Introduction: The Kernel’s Window to Android

The Android operating system, built upon the Linux kernel, exposes a wealth of system and process information through two pseudo-filesystems: /proc and /sys. These virtual filesystems are not stored on persistent storage but are generated dynamically by the kernel to provide a direct interface for interacting with and observing kernel data structures. For security researchers, root developers, and anti-tampering specialists, understanding how these filesystems work and how they can be manipulated or monitored is crucial for both achieving stealthy root access and robustly detecting it.

This article will delve into the intricacies of /proc and /sys, exploring their structure, common ways root exploits interact with them, and sophisticated methods for detecting kernel-level root manipulations. We’ll also touch upon techniques used by stealthy rooting solutions to evade these detection mechanisms, highlighting the ongoing cat-and-mouse game in Android security.

The Anatomy of /proc and /sys

To effectively detect or hide root, one must first grasp the purpose and contents of these foundational kernel interfaces.

/proc: The Process Filesystem

/proc is a virtual filesystem that provides a window into running processes and kernel parameters. Each running process has a corresponding directory named after its Process ID (PID) under /proc. Within each PID directory, various files expose detailed information about that process:

• /proc/<pid>/cmdline: The command line arguments that started the process.
• /proc/<pid>/comm: The command name of the process.
• /proc/<pid>/exe: A symbolic link to the executable file of the process.
• /proc/<pid>/maps: A list of memory regions and their permissions.
• /proc/<pid>/status: Comprehensive status information, including UIDs, GIDs, and capabilities.
• /proc/<pid>/fd/: A directory containing symbolic links to open file descriptors.
• /proc/<pid>/ns/: Directories for process namespaces (mnt, pid, net, etc.).

Beyond process information, /proc also contains system-wide kernel data:

• /proc/cmdline: The kernel command line arguments passed at boot.
• /proc/cpuinfo: CPU information.
• /proc/meminfo: Memory usage statistics.
• /proc/modules: A list of currently loaded kernel modules.
• /proc/mounts: A list of mounted filesystems (active mounts).

Example: Inspecting a process

adb shell cat /proc/self/comm     # View current process command name (e.g.,

        
        
        

            

                
            
            

                
Android Mobile Specs & Compare Directory
                
Are you researching mobile hardware properties, processor SoCs, GPU chipsets, or RAM configurations? Access our complete specs catalog to compare up to 5 devices side-by-side!
                Compare Devices Specs →