ID:
NATIVE_LIBRARYCategory: Service signals Status in RKNHardering 2.10.0: Active check Role in the verdict: Availability
This page describes the actual implementation in RKNHardering 2.10.0. It distinguishes what can be done without root, what requires root, and where a mitigation only reduces one signal without hiding the VPN as a whole.
Before any JNI probes run, NativeSignsBridge loads the native library. If System.loadLibrary fails, both NativeSignsChecker and the deep VPN detector return a line with ID NATIVE_LIBRARY, including the exception text when available. Interface, route, root, and hook probes are not considered completed after this failure.
The trigger is a .so loading failure, incompatible ABI, missing library, linker or namespace error, or JNI exception. A successful load does not produce a separate positive line.
This is neither a clean-device indicator nor a VPN indicator. It means that a substantial part of the native coverage is unavailable, so the overall result must be treated as incomplete.
How the line affects the report: The signal means that the probe could not be performed. unavailable must not be interpreted as proof that no VPN is present.
Possible causes include a damaged APK, a split APK missing the required ABI, an incompatible 32/64-bit process, packer interference, a build error, or an environment restriction. This failure is especially likely after repacking.
This line must be evaluated together with neighboring signals. A clean result from a single API does not simultaneously cover Java Binder, libc, raw netlink/syscalls, procfs/sysfs, local sockets, and server-side indicators.
Reinstall the official APK of the same version; do not extract and re-sign it. Confirm that the device supports the build’s ABI and that installation completed without a split conflict. For development, build the APK with the standard Gradle task and inspect the lib/* entries inside it.
First disable modules that alter the linker namespace, Zygote, or library loading for RKNHardering. Do not attempt to hide a VPN by deliberately breaking JNI: the app explicitly reports that the check is unavailable rather than treating it as clean.
adb shell pm path com.notcvnt.rknhardering
adb shell dumpsys package com.notcvnt.rknhardering | grep -E 'primaryCpuAbi|secondaryCpuAbi'
adb logcat -c
adb shell am force-stop com.notcvnt.rknhardering
# Then open the app and look for UnsatisfiedLinkError/dlopen in logcat:
adb logcat | grep -Ei 'rknhardering|UnsatisfiedLinkError|dlopen|linker'
For a local build, also run unzip -l app-release.apk | grep '/lib/'.
After any change, force-stop both RKNHardering and the VPN client, start them again, and repeat the full scan. Zygisk, Xposed, and kernel modules usually require a reboot. Compare not only this line but also neighboring signals: a partial hook often creates inconsistencies between APIs.
The probe itself runs with ordinary app permissions and does not request root. The ADB commands below are for orientation only: adb shell runs under a different UID and may see either more or less than the app process. The decisive test is to run the check again after a force-stop.
Reinstallation may remove local app data if adb install -r is used with an incompatible signature or if the app is uninstalled first. Save exported reports and settings.
Restore the APK with its original signature and revert only changes that affected loading. If the problem appeared after installing a root module, disable that specific module and reboot.
Availability. Verified against the libraryUnavailableResult() branches in both Kotlin checkers and the JNI method registration. The signal describes check coverage, not network state.
The status of a third-party solution does not automatically carry over to this device. A module developer’s claim is only the initial hypothesis; confirmation requires a reproducible RKNHardering result on the specific Android version, firmware, and kernel.
NativeSignsBridge.kt — JNI loading and native bridge.NativeSignsChecker.kt — main native/legacy verdict logic.VpnNativeDetectorChecker.kt — deep VPN verdict and confidence.native_signs_probe.cpp — native probe implementation.NativeSignalId.kt — complete ID registry.NativeSignalCatalog.kt — category, slug, and line mapping.Related signals: general-diagnostics, syscall-unavailable, library-integrity.