susfs4ksu-module

Overview

Created by sidex15, SUSFS (Super User Secret File System) represents a generational leap in root concealment.

Traditional hiding tools (like Shamiko or Magisk DenyList) operate in userspace. They rely on libc hooking, ptrace, or mount namespace unmounting within the target application’s process. However, advanced anti-root engines can bypass userspace hooks by invoking direct raw assembly syscalls (e.g., svc #0 in ARM64) to query the kernel directly, reading /proc/self/mountinfo or opening /data/adb directly.

SUSFS solves this by moving hiding logic directly into the Linux Kernel. Because the kernel is the ultimate authority over all filesystem and process queries, userspace applications cannot bypass kernel-level filtering regardless of what syscalls they execute.

Technical Architecture & How It Works

Kernel-Space Filesystem Interception

1. VFS Syscall Hooking: SUSFS patches core Virtual File System (VFS) functions in the Linux kernel:
   • vfs_read and show_mountinfo: Automatically filters out any mount point created by KernelSU or APatch before formatting /proc/[pid]/mounts or /proc/[pid]/mountinfo.
   • vfs_statx / vfs_getattr: Intercepts file attribute queries. When an app checks /data/adb/ksu or /system/bin/su, the kernel responds with ENOENT (No such file or directory) unless the calling process is a verified root manager.
2. Kstat Spoofing: Detection apps check inode metadata (modification dates, hardlink counts). SUSFS spoofs inode timestamps so system partitions appear unmounted and unmodified.
3. Module Companion: The susfs4ksu-module acts as the userspace bridge, reading module configurations at boot and sending ioctl commands to the kernel to register paths, loop devices, and processes that must be concealed.

Prerequisites & Installation

Step 1: Flash a SUSFS-Patched Kernel

Before installing this module, your device must be running a kernel built with SUSFS support:

1. Locate a custom kernel for your device model that includes SUSFS patches (e.g. WildKSU, GKI SUSFS, or your own compiled build).
2. Flash the kernel via fastboot or recovery:

   fastboot flash boot boot.img

Step 2: Flash the SUSFS Module

1. Open KernelSU or APatch.
2. Go to Modules $\rightarrow$ Install $\rightarrow$ select susfs4ksu-module-vX.zip.
3. Reboot your device.

Step 3: Verify Kernel Status

Run the following diagnostic command via terminal:

su -c "ksu_susfs show_version"

You should see: ksu_susfs version: v1.5.x (or newer).

Configuration & Custom Path Hiding

The module companion tool (ksu_susfs) allows dynamic configuration:

# Hide a specific custom path from untrusted apps:
su -c "ksu_susfs add_sus_path /data/local/tmp/my_tool"

# Hide a custom loop mount:
su -c "ksu_susfs add_sus_mount /system/etc/hosts"

# Check currently hidden mounts:
su -c "ksu_susfs show_sus_mount"