/
← Voltar ao feed
low

Hakai Security releases Beerus Framework v1.1 for Android pentesting with KernelSU support and gRPC transport

1 fonte(s) · 1 atualização(ões) · publicado 02/07/2026 17:39 · coletado há 2 dias

Hakai Security has published Beerus Framework v1.1, a minor update to its on-device Android mobile pentest toolkit. The release adds KernelSU support alongside Magisk, an optional gRPC transport for memory dumps and sandbox exfiltration, integrated auto-update, and an iptables alternative to Proxy Profiles. It also fixes several defects accumulated since v1.0 and includes the project's first external contribution, which improves Magisk detection. This is tooling news with no vulnerability, exploitation or threat actor activity, but it is relevant to defenders because the framework can intercept TLS, dump process memory and exfiltrate application sandboxes on rooted devices.

Detalhes técnicos

  • Root detection: Beerus first tries to detect Magisk, then falls back to checking ksud -V for KernelSU. Root-dependent features (Frida Core, system property manipulation, Boot Options, Trusted System Certificates, module management) now work on both.
  • Trusted System Certificates fix: v1.0 only copied user certificates to /system/etc/security/cacerts, which is ineffective on newer Android versions that use the Conscrypt APEX store. v1.1 builds a temporary trust store with system and user certificates, applies the SELinux context u:object_r:system_security_cacerts_file:s0, and bind-mounts it over /apex/com.android.conscrypt/cacerts and, when present, /system/etc/security/cacerts.
  • Memory Dump optimization: it now filters /proc/<pid>/maps for rw regions (heap, anonymous, .dex, .odex, .oat), skips regions over 20MB, and reads with dd in 4096-byte pages instead of byte by byte. Previously a dump could take 20-30 minutes.
  • gRPC transport: enabled by a grpc:// server address, with HTTP/HTTPS remaining the default. A BeerusTransfer service exposes Check and a streaming Upload of UploadChunk messages, with a SHA256 hash computed on receipt. The server mode is started with --grpc and can safely extract received .tar.gz files.
  • Root Modules freeze fix: module enumeration moved to MainActivity.onCreate() with asynchronous callbacks, removing the wait()/notify() blocking logic.
  • Frida Auto Injector: the editor is replaced by Sora Editor with TextMate highlighting. A fridaCore SIGSEGV is fixed: json_parser_get_root() returned NULL on non-JSON messages and was then dereferenced. -latomic was added to the build for ARM32. Injection now uses frida_device_spawn_sync to start the target suspended, load the script and then resume, so hooks on onCreate and early lifecycle work.

Remediação

No remediation applies, as this is a tooling release. Users of Beerus should update to v1.1. Defenders should be aware that rooted test devices running such frameworks can expose app memory and sandbox contents and can intercept TLS via promoted system certificates.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 02/07/2026 17:39 · coletado 19/10 18:03 primeiro registro

    Hakai Security releases Beerus Framework v1.1 for Android pentesting with KernelSU support and gRPC transport

    ler a análise desta fonte

    Hakai Security has published Beerus Framework v1.1, a minor update to its on-device Android mobile pentest toolkit. The release adds KernelSU support alongside Magisk, an optional gRPC transport for memory dumps and sandbox exfiltration, integrated auto-update, and an iptables alternative to Proxy Profiles. It also fixes several defects accumulated since v1.0 and includes the project's first external contribution, which improves Magisk detection. This is tooling news with no vulnerability, exploitation or threat actor activity, but it is relevant to defenders because the framework can intercept TLS, dump process memory and exfiltrate application sandboxes on rooted devices.

    Technical Details

    • Root detection: Beerus first tries to detect Magisk, then falls back to checking ksud -V for KernelSU. Root-dependent features (Frida Core, system property manipulation, Boot Options, Trusted System Certificates, module management) now work on both.
    • Trusted System Certificates fix: v1.0 only copied user certificates to /system/etc/security/cacerts, which is ineffective on newer Android versions that use the Conscrypt APEX store. v1.1 builds a temporary trust store with system and user certificates, applies the SELinux context u:object_r:system_security_cacerts_file:s0, and bind-mounts it over /apex/com.android.conscrypt/cacerts and, when present, /system/etc/security/cacerts.
    • Memory Dump optimization: it now filters /proc/<pid>/maps for rw regions (heap, anonymous, .dex, .odex, .oat), skips regions over 20MB, and reads with dd in 4096-byte pages instead of byte by byte. Previously a dump could take 20-30 minutes.
    • gRPC transport: enabled by a grpc:// server address, with HTTP/HTTPS remaining the default. A BeerusTransfer service exposes Check and a streaming Upload of UploadChunk messages, with a SHA256 hash computed on receipt. The server mode is started with --grpc and can safely extract received .tar.gz files.
    • Root Modules freeze fix: module enumeration moved to MainActivity.onCreate() with asynchronous callbacks, removing the wait()/notify() blocking logic.
    • Frida Auto Injector: the editor is replaced by Sora Editor with TextMate highlighting. A fridaCore SIGSEGV is fixed: json_parser_get_root() returned NULL on non-JSON messages and was then dereferenced. -latomic was added to the build for ARM32. Injection now uses frida_device_spawn_sync to start the target suspended, load the script and then resume, so hooks on onCreate and early lifecycle work.

    Remediation

    No remediation applies, as this is a tooling release. Users of Beerus should update to v1.1. Defenders should be aware that rooted test devices running such frameworks can expose app memory and sandbox contents and can intercept TLS via promoted system certificates.