diff --git a/.github/workflows/build-manager.yml b/.github/workflows/build-manager.yml
index ced4799490dd..8bb5d02d14cf 100644
--- a/.github/workflows/build-manager.yml
+++ b/.github/workflows/build-manager.yml
@@ -21,6 +21,8 @@ jobs:
         include:
           - target: aarch64-linux-android
             os: ubuntu-latest
+          - target: armv7-linux-androideabi
+            os: ubuntu-latest
           - target: x86_64-linux-android
             os: ubuntu-latest
           - target: x86_64-pc-windows-gnu # windows pc
@@ -91,6 +93,12 @@ jobs:
         with:
           name: ksud-aarch64-linux-android
           path: .
+          
+      - name: Download arm32 ksud
+        uses: actions/download-artifact@v4
+        with:
+          name: ksud-armv7-linux-androideabi
+          path: .
 
       - name: Download x86_64 ksud
         uses: actions/download-artifact@v4
@@ -101,8 +109,10 @@ jobs:
       - name: Copy ksud to app jniLibs
         run: |
           mkdir -p app/src/main/jniLibs/arm64-v8a
+          mkdir -p app/src/main/jniLibs/armeabi-v7a
           mkdir -p app/src/main/jniLibs/x86_64
           cp -f ../aarch64-linux-android/release/ksud ../manager/app/src/main/jniLibs/arm64-v8a/libksud.so
+          cp -f ../armv7-linux-androideabi/release/ksud ../manager/app/src/main/jniLibs/armeabi-v7a/libksud.so
           cp -f ../x86_64-linux-android/release/ksud ../manager/app/src/main/jniLibs/x86_64/libksud.so
 
       - name: Build with Gradle
@@ -135,7 +145,6 @@ jobs:
         env:
           CHAT_ID: ${{ secrets.CHAT_ID }}
           BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-          MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
           COMMIT_URL: ${{ github.event.head_commit.url }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
diff --git a/.github/workflows/ksud.yml b/.github/workflows/ksud.yml
index 5171515d2e04..696351e6adb2 100644
--- a/.github/workflows/ksud.yml
+++ b/.github/workflows/ksud.yml
@@ -36,10 +36,23 @@ jobs:
         cargo install cross --git https://github.com/cross-rs/cross --rev 66845c1
 
     - name: Build ksud
-      run: CROSS_NO_WARNINGS=0 cross build --target ${{ inputs.target }} --release --manifest-path ./userspace/ksud/Cargo.toml
+      run: |
+        if [[ "${{ inputs.target }}" = "armv7-linux-androideabi" ]]; then
+        	CROSS_NO_WARNINGS=0 cross build --target ${{ inputs.target }} --release --manifest-path ./userspace/ksud32/Cargo.toml
+        else
+        	CROSS_NO_WARNINGS=0 cross build --target ${{ inputs.target }} --release --manifest-path ./userspace/ksud/Cargo.toml
+        fi
 
     - name: Upload ksud artifact
+      if: inputs.target != "armv7-linux-androideabi"
       uses: actions/upload-artifact@v4
       with:
         name: ksud-${{ inputs.target }}
         path: userspace/ksud/target/**/release/ksud*
+        
+    - name: Upload ksud32 artifact
+      if: inputs.target == "armv7-linux-androideabi"
+      uses: actions/upload-artifact@v4
+      with:
+        name: ksud-${{ inputs.target }}
+        path: userspace/ksud32/target/**/release/ksud*
\ No newline at end of file
diff --git a/kernel/arch.h b/kernel/arch.h
index f36ec5f509fa..bdfed76b25f7 100644
--- a/kernel/arch.h
+++ b/kernel/arch.h
@@ -32,6 +32,10 @@
 #define SYS_EXECVE_SYMBOL "sys_execve"
 #endif
 
+#elif defined(__arm__)
+#ifdef CONFIG_KPROBES
+#error "KPROBE is not supported in this arch!"
+#endif
 #elif defined(__x86_64__)
 
 #define __PT_PARM1_REG di
diff --git a/manager/build.gradle.kts b/manager/build.gradle.kts
index 3bb25ee907cc..1fa8337beb2d 100644
--- a/manager/build.gradle.kts
+++ b/manager/build.gradle.kts
@@ -18,7 +18,7 @@ cmaker {
                 "-DANDROID_STL=none",
             )
         )
-        abiFilters("arm64-v8a", "x86_64", "riscv64")
+        abiFilters("arm64-v8a", "x86_64", "armeabi-v7a", "riscv64")
     }
     buildTypes {
         if (it.name == "release") {
diff --git a/userspace/ksud32/.gitignore b/userspace/ksud32/.gitignore
new file mode 100644
index 000000000000..3c71873d9fb4
--- /dev/null
+++ b/userspace/ksud32/.gitignore
@@ -0,0 +1,2 @@
+/target
+.cargo/
\ No newline at end of file
diff --git a/userspace/ksud32/Cargo.lock b/userspace/ksud32/Cargo.lock
new file mode 100644
index 000000000000..72f9c5366f50
--- /dev/null
+++ b/userspace/ksud32/Cargo.lock
@@ -0,0 +1,1655 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+
+[[package]]
+name = "adler32"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "611cc2ae7d2e242c457e4be7f97036b8ad9ca152b499f53faf99b1ed8fc2553f"
+
+[[package]]
+name = "android-properties"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04"
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_log-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ecc8056bf6ab9892dcd53216c83d1597487d7dacac16c8df6b877d127df9937"
+
+[[package]]
+name = "android_logger"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b07e8e73d720a1f2e4b6014766e6039fd2e96a4fa44e2a78d0e1fa2ff49826"
+dependencies = [
+ "android_log-sys",
+ "env_filter",
+ "log",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "721cae7de5c34fbb2acd27e21e6d2cf7b886dce0c27388d46c4e6c47ea4318dd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "backtrace"
+version = "0.3.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-targets",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ac0150caa2ae65ca5bd83f25c7de183dea78d4d366469f148435e2acfbad0da"
+
+[[package]]
+name = "cc"
+version = "1.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
+dependencies = [
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chrono"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "wasm-bindgen",
+ "windows-targets",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97f376d85a664d5837dbae44bf546e6477a679ff6610010f17276f686d867e8"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19bc80abd44e4bed93ca373a0704ccbd1b710dc5749406201bb018272808dc54"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1462739cb27611015575c0c11df5df7601141071f07518d56fcc1be504cbec97"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+
+[[package]]
+name = "const_format"
+version = "0.2.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50c655d81ff1114fb0dcdea9225ea9f0cc712a6f8d189378e82bdf62a473a64b"
+dependencies = [
+ "const_format_proc_macros",
+]
+
+[[package]]
+name = "const_format_proc_macros"
+version = "0.2.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eff1a44b93f47b1bac19a27932f5c591e43d1ba357ee4f61526c8a25603f0eb1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core2"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608697df725056feaccfa42cffdaeeec3fccc4ffc38358ecd19b243e716a78e0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69e6e4d7b33a94f0991c26729976b10ebde1d34c3ee82408fb536164fa10d636"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
+
+[[package]]
+name = "crc32fast"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-epoch",
+ "crossbeam-queue",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "dary_heap"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04d2cd9c18b9f454ed67da600630b021a8a80bf33f8c95896ab33aaf1c26b728"
+
+[[package]]
+name = "deflate64"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da692b8d1080ea3045efaab14434d40468c3d8657e42abddfffca87b428f4c1b"
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "derive-new"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cdc8d50f426189eef89dac62fabfa0abb27d5cc008f25bf4156a0203325becc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30542c1ad912e0e3d22a1935c290e12e8a29d704a420177a31faad4a601a0800"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "either"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "env_filter"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f2c92ceda6ceec50f43169f9ee8424fe2db276791afde7b2cd8bc084cb376ab"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13fa619b91fb2381732789fc5de83b45675e882f66623b7d8cb4f643017018d"
+dependencies = [
+ "env_filter",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "extattr"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b59f8a77817ff1b795adafc535941bdf664184f5f95e0b6d1d77dd6d12815dc"
+dependencies = [
+ "bitflags 1.3.2",
+ "errno 0.2.8",
+ "libc",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
+
+[[package]]
+name = "flate2"
+version = "1.0.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1b589b4dc103969ad3cf85c950899926ec64300a1a46d76c03a6072957036f0"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getopts"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "gimli"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a9bfc1af68b1726ea47d3d5109de126281def866b33970e10fbab11b5dafab3"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "humansize"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cb51c9a029ddc91b07a787f1d86b53ccfa49b0e86688c946ebe8d3555685dd7"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "include-flate"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df49c16750695486c1f34de05da5b7438096156466e7f76c38fcdf285cf0113e"
+dependencies = [
+ "include-flate-codegen",
+ "lazy_static",
+ "libflate",
+]
+
+[[package]]
+name = "include-flate-codegen"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c5b246c6261be723b85c61ecf87804e8ea4a35cb68be0ff282ed84b95ffe7d7"
+dependencies = [
+ "libflate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.15.1",
+]
+
+[[package]]
+name = "is_executable"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4a1b5bad6f9072935961dfbf1cced2f3d129963d091b6f69f007fe04e758ae2"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "java-properties"
+version = "2.0.0"
+source = "git+https://github.com/Kernel-SU/java-properties.git?branch=master#42a4aa941b70ded2dd3be9e9f892471023e70229"
+dependencies = [
+ "encoding_rs",
+ "lazy_static",
+ "regex-lite",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.72"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a88f1bda2bd75b0452a14784937d796722fdebfe50df998aeb3f0b7603019a9"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jwalk"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2735847566356cd2179a2a38264839308f7079fa96e6bd5a42d740460e003c56"
+dependencies = [
+ "crossbeam",
+ "rayon",
+]
+
+[[package]]
+name = "ksud"
+version = "0.1.0"
+dependencies = [
+ "android-properties",
+ "android_logger",
+ "anyhow",
+ "chrono",
+ "clap",
+ "const_format",
+ "derive-new",
+ "encoding_rs",
+ "env_logger",
+ "extattr",
+ "getopts",
+ "humansize",
+ "is_executable",
+ "java-properties",
+ "jwalk",
+ "libc",
+ "log",
+ "loopdev",
+ "nom",
+ "procfs",
+ "regex-lite",
+ "retry",
+ "rust-embed",
+ "rustix 0.38.34",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha256",
+ "tempfile",
+ "which",
+ "zip",
+ "zip-extensions",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.162"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
+
+[[package]]
+name = "libflate"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45d9dfdc14ea4ef0900c1cddbc8dcd553fbaacd8a4a282cf4018ae9dd04fb21e"
+dependencies = [
+ "adler32",
+ "core2",
+ "crc32fast",
+ "dary_heap",
+ "libflate_lz77",
+]
+
+[[package]]
+name = "libflate_lz77"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e0d73b369f386f1c44abd9c570d5318f55ccde816ff4b562fa452e5182863d"
+dependencies = [
+ "core2",
+ "hashbrown 0.14.5",
+ "rle-decode-fast",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+
+[[package]]
+name = "lockfree-object-pool"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9374ef4228402d4b7e403e5838cb880d9ee663314b0a900d5a6aabf0c213552e"
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+
+[[package]]
+name = "loopdev"
+version = "0.5.0"
+source = "git+https://gitlab.com/Rissu-Projekt/kernelsu/loopdev.git#0a38336dc6b54f2789734fe7cfb2bdae29414d3c"
+dependencies = [
+ "errno 0.2.8",
+ "libc",
+ "rustix 0.38.35",
+]
+
+[[package]]
+name = "lzma-rs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e"
+dependencies = [
+ "byteorder",
+ "crc",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
+dependencies = [
+ "adler2",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "object"
+version = "0.36.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "procfs"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
+dependencies = [
+ "bitflags 2.6.0",
+ "chrono",
+ "flate2",
+ "hex",
+ "procfs-core",
+ "rustix 0.38.39",
+]
+
+[[package]]
+name = "procfs-core"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
+dependencies = [
+ "bitflags 2.6.0",
+ "chrono",
+ "hex",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rayon"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "regex-lite"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53a49587ad06b26609c52e423de037e7f57f20d53535d66e08c695f347df952a"
+
+[[package]]
+name = "retry"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9166d72162de3575f950507683fac47e30f6f2c3836b71b7fbc61aa517c9c5f4"
+dependencies = [
+ "rand",
+]
+
+[[package]]
+name = "rle-decode-fast"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3582f63211428f83597b51b2ddb88e2a91a9d52d12831f9d08f5e624e8977422"
+
+[[package]]
+name = "rust-embed"
+version = "8.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa66af4a4fdd5e7ebc276f115e895611a34739a9c1c01028383d612d550953c0"
+dependencies = [
+ "include-flate",
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "8.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6125dbc8867951125eec87294137f4e9c2c96566e61bf72c45095a7c77761478"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rust-embed-utils",
+ "syn",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "8.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e5347777e9aacb56039b0e1f28785929a8a3b709e87482e7442c72e7c12529d"
+dependencies = [
+ "sha2",
+ "walkdir",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
+[[package]]
+name = "rustix"
+version = "0.38.34"
+source = "git+https://github.com/Kernel-SU/rustix.git?branch=main#4a53fbc7cb7a07cabe87125cc21dbc27db316259"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno 0.3.9",
+ "itoa",
+ "libc",
+ "linux-raw-sys",
+ "once_cell",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.35"
+source = "git+https://github.com/bytecodealliance/rustix.git?branch=main#53529acfcd23329bbeb67574e5c63e51c4cd732e"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno 0.3.9",
+ "itoa",
+ "libc",
+ "linux-raw-sys",
+ "once_cell",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "375116bee2be9ed569afe2154ea6a99dfdffd257f533f187498c2a8f5feaf4ee"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno 0.3.9",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.214"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55c3193aca71c12ad7890f1785d2b73e1b9f63a0bbc353c08ef26fe03fc56b5"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.214"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.132"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha256"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18278f6a914fa3070aa316493f7d2ddfb9ac86ebc06fa3b83bffda487e9065b0"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "hex",
+ "sha2",
+ "tokio",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "2.0.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28cce251fcbc87fac86a866eeb0d6c2d536fc16d06f184bb61aeae11aa4cee0c"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "once_cell",
+ "rustix 0.38.39",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02dd99dc800bbb97186339685293e1cc5d9df1f8fae2d0aecd9ff1c77efea892"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "tokio"
+version = "1.41.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "128d1e363af62632b8eb57219c8fd7877144af57558fb2ef0368d0087bddeb2e"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb6dd4d3ca0ddffd1dd1c9c04f94b868c37ff5fac97c30b97cff2d74fce3a358"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e79384be7f8f5a9dd5d7167216f022090cf1f9ec128e6e6a482a2cb5c5422c56"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65fc09f10666a9f147042251e0dda9c18f166ff7de300607007e96bdebc1068d"
+
+[[package]]
+name = "which"
+version = "6.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ee928febd44d98f2f459a4a79bd4d928591333a494a10a868418ac1b39cf1f"
+dependencies = [
+ "either",
+ "home",
+ "rustix 0.38.39",
+ "winsafe",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winsafe"
+version = "0.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zip"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc5e4288ea4057ae23afc69a4472434a87a2495cafce6632fd1c4ec9f5cf3494"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "deflate64",
+ "displaydoc",
+ "flate2",
+ "indexmap",
+ "lzma-rs",
+ "memchr",
+ "thiserror",
+ "time",
+ "zopfli",
+]
+
+[[package]]
+name = "zip-extensions"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "386508a00aae1d8218b9252a41f59bba739ccee3f8e420bb90bcb1c30d960d4a"
+dependencies = [
+ "zip",
+]
+
+[[package]]
+name = "zopfli"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5019f391bac5cf252e93bbcc53d039ffd62c7bfb7c150414d61369afe57e946"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "lockfree-object-pool",
+ "log",
+ "once_cell",
+ "simd-adler32",
+]
diff --git a/userspace/ksud32/Cargo.toml b/userspace/ksud32/Cargo.toml
new file mode 100644
index 000000000000..b0a140b13228
--- /dev/null
+++ b/userspace/ksud32/Cargo.toml
@@ -0,0 +1,62 @@
+[package]
+name = "ksud"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+anyhow = "1.0"
+clap = { version = "4.5", features = ["derive"] }
+const_format = "0.2"
+zip = { version = "2.2", default-features = false }
+zip-extensions = { version = "0.8", features = [
+    "deflate",
+    "deflate64",
+    "time",
+    "lzma",
+    "xz",
+], default-features = false }
+java-properties = { git = "https://github.com/Kernel-SU/java-properties.git", branch = "master", default-features = false }
+log = "0.4"
+env_logger = { version = "0.11", default-features = false }
+serde = { version = "1.0" }
+serde_json = "1.0"
+encoding_rs = "0.8"
+retry = "2.0"
+humansize = "2.1"
+libc = "0.2"
+extattr = "1.0"
+jwalk = "0.8"
+is_executable = "1.0"
+nom = "7.1"
+derive-new = "0.7"
+rust-embed = { version = "8.5", features = [
+    "debug-embed",
+    "compression", # must clean build after updating binaries
+] }
+which = "6.0"
+getopts = "0.2"
+sha256 = "1"
+sha1 = "0.10"
+tempfile = "3.13"
+chrono = "0.4"
+regex-lite = "0.1"
+
+[target.'cfg(any(target_os = "android", target_os = "linux"))'.dependencies]
+rustix = { git = "https://github.com/Kernel-SU/rustix.git", branch = "main", features = [
+    "all-apis",
+] }
+# some android specific dependencies which compiles under unix are also listed here for convenience of coding
+android-properties = { version = "0.2", features = ["bionic-deprecated"] }
+procfs = "0.17"
+loopdev = { git = "https://gitlab.com/Rissu-Projekt/kernelsu/loopdev.git" }
+
+[target.'cfg(target_os = "android")'.dependencies]
+android_logger = { version = "0.14", default-features = false }
+
+[profile.release]
+strip = true
+opt-level = "z"
+lto = true
+codegen-units = 1
diff --git a/userspace/ksud32/bin/.gitignore b/userspace/ksud32/bin/.gitignore
new file mode 100644
index 000000000000..1464b7ed27b3
--- /dev/null
+++ b/userspace/ksud32/bin/.gitignore
@@ -0,0 +1 @@
+**/*.ko
\ No newline at end of file
diff --git a/userspace/ksud32/bin/arm/busybox b/userspace/ksud32/bin/arm/busybox
new file mode 100644
index 000000000000..bcdaf5f298f2
Binary files /dev/null and b/userspace/ksud32/bin/arm/busybox differ
diff --git a/userspace/ksud32/bin/arm/resetprop b/userspace/ksud32/bin/arm/resetprop
new file mode 100755
index 000000000000..ef2987196b68
Binary files /dev/null and b/userspace/ksud32/bin/arm/resetprop differ
diff --git a/userspace/ksud32/build.rs b/userspace/ksud32/build.rs
new file mode 100644
index 000000000000..021418acf722
--- /dev/null
+++ b/userspace/ksud32/build.rs
@@ -0,0 +1,56 @@
+use std::env;
+use std::fs::File;
+use std::io::Write;
+use std::path::Path;
+use std::process::Command;
+
+fn get_git_version() -> Result<(u32, String), std::io::Error> {
+    let output = Command::new("git")
+        .args(["rev-list", "--count", "HEAD"])
+        .output()?;
+
+    let output = output.stdout;
+    let version_code = String::from_utf8(output).expect("Failed to read git count stdout");
+    let version_code: u32 = version_code
+        .trim()
+        .parse()
+        .map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, "Failed to parse git count"))?;
+    let version_code = 10000 + 200 + version_code; // For historical reasons
+
+    let version_name = String::from_utf8(
+        Command::new("git")
+            .args(["describe", "--tags", "--always"])
+            .output()?
+            .stdout,
+    )
+    .map_err(|_| {
+        std::io::Error::new(
+            std::io::ErrorKind::Other,
+            "Failed to read git describe stdout",
+        )
+    })?;
+    let version_name = version_name.trim_start_matches('v').to_string();
+    Ok((version_code, version_name))
+}
+
+fn main() {
+    let (code, name) = match get_git_version() {
+        Ok((code, name)) => (code, name),
+        Err(_) => {
+            // show warning if git is not installed
+            println!("cargo:warning=Failed to get git version, using 0.0.0");
+            (0, "0.0.0".to_string())
+        }
+    };
+    let out_dir = env::var("OUT_DIR").expect("Failed to get $OUT_DIR");
+    let out_dir = Path::new(&out_dir);
+    File::create(Path::new(out_dir).join("VERSION_CODE"))
+        .expect("Failed to create VERSION_CODE")
+        .write_all(code.to_string().as_bytes())
+        .expect("Failed to write VERSION_CODE");
+
+    File::create(Path::new(out_dir).join("VERSION_NAME"))
+        .expect("Failed to create VERSION_NAME")
+        .write_all(name.trim().as_bytes())
+        .expect("Failed to write VERSION_NAME");
+}
diff --git a/userspace/ksud32/src/apk_sign.rs b/userspace/ksud32/src/apk_sign.rs
new file mode 100644
index 000000000000..6d047ccad9be
--- /dev/null
+++ b/userspace/ksud32/src/apk_sign.rs
@@ -0,0 +1,115 @@
+use anyhow::{ensure, Result};
+use std::io::{Read, Seek, SeekFrom};
+
+pub fn get_apk_signature(apk: &str) -> Result<(u32, String)> {
+    let mut buffer = [0u8; 0x10];
+    let mut size4 = [0u8; 4];
+    let mut size8 = [0u8; 8];
+    let mut size_of_block = [0u8; 8];
+
+    let mut f = std::fs::File::open(apk)?;
+
+    let mut i = 0;
+    loop {
+        let mut n = [0u8; 2];
+        f.seek(SeekFrom::End(-i - 2))?;
+        f.read_exact(&mut n)?;
+
+        let n = u16::from_le_bytes(n);
+        if i64::from(n) == i {
+            f.seek(SeekFrom::Current(-22))?;
+            f.read_exact(&mut size4)?;
+
+            if u32::from_le_bytes(size4) ^ 0xcafe_babe_u32 == 0xccfb_f1ee_u32 {
+                if i > 0 {
+                    println!("warning: comment length is {i}");
+                }
+                break;
+            }
+        }
+
+        ensure!(n != 0xffff, "not a zip file");
+
+        i += 1;
+    }
+
+    f.seek(SeekFrom::Current(12))?;
+    // offset
+    f.read_exact(&mut size4)?;
+    f.seek(SeekFrom::Start(u64::from(u32::from_le_bytes(size4)) - 0x18))?;
+
+    f.read_exact(&mut size8)?;
+    f.read_exact(&mut buffer)?;
+
+    ensure!(&buffer == b"APK Sig Block 42", "Can not found sig block");
+
+    let pos = u64::from(u32::from_le_bytes(size4)) - (u64::from_le_bytes(size8) + 0x8);
+    f.seek(SeekFrom::Start(pos))?;
+    f.read_exact(&mut size_of_block)?;
+
+    ensure!(size_of_block == size8, "not a signed apk");
+
+    let mut v2_signing: Option<(u32, String)> = None;
+    let mut v3_signing_exist = false;
+    let mut v3_1_signing_exist = false;
+
+    loop {
+        let mut id = [0u8; 4];
+        let mut offset = 4u32;
+
+        f.read_exact(&mut size8)?; // sequence length
+        if size8 == size_of_block {
+            break;
+        }
+
+        f.read_exact(&mut id)?; // id
+
+        let id = u32::from_le_bytes(id);
+        if id == 0x7109_871a_u32 {
+            v2_signing = Some(calc_cert_sha256(&mut f, &mut size4, &mut offset)?);
+        } else if id == 0xf053_68c0_u32 {
+            // v3 signature scheme
+            v3_signing_exist = true;
+        } else if id == 0x1b93_ad61_u32 {
+            // v3.1 signature scheme: credits to vvb2060
+            v3_1_signing_exist = true;
+        }
+
+        f.seek(SeekFrom::Current(
+            i64::from_le_bytes(size8) - i64::from(offset),
+        ))?;
+    }
+
+    if v3_signing_exist || v3_1_signing_exist {
+        return Err(anyhow::anyhow!("Unexpected v3 signature found!",));
+    }
+
+    v2_signing.ok_or(anyhow::anyhow!("No signature found!"))
+}
+
+fn calc_cert_sha256(
+    f: &mut std::fs::File,
+    size4: &mut [u8; 4],
+    offset: &mut u32,
+) -> Result<(u32, String)> {
+    f.read_exact(size4)?; // signer-sequence length
+    f.read_exact(size4)?; // signer length
+    f.read_exact(size4)?; // signed data length
+    *offset += 0x4 * 3;
+
+    f.read_exact(size4)?; // digests-sequence length
+    let pos = u32::from_le_bytes(*size4); // skip digests
+    f.seek(SeekFrom::Current(i64::from(pos)))?;
+    *offset += 0x4 + pos;
+
+    f.read_exact(size4)?; // certificates length
+    f.read_exact(size4)?; // certificate length
+    *offset += 0x4 * 2;
+
+    let cert_len = u32::from_le_bytes(*size4);
+    let mut cert: Vec<u8> = vec![0; cert_len as usize];
+    f.read_exact(&mut cert)?;
+    *offset += cert_len;
+
+    Ok((cert_len, sha256::digest(&cert)))
+}
diff --git a/userspace/ksud32/src/assets.rs b/userspace/ksud32/src/assets.rs
new file mode 100644
index 000000000000..0b3e9fe9c959
--- /dev/null
+++ b/userspace/ksud32/src/assets.rs
@@ -0,0 +1,21 @@
+use anyhow::Result;
+use const_format::concatcp;
+use rust_embed::RustEmbed;
+use std::path::Path;
+
+use crate::{defs::BINARY_DIR, utils};
+
+pub const RESETPROP_PATH: &str = concatcp!(BINARY_DIR, "resetprop");
+pub const BUSYBOX_PATH: &str = concatcp!(BINARY_DIR, "busybox");
+
+#[derive(RustEmbed)]
+#[folder = "bin/arm"]
+struct Asset;
+
+pub fn ensure_binaries(ignore_if_exist: bool) -> Result<()> {
+    for file in Asset::iter() {
+        let asset = Asset::get(&file).ok_or(anyhow::anyhow!("asset not found: {}", file))?;
+        utils::ensure_binary(format!("{BINARY_DIR}{file}"), &asset.data, ignore_if_exist)?
+    }
+    Ok(())
+}
\ No newline at end of file
diff --git a/userspace/ksud32/src/banner b/userspace/ksud32/src/banner
new file mode 100644
index 000000000000..6087569c3f04
--- /dev/null
+++ b/userspace/ksud32/src/banner
@@ -0,0 +1,5 @@
+  _  __                    _ ____  _   _ 
+ | |/ /___ _ __ _ __   ___| / ___|| | | |
+ | ' // _ \ '__| '_ \ / _ \ \___ \| | | |
+ | . \  __/ |  | | | |  __/ |___) | |_| |
+ |_|\_\___|_|  |_| |_|\___|_|____/ \___/ 
diff --git a/userspace/ksud32/src/cli.rs b/userspace/ksud32/src/cli.rs
new file mode 100644
index 000000000000..187c3ffcf59f
--- /dev/null
+++ b/userspace/ksud32/src/cli.rs
@@ -0,0 +1,261 @@
+use anyhow::{Ok, Result};
+use clap::Parser;
+
+#[cfg(target_os = "android")]
+use android_logger::Config;
+#[cfg(target_os = "android")]
+use log::LevelFilter;
+
+use crate::{apk_sign, assets, debug, defs, init_event, ksucalls, module, utils};
+
+/// KernelSU userspace cli
+#[derive(Parser, Debug)]
+#[command(author, version = defs::VERSION_NAME, about, long_about = None)]
+struct Args {
+    #[command(subcommand)]
+    command: Commands,
+}
+
+#[derive(clap::Subcommand, Debug)]
+enum Commands {
+    /// Manage KernelSU modules
+    Module {
+        #[command(subcommand)]
+        command: Module,
+    },
+
+    /// Trigger `post-fs-data` event
+    PostFsData,
+
+    /// Trigger `service` event
+    Services,
+
+    /// Trigger `boot-complete` event
+    BootCompleted,
+
+    /// SELinux policy Patch tool
+    Sepolicy {
+        #[command(subcommand)]
+        command: Sepolicy,
+    },
+
+    /// Manage App Profiles
+    Profile {
+        #[command(subcommand)]
+        command: Profile,
+    },
+    
+    /// For developers
+    Debug {
+        #[command(subcommand)]
+        command: Debug,
+    },
+}
+
+#[derive(clap::Subcommand, Debug)]
+enum Debug {
+    /// Set the manager app, kernel CONFIG_KSU_DEBUG should be enabled.
+    SetManager {
+        /// manager package name
+        #[arg(default_value_t = String::from("me.weishu.kernelsu"))]
+        apk: String,
+    },
+
+    /// Get apk size and hash
+    GetSign {
+        /// apk path
+        apk: String,
+    },
+
+    /// Root Shell
+    Su {
+        /// switch to gloabl mount namespace
+        #[arg(short, long, default_value = "false")]
+        global_mnt: bool,
+    },
+
+    /// Get kernel version
+    Version,
+
+    Mount,
+
+    /// For testing
+    Test,
+}
+
+#[derive(clap::Subcommand, Debug)]
+enum Sepolicy {
+    /// Patch sepolicy
+    Patch {
+        /// sepolicy statements
+        sepolicy: String,
+    },
+
+    /// Apply sepolicy from file
+    Apply {
+        /// sepolicy file path
+        file: String,
+    },
+
+    /// Check if sepolicy statement is supported/valid
+    Check {
+        /// sepolicy statements
+        sepolicy: String,
+    },
+}
+
+#[derive(clap::Subcommand, Debug)]
+enum Module {
+    /// Install module <ZIP>
+    Install {
+        /// module zip file path
+        zip: String,
+    },
+
+    /// Uninstall module <id>
+    Uninstall {
+        /// module id
+        id: String,
+    },
+
+    /// enable module <id>
+    Enable {
+        /// module id
+        id: String,
+    },
+
+    /// disable module <id>
+    Disable {
+        // module id
+        id: String,
+    },
+
+    /// run action for module <id>
+    Action {
+        // module id
+        id: String,
+    },
+
+    /// list all modules
+    List,
+}
+
+#[derive(clap::Subcommand, Debug)]
+enum Profile {
+    /// get root profile's selinux policy of <package-name>
+    GetSepolicy {
+        /// package name
+        package: String,
+    },
+
+    /// set root profile's selinux policy of <package-name> to <profile>
+    SetSepolicy {
+        /// package name
+        package: String,
+        /// policy statements
+        policy: String,
+    },
+
+    /// get template of <id>
+    GetTemplate {
+        /// template id
+        id: String,
+    },
+
+    /// set template of <id> to <template string>
+    SetTemplate {
+        /// template id
+        id: String,
+        /// template string
+        template: String,
+    },
+
+    /// delete template of <id>
+    DeleteTemplate {
+        /// template id
+        id: String,
+    },
+
+    /// list all templates
+    ListTemplates,
+}
+
+pub fn run() -> Result<()> {
+    #[cfg(target_os = "android")]
+    android_logger::init_once(
+        Config::default()
+            .with_max_level(LevelFilter::Trace) // limit log level
+            .with_tag("KernelSU"), // logs will show under mytag tag
+    );
+
+    #[cfg(not(target_os = "android"))]
+    env_logger::init();
+
+    // the kernel executes su with argv[0] = "su" and replace it with us
+    let arg0 = std::env::args().next().unwrap_or_default();
+    if arg0 == "su" || arg0 == "/system/bin/su" {
+        return crate::su::root_shell();
+    }
+
+    let cli = Args::parse();
+
+    log::info!("command: {:?}", cli.command);
+
+    let result = match cli.command {
+        Commands::PostFsData => init_event::on_post_data_fs(),
+        Commands::BootCompleted => init_event::on_boot_completed(),
+
+        Commands::Module { command } => {
+            #[cfg(any(target_os = "linux", target_os = "android"))]
+            {
+                utils::switch_mnt_ns(1)?;
+                utils::unshare_mnt_ns()?;
+            }
+            match command {
+                Module::Install { zip } => module::install_module(&zip),
+                Module::Uninstall { id } => module::uninstall_module(&id),
+                Module::Enable { id } => module::enable_module(&id),
+                Module::Disable { id } => module::disable_module(&id),
+                Module::Action { id } => module::run_action(&id),
+                Module::List => module::list_modules(),
+            }
+        },
+        Commands::Sepolicy { command } => match command {
+            Sepolicy::Patch { sepolicy } => crate::sepolicy::live_patch(&sepolicy),
+            Sepolicy::Apply { file } => crate::sepolicy::apply_file(file),
+            Sepolicy::Check { sepolicy } => crate::sepolicy::check_rule(&sepolicy),
+        },
+        Commands::Services => init_event::on_services(),
+        Commands::Profile { command } => match command {
+            Profile::GetSepolicy { package } => crate::profile::get_sepolicy(package),
+            Profile::SetSepolicy { package, policy } => {
+                crate::profile::set_sepolicy(package, policy)
+            }
+            Profile::GetTemplate { id } => crate::profile::get_template(id),
+            Profile::SetTemplate { id, template } => crate::profile::set_template(id, template),
+            Profile::DeleteTemplate { id } => crate::profile::delete_template(id),
+            Profile::ListTemplates => crate::profile::list_templates(),
+        },
+
+        Commands::Debug { command } => match command {
+            Debug::SetManager { apk } => debug::set_manager(&apk),
+            Debug::GetSign { apk } => {
+                let sign = apk_sign::get_apk_signature(&apk)?;
+                println!("size: {:#x}, hash: {}", sign.0, sign.1);
+                Ok(())
+            }
+            Debug::Version => {
+                println!("Kernel Version: {}", ksucalls::get_version());
+                Ok(())
+            }
+            Debug::Su { global_mnt } => crate::su::grant_root(global_mnt),
+            Debug::Mount => init_event::mount_modules_systemlessly(defs::MODULE_DIR),
+            Debug::Test => assets::ensure_binaries(false),
+        },
+    };
+
+    if let Err(e) = &result {
+        log::error!("Error: {:?}", e);
+    }
+    result
+}
diff --git a/userspace/ksud32/src/debug.rs b/userspace/ksud32/src/debug.rs
new file mode 100644
index 000000000000..8ff851d30b2f
--- /dev/null
+++ b/userspace/ksud32/src/debug.rs
@@ -0,0 +1,52 @@
+use anyhow::{ensure, Context, Ok, Result};
+use std::{
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+const KERNEL_PARAM_PATH: &str = "/sys/module/kernelsu";
+
+fn read_u32(path: &PathBuf) -> Result<u32> {
+    let content = std::fs::read_to_string(path)?;
+    let content = content.trim();
+    let content = content.parse::<u32>()?;
+    Ok(content)
+}
+
+fn set_kernel_param(uid: u32) -> Result<()> {
+    let kernel_param_path = Path::new(KERNEL_PARAM_PATH).join("parameters");
+
+    let ksu_debug_manager_uid = kernel_param_path.join("ksu_debug_manager_uid");
+    let before_uid = read_u32(&ksu_debug_manager_uid)?;
+    std::fs::write(&ksu_debug_manager_uid, uid.to_string())?;
+    let after_uid = read_u32(&ksu_debug_manager_uid)?;
+
+    println!("set manager uid: {before_uid} -> {after_uid}");
+
+    Ok(())
+}
+
+#[cfg(target_os = "android")]
+fn get_pkg_uid(pkg: &str) -> Result<u32> {
+    // stat /data/data/<pkg>
+    let uid = rustix::fs::stat(format!("/data/data/{pkg}"))
+        .with_context(|| format!("stat /data/data/{}", pkg))?
+        .st_uid;
+    Ok(uid)
+}
+
+pub fn set_manager(pkg: &str) -> Result<()> {
+    ensure!(
+        Path::new(KERNEL_PARAM_PATH).exists(),
+        "CONFIG_KSU_DEBUG is not enabled"
+    );
+
+    #[cfg(target_os = "android")]
+    let uid = get_pkg_uid(pkg)?;
+    #[cfg(not(target_os = "android"))]
+    let uid = 0;
+    set_kernel_param(uid)?;
+    // force-stop it
+    let _ = Command::new("am").args(["force-stop", pkg]).status();
+    Ok(())
+}
diff --git a/userspace/ksud32/src/defs.rs b/userspace/ksud32/src/defs.rs
new file mode 100644
index 000000000000..ad9338a85470
--- /dev/null
+++ b/userspace/ksud32/src/defs.rs
@@ -0,0 +1,38 @@
+use const_format::concatcp;
+
+pub const ADB_DIR: &str = "/data/adb/";
+pub const WORKING_DIR: &str = concatcp!(ADB_DIR, "ksu/");
+pub const BINARY_DIR: &str = concatcp!(WORKING_DIR, "bin/");
+pub const LOG_DIR: &str = concatcp!(WORKING_DIR, "log/");
+
+pub const PROFILE_DIR: &str = concatcp!(WORKING_DIR, "profile/");
+pub const PROFILE_SELINUX_DIR: &str = concatcp!(PROFILE_DIR, "selinux/");
+pub const PROFILE_TEMPLATE_DIR: &str = concatcp!(PROFILE_DIR, "templates/");
+
+pub const KSURC_PATH: &str = concatcp!(WORKING_DIR, ".ksurc");
+pub const KSU_OVERLAY_SOURCE: &str = "KSU";
+pub const DAEMON_PATH: &str = concatcp!(ADB_DIR, "ksud");
+
+pub const MODULE_DIR: &str = concatcp!(ADB_DIR, "modules/");
+pub const MODULE_IMG: &str = concatcp!(WORKING_DIR, "modules.img");
+pub const MODULE_UPDATE_IMG: &str = concatcp!(WORKING_DIR, "modules_update.img");
+
+pub const MODULE_UPDATE_TMP_IMG: &str = concatcp!(WORKING_DIR, "update_tmp.img");
+
+// warning: this directory should not change, or you need to change the code in module_installer.sh!!!
+pub const MODULE_UPDATE_TMP_DIR: &str = concatcp!(ADB_DIR, "modules_update/");
+
+pub const SYSTEM_RW_DIR: &str = concatcp!(MODULE_DIR, ".rw/");
+
+pub const TEMP_DIR: &str = "/debug_ramdisk";
+pub const TEMP_DIR_LEGACY: &str = "/sbin";
+
+pub const MODULE_WEB_DIR: &str = "webroot";
+pub const MODULE_ACTION_SH: &str = "action.sh";
+pub const DISABLE_FILE_NAME: &str = "disable";
+pub const UPDATE_FILE_NAME: &str = "update";
+pub const REMOVE_FILE_NAME: &str = "remove";
+pub const SKIP_MOUNT_FILE_NAME: &str = "skip_mount";
+
+pub const VERSION_CODE: &str = include_str!(concat!(env!("OUT_DIR"), "/VERSION_CODE"));
+pub const VERSION_NAME: &str = include_str!(concat!(env!("OUT_DIR"), "/VERSION_NAME"));
\ No newline at end of file
diff --git a/userspace/ksud32/src/init_event.rs b/userspace/ksud32/src/init_event.rs
new file mode 100644
index 000000000000..16ad389e1eb4
--- /dev/null
+++ b/userspace/ksud32/src/init_event.rs
@@ -0,0 +1,305 @@
+use anyhow::{bail, Context, Result};
+use log::{info, warn};
+use std::{collections::HashMap, path::Path};
+
+use crate::module::prune_modules;
+use crate::{
+    assets, defs, ksucalls, mount, restorecon,
+    utils::{self, ensure_clean_dir},
+};
+
+fn mount_partition(partition_name: &str, lowerdir: &Vec<String>) -> Result<()> {
+    if lowerdir.is_empty() {
+        warn!("partition: {partition_name} lowerdir is empty");
+        return Ok(());
+    }
+
+    let partition = format!("/{partition_name}");
+
+    // if /partition is a symlink and linked to /system/partition, then we don't need to overlay it separately
+    if Path::new(&partition).read_link().is_ok() {
+        warn!("partition: {partition} is a symlink");
+        return Ok(());
+    }
+
+    let mut workdir = None;
+    let mut upperdir = None;
+    let system_rw_dir = Path::new(defs::SYSTEM_RW_DIR);
+    if system_rw_dir.exists() {
+        workdir = Some(system_rw_dir.join(partition_name).join("workdir"));
+        upperdir = Some(system_rw_dir.join(partition_name).join("upperdir"));
+    }
+
+    mount::mount_overlay(&partition, lowerdir, workdir, upperdir)
+}
+
+pub fn mount_modules_systemlessly(module_dir: &str) -> Result<()> {
+    // construct overlay mount params
+    let dir = std::fs::read_dir(module_dir);
+    let Ok(dir) = dir else {
+        bail!("open {} failed", defs::MODULE_DIR);
+    };
+
+    let mut system_lowerdir: Vec<String> = Vec::new();
+
+    let partition = vec!["vendor", "product", "system_ext", "odm", "oem"];
+    let mut partition_lowerdir: HashMap<String, Vec<String>> = HashMap::new();
+    for ele in &partition {
+        partition_lowerdir.insert((*ele).to_string(), Vec::new());
+    }
+
+    for entry in dir.flatten() {
+        let module = entry.path();
+        if !module.is_dir() {
+            continue;
+        }
+        let disabled = module.join(defs::DISABLE_FILE_NAME).exists();
+        if disabled {
+            info!("module: {} is disabled, ignore!", module.display());
+            continue;
+        }
+        let skip_mount = module.join(defs::SKIP_MOUNT_FILE_NAME).exists();
+        if skip_mount {
+            info!("module: {} skip_mount exist, skip!", module.display());
+            continue;
+        }
+
+        let module_system = Path::new(&module).join("system");
+        if module_system.is_dir() {
+            system_lowerdir.push(format!("{}", module_system.display()));
+        }
+
+        for part in &partition {
+            // if /partition is a mountpoint, we would move it to $MODPATH/$partition when install
+            // otherwise it must be a symlink and we don't need to overlay!
+            let part_path = Path::new(&module).join(part);
+            if part_path.is_dir() {
+                if let Some(v) = partition_lowerdir.get_mut(*part) {
+                    v.push(format!("{}", part_path.display()));
+                }
+            }
+        }
+    }
+
+    // mount /system first
+    if let Err(e) = mount_partition("system", &system_lowerdir) {
+        warn!("mount system failed: {:#}", e);
+    }
+
+    // mount other partitions
+    for (k, v) in partition_lowerdir {
+        if let Err(e) = mount_partition(&k, &v) {
+            warn!("mount {k} failed: {:#}", e);
+        }
+    }
+
+    Ok(())
+}
+
+pub fn on_post_data_fs() -> Result<()> {
+    ksucalls::report_post_fs_data();
+
+    utils::umask(0);
+
+    #[cfg(unix)]
+    let _ = catch_bootlog("logcat", vec!["logcat"]);
+    #[cfg(unix)]
+    let _ = catch_bootlog("dmesg", vec!["dmesg", "-w"]);
+
+    if utils::has_magisk() {
+        warn!("Magisk detected, skip post-fs-data!");
+        return Ok(());
+    }
+
+    let safe_mode = crate::utils::is_safe_mode();
+
+    if safe_mode {
+        // we should still mount modules.img to `/data/adb/modules` in safe mode
+        // becuase we may need to operate the module dir in safe mode
+        warn!("safe mode, skip common post-fs-data.d scripts");
+    } else {
+        // Then exec common post-fs-data scripts
+        if let Err(e) = crate::module::exec_common_scripts("post-fs-data.d", true) {
+            warn!("exec common post-fs-data scripts failed: {}", e);
+        }
+    }
+
+    let module_update_img = defs::MODULE_UPDATE_IMG;
+    let module_img = defs::MODULE_IMG;
+    let module_dir = defs::MODULE_DIR;
+    let module_update_flag = Path::new(defs::WORKING_DIR).join(defs::UPDATE_FILE_NAME);
+
+    // modules.img is the default image
+    let mut target_update_img = &module_img;
+
+    // we should clean the module mount point if it exists
+    ensure_clean_dir(module_dir)?;
+
+    assets::ensure_binaries(true).with_context(|| "Failed to extract bin assets")?;
+
+    if Path::new(module_update_img).exists() {
+        if module_update_flag.exists() {
+            // if modules_update.img exists, and the the flag indicate this is an update
+            // this make sure that if the update failed, we will fallback to the old image
+            // if we boot succeed, we will rename the modules_update.img to modules.img #on_boot_complete
+            target_update_img = &module_update_img;
+            // And we should delete the flag immediately
+            std::fs::remove_file(module_update_flag)?;
+        } else {
+            // if modules_update.img exists, but the flag not exist, we should delete it
+            std::fs::remove_file(module_update_img)?;
+        }
+    }
+
+    if !Path::new(target_update_img).exists() {
+        return Ok(());
+    }
+
+    // we should always mount the module.img to module dir
+    // becuase we may need to operate the module dir in safe mode
+    info!("mount module image: {target_update_img} to {module_dir}");
+    mount::AutoMountExt4::try_new(target_update_img, module_dir, false)
+        .with_context(|| "mount module image failed".to_string())?;
+
+    // tell kernel that we've mount the module, so that it can do some optimization
+    ksucalls::report_module_mounted();
+
+    // if we are in safe mode, we should disable all modules
+    if safe_mode {
+        warn!("safe mode, skip post-fs-data scripts and disable all modules!");
+        if let Err(e) = crate::module::disable_all_modules() {
+            warn!("disable all modules failed: {}", e);
+        }
+        return Ok(());
+    }
+
+    if let Err(e) = prune_modules() {
+        warn!("prune modules failed: {}", e);
+    }
+
+    if let Err(e) = restorecon::restorecon() {
+        warn!("restorecon failed: {}", e);
+    }
+
+    // load sepolicy.rule
+    if crate::module::load_sepolicy_rule().is_err() {
+        warn!("load sepolicy.rule failed");
+    }
+
+    if let Err(e) = crate::profile::apply_sepolies() {
+        warn!("apply root profile sepolicy failed: {}", e);
+    }
+
+    // mount temp dir
+    if let Err(e) = mount::mount_tmpfs(utils::get_tmp_path()) {
+        warn!("do temp dir mount failed: {}", e);
+    }
+
+    // exec modules post-fs-data scripts
+    // TODO: Add timeout
+    if let Err(e) = crate::module::exec_stage_script("post-fs-data", true) {
+        warn!("exec post-fs-data scripts failed: {}", e);
+    }
+
+    // load system.prop
+    if let Err(e) = crate::module::load_system_prop() {
+        warn!("load system.prop failed: {}", e);
+    }
+
+    // mount module systemlessly by overlay
+    if let Err(e) = mount_modules_systemlessly(module_dir) {
+        warn!("do systemless mount failed: {}", e);
+    }
+
+    run_stage("post-mount", true);
+
+    std::env::set_current_dir("/").with_context(|| "failed to chdir to /")?;
+
+    Ok(())
+}
+
+fn run_stage(stage: &str, block: bool) {
+    utils::umask(0);
+
+    if utils::has_magisk() {
+        warn!("Magisk detected, skip {stage}");
+        return;
+    }
+
+    if crate::utils::is_safe_mode() {
+        warn!("safe mode, skip {stage} scripts");
+        return;
+    }
+
+    if let Err(e) = crate::module::exec_common_scripts(&format!("{stage}.d"), block) {
+        warn!("Failed to exec common {stage} scripts: {e}");
+    }
+    if let Err(e) = crate::module::exec_stage_script(stage, block) {
+        warn!("Failed to exec {stage} scripts: {e}");
+    }
+}
+
+pub fn on_services() -> Result<()> {
+    info!("on_services triggered!");
+    run_stage("service", false);
+
+    Ok(())
+}
+
+pub fn on_boot_completed() -> Result<()> {
+    ksucalls::report_boot_complete();
+    info!("on_boot_completed triggered!");
+    let module_update_img = Path::new(defs::MODULE_UPDATE_IMG);
+    let module_img = Path::new(defs::MODULE_IMG);
+    if module_update_img.exists() {
+        // this is a update and we successfully booted
+        if std::fs::rename(module_update_img, module_img).is_err() {
+            warn!("Failed to rename images, copy it now.",);
+            std::fs::copy(module_update_img, module_img)
+                .with_context(|| "Failed to copy images")?;
+            std::fs::remove_file(module_update_img).with_context(|| "Failed to remove image!")?;
+        }
+    }
+
+    run_stage("boot-completed", false);
+
+    Ok(())
+}
+
+#[cfg(unix)]
+fn catch_bootlog(logname: &str, command: Vec<&str>) -> Result<()> {
+    use std::os::unix::process::CommandExt;
+    use std::process::Stdio;
+
+    let logdir = Path::new(defs::LOG_DIR);
+    utils::ensure_dir_exists(logdir)?;
+    let bootlog = logdir.join(format!("{logname}.log"));
+    let oldbootlog = logdir.join(format!("{logname}.old.log"));
+
+    if bootlog.exists() {
+        std::fs::rename(&bootlog, oldbootlog)?;
+    }
+
+    let bootlog = std::fs::File::create(bootlog)?;
+
+    let mut args = vec!["-s", "9", "30s"];
+    args.extend_from_slice(&command);
+    // timeout -s 9 30s logcat > boot.log
+    let result = unsafe {
+        std::process::Command::new("timeout")
+            .process_group(0)
+            .pre_exec(|| {
+                utils::switch_cgroups();
+                Ok(())
+            })
+            .args(args)
+            .stdout(Stdio::from(bootlog))
+            .spawn()
+    };
+
+    if let Err(e) = result {
+        warn!("Failed to start logcat: {:#}", e);
+    }
+
+    Ok(())
+}
diff --git a/userspace/ksud32/src/installer.sh b/userspace/ksud32/src/installer.sh
new file mode 100644
index 000000000000..40138ae3b15a
--- /dev/null
+++ b/userspace/ksud32/src/installer.sh
@@ -0,0 +1,446 @@
+#!/system/bin/sh
+############################################
+# KernelSU installer script
+# mostly from module_installer.sh
+# and util_functions.sh in Magisk
+############################################
+
+umask 022
+
+ui_print() {
+  if $BOOTMODE; then
+    echo "$1"
+  else
+    echo -e "ui_print $1\nui_print" >> /proc/self/fd/$OUTFD
+  fi
+}
+
+toupper() {
+  echo "$@" | tr '[:lower:]' '[:upper:]'
+}
+
+grep_cmdline() {
+  local REGEX="s/^$1=//p"
+  { echo $(cat /proc/cmdline)$(sed -e 's/[^"]//g' -e 's/""//g' /proc/cmdline) | xargs -n 1; \
+    sed -e 's/ = /=/g' -e 's/, /,/g' -e 's/"//g' /proc/bootconfig; \
+  } 2>/dev/null | sed -n "$REGEX"
+}
+
+grep_prop() {
+  local REGEX="s/$1=//p"
+  shift
+  local FILES=$@
+  [ -z "$FILES" ] && FILES='/system/build.prop'
+  cat $FILES 2>/dev/null | dos2unix | sed -n "$REGEX" | head -n 1 | xargs
+}
+
+grep_get_prop() {
+  local result=$(grep_prop $@)
+  if [ -z "$result" ]; then
+    # Fallback to getprop
+    getprop "$1"
+  else
+    echo $result
+  fi
+}
+
+is_mounted() {
+  grep -q " $(readlink -f $1) " /proc/mounts 2>/dev/null
+  return $?
+}
+
+abort() {
+  ui_print "$1"
+  $BOOTMODE || recovery_cleanup
+  [ ! -z $MODPATH ] && rm -rf $MODPATH
+  rm -rf $TMPDIR
+  exit 1
+}
+
+print_title() {
+  local len line1len line2len bar
+  line1len=$(echo -n $1 | wc -c)
+  line2len=$(echo -n $2 | wc -c)
+  len=$line2len
+  [ $line1len -gt $line2len ] && len=$line1len
+  len=$((len + 2))
+  bar=$(printf "%${len}s" | tr ' ' '*')
+  ui_print "$bar"
+  ui_print " $1 "
+  [ "$2" ] && ui_print " $2 "
+  ui_print "$bar"
+}
+
+check_sepolicy() {
+    /data/adb/ksud sepolicy check "$1"
+    return $?
+}
+
+######################
+# Environment Related
+######################
+
+setup_flashable() {
+  ensure_bb
+  $BOOTMODE && return
+  if [ -z $OUTFD ] || readlink /proc/$$/fd/$OUTFD | grep -q /tmp; then
+    # We will have to manually find out OUTFD
+    for FD in `ls /proc/$$/fd`; do
+      if readlink /proc/$$/fd/$FD | grep -q pipe; then
+        if ps | grep -v grep | grep -qE " 3 $FD |status_fd=$FD"; then
+          OUTFD=$FD
+          break
+        fi
+      fi
+    done
+  fi
+  recovery_actions
+}
+
+ensure_bb() {
+  :
+}
+
+recovery_actions() {
+  :
+}
+
+recovery_cleanup() {
+  :
+}
+
+#######################
+# Installation Related
+#######################
+
+# find_block [partname...]
+find_block() {
+  local BLOCK DEV DEVICE DEVNAME PARTNAME UEVENT
+  for BLOCK in "$@"; do
+    DEVICE=`find /dev/block \( -type b -o -type c -o -type l \) -iname $BLOCK | head -n 1` 2>/dev/null
+    if [ ! -z $DEVICE ]; then
+      readlink -f $DEVICE
+      return 0
+    fi
+  done
+  # Fallback by parsing sysfs uevents
+  for UEVENT in /sys/dev/block/*/uevent; do
+    DEVNAME=`grep_prop DEVNAME $UEVENT`
+    PARTNAME=`grep_prop PARTNAME $UEVENT`
+    for BLOCK in "$@"; do
+      if [ "$(toupper $BLOCK)" = "$(toupper $PARTNAME)" ]; then
+        echo /dev/block/$DEVNAME
+        return 0
+      fi
+    done
+  done
+  # Look just in /dev in case we're dealing with MTD/NAND without /dev/block devices/links
+  for DEV in "$@"; do
+    DEVICE=`find /dev \( -type b -o -type c -o -type l \) -maxdepth 1 -iname $DEV | head -n 1` 2>/dev/null
+    if [ ! -z $DEVICE ]; then
+      readlink -f $DEVICE
+      return 0
+    fi
+  done
+  return 1
+}
+
+# setup_mntpoint <mountpoint>
+setup_mntpoint() {
+  local POINT=$1
+  [ -L $POINT ] && mv -f $POINT ${POINT}_link
+  if [ ! -d $POINT ]; then
+    rm -f $POINT
+    mkdir -p $POINT
+  fi
+}
+
+# mount_name <partname(s)> <mountpoint> <flag>
+mount_name() {
+  local PART=$1
+  local POINT=$2
+  local FLAG=$3
+  setup_mntpoint $POINT
+  is_mounted $POINT && return
+  # First try mounting with fstab
+  mount $FLAG $POINT 2>/dev/null
+  if ! is_mounted $POINT; then
+    local BLOCK=$(find_block $PART)
+    mount $FLAG $BLOCK $POINT || return
+  fi
+  ui_print "- Mounting $POINT"
+}
+
+# mount_ro_ensure <partname(s)> <mountpoint>
+mount_ro_ensure() {
+  # We handle ro partitions only in recovery
+  $BOOTMODE && return
+  local PART=$1
+  local POINT=$2
+  mount_name "$PART" $POINT '-o ro'
+  is_mounted $POINT || abort "! Cannot mount $POINT"
+}
+
+mount_partitions() {
+  # Check A/B slot
+  SLOT=`grep_cmdline androidboot.slot_suffix`
+  if [ -z $SLOT ]; then
+    SLOT=`grep_cmdline androidboot.slot`
+    [ -z $SLOT ] || SLOT=_${SLOT}
+  fi
+  [ -z $SLOT ] || ui_print "- Current boot slot: $SLOT"
+
+  # Mount ro partitions
+  if is_mounted /system_root; then
+    umount /system 2&>/dev/null
+    umount /system_root 2&>/dev/null
+  fi
+  mount_ro_ensure "system$SLOT app$SLOT" /system
+  if [ -f /system/init -o -L /system/init ]; then
+    SYSTEM_ROOT=true
+    setup_mntpoint /system_root
+    if ! mount --move /system /system_root; then
+      umount /system
+      umount -l /system 2>/dev/null
+      mount_ro_ensure "system$SLOT app$SLOT" /system_root
+    fi
+    mount -o bind /system_root/system /system
+  else
+    SYSTEM_ROOT=false
+    grep ' / ' /proc/mounts | grep -qv 'rootfs' || grep -q ' /system_root ' /proc/mounts && SYSTEM_ROOT=true
+  fi
+  # /vendor is used only on some older devices for recovery AVBv1 signing so is not critical if fails
+  [ -L /system/vendor ] && mount_name vendor$SLOT /vendor '-o ro'
+  $SYSTEM_ROOT && ui_print "- Device is system-as-root"
+
+  # Mount sepolicy rules dir locations in recovery (best effort)
+  if ! $BOOTMODE; then
+    mount_name "cache cac" /cache
+    mount_name metadata /metadata
+    mount_name persist /persist
+  fi
+}
+
+api_level_arch_detect() {
+  API=$(grep_get_prop ro.build.version.sdk)
+  ABI=$(grep_get_prop ro.product.cpu.abi)
+  if [ "$ABI" = "x86" ]; then
+    ARCH=x86
+    ABI32=x86
+    IS64BIT=false
+  elif [ "$ABI" = "arm64-v8a" ]; then
+    ARCH=arm64
+    ABI32=armeabi-v7a
+    IS64BIT=true
+  elif [ "$ABI" = "x86_64" ]; then
+    ARCH=x64
+    ABI32=x86
+    IS64BIT=true
+  else
+    ARCH=arm
+    ABI=armeabi-v7a
+    ABI32=armeabi-v7a
+    IS64BIT=false
+  fi
+}
+
+#################
+# Module Related
+#################
+
+set_perm() {
+  chown $2:$3 $1 || return 1
+  chmod $4 $1 || return 1
+  local CON=$5
+  [ -z $CON ] && CON=u:object_r:system_file:s0
+  chcon $CON $1 || return 1
+}
+
+set_perm_recursive() {
+  find $1 -type d 2>/dev/null | while read dir; do
+    set_perm $dir $2 $3 $4 $6
+  done
+  find $1 -type f -o -type l 2>/dev/null | while read file; do
+    set_perm $file $2 $3 $5 $6
+  done
+}
+
+mktouch() {
+  mkdir -p ${1%/*} 2>/dev/null
+  [ -z $2 ] && touch $1 || echo $2 > $1
+  chmod 644 $1
+}
+
+mark_remove() {
+  mkdir -p ${1%/*} 2>/dev/null
+  mknod $1 c 0 0
+  chmod 644 $1
+}
+
+mark_replace() {
+  # REPLACE must be directory!!!
+  # https://docs.kernel.org/filesystems/overlayfs.html#whiteouts-and-opaque-directories
+  mkdir -p $1 2>/dev/null
+  setfattr -n trusted.overlay.opaque -v y $1
+  chmod 644 $1
+}
+
+request_size_check() {
+  reqSizeM=`du -ms "$1" | cut -f1`
+}
+
+request_zip_size_check() {
+  reqSizeM=`unzip -l "$1" | tail -n 1 | awk '{ print int(($1 - 1) / 1048576 + 1) }'`
+}
+
+boot_actions() { return; }
+
+# Require ZIPFILE to be set
+is_legacy_script() {
+  unzip -l "$ZIPFILE" install.sh | grep -q install.sh
+  return $?
+}
+
+handle_partition() {
+    # if /system/vendor is a symlink, we need to move it out of $MODPATH/system, otherwise it will be overlayed
+    # if /system/vendor is a normal directory, it is ok to overlay it and we don't need to overlay it separately.
+    if [ ! -e $MODPATH/system/$1 ]; then
+        # no partition found
+        return;
+    fi
+
+    if [ -L "/system/$1" ] && [ "$(readlink -f /system/$1)" = "/$1" ]; then
+        ui_print "- Handle partition /$1"
+        # we create a symlink if module want to access $MODPATH/system/$1
+        # but it doesn't always work(ie. write it in post-fs-data.sh would fail because it is readonly)
+        mv -f $MODPATH/system/$1 $MODPATH/$1 && ln -sf ../$1 $MODPATH/system/$1
+    fi
+}
+
+# Require OUTFD, ZIPFILE to be set
+install_module() {
+  rm -rf $TMPDIR
+  mkdir -p $TMPDIR
+  chcon u:object_r:system_file:s0 $TMPDIR
+  cd $TMPDIR
+
+  mount_partitions
+  api_level_arch_detect
+
+  # Setup busybox and binaries
+  if $BOOTMODE; then
+    boot_actions
+  else
+    recovery_actions
+  fi
+
+  # Extract prop file
+  unzip -o "$ZIPFILE" module.prop -d $TMPDIR >&2
+  [ ! -f $TMPDIR/module.prop ] && abort "! Unable to extract zip file!"
+
+  local MODDIRNAME=modules
+  $BOOTMODE && MODDIRNAME=modules_update
+  local MODULEROOT=$NVBASE/$MODDIRNAME
+  MODID=`grep_prop id $TMPDIR/module.prop`
+  MODNAME=`grep_prop name $TMPDIR/module.prop`
+  MODAUTH=`grep_prop author $TMPDIR/module.prop`
+  MODPATH=$MODULEROOT/$MODID
+
+  # Create mod paths
+  rm -rf $MODPATH
+  mkdir -p $MODPATH
+
+  if is_legacy_script; then
+    unzip -oj "$ZIPFILE" module.prop install.sh uninstall.sh 'common/*' -d $TMPDIR >&2
+
+    # Load install script
+    . $TMPDIR/install.sh
+
+    # Callbacks
+    print_modname
+    on_install
+
+    [ -f $TMPDIR/uninstall.sh ] && cp -af $TMPDIR/uninstall.sh $MODPATH/uninstall.sh
+    $SKIPMOUNT && touch $MODPATH/skip_mount
+    $PROPFILE && cp -af $TMPDIR/system.prop $MODPATH/system.prop
+    cp -af $TMPDIR/module.prop $MODPATH/module.prop
+    $POSTFSDATA && cp -af $TMPDIR/post-fs-data.sh $MODPATH/post-fs-data.sh
+    $LATESTARTSERVICE && cp -af $TMPDIR/service.sh $MODPATH/service.sh
+
+    ui_print "- Setting permissions"
+    set_permissions
+  else
+    print_title "$MODNAME" "by $MODAUTH"
+    print_title "Powered by KernelSU"
+
+    unzip -o "$ZIPFILE" customize.sh -d $MODPATH >&2
+
+    if ! grep -q '^SKIPUNZIP=1$' $MODPATH/customize.sh 2>/dev/null; then
+      ui_print "- Extracting module files"
+      unzip -o "$ZIPFILE" -x 'META-INF/*' -d $MODPATH >&2
+
+      # Default permissions
+      set_perm_recursive $MODPATH 0 0 0755 0644
+      set_perm_recursive $MODPATH/system/bin 0 2000 0755 0755
+      set_perm_recursive $MODPATH/system/xbin 0 2000 0755 0755
+      set_perm_recursive $MODPATH/system/system_ext/bin 0 2000 0755 0755
+      set_perm_recursive $MODPATH/system/vendor 0 2000 0755 0755 u:object_r:vendor_file:s0
+    fi
+
+    # Load customization script
+    [ -f $MODPATH/customize.sh ] && . $MODPATH/customize.sh
+  fi
+
+  # Handle replace folders
+  for TARGET in $REPLACE; do
+    ui_print "- Replace target: $TARGET"
+    mark_replace $MODPATH$TARGET
+  done
+
+  # Handle remove files
+  for TARGET in $REMOVE; do
+    ui_print "- Remove target: $TARGET"
+    mark_remove $MODPATH$TARGET
+  done
+
+  handle_partition vendor
+  handle_partition system_ext
+  handle_partition product
+
+  if $BOOTMODE; then
+    mktouch $NVBASE/modules/$MODID/update
+    rm -rf $NVBASE/modules/$MODID/remove 2>/dev/null
+    rm -rf $NVBASE/modules/$MODID/disable 2>/dev/null
+    cp -af $MODPATH/module.prop $NVBASE/modules/$MODID/module.prop
+  fi
+
+  # Remove stuff that doesn't belong to modules and clean up any empty directories
+  rm -rf \
+  $MODPATH/system/placeholder $MODPATH/customize.sh \
+  $MODPATH/README.md $MODPATH/.git*
+  rmdir -p $MODPATH 2>/dev/null
+
+  cd /
+  $BOOTMODE || recovery_cleanup
+  rm -rf $TMPDIR
+
+  ui_print "- Done"
+}
+
+##########
+# Presets
+##########
+
+# Detect whether in boot mode
+[ -z $BOOTMODE ] && ps | grep zygote | grep -qv grep && BOOTMODE=true
+[ -z $BOOTMODE ] && ps -A 2>/dev/null | grep zygote | grep -qv grep && BOOTMODE=true
+[ -z $BOOTMODE ] && BOOTMODE=false
+
+NVBASE=/data/adb
+TMPDIR=/dev/tmp
+POSTFSDATAD=$NVBASE/post-fs-data.d
+SERVICED=$NVBASE/service.d
+
+# Some modules dependents on this
+export MAGISK_VER=25.2
+export MAGISK_VER_CODE=25200
diff --git a/userspace/ksud32/src/ksucalls.rs b/userspace/ksud32/src/ksucalls.rs
new file mode 100644
index 000000000000..596df5458670
--- /dev/null
+++ b/userspace/ksud32/src/ksucalls.rs
@@ -0,0 +1,43 @@
+const EVENT_POST_FS_DATA: u64 = 1;
+const EVENT_BOOT_COMPLETED: u64 = 2;
+const EVENT_MODULE_MOUNTED: u64 = 3;
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn get_version() -> i32 {
+    rustix::process::ksu_get_version()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn get_version() -> i32 {
+    0
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+fn report_event(event: u64) {
+    rustix::process::ksu_report_event(event)
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+fn report_event(_event: u64) {}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn check_kernel_safemode() -> bool {
+    rustix::process::ksu_check_kernel_safemode()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn check_kernel_safemode() -> bool {
+    false
+}
+
+pub fn report_post_fs_data() {
+    report_event(EVENT_POST_FS_DATA);
+}
+
+pub fn report_boot_complete() {
+    report_event(EVENT_BOOT_COMPLETED);
+}
+
+pub fn report_module_mounted() {
+    report_event(EVENT_MODULE_MOUNTED);
+}
diff --git a/userspace/ksud32/src/main.rs b/userspace/ksud32/src/main.rs
new file mode 100644
index 000000000000..f2d0efc97c4b
--- /dev/null
+++ b/userspace/ksud32/src/main.rs
@@ -0,0 +1,18 @@
+mod apk_sign;
+mod assets;
+mod cli;
+mod debug;
+mod defs;
+mod init_event;
+mod ksucalls;
+mod module;
+mod mount;
+mod profile;
+mod restorecon;
+mod sepolicy;
+mod su;
+mod utils;
+
+fn main() -> anyhow::Result<()> {
+    cli::run()
+}
diff --git a/userspace/ksud32/src/module.rs b/userspace/ksud32/src/module.rs
new file mode 100644
index 000000000000..3cd962074941
--- /dev/null
+++ b/userspace/ksud32/src/module.rs
@@ -0,0 +1,706 @@
+#[allow(clippy::wildcard_imports)]
+use crate::utils::*;
+use crate::{
+    assets, defs, ksucalls, mount,
+    restorecon::{restore_syscon, setsyscon},
+    sepolicy,
+};
+
+use anyhow::{anyhow, bail, ensure, Context, Result};
+use const_format::concatcp;
+use is_executable::is_executable;
+use java_properties::PropertiesIter;
+use log::{info, warn};
+
+use std::{
+    collections::HashMap,
+    env::var as env_var,
+    fs::{remove_dir_all, remove_file, set_permissions, File, Permissions},
+    io::Cursor,
+    path::{Path, PathBuf},
+    process::{Command, Stdio},
+    str::FromStr,
+};
+use zip_extensions::zip_extract_file_to_memory;
+
+#[cfg(unix)]
+use std::os::unix::{prelude::PermissionsExt, process::CommandExt};
+
+const INSTALLER_CONTENT: &str = include_str!("./installer.sh");
+const INSTALL_MODULE_SCRIPT: &str = concatcp!(
+    INSTALLER_CONTENT,
+    "\n",
+    "install_module",
+    "\n",
+    "exit 0",
+    "\n"
+);
+
+fn exec_install_script(module_file: &str) -> Result<()> {
+    let realpath = std::fs::canonicalize(module_file)
+        .with_context(|| format!("realpath: {module_file} failed"))?;
+
+    let result = Command::new(assets::BUSYBOX_PATH)
+        .args(["sh", "-c", INSTALL_MODULE_SCRIPT])
+        .env("ASH_STANDALONE", "1")
+        .env(
+            "PATH",
+            format!(
+                "{}:{}",
+                env_var("PATH").unwrap(),
+                defs::BINARY_DIR.trim_end_matches('/')
+            ),
+        )
+        .env("KSU", "true")
+        .env("KSU_KERNEL_VER_CODE", ksucalls::get_version().to_string())
+        .env("KSU_VER", defs::VERSION_NAME)
+        .env("KSU_VER_CODE", defs::VERSION_CODE)
+        .env("OUTFD", "1")
+        .env("ZIPFILE", realpath)
+        .status()?;
+    ensure!(result.success(), "Failed to install module script");
+    Ok(())
+}
+
+// becuase we use something like A-B update
+// we need to update the module state after the boot_completed
+// if someone(such as the module) install a module before the boot_completed
+// then it may cause some problems, just forbid it
+fn ensure_boot_completed() -> Result<()> {
+    // ensure getprop sys.boot_completed == 1
+    if getprop("sys.boot_completed").as_deref() != Some("1") {
+        bail!("Android is Booting!");
+    }
+    Ok(())
+}
+
+fn mark_update() -> Result<()> {
+    ensure_file_exists(concatcp!(defs::WORKING_DIR, defs::UPDATE_FILE_NAME))
+}
+
+fn mark_module_state(module: &str, flag_file: &str, create_or_delete: bool) -> Result<()> {
+    let module_state_file = Path::new(defs::MODULE_DIR).join(module).join(flag_file);
+    if create_or_delete {
+        ensure_file_exists(module_state_file)
+    } else {
+        if module_state_file.exists() {
+            std::fs::remove_file(module_state_file)?;
+        }
+        Ok(())
+    }
+}
+
+fn foreach_module(active_only: bool, mut f: impl FnMut(&Path) -> Result<()>) -> Result<()> {
+    let modules_dir = Path::new(defs::MODULE_DIR);
+    let dir = std::fs::read_dir(modules_dir)?;
+    for entry in dir.flatten() {
+        let path = entry.path();
+        if !path.is_dir() {
+            warn!("{} is not a directory, skip", path.display());
+            continue;
+        }
+
+        if active_only && path.join(defs::DISABLE_FILE_NAME).exists() {
+            info!("{} is disabled, skip", path.display());
+            continue;
+        }
+        if active_only && path.join(defs::REMOVE_FILE_NAME).exists() {
+            warn!("{} is removed, skip", path.display());
+            continue;
+        }
+
+        f(&path)?;
+    }
+
+    Ok(())
+}
+
+fn foreach_active_module(f: impl FnMut(&Path) -> Result<()>) -> Result<()> {
+    foreach_module(true, f)
+}
+
+fn get_minimal_image_size(img: &str) -> Result<u64> {
+    check_image(img)?;
+    let output = Command::new("resize2fs")
+        .args(["-P", img])
+        .stdout(Stdio::piped())
+        .output()?;
+    let output = String::from_utf8_lossy(&output.stdout);
+    println!("- {}", output.trim());
+    let regex = regex::Regex::new(r"filesystem: (\d+)")?;
+    let result = regex
+        .captures(&output)
+        .ok_or(anyhow::anyhow!("regex not match"))?;
+    let result = &result[1];
+    let result = u64::from_str(result)?;
+    Ok(result)
+}
+
+fn check_image(img: &str) -> Result<()> {
+    let result = Command::new("e2fsck")
+        .args(["-yf", img])
+        .stdout(Stdio::piped())
+        .status()
+        .with_context(|| format!("Failed to exec e2fsck {img}"))?;
+    let code = result.code();
+    // 0 or 1 is ok
+    // 0: no error
+    // 1: file system errors corrected
+    // https://man7.org/linux/man-pages/man8/e2fsck.8.html
+    // ensure!(
+    //     code == Some(0) || code == Some(1),
+    //     "Failed to check image, e2fsck exit code: {}",
+    //     code.unwrap_or(-1)
+    // );
+    info!("e2fsck exit code: {}", code.unwrap_or(-1));
+    Ok(())
+}
+
+fn grow_image_size(img: &str, extra_size: u64) -> Result<()> {
+    let minimal_size = get_minimal_image_size(img)?; // the minimal size is in KB
+    let target_size = minimal_size * 1024 + extra_size;
+    // check image
+    check_image(img)?;
+    println!(
+        "- Target image size: {}",
+        humansize::format_size(target_size, humansize::DECIMAL)
+    );
+    let target_size = target_size / 1024 + 1024;
+    info!("resize image to {target_size}K, minimal size is {minimal_size}K");
+    let result = Command::new("resize2fs")
+        .args([img, &format!("{target_size}K")])
+        .stdout(Stdio::piped())
+        .status()
+        .with_context(|| format!("Failed to exec resize2fs {img}"))?;
+    ensure!(result.success(), "Failed to resize2fs: {}", result);
+    check_image(img)?;
+    Ok(())
+}
+
+pub fn load_sepolicy_rule() -> Result<()> {
+    foreach_active_module(|path| {
+        let rule_file = path.join("sepolicy.rule");
+        if !rule_file.exists() {
+            return Ok(());
+        }
+        info!("load policy: {}", &rule_file.display());
+
+        if sepolicy::apply_file(&rule_file).is_err() {
+            warn!("Failed to load sepolicy.rule for {}", &rule_file.display());
+        }
+        Ok(())
+    })?;
+
+    Ok(())
+}
+
+fn exec_script<T: AsRef<Path>>(path: T, wait: bool) -> Result<()> {
+    info!("exec {}", path.as_ref().display());
+
+    let mut command = &mut Command::new(assets::BUSYBOX_PATH);
+    #[cfg(unix)]
+    {
+        command = command.process_group(0);
+        command = unsafe {
+            command.pre_exec(|| {
+                // ignore the error?
+                switch_cgroups();
+                Ok(())
+            })
+        };
+    }
+    command = command
+        .current_dir(path.as_ref().parent().unwrap())
+        .arg("sh")
+        .arg(path.as_ref())
+        .env("ASH_STANDALONE", "1")
+        .env("KSU", "true")
+        .env("KSU_KERNEL_VER_CODE", ksucalls::get_version().to_string())
+        .env("KSU_VER_CODE", defs::VERSION_CODE)
+        .env("KSU_VER", defs::VERSION_NAME)
+        .env(
+            "PATH",
+            format!(
+                "{}:{}",
+                env_var("PATH").unwrap(),
+                defs::BINARY_DIR.trim_end_matches('/')
+            ),
+        );
+
+    let result = if wait {
+        command.status().map(|_| ())
+    } else {
+        command.spawn().map(|_| ())
+    };
+    result.map_err(|err| anyhow!("Failed to exec {}: {}", path.as_ref().display(), err))
+}
+
+pub fn exec_stage_script(stage: &str, block: bool) -> Result<()> {
+    foreach_active_module(|module| {
+        let script_path = module.join(format!("{stage}.sh"));
+        if !script_path.exists() {
+            return Ok(());
+        }
+
+        exec_script(&script_path, block)
+    })?;
+
+    Ok(())
+}
+
+pub fn exec_common_scripts(dir: &str, wait: bool) -> Result<()> {
+    let script_dir = Path::new(defs::ADB_DIR).join(dir);
+    if !script_dir.exists() {
+        info!("{} not exists, skip", script_dir.display());
+        return Ok(());
+    }
+
+    let dir = std::fs::read_dir(&script_dir)?;
+    for entry in dir.flatten() {
+        let path = entry.path();
+
+        if !is_executable(&path) {
+            warn!("{} is not executable, skip", path.display());
+            continue;
+        }
+
+        exec_script(path, wait)?;
+    }
+
+    Ok(())
+}
+
+pub fn load_system_prop() -> Result<()> {
+    foreach_active_module(|module| {
+        let system_prop = module.join("system.prop");
+        if !system_prop.exists() {
+            return Ok(());
+        }
+        info!("load {} system.prop", module.display());
+
+        // resetprop -n --file system.prop
+        Command::new(assets::RESETPROP_PATH)
+            .arg("-n")
+            .arg("--file")
+            .arg(&system_prop)
+            .status()
+            .with_context(|| format!("Failed to exec {}", system_prop.display()))?;
+
+        Ok(())
+    })?;
+
+    Ok(())
+}
+
+pub fn prune_modules() -> Result<()> {
+    foreach_module(false, |module| {
+        remove_file(module.join(defs::UPDATE_FILE_NAME)).ok();
+
+        if !module.join(defs::REMOVE_FILE_NAME).exists() {
+            return Ok(());
+        }
+
+        info!("remove module: {}", module.display());
+
+        let uninstaller = module.join("uninstall.sh");
+        if uninstaller.exists() {
+            if let Err(e) = exec_script(uninstaller, true) {
+                warn!("Failed to exec uninstaller: {}", e);
+            }
+        }
+
+        if let Err(e) = remove_dir_all(module) {
+            warn!("Failed to remove {}: {}", module.display(), e);
+        }
+
+        Ok(())
+    })?;
+
+    Ok(())
+}
+
+fn _install_module(zip: &str) -> Result<()> {
+    ensure_boot_completed()?;
+
+    // print banner
+    println!(include_str!("banner"));
+
+    assets::ensure_binaries(false).with_context(|| "Failed to extract assets")?;
+
+    // first check if workding dir is usable
+    ensure_dir_exists(defs::WORKING_DIR).with_context(|| "Failed to create working dir")?;
+    ensure_dir_exists(defs::BINARY_DIR).with_context(|| "Failed to create bin dir")?;
+
+    // read the module_id from zip, if faild if will return early.
+    let mut buffer: Vec<u8> = Vec::new();
+    let entry_path = PathBuf::from_str("module.prop")?;
+    let zip_path = PathBuf::from_str(zip)?;
+    let zip_path = zip_path.canonicalize()?;
+    zip_extract_file_to_memory(&zip_path, &entry_path, &mut buffer)?;
+
+    let mut module_prop = HashMap::new();
+    PropertiesIter::new_with_encoding(Cursor::new(buffer), encoding_rs::UTF_8).read_into(
+        |k, v| {
+            module_prop.insert(k, v);
+        },
+    )?;
+    info!("module prop: {:?}", module_prop);
+
+    let Some(module_id) = module_prop.get("id") else {
+        bail!("module id not found in module.prop!");
+    };
+    let module_id = module_id.trim();
+
+    let modules_img = Path::new(defs::MODULE_IMG);
+    let modules_update_img = Path::new(defs::MODULE_UPDATE_IMG);
+    let module_update_tmp_dir = defs::MODULE_UPDATE_TMP_DIR;
+
+    let modules_img_exist = modules_img.exists();
+    let modules_update_img_exist = modules_update_img.exists();
+
+    // prepare the tmp module img
+    let tmp_module_img = defs::MODULE_UPDATE_TMP_IMG;
+    let tmp_module_path = Path::new(tmp_module_img);
+    if tmp_module_path.exists() {
+        std::fs::remove_file(tmp_module_path)?;
+    }
+
+    let default_reserve_size = 256 * 1024 * 1024;
+    let zip_uncompressed_size = get_zip_uncompressed_size(zip)?;
+    let grow_size = default_reserve_size + zip_uncompressed_size;
+
+    info!(
+        "zip uncompressed size: {}",
+        humansize::format_size(zip_uncompressed_size, humansize::DECIMAL)
+    );
+    info!(
+        "grow size: {}",
+        humansize::format_size(grow_size, humansize::DECIMAL)
+    );
+
+    println!("- Preparing image");
+    println!(
+        "- Module size: {}",
+        humansize::format_size(zip_uncompressed_size, humansize::DECIMAL)
+    );
+
+    if !modules_img_exist && !modules_update_img_exist {
+        // if no modules and modules_update, it is brand new installation, we should create a new img
+        // create a tmp module img and mount it to modules_update
+        info!("Creating brand new module image");
+        File::create(tmp_module_img)
+            .context("Failed to create ext4 image file")?
+            .set_len(grow_size)
+            .context("Failed to extend ext4 image")?;
+        // format the img to ext4 filesystem
+        let result = Command::new("mkfs.ext4")
+            .arg("-b")
+            .arg("1024")
+            .arg(tmp_module_img)
+            .stdout(Stdio::piped())
+            .output()?;
+        ensure!(
+            result.status.success(),
+            "Failed to format ext4 image: {}",
+            String::from_utf8(result.stderr).unwrap()
+        );
+        check_image(tmp_module_img)?;
+    } else if modules_update_img_exist {
+        // modules_update.img exists, we should use it as tmp img
+        info!("Using existing modules_update.img as tmp image");
+        std::fs::copy(modules_update_img, tmp_module_img).with_context(|| {
+            format!(
+                "Failed to copy {} to {}",
+                modules_update_img.display(),
+                tmp_module_img
+            )
+        })?;
+        // grow size of the tmp image
+        grow_image_size(tmp_module_img, grow_size)?;
+    } else {
+        // modules.img exists, we should use it as tmp img
+        info!("Using existing modules.img as tmp image");
+        std::fs::copy(modules_img, tmp_module_img).with_context(|| {
+            format!(
+                "Failed to copy {} to {}",
+                modules_img.display(),
+                tmp_module_img
+            )
+        })?;
+        // grow size of the tmp image
+        grow_image_size(tmp_module_img, grow_size)?;
+    }
+
+    // ensure modules_update exists
+    ensure_dir_exists(module_update_tmp_dir)?;
+
+    // mount the modules_update.img to mountpoint
+    println!("- Mounting image");
+
+    let _dontdrop = mount::AutoMountExt4::try_new(tmp_module_img, module_update_tmp_dir, true)?;
+
+    info!("mounted {} to {}", tmp_module_img, module_update_tmp_dir);
+
+    setsyscon(module_update_tmp_dir)?;
+
+    let module_dir = format!("{module_update_tmp_dir}/{module_id}");
+    ensure_clean_dir(&module_dir)?;
+    info!("module dir: {}", module_dir);
+
+    // unzip the image and move it to modules_update/<id> dir
+    let file = File::open(zip)?;
+    let mut archive = zip::ZipArchive::new(file)?;
+    archive.extract(&module_dir)?;
+
+    // set permission and selinux context for $MOD/system
+    let module_system_dir = PathBuf::from(module_dir).join("system");
+    if module_system_dir.exists() {
+        #[cfg(unix)]
+        set_permissions(&module_system_dir, Permissions::from_mode(0o755))?;
+        restore_syscon(&module_system_dir)?;
+    }
+
+    exec_install_script(zip)?;
+
+    info!("rename {tmp_module_img} to {}", defs::MODULE_UPDATE_IMG);
+    // all done, rename the tmp image to modules_update.img
+    if std::fs::rename(tmp_module_img, defs::MODULE_UPDATE_IMG).is_err() {
+        warn!("Rename image failed, try copy it.");
+        std::fs::copy(tmp_module_img, defs::MODULE_UPDATE_IMG)
+            .with_context(|| "Failed to copy image.".to_string())?;
+        let _ = std::fs::remove_file(tmp_module_img);
+    }
+
+    mark_update()?;
+
+    info!("Module install successfully!");
+
+    Ok(())
+}
+
+pub fn install_module(zip: &str) -> Result<()> {
+    let result = _install_module(zip);
+    if let Err(ref e) = result {
+        // error happened, do some cleanup!
+        let _ = std::fs::remove_file(defs::MODULE_UPDATE_TMP_IMG);
+        let _ = mount::umount_dir(defs::MODULE_UPDATE_TMP_DIR);
+        println!("- Error: {e}");
+    }
+    result
+}
+
+fn update_module<F>(update_dir: &str, id: &str, func: F) -> Result<()>
+where
+    F: Fn(&str, &str) -> Result<()>,
+{
+    ensure_boot_completed()?;
+
+    let modules_img = Path::new(defs::MODULE_IMG);
+    let modules_update_img = Path::new(defs::MODULE_UPDATE_IMG);
+    let modules_update_tmp_img = Path::new(defs::MODULE_UPDATE_TMP_IMG);
+    if !modules_update_img.exists() && !modules_img.exists() {
+        bail!("Please install module first!");
+    } else if modules_update_img.exists() {
+        info!(
+            "copy {} to {}",
+            modules_update_img.display(),
+            modules_update_tmp_img.display()
+        );
+        std::fs::copy(modules_update_img, modules_update_tmp_img)?;
+    } else {
+        info!(
+            "copy {} to {}",
+            modules_img.display(),
+            modules_update_tmp_img.display()
+        );
+        std::fs::copy(modules_update_img, modules_update_tmp_img)?;
+    }
+
+    // ensure modules_update dir exist
+    ensure_clean_dir(update_dir)?;
+
+    // mount the modules_update img
+    let _dontdrop = mount::AutoMountExt4::try_new(defs::MODULE_UPDATE_TMP_IMG, update_dir, true)?;
+
+    // call the operation func
+    let result = func(id, update_dir);
+
+    if let Err(e) = std::fs::rename(modules_update_tmp_img, defs::MODULE_UPDATE_IMG) {
+        warn!("Rename image failed: {e}, try copy it.");
+        std::fs::copy(modules_update_tmp_img, defs::MODULE_UPDATE_IMG)
+            .with_context(|| "Failed to copy image.".to_string())?;
+        let _ = std::fs::remove_file(modules_update_tmp_img);
+    }
+
+    mark_update()?;
+
+    result
+}
+
+pub fn uninstall_module(id: &str) -> Result<()> {
+    update_module(defs::MODULE_UPDATE_TMP_DIR, id, |mid, update_dir| {
+        let dir = Path::new(update_dir);
+        ensure!(dir.exists(), "No module installed");
+
+        // iterate the modules_update dir, find the module to be removed
+        let dir = std::fs::read_dir(dir)?;
+        for entry in dir.flatten() {
+            let path = entry.path();
+            let module_prop = path.join("module.prop");
+            if !module_prop.exists() {
+                continue;
+            }
+            let content = std::fs::read(module_prop)?;
+            let mut module_id: String = String::new();
+            PropertiesIter::new_with_encoding(Cursor::new(content), encoding_rs::UTF_8).read_into(
+                |k, v| {
+                    if k.eq("id") {
+                        module_id = v;
+                    }
+                },
+            )?;
+            if module_id.eq(mid) {
+                let remove_file = path.join(defs::REMOVE_FILE_NAME);
+                File::create(remove_file).with_context(|| "Failed to create remove file.")?;
+                break;
+            }
+        }
+
+        // santity check
+        let target_module_path = format!("{update_dir}/{mid}");
+        let target_module = Path::new(&target_module_path);
+        if target_module.exists() {
+            let remove_file = target_module.join(defs::REMOVE_FILE_NAME);
+            if !remove_file.exists() {
+                File::create(remove_file).with_context(|| "Failed to create remove file.")?;
+            }
+        }
+
+        let _ = mark_module_state(id, defs::REMOVE_FILE_NAME, true);
+
+        Ok(())
+    })
+}
+
+pub fn run_action(id: &str) -> Result<()> {
+    let action_script_path = format!("/data/adb/modules/{}/action.sh", id);
+    exec_script(&action_script_path, true)
+}
+
+fn _enable_module(module_dir: &str, mid: &str, enable: bool) -> Result<()> {
+    let src_module_path = format!("{module_dir}/{mid}");
+    let src_module = Path::new(&src_module_path);
+    ensure!(src_module.exists(), "module: {} not found!", mid);
+
+    let disable_path = src_module.join(defs::DISABLE_FILE_NAME);
+    if enable {
+        if disable_path.exists() {
+            std::fs::remove_file(&disable_path).with_context(|| {
+                format!("Failed to remove disable file: {}", &disable_path.display())
+            })?;
+        }
+    } else {
+        ensure_file_exists(disable_path)?;
+    }
+
+    let _ = mark_module_state(mid, defs::DISABLE_FILE_NAME, !enable);
+
+    Ok(())
+}
+
+pub fn enable_module(id: &str) -> Result<()> {
+    update_module(defs::MODULE_UPDATE_TMP_DIR, id, |mid, update_dir| {
+        _enable_module(update_dir, mid, true)
+    })
+}
+
+pub fn disable_module(id: &str) -> Result<()> {
+    update_module(defs::MODULE_UPDATE_TMP_DIR, id, |mid, update_dir| {
+        _enable_module(update_dir, mid, false)
+    })
+}
+
+pub fn disable_all_modules() -> Result<()> {
+    mark_all_modules(defs::DISABLE_FILE_NAME)
+}
+
+fn mark_all_modules(flag_file: &str) -> Result<()> {
+    // we assume the module dir is already mounted
+    let dir = std::fs::read_dir(defs::MODULE_DIR)?;
+    for entry in dir.flatten() {
+        let path = entry.path();
+        let flag = path.join(flag_file);
+        if let Err(e) = ensure_file_exists(flag) {
+            warn!("Failed to mark module: {}: {}", path.display(), e);
+        }
+    }
+
+    Ok(())
+}
+
+fn _list_modules(path: &str) -> Vec<HashMap<String, String>> {
+    // first check enabled modules
+    let dir = std::fs::read_dir(path);
+    let Ok(dir) = dir else {
+        return Vec::new();
+    };
+
+    let mut modules: Vec<HashMap<String, String>> = Vec::new();
+
+    for entry in dir.flatten() {
+        let path = entry.path();
+        info!("path: {}", path.display());
+        let module_prop = path.join("module.prop");
+        if !module_prop.exists() {
+            continue;
+        }
+        let content = std::fs::read(&module_prop);
+        let Ok(content) = content else {
+            warn!("Failed to read file: {}", module_prop.display());
+            continue;
+        };
+        let mut module_prop_map: HashMap<String, String> = HashMap::new();
+        let encoding = encoding_rs::UTF_8;
+        let result =
+            PropertiesIter::new_with_encoding(Cursor::new(content), encoding).read_into(|k, v| {
+                module_prop_map.insert(k, v);
+            });
+
+        if !module_prop_map.contains_key("id") || module_prop_map["id"].is_empty() {
+            if let Some(id) = entry.file_name().to_str() {
+                info!("Use dir name as module id: {}", id);
+                module_prop_map.insert("id".to_owned(), id.to_owned());
+            } else {
+                info!("Failed to get module id: {:?}", module_prop);
+                continue;
+            }
+        }
+
+        // Add enabled, update, remove flags
+        let enabled = !path.join(defs::DISABLE_FILE_NAME).exists();
+        let update = path.join(defs::UPDATE_FILE_NAME).exists();
+        let remove = path.join(defs::REMOVE_FILE_NAME).exists();
+        let web = path.join(defs::MODULE_WEB_DIR).exists();
+        let action = path.join(defs::MODULE_ACTION_SH).exists();
+
+        module_prop_map.insert("enabled".to_owned(), enabled.to_string());
+        module_prop_map.insert("update".to_owned(), update.to_string());
+        module_prop_map.insert("remove".to_owned(), remove.to_string());
+        module_prop_map.insert("web".to_owned(), web.to_string());
+        module_prop_map.insert("action".to_owned(), action.to_string());
+
+        if result.is_err() {
+            warn!("Failed to parse module.prop: {}", module_prop.display());
+            continue;
+        }
+        modules.push(module_prop_map);
+    }
+
+    modules
+}
+
+pub fn list_modules() -> Result<()> {
+    let modules = _list_modules(defs::MODULE_DIR);
+    println!("{}", serde_json::to_string_pretty(&modules)?);
+    Ok(())
+}
\ No newline at end of file
diff --git a/userspace/ksud32/src/mount.rs b/userspace/ksud32/src/mount.rs
new file mode 100644
index 000000000000..11be898bbeb7
--- /dev/null
+++ b/userspace/ksud32/src/mount.rs
@@ -0,0 +1,327 @@
+use anyhow::{anyhow, bail, Ok, Result};
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use anyhow::Context;
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use rustix::{fd::AsFd, fs::CWD, mount::*};
+
+use crate::defs::KSU_OVERLAY_SOURCE;
+use log::{info, warn};
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use procfs::process::Process;
+use std::path::Path;
+use std::path::PathBuf;
+
+pub struct AutoMountExt4 {
+    target: String,
+    auto_umount: bool,
+}
+
+impl AutoMountExt4 {
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    pub fn try_new(source: &str, target: &str, auto_umount: bool) -> Result<Self> {
+        mount_ext4(source, target)?;
+        Ok(Self {
+            target: target.to_string(),
+            auto_umount,
+        })
+    }
+
+    #[cfg(not(any(target_os = "linux", target_os = "android")))]
+    pub fn try_new(_src: &str, _mnt: &str, _auto_umount: bool) -> Result<Self> {
+        unimplemented!()
+    }
+
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    pub fn umount(&self) -> Result<()> {
+        unmount(self.target.as_str(), UnmountFlags::DETACH)?;
+        Ok(())
+    }
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+impl Drop for AutoMountExt4 {
+    fn drop(&mut self) {
+        log::info!(
+            "AutoMountExt4 drop: {}, auto_umount: {}",
+            self.target,
+            self.auto_umount
+        );
+        if self.auto_umount {
+            let _ = self.umount();
+        }
+    }
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn mount_ext4(source: impl AsRef<Path>, target: impl AsRef<Path>) -> Result<()> {
+    let new_loopback = loopdev::LoopControl::open()?
+        .next_free()
+        .with_context(|| "Failed to alloc loop")?;
+    new_loopback
+        .with()
+        .attach(source)
+        .with_context(|| "Failed to attach loop")?;
+    let lo = new_loopback.path().ok_or(anyhow!("no loop"))?;
+    if let Result::Ok(fs) = fsopen("ext4", FsOpenFlags::FSOPEN_CLOEXEC) {
+        let fs = fs.as_fd();
+        fsconfig_set_string(fs, "source", lo)?;
+        fsconfig_create(fs)?;
+        let mount = fsmount(fs, FsMountFlags::FSMOUNT_CLOEXEC, MountAttrFlags::empty())?;
+        move_mount(
+            mount.as_fd(),
+            "",
+            CWD,
+            target.as_ref(),
+            MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH,
+        )?;
+    } else {
+        mount(lo, target.as_ref(), "ext4", MountFlags::empty(), "")?;
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn umount_dir(src: impl AsRef<Path>) -> Result<()> {
+    unmount(src.as_ref(), UnmountFlags::empty())
+        .with_context(|| format!("Failed to umount {}", src.as_ref().display()))?;
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn mount_overlayfs(
+    lower_dirs: &[String],
+    lowest: &str,
+    upperdir: Option<PathBuf>,
+    workdir: Option<PathBuf>,
+    dest: impl AsRef<Path>,
+) -> Result<()> {
+    let lowerdir_config = lower_dirs
+        .iter()
+        .map(|s| s.as_ref())
+        .chain(std::iter::once(lowest))
+        .collect::<Vec<_>>()
+        .join(":");
+    info!(
+        "mount overlayfs on {:?}, lowerdir={}, upperdir={:?}, workdir={:?}",
+        dest.as_ref(),
+        lowerdir_config,
+        upperdir,
+        workdir
+    );
+
+    let upperdir = upperdir
+        .filter(|up| up.exists())
+        .map(|e| e.display().to_string());
+    let workdir = workdir
+        .filter(|wd| wd.exists())
+        .map(|e| e.display().to_string());
+
+    let result = (|| {
+        let fs = fsopen("overlay", FsOpenFlags::FSOPEN_CLOEXEC)?;
+        let fs = fs.as_fd();
+        fsconfig_set_string(fs, "lowerdir", &lowerdir_config)?;
+        if let (Some(upperdir), Some(workdir)) = (&upperdir, &workdir) {
+            fsconfig_set_string(fs, "upperdir", upperdir)?;
+            fsconfig_set_string(fs, "workdir", workdir)?;
+        }
+        fsconfig_set_string(fs, "source", KSU_OVERLAY_SOURCE)?;
+        fsconfig_create(fs)?;
+        let mount = fsmount(fs, FsMountFlags::FSMOUNT_CLOEXEC, MountAttrFlags::empty())?;
+        move_mount(
+            mount.as_fd(),
+            "",
+            CWD,
+            dest.as_ref(),
+            MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH,
+        )
+    })();
+
+    if let Err(e) = result {
+        warn!("fsopen mount failed: {:#}, fallback to mount", e);
+        let mut data = format!("lowerdir={lowerdir_config}");
+        if let (Some(upperdir), Some(workdir)) = (upperdir, workdir) {
+            data = format!("{data},upperdir={upperdir},workdir={workdir}");
+        }
+        mount(
+            KSU_OVERLAY_SOURCE,
+            dest.as_ref(),
+            "overlay",
+            MountFlags::empty(),
+            data,
+        )?;
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn mount_tmpfs(dest: impl AsRef<Path>) -> Result<()> {
+    info!("mount tmpfs on {}", dest.as_ref().display());
+    if let Result::Ok(fs) = fsopen("tmpfs", FsOpenFlags::FSOPEN_CLOEXEC) {
+        let fs = fs.as_fd();
+        fsconfig_set_string(fs, "source", KSU_OVERLAY_SOURCE)?;
+        fsconfig_create(fs)?;
+        let mount = fsmount(fs, FsMountFlags::FSMOUNT_CLOEXEC, MountAttrFlags::empty())?;
+        move_mount(
+            mount.as_fd(),
+            "",
+            CWD,
+            dest.as_ref(),
+            MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH,
+        )?;
+    } else {
+        mount(
+            KSU_OVERLAY_SOURCE,
+            dest.as_ref(),
+            "tmpfs",
+            MountFlags::empty(),
+            "",
+        )?;
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn bind_mount(from: impl AsRef<Path>, to: impl AsRef<Path>) -> Result<()> {
+    info!(
+        "bind mount {} -> {}",
+        from.as_ref().display(),
+        to.as_ref().display()
+    );
+    if let Result::Ok(tree) = open_tree(
+        CWD,
+        from.as_ref(),
+        OpenTreeFlags::OPEN_TREE_CLOEXEC
+            | OpenTreeFlags::OPEN_TREE_CLONE
+            | OpenTreeFlags::AT_RECURSIVE,
+    ) {
+        move_mount(
+            tree.as_fd(),
+            "",
+            CWD,
+            to.as_ref(),
+            MoveMountFlags::MOVE_MOUNT_F_EMPTY_PATH,
+        )?;
+    } else {
+        mount(
+            from.as_ref(),
+            to.as_ref(),
+            "",
+            MountFlags::BIND | MountFlags::REC,
+            "",
+        )?;
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+fn mount_overlay_child(
+    mount_point: &str,
+    relative: &String,
+    module_roots: &Vec<String>,
+    stock_root: &String,
+) -> Result<()> {
+    if !module_roots
+        .iter()
+        .any(|lower| Path::new(&format!("{lower}{relative}")).exists())
+    {
+        return bind_mount(stock_root, mount_point);
+    }
+    if !Path::new(&stock_root).is_dir() {
+        return Ok(());
+    }
+    let mut lower_dirs: Vec<String> = vec![];
+    for lower in module_roots {
+        let lower_dir = format!("{lower}{relative}");
+        let path = Path::new(&lower_dir);
+        if path.is_dir() {
+            lower_dirs.push(lower_dir);
+        } else if path.exists() {
+            // stock root has been blocked by this file
+            return Ok(());
+        }
+    }
+    if lower_dirs.is_empty() {
+        return Ok(());
+    }
+    // merge modules and stock
+    if let Err(e) = mount_overlayfs(&lower_dirs, stock_root, None, None, mount_point) {
+        warn!("failed: {:#}, fallback to bind mount", e);
+        bind_mount(stock_root, mount_point)?;
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn mount_overlay(
+    root: &String,
+    module_roots: &Vec<String>,
+    workdir: Option<PathBuf>,
+    upperdir: Option<PathBuf>,
+) -> Result<()> {
+    info!("mount overlay for {}", root);
+    std::env::set_current_dir(root).with_context(|| format!("failed to chdir to {root}"))?;
+    let stock_root = ".";
+
+    // collect child mounts before mounting the root
+    let mounts = Process::myself()?
+        .mountinfo()
+        .with_context(|| "get mountinfo")?;
+    let mut mount_seq = mounts
+        .0
+        .iter()
+        .filter(|m| {
+            m.mount_point.starts_with(root) && !Path::new(&root).starts_with(&m.mount_point)
+        })
+        .map(|m| m.mount_point.to_str())
+        .collect::<Vec<_>>();
+    mount_seq.sort();
+    mount_seq.dedup();
+
+    mount_overlayfs(module_roots, root, upperdir, workdir, root)
+        .with_context(|| "mount overlayfs for root failed")?;
+    for mount_point in mount_seq.iter() {
+        let Some(mount_point) = mount_point else {
+            continue;
+        };
+        let relative = mount_point.replacen(root, "", 1);
+        let stock_root: String = format!("{stock_root}{relative}");
+        if !Path::new(&stock_root).exists() {
+            continue;
+        }
+        if let Err(e) = mount_overlay_child(mount_point, &relative, module_roots, &stock_root) {
+            warn!(
+                "failed to mount overlay for child {}: {:#}, revert",
+                mount_point, e
+            );
+            umount_dir(root).with_context(|| format!("failed to revert {root}"))?;
+            bail!(e);
+        }
+    }
+    Ok(())
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn mount_ext4(_src: &str, _target: &str, _autodrop: bool) -> Result<()> {
+    unimplemented!()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn umount_dir(_src: &str) -> Result<()> {
+    unimplemented!()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn mount_overlay(
+    _root: &String,
+    _module_roots: &Vec<String>,
+    _workdir: Option<PathBuf>,
+    _upperdir: Option<PathBuf>,
+) -> Result<()> {
+    unimplemented!()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn mount_tmpfs(_dest: impl AsRef<Path>) -> Result<()> {
+    unimplemented!()
+}
diff --git a/userspace/ksud32/src/profile.rs b/userspace/ksud32/src/profile.rs
new file mode 100644
index 000000000000..21574448a4c9
--- /dev/null
+++ b/userspace/ksud32/src/profile.rs
@@ -0,0 +1,79 @@
+use crate::utils::ensure_dir_exists;
+use crate::{defs, sepolicy};
+use anyhow::{Context, Result};
+use std::path::Path;
+
+pub fn set_sepolicy(pkg: String, policy: String) -> Result<()> {
+    ensure_dir_exists(defs::PROFILE_SELINUX_DIR)?;
+    let policy_file = Path::new(defs::PROFILE_SELINUX_DIR).join(pkg);
+    std::fs::write(&policy_file, policy)?;
+    sepolicy::apply_file(&policy_file)?;
+    Ok(())
+}
+
+pub fn get_sepolicy(pkg: String) -> Result<()> {
+    let policy_file = Path::new(defs::PROFILE_SELINUX_DIR).join(pkg);
+    let policy = std::fs::read_to_string(policy_file)?;
+    println!("{policy}");
+    Ok(())
+}
+
+// ksud doesn't guarteen the correctness of template, it just save
+pub fn set_template(id: String, template: String) -> Result<()> {
+    ensure_dir_exists(defs::PROFILE_TEMPLATE_DIR)?;
+    let template_file = Path::new(defs::PROFILE_TEMPLATE_DIR).join(id);
+    std::fs::write(template_file, template)?;
+    Ok(())
+}
+
+pub fn get_template(id: String) -> Result<()> {
+    let template_file = Path::new(defs::PROFILE_TEMPLATE_DIR).join(id);
+    let template = std::fs::read_to_string(template_file)?;
+    println!("{template}");
+    Ok(())
+}
+
+pub fn delete_template(id: String) -> Result<()> {
+    let template_file = Path::new(defs::PROFILE_TEMPLATE_DIR).join(id);
+    std::fs::remove_file(template_file)?;
+    Ok(())
+}
+
+pub fn list_templates() -> Result<()> {
+    let templates = std::fs::read_dir(defs::PROFILE_TEMPLATE_DIR);
+    let Ok(templates) = templates else {
+        return Ok(());
+    };
+    for template in templates {
+        let template = template?;
+        let template = template.file_name();
+        if let Some(template) = template.to_str() {
+            println!("{template}");
+        };
+    }
+    Ok(())
+}
+
+pub fn apply_sepolies() -> Result<()> {
+    let path = Path::new(defs::PROFILE_SELINUX_DIR);
+    if !path.exists() {
+        log::info!("profile sepolicy dir not exists.");
+        return Ok(());
+    }
+
+    let sepolicies =
+        std::fs::read_dir(path).with_context(|| "profile sepolicy dir open failed.".to_string())?;
+    for sepolicy in sepolicies {
+        let Ok(sepolicy) = sepolicy else {
+            log::info!("profile sepolicy dir read failed.");
+            continue;
+        };
+        let sepolicy = sepolicy.path();
+        if sepolicy::apply_file(&sepolicy).is_ok() {
+            log::info!("profile sepolicy applied: {:?}", sepolicy);
+        } else {
+            log::info!("profile sepolicy apply failed: {:?}", sepolicy);
+        }
+    }
+    Ok(())
+}
diff --git a/userspace/ksud32/src/restorecon.rs b/userspace/ksud32/src/restorecon.rs
new file mode 100644
index 000000000000..152a7c5ed529
--- /dev/null
+++ b/userspace/ksud32/src/restorecon.rs
@@ -0,0 +1,81 @@
+use crate::defs;
+use anyhow::Result;
+use jwalk::{Parallelism::Serial, WalkDir};
+use std::path::Path;
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use anyhow::{Context, Ok};
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use extattr::{lsetxattr, Flags as XattrFlags};
+
+pub const SYSTEM_CON: &str = "u:object_r:system_file:s0";
+pub const ADB_CON: &str = "u:object_r:adb_data_file:s0";
+pub const UNLABEL_CON: &str = "u:object_r:unlabeled:s0";
+
+const SELINUX_XATTR: &str = "security.selinux";
+
+pub fn lsetfilecon<P: AsRef<Path>>(path: P, con: &str) -> Result<()> {
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    lsetxattr(&path, SELINUX_XATTR, con, XattrFlags::empty()).with_context(|| {
+        format!(
+            "Failed to change SELinux context for {}",
+            path.as_ref().display()
+        )
+    })?;
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn lgetfilecon<P: AsRef<Path>>(path: P) -> Result<String> {
+    let con = extattr::lgetxattr(&path, SELINUX_XATTR).with_context(|| {
+        format!(
+            "Failed to get SELinux context for {}",
+            path.as_ref().display()
+        )
+    })?;
+    let con = String::from_utf8_lossy(&con);
+    Ok(con.to_string())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn setsyscon<P: AsRef<Path>>(path: P) -> Result<()> {
+    lsetfilecon(path, SYSTEM_CON)
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn setsyscon<P: AsRef<Path>>(path: P) -> Result<()> {
+    unimplemented!()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn lgetfilecon<P: AsRef<Path>>(path: P) -> Result<String> {
+    unimplemented!()
+}
+
+pub fn restore_syscon<P: AsRef<Path>>(dir: P) -> Result<()> {
+    for dir_entry in WalkDir::new(dir).parallelism(Serial) {
+        if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {
+            setsyscon(&path)?;
+        }
+    }
+    Ok(())
+}
+
+fn restore_syscon_if_unlabeled<P: AsRef<Path>>(dir: P) -> Result<()> {
+    for dir_entry in WalkDir::new(dir).parallelism(Serial) {
+        if let Some(path) = dir_entry.ok().map(|dir_entry| dir_entry.path()) {
+            if let anyhow::Result::Ok(con) = lgetfilecon(&path) {
+                if con == UNLABEL_CON || con.is_empty() {
+                    lsetfilecon(&path, SYSTEM_CON)?;
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+pub fn restorecon() -> Result<()> {
+    lsetfilecon(defs::DAEMON_PATH, ADB_CON)?;
+    restore_syscon_if_unlabeled(defs::MODULE_DIR)?;
+    Ok(())
+}
diff --git a/userspace/ksud32/src/sepolicy.rs b/userspace/ksud32/src/sepolicy.rs
new file mode 100644
index 000000000000..b7286a06a769
--- /dev/null
+++ b/userspace/ksud32/src/sepolicy.rs
@@ -0,0 +1,739 @@
+use anyhow::{bail, Result};
+use derive_new::new;
+use nom::{
+    branch::alt,
+    bytes::complete::{tag, take_while, take_while1, take_while_m_n},
+    character::{
+        complete::{space0, space1},
+        is_alphanumeric,
+    },
+    combinator::map,
+    sequence::Tuple,
+    IResult, Parser,
+};
+use std::{ffi, path::Path, vec};
+
+type SeObject<'a> = Vec<&'a str>;
+
+fn is_sepolicy_char(c: char) -> bool {
+    is_alphanumeric(c as u8) || c == '_' || c == '-'
+}
+
+fn parse_single_word(input: &str) -> IResult<&str, &str> {
+    take_while1(is_sepolicy_char).parse(input)
+}
+
+fn parse_bracket_objs(input: &str) -> IResult<&str, SeObject> {
+    let (input, (_, words, _)) = (
+        tag("{"),
+        take_while_m_n(1, 100, |c: char| is_sepolicy_char(c) || c.is_whitespace()),
+        tag("}"),
+    )
+        .parse(input)?;
+    Ok((input, words.split_whitespace().collect()))
+}
+
+fn parse_single_obj(input: &str) -> IResult<&str, SeObject> {
+    let (input, word) = take_while1(is_sepolicy_char).parse(input)?;
+    Ok((input, vec![word]))
+}
+
+fn parse_star(input: &str) -> IResult<&str, SeObject> {
+    let (input, _) = tag("*").parse(input)?;
+    Ok((input, vec!["*"]))
+}
+
+// 1. a single sepolicy word
+// 2. { obj1 obj2 obj3 ...}
+// 3. *
+fn parse_seobj(input: &str) -> IResult<&str, SeObject> {
+    let (input, strs) = alt((parse_single_obj, parse_bracket_objs, parse_star)).parse(input)?;
+    Ok((input, strs))
+}
+
+fn parse_seobj_no_star(input: &str) -> IResult<&str, SeObject> {
+    let (input, strs) = alt((parse_single_obj, parse_bracket_objs)).parse(input)?;
+    Ok((input, strs))
+}
+
+trait SeObjectParser<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self>
+    where
+        Self: Sized;
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct NormalPerm<'a> {
+    op: &'a str,
+    source: SeObject<'a>,
+    target: SeObject<'a>,
+    class: SeObject<'a>,
+    perm: SeObject<'a>,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct XPerm<'a> {
+    op: &'a str,
+    source: SeObject<'a>,
+    target: SeObject<'a>,
+    class: SeObject<'a>,
+    operation: &'a str,
+    perm_set: &'a str,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct TypeState<'a> {
+    op: &'a str,
+    stype: SeObject<'a>,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct TypeAttr<'a> {
+    stype: SeObject<'a>,
+    sattr: SeObject<'a>,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct Type<'a> {
+    name: &'a str,
+    attrs: SeObject<'a>,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct Attr<'a> {
+    name: &'a str,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct TypeTransition<'a> {
+    source: &'a str,
+    target: &'a str,
+    class: &'a str,
+    default_type: &'a str,
+    object_name: Option<&'a str>,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct TypeChange<'a> {
+    op: &'a str,
+    source: &'a str,
+    target: &'a str,
+    class: &'a str,
+    default_type: &'a str,
+}
+
+#[derive(Debug, PartialEq, Eq, new)]
+struct GenFsCon<'a> {
+    fs_name: &'a str,
+    partial_path: &'a str,
+    fs_context: &'a str,
+}
+
+#[derive(Debug)]
+enum PolicyStatement<'a> {
+    // "allow *source_type *target_type *class *perm_set"
+    // "deny *source_type *target_type *class *perm_set"
+    // "auditallow *source_type *target_type *class *perm_set"
+    // "dontaudit *source_type *target_type *class *perm_set"
+    NormalPerm(NormalPerm<'a>),
+
+    // "allowxperm *source_type *target_type *class operation xperm_set"
+    // "auditallowxperm *source_type *target_type *class operation xperm_set"
+    // "dontauditxperm *source_type *target_type *class operation xperm_set"
+    XPerm(XPerm<'a>),
+
+    // "permissive ^type"
+    // "enforce ^type"
+    TypeState(TypeState<'a>),
+
+    // "type type_name ^(attribute)"
+    Type(Type<'a>),
+
+    // "typeattribute ^type ^attribute"
+    TypeAttr(TypeAttr<'a>),
+
+    // "attribute ^attribute"
+    Attr(Attr<'a>),
+
+    // "type_transition source_type target_type class default_type (object_name)"
+    TypeTransition(TypeTransition<'a>),
+
+    // "type_change source_type target_type class default_type"
+    // "type_member source_type target_type class default_type"
+    TypeChange(TypeChange<'a>),
+
+    // "genfscon fs_name partial_path fs_context"
+    GenFsCon(GenFsCon<'a>),
+}
+
+impl<'a> SeObjectParser<'a> for NormalPerm<'a> {
+    fn parse(input: &'a str) -> IResult<&str, Self> {
+        let (input, op) = alt((
+            tag("allow"),
+            tag("deny"),
+            tag("auditallow"),
+            tag("dontaudit"),
+        ))(input)?;
+
+        let (input, _) = space0(input)?;
+        let (input, source) = parse_seobj(input)?;
+        let (input, _) = space0(input)?;
+        let (input, target) = parse_seobj(input)?;
+        let (input, _) = space0(input)?;
+        let (input, class) = parse_seobj(input)?;
+        let (input, _) = space0(input)?;
+        let (input, perm) = parse_seobj(input)?;
+        Ok((input, NormalPerm::new(op, source, target, class, perm)))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for XPerm<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, op) = alt((
+            tag("allowxperm"),
+            tag("auditallowxperm"),
+            tag("dontauditxperm"),
+        ))(input)?;
+
+        let (input, _) = space0(input)?;
+        let (input, source) = parse_seobj(input)?;
+        let (input, _) = space0(input)?;
+        let (input, target) = parse_seobj(input)?;
+        let (input, _) = space0(input)?;
+        let (input, class) = parse_seobj(input)?;
+        let (input, _) = space0(input)?;
+        let (input, operation) = parse_single_word(input)?;
+        let (input, _) = space0(input)?;
+        let (input, perm_set) = parse_single_word(input)?;
+
+        Ok((
+            input,
+            XPerm::new(op, source, target, class, operation, perm_set),
+        ))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for TypeState<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, op) = alt((tag("permissive"), tag("enforce")))(input)?;
+
+        let (input, _) = space1(input)?;
+        let (input, stype) = parse_seobj_no_star(input)?;
+
+        Ok((input, TypeState::new(op, stype)))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for Type<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, _) = tag("type")(input)?;
+        let (input, _) = space1(input)?;
+        let (input, name) = parse_single_word(input)?;
+
+        if input.is_empty() {
+            return Ok((input, Type::new(name, vec!["domain"]))); // default to domain
+        }
+
+        let (input, _) = space1(input)?;
+        let (input, attrs) = parse_seobj_no_star(input)?;
+
+        Ok((input, Type::new(name, attrs)))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for TypeAttr<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, _) = alt((tag("typeattribute"), tag("attradd")))(input)?;
+        let (input, _) = space1(input)?;
+        let (input, stype) = parse_seobj_no_star(input)?;
+        let (input, _) = space1(input)?;
+        let (input, attr) = parse_seobj_no_star(input)?;
+
+        Ok((input, TypeAttr::new(stype, attr)))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for Attr<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, _) = tag("attribute")(input)?;
+        let (input, _) = space1(input)?;
+        let (input, attr) = parse_single_word(input)?;
+
+        Ok((input, Attr::new(attr)))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for TypeTransition<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, _) = alt((tag("type_transition"), tag("name_transition")))(input)?;
+        let (input, _) = space1(input)?;
+        let (input, source) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, target) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, class) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, default) = parse_single_word(input)?;
+
+        if input.is_empty() {
+            return Ok((
+                input,
+                TypeTransition::new(source, target, class, default, None),
+            ));
+        }
+
+        let (input, _) = space1(input)?;
+        let (input, object) = parse_single_word(input)?;
+
+        Ok((
+            input,
+            TypeTransition::new(source, target, class, default, Some(object)),
+        ))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for TypeChange<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, op) = alt((tag("type_change"), tag("type_member")))(input)?;
+        let (input, _) = space1(input)?;
+        let (input, source) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, target) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, class) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, default) = parse_single_word(input)?;
+
+        Ok((input, TypeChange::new(op, source, target, class, default)))
+    }
+}
+
+impl<'a> SeObjectParser<'a> for GenFsCon<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self>
+    where
+        Self: Sized,
+    {
+        let (input, _) = tag("genfscon")(input)?;
+        let (input, _) = space1(input)?;
+        let (input, fs) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, path) = parse_single_word(input)?;
+        let (input, _) = space1(input)?;
+        let (input, context) = parse_single_word(input)?;
+        Ok((input, GenFsCon::new(fs, path, context)))
+    }
+}
+
+impl<'a> PolicyStatement<'a> {
+    fn parse(input: &'a str) -> IResult<&'a str, Self> {
+        let (input, _) = space0(input)?;
+        let (input, statement) = alt((
+            map(NormalPerm::parse, PolicyStatement::NormalPerm),
+            map(XPerm::parse, PolicyStatement::XPerm),
+            map(TypeState::parse, PolicyStatement::TypeState),
+            map(Type::parse, PolicyStatement::Type),
+            map(TypeAttr::parse, PolicyStatement::TypeAttr),
+            map(Attr::parse, PolicyStatement::Attr),
+            map(TypeTransition::parse, PolicyStatement::TypeTransition),
+            map(TypeChange::parse, PolicyStatement::TypeChange),
+            map(GenFsCon::parse, PolicyStatement::GenFsCon),
+        ))(input)?;
+        let (input, _) = space0(input)?;
+        let (input, _) = take_while(|c| c == ';')(input)?;
+        let (input, _) = space0(input)?;
+        Ok((input, statement))
+    }
+}
+
+fn parse_sepolicy<'a, 'b>(input: &'b str, strict: bool) -> Result<Vec<PolicyStatement<'a>>>
+where
+    'b: 'a,
+{
+    let mut statements = vec![];
+
+    for line in input.split(['\n', ';']) {
+        let trimmed_line = line.trim();
+        if trimmed_line.is_empty() || trimmed_line.starts_with('#') {
+            continue;
+        }
+        if let Ok((_, statement)) = PolicyStatement::parse(trimmed_line) {
+            statements.push(statement);
+        } else if strict {
+            bail!("Failed to parse policy statement: {}", line)
+        }
+    }
+    Ok(statements)
+}
+
+const SEPOLICY_MAX_LEN: usize = 128;
+
+const CMD_NORMAL_PERM: u32 = 1;
+const CMD_XPERM: u32 = 2;
+const CMD_TYPE_STATE: u32 = 3;
+const CMD_TYPE: u32 = 4;
+const CMD_TYPE_ATTR: u32 = 5;
+const CMD_ATTR: u32 = 6;
+const CMD_TYPE_TRANSITION: u32 = 7;
+const CMD_TYPE_CHANGE: u32 = 8;
+const CMD_GENFSCON: u32 = 9;
+
+#[derive(Debug, Default)]
+enum PolicyObject {
+    All, // for "*", stand for all objects, and is NULL in ffi
+    One([u8; SEPOLICY_MAX_LEN]),
+    #[default]
+    None,
+}
+
+impl TryFrom<&str> for PolicyObject {
+    type Error = anyhow::Error;
+    fn try_from(s: &str) -> Result<Self> {
+        anyhow::ensure!(s.len() <= SEPOLICY_MAX_LEN, "policy object too long");
+        if s == "*" {
+            return Ok(PolicyObject::All);
+        }
+        let mut buf = [0u8; SEPOLICY_MAX_LEN];
+        buf[..s.len()].copy_from_slice(s.as_bytes());
+        Ok(PolicyObject::One(buf))
+    }
+}
+
+/// atomic statement, such as: allow domain1 domain2:file1 read;
+/// normal statement would be expand to atomic statement, for example:
+/// allow domain1 domain2:file1 { read write }; would be expand to two atomic statement
+/// allow domain1 domain2:file1 read;allow domain1 domain2:file1 write;
+#[allow(clippy::too_many_arguments)]
+#[derive(Debug, new)]
+struct AtomicStatement {
+    cmd: u32,
+    subcmd: u32,
+    sepol1: PolicyObject,
+    sepol2: PolicyObject,
+    sepol3: PolicyObject,
+    sepol4: PolicyObject,
+    sepol5: PolicyObject,
+    sepol6: PolicyObject,
+    sepol7: PolicyObject,
+}
+
+impl<'a> TryFrom<&'a NormalPerm<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a NormalPerm<'a>) -> Result<Self> {
+        let mut result = vec![];
+        let subcmd = match perm.op {
+            "allow" => 1,
+            "deny" => 2,
+            "auditallow" => 3,
+            "dontaudit" => 4,
+            _ => 0,
+        };
+        for &s in &perm.source {
+            for &t in &perm.target {
+                for &c in &perm.class {
+                    for &p in &perm.perm {
+                        result.push(AtomicStatement {
+                            cmd: CMD_NORMAL_PERM,
+                            subcmd,
+                            sepol1: s.try_into()?,
+                            sepol2: t.try_into()?,
+                            sepol3: c.try_into()?,
+                            sepol4: p.try_into()?,
+                            sepol5: PolicyObject::None,
+                            sepol6: PolicyObject::None,
+                            sepol7: PolicyObject::None,
+                        });
+                    }
+                }
+            }
+        }
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a XPerm<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a XPerm<'a>) -> Result<Self> {
+        let mut result = vec![];
+        let subcmd = match perm.op {
+            "allowxperm" => 1,
+            "auditallowxperm" => 2,
+            "dontauditxperm" => 3,
+            _ => 0,
+        };
+        for &s in &perm.source {
+            for &t in &perm.target {
+                for &c in &perm.class {
+                    result.push(AtomicStatement {
+                        cmd: CMD_XPERM,
+                        subcmd,
+                        sepol1: s.try_into()?,
+                        sepol2: t.try_into()?,
+                        sepol3: c.try_into()?,
+                        sepol4: perm.operation.try_into()?,
+                        sepol5: perm.perm_set.try_into()?,
+                        sepol6: PolicyObject::None,
+                        sepol7: PolicyObject::None,
+                    });
+                }
+            }
+        }
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a TypeState<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a TypeState<'a>) -> Result<Self> {
+        let mut result = vec![];
+        let subcmd = match perm.op {
+            "permissive" => 1,
+            "enforcing" => 2,
+            _ => 0,
+        };
+        for &t in &perm.stype {
+            result.push(AtomicStatement {
+                cmd: CMD_TYPE_STATE,
+                subcmd,
+                sepol1: t.try_into()?,
+                sepol2: PolicyObject::None,
+                sepol3: PolicyObject::None,
+                sepol4: PolicyObject::None,
+                sepol5: PolicyObject::None,
+                sepol6: PolicyObject::None,
+                sepol7: PolicyObject::None,
+            });
+        }
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a Type<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a Type<'a>) -> Result<Self> {
+        let mut result = vec![];
+        for &attr in &perm.attrs {
+            result.push(AtomicStatement {
+                cmd: CMD_TYPE,
+                subcmd: 0,
+                sepol1: perm.name.try_into()?,
+                sepol2: attr.try_into()?,
+                sepol3: PolicyObject::None,
+                sepol4: PolicyObject::None,
+                sepol5: PolicyObject::None,
+                sepol6: PolicyObject::None,
+                sepol7: PolicyObject::None,
+            });
+        }
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a TypeAttr<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a TypeAttr<'a>) -> Result<Self> {
+        let mut result = vec![];
+        for &t in &perm.stype {
+            for &attr in &perm.sattr {
+                result.push(AtomicStatement {
+                    cmd: CMD_TYPE_ATTR,
+                    subcmd: 0,
+                    sepol1: t.try_into()?,
+                    sepol2: attr.try_into()?,
+                    sepol3: PolicyObject::None,
+                    sepol4: PolicyObject::None,
+                    sepol5: PolicyObject::None,
+                    sepol6: PolicyObject::None,
+                    sepol7: PolicyObject::None,
+                });
+            }
+        }
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a Attr<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a Attr<'a>) -> Result<Self> {
+        let result = vec![AtomicStatement {
+            cmd: CMD_ATTR,
+            subcmd: 0,
+            sepol1: perm.name.try_into()?,
+            sepol2: PolicyObject::None,
+            sepol3: PolicyObject::None,
+            sepol4: PolicyObject::None,
+            sepol5: PolicyObject::None,
+            sepol6: PolicyObject::None,
+            sepol7: PolicyObject::None,
+        }];
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a TypeTransition<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a TypeTransition<'a>) -> Result<Self> {
+        let mut result = vec![];
+        let obj = match perm.object_name {
+            Some(obj) => obj.try_into()?,
+            None => PolicyObject::None,
+        };
+        result.push(AtomicStatement {
+            cmd: CMD_TYPE_TRANSITION,
+            subcmd: 0,
+            sepol1: perm.source.try_into()?,
+            sepol2: perm.target.try_into()?,
+            sepol3: perm.class.try_into()?,
+            sepol4: perm.default_type.try_into()?,
+            sepol5: obj,
+            sepol6: PolicyObject::None,
+            sepol7: PolicyObject::None,
+        });
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a TypeChange<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a TypeChange<'a>) -> Result<Self> {
+        let mut result = vec![];
+        let subcmd = match perm.op {
+            "type_change" => 1,
+            "type_member" => 2,
+            _ => 0,
+        };
+        result.push(AtomicStatement {
+            cmd: CMD_TYPE_CHANGE,
+            subcmd,
+            sepol1: perm.source.try_into()?,
+            sepol2: perm.target.try_into()?,
+            sepol3: perm.class.try_into()?,
+            sepol4: perm.default_type.try_into()?,
+            sepol5: PolicyObject::None,
+            sepol6: PolicyObject::None,
+            sepol7: PolicyObject::None,
+        });
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a GenFsCon<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(perm: &'a GenFsCon<'a>) -> Result<Self> {
+        let result = vec![AtomicStatement {
+            cmd: CMD_GENFSCON,
+            subcmd: 0,
+            sepol1: perm.fs_name.try_into()?,
+            sepol2: perm.partial_path.try_into()?,
+            sepol3: perm.fs_context.try_into()?,
+            sepol4: PolicyObject::None,
+            sepol5: PolicyObject::None,
+            sepol6: PolicyObject::None,
+            sepol7: PolicyObject::None,
+        }];
+        Ok(result)
+    }
+}
+
+impl<'a> TryFrom<&'a PolicyStatement<'a>> for Vec<AtomicStatement> {
+    type Error = anyhow::Error;
+    fn try_from(value: &'a PolicyStatement) -> Result<Self> {
+        match value {
+            PolicyStatement::NormalPerm(perm) => perm.try_into(),
+            PolicyStatement::XPerm(perm) => perm.try_into(),
+            PolicyStatement::TypeState(perm) => perm.try_into(),
+            PolicyStatement::Type(perm) => perm.try_into(),
+            PolicyStatement::TypeAttr(perm) => perm.try_into(),
+            PolicyStatement::Attr(perm) => perm.try_into(),
+            PolicyStatement::TypeTransition(perm) => perm.try_into(),
+            PolicyStatement::TypeChange(perm) => perm.try_into(),
+            PolicyStatement::GenFsCon(perm) => perm.try_into(),
+        }
+    }
+}
+
+////////////////////////////////////////////////////////////////
+///  for C FFI to call kernel interface
+///////////////////////////////////////////////////////////////
+
+#[derive(Debug)]
+#[repr(C)]
+struct FfiPolicy {
+    cmd: u32,
+    subcmd: u32,
+    sepol1: *const ffi::c_char,
+    sepol2: *const ffi::c_char,
+    sepol3: *const ffi::c_char,
+    sepol4: *const ffi::c_char,
+    sepol5: *const ffi::c_char,
+    sepol6: *const ffi::c_char,
+    sepol7: *const ffi::c_char,
+}
+
+fn to_c_ptr(pol: &PolicyObject) -> *const ffi::c_char {
+    match pol {
+        PolicyObject::None | PolicyObject::All => std::ptr::null(),
+        PolicyObject::One(s) => s.as_ptr().cast::<ffi::c_char>(),
+    }
+}
+
+impl From<AtomicStatement> for FfiPolicy {
+    fn from(policy: AtomicStatement) -> FfiPolicy {
+        FfiPolicy {
+            cmd: policy.cmd,
+            subcmd: policy.subcmd,
+            sepol1: to_c_ptr(&policy.sepol1),
+            sepol2: to_c_ptr(&policy.sepol2),
+            sepol3: to_c_ptr(&policy.sepol3),
+            sepol4: to_c_ptr(&policy.sepol4),
+            sepol5: to_c_ptr(&policy.sepol5),
+            sepol6: to_c_ptr(&policy.sepol6),
+            sepol7: to_c_ptr(&policy.sepol7),
+        }
+    }
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+fn apply_one_rule<'a>(statement: &'a PolicyStatement<'a>, strict: bool) -> Result<()> {
+    let policies: Vec<AtomicStatement> = statement.try_into()?;
+
+    for policy in policies {
+        if !rustix::process::ksu_set_policy(&FfiPolicy::from(policy)) {
+            log::warn!("apply rule: {:?} failed.", statement);
+            if strict {
+                return Err(anyhow::anyhow!("apply rule {:?} failed.", statement));
+            }
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+fn apply_one_rule<'a>(_statement: &'a PolicyStatement<'a>, _strict: bool) -> Result<()> {
+    unimplemented!()
+}
+
+pub fn live_patch(policy: &str) -> Result<()> {
+    let result = parse_sepolicy(policy.trim(), false)?;
+    for statement in result {
+        println!("{statement:?}");
+        apply_one_rule(&statement, false)?;
+    }
+    Ok(())
+}
+
+pub fn apply_file<P: AsRef<Path>>(path: P) -> Result<()> {
+    let input = std::fs::read_to_string(path)?;
+    live_patch(&input)
+}
+
+pub fn check_rule(policy: &str) -> Result<()> {
+    let path = Path::new(policy);
+    let policy = if path.exists() {
+        std::fs::read_to_string(path)?
+    } else {
+        policy.to_string()
+    };
+    parse_sepolicy(policy.trim(), true)?;
+    Ok(())
+}
diff --git a/userspace/ksud32/src/su.rs b/userspace/ksud32/src/su.rs
new file mode 100644
index 000000000000..30df2436a55e
--- /dev/null
+++ b/userspace/ksud32/src/su.rs
@@ -0,0 +1,284 @@
+use anyhow::{Ok, Result};
+use getopts::Options;
+use std::env;
+#[cfg(unix)]
+use std::os::unix::process::CommandExt;
+use std::path::PathBuf;
+use std::{ffi::CStr, process::Command};
+
+use crate::{
+    defs,
+    utils::{self, umask},
+};
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use rustix::{
+    process::getuid,
+    thread::{set_thread_res_gid, set_thread_res_uid, Gid, Uid},
+};
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn grant_root(global_mnt: bool) -> Result<()> {
+    rustix::process::ksu_grant_root()?;
+
+    let mut command = Command::new("sh");
+    let command = unsafe {
+        command.pre_exec(move || {
+            if global_mnt {
+                let _ = utils::switch_mnt_ns(1);
+                let _ = utils::unshare_mnt_ns();
+            }
+            Result::Ok(())
+        })
+    };
+    // add /data/adb/ksu/bin to PATH
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    add_path_to_env(defs::BINARY_DIR)?;
+    Err(command.exec().into())
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn grant_root(_global_mnt: bool) -> Result<()> {
+    unimplemented!("grant_root is only available on android");
+}
+
+fn print_usage(program: &str, opts: Options) {
+    let brief = format!("KernelSU\n\nUsage: {program} [options] [-] [user [argument...]]");
+    print!("{}", opts.usage(&brief));
+}
+
+fn set_identity(uid: u32, gid: u32, groups: &[u32]) {
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    {
+        rustix::thread::set_thread_groups(
+            groups
+                .iter()
+                .map(|g| unsafe { Gid::from_raw(*g) })
+                .collect::<Vec<_>>()
+                .as_ref(),
+        )
+        .ok();
+        let gid = unsafe { Gid::from_raw(gid) };
+        let uid = unsafe { Uid::from_raw(uid) };
+        set_thread_res_gid(gid, gid, gid).ok();
+        set_thread_res_uid(uid, uid, uid).ok();
+    }
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn root_shell() -> Result<()> {
+    unimplemented!()
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn root_shell() -> Result<()> {
+    // we are root now, this was set in kernel!
+
+    use anyhow::anyhow;
+    let env_args: Vec<String> = env::args().collect();
+    let program = env_args[0].clone();
+    let args = env_args
+        .iter()
+        .position(|arg| arg == "-c")
+        .map(|i| {
+            let rest = env_args[i + 1..].to_vec();
+            let mut new_args = env_args[..i].to_vec();
+            new_args.push("-c".to_string());
+            if !rest.is_empty() {
+                new_args.push(rest.join(" "));
+            }
+            new_args
+        })
+        .unwrap_or_else(|| env_args.clone());
+
+    let mut opts = Options::new();
+    opts.optopt(
+        "c",
+        "command",
+        "pass COMMAND to the invoked shell",
+        "COMMAND",
+    );
+    opts.optflag("h", "help", "display this help message and exit");
+    opts.optflag("l", "login", "pretend the shell to be a login shell");
+    opts.optflag(
+        "p",
+        "preserve-environment",
+        "preserve the entire environment",
+    );
+    opts.optflag(
+        "s",
+        "shell",
+        "use SHELL instead of the default /system/bin/sh",
+    );
+    opts.optflag("v", "version", "display version number and exit");
+    opts.optflag("V", "", "display version code and exit");
+    opts.optflag(
+        "M",
+        "mount-master",
+        "force run in the global mount namespace",
+    );
+    opts.optopt("g", "group", "Specify the primary group", "GROUP");
+    opts.optmulti(
+        "G",
+        "supp-group",
+        "Specify a supplementary group. The first specified supplementary group is also used as a primary group if the option -g is not specified.",
+        "GROUP",
+    );
+
+    // Replace -cn with -z, -mm with -M for supporting getopt_long
+    let args = args
+        .into_iter()
+        .map(|e| {
+            if e == "-mm" {
+                "-M".to_string()
+            } else if e == "-cn" {
+                "-z".to_string()
+            } else {
+                e
+            }
+        })
+        .collect::<Vec<String>>();
+
+    let matches = match opts.parse(&args[1..]) {
+        Result::Ok(m) => m,
+        Err(f) => {
+            println!("{f}");
+            print_usage(&program, opts);
+            std::process::exit(-1);
+        }
+    };
+
+    if matches.opt_present("h") {
+        print_usage(&program, opts);
+        return Ok(());
+    }
+
+    if matches.opt_present("v") {
+        println!("{}:KernelSU", defs::VERSION_NAME);
+        return Ok(());
+    }
+
+    if matches.opt_present("V") {
+        println!("{}", defs::VERSION_CODE);
+        return Ok(());
+    }
+
+    let shell = matches.opt_str("s").unwrap_or("/system/bin/sh".to_string());
+    let mut is_login = matches.opt_present("l");
+    let preserve_env = matches.opt_present("p");
+    let mount_master = matches.opt_present("M");
+
+    let groups = matches
+        .opt_strs("G")
+        .into_iter()
+        .map(|g| g.parse::<u32>().map_err(|_| anyhow!("Invalid GID: {}", g)))
+        .collect::<Result<Vec<_>, _>>()?;
+
+    // if -g provided, use it.
+    let mut gid = matches
+        .opt_str("g")
+        .map(|g| g.parse::<u32>().map_err(|_| anyhow!("Invalid GID: {}", g)))
+        .transpose()?;
+
+    // otherwise, use the first gid of groups.
+    if gid.is_none() && !groups.is_empty() {
+        gid = Some(groups[0]);
+    }
+
+    // we've make sure that -c is the last option and it already contains the whole command, no need to construct it again
+    let args = matches
+        .opt_str("c")
+        .map(|cmd| vec!["-c".to_string(), cmd])
+        .unwrap_or_default();
+
+    let mut free_idx = 0;
+    if !matches.free.is_empty() && matches.free[free_idx] == "-" {
+        is_login = true;
+        free_idx += 1;
+    }
+
+    // use current uid if no user specified, these has been done in kernel!
+    let mut uid = getuid().as_raw();
+    if free_idx < matches.free.len() {
+        let name = &matches.free[free_idx];
+        uid = unsafe {
+            let pw = libc::getpwnam(name.as_ptr()).as_ref();
+
+            match pw {
+                Some(pw) => pw.pw_uid,
+                None => name.parse::<u32>().unwrap_or(0),
+            }
+        }
+    }
+
+    // if there is no gid provided, use uid.
+    let gid = gid.unwrap_or(uid);
+    // https://github.com/topjohnwu/Magisk/blob/master/native/src/su/su_daemon.cpp#L408
+    let arg0 = if is_login { "-" } else { &shell };
+
+    let mut command = &mut Command::new(&shell);
+
+    if !preserve_env {
+        // This is actually incorrect, i don't know why.
+        // command = command.env_clear();
+
+        let pw = unsafe { libc::getpwuid(uid).as_ref() };
+
+        if let Some(pw) = pw {
+            let home = unsafe { CStr::from_ptr(pw.pw_dir) };
+            let pw_name = unsafe { CStr::from_ptr(pw.pw_name) };
+
+            let home = home.to_string_lossy();
+            let pw_name = pw_name.to_string_lossy();
+
+            command = command
+                .env("HOME", home.as_ref())
+                .env("USER", pw_name.as_ref())
+                .env("LOGNAME", pw_name.as_ref())
+                .env("SHELL", &shell);
+        }
+    }
+
+    // add /data/adb/ksu/bin to PATH
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    add_path_to_env(defs::BINARY_DIR)?;
+
+    // when KSURC_PATH exists and ENV is not set, set ENV to KSURC_PATH
+    if PathBuf::from(defs::KSURC_PATH).exists() && env::var("ENV").is_err() {
+        command = command.env("ENV", defs::KSURC_PATH);
+    }
+
+    // escape from the current cgroup and become session leader
+    // WARNING!!! This cause some root shell hang forever!
+    // command = command.process_group(0);
+    command = unsafe {
+        command.pre_exec(move || {
+            umask(0o22);
+            utils::switch_cgroups();
+
+            // switch to global mount namespace
+            #[cfg(any(target_os = "linux", target_os = "android"))]
+            if mount_master {
+                let _ = utils::switch_mnt_ns(1);
+                let _ = utils::unshare_mnt_ns();
+            }
+
+            set_identity(uid, gid, &groups);
+
+            Result::Ok(())
+        })
+    };
+
+    command = command.args(args).arg0(arg0);
+    Err(command.exec().into())
+}
+
+fn add_path_to_env(path: &str) -> Result<()> {
+    let mut paths =
+        env::var_os("PATH").map_or(Vec::new(), |val| env::split_paths(&val).collect::<Vec<_>>());
+    let new_path = PathBuf::from(path.trim_end_matches('/'));
+    paths.push(new_path);
+    let new_path_env = env::join_paths(paths)?;
+    env::set_var("PATH", new_path_env);
+    Ok(())
+}
diff --git a/userspace/ksud32/src/utils.rs b/userspace/ksud32/src/utils.rs
new file mode 100644
index 000000000000..a7fb238c72e4
--- /dev/null
+++ b/userspace/ksud32/src/utils.rs
@@ -0,0 +1,246 @@
+use anyhow::{bail, Context, Error, Ok, Result};
+use std::{
+    fs::{self, create_dir_all, remove_file, write, File, OpenOptions},
+    io::{
+        ErrorKind::{AlreadyExists, NotFound},
+        Write,
+    },
+    path::Path,
+    sync::OnceLock,
+};
+
+use crate::{defs, ksucalls};
+use std::fs::metadata;
+#[allow(unused_imports)]
+use std::fs::{set_permissions, Permissions};
+#[cfg(unix)]
+use std::os::unix::prelude::PermissionsExt;
+use std::path::PathBuf;
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+use rustix::{
+    process,
+    thread::{move_into_link_name_space, unshare, LinkNameSpaceType, UnshareFlags},
+};
+
+pub fn ensure_clean_dir(dir: impl AsRef<Path>) -> Result<()> {
+    let path = dir.as_ref();
+    log::debug!("ensure_clean_dir: {}", path.display());
+    if path.exists() {
+        log::debug!("ensure_clean_dir: {} exists, remove it", path.display());
+        std::fs::remove_dir_all(path)?;
+    }
+    Ok(std::fs::create_dir_all(path)?)
+}
+
+pub fn ensure_file_exists<T: AsRef<Path>>(file: T) -> Result<()> {
+    match File::options().write(true).create_new(true).open(&file) {
+        std::result::Result::Ok(_) => Ok(()),
+        Err(err) => {
+            if err.kind() == AlreadyExists && file.as_ref().is_file() {
+                Ok(())
+            } else {
+                Err(Error::from(err))
+                    .with_context(|| format!("{} is not a regular file", file.as_ref().display()))
+            }
+        }
+    }
+}
+
+pub fn ensure_dir_exists<T: AsRef<Path>>(dir: T) -> Result<()> {
+    let result = create_dir_all(&dir).map_err(Error::from);
+    if dir.as_ref().is_dir() {
+        result
+    } else if result.is_ok() {
+        bail!("{} is not a regular directory", dir.as_ref().display())
+    } else {
+        result
+    }
+}
+
+pub fn ensure_binary<T: AsRef<Path>>(
+    path: T,
+    contents: &[u8],
+    ignore_if_exist: bool,
+) -> Result<()> {
+    if ignore_if_exist && path.as_ref().exists() {
+        return Ok(());
+    }
+
+    ensure_dir_exists(path.as_ref().parent().ok_or_else(|| {
+        anyhow::anyhow!(
+            "{} does not have parent directory",
+            path.as_ref().to_string_lossy()
+        )
+    })?)?;
+
+    if let Err(e) = remove_file(path.as_ref()) {
+        if e.kind() != NotFound {
+            return Err(Error::from(e))
+                .with_context(|| format!("failed to unlink {}", path.as_ref().display()));
+        }
+    }
+
+    write(&path, contents)?;
+    #[cfg(unix)]
+    set_permissions(&path, Permissions::from_mode(0o755))?;
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn getprop(prop: &str) -> Option<String> {
+    android_properties::getprop(prop).value()
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn getprop(_prop: &str) -> Option<String> {
+    unimplemented!()
+}
+
+pub fn is_safe_mode() -> bool {
+    let safemode = getprop("persist.sys.safemode")
+        .filter(|prop| prop == "1")
+        .is_some()
+        || getprop("ro.sys.safemode")
+            .filter(|prop| prop == "1")
+            .is_some();
+    log::info!("safemode: {}", safemode);
+    if safemode {
+        return true;
+    }
+    let safemode = ksucalls::check_kernel_safemode();
+    log::info!("kernel_safemode: {}", safemode);
+    safemode
+}
+
+pub fn get_zip_uncompressed_size(zip_path: &str) -> Result<u64> {
+    let mut zip = zip::ZipArchive::new(std::fs::File::open(zip_path)?)?;
+    let total: u64 = (0..zip.len())
+        .map(|i| zip.by_index(i).unwrap().size())
+        .sum();
+    Ok(total)
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn switch_mnt_ns(pid: i32) -> Result<()> {
+    use rustix::{
+        fd::AsFd,
+        fs::{open, Mode, OFlags},
+    };
+    let path = format!("/proc/{pid}/ns/mnt");
+    let fd = open(path, OFlags::RDONLY, Mode::from_raw_mode(0))?;
+    let current_dir = std::env::current_dir();
+    move_into_link_name_space(fd.as_fd(), Some(LinkNameSpaceType::Mount))?;
+    if let std::result::Result::Ok(current_dir) = current_dir {
+        let _ = std::env::set_current_dir(current_dir);
+    }
+    Ok(())
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn unshare_mnt_ns() -> Result<()> {
+    unshare(UnshareFlags::NEWNS)?;
+    Ok(())
+}
+
+fn switch_cgroup(grp: &str, pid: u32) {
+    let path = Path::new(grp).join("cgroup.procs");
+    if !path.exists() {
+        return;
+    }
+
+    let fp = OpenOptions::new().append(true).open(path);
+    if let std::result::Result::Ok(mut fp) = fp {
+        let _ = writeln!(fp, "{pid}");
+    }
+}
+
+pub fn switch_cgroups() {
+    let pid = std::process::id();
+    switch_cgroup("/acct", pid);
+    switch_cgroup("/dev/cg2_bpf", pid);
+    switch_cgroup("/sys/fs/cgroup", pid);
+
+    if getprop("ro.config.per_app_memcg")
+        .filter(|prop| prop == "false")
+        .is_none()
+    {
+        switch_cgroup("/dev/memcg/apps", pid);
+    }
+}
+
+#[cfg(any(target_os = "linux", target_os = "android"))]
+pub fn umask(mask: u32) {
+    process::umask(rustix::fs::Mode::from_raw_mode(mask));
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+pub fn umask(_mask: u32) {
+    unimplemented!("umask is not supported on this platform")
+}
+
+pub fn has_magisk() -> bool {
+    which::which("magisk").is_ok()
+}
+
+fn is_ok_empty(dir: &str) -> bool {
+    use std::result::Result::Ok;
+
+    match fs::read_dir(dir) {
+        Ok(mut entries) => entries.next().is_none(),
+        Err(_) => false,
+    }
+}
+
+fn find_temp_path() -> String {
+    use std::result::Result::Ok;
+
+    if is_ok_empty(defs::TEMP_DIR) {
+        return defs::TEMP_DIR.to_string();
+    }
+
+    // Try to create a random directory in /dev/
+    let r = tempfile::tempdir_in("/dev/");
+    match r {
+        Ok(tmp_dir) => {
+            if let Some(path) = tmp_dir.into_path().to_str() {
+                return path.to_string();
+            }
+        }
+        Err(_e) => {}
+    }
+
+    let dirs = [
+        defs::TEMP_DIR,
+        "/patch_hw",
+        "/oem",
+        "/root",
+        defs::TEMP_DIR_LEGACY,
+    ];
+
+    // find empty directory
+    for dir in dirs {
+        if is_ok_empty(dir) {
+            return dir.to_string();
+        }
+    }
+
+    // Fallback to non-empty directory
+    for dir in dirs {
+        if metadata(dir).is_ok() {
+            return dir.to_string();
+        }
+    }
+
+    "".to_string()
+}
+
+pub fn get_tmp_path() -> &'static str {
+    static CHOSEN_TMP_PATH: OnceLock<String> = OnceLock::new();
+
+    CHOSEN_TMP_PATH.get_or_init(|| {
+        let r = find_temp_path();
+        log::info!("Chosen temp_path: {}", r);
+        r
+    })
+}
\ No newline at end of file
diff --git a/userspace/su/jni/Application.mk b/userspace/su/jni/Application.mk
index 873252b9e8bd..371942834384 100644
--- a/userspace/su/jni/Application.mk
+++ b/userspace/su/jni/Application.mk
@@ -1,3 +1,3 @@
-APP_ABI := arm64-v8a x86_64
+APP_ABI := arm64-v8a armeabi-v7a x86_64
 APP_PLATFORM := android-24
 APP_STL := none