RKNHardering
RKNHardering is an Android application that detects VPN and proxy usage on a device, implementing the Russian Federal Service for Supervision of Communications (RKN) methodology for identifying circumvention tools.
The app runs nine independent detection modules in parallel and produces a combined verdict:
- GeoIP — checks the public IP against GeoIP databases and hosting/proxy signal providers
- IP Comparison — compares responses from RU and non-RU public IP checkers
- Direct Signs — inspects NetworkCapabilities, system proxy settings, and installed VPN apps
- Indirect Signs — analyzes network interfaces, routing table, DNS, dumpsys VPN output, and localhost proxy listeners
- Location Signals — reads MCC/SIM/cell/Wi-Fi data and queries BeaconDB for geolocation
- Bypass Check — scans localhost for open SOCKS5/HTTP proxies, Xray gRPC API endpoints, and detects underlying network leaks
- CDN Pulling — sends HTTPS requests to trace endpoints to determine the apparent public IP
- Call Transport — checks STUN and MTProto availability to detect traffic tunneling
- Native Signs — performs JNI-level checks of interfaces, routes, /proc/self/maps hook markers, and root indicators
The final verdict (NOT DETECTED / NEEDS REVIEW / DETECTED) is calculated by VerdictEngine using a weighted combination of the module results.
Minimum Android version: 8.0 (API 26).
Source code: https://github.com/xtclovver/RKNHardering
The app runs nine independent detection modules in parallel and produces a combined verdict:
- GeoIP — checks the public IP against GeoIP databases and hosting/proxy signal providers
- IP Comparison — compares responses from RU and non-RU public IP checkers
- Direct Signs — inspects NetworkCapabilities, system proxy settings, and installed VPN apps
- Indirect Signs — analyzes network interfaces, routing table, DNS, dumpsys VPN output, and localhost proxy listeners
- Location Signals — reads MCC/SIM/cell/Wi-Fi data and queries BeaconDB for geolocation
- Bypass Check — scans localhost for open SOCKS5/HTTP proxies, Xray gRPC API endpoints, and detects underlying network leaks
- CDN Pulling — sends HTTPS requests to trace endpoints to determine the apparent public IP
- Call Transport — checks STUN and MTProto availability to detect traffic tunneling
- Native Signs — performs JNI-level checks of interfaces, routes, /proc/self/maps hook markers, and root indicators
The final verdict (NOT DETECTED / NEEDS REVIEW / DETECTED) is calculated by VerdictEngine using a weighted combination of the module results.
Minimum Android version: 8.0 (API 26).
Source code: https://github.com/xtclovver/RKNHardering
