English | 简体中文
An Android sing-box GUI client. VPN Service mode uses AndroidLibBoxLite; ROOT modes execute the reF1nd sing-box build for Android.
- VPN Service, TPROXY(ROOT), TUN(ROOT), eBPF(ROOT), TUN2SOCKS(ROOT), and BPF2SOCKS(ROOT) run modes
- Strict sing-box JSON configurations from QR code, local file, or URL subscription
- Official sing-box command API for status, traffic, connections, modes, proxy selection, and delay tests
- ROOT start-on-boot script generation through Magisk
service.d - Material 3 Compose UI
- Works without root permission.
- Runs sing-box in the app process through AndroidLibBoxLite JNI and its local command server.
- Uses Android
VpnService; the optional Hev TUN path continues to usehev-socks5-tunnel.
- Runs the bundled sing-box Android binary with a TPROXY inbound.
- Uses iptables and policy routing for transparent proxy traffic.
- Runs the bundled sing-box Android binary with the fixed TUN device
asterisk0. - Keeps sing-box
auto_routedisabled and applies app-managed iptables and policy routing rules. - Supports the System, gVisor, and Mixed TUN stacks.
- Uses the reF1nd sing-box eBPF inbound to attach cgroup socket-address programs directly.
- Does not use a TUN device, TProxy, iptables, policy routing, a Bridge helper, or a local SOCKS5 intermediary.
- The direct-bypass switch copies rule sets routed to the direct outbound into
bypass_rule_set. - Optional shared-network TC uses exact downstream interface names. Wildcards and interface prefixes are not supported.
- Availability depends on device kernel, cgroup v2, and eBPF support.
- Uses
hev-socks5-tunnelto createasterisk0. - Sends tunnel traffic to a local sing-box SOCKS5 inbound.
- Uses eBPF and the native
bpf2sockshelper to send TCP and UDP traffic to a local sing-box SOCKS5 inbound. - Requires the eBPF capability probe to pass before startup.
ROOT modes use the native asteriskd monitor to maintain local-address bypass rules and optional IPv6 state. Runtime binaries, configuration, PID files, helpers, and logs remain in the app-private files/sing-box directory. Only the boot entry script is installed outside it at /data/adb/service.d/asteriskbox_start.sh.
- The bundled ROOT core is the reF1nd sing-box Android binary selected by
ProjectConfig.SING_BOX_VERSIONand may be manually replaced from the resource page. - Direct CIDR IPv4/IPv6 files and custom resource files can be replaced or updated from configured URLs.
- Rule sets remain part of the sing-box JSON configuration.
Initialize submodules before building:
git submodule update --init --recursiveBuild with Android Studio or the Gradle wrapper:
.\gradlew.bat assembleDebugThe build resolves the AndroidLibBoxLite version configured by ProjectConfig.ANDROID_LIB_BOX_LITE_VERSION, downloads the reF1nd ROOT core version configured by ProjectConfig.SING_BOX_VERSION for all supported ABIs, builds the native helper submodules, and produces ABI split APKs plus a universal APK.
If Gradle cannot find Android NDK, set ndk.dir in local.properties, set ANDROID_NDK_HOME, or install an NDK under the Android SDK.
appops set org.asterisk.zcc.abox ACTIVATE_VPN allow