EnvScope is an Android runtime inspection tool designed to detect dynamic instrumentation frameworks and hook traces. It utilizes both Kotlin and native C++ layers to identify hidden environments like Magisk, Zygisk, Xposed, and Frida through deep system, memory, and port analysis.

I found EnvScope highly effective for testing device security and checking if root hiding mechanisms are actually working. Under the hood, it aggressively cross-checks memory maps and thread stacks, giving you a clear picture of exactly which frameworks are secretly attaching to your system.

Dual-layer inspection pairs native C++ techniques with Kotlin scanning to catch tools that hide from standard Java APIs.
Active port probing connects directly to local host addresses to expose hidden Frida servers running quietly in the background.
Deep memory mapping looks through system files to spot injected libraries, inline hooks, and modified Zygisk shared objects.
Thread stack tracking identifies specific hook call chains generated by active frameworks like LSPosed or EdXposed.

Support & Requirements

Android Versions: Android 8.0 and newer (includes proper package visibility for Android 11+).
Root Support: Works with Magisk, KernelSU, and APatch environments.

How to Install

Open your preferred root manager (Magisk, KernelSU, or APatch) and go to the Modules section.
Tap the "Install from storage" option and select your downloaded EnvScope .zip file.
Reboot your device after the flashing process finishes completely.