Anubis Nightly

Android app manager with VPN integration. Manages groups of apps by freezing/unfreezing them based on VPN connection state.

Unlike sandbox-based solutions (Island, Insular, Shelter), which only isolate apps in a work profile where they can still detect VPN through the shared network stack, Anubis uses pm disable-user to completely disable apps at the system level. A disabled app cannot run any code, detect any network interfaces, or send any data.

Features

App groups with different network policies:

- Local: apps frozen when VPN is active, launched without VPN - VPN Only: apps frozen when VPN is inactive, launched through VPN - Launch with VPN: never frozen, but launching triggers VPN activation

Other features:

- Home screen launcher with tap-to-launch using the correct VPN state - Grayscale icons for frozen/disabled apps - Long press for freeze/unfreeze, shortcut creation, group management - VPN client orchestration with auto start/stop for supported clients; any client works in manual mode - Custom VPN client selection from the app list - Active VPN client detection via dumpsys connectivity owner UID - Pinned shortcuts that orchestrate freeze/VPN/launch in one tap - Network check: ping, country, city (IP hidden by default) - Quick Settings tile - Auto-freeze on boot and on app launch if VPN is already active - Background VPN monitoring with auto-freeze when VPN is toggled outside Anubis (opt-in) - Multi-step VPN disconnect: API, dummy VPN takeover, force-stop, kill

How It Works

Freeze mechanism: uses Shizuku to run pm disable-user --user 0 <package>, completely disabling an app at the OS level. The app cannot run background services, receive broadcasts, access network interfaces, or detect VPN or proxy. This differs from sandboxing, which still lets the app run and inspect the network stack.

VPN start: for clients with a known API, Anubis sends shell commands via Shizuku. Three control modes: SEPARATE (independent start and stop commands), TOGGLE (single toggle command), MANUAL (no external API; Anubis opens the app and the user taps connect).

VPN stop: toggle commands are unreliable for stopping, so Anubis uses a multi-step approach: API stop for SEPARATE clients, a dummy VPN to revoke the client's VPN, then am force-stop to kill the detected app. Apps are never unfrozen while VPN is still active.

VPN detection: extracts the VPN network owner UID from dumpsys connectivity and resolves UID to package name via pm list packages --uid. Works with any client, including unknown or custom ones.

Supported VPN clients

Full control (independent start/stop): NekoBox, Incy, Clash Meta (Meta and Alpha), FlClash, FlClashX.

Auto-toggle (start via widget or shortcut, stop via dummy-VPN fallback): v2rayNG (Play, F-Droid), Happ (Play, GitHub), v2rayTun, V2Box, olcng, Exclave, husi.

Full start/stop via automation token: Tunguska.

Manual (Anubis opens the app, user connects): AmneziaVPN, AmneziaWG, WireGuard, WG Tunnel, TeapodStream, Karing, or any app selected in Settings as "Other client".

Tunguska setup: install and import a working profile, start it once and grant VPN permission, enable automation in Tunguska's Anubis Integration and copy the token, select Tunguska in Anubis and paste the token, then use Anubis normally.

Discovering VPN client APIs: for closed-source clients, broadcast actions can be found via APK analysis with jadx. The two common patterns are widget broadcasts (v2ray/xray forks) and exported shortcut activities (SagerNet forks). This is standard Android IPC discovery, not reverse engineering of protected code; broadcast actions and exported activities are public interfaces by design.

Requirements

- Android 10+ (API 29) - Shizuku installed and running - At least one VPN client installed

Setup

- Install and start Shizuku (via ADB or Wireless Debugging). - Install Anubis. - Grant Shizuku permission when prompted. - Grant VPN permission when prompted (needed for dummy VPN disconnect). - Assign apps to groups in the Apps tab. - Select the VPN client in Settings (known or custom). - Toggle stealth mode on the Home screen.

License

MIT