SlickBox

Русская версия

SlickBox is a full-device VPN client for Android 11+. The application uses Android VpnService, Jetpack Compose, Xray, sing-box, and sing-tun.

Features

• Xray and sing-box cores with automatic or manual selection.
• gVisor, system, and mixed packet stacks.
• Full-device IPv4 and optional IPv6 routing.
• Per-app bypass and proxy-only modes.
• DNS, MTU, sniffing, routing rules, and ad blocking settings.
• Subscription import and scheduled background refresh.
• Compact and wide-screen Compose layouts.
• Xray live logs and server latency checks.

Supported Formats

Share links: vless://, vmess://, trojan://, ss://, hysteria2://, hy2://, tuic://, ssh://, and naive+https://.

Configuration documents: sing-box JSON, WireGuard INI, inline OpenVPN, and plain or whole-body Base64 subscriptions.

Xray handles VLESS, VMess, Trojan, and Shadowsocks. sing-box additionally handles Hysteria2, TUIC, WireGuard, SSH, OpenVPN, OpenConnect, NaiveProxy, and ShadowTLS. XHTTP and KCP currently require Xray.

Core Architecture

Jetpack Compose
  -> SlickBoxVpnService
  -> Android TUN
  -> mobile-core (gomobile AAR)
       |-> Xray fork -> sing-tun
       `-> sing-box --> sing-tun
  -> VpnService.protect(outbound socket)
  -> physical network

SlickBoxVpnService creates the TUN and owns its original ParcelFileDescriptor. The selected native core duplicates the descriptor and passes only the duplicate to sing-tun. During shutdown, the native engine is stopped before Android closes the original descriptor.

Only one native core can run in the process. Every outbound socket is passed through VpnService.protect so core traffic bypasses the TUN instead of looping back into it.

The Xray fork adds an Android native TUN factory and routes decoded sing-tun TCP/UDP flows into Xray. The direct sing-box path uses a minimal Android platform bridge. Both paths support gVisor, system, and mixed stacks; with_gvisor is therefore a required native build tag.

Requirements

Component	Requirement
Android	11+ (minSdk 30)
ABI	arm64-v8a
Android SDK	Platform 36 and a gomobile-compatible NDK
Java	JDK 21; app bytecode targets JVM 17
Go	1.26+ and gomobile

The source tree requires xray-core, sing-tun, and sing-box at the root. For the public repository these directories must be pinned submodules. The Xray submodule must point to the SlickBox fork containing the Android TUN patch.

Install gomobile if needed:

go install golang.org/x/mobile/cmd/gomobile@latest

Build

The scripts test the Go bridge, build the native AAR, run Android JVM tests, and assemble the debug APK. They contain no machine-specific paths.

Windows:

build.bat

Linux/macOS:

chmod +x build.sh gradlew
./build.sh

Install and launch on an authorized ARM64 device:

build.bat -run

./build.sh -run

APK output: app/build/outputs/apk/debug/app-debug.apk.

Direct Gradle assembly requires a previously generated app/libs/mobile-core.aar; use the root build script for a complete build.

Data And Limitations

• The application UI is currently Russian.
• Server data is stored in app-private SharedPreferences; most credentials are not encrypted at rest. Android backup is disabled.
• Subscription and remote icon requests originate outside SlickBox's own VPN because the app process is excluded to prevent routing loops.
• Xray logs can contain connection metadata; review them before sharing.
• Only ARM64 Android devices are supported.
• Device-level VPN behavior is not covered by desktop/JVM tests.
• Release signing is not configured in the repository.

See PRIVACY.md, SECURITY.md, and CONTRIBUTING.md.

License

SlickBox is licensed under GNU GPL v3.0 or later. See LICENSE. Xray is MPL-2.0; sing-box and sing-tun are GPL-3.0-or-later. Exact dependency revisions and notices are listed in THIRD_PARTY_NOTICES.md.