直连代理

A selective network-connectivity module for Android Root and LSPosed environments.

Combines pollution-resistant DNS, verified endpoint candidates, transparent TCP/TLS relaying, and fail-open protection in a data plane that is authorized per application.

GitHub is the stable baseline with completed end-to-end device validation. Google, YouTube, Discord, and OpenAI/ChatGPT are integrated into the same profile and routing system but remain experimental, disabled by default, and require separate validation on each device and network.

Features

- Modern LSPosed module — Built with LibXposed API 102, compatible with API 101 or later - Explicit application scope — LSPosed hooks and Root data plane are authorized separately - Dynamic candidate system — Combines trusted DNS, bundled safety snapshots, and bounded historical results, verified with TCP, system trust store, hostname checks, and endpoint semantics - Root transparent mode — Intercepts only target DNS, TCP/443, and required QUIC fallback traffic for selected UIDs - Original-destination recovery — Reads SO_ORIGINAL_DST through JNI - TLS relay — Parses multi-record ClientHello messages and routes by virtual IP, allowed SNI, or original destination - Optional browser TLS termination — Restricted to explicitly authorized browser UIDs with per-device CA and strict validation - Fail-open lifecycle — Removes GHD_* rules on failure; independent guardian cleans stale state after abnormal termination - Observability — Displays active generation, Root UID, candidate counts, hook heartbeat, DNS hits, and failure stages

Compatibility

- Android 8.0+ (minSdk 26, targetSdk 36); validated on Android 12–16 - LSPosed Modern API 101+; compiled against API 102 - Root: Magisk / KernelSU with working su, iptables, owner matching, and REDIRECT - ABI: arm64-v8a, armeabi-v7a, x86_64

Backend modes

- Auto — Prefers transparent Root backend when capabilities pass, otherwise falls back - Root transparent — Installs bounded per-UID iptables rules without occupying the VPN slot - VPN — Uses Android VpnService for devices without Root - Xposed (DNS + Root relay) — Hook provides in-process DNS handling; Root backend handles transparent relaying

Platform status

- GitHub — Validated baseline - Google — Experimental, disabled by default - YouTube — Experimental, disabled by default - Discord — Experimental - OpenAI / ChatGPT — Experimental, disabled by default

Installation

1. Download and install the APK. 2. Enable the module in LSPosed, select only the applications that need it, then force-stop and restart those applications. 3. Open Github-direct and grant Root access. Select the same applications in the Root scope. 4. Prefer Auto (Root first). Devices without Root can use VPN mode. 5. Enable platform profiles as needed and confirm the status page shows a running Root service.

Security boundaries

- Does not scan public address space; candidates come only from configured trusted sources - No TrustAll, disabled hostname verification, or invalid certificate acceptance - Does not install a default route or silently switch to a third-party egress - Hook hot paths read immutable snapshots only and fail open

License

Apache 2.0