Add native NoMount and SuSFS integration

[ivanzasilly]

Hi JingMatrix,

I'm opening this to discuss improving stealth against advanced root detection apps like DuckDetector.

It's not uncommon for apps to detect mounts created by Vector, and people have been concerned about it. In this picture below, DuckDetector is detecting dex2oat64 mounts created by Vector.

So I figured why won't Vector automatically integrate with NoMount primarily and SuSFS?

stealth_mount() {
    local src="$1"
    local dst="$2"
    if ! /data/adb/modules/nomount/bin/nm rule add "$dst" "$src"; then
        if mount -o bind "$src" "$dst"; then
            /data/adb/ksu/bin/ksu_susfs add_sus_mount "$dst"
        fi
    fi
}

In this example, the function at first tries to use NoMount to redirect open() requests from $dst to $src at a kernel VFS layer. When that fails, it falls back to the traditional bind mount, then, if it detects a ksu_susfs binary, marks $dst as a suspicious mount with it.

I believe native integration here would make Vector the most stealthy hooking framework available for KernelSU/APatch users.

Regards, IvanZaSilly

[JingMatrix]

Hello. Mount tracing handling is deferred to Zygisk implementations, such as NeoZygisk.

P.S.: susfs is old legacy and NeoZygisk could reach the same level stealth from userspace.