - Jailbreak supported Google Pixel phones with GhostLock; stages the payload via Shizuku, no PC needed. FOSS

TIP

See the dedicated guide Root Without Unlocking the Bootloader for what GhostLock can and can't do, device support, and every app, exploit port, and research project. Also see Bootloader Mods & Temporary Root Solutions for related locked-bootloader approaches (Kaeru, Fenrir).

Module Managers

• ⭐ MMRL - An Android app that helps manage your own modules repository. FOSS [M] [K] [A]||
• KPatch Next Module - Standalone implementation of KPM (KernelSU Patch Module) support for Magisk/KernelSU with WebUI. FOSS [M] [K]
• Magisk Manager for Recovery Mode - Easily manage your Magisk Modules from a terminal session in your custom recovery. FOSS [M]

Metamodules

NOTE

Metamodules provides the core mounting infrastructure for the module system. Unlike regular modules that modify system files, metamodules control how regular modules are installed and mounted.

• ⭐ Meta-overlayfs - Official reference implementation using OverlayFS for most users and standard setup. FOSS [K]
• ⭐ Mountify - OverlayFS with tmpfs/ext4 sparse support for reduced detection, works on APatch/Magisk too. FOSS [M] [K] [A]
• Magic Mount Metamodule - An implementation of a metamodule using Magic Mount, based on MKSU. FOSS [M] [K] [A]
• Meta-hybrid_mount - Three-engine mount orchestration (OverlayFS + Magic Mount + Kasumi LKM) with conflict monitor, SolidJS WebUI, auto-fallback, and EROFS storage backend support. FOSS [K] [A]
• meta-mm - The official KernelSU Modules Repo's Magic Mount metamodule. Lighter alternative to meta-magic_mount for users who just want Magisk-compatible mounting without extra tooling. FOSS [K]
• ZeroMount - Mountless module loading with Kernel-level VFS path redirection & SUSFS integration, WebUI, bootloop guard, and strategy fallback. FOSS [M] [K] [A]

LSPosed & Xposed

NOTE

LSPosed allows you to use Xposed modules, that can modify or extend the functionality of your Android system and apps.

• ⭐ Vector - Open Source Fork of original LSPosed with dynamic module loading, and other improvements. FOSS [M]
• LSPosed - A Riru / Zygisk module that provides an ART hooking framework delivering consistent APIs with the OG Xposed, leveraging the LSPlant hooking framework. Proprietary

TIP

See our LSPosed installation guide for setup instructions.

Zygisk

What is Zygisk?

A feature that lets modules inject code into Android's Zygote process for system-level modifications like root hiding and app patching.

• ⭐ Zygisk Next The "Gold Standard" for detection evasion. It is a standalone Zygisk implementation that offers the most advanced stealth features, including a dedicated Zygote Monitor and dashboard. Proprietary [M] [K] [A]
• NeoZygisk A minimalist, high-stealth implementation using ptrace injection. It focuses on "trace cleaning," aiming to remove all injection artifacts from memory once modules are loaded. FOSS [M] [K] [A]
• ReZygisk A high-performance implementation entirely rewritten in C. It introduces custom linkers to bypass modern linker-based detections, offering a WebUI for status monitoring and compatibility with Android 15 and 16. FOSS [M] [K] [A]

Comparison table

	Magisk Built-in	Zygisk Next	NeoZygisk	ReZygisk
Key Advantage	Official & simple	Detection evasion	Stealth / cleaning	Speed / open source
License	GPL-3.0	Proprietary	GPL-3.0	GPL-3.0 / AGPL-3.0
Root Support	Magisk only	Magisk, KSU, APatch	Magisk, KSU, KSU Next, APatch	Magisk, KSU, APatch
Hiding Approach	Basic DenyList	ZN Linker + anon memory + Shamiko	Ptrace injection + unmounting	Custom linker + maps hiding
Strengths	✅ Stable, well-documented ✅ Widest arch (incl. x86)	✅ Most feature-rich ✅ Largest community	✅ Hard to trace in memory ✅ Minimal & open	✅ Fastest (native C) ✅ Fully open & auditable
Trade-offs	❌ Magisk-only ❌ Easily detected	❌ Closed source ❌ ZN Linker experimental	❌ 64-bit only ❌ Smaller community	❌ RC phase ❌ Some compat issues

TIP

Use these for Zygisk features on KernelSU/APatch, or for more control than Magisk's built-in provides.

Root Hiding & Play Integrity

What is Play Integrity?

A Google API that lets apps verify a device is "genuine" - unmodified, Play-certified, and bootloader-locked. Apps use it to block rooted/modified devices. Verdicts: MEETS_BASIC_INTEGRITY < MEETS_DEVICE_INTEGRITY < MEETS_STRONG_INTEGRITY.

Why hide root?

Banking, payment, and some streaming/game apps detect root and refuse to run. Hiding root lets them work on a rooted device.

What's realistic in 2026?

Since Google's mid-2025 changes, DEVICE_INTEGRITY requires a locked bootloader on Android 13+, and STRONG_INTEGRITY needs an unrevoked hardware keybox (increasingly scarce). For most rooted users, passing BASIC + DEVICE integrity (via PIF + TrickyStore) is the practical ceiling - chasing STRONG is a deep, often futile rabbit hole.

Susfs

What is SUSFS?

SUSFS (Systemless User Space File System) is a kernel-level module that allows root-hiding and system modifications without altering the system partition. It provides a stealthy environment for modules to operate, making it harder for apps to detect root or modifications.

• ⭐ SUSFS for KernelSU - Add-on root-hiding service for SUSFS-patched kernels (KernelSU/Next). The core of modern KSU hiding setups. FOSS [M] [K]
• RENE - SUSFS/KernelSU module for patched kernels with enhanced root hiding & spoofing. FOSS [M] [K]
• ReSuSFS - SUSFS/KernelSU module for patched kernels with modern ui and configuration options. FOSS [M] [K]

Click for detailed comparison

	BRENE	ReSuSFS
Root hiding	Excellent	Excellent
SuSFS utilization	Excellent	Excellent
Mount/path hiding	Excellent	Excellent
Property/boot spoofing	Excellent	Very good
Memory-map hiding	Very good	Excellent
Configuration/extensibility	Good	Excellent
Code architecture	Complex/opinionated	Cleaner/modular
Competing-module behavior	Aggressive; automatically removes ReSuSFS/PIF variant	No equivalent behavior identified
Security/trust assessment	⚠️ Requires caution/audit	Better
Overall recommendation	Powerful but questionable design choice	🏆 Preferred

• ⭐ HMA-OSS - FOSS rewrite of Hide My Applist; hides your app list, settings, and package installers. FOSS [LSP]
• ⭐ TEESimulator - Create a complete, software-based simulation of a hardware-backed Trusted Execution Environment (TEE) for Key Attestation. FOSS [M] [K]
• ⭐ Shamiko - Hides Magisk root from detection. Proprietary [M]
• Always Strong - Bundles TEESimulator-RS and PlayIntegrityFork into a single module for strong integrity on rooted devices. FOSS [M] [K]
• DirtySepolicy Bypass - Bypasses new DirtySepolicy on rooted Android devices to keep apps working. FOSS [M] [K] [A]
• Hide My Applist - Intercepts app-list detection. Proprietary [LSP]
• Komodo Build Props - Spoofs your device as a Pixel 9 Pro XL (komodo). FOSS [M]
• NoHello - Lightweight Zygisk module to hide root. FOSS [M]
• OhMyKeymint - Custom keystore implementation for Android Keystore Spoofer. FOSS [M] [K]
• Play Integrity Fix (inject) - Actively maintained fork using injected GMS/Play Store spoofing with a WebUI. FOSS [M]
• Play Integrity Fork (PIF) - The most actively maintained PIF. Fixes DEVICE_INTEGRITY verdicts with custom fields/props. Recommended starting point after chiteroman's original was discontinued. FOSS [M]
• PlaycurlNEXT - Fixes Play Integrity (and SafetyNet) verdicts with custom fields and props. FOSS [M] [K]
• ReZygisk's Treat Wheel - Hides Magisk/root traces exclusively for ReZygisk, acting as the best userspace root hiding tool. FOSS [M] [K]
• Sensitive Props - Modifies system properties and applies device-specific fixes to bypass SafetyNet/Play Integrity. FOSS [M]
• Specter - Unified Play Integrity and root hiding stack for Android. Successor of Yurikey. FOSS [M] [K]
• TEESimulator-RS - Fork of TEESimulator with native Rust certificate generation, key persistence, and AOSP-compliant attestation behavior. FOSS [M] [K]
• Tricky Addon – Update Target List - KSU WebUI to configure TrickyStore's target.txt. FOSS [K]
• TrickyStore - Modifies the certificate chain for Android key attestation (keybox-based). The original/reference module. Proprietary [M] [K]
• TrickyStore OSS - Open-source alternative to TrickyStore. FOSS [M] [K]
• YuriKey - Systemless module to obtain strong integrity easily. FOSS [M] [K]
• Zygisk Assistant - Zygisk module to hide root on KernelSU, Magisk, and APatch. FOSS [M]

TIP

Combine these with a proper Zygisk implementation for best results.

Bootloop Protection

• Anti bootloop - Protect from bootloops. FOSS [M]
• AshReXcue - Bootloop Protector - Prevent boot loops caused by problematic modules installed via KernelSU or Magisk. FOSS [M] [K]
• YetAnotherBootloopProtector - Monitor and fix potential Bootloops and SystemUI failures. FOSS [M]

Root Detection & Testing

• ⭐ Android-Native-Root-Detector - A tool for detecting root on android. FOSS
• ⭐ Duck Detector Fork - Duck Detector fork with additional features and improvements. FOSS
• Android-Device-Trust - Android device attestation and fingerprinting tool. FOSS
• Chunqiu Detector - Solutions, scripts, and modules for bypassing and troubleshooting Chunqiu Detector checks on rooted Android devices. FOSS
• Duck Detector - Android environment integrity inspection tool for root, hook, bootloader, SELinux, virtualization, and attestation signals. FOSS
• MagiskDetection - Collection of Some publicly Available POC Apps to Detect Root/Magisk presence. Proprietary
• PIF Detector - Native app designed to detect modifications, bypasses, or "fixes" applied to the Google Play Integrity API. FOSS [M] [K]
• Play Integrity Alert - Get notified when an app calls the Play Integrity API. FOSS [LSP]
• Play Integrity API Checker - This app shows info about your device integrity as reported by Google Play Services. If any of this fails could mean your device is rooted or tampered in a way. FOSS|
• Securify - Yet Another Root Checker and Play Integrity API Application. FOSS
• ZygoteNextProbe - Research probe that checks whether Android 17's zygote_next native isolated services leak a global mount view - potentially exposing Magisk/Zygisk/LSPosed mounts to apps. FOSS