VPN Hide

Hides an active VPN connection on Android from selected applications.

Existing modules like NoVPNDetect and NoVPNDetect Enhanced only cover Java API detection and hook inside the target app's process via Xposed. This approach has two critical weaknesses: any app with anti-tamper or memory-injection checks detects Xposed hooks and refuses to run, and native detection paths (ioctl, getifaddrs, netlink sockets, /proc/net/*) are completely missed.

VPN Hide solves both with a multi-layer architecture.

How it works

Level 1 — Java API (LSPosed module) Hooks system_server rather than the target app. NetworkCapabilities, NetworkInfo, and LinkProperties are filtered at the Binder level before data reaches the app process. The app receives clean data over IPC, with no injection into its process and nothing to detect. The same module hides selected apps from observer apps at the PackageManager level.

Level 2 — Native (kernel module, KPM, or Zygisk) Covers native detection paths. Exactly one native backend must be active: - Kernel module (recommended for supported GKI kernels): kprobe/kretprobe hooks at kernel level. Filters ioctl, getifaddrs, netlink dumps of interfaces, addresses, routes, and policy rules, and rejects SO_BINDTODEVICE and SO_BINDTODEVICE/SO_BINDTOIFINDEX for hidden interfaces. Zero footprint in the app process. - KPM (KernelPatch Module): same 11 logical kernel hooks without the GKI .ko binding. Useful for older or non-GKI kernels and situations where .ko cannot load. Requires KernelPatch runtime such as APatch or KPatch-Next-Module. - Zygisk: fallback when kernel-level is not possible. Inline hooks on libc inside the app process, which can be bypassed by direct syscalls.

Level 3 — Port hiding module Separate Magisk module. Uses iptables to block selected apps from accessing 127.0.0.1 and ::1, so they cannot discover a locally running VPN or proxy daemon by open port.

The target app process is completely untouched when using LSPosed plus a kernel-level native backend. No Xposed, no inline hooks, no modified memory regions. This makes VPN Hide work with banking and government apps that actively detect and block Xposed-based modules.

What it hides

Three things, configurable per app through four roles (Java, Native, Apps, Ports):

- Interface hiding: removes VPN interfaces and routes from native APIs, prevents socket binding to hidden interfaces, and cleans Java APIs. - Port hiding: blocks localhost access for selected apps so they cannot detect Clash, sing-box, V2Ray, Happ, and similar tools. - App hiding: hides selected installed apps from observer apps, useful against package visibility checks for VPN or proxy clients.

Requirements

- Always: the VPN Hide app, plus LSPosed or Vector for the Java layer, plus exactly one native backend - Kernel module: GKI kernel 5.10, 5.15, 6.1, 6.6, or 6.12 - KPM: KernelPatch runtime (APatch or KPatch-Next-Module) - Zygisk: any modern root solution with Zygisk enabled - Optional: port hiding module for localhost blocking

Do not install multiple native backends at once. If they are all present, the app chooses by priority: kernel module, then in-kernel built-in, then KPM, then Zygisk.

Setup

1. Install the app and enable the LSPosed module. Add System Framework to its scope and reboot. 2. Install exactly one native backend and reboot. 3. Optional: install the port hiding module for localhost blocking. 4. On the Hiding tab, assign roles (J, N, A, P) to the apps you want to hide the VPN from, not to the VPN client itself. 5. After saving, force-stop the target app and reopen it. Zygisk hooks apply at process start; the other layers apply immediately, but the app may have cached the old response.

Changes only require a reboot when installing or updating modules.

Threat model

VPN Hide hides an active VPN from specific apps. It is not intended to: - Hide root or a custom ROM - Bypass Play Integrity - Fool server-side detection such as DNS leaks, IP blocklists, or latency and TLS fingerprinting

Known limitations

- Kernel module requires a GKI kernel with CONFIG_KPROBES enabled (standard on Android 12 and above). - KPM requires a KernelPatch runtime and must not be installed alongside the .ko variant. - LSPosed requires LSPosed, LSPosed-Next, or Vector. - Zygisk builds for arm64-v8a and armeabi-v7a; kernel backends are arm64 only. - Direct syscalls bypass Zygisk libc hooks, which is why kernel-level backends exist. - Server-side detection cannot be fixed on the client. Use split tunnelling alongside VPN Hide.

License

MIT