Add new resource link for Android ARM64 dynamic instrumentation module in README

.claude/skills/mobile-security/SKILL.md

@@ -150,6 +150,37 @@ Interceptor.attach(Module.findExportByName("libgame.so", "function_name"), {
 | APatch    | Kernel      | High    | Yes         | Growing       |
 ```
 
+### Managed Dynamic Instrumentation on Rooted Android
+```
+Methodology (KSU/Magisk module + single binary engine):
+- Package injector + loader + agent into one ARM64 binary
+  to reduce footprint and version mismatch risk
+- Expose a local HTTP RPC control plane (127.0.0.1:<port>) for
+  low-latency script management, session listing, and function calls
+- Keep boot path safe: do NOT start instrumentation engine in
+  post-fs-data/service early stage; use delayed manual start after
+  boot_completed to avoid zygote/module startup contention
+
+Injection modes:
+- Attach: ptrace into running process, inject bootstrap shellcode,
+  resolve libc symbols, dlopen agent, then run JS
+- Spawn: zygote-hijack path to pause child at fork and inject before
+  app initialization (covers Application.onCreate / class init)
+- Watch-SO: eBPF-based dlopen monitor that triggers injection when
+  target native library is loaded
+
+Stealth tiers:
+- NORMAL: direct RWX patching (fastest, easiest to detect)
+- WXSHADOW: shadow-page patching to reduce /proc memory visibility
+- RECOMP: function recompile/relocation with minimal inline patch
+
+Operational pattern:
+- Lifecycle commands: start/stop/restart/status
+- Analysis mode: temporarily disable conflicting zygisk modules,
+  reboot, instrument, then restore and reboot back to normal mode
+- Troubleshooting-first logging: keep manager and engine logs separate
+```
+
 ### Root Detection Bypass
 
 #### Common Checks

README.md

@@ -1128,6 +1128,7 @@ npx skills add https://github.com/gmh5225/awesome-game-security --skill reverse-
 - https://github.com/Exo1i/MagiskHluda [Run a more undetectable frida server on boot using magisk]
 - https://github.com/suifei/fridare [Powerful Frida repackaging tool for iOS and Android. Easily modify Frida servers to enhance stealth and bypass detection]
 - https://github.com/kkkbbb/rustFrida [Frida-like Android ARM64 hook — QuickJS, Java/native/stealth hook, QBDI; pairs with wxshadow (mkpms)]
+- https://github.com/dreamland-blog/KSU-Rust-Frida [Android ARM64 dynamic instrumentation module workflow for KernelSU/Magisk: single-binary engine, attach/spawn/watch-so, HTTP RPC control plane, and multi-mode stealth (normal/wxshadow/recomp)]
 - https://github.com/TheQmaks/phantom-frida [Build anti-detection Frida server from source]
 
 > Hook ART(android)