0 Fork 0

Files

T

Apply one fixed baseline to every scoped app; drop all settings

Per-app settings never worked: a hooked app reads Veil's config through
XSharedPreferences, which for a legacy module points at Veil's private
data dir (/data/data/space.bdeshi.veil/shared_prefs). Hooked apps can't
read it, so every app silently fell back to "hide everything" and every
toggle, hidden-package edit and picker entry was ignored. Confirmed on
device with Veil Probe: unticking a feature changed nothing.

The framework's fix for this (xposedsharedprefs, redirecting the module's
prefs dir to one hooked apps can read) needs the framework to hook Veil's
own process. On Vector v2.2 here it never does, even with Veil in its own
scope and after a reboot, so there's no reliable channel from Veil's app
to a hooked app.

So stop pretending there is one:
- VeilHook applies all six features with the fixed Features.HIDDEN_PACKAGES
  (KernelSU, Magisk, Veil) to every app in scope, with no prefs read.
- Remove discovery: the Application#attach hook, the exported provider
  (one less way for an app to spot Veil) and the launcher <queries>.
- The settings screen becomes a read-only summary plus the help panel;
  help tips cover leaving an app out of scope, changing the list by
  rebuilding, and turning verbose logging off afterwards, since it
  names Veil in each hooked app's own logcat.

Verified on device: all 24 testable hooked paths in Veil Probe stay
hidden, Veil's provider no longer resolves, a scoped app still loads Veil.

Co-Authored-By: agent <agent@bdeshi.space>

2026-11-03 19:51:52 +06:00

3.0 KiB

Raw Blame History

Veil

An LSPosed module that hides accessibility, debugging, and root/hook state from the apps in its scope, without changing the actual state of the device.

Important

Built entirely by AI in one evening to fix a personal problem. YMMV — it works for me and hasn't been audited beyond that.

Requirements

Rooted device with a working Zygisk implementation and LSPosed (or an LSPosed-compatible framework such as Vector).
Android 8.1+.

Setup

Build (below) or grab a release APK from the repo's Releases page.
Enable the module in LSPosed Manager and scope it to the target apps.
Force-stop each target app; Veil applies from its next cold start.

If the target app still won't launch, check whether it's on your root manager's DenyList (e.g. KernelSU: app profile → "Umount modules"). An app on that list never gets Zygisk modules injected at all, Veil included. The settings screen's help panel covers this and a few other gotchas.

Features

Every app in scope gets all of these. Veil's settings screen is a read-only summary.

Feature	Hides
Accessibility services	Any accessibility service running
USB / wireless debugging	`adb_enabled` / `adb_wifi_enabled`
Developer options	Developer Options enabled state
Mock location	Legacy pre-Marshmallow flag only
Root / manager apps	Fixed list: KernelSU, Magisk, Veil itself
Build tags/type	Real build swapped for `release-keys` / `user`

Doesn't cover native-level root/hook detection or remote attestation (Play Integrity, SafetyNet) — that's your Zygisk implementation's job, not Veil's.

Why there's no per-app configuration

A hooked app can't read anything Veil's own app saves: Veil's data dir is private to it, and the framework's shared-prefs redirect for legacy modules only works if the framework hooks Veil's own process, which Vector doesn't reliably do. Settings would be silently ignored, so there are none. To change what's hidden, edit VeilHook.kt / Features.HIDDEN_PACKAGES and rebuild. For per-app package lists, use Hide My Applist.

Building

Requires JDK 17 and Android SDK (platform 35, build-tools 35.0.0).

./gradlew assembleDebug       # debug-signed APK
./gradlew assembleRelease     # minified release build, debug-signed unless keystore.properties exists
scripts/generate-keystore.sh  # create a personal release-signing keystore
scripts/release.sh            # build + copy signed release APK into dist/

CI releases

Pushing a tag matching *.*.* (e.g. 1.2.0) triggers .github/workflows/release.yml. For a properly signed CI build, set repo secrets: KEYSTORE_BASE64 (base64 of your release.jks), KEYSTORE_PASSWORD, KEY_ALIAS, KEY_PASSWORD.

3.0 KiB Raw Blame History