Magisk is a suite of open-source tools for customizing Android devices, providing systemless root access (MagiskSU), a module framework, boot image patching (MagiskBoot), init process hijacking (MagiskInit), SELinux policy modification (MagiskPolicy), and Zygisk (code injection into the Zygote process). The system is composed of a native daemon (magiskd) written in Rust and C++ that communicates with an Android management app (Magisk Manager) via Unix sockets. The app is built with Kotlin and Jetpack Compose (modern UI) alongside a legacy XML/DataBinding variant, and includes a stub APK mechanism for hiding the app from detection. Key entry points include the native binaries (magisk, magiskinit, magiskboot, magiskpolicy, resetprop, su) and the Android app's MainActivity and SuRequestActivity. The build system is Gradle with custom plugins, orchestrating compilation of Rust, C++, and Kotlin components. Data flows involve the app fetching module updates from GitHub repositories, downloading and installing modules, managing superuser policies stored in a SQLite database (magisk.db), and logging su requests. The daemon handles root requests, module mounting, denylist enforcement, and Zygisk module loading. External dependencies include the Android SDK, NDK, Rust toolchain, and libraries such as Retrofit, OkHttp, Room, Moshi, Wire, and libsu. The codebase demonstrates high craftsmanship with elegant architecture, reusable components (e.g., a standalone CLI argument parsing proc-macro, a full terminal emulator, a download engine), and non-obvious engineering solutions for low-level system manipulation. However, it carries maintenance risks due to its multi-language complexity, reliance on Android internals, and dual UI codebase.
TEESimulator is a system-level Android root tool that intercepts and replaces hardware-backed key attestation for selected apps. It injects native libraries into the keystore daemon (keystore2 on Android 12+, keystore on 10/11) via ptrace, hooks Binder transactions, and routes KeyMint requests to an in-process Rust TA that implements AOSP's kmr-ta with BoringSSL. A Kotlin daemon runs as root, manages profiles (keybox, mode, device identity, patch levels), harvests real device parameters, and provides a WebUI for configuration. The system supports two modes: patch (re-sign real attestation leaf) and generation (mint keys entirely in software). It is designed for Android 10-17, requires root, and is distributed as a Magisk/KernelSU/APatch module. The architecture is a multi-process, multi-language system: a Kotlin control daemon (app_process), native C++ interceptors (keymint, keystore), a Rust TA (teesim-km), and a JavaScript WebUI. Communication between daemon and interceptors uses a custom JSON-based protocol over Unix domain sockets. The daemon harvests real device attestation parameters, resolves per-app profiles, and pushes configuration to the interceptors. The interceptors use PLT hooks (AIBinder_transact, ioctl) to redirect KeyMint/Keystore calls for target apps to the local TA, while forwarding non-target calls to the real hardware. The codebase demonstrates high craftsmanship in its handling of Android internals, with careful version branching, RAII wrappers for ptrace, safe file I/O via base64 heredoc, and a schema-driven WebUI. However, it is heavily dependent on Android API internals and may require updates with each major Android release. The project is actively maintained with recent commits and responsive issue triage.
This repository appears to be the Zygisk Next project, a standalone implementation of Zygisk providing Zygisk API support for KernelSU and a replacement for Magisk's built-in Zygisk. However, the provided file tree contains only metadata files (README, .git, .github issue templates) and no actual source code. Without access to the implementation files (likely C/C++ for Android native modules), it is impossible to verify the architecture, entry points, data flows, or code quality. The README describes requirements and compatibility with KernelSU, Magisk, and APatch, but the code itself is absent from this analysis. The repository has tags (v1.4.4, v1.4.5) and a branch, indicating active development, but the lack of source prevents any meaningful assessment of craftsmanship or reusability.