RKNHardering
Detects VPN and proxy usage on Android using RKN methodology
新版本 2.11.0
1. Added grouped Native signs categories, signal-level results, and online help pages.
2. Added privacy-safe beta checks, including VPNHide system-hook timing detection.
3. Expanded native VPN and VPNHide detection for kernel and network signals.
4. Fixed spoofed ICMP response handling, CDN-check UI, and host-route false positives.
5. Improved documentation and translations.
2. Added privacy-safe beta checks, including VPNHide system-hook timing detection.
3. Expanded native VPN and VPNHide detection for kernel and network signals.
4. Fixed spoofed ICMP response handling, CDN-check UI, and host-route false positives.
5. Improved documentation and translations.
RKNHardering is an Android application that detects VPN and proxy usage on a device, implementing the Russian Federal Service for Supervision of Communications (RKN) methodology for identifying circumvention tools.
The app runs nine independent detection modules in parallel and produces a combined verdict:
- GeoIP — checks the public IP against GeoIP databases and hosting/proxy signal providers
- IP Comparison — compares responses from RU and non-RU public IP checkers
- Direct Signs — inspects NetworkCapabilities, system proxy settings, and installed VPN apps
- Indirect Signs — analyzes network interfaces, routing table, DNS, dumpsys VPN output, and localhost proxy listeners
- Location Signals — reads MCC/SIM/cell/Wi-Fi data and queries BeaconDB for geolocation
- Bypass Check — scans localhost for open SOCKS5/HTTP proxies, Xray gRPC API endpoints, and detects underlying network leaks
- CDN Pulling — sends HTTPS requests to trace endpoints to determine the apparent public IP
- Call Transport — checks STUN and MTProto availability to detect traffic tunneling
- Native Signs — performs JNI-level checks of interfaces, routes, /proc/self/maps hook markers, and root indicators
The final verdict (NOT DETECTED / NEEDS REVIEW / DETECTED) is calculated by VerdictEngine using a weighted combination of the module results.
Minimum Android version: 8.0 (API 26).
Source code: https://github.com/xtclovver/RKNHardering
The app runs nine independent detection modules in parallel and produces a combined verdict:
- GeoIP — checks the public IP against GeoIP databases and hosting/proxy signal providers
- IP Comparison — compares responses from RU and non-RU public IP checkers
- Direct Signs — inspects NetworkCapabilities, system proxy settings, and installed VPN apps
- Indirect Signs — analyzes network interfaces, routing table, DNS, dumpsys VPN output, and localhost proxy listeners
- Location Signals — reads MCC/SIM/cell/Wi-Fi data and queries BeaconDB for geolocation
- Bypass Check — scans localhost for open SOCKS5/HTTP proxies, Xray gRPC API endpoints, and detects underlying network leaks
- CDN Pulling — sends HTTPS requests to trace endpoints to determine the apparent public IP
- Call Transport — checks STUN and MTProto availability to detect traffic tunneling
- Native Signs — performs JNI-level checks of interfaces, routes, /proc/self/maps hook markers, and root indicators
The final verdict (NOT DETECTED / NEEDS REVIEW / DETECTED) is calculated by VerdictEngine using a weighted combination of the module results.
Minimum Android version: 8.0 (API 26).
Source code: https://github.com/xtclovver/RKNHardering
反特徵
此應用程式可能有您不喜歡的功能。 瞭解更多！
- 作者: xtclovver
- 授權條款: GNU Affero General Public License v3.0 only
- 問題追蹤系統
- 原始碼
- 建置詮釋資料
- 可重現建置狀態
版本
雖然在下方可選擇下載 APK 檔案，但要留意這樣的安裝方式將不會收到更新通知，是一種較不安全的下載方法。建議您先安裝 F-Droid 用戶端使用。
下載 F-Droid-
arm64-v8aarmeabi-v7ax86_64此版本需要 Android 8.0 或更高的版本。
此套件包由原開發者建置和簽署，並保證與此原始碼 Tarball 保持一致。
-
arm64-v8aarmeabi-v7ax86_64此版本需要 Android 8.0 或更高的版本。
此套件包由原開發者建置和簽署，並保證與此原始碼 Tarball 保持一致。
-
arm64-v8aarmeabi-v7ax86_64此版本需要 Android 8.0 或更高的版本。
此套件包由原開發者建置和簽署，並保證與此原始碼 Tarball 保持一致。
新版本 2.10.0
1. Added a deep native VPN detector with interface, routing, socket, sysfs, /proc, netlink, PMTU/MSS and environment probes. Permission-limited probes are reported as unavailable instead of crashing.
2. Added Simple, Normal and Advanced result display modes. Advanced mode records bounded, sanitized technical diagnostics in memory and keeps them out of JSON/Markdown exports.
3. Improved verdict handling and diagnostics with new native evidence categories, structured trace capture, safer cancellat
2. Added Simple, Normal and Advanced result display modes. Advanced mode records bounded, sanitized technical diagnostics in memory and keeps them out of JSON/Markdown exports.
3. Improved verdict handling and diagnostics with new native evidence categories, structured trace capture, safer cancellat
新版本 2.9.0
1. Added six new VPN/proxy detectors: extended interface patterns (utun, ZeroTier, Tailscale, IPsec/xfrm, GRE, L2TP), VPN transport type detection, TUN/TAP by sysfs interface type, host-route /32 heuristic, a Clash/mihomo/sing-box REST API scanner, and a local SOCKS5 weak-credentials probe. The last two scanners are optional and enabled in settings.
2. Added emulator detection (QEMU, Genymotion, BlueStacks) and isolated-context detection (secondary user, cloned app, work profile). Network tests
2. Added emulator detection (QEMU, Genymotion, BlueStacks) and isolated-context detection (secondary user, cloned app, work profile). Network tests