Repository navigation
Releases
Releases · 0xhydraOp/GhostBoot
GhostBoot v1.2.0
v1.1.0
v1.1.0 - Audit fixes + robustness 1-7 (verified build)
Built from master (NDK 28.2, Gradle 8.7, versionCode 103). Native .so compiled warning-free for all 4 ABIs; APK version check passes.
Audit fixes
- Per-fork hook reset + secondary-process (:suffix) targeting (main.cpp)
- Config locking made atomic; empty-target clear; boot intent actions fixed
- Android 14+ FGS subtype declared; honest hook return; 16K page support
- App list off main thread; runtime notification + Usage Access flows
Robustness 1-7
- JNI android.os.Build TAGS/TYPE patch (closes the Java-statics gap)
- Full prop API: get + read + read_callback; 32-bit REL PLT support
- memfd proc filters: mounts/mountinfo (Basic), + maps/smaps/cmdline/packages.list (Aggressive)
- Extended hide paths; settings.conf gates (spoof/root-hide/lsposed/stealth); stealth-gated logging
- Companion: RootShell with checked I/O, settings sync without reboot, Verify card, 5-min watchdog, direct-boot-safe boot
Files
- ghostboot-v1.1.0.zip - Magisk/KernelSU/APatch module (zygisk .so x4)
- ghostboot-companion-debug.apk - companion app (debug)
Previous v1.0.2 release notes and baselines are unchanged; see README + project_spec.
v1.0.2 — Comprehensive code review fixes
v1.0.2 — Comprehensive Code Review Fixes
17 improvements from full code audit. Fixes include crash guards, robustness improvements, dead code removal, and battery optimizations.
Native C++ (Zygisk module)
| Fix | File |
|---|---|
ps -A fallback to ps -e for older ROMs |
customize.sh |
getprop || true guards for set -eu safety |
customize.sh |
st_name offset bounds check (>1MB heuristic) |
property_hook.cpp |
logcat logging via __android_log_print |
property_hook.cpp, main.cpp |
Check apply_property_hooks return value |
main.cpp |
Removed dead g_env pointer |
main.cpp |
list() returns copy instead of dangling reference |
config.cpp, ghostboot.hpp |
mprotect failure logging with errno |
property_hook.cpp |
Shell scripts
| Fix | File |
|---|---|
Retry loop (5 attempts) for am startservice |
service.sh |
ps -A fallback ps -e for Zygisk detection |
customize.sh |
Kotlin companion app
| Fix | File |
|---|---|
| Exact package match for banking detection | MainActivity.kt |
| System package blacklist (prevents accidental system hook) | MainActivity.kt |
| Target list write deduplication (no redundant I/O) | GhostBootService.kt |
Removed dead SOCKET_PATH constant |
GhostBootService.kt |
Metadata
| Fix | File |
|---|---|
| Version bump to v1.0.2 (versionCode 102) | module.prop |
v1.0.1: Fix: crash when hooking target apps on ARM64 Android 14+
v1.0.1 — Crash Fix
Fixes crash on ARM64 Android 14+ when hooking target apps.
What was wrong:
__builtin___clear_cacheon GOT data addresses triggered MTE/tagged-pointer abort in libcmprotectreturn value was unchecked — if page couldn't be made writable (SELinux/seccomp), write caused SIGSEGV
What changed:
- Removed
__builtin___clear_cachecall (not needed for GOT data writes; mprotect barriers suffice) - Check
mprotectreturn value; skip GOT entry gracefully on failure - Null-guard on
orig_prop_getbefore forwarding calls - Mount hiding re-enabled
To update: Download the new zip, re-flash in Magisk, reboot.
v1.0
GhostBoot v1.0 — Per-app bootloader spoof & root hide for Android 10-15.
Installation:
- Flash ghostboot-v1.0.zip in Magisk/KernelSU/APatch
- Reboot
- Install ghostboot-companion-debug.apk
- Open GhostBoot, select banking apps, start service
Requirements: Magisk 26.0+ (Zygisk), Android 10-15, arm64-v8a
What it does:
- Spoofs bootloader properties (ro.boot.verifiedbootstate → green)
- Hides /data/adb, su binaries, LSPosed files from target apps
- Per-app targeting via companion app
- Zero traces after app closes