From 1b632fb31889b38a653ac944515c5c8dfb3eac50 Mon Sep 17 00:00:00 2001
From: bmax <bmax@placeholder.com>
Date: Tue, 2 Apr 2024 17:25:53 +0800
Subject: [PATCH] a

---
 kernel/base/predata.c                | 33 ++++++-----
 kernel/base/setup1.S                 |  6 +-
 kernel/base/start.h                  |  6 +-
 kernel/include/predata.h             |  2 +-
 kernel/include/preset.h              |  6 +-
 kernel/linux/include/linux/random.h  |  7 ---
 kernel/linux/include/linux/uaccess.h | 13 +----
 kernel/patch/common/supercall.c      | 82 +++++++++++++++++++---------
 kernel/patch/common/utils.c          | 21 ++-----
 kernel/patch/include/kputils.h       |  2 +-
 kernel/patch/include/uapi/scdefs.h   |  3 +-
 kernel/patch/ksyms/libs.c            | 23 +++-----
 kernel/patch/ksyms/misc.c            |  9 ++-
 tools/patch.c                        |  6 +-
 user/android/android_user.c          |  8 ++-
 user/kpatch.c                        |  8 +--
 user/supercall.h                     |  7 ---
 17 files changed, 120 insertions(+), 122 deletions(-)

diff --git a/kernel/base/predata.c b/kernel/base/predata.c
index 757b3815..a4ef0553 100644
--- a/kernel/base/predata.c
+++ b/kernel/base/predata.c
@@ -15,11 +15,13 @@
 extern start_preset_t start_preset;
 
 static char *superkey = 0;
-static char *superkey_hash = 0;
+static char *root_superkey = 0;
 static struct patch_symbol *patch_symbol = 0;
 
-uint64_t _rand_next = 1000000007;
-int skip_hash_auth = 0;
+static const char bstr[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+
+static uint64_t _rand_next = 1000000007;
+static int enable_root_key = 1;
 
 int auth_superkey(const char *key)
 {
@@ -27,7 +29,7 @@ int auth_superkey(const char *key)
     rc = lib_strncmp(superkey, key, SUPER_KEY_LEN);
     if (!rc) return rc;
 
-    if (skip_hash_auth) return rc;
+    if (!enable_root_key) return rc;
 
     BYTE hash[SHA256_BLOCK_SIZE];
     SHA256_CTX ctx;
@@ -35,19 +37,20 @@ int auth_superkey(const char *key)
     sha256_update(&ctx, (const BYTE *)key, lib_strnlen(key, SUPER_KEY_LEN));
     sha256_final(&ctx, hash);
     int len = SHA256_BLOCK_SIZE > ROOT_SUPER_KEY_HASH_LEN ? ROOT_SUPER_KEY_HASH_LEN : SHA256_BLOCK_SIZE;
-    rc = lib_memcmp(superkey_hash, hash, len);
+    rc = lib_memcmp(root_superkey, hash, len);
 
     return rc;
 }
 
 void reset_superkey(const char *key)
 {
-    lib_strncpy(superkey, key, SUPER_KEY_LEN);
+    lib_strncpy(superkey, key, SUPER_KEY_LEN - 1);
+    superkey[SUPER_KEY_LEN - 1] = '\0';
 }
 
-void skip_hash_auth_superkey(int skip_hash)
+void enable_auth_root_key(int enable)
 {
-    skip_hash_auth = skip_hash;
+    enable_root_key = enable;
 }
 
 uint64_t rand_next()
@@ -91,10 +94,10 @@ int on_each_extra_item(int (*callback)(const patch_extra_item_t *extra, const ch
 void predata_init()
 {
     superkey = (char *)start_preset.superkey;
-    superkey_hash = (char *)start_preset.superkey_hash;
+    root_superkey = (char *)start_preset.root_superkey;
     char *compile_time = start_preset.header.compile_time;
 
-    // RNG, relies on KASLR
+    // RNG
     _rand_next *= kernel_va;
     _rand_next *= kver;
     _rand_next *= kpver;
@@ -102,13 +105,15 @@ void predata_init()
     _rand_next *= _kp_region_end;
     if (*(uint64_t *)compile_time) _rand_next *= *(uint64_t *)compile_time;
     if (*(uint64_t *)(superkey)) _rand_next *= *(uint64_t *)(superkey);
-    if (*(uint64_t *)(superkey_hash)) _rand_next *= *(uint64_t *)(superkey_hash);
+    if (*(uint64_t *)(root_superkey)) _rand_next *= *(uint64_t *)(root_superkey);
 
     // random key
     if (lib_strnlen(superkey, SUPER_KEY_LEN) <= 0) {
-        for (int i = 0; i < 16; ++i) {
-            uint64_t rand = rand_next() % ('z' - '0' + 1);
-            superkey[i] = (char)('0' + rand);
+        int len = SUPER_KEY_LEN > 16 ? 16 : SUPER_KEY_LEN;
+        len--;
+        for (int i = 0; i < len; ++i) {
+            uint64_t rand = rand_next() % (sizeof(bstr) - 1);
+            superkey[i] = bstr[rand];
         }
     }
     log_boot("gen rand key: %s\n", superkey);
diff --git a/kernel/base/setup1.S b/kernel/base/setup1.S
index ba2b15ab..10c05e26 100644
--- a/kernel/base/setup1.S
+++ b/kernel/base/setup1.S
@@ -103,9 +103,9 @@ start_prepare:
     mov x2, #SUPER_KEY_LEN
     bl memcpy8
 
-    // memcpy(start_preset.superkey_hash, setup_preset.superkey_hash, ROOT_SUPER_KEY_HASH_LEN);
-    add x0, x11, #start_superkey_hash_offset;
-    add x1, x10, #setup_superkey_hash_offset
+    // memcpy(start_preset.root_superkey, setup_preset.root_superkey, ROOT_SUPER_KEY_HASH_LEN);
+    add x0, x11, #start_root_superkey_offset;
+    add x1, x10, #setup_root_superkey_offset
     mov x2, #ROOT_SUPER_KEY_HASH_LEN
     bl memcpy8
 
diff --git a/kernel/base/start.h b/kernel/base/start.h
index 48f510b3..5766bfbc 100644
--- a/kernel/base/start.h
+++ b/kernel/base/start.h
@@ -23,7 +23,7 @@ typedef struct
     int64_t map_backup_len;
     uint8_t map_backup[MAP_MAX_SIZE];
     uint8_t superkey[SUPER_KEY_LEN];
-    uint8_t superkey_hash[ROOT_SUPER_KEY_HASH_LEN];
+    uint8_t root_superkey[ROOT_SUPER_KEY_HASH_LEN];
     patch_symbol_t patch_symbol;
 } start_preset_t;
 #else
@@ -38,8 +38,8 @@ typedef struct
 #define start_map_backup_len_offset (start_map_offset_offset + 8)
 #define start_map_backup_offset (start_map_backup_len_offset + 8)
 #define start_superkey_offset (start_map_backup_offset + MAP_MAX_SIZE)
-#define start_superkey_hash_offset (start_superkey_offset + SUPER_KEY_LEN)
-#define start_patch_symbol_offset (start_superkey_hash_offset + ROOT_SUPER_KEY_HASH_LEN)
+#define start_root_superkey_offset (start_superkey_offset + SUPER_KEY_LEN)
+#define start_patch_symbol_offset (start_root_superkey_offset + ROOT_SUPER_KEY_HASH_LEN)
 #define start_patch_extra_offset_offset (start_patch_symbol_offset + PATCH_SYMBOL_LEN)
 #define start_patch_extra_size_offset (start_patch_extra_offset_offset + 8)
 #define start_end (start_patch_extra_size_offset + 8)
diff --git a/kernel/include/predata.h b/kernel/include/predata.h
index bdf0421b..66e60ec1 100644
--- a/kernel/include/predata.h
+++ b/kernel/include/predata.h
@@ -11,7 +11,7 @@
 
 int auth_superkey(const char *key);
 void reset_superkey(const char *key);
-void skip_hash_auth_superkey(int skip_hash);
+void enable_auth_root_key(int skip_hash);
 const char *get_superkey();
 
 uint64_t rand_next();
diff --git a/kernel/include/preset.h b/kernel/include/preset.h
index 4acba211..1970d33e 100644
--- a/kernel/include/preset.h
+++ b/kernel/include/preset.h
@@ -234,7 +234,7 @@ typedef struct _setup_preset_t
     map_symbol_t map_symbol;
     uint8_t header_backup[HDR_BACKUP_SIZE];
     uint8_t superkey[SUPER_KEY_LEN];
-    uint8_t superkey_hash[ROOT_SUPER_KEY_HASH_LEN];
+    uint8_t root_superkey[ROOT_SUPER_KEY_HASH_LEN];
     uint8_t __[SETUP_PRESERVE_LEN];
     patch_symbol_t patch_symbol;
     char additional[ADDITIONAL_LEN];
@@ -256,8 +256,8 @@ typedef struct _setup_preset_t
 #define setup_map_symbol_offset (setup_printk_offset_offset + 8)
 #define setup_header_backup_offset (setup_map_symbol_offset + MAP_SYMBOL_SIZE)
 #define setup_superkey_offset (setup_header_backup_offset + HDR_BACKUP_SIZE)
-#define setup_superkey_hash_offset (setup_superkey_offset + SUPER_KEY_LEN)
-#define setup_patch_symbol_offset (setup_superkey_hash_offset + ROOT_SUPER_KEY_HASH_LEN + SETUP_PRESERVE_LEN)
+#define setup_root_superkey_offset (setup_superkey_offset + SUPER_KEY_LEN)
+#define setup_patch_symbol_offset (setup_root_superkey_offset + ROOT_SUPER_KEY_HASH_LEN + SETUP_PRESERVE_LEN)
 #define setup_end (setup_patch_symbol_offset + PATCH_SYMBOL_LEN)
 #endif
 
diff --git a/kernel/linux/include/linux/random.h b/kernel/linux/include/linux/random.h
index 717be732..b795e602 100644
--- a/kernel/linux/include/linux/random.h
+++ b/kernel/linux/include/linux/random.h
@@ -14,11 +14,4 @@ extern void kfunc_def(get_random_bytes)(void *buf, int nbytes);
 extern uint64_t kfunc_def(get_random_u64)(void);
 extern uint64_t kfunc_def(get_random_long)(void);
 
-static inline void get_random_bytes(void *buf, int nbytes)
-{
-    kfunc_call_void(get_random_bytes, buf, nbytes);
-}
-
-uint64_t get_random_u64(void);
-
 #endif
\ No newline at end of file
diff --git a/kernel/linux/include/linux/uaccess.h b/kernel/linux/include/linux/uaccess.h
index 27b2f362..1356b5b9 100644
--- a/kernel/linux/include/linux/uaccess.h
+++ b/kernel/linux/include/linux/uaccess.h
@@ -13,7 +13,8 @@
 // unsigned long __must_check copy_in_user(void __user *to, const void __user *from, unsigned long n);
 
 //  >= 5.8, On success, returns the length of the string INCLUDING the trailing NUL.
-extern long kfunc_def(compact_strncpy_from_user)(char *dst, const void __user *unsafe_addr, long count);
+extern long kfunc_def(strncpy_from_user_nofault)(char *dst, const void __user *unsafe_addr, long count);
+
 /**
  * strncpy_from_unsafe_user: - Copy a NUL terminated string from unsafe user
  *				address.
@@ -33,6 +34,7 @@ extern long kfunc_def(compact_strncpy_from_user)(char *dst, const void __user *u
  * sets the last byte of @dst buffer to NUL and returns @count.
  */
 extern long kfunc_def(strncpy_from_unsafe_user)(char *dst, const void __user *unsafe_addr, long count);
+
 /**
  * strncpy_from_user: - Copy a NUL terminated string from userspace.
  * @dst:   Destination address, in kernel space.  This buffer must be at
@@ -60,13 +62,4 @@ extern long kfunc_def(strnlen_user)(const char __user *str, long n);
 
 long compact_strncpy_from_user(char *dest, const char __user *src, long count);
 
-static inline long strnlen_user_nofault(const char __user *str, long n)
-{
-    kfunc_call(strnlen_user_nofault, str, n);
-    kfunc_call(strnlen_unsafe_user, str, n);
-    kfunc_call(strnlen_user, str, n);
-    kfunc_not_found();
-    return 0;
-}
-
 #endif
\ No newline at end of file
diff --git a/kernel/patch/common/supercall.c b/kernel/patch/common/supercall.c
index 2d04598b..9a34d689 100644
--- a/kernel/patch/common/supercall.c
+++ b/kernel/patch/common/supercall.c
@@ -27,6 +27,8 @@
 #include <linux/slab.h>
 #include <kputils.h>
 #include <pidmem.h>
+#include <predata.h>
+#include <linux/random.h>
 
 #define MAX_KEY_LEN 128
 
@@ -34,19 +36,19 @@
 
 static long call_test(long arg1, long arg2, long arg3)
 {
-    char *cmd = "/system/bin/touch";
-    // const char *superkey = get_superkey();
-    char *argv[] = {
-        cmd,
-        "/data/local/tmp/test.txt",
-        NULL,
-    };
-    char *envp[] = {
-        "PATH=/system/bin:/data/adb",
-        NULL,
-    };
-    int rc = call_usermodehelper(cmd, argv, envp, UMH_WAIT_PROC);
-    log_boot("user_init: %d\n", rc);
+    // char *cmd = "/system/bin/touch";
+    // // const char *superkey = get_superkey();
+    // char *argv[] = {
+    //     cmd,
+    //     "/data/local/tmp/test.txt",
+    //     NULL,
+    // };
+    // char *envp[] = {
+    //     "PATH=/system/bin:/data/adb",
+    //     NULL,
+    // };
+    // int rc = call_usermodehelper(cmd, argv, envp, UMH_WAIT_PROC);
+    // log_boot("user_init: %d\n", rc);
     return 0;
 }
 
@@ -127,11 +129,6 @@ static long call_kpm_info(const char *__user uname, char *__user out_info, int o
     return sz;
 }
 
-static unsigned long call_pid_virt_to_phys(pid_t pid, uintptr_t vaddr)
-{
-    return pid_virt_to_phys(pid, vaddr);
-}
-
 static long call_su(struct su_profile *__user uprofile)
 {
     struct su_profile *profile = memdup_user(uprofile, sizeof(struct su_profile));
@@ -152,6 +149,35 @@ static long call_su_task(pid_t pid, struct su_profile *__user uprofile)
     return rc;
 }
 
+static long call_skey_get(char *__user out_key, int out_len)
+{
+    const char *key = get_superkey();
+    int klen = strlen(key);
+    if (klen >= out_len) return -ENOMEM;
+    int rc = compat_copy_to_user(out_key, get_superkey(), klen + 1);
+    return rc;
+}
+
+static long call_skey_set(char *__user new_key)
+{
+    char buf[SUPER_KEY_LEN];
+    int len = compact_strncpy_from_user(buf, new_key, sizeof(buf));
+    if (len >= SUPER_KEY_LEN && buf[SUPER_KEY_LEN - 1]) return -E2BIG;
+    reset_superkey(new_key);
+    return 0;
+}
+
+static long call_skey_root_enable(int enable)
+{
+    enable_auth_root_key(enable);
+    return 0;
+}
+
+static unsigned long call_pid_virt_to_phys(pid_t pid, uintptr_t vaddr)
+{
+    return pid_virt_to_phys(pid, vaddr);
+}
+
 static long supercall(long cmd, long arg1, long arg2, long arg3, long arg4)
 {
     switch (cmd) {
@@ -168,12 +194,11 @@ static long supercall(long cmd, long arg1, long arg2, long arg3, long arg4)
 
     switch (cmd) {
     case SUPERCALL_SKEY_GET:
-        break;
+        return call_skey_get((char *__user)arg1, (int)arg2);
     case SUPERCALL_SKEY_SET:
-        break;
-    case SUPERCALL_SKEY_RAND:
-        break;
+        return call_skey_set((char *__user)arg1);
     case SUPERCALL_SKEY_ROOT_ENABLE:
+        return call_skey_root_enable((int)arg1);
         break;
     }
 
@@ -204,6 +229,7 @@ static long supercall(long cmd, long arg1, long arg2, long arg3, long arg4)
     case SUPERCALL_TEST:
         return call_test(arg1, arg2, arg3);
     }
+
 #ifdef ANDROID
     return supercall_android(cmd, arg1, arg2, arg3);
 #endif
@@ -214,20 +240,24 @@ static void before(hook_fargs6_t *args, void *udata)
 {
     const char *__user ukey = (const char *__user)syscall_argn(args, 0);
     long ver_xx_cmd = (long)syscall_argn(args, 1);
-    long a1 = (long)syscall_argn(args, 2);
-    long a2 = (long)syscall_argn(args, 3);
-    long a3 = (long)syscall_argn(args, 4);
-    long a4 = (long)syscall_argn(args, 5);
 
+    // todo: from 0.10.5
     // uint32_t ver = (ver_xx_cmd & 0xFFFFFFFF00000000ul) >> 32;
     // long xx = (ver_xx_cmd & 0xFFFF0000) >> 16;
+
     long cmd = ver_xx_cmd & 0xFFFF;
+    if (cmd < SUPERCALL_HELLO || cmd > SUPERCALL_MAX) return;
 
     char key[MAX_KEY_LEN];
     long len = compact_strncpy_from_user(key, ukey, MAX_KEY_LEN);
     if (len <= 0) return;
     if (auth_superkey(key)) return;
 
+    long a1 = (long)syscall_argn(args, 2);
+    long a2 = (long)syscall_argn(args, 3);
+    long a3 = (long)syscall_argn(args, 4);
+    long a4 = (long)syscall_argn(args, 5);
+
     args->skip_origin = 1;
     args->ret = supercall(cmd, a1, a2, a3, a4);
 }
diff --git a/kernel/patch/common/utils.c b/kernel/patch/common/utils.c
index af5bdbe5..e21bc72f 100644
--- a/kernel/patch/common/utils.c
+++ b/kernel/patch/common/utils.c
@@ -96,6 +96,8 @@ KP_EXPORT_SYMBOL(compat_copy_to_user);
 
 long compact_strncpy_from_user(char *dest, const char __user *src, long count)
 {
+    kfunc_call(strncpy_from_user_nofault, dest, src, count);
+    kfunc_call(strncpy_from_unsafe_user, dest, src, count);
     if (kfunc(strncpy_from_user)) {
         long rc = kfunc(strncpy_from_user)(dest, src, count);
         if (rc >= count) {
@@ -106,8 +108,6 @@ long compact_strncpy_from_user(char *dest, const char __user *src, long count)
         }
         return rc;
     }
-    kfunc_call(compact_strncpy_from_user, dest, src, count);
-    kfunc_call(strncpy_from_unsafe_user, dest, src, count);
     return 0;
 }
 KP_EXPORT_SYMBOL(compact_strncpy_from_user);
@@ -151,17 +151,8 @@ KP_EXPORT_SYMBOL(copy_to_user_stack);
 
 uint64_t get_random_u64(void)
 {
-    // kfunc_call(get_random_u64);
-    // kfunc_call(get_random_long);
-    // _rand_next = 1103515245 * _rand_next + 12345;
-    // return _rand_next;
+    kfunc_call(get_random_u64);
+    kfunc_call(get_random_long);
+    return rand_next();
 }
-
-char *random_string(int len)
-{
-    char buff[128];
-    if (kfunc(get_random_bytes)) {
-        get_random_bytes(buff, len);
-    } else {
-    }
-}
\ No newline at end of file
+KP_EXPORT_SYMBOL(get_random_u64);
diff --git a/kernel/patch/include/kputils.h b/kernel/patch/include/kputils.h
index 00f370ed..9e847efb 100644
--- a/kernel/patch/include/kputils.h
+++ b/kernel/patch/include/kputils.h
@@ -13,7 +13,7 @@ int __must_check compat_copy_to_user(void __user *to, const void *from, int n);
 
 void *__user copy_to_user_stack(const void *data, int len);
 
-char *random_string(int len);
+uint64_t get_random_u64(void);
 
 void print_bootlog();
 
diff --git a/kernel/patch/include/uapi/scdefs.h b/kernel/patch/include/uapi/scdefs.h
index 7662b5a6..09b0cbca 100644
--- a/kernel/patch/include/uapi/scdefs.h
+++ b/kernel/patch/include/uapi/scdefs.h
@@ -28,8 +28,7 @@ static inline long hash_key(const char *key)
 
 #define SUPERCALL_SKEY_GET 0x100a
 #define SUPERCALL_SKEY_SET 0x100b
-#define SUPERCALL_SKEY_RAND 0x100c
-#define SUPERCALL_SKEY_ROOT_ENABLE 0x100d
+#define SUPERCALL_SKEY_ROOT_ENABLE 0x100c
 
 #define SUPERCALL_SU 0x1010
 #define SUPERCALL_SU_TASK 0x1011 // syscall(__NR_gettid)
diff --git a/kernel/patch/ksyms/libs.c b/kernel/patch/ksyms/libs.c
index 8a7019fb..9e1c52e5 100644
--- a/kernel/patch/ksyms/libs.c
+++ b/kernel/patch/ksyms/libs.c
@@ -21,32 +21,23 @@ static void _linux_lib_misc(const char *name, unsigned long addr)
 
 #include <linux/uaccess.h>
 
-long kfunc_def(compact_strncpy_from_user)(char *dst, const void __user *unsafe_addr, long count) = 0;
-KP_EXPORT_SYMBOL(kfunc(compact_strncpy_from_user));
+long kfunc_def(strncpy_from_user_nofault)(char *dst, const void __user *unsafe_addr, long count) = 0;
 long kfunc_def(strncpy_from_unsafe_user)(char *dst, const void __user *unsafe_addr, long count) = 0;
-KP_EXPORT_SYMBOL(kfunc(strncpy_from_unsafe_user));
 long kfunc_def(strncpy_from_user)(char *dest, const char __user *src, long count) = 0;
-KP_EXPORT_SYMBOL(kfunc(strncpy_from_user));
+
 long kfunc_def(strnlen_user_nofault)(const void __user *unsafe_addr, long count) = 0;
-KP_EXPORT_SYMBOL(kfunc(strnlen_user_nofault));
 long kfunc_def(strnlen_unsafe_user)(const void __user *unsafe_addr, long count) = 0;
-KP_EXPORT_SYMBOL(kfunc(strnlen_unsafe_user));
 long kfunc_def(strnlen_user)(const char __user *str, long n);
-KP_EXPORT_SYMBOL(kfunc(strnlen_user));
 
 static void _linux_lib_strncpy_from_user_sym_match(const char *name, unsigned long addr)
 {
-    kfunc_match(compact_strncpy_from_user, name, addr);
-    if (!kfunc(compact_strncpy_from_user)) {
-        kfunc_match(strncpy_from_unsafe_user, name, addr);
-    }
+    kfunc_match(strncpy_from_user_nofault, name, addr);
+    kfunc_match(strncpy_from_unsafe_user, name, addr);
     kfunc_match(strncpy_from_user, name, addr);
 
-    kfunc_match(strnlen_user_nofault, name, addr);
-    if (!kfunc(strnlen_user_nofault)) {
-        kfunc_match(strnlen_unsafe_user, name, addr);
-    }
-    kfunc_match(strnlen_user, name, addr);
+    // kfunc_match(strnlen_user_nofault, name, addr);
+    // kfunc_match(strnlen_unsafe_user, name, addr);
+    // kfunc_match(strnlen_user, name, addr);
 }
 
 // lib/string.c
diff --git a/kernel/patch/ksyms/misc.c b/kernel/patch/ksyms/misc.c
index 9bd5ad92..ee759c15 100644
--- a/kernel/patch/ksyms/misc.c
+++ b/kernel/patch/ksyms/misc.c
@@ -720,14 +720,19 @@ static void _linux_seccomp_sym_match(const char *name, unsigned long addr)
 
 void kfunc_def(panic)(const char *fmt, ...) __noreturn __cold = 0;
 int kfunc_def(call_usermodehelper)(const char *path, char **argv, char **envp, int wait) = 0;
+
 // /drivers/char/random.c
 void kfunc_def(get_random_bytes)(void *buf, int nbytes) = 0;
+uint64_t kfunc_def(get_random_u64)(void) = 0;
+uint64_t kfunc_def(get_random_long)(void) = 0;
 
 static void _linux_misc_misc(const char *name, unsigned long addr)
 {
     kfunc_match(panic, name, addr);
-    kfunc_match(call_usermodehelper, name, addr);
-    kfunc_match(get_random_bytes, name, addr);
+    // kfunc_match(call_usermodehelper, name, addr);
+    // kfunc_match(get_random_bytes, name, addr);
+    // kfunc_match(get_random_u64, name, addr);
+    // kfunc_match(get_random_long, name, addr);
 }
 
 // linux/bottom_half.h
diff --git a/tools/patch.c b/tools/patch.c
index 1d38e253..cc887a89 100644
--- a/tools/patch.c
+++ b/tools/patch.c
@@ -150,7 +150,7 @@ void print_preset_info(preset_t *preset)
 
     // todo: remove compat version
     if (ver_num > 0xa04) {
-        char *hexstr = bytes_to_hexstr(setup->superkey_hash, ROOT_SUPER_KEY_HASH_LEN);
+        char *hexstr = bytes_to_hexstr(setup->root_superkey, ROOT_SUPER_KEY_HASH_LEN);
         fprintf(stdout, "root_superkey=%s\n", hexstr);
         free(hexstr);
     }
@@ -557,8 +557,8 @@ int patch_update_img(const char *kimg_path, const char *kpimg_path, const char *
         sha256_init(&ctx);
         sha256_update(&ctx, (const BYTE *)superkey, strnlen(superkey, SUPER_KEY_LEN));
         sha256_final(&ctx, buf);
-        memcpy(setup->superkey_hash, buf, len);
-        char *hexstr = bytes_to_hexstr(setup->superkey_hash, len);
+        memcpy(setup->root_superkey, buf, len);
+        char *hexstr = bytes_to_hexstr(setup->root_superkey, len);
         tools_logi("root superkey hash: %s\n", hexstr);
         free(hexstr);
     }
diff --git a/user/android/android_user.c b/user/android/android_user.c
index 500934ed..fa9a16ae 100644
--- a/user/android/android_user.c
+++ b/user/android/android_user.c
@@ -162,12 +162,12 @@ static void fork_for_result(const char *exec, char *const *argv)
     if (pid < 0) {
         log_kernel("%d fork %s error: %d\n", getpid(), exec, pid);
     } else if (pid == 0) {
-        setenv("KERNEL_PATCH", "true", 1);
+        setenv("KERNELPATCH", "true", 1);
         char kpver[16] = { '\0' }, kver[16] = { '\0' };
         sprintf(kpver, "%x", sc_kp_ver(key));
-        setenv("KERNEL_PATCH_VER", kpver, 1);
+        setenv("KERNELPATCH_VERSION", kpver, 1);
         sprintf(kver, "%x", sc_k_ver(key));
-        setenv("KERNEL_VER", kver, 1);
+        setenv("KERNEL_VERSION", kver, 1);
         setenv("SUPERKEY", key, 1);
         int rc = execv(exec, argv);
         log_kernel("%d exec %s error: %s\n", getpid(), cmd, strerror(errno));
@@ -252,6 +252,8 @@ static void post_fs_data_init()
     load_config_su_path();
     load_config_allow_uids();
 
+    // load modules
+
     log_kernel("%d finished android user post-fs-data-init.\n", getpid());
 }
 
diff --git a/user/kpatch.c b/user/kpatch.c
index 2325ce38..63cec4c0 100644
--- a/user/kpatch.c
+++ b/user/kpatch.c
@@ -76,8 +76,7 @@ static void usage(int status)
                         "help                           Print this help message. \n"
                         "get                            Print current superkey.\n"
                         "set <SUPERKEY>                 Set current superkey.\n"
-                        "rand                           Randomize current superkey.\n"
-                        "root [enable|disable]          Whether to use hash to verify the root superkey.\n"
+                        "rootkey [enable|disable]       Whether to use hash to verify the root superkey.\n"
                         "");
     }
     exit(status);
@@ -97,8 +96,7 @@ int skey_main(int argc, char **argv)
     } cmd_arr[] = {
         { "get", SUPERCALL_SKEY_GET },
         { "set", SUPERCALL_SKEY_SET },
-        { "rand", SUPERCALL_SKEY_RAND },
-        { "root", SUPERCALL_SKEY_ROOT_ENABLE },
+        { "rootkey", SUPERCALL_SKEY_ROOT_ENABLE },
         { "help", 0 },
     };
 
@@ -120,8 +118,6 @@ int skey_main(int argc, char **argv)
         if (argc < 3) error(-EINVAL, 0, "no new superkey");
         const char *new_key = argv[2];
         return sc_skey_set(key, new_key);
-    case SUPERCALL_SKEY_RAND:
-        return sc_skey_rand(key);
     case SUPERCALL_SKEY_ROOT_ENABLE:
         if (argc < 3) error(-EINVAL, 0, "no enable or disable specified");
         if (!strcmp("enable", argv[2])) {
diff --git a/user/supercall.h b/user/supercall.h
index 65d81378..a6fa071f 100644
--- a/user/supercall.h
+++ b/user/supercall.h
@@ -72,13 +72,6 @@ static inline uint32_t sc_skey_set(const char *key, const char *new_key)
     return (uint32_t)ret;
 }
 
-static inline uint32_t sc_skey_rand(const char *key)
-{
-    if (!key || !key[0]) return -EINVAL;
-    long ret = syscall(__NR_supercall, key, ver_and_cmd(key, SUPERCALL_SKEY_RAND));
-    return (uint32_t)ret;
-}
-
 static inline uint32_t sc_skey_root_enable(const char *key, bool enable)
 {
     if (!key || !key[0]) return -EINVAL;