ANDROID NATIVE SOCKET-LEVEL INTERCEPTION ZERO-CLOUD LOGGING

Nullog: Socket-Level Interception & Android Privacy

How NULLOG intercepts covert advertising tracking SDKs, analytics beacons, and background telemetry at the Android socket layer without routing traffic to any remote third-party cloud.

Project Status

● Live in Production

Official URL

nullog.fyi ↗

Core Architecture

Android VpnService + NDK Packet Loop

Latency Impact

< 0.2ms Per-Socket Inspection

The Problem

Modern Android applications are bundled with dozens of closed-source third-party SDKs (advertising networks, fingerprinting trackers, user analytics). These SDKs continuously beacon device telemetry, location data, battery status, and browsing behavior in the background.

Traditional cloud-based DNS blockers require redirecting the user's entire unencrypted network stream to a remote server, introducing latency, single points of failure, and transferring trust to a third-party server operator.

System Architecture & Engineering Solution

NULLOG creates a localized, battery-efficient virtual network interface on the device via the Android VpnService API. All outbound IP packets (TCP, UDP, ICMP) are captured locally at the socket boundary without establishing an external VPN tunnel.

[Android App Socket] ──▶ [Virtual TUN Device] ──▶ [Local NDK Parser Loop]
                                                              │
                    ┌─────────────────────────────────────────┴────────────────────────┐
                    ▼                                                                  ▼
        [Tracker Domain / IP Detected]                                      [Legitimate Traffic]
                    │                                                                  │
             (Packet Dropped)                                             (Forwarded Directly to
          (0 Remote Hops / 0 Log)                                            Real Gateway)
              

Native NDK C/Rust Filter: Packet inspection is offloaded to a high-speed compiled native loop that matches destination hosts against high-performance Radix-tree and Bloom-filter rule sets in memory in < 0.2ms.

Key Technical Challenges & Optimizations

1. Battery Consumption & Wakelock Minimization: Running a continuous background daemon on Android can trigger OS battery throttling. Nullog utilizes zero-copy ring buffers and asynchronous epoll event loops to ensure near-zero CPU wakeups when the screen is off.

2. Per-App Routing & Tunnel Bypass: Implementing granular rules allowing specific system services or banking apps to bypass filtering while strictly enforcing rules on untrusted social and gaming apps.

3. Anti-DPI & DoH Resolution: Integrated DNS-over-HTTPS (DoH) engine preventing ISP-level DNS hijacking while blocking covert DNS fallback queries initiated by tracker SDKs.

Production Results & Verified Metrics

• Zero Remote Hops: 100% of socket filtering occurs on local device CPU.
• Zero Cloud Logging: No analytics servers, no databases, no tracking cookies.
• High Throughput: Tested at over 500 Mbps local tunneling bandwidth with zero packet drops.

Visit Nullog.fyi ↗ ← Back to All Projects