KernelPatch Module (KPM)

About 1133 wordsAbout 4 min

2025-12-23

FolkPatch is based on secondary development of . depends on , inherits all its features and extends them. Therefore, FolkPatch also supports using Modules (). Below are instructions for using .

What is ?

is a module running in kernel space, allowing code to run directly in kernel space, similar to Loadable Kernel Modules (), but loaded through 's mechanism.

is in ELF format, built using the aarch64-none-elf- toolchain, and loaded into the kernel via sc_kpm_load() . Each declares metadata such as KPM_NAME and KPM_VERSION, and implements lifecycle callbacks such as KPM_INIT, KPM_CTL0, KPM_CTL1, and KPM_EXIT.

can use 's inline hook (hook, hook_wrap) and syscall hook (hook_syscalln, fp_hook_syscalln) capabilities, as well as access kernel symbols through kallsyms_lookup_name().

Through , you can implement some functions that cannot achieve, such as:

Partition image protection (format interception)
Kernel-level hiding
Syscall monitoring and modification
Kernel function hooking

How to Install ?

There are three ways to install : Embed, Load, and Install.

About "Install"

Currently, FolkPatch has not implemented the "Install" operation for , because its upstream has not implemented it yet. Therefore, at this stage, FolkPatch's can only be installed via "Embed" and "Load". and developers are working hard to implement related functions, please wait patiently.

Embed

Embed refers to embedding directly into the kernel. installed in this mode will be merged into boot.img together with kernel and loaded during the pre-kernel-init stage.

embedding can be done when patching boot.img using FolkPatch Manager for the first time or after FolkPatch installation is complete. You can also use kptools to manually embed.

Embed at First Patching

Follow the automatic patching process in the Installation Guide. Do not immediately proceed to the next step after setting SuperKey.
Click the "Embed Module" button, then select the file you want to embed (suffix is .kpm).
Confirm that the to be embedded is the one you want to use.
Complete the remaining "Automatic Patching" process.

Embed After Installing FolkPatch

After FolkPatch is installed, the way to embed is roughly the same as installing . You can click the button in the lower right corner of the "Kernel Module" interface, select "Embed", and the subsequent steps can be carried out with reference to Embed at First Patching.

注意

Embedded will not be updated until boot.img is re-patched. If you need to update an embedded , you need to re-run the patching process.

Load

Load refers to handing over to the kernel for loading immediately. loaded in this way will take effect immediately, but will disappear after the next restart (non-persistent).

The way to load is roughly the same as installing , the only difference is that does not need to be restarted after loading.

Install

Note

Currently, and have not yet implemented installation. The following description is only a description of the expected behavior for installing .

Install refers to installing as a module file similar to into /data/adb/kpmodules or a similar directory. installed in this way can be loaded at specific events.

Auto Load

FolkPatch provides auto-loading functionality, allowing specified KPMs to be automatically loaded into the kernel at system startup.

The storage directory is /data/adb/fp/kpms/, and auto-loaded KPMs are placed in the /data/adb/fp/kpms/autoload/ directory. The configuration file is /data/adb/fp/kpms/kpm_autoload_config.json.

/data/adb/fp/kpms# KPM storage directory

autoload# Auto-load directory

example.kpm# KPM module file

kpm_autoload_config.json# Auto-load configuration file

FolkPatch provides two configuration methods:

Visual Configuration: Add files through the interface, edit parameters and loading phases
JSON Configuration: Edit the JSON configuration file directly

The rest of the behavior is consistent with Load.

Loading Phases

Each can be configured to load in one of two phases:

Phase	Description
`service` (default)	Loaded during the service phase, after policies are applied and module mounting is complete
`post-fs-data`	Loaded during early boot, before policy injection and module mounting

Most use cases work fine with the default service phase. Only select post-fs-data when you need to intervene in kernel behavior during early boot.

Parameter Passing

Each can be configured with a parameter string that is passed at startup. Parameters are passed directly to the 's initialization function through the kernel .

In visual mode, click the edit button on a entry to set parameters. In JSON mode, fill in the args field.

Safe Mode

When the device enters safe mode, the auto-loading feature is automatically disabled and all configured KPMs will not be loaded. This prevents boot issues caused by abnormal KPMs.

Configuration File Format

{
  "enabled": true,
  "kpmEntries": [
    {
      "path": "/data/adb/fp/kpms/autoload/example.kpm",
      "event": "service",
      "args": ""
    }
  ]
}

enabledRequiredboolean

Whether auto-loading is enabled

pathRequiredstring

file path (must be within /data/adb/fp/kpms/autoload/ directory)

eventOptionalstring

service

Loading phase: service or post-fs-data

argsOptionalstring

Parameter string passed to the , defaults to empty

注意

A maximum of 64 auto-load entries can be configured. files must be located in the /data/adb/fp/kpms/autoload/ directory, otherwise loading will be rejected.