vpnhide icon

vpnhide

v1.3.0guide

Hide active VPN from selected Android apps (kernel module + LSPosed + Zygisk)

★585 stars
•Networking & Proxies•by okhsunrog•Proprietary•Updated Sep 17, 2026
Platforms:
✓ Magisk✓ KernelSU
Download v1.3.0Starting download...GitHub Source
vpnhide-zygisk.zip

Overview

Developed by okhsunrog, VPN Hide is an advanced anti-detection solution engineered to conceal active VPN tunnels on Android devices.

Many regional banking, ride-sharing, and streaming applications actively refuse to operate when a VPN connection is present, citing fraud prevention policies. While simple Xposed hooks can spoof Android’s Java NetworkCapabilities, modern applications employ native code (C/C++, Flutter, React Native) to directly query Linux network sockets (getifaddrs, ioctl, and /proc/net/*). VPN Hide counters both detection vectors through a synchronized multi-layer architecture.

Technical Architecture & How It Works

Three-Tier Cloaking Engine

VPN Hide implements protection across the entire Android software stack:

  1. Level 1 (Java API / LSPosed): Hooks into system_server rather than the target app’s private address space whenever possible. It strips TRANSPORT_VPN flags from reported NetworkCapabilities before delivering them to applications.
  2. Level 2 (Native Runtime / Zygisk): Intercepts native C library calls (getifaddrs, socket, ioctl) to filter out virtual adapter names (e.g. tun0, ppp0, wg0).
  3. Level 3 (Kernel Subsystem / Built-in): For environments with kernel integration (KPM or patched kernels), the module filters network interface listings directly in kernel space, making virtual tunnels invisible to low-level syscalls.

Installation & Setup

  1. Verify that your root manager (Magisk, KernelSU, or APatch) has an active Zygisk implementation.
  2. Install LSPosed or Vector for Java-level interception.
  3. Download the latest vpnhide-*.zip release from the project’s repository.
  4. Flash the module in your root manager and reboot.
  5. In LSPosed, enable the VPN Hide module and select your target applications.

Configuration & Practical Usage

  • Target App Selection: Open the VPN Hide configuration interface in LSPosed and check the applications that should perceive a direct Wi-Fi or cellular connection rather than a VPN.
  • Kernel Integration: If your kernel supports Kernel Patch Module (KPM), flash the companion vpnhide_kmod component to enable hardware-level interface masking.

Troubleshooting & Common Issues

  • App Detects Memory Hooks: If a target app crashes due to anti-tamper checks, switch the module to its system-server-only interception mode to avoid injecting code directly into the protected app process.

Frequently Asked Questions

Why do traditional Xposed VPN hiders fail on banking apps?

Legacy modules like NoVPNDetect only hook high-level Java APIs (such as ConnectivityManager) inside the target process. Modern banking apps use anti-tamper SDKs that detect Xposed memory injection, and they use native C/C++ code to check /proc/net/dev and ioctl calls directly, bypassing Java hooks entirely.

How does vpnhide solve native VPN detection?

vpnhide employs a multi-tiered architecture combining system_server hooks, Zygisk library filtering, and optional kernel drivers that filter out tun/tap network interfaces at the OS syscall level.