kernel.zip
SKRoot Pro 奥创版 (Ultron Edition) V3.0
Linux 6.6内核专用 - ARM64
Phase 1: 内存安全 + 块复制 + 缓存刷新 + 错误码
Phase 2: 进程隐藏 + SELinux增强 + 反检测
Phase 3: prctl通信 + dm-verity绕过
输入文件：kernel
文件大小：36526592 bytes
Find the current Linux kernel version: 6.6.89
code_static_start: 0x10000
fisrt kallsyms_offset_start: 0x1495418
fisrt kallsyms_offset_end: 0x14ffd20
kallsyms_relative_base: 0xffffffc080000000, offset: 0x14ffd20
current kallsyms_num: 0x1aa42, offset: 0x1320630
kallsyms_offset_start: 0x1495418
kallsyms_offset_end: 0x14ffd20
kallsyms_names_start: 0x1320638
kallsyms_names_end: 0x14947d2
kallsyms_markers_start: 0x14947d8
kallsyms_markers_end: 0x1494e84
kallsyms_token_table_start: 0x1494e88
kallsyms_token_table_end: 0x1495216
kallsyms_token_index_start: 0x1495218
kallsyms_seqq_of_names_list_start: 0x14ffd28
kallsyms_seqq_of_names_list_end: 0x154fbee
Failed on cs_open() with error returned: 8
Failed on cs_open() with error returned: 8
Failed on cs_open() with errror returned: 8
Failed on cs_open() with error returned: 8
Failed on cs_open() with error return: 8
_text:0
_s text:10000
die:212c4, size:0
arm64_notify_die:217b4, size:0
__drm_printfn_ceredump:8ed54c, size:0
__do_execve_file:0
do_execve_common:3d0980
do_execve_common:0
do_execve:0
avc_denied:628f74, size:0
audit_log_start:1c54f0
filldir64:3e16a8
sys_getuid:cc594, size:0
prctl_get_seccomp:1d9dfc, size:0
__cfi_check:0, size:0
__cfi_check_fail:0
__cfi_slowpath_diag:0
__cfi_slowpath:0
__ubsan_handle_cfi_check_fail_abort:0
__ubsan_handle_cfi_check_fail:0
report_cfi_failure:2a96a8
module_alloc:2fa64
module_memfree:177764
kallsyms_lookup_name:1a7e50
vfree:34d508
proc_pid_readdir:472610
find_task_by_vpid:da56c
selinux_enforcing:0
selinux_state:2326ea0
proc_fill_cache:4721d8, size:0
sys_prctl:0
__arm64_sys_prctl:cdbb4
sys_call_table:1080cb0
compat_sys_call_table:10873a8
=== 关键符号 ===
sys_getuid: offset=0xc59f4, size=0x0
prctl_get_seccomp: offset=0xd9dfc, size=0x0
die: offset=0x212c4, size=0x0
arm64_notify_die: offset=0x217b4, size=0x0
__drm_printfn_coredump: offset=0x8ed54c, size=0x0
do_execveat_common: 0x3d0980
avc_denied: offset=0x628f74, size=0x0
audit_log_start: 0x1c54f0
filldir64: 0x3e16a8
=== Pro版模块系统符号 ===
kallsyms_lookup_name: 0x1a7e50 [OK]
module_alloc: 0x2fa64 [OK]
module_memfree: 0x177764 [OK]
vfree(备用): 0x34d508 [OK]
=== 奥创版增强符号 ===
sys_prctl: 0x0 [未找到]
__arm64_sys_prctl: 0xcdbb4 [OK]
selinux_enforcing: 0x0 [未找到]
sys_call_table: 0x1080cb0 [OK]
Failed on cs_open() with error returned: 8
无法解析cred偏移
内核版本检测为 6.6.89，但随后 cs_open 失败（错误码 8），导致无法解析 cred 偏移。
内核文件是从手机 boot.img 中通过 magiskboot unpack 提取的，文件格式为 Linux kernel ARM64 boot executable Image。
希望作者协助分析原因。最后附上原boot提取的kernel文件
kernel.zip
kernel.zip
SKRoot Pro 奥创版 (Ultron Edition) V3.0
Linux 6.6内核专用 - ARM64
Phase 1: 内存安全 + 块复制 + 缓存刷新 + 错误码
Phase 2: 进程隐藏 + SELinux增强 + 反检测
Phase 3: prctl通信 + dm-verity绕过
输入文件：kernel
文件大小：36526592 bytes
Find the current Linux kernel version: 6.6.89
code_static_start: 0x10000
fisrt kallsyms_offset_start: 0x1495418
fisrt kallsyms_offset_end: 0x14ffd20
kallsyms_relative_base: 0xffffffc080000000, offset: 0x14ffd20
current kallsyms_num: 0x1aa42, offset: 0x1320630
kallsyms_offset_start: 0x1495418
kallsyms_offset_end: 0x14ffd20
kallsyms_names_start: 0x1320638
kallsyms_names_end: 0x14947d2
kallsyms_markers_start: 0x14947d8
kallsyms_markers_end: 0x1494e84
kallsyms_token_table_start: 0x1494e88
kallsyms_token_table_end: 0x1495216
kallsyms_token_index_start: 0x1495218
kallsyms_seqq_of_names_list_start: 0x14ffd28
kallsyms_seqq_of_names_list_end: 0x154fbee
Failed on cs_open() with error returned: 8
Failed on cs_open() with error returned: 8
Failed on cs_open() with errror returned: 8
Failed on cs_open() with error returned: 8
Failed on cs_open() with error return: 8
_text:0
_s text:10000
die:212c4, size:0
arm64_notify_die:217b4, size:0
__drm_printfn_ceredump:8ed54c, size:0
__do_execve_file:0
do_execve_common:3d0980
do_execve_common:0
do_execve:0
avc_denied:628f74, size:0
audit_log_start:1c54f0
filldir64:3e16a8
sys_getuid:cc594, size:0
prctl_get_seccomp:1d9dfc, size:0
__cfi_check:0, size:0
__cfi_check_fail:0
__cfi_slowpath_diag:0
__cfi_slowpath:0
__ubsan_handle_cfi_check_fail_abort:0
__ubsan_handle_cfi_check_fail:0
report_cfi_failure:2a96a8
module_alloc:2fa64
module_memfree:177764
kallsyms_lookup_name:1a7e50
vfree:34d508
proc_pid_readdir:472610
find_task_by_vpid:da56c
selinux_enforcing:0
selinux_state:2326ea0
proc_fill_cache:4721d8, size:0
sys_prctl:0
__arm64_sys_prctl:cdbb4
sys_call_table:1080cb0
compat_sys_call_table:10873a8
=== 关键符号 ===
sys_getuid: offset=0xc59f4, size=0x0
prctl_get_seccomp: offset=0xd9dfc, size=0x0
die: offset=0x212c4, size=0x0
arm64_notify_die: offset=0x217b4, size=0x0
__drm_printfn_coredump: offset=0x8ed54c, size=0x0
do_execveat_common: 0x3d0980
avc_denied: offset=0x628f74, size=0x0
audit_log_start: 0x1c54f0
filldir64: 0x3e16a8
=== Pro版模块系统符号 ===
kallsyms_lookup_name: 0x1a7e50 [OK]
module_alloc: 0x2fa64 [OK]
module_memfree: 0x177764 [OK]
vfree(备用): 0x34d508 [OK]
=== 奥创版增强符号 ===
sys_prctl: 0x0 [未找到]
__arm64_sys_prctl: 0xcdbb4 [OK]
selinux_enforcing: 0x0 [未找到]
sys_call_table: 0x1080cb0 [OK]
Failed on cs_open() with error returned: 8
无法解析cred偏移
内核版本检测为 6.6.89，但随后 cs_open 失败（错误码 8），导致无法解析 cred 偏移。
内核文件是从手机 boot.img 中通过 magiskboot unpack 提取的，文件格式为 Linux kernel ARM64 boot executable Image。
希望作者协助分析原因。最后附上原boot提取的kernel文件
kernel.zip