Box4Magisk / KernelSU / APatch

English | 中文

This project is a Magisk / KernelSU / APatch module designed to deploy various proxy cores on Android devices, including clash, mihomo, sing-box, v2ray, xray, and hysteria.

Supported transparent proxy modes:

• REDIRECT: TCP only
• TPROXY: TCP + UDP (default priority)
• TUN: TCP + UDP (provided by the core; only supported by sing-box, clash, mihomo, and xray)
• Hybrid mode: REDIRECT (TCP) + TUN (UDP)

This project essentially combines a proxy core launcher with AndroidTProxyShell to implement transparent proxying.

Disclaimer

This project is not responsible for device bricking, data corruption, or any other hardware/software issues.

Important Warning: Please ensure your configuration file does not cause traffic looping, otherwise it may lead to infinite device reboots!

If you are not familiar with proxy configuration, it is recommended to first use user-friendly apps (such as ClashForAndroid, sing-box for Android, v2rayNG, SagerNet, etc.) to learn the basic concepts.

Installation

• Download the latest module ZIP package from Releases.
• Install it in Magisk Manager, KernelSU Manager, or APatch Manager.
• Online update is supported (changes take effect immediately without rebooting after update).

Note: The module does not include any proxy core binary files.

After installation, please manually download the core executable files for your device architecture and place them in the /data/adb/box/bin/ directory.

Configuration

Selecting the Proxy Core

Core working directory: /data/adb/box/<core_name> The core is determined by the bin_name variable in /data/adb/box/scripts/box.config. Available options:

• sing-box (recommended, default)
• clash
• mihomo
• xray
• v2ray
• hysteria

Tip: mihomo and sing-box come with default configuration files that are pre-configured to work with transparent proxy. It is recommended to directly edit the proxy-providers or outbounds sections to add your nodes. For advanced configuration, please refer to the official documentation:

• Clash
• Mihomo
• sing-box
• V2Ray
• Xray
• Hysteria

The module will automatically check the validity of the configuration file, with results saved in /data/adb/box/run/check.log.

Main Configuration Options

The following are the key options in /data/adb/box/scripts/tproxy.conf. Pay special attention to correctly configuring the *INTERFACE variables (e.g., MOBILEINTERFACE="rmnetdata+", WIFIINTERFACE="wlan0", HOTSPOTINTERFACE="wlan2", USBINTERFACE="rndis+") to match your device's actual interface names (check with ifconfig or ip link).

| Configuration Item | Default Value | Description | |---------------------------------|---------------------|-------------| | COREUSERGROUP | root:netadmin | User and group under which the proxy core runs. Advanced users can customize this (requires setcap support). Must be consistent with the boxuser_group variable in box.config | | PROXYTCPPORT / PROXYUDPPORT | 1536 | Transparent proxy listening port | | PROXY_MODE | 0 | Proxy mode: 0=auto (TPROXY preferred), 1=TPROXY, 2=REDIRECT, any other value (only start the core to support native TUN) | | DNSHIJACKENABLE | 1 | DNS hijacking (0=disable, 1=enable TPROXY, 2=enable REDIRECT; no need to change unless necessary) | | DNS_PORT | 1053 | DNS listening port | | MOBILEINTERFACE | rmnetdata+ | Mobile data interface name | | WIFI_INTERFACE | wlan0 | WiFi interface name | | HOTSPOT_INTERFACE | wlan2 | Hotspot interface name | | USB_INTERFACE | rndis+ | USB tethering interface name | | PROXY_MOBILE | 1 | Whether to proxy mobile data traffic (1=proxy, 0=do not proxy; supports any combination with other interfaces) | | PROXY_WIFI | 1 | Whether to proxy WiFi traffic (1=proxy, 0=do not proxy; supports any combination with other interfaces) | | PROXY_HOTSPOT | 0 | Whether to proxy hotspot traffic (1=proxy, 0=do not proxy; supports any combination with other interfaces; MAC filtering takes effect when enabled) | | PROXY_USB | 0 | Whether to proxy USB tethering traffic (1=proxy, 0=do not proxy; supports any combination with other interfaces) | | PROXYTCP / PROXYUDP | 1 / 1 | Whether to proxy TCP/UDP traffic (1=proxy, 0=do not proxy) | | PROXYIPV6 | 0 | Whether to proxy IPv6 (1=proxy, 0=disable; in REDIRECT mode, the module will automatically check kernel support for IP6NFNAT and IP6NFTARGETREDIRECT. If not supported, IPv6 proxy will be disabled) | | APPPROXYENABLE | 0 | Enable per-app proxy (1=enable) | | APPPROXYMODE | blacklist | blacklist (bypass specified apps) or whitelist (proxy only specified apps) | | BYPASSAPPSLIST / PROXYAPPSLIST | empty | App list, format: "userID:packageName" (multiple entries separated by spaces, e.g. "0:com.android.systemui 10:com.tencent.mm") | | BYPASSCNIP | 0 | Whether to bypass mainland China IPs (1=enable, 0=disable; requires kernel support for ipset. The module will check automatically; if not supported, the feature will be disabled. When enabled, IP lists will be downloaded from the specified URL) | | MACFILTERENABLE | 0 | Enable MAC address filtering (1=enable, 0=disable; only effective when PROXY_HOTSPOT=1) | | MACPROXYMODE | blacklist | blacklist (bypass specified MACs) or whitelist (proxy only specified MACs) | | BYPASSMACSLIST / PROXYMACSLIST | empty | MAC address list (multiple entries separated by spaces, e.g. "AA:BB:CC:DD:EE:FF 11:22:33:44:55:66") |

For other configuration options, please refer to AndroidTProxyShell.

Usage

Normal Usage (Recommended)

• The service is enabled by default on boot.
• Enable/disable the module via Magisk / KernelSU / APatch Manager to start/stop the service in real time (no device reboot required).

Per-App Proxy (Routing)

After enabling APPPROXYENABLE=1:

• Blacklist mode (default): Proxy all apps except those in the specified list (use BYPASSAPPSLIST).
• Whitelist mode: Proxy only the specified apps (use PROXYAPPSLIST and set APPPROXYMODE=whitelist).

Using Only the Core's Native TUN (No Transparent Proxy)

Set PROXY_MODE=core or any value other than 0-2. Transparent proxy rules will not be loaded; only the core will be started (suitable for sing-box/clash/mihomo TUN inbound).

Manual Mode

After creating an empty file /data/adb/box/manual:

• The service will no longer start on boot and cannot be controlled via the Manager.
• Manual commands:

- Service: /data/adb/box/scripts/box.service start|stop|restart|status - Transparent proxy: /data/adb/box/scripts/box.tproxy start|stop|restart

Additional Notes

• After modifying the core configuration file, please ensure the ports and other settings are consistent with those in box.config and tproxy.conf.
• The module automatically prevents looping (bypasses local IP and utilizes the NETFILTERXTMATCHADDRTYPE feature). However, if your device has a public IP, it is still recommended to manually add bypass rules.
• Logs are located in the /data/adb/box/run/ directory.

Uninstallation

• Uninstalling the module from Magisk Manager, KernelSU Manager, or APatch will remove the /data/adb/service.d/box4_service.sh file but retain the Box data directory /data/adb/box.
• To clear Box data, use the command: rm -rf /data/adb/box

Changelog

CHANGELOG

Project Star Growth Trend Chart