Zapret Mobile

No-root DPI-bypass VPN for Android: a local VpnService that fragments the TLS ClientHello (and splits HTTP) so censorship DPI can't match the domain. Go engine (gVisor + desync) via gomobile.

A no-root DPI-bypass VPN for Android. It runs entirely on your phone: a local VpnService captures your traffic and re-frames the TLS ClientHello and HTTP request so that censorship Deep Packet Inspection can no longer match the domain you are visiting. Your traffic still goes directly to each website — there is no remote proxy, nothing is decrypted, and no account is required.

It is a mobile relative of desktop zapret, GoodbyeDPI and ByeDPI, using the subset of their techniques that works without root on a stock Android phone.

How it works ┌─────────────────────────── your phone ───────────────────────────┐ apps ──▶│ Android VpnService (TUN) ──▶ Go engine (one .aar) │──▶ internet │ ├─ gVisor userspace TCP/IP stack │ (direct, │ ├─ desync dialer (per connection) │ no proxy) │ └─ protect() keeps egress off-VPN │ └───────────────────────────────────────────────────────────────────┘ The app asks for the system VPN permission and opens a TUN interface with VpnService (no root needed — this is a normal Android API). A gVisor userspace network stack reads IP packets from the TUN and turns each TCP flow into a connection the engine can handle. For every outgoing connection, the desync dialer re-frames the first payload (the TLS ClientHello or the HTTP request) and dials the real destination through a protect()ed socket so it leaves the phone normally. The result the server reassembles is byte-for-byte identical to your original request. Only the framing changes — which is exactly what a DPI box that keys on a contiguous SNI / Host field fails to follow.

What works without root — and what doesn't Desktop zapret's most famous trick is sending fake packets with a low TTL so the censor sees them but the server never does. That (and true segment reordering) needs raw sockets / TCP_REPAIR, i.e. root, and would corrupt the stream if attempted from an unprivileged app. Zapret Mobile therefore implements only the stream-safe methods, which need no special privilege and are what tools like SpoofDPI, GreenTunnel and PowerTunnel rely on:

Method What it does Notes tlsrec Splits the TLS ClientHello into two TLS records across the SNI Core method, always server-safe split Splits the first write into two TCP segments Composes with tlsrec hostsplit Splits a plaintext HTTP request inside the Host header For port-80 traffic oob Injects a TCP urgent (out-of-band) byte at a boundary Experimental; a few servers mishandle urgent data Methods requiring root (TTL fakes, disorder/retransmit) are intentionally omitted; see ARCHITECTURE.md.

Strategy grammar A strategy is a comma-separated list of steps applied to the first payload, with an optional inter-segment delay:

strategy := step ("," step)* ("@delay=" <ms>)? step := method (":" position)? method := tlsrec | split | hostsplit | oob | none position := <n> | sni[±n] | host[±n] Examples:

tlsrec:sni # split the ClientHello record at the SNI (default-ish) tlsrec:sni,split:1 # also force a separate first TCP segment tlsrec:sni-1,split:2 @delay=15 split:3 # lightest touch: just split the first TCP segment The in-app presets cover the common cases; pick Custom to type your own. Validation is live (the Go parser is called directly through the bound engine).

Features No root, no remote server, no sign-up. Start/stop from the app, a Quick Settings tile, or automatically on boot. Per-connection DPI desync with selectable presets or a custom strategy. Optional Block QUIC (UDP/443) so browsers fall back to TCP TLS, where the desync applies. Material 3 UI with a live log; dynamic color on Android 12+.

Credits Inspired by zapret, ByeDPI, SpoofDPI and PowerTunnel. Built on gVisor's netstack.

License MIT