Hiding a VPN while adding an obvious Xposed or Zygisk layer to the process is a poor trade. RKNHardering separately checks for root access, mounts, SELinux state, system properties, su, hook markers, RWX memory, linker and library integrity, Java/native discrepancies, and emulation. The purpose of this section is to minimize the exposed surface, not to promise undetectable root access.
The most reliable arrangement for these checks is a physical device running a stock, enforcing build, with the boot state relocked after a supported installation where possible, and without su, /data/adb modules, Xposed, or a repackaged APK.
Changing Build.MODEL does not turn an emulator into a physical device. RKNHardering checks QEMU properties, pipes and drivers, Goldfish artifacts, BlueStacks indicators, and the overall build profile. Use a real phone for the control baseline. An emulator remains useful for functional testing, but expect NATIVE_EMULATOR or a review state.
Do not use rootless Xposed or NPatch on RKNHardering. Repackaging changes the APK signature and structure, while runtime injection creates process-local hooks. That directly intersects with LIBRARY_INTEGRITY, HOOK_MARKERS, RWX_MEMORY_REGIONS, beta.linker_integrity, and beta.direct_syscall_consistency.
System Framework in scope./system writable.resetprop substitutions. Inconsistent properties are more conspicuous than the original value.maps, and native/library signals.ROOT_SU_BINARY looks for an executable su at common paths. ROOT_MANAGEMENT covers /data/adb/magisk, /data/adb/modules, KernelSU or APatch directories, and similar traces. ROOT_PROPERTY and ROOT_MAGISK_PROPERTY cover unsafe or characteristic properties. ROOT_SYSTEM_RW, ROOT_SUSPICIOUS_MOUNT, and ROOT_OVERLAY_MOUNT cover writable system partitions and unusual bind or overlay mounts. ROOT_SELINUX covers permissive state or the absence of enforcing mode. ROOT_UID covers UID or GID 0.
A deny list or namespace unmount helps only with paths that are genuinely hidden from the target’s mount namespace. It does not change global kernel properties, repair SELinux state, or remove process-local Zygisk code.
Download it only from the official repository. The built-in DenyList and Zygisk behavior have changed across releases, so consult the release notes. The rule for RKNHardering is simple: the target must not receive root access and must not see module mounts. When VPNHide operates through the kernel and system_server, the target process can remain free of Zygisk injection.
App Profile can restrict root per application and unmount module changes. Official references: the repository and documentation. Confirm that the profile applies to the correct UID, especially in a work or private profile.
Use a strong SuperKey and never expose it in logs or screenshots. APatch documentation requires a backup of the original boot.img. VPNHide’s KPM backend may depend on a correctly functioning KernelPatch runtime; that does not mean root artifacts are concealed automatically.
Zygisk Next provides the Zygisk API and linker, memory, and unmount modes. NoHello advertises root and Zygisk concealment plus mount rules. SUSFS core and its userspace module are intended for kernel-level concealment of mounts and paths, but require a kernel already built with a compatible SUSFS patch. Installing one ZIP over an ordinary kernel does not add the missing kernel patch.
These are additional external projects, not required parts of VPNHide. They may help with individual ROOT_* or mount signals, but they also add their own code, configuration, and compatibility risk. Add only one new component per iteration. Do not install unknown builds from Telegram or file-sharing sites; verify the repository, release signature or checksum, and never disclose a SuperKey or other secrets to third parties.
SUSFS is particularly sensitive to kernel version and integration. The kernel patch, userspace module, and root manager must be mutually compatible. A mismatched combination may fail to load, break mounts, or cause a boot loop. On a primary device without a recovery path, it is not a sensible first step.
Hide My Applist and current forks can filter package-list channels, but they usually require Xposed or Zygisk processing inside the selected application. That is a poor default for RKNHardering: concealing INSTALLED_APP can introduce HOOK_MARKERS, LSPOSED, linker or RWX findings, or a direct-syscall mismatch. VPNHide’s Apps role, operating through system_server, is preferable because it does not require putting HMA in the target’s scope. Keep HMA as a separate comparative experiment rather than stacking it on top of an already functioning PackageManager filter.
Keep getenforce at Enforcing. Permissive weakens the device and is a direct signal. Do not alter ro.secure, ro.debuggable, ro.build.tags, service.adb.root, or similar properties at random. Any substitution must remain internally consistent with the build fingerprint and firmware mode; otherwise it creates a new integrity conflict.
HOOK_MARKERS, RWX_MEMORY_REGIONS, LIBRARY_INTEGRITY, LSPOSED, HOOK_PROPERTY, and the β linker and direct-syscall checks look for the effects of intervention, not merely a module name. Renaming the LSPosed APK or package is therefore insufficient.
Preferred order from least visible to the target:
system_server hook — the target is not injected.adb shell id
adb shell getenforce
adb shell getprop ro.debuggable
adb shell getprop ro.secure
adb shell getprop ro.build.tags
adb shell mount | head -n 80
adb shell cat /proc/self/mountinfo | head -n 80
adb shell cmd package list packages -U | grep com.notcvnt.rknhardering
Shell output is not sufficient to inspect the application’s own namespace: the shell and target can see different mounts. Use RKNHardering results and the root manager’s diagnostics. Do not publish complete mountinfo, getprop, or module lists without redaction; they can contain paths, serial-related data, and names of private modules.
Root-only reads:
adb shell su -c 'ls -la /data/adb'
adb shell su -c 'ls -la /data/adb/modules'
adb shell su -c 'cat /sys/fs/selinux/enforce'
permission denied is expected without su; with su, it means insufficient privileges, policy restrictions, or a different namespace. Do not “fix” it by granting the application broad permissions.
After installing a concealment component, compare four groups: local VPN signals, root signals, hook and integrity signals, and network stability. When the VPN indicators disappear but LIBRARY_INTEGRITY and RWX appear, switch to a kernel backend or remove the target from the injection scope.
To roll back, disable the last module, reboot, force-stop RKNHardering, and repeat the baseline check. If the phone no longer boots, use the root manager’s official module safe mode or rescue procedure, or restore the saved stock boot image. Do not delete arbitrary /data/adb directories from recovery without knowing which manager owns them.