ReSukiSU Ultima

English | 简体中文

A based-on SukiSU-Ultra/SukiSU-Ultra fork, added some interesting changes, also make it more stable and build easily.

Features

1. Kernel-based su and root access management
2. Module system based on metamodules: Pluggable infrastructure for systemless modifications.
3. App Profile: Lock up the root power in a cage
4. Support non-GKI and GKI 1.0
5. KPM Support
6. Tweaks to the manager theme and the built-in susfs management tool.
7. Multi manager support, for default Official KernelSU/RKSU/MKSU/SukiSU is supported work as manager with ReSukiSU Ultima's kernel
8. Sentinel: kernel-side root-probe detection with per-app cloaking and optional su-request notifications.
9. Built-in Zygisk: a self-contained, ptrace-based Zygisk implementation - run Zygisk modules without a separate Zygisk provider.

Compatibility Status

• ReSukiSU Ultima officially supports Android GKI 2.0 devices (kernel 5.10+).

• Older kernels (3.4+) are also compatible, but the kernel will have to be built manually.

• Currently, only arm64-v8a, armeabi-v7a and X86_64are supported.

• SuSFS in this project is Only support backport to kernel 4.3+

• Tracepoint Syscall Redirect hook is only support with GKI2(5.10+) kernel

Hook Mode

• Tracepoint Syscall Redirect hook The default hook mode, from upstream, but its only support GKI2 kernel with arm64-v8a or x86_64 ABI
• Manual Hook The most compatible Hook, support from Linux kernel 3.4 to Linux kernel 6.18
• SuSFS Inline Hook An hook from SuSFS, like Manual Hook, but provide from SuSFS project, not this project

Integration

See the repository.

KPM Support

• Based on KernelPatch, we removed features redundant with KSU and retained only KPM support.
• Work in Progress: Expanding APatch compatibility by integrating additional functions to ensure compatibility across different implementations.

Open-source repository: https://github.com/ShirkNeko/SukiSU_KernelPatch_patch

KPM template: https://github.com/udochina/KPM-Build-Anywhere

Note

1. Requires CONFIG_KPM=y
2. Non-GKI devices requires CONFIG_KALLSYMS=y and CONFIG_KALLSYMS_ALL=y
3. For kernels below 4.19, backporting from set_memory.h from 4.19 is required.

Sentinel

Sentinel is a kernel-side root-probe detector. It watches for apps that probe for root - e.g. access("/system/bin/su"), magisk/ksu path checks, packages.list enumeration - and streams those probe events to the manager, where you can review them and cloak the offending app. Cloaking hides root from that app by reusing the existing App Profile enforcement (umount + root-deny), so a detector sees a clean, unrooted device.

• Recent Probes: a live feed on the Sentinel screen showing which apps probed for root and what they looked for.
• Auto-cloak: automatically cloak any new app that probes for root.
• Notify on root requests: instead of auto-cloaking, get a notification when a non-cloaked app probes for su, with one-tap Grant / Cloak / Ignore. A cloaked app never notifies. (Auto-cloak and Notify are mutually exclusive.)

Detection is opt-in at runtime from the manager's Sentinel screen; kernel overhead is negligible when it is off.

Note

1. Requires CONFIG_KSU_SENTINEL=y (enabled by default; depends on KSU).
2. Cloak enforcement reuses App Profile, so no extra config is needed.

Built-in Zygisk

ReSukiSU Ultima ships its own self-contained Zygisk implementation ("Zygisk-Ultima"), so Zygisk modules work without installing a separate Zygisk provider. It is a ptrace-based injector deployed under ksud (not as a module) and is off by default - enable it from the manager's settings, then reboot. The launch hook installed in post-fs-data.d doubles as a kill-switch: if anything ever goes wrong, deleting it disables Zygisk on the next boot.

This engine is adapted from ReZygisk by The PerformanC Organization (GPL-3.0) - huge thanks to them for keeping it open source.

Note

1. Off by default; toggle it in the manager and reboot to apply.
2. No extra kernel config is required.

Sponsor

• ShirkNeko (maintainer of SukiSU)
• weishu (author of KernelSU)

ShirkNeko's sponsorship list

• Ktouls Thanks so much for bringing me support.
• zaoqi123 Thanks for the milk tea.
• wswzgdg Many thanks for supporting this project.
• yspbwx2010 Many thanks.
• DARKWWEE 100 USDT
• Saksham Singla Provide and maintain the website
• OukaroMF Donation of website domain name

License

• The file in the “kernel” directory is under GPL-2.0-only license.
• The images of the files ic_launcher(?!.*alt.*).* with anime character sticker are copyrighted by 怡子曰曰, the Brand Intellectual Property in the images is owned by 明风 OuO, and the vectorization is done by @MiRinChan. Before using these files, in addition to complying with Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International, you also need to comply with the authorization of the two authors to use these artistic contents.
• Except for the files or directories mentioned above, all other parts are under GPL-3.0 or later license.

Credit

• SukiSU-Ultra/SukiSU-Ultra： upstream
• ReZygisk by The PerformanC Organization: the open-source (GPL-3.0) ptrace-based Zygisk implementation our built-in Zygisk engine is adapted from. Thank you for keeping it open source.

SukiSU's credit

• KernelSU: upstream
• MKSU: Magic Mount
• RKSU: support non-GKI
• susfs: An addon root hiding kernel patches and userspace module for KernelSU.
• KernelPatch: KernelPatch is a key part of the APatch implementation of the kernel module

KernelSU's credit

• Kernel-Assisted Superuser: The KernelSU idea.
• Magisk: The powerful root tool.
• genuine: APK v2 signature validation.
• Diamorphine: Some rootkit skills.