diff --git a/README.md b/README.md index e10d960..7a0bd3c 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,42 @@ Android-приложение для обнаружения VPN и прокси Минимальная версия Android: 8.0 (API 26). +## Нужна помощь сообщества / Community Help Wanted + +> **RU** + +Этот проект документирует методы обнаружения VPN и прокси на Android-устройствах. Однако **обратная задача**, как предотвратить детектирование наличия VPN, исследована значительно хуже. + +Я ищу людей, готовых помочь собрать, систематизировать и протестировать информацию о способах обхода детектов, включая, но не ограничиваясь: + +- **Маскировка сетевых интерфейсов** (как скрыть `tun0`, `wg0` и другие VPN-подобные интерфейсы от `NetworkInterface.getNetworkInterfaces()` и `/proc/net/route`) +- **Подмена NetworkCapabilities** (способы убрать `TRANSPORT_VPN`, `IS_VPN`, `VpnTransportInfo` из ответов `ConnectivityManager`) +- **Скрытие от dumpsys** (предотвращение утечки информации через `dumpsys vpn_management` и `dumpsys activity services android.net.VpnService`) +- **MTU-нормализация** (выставление стандартного MTU (1500) для туннельных интерфейсов на различных клиентах) +- **DNS-утечки** (предотвращение обнаружения loopback/private DNS при активном VPN) +- **Скрытие localhost-прокси** (как предотвратить обнаружение через `/proc/net/tcp` и сканирование портов) +- **Обход нативных проверок** (противодействие JNI-проверкам через `/proc/self/maps`, `getifaddrs()`, `dlsym`) +- **Маскировка установленных приложений** (скрытие пакетов VPN-приложений от `PackageManager`) + +Если вы обладаете знаниями в этих областях, пожалуйста, откройте Issue или Pull Request с описанием метода, условий применимости и ограничений. Любая информация ценна — от теоретических идей до работающих PoC. + +> **EN** + +This project documents methods for detecting VPNs and proxies on Android devices. However, **the inverse problem** how to prevent the detection of an active VPN has been studied much less thoroughly. + +I am looking for people willing to help collect, organize, and test information about ways to bypass detection, including, but not limited to: + +- **Network interface masking** (how to hide `tun0`, `wg0`, and other VPN-like interfaces from `NetworkInterface.getNetworkInterfaces()` and `/proc/net/route`) +- **NetworkCapabilities spoofing** (ways to remove `TRANSPORT_VPN`, `IS_VPN`, and `VpnTransportInfo` from `ConnectivityManager` responses) +- **Hiding from dumpsys** (preventing information leakage through `dumpsys vpn_management` and `dumpsys activity services android.net.VpnService`) +- **MTU normalization** (setting a standard MTU of 1500 for tunnel interfaces across different clients) +- **DNS leaks** (preventing detection of loopback/private DNS while a VPN is active) +- **Hiding localhost proxies** (how to prevent detection via `/proc/net/tcp` and port scanning) +- **Bypassing native checks** (countering JNI-based checks through `/proc/self/maps`, `getifaddrs()`, and `dlsym`) +- **Masking installed applications** (hiding VPN app packages from `PackageManager`) + +If you have expertise in these areas, please open an Issue or Pull Request describing the method, the conditions under which it applies, and its limitations. Any information is valuable, from theoretical ideas to working PoCs. + ## Архитектура Шесть независимых модулей проверки запускаются параллельно. Итоговый вердикт рассчитывается в `VerdictEngine`. diff --git a/docs/README.en.md b/docs/README.en.md index a289ed3..f17870c 100644 --- a/docs/README.en.md +++ b/docs/README.en.md @@ -6,6 +6,23 @@ Android app for detecting VPNs and proxies on a device. Implements the Roskomnad Minimum Android version: 8.0 (API 26). +## Community Help Wanted + +This project documents methods for detecting VPNs and proxies on Android devices. However, **the inverse problem** how to prevent the detection of an active VPN has been studied much less thoroughly. + +I am looking for people willing to help collect, organize, and test information about ways to bypass detection, including, but not limited to: + +- **Network interface masking** (how to hide `tun0`, `wg0`, and other VPN-like interfaces from `NetworkInterface.getNetworkInterfaces()` and `/proc/net/route`) +- **NetworkCapabilities spoofing** (ways to remove `TRANSPORT_VPN`, `IS_VPN`, and `VpnTransportInfo` from `ConnectivityManager` responses) +- **Hiding from dumpsys** (preventing information leakage through `dumpsys vpn_management` and `dumpsys activity services android.net.VpnService`) +- **MTU normalization** (setting a standard MTU of 1500 for tunnel interfaces across different clients) +- **DNS leaks** (preventing detection of loopback/private DNS while a VPN is active) +- **Hiding localhost proxies** (how to prevent detection via `/proc/net/tcp` and port scanning) +- **Bypassing native checks** (countering JNI-based checks through `/proc/self/maps`, `getifaddrs()`, and `dlsym`) +- **Masking installed applications** (hiding VPN app packages from `PackageManager`) + +If you have expertise in these areas, please open an Issue or Pull Request describing the method, the conditions under which it applies, and its limitations. Any information is valuable, from theoretical ideas to working PoCs. + ## Architecture Six independent check modules run in parallel. The final verdict is calculated in `VerdictEngine`.