kknd Detector

kknd Root Detector is an Android application that performs deep, multi-layer detection of root access, hook frameworks, SELinux policy tampering, and system integrity violations, using both Kotlin and native C++ checks.

Features

Native layer (C++), 71 checks:

- Binary scans: su, root manager packages, suspicious paths - Mount namespace: bind-mounts, overlayfs, namespace isolation - Property tampering: resetprop scan across all partition prop files, __system_property_serial drift, PIF/TrickyStore spoof configs - SELinux: attr/current write probe (root contexts in policy), DirtySepolicy selinux_check_access rule checks - Zygisk / LSPosed: module presence, memory maps, JNI hook traces - Hardware security: keystore attestation, TEE status, boot state

Kotlin layer, 68 checks:

Mirrors the native layer with JVM-level checks: package manager scans, reflection-based SELinux.checkSELinuxAccess, property reads, Play Integrity API integration, and certificate chain validation.

Use cases

- Testing rooted Android devices - Studying root and hook framework detection techniques - Learning Android native security (SELinux, properties, mount namespaces) - Developing root detection in production apps

Interface language:

- English

License

MIT