DresOS-The-Android-Defensive-Security-System - Turn any Android device into a secure fortress, TW

项目说明

DresOS Android Defensi System

---

> Project Goal: Turn any Android phone into a fully private, hardened, FOSS only device with no Google tracking, no Google Services, no hidden data har, and only open source replacements then layer on a full defensi stack to protect against sur, malware, censorship, and network le.

> See it running: Watch the full DresOS Android 16 demo on a Motorola Moto g32, every layer active, on Ko-fi or directly at streamable.com/rg3tsm.

> Why: Because of all the restrictions Google is bringing into place over the open source communities, to bring you back your privacy, to stop your data being sold, and to give you full operational security on a device you actually control.

---

EXTREME WARNING

Rooting and flashing can brick your device, void your warranty, trip Knox/SafetyNet, and wipe all data.
Back up e (photos, apps, files) before starting.
This is ad, if you're not comfortable with ADB/fastboot or device specific guides, stop and use a non root method.
Proceed at your own risk.

Make a full TWRP backup after rooting (Boot + System + Data + ) before any debloating.

---

Table of Contents

Part 1: DeGoogling (Full Root Method)

* What You Will Need
* Replacement O
* Step 1: Unlock the Bootloader
* Step 2: Install TWRP (Custom Recovery)
* Step 3: Install Magisk (Root)
* Step 4: Install Core FOSS Apps
* Step 5: Install Magisk Modules
* Step 6: Set Up DresOS microG (Replaces Google Services)
* Step 7: Install DresOS WebView as System WebView
* Step 8: Set Up Shizuku
* Step 9: Fine Tune Debloat & Cleanup
* Step 10: Replace System File Manager, Package Installer & Download Manager
* Step 11: Final Setup & Defaults

Part 2: Operational Security (OPSEC Stack)

* OPSEC O
* OPSEC Step 1: Configure DNS and MAC Randomization
* OPSEC Step 2: Set Up In Pro
* OPSEC Step 3: OONI Probe Network Censorship Detector
* OPSEC Step 4: Install AFWall+ Root Le
* OPSEC Step 5: Set Up The Tuta & DuckDuckGo Suite
* OPSEC Step 6: Set up DresSecureComms
* OPSEC Step 7: Final Checks and Hardening Tips

Part 3: Fossify Suite

* Apps in the Suite

Part 4: Additional Apps and Core Components

* Apps O
* 1. RedReader, Private Reddit Client
* 2. Metrolist, Private YouTube Music Client
* 3. Arcane Chat, Decentralized Encrypted Messaging
* 4. HeliBoard, Offline Keyboard
* 5. A, Gallery and Photo Manager
* 6. Stratum, 2FA Authenticator

#### Confirmed working devices:

DresOS is built for uni compatibility: the degoogling and OPSEC steps work on any rooted Android 10 or newer device, and the Magisk modules are written to run on any ABI and any OEM partition layout. The combinations below are the ones confirmed working end to end so far

| Device | Android |
| --- | --- |
| Motorola Moto G32 | LineageOS Android 15 and 16 |
| Motorola ThinkPhone | Stock Android 15 |
| Motorola Moto G7 Plus | Stock Android 10 |
| Motorola Moto G7 Plus | LineageOS Android 15 |
| Samsung Galaxy A05s | Stock Android 10 |
| Samsung Galaxy A02s | Stock Android 12 |

If you run DresOS on a device that is not listed, a confirmation report is welcome so the list can grow.

* License

---

Part 1: DeGoogling (Full Root Method)

What You Will Need

Download only from these official links (2026). Install F-Droid first, it is the backbone of your FOSS ecosystem.

| Tool | Purpose | Link |
| --- | --- | --- |
| F-Droid | Main FOSS app store | Download APK / Site |
| Inure App Manager | Debloat + app management | GitHub Releases |
| Shizuku | Root like ad system permissions | GitHub Releases |
| TWRP | Custom recovery (full backups + flashing) | twrp.me search your exact device model |
| Magisk | Root + module framework | GitHub Releases |
| DresOS microG Module | Magisk module v3.1.2, uni systemless microG suite. Pure file o: no Zygisk payload, no Xposed, no boot scripts, so it cannot bootloop the device. Signature spoofing is provided by the ROM because the microG APKs carry the official microG key. | DresOS Magisk Modules releases |
| DresOS WebView Module | Magisk module v2.2.0, systemless replacement of Android System WebView with DresOS WebView RRO plus bind mount, activated by cmd web after boot, with bootloop sentinel and inert mode fallback | DresOS Magisk Modules releases |
| AFWall+ | Root le firewall, per app kernel le, mobile data proxy redirect, no VPN slot | F-Droid / GitHub |
| SD Maid SE | Deep system cleaner + remnant finder | F-Droid |
| DresSecureComms | DresOS secure communications: SMS, dialer, contacts, link scanning, metadata wipe, geo spoofer (replaces Fossify Phone, Messages, Contacts, URL Checker, Fake Traveler and a separate antivirus app) | GitHub releases |
| Fossify Apps | Launcher, Clock and Notes | fossify.org/apps () |
| A | Gallery, photo and video manager (replaces Fossify Gallery and Google Photos) | F-Droid |
| Amaze File Manager | File manager with built in AES encryption and root explorer | F-Droid |
| DresOS WebView | System WebView, bundled inside the DresOS module ZIP | APK source: |
| In Pro | Tor + I2P + DNSCrypt in proxy + root mode, IP anonymisation, encrypted DNS, no VPN slot used | F-Droid |
| DuckDuckGo Privacy Browser | Primary browser (Chrome replacement) | F-Droid |
| Aurora Store | Anonymous Play Store alternative | F-Droid |
| HeliBoard | Fully offline keyboard (no Gboard) | F-Droid |
| Tuta Mail | End to end encrypted email (no Gmail) | F-Droid |
| Tuta Calendar | End to end encrypted calendar, syncs with your Tuta account (no Google Calendar) | F-Droid |
| Stratum | Offline two factor authenticator (TOTP/HOTP), encrypted backups, no internet, no cloud | stratumauth.com/download / GitHub |
| Gopeed | FOSS download manager, HTTP/HTTPS/BitTorrent/magnet, hash , no Google components | F-Droid / gopeed.com |
| SAI | Split APK Installer, FOSS package installer | F-Droid |

---

Replacement O

Here is exactly what each core app replaces and why it is better for privacy:

| App | Replaces | Why It's Better |
| --- | --- | --- |
| DresSecureComms | Stock Phone, Dialer, SMS, Contacts | DresOS secure comms app: private SMS with optional encryption, full dialer, caller ID and spam screening, encrypted contacts vault, no Google services and comes with link scanning, file scanning, mock location |
| Amaze File Manager | Google Files / Stock File Manager / ZArchiver Pro | Open source file manager with built in AES 256 encryption, biometric lock, root explorer, and APK management |
| DuckDuckGo Privacy Browser | Chrome | Private search engine, tracker blocking, zero Google telemetry |
| DresOS WebView | Android System WebView (Google) | Blocks ads & trackers in every app that loads web content |
| Tuta Mail | Gmail | End to end encrypted email (no Google account or content scanning) |
| Tuta Calendar | Google Calendar | End to end encrypted calendar, syncs across your devices through your Tuta account, zero knowledge |
| HeliBoard | Gboard | Completely offline keyboard, no data sent anywhere, ever |
| Aurora Store | Google Play Store | Anonymous downloads, no Google account required |
| DresOS microG | Google Play Services | Full app compatibility without any Google tracking infrastructure |
| Fossify Launcher / Clock / Notes | Stock Google equi | open source system app replacements |
| A | Google Photos / Stock Gallery | Open source photo and video gallery, metadata , map and tag organisation, no cloud, no trackers |
| Stratum | Google Authenticator / Authy | Offline open source 2FA, encrypted exportable backups, no cloud lock in, single permission |
| Gopeed | Google Download Manager | Modern FOSS download manager, HTTP/BitTorrent/magnet, hash , actively maintained |
| DresOS WebView Module | Manual WebView patching process | Single Magisk flash: places DresOS WebView in systemless tree, ships a static RRO that allowlists it in config_web, activates via cmd web after boot, includes bootloop sentinel |
| In Pro | Orbot + separate DNS/I2P apps | Combines Tor, I2P, and DNSCrypt in proxy + root mode, no VPN slot used; IP spoofing system proxy; iptables DNS redirect at kernel level |
| AFWall+ | No equi in stock Android | Root le firewall; per app internet blocking at kernel level; custom rules for mobile data proxy routing; works independently of VPN and proxy layers |

---

Step 1: Unlock the Bootloader

Device specific, required for TWRP + Magisk. Usually wipes all data.

1. Enable De Options: Settings, About phone, tap Build number 7 times.
2. Turn on OEM unlocking + USB debugging.
3. Install ADB & Fastboot on your PC (Android Platform Tools from Android De).
4. Connect phone via USB.
5. Run: adb reboot bootloader
6. Run: fastboot flashing unlock (or fastboot oem unlock on older devices).
7. Confirm on phone screen, this will factory reset the device.

Samsung: Use Download Mode + Odin with official or unofficial unlock.
Huawei / carrier locked phones: Use the official unlock code process for your carrier.
Exact instructions: Search [your exact model] unlock bootloader XDA De and follow that device's specific guide.

Phone will factory reset. Set it up again and re enable USB debugging before continuing.

---

Step 2: Install TWRP (Custom Recovery)

TWRP gives you full device backups and easy module/zip flashing.

1. Go to twrp.me and search your exact device model and .
2. Download the latest .img (and .zip if a).
3. Follow the exact instructions on that device's TWRP page, they are device specific.

Typical commands:

Reboot to recovery to confirm TWRP is permanently installed.

No TWRP for your device? Use Magisk direct patching method only (see Step 3 below) or check XDA for unofficial TWRP builds. Search [model] unofficial TWRP.

TWRP Backup (if not done already): Boot to TWRP, Backup, select Boot + System + Data + , swipe to back up. This is your emergency restore point. Store the backup folder in a safe location off device.

If anything breaks: Boot to TWRP, Restore, select your backup, swipe. Your full system is back in minutes.

---

Step 3: Install Magisk (Root)

Two methods, pick one based on your situation.

#### Recommended: Magisk Patching Method (works on almost e)

1. Download the latest Magisk APK from GitHub.
2. Extract your device's boot.img (or init_boot.img) from the stock firmware ZIP for your exact model and Android .
3. Install the Magisk app on your phone.
4. Open Magisk app, Install, Select and Patch a File, choose boot.img.
5. magisk_patched_xxxx.img will appear in your Downloads folder.
6. Pull it to your PC: adb pull /sdcard/Download/magisk_patched_xxxx.img
7. adb reboot bootloader
8. fastboot flash boot magisk_patched_xxxx.img (or init_boot if your device uses it).
9. On some devices you also need to flash a patched .img with flags: fastboot flash .img --disable- --disable-
10. Reboot. Open Magisk app, it should show "Installed."

#### Alternative: Via TWRP

1. Rename the Magisk APK file from .apk to .zip
2. Boot to TWRP, Install, select and flash the .zip
3. Reboot system

Samsung specific: Use Recovery mode + Odin with a patched AP.tar file.

Reboot, open Magisk app, you are rooted. Keep Magisk app installed, you need it for e that follows.

---

Step 4: Install Core FOSS Apps

1. Transfer the F-Droid APK to your phone and install it (allow installs from unknown sources when prompted).
2. Open F-Droid and from the search/browse install all of these:
* Inure App Manager
* Shizuku
* SD Maid SE
* Fossify Launcher, Clock, and Notes
* A
* Amaze File Manager
* HeliBoard
* DuckDuckGo Privacy Browser
* Aurora Store
* Tuta Mail
* Tuta Calendar
* Stratum
* Gopeed
* SAI (Split APK Installer)
3. Install DresSecureComms from its GitHub releases. Set it as your default SMS and phone app after first launch.
4. Download the DresOS WebView module from DresOS Magisk Modules releases, you will flash it in Step 5.

Do not open or configure these apps yet, follow each step in order.

---

Step 5: Install Magisk Modules

Open Magisk app, Modules, Install from storage and flash each of these one at a time, rebooting between them if instructed:

1. DresOS microG Module v3.1.2 (dresosmicrog), uni systemless microG suite, single flash. Ships the officially signed microG GmsCore 0.3.15, Companion (FakeStore), GsfProxy, DroidGuard Helper, Aurora Store, and Aurora Services as pri system apps under product, with a privapp permissions allowlist generated from the bundled manifests. It is a pure file o: no Zygisk payload, no Xposed, no runtime PackageManager work, and it ne other modules, so it cannot bootloop the device and coexists cleanly with the DresOS WebView module. Signature spoofing is provided by the ROM: because the microG APKs carry the official microG key, any ROM with microG signature spoofing support spoofs them automatically once placed in priv app.

* Full details in Step 6.
2. DresOS WebView Module v2.2.0 (dresoswv), systemless replacement of Android System WebView with DresOS WebView. Drops the signed DresOS WebView APK into the systemless tree at system/product/app/DresOSWebView/, ships a static RRO that adds org.dresos.webview plus the DresOS signing certificate to the framework config_web allowlist, and activates DresOS WebView via cmd web set-web after boot complete. Updating over the AOSmium build swaps it out in place. Includes a post fs data bootloop sentinel and an inert mode fallback so a failed acti cannot bootloop the device.
* Handles the entire WebView switch in one flash. Full details in Step 7.

Reboot after flashing both modules above.

---

Step 6: Set Up DresOS microG (Replaces Google Services)

The DresOS microG module installs a clean, privacy respecting replacement for Google Play Services as systemless pri apps. Apps that require Play Services (push notifications, maps, logins, app compatibility) will work through microG with zero Google data har.

What it stages:

Signature spoofing is provided by the ROM, not by the module. Because the bundled microG APKs are signed with the official microG key, any ROM that supports microG signature spoofing (LineageOS from 2024 02 26 onward, /e/OS, CalyxOS, iodeOS, Di and similar) activates spoofing automatically once the apps are placed in priv app. There is no Zygisk hook and no Xposed or LSPosed framework in on any ABI.

#### Acti

1. Open Magisk app, Modules. Confirm DresOS microG is listed and enabled.
2. Tap the Action button on the DresOS microG entry. This prints the status dashboard, regrants runtime permissions to GmsCore, Companion, GSF, and DroidGuard, and restarts the microG components. Grant root when prompted.
3. Open the microG Settings app from your app drawer.
4. Go to Self Check. The signature spoofing item should read green because the ROM is spoofing the officially signed microG. Every other item should tick, except SafetyNet and Play Integrity, which are planned for a later release.
5. If signature spoofing reads as failing, reboot once more and re check.

#### Logs and diagnostics

#### On ROMs that already ship microG

LineageOS for microG, CalyxOS, iodeOS, /e/OS already provide nati spoofing and may ship microG built in. The installer detects an already present, upstream signed microG by reading the X.509 certificate SHA 256 via cmd package dump and leaves the ROM's microG in place, staging only the Aurora components on those ROMs so there is no duplicate.

GrapheneOS deliberately blocks nati spoofing and ships its own Sandboxed Google Play. The module detects GrapheneOS and aborts the install.

#### Aurora Store an Anonymous App Store

Aurora Store is an open source, unofficial Google Play Store client that lets you browse, download, and update apps from Google's Play catalogue without a Google account and without any Google Play Services telemetry. It is a full Google Play replacement with complete anonymity.

Source Code: no need for download link as the module covers that

Open Aurora Store once the module is active. Sign in with Anonymous (no Google account). You can now install apps from the Play Store catalogue without a Google account.

Aurora Services: v3.0.0 stages the Aurora pri extension (com.aurora.services) as a system priv app with its own permissions allowlist, so silent prompt free installs through Aurora Store work without the standard Android installer prompt appearing for every app.

#### Key Features

* Anonymous mode, browse and download apps using randomly generated anonymous credentials. Google sees an anonymous device, not your account.
* No Google account login required
* Full Play Store catalogue access, any app a on Google Play can be downloaded
* App update management, check for updates for all Play sourced apps
* Exodus Privacy integration, shows you a detailed tracker and permission report for every app before you install it
* Block automatic app updates for specific apps
* Spoofed device profile, can present as a different Android device to access region locked apps
* No ads, no telemetry, zero Google components in the Aurora app itself

#### Setup and Usage

1. Installed via our Microg module.
2. Open Aurora Store, select Anonymous mode during setup. Do not log in with a Google account.
3. Browse, search, and install apps exactly as you would on the Play Store.
4. Before installing any app, check its tracker report:
* Tap the app, scroll down to Privacy, check the Exodus Privacy report
* Apps with many trackers (ad, analytics, fingerprinting) should be a or replaced with FOSS alternatives
5. Manage updates:
* Aurora Store, Updates tab, review a updates
* Update FOSS apps instead (F-Droid signatures; Aurora Store does not independently )

---

Step 7: Install DresOS WebView as System WebView

#### What is the System WebView?

The Android System WebView is a browser engine baked into Android itself. It is not a browser you open it powers web content rendering inside hundreds of apps: social media feeds, email clients, news apps, microG sign in screens, shopping apps, and more. Every time any of those apps display a webpage internally, the System WebView is doing the rendering. Replacing Google's default with DresOS WebView means all of that content runs through a privacy hardened, Google free engine rather than Google's WebView.

#### Why It's in the DresOS Suite

DresOS WebView (built by DresOperatingSystems from Cromite) is a Chromium engine carrying Cromite's privacy and security hardening, with Google services and telemetry stripped throughout.

Source Code

#### What It Is

DresOS WebView, built by DresOperatingSystems from Cromite, is a Chromium engine carrying Cromite's privacy and security hardening throughout. The Android System WebView is the rendering engine hundreds of apps use internally any time they show web content, from social feeds to sign in screens to in app articles. By default that engine is Google's, which phones home on every render. DresOS WebView replaces it system wide, so every app that draws web content does so through a Google free, privacy hardened engine. It is in: you never open DresOS WebView directly, and your actual browser is DuckDuckGo.

#### Key Features

* Chromium engine built from Cromite with its privacy and security hardening throughout
* Replaces Google's Android System WebView for every app on the device at once
* No Google services, no telemetry, no anti features
* Installed systemlessly through the DresOS WebView Module, so it is bootloop safe and fully re

Your e browser is DuckDuckGo Privacy Browser. DresOS WebView runs silently in the background as the engine all other apps use to render web content.

#### Setup and Usage

DresOS WebView is not installed by hand. The DresOS WebView Module v2.2.0 you flash drops the signed APK into the systemless tree, registers it through a static RRO, and promotes it to the acti provider with cmd web set-web after boot. Full flashing and steps, including the bootloop sentinel and inert mode fallback. Confirm it is active with adb shell dumpsys web | grep "Current WebView package", which should report org.dresos.webview.

---

#### DresOS WebView Module v2.2.0

What the module does in one flash:

1. the host en: Magisk 29.0 or newer, Android 10 through 16, arm64. Aborts cleanly on 32 bit arm and on x86/x86_64 (DresOS WebView is currently built for arm64 only), on unknown ABIs, and on devices that ship WebView as an APEX module.
2. Drops the signed DresOS WebView APK into the systemless tree at system/product/app/DresOSWebView/DresOSWebView.apk. Magisk magic mount makes this to PackageManager as a preinstalled system app, satisfying the framework MATCH_FACTORY_ONLY scan that Web performs.
3. Places a static RRO in the systemless o partition. The RRO adds org.dresos.webview plus the full DresOS signing certificate to the framework config_web resource, which is the canonical allowlist that Web reads at boot. Both com.google.android.webview and com.android.webview are kept in the allowlist as fallbacks so removing DresOS WebView cannot leave the device without a valid provider.
4. After sys.boot_completed, service.sh calls cmd web set-web org.dresos.webview to promote DresOS WebView to the acti, with a settings put global web fallback write for redundancy.
5. Acti is by re reading dumpsys web. If the acti is not DresOS WebView, the module flips itself into inert mode and stays out of the way until the user in.

Bootloop safety:

The module ships with two layers of protection so a failed acti cannot brick the device.

Package details:

#### Flash Instructions

1. Download DresOS WebView .zip from the releases link above
2. Open Magisk, Modules, Install from storage
3. Select the ZIP and wait for installation to complete
4. Tap Reboot

#### After Reboot

No manual step is required. The module activates DresOS WebView automatically after boot complete. To acti, from adb:

Expected output:

If the output shows the OEM provider instead of DresOS WebView, check the acti log to diagnose:

The De Options WebView picker may still show the OEM provider as selected on some OEM ROMs even when DresOS WebView is actually acti dumpsys over the UI.

#### Diagnostic Logs

If something goes wrong check these files via adb or a terminal app:

#### Uninstalling

Disable or remove the module in Magisk, Modules and reboot. The uninstall.sh script clears the framework's sa provider selection and restores either com.google.android.webview (on GMS devices) or com.android.webview (on AOSP/LineageOS builds) as the acti.

---

Step 8: Set Up Shizuku

Shizuku gives apps like Inure App Manager powerful system le, specifically the ability to deeply debloat and manage system apps, without requiring every indi operation to go through a full root prompt. It is safer, more granular, and lighter than running e root, and it works perfectly alongside your existing Magisk root.

#### Why Use Shizuku?

* Lets Inure and other tools debloat safely and deeply at the system level.
* Survi when configured correctly.
* Uses Android's ADB equi permission layer, no need to expose full root for every operation.
* Works with several other FOSS tools that support it.

#### Step by Step Root Setup (Recommended As Device Already Rooted)

1. Open the Shizuku app.
2. Click start root.
3. When Magisk prompts for root permission, grant it to Shizuku permanently.
4. You will briefly see a black screen with white text confirming the service has started.
5. Go to Shizuku settings and enable Auto start on boot.

#### Grant Permissions to Apps

* When you open Inure App Manager for the first time it will automatically request Shizuku access, approve it and grant all requested permissions.
* You can view and manage all apps that have been granted Shizuku access under Shizuku via Authorized apps.

Test: Reboot your phone. Open Shizuku, it should auto start and show "Running" with root status. If it shows "Not running," open Shizuku and tap Start again.

You are now ready for the deepest, safest debloating possible.

---

Step 9: Fine Tune Debloat & Cleanup

Now we remo trace of Google and system bloat safely.

#### 9.1 Inure App Manager (Recommended Bulk Removal)

1. Open Inure App Manager.
2. Grant it full access, choose Root and Shizuku. Approve e it asks for.
3. Go to the Debloat tab.
4. Tap the select all icon.
5. Select the Recommended debloat list.
6. This automatically selects e your device does not need: Google bloat, carrier apps, unused system services, etc.
7. Review the list carefully. Uncheck anything you want to keep. Then tap Debloat then uninstall to remo.
8. Restart the phone.

#### 9.2 (Fine Tuning Pass)

Only do this if you ha the replacement apps

1. Reopen inure
2. Go back to the Debloat tab.
3. Remove all remaining Google system apps, including:
* Gmail
* Google Search
* Chrome
* Google Play Services remnants (anything not replaced by microG)
* Stock Apps (phone, messages, clock, gallery, camera etc)
* Any other carrier or OEM bloat that is safe to remo will explain what the proccess/app is for and if its safe or not to remove and will warn you if remo bootloop)
4. Apply changes and reboot.

> Note: If Inure looks like it is doing nothing after you tap Debloat, leave it running. It is digging through your system to safely remo. This can take several minutes. Remember every device is different so be careful when fine tuning.

#### CRITICAL WARNING

You must ha all replacement apps before removing their Google equi. Specifically:
* Install Tuta Mail before removing Gmail
* Install DresSecureComms and set it as the default phone and SMS app before removing the stock dialer and SMS app
* Install DresOS WebView (via the DresOS module) before removing Chrome and Google WebView
* Install Gopeed before removing Google Download Manager
* Install SAI before removing the Google Package Installer

Removing a system app without a replacement can break core phone functions until you restore a backup.

#### 9.3 Final Cleanup with SD Maid SE

Open SD Maid SE, run Full Scan + CorpseFinder, delete every Google remnant, leftover data folder, and orphaned system file.

---

Step 10: Replace System File Manager, Package Installer & Download Manager

A truly de Googled phone requires replacing not just apps but the system le Google embeds for file management, app installation, and downloading. Here is the full FOSS replacement stack, zero Google components:

#### File Management and Encryption: Amaze File Manager

Download: F-Droid

Amaze File Manager is a fully open source (GPL 3.0) file manager built by Team Amaze. It replaces both a standard file manager and a separate encryption tool in a single app. A on F-Droid with no Google dependencies, actively maintained, and supports Android 5.0 and up.

#### Key Features

#### Setup and Usage

1. Install .
2. Open Amaze File Manager and grant storage permission.
3. Set as default file manager: Settings, Apps, Default apps, Files, Amaze.

Key features relevant to the DresOS build:

File management: Full local file browsing across internal storage, SD card, and USB OTG. Cut, copy, mo, rename, create folders. Multiple tabs open simultaneously. Bookmark frequently used directories. Built in text editor, ZIP/RAR reader, APK reader, and database reader.

AES 256 encryption: Amaze has built in AES encryption for files and folders, no separate archiving app needed. To encrypt a file: Press the options menu on the right hand side of the file, select Encrypt, set a password. The encrypted file gets an .aes extension. To decrypt: tap the .aes file, enter the password. Encrypted files cannot be read without the password even with full physical access to the device.

Biometric lock: Lock the entire app behind fingerprint or face unlock , Security, Fingerprint. This prevents anyone who picks up your phone from accessing your files.

Root explorer: On your rooted device, enable root mode in Settings, Root Explorer. This lets you browse and manage system directories directly, useful for ad DresOS maintenance.

APK management: Long press any APK file to install it directly, or use the built in App Manager to backup, view, or uninstall installed apps.

Set Amaze File Manager as your default file manager in Settings, Apps, Default apps, Files.

#### Package Installer: SAI (Split APK Installer)

SAI (Split APK Installer) is a fully open source replacement for Google's PackageInstaller. It supports:

* Standard APK installation
* Split APK packages (.apks / .xapk files), the format many apps use
* APK signature before installing
* Batch installation from ZIP archives
* Root and Shizuku installation modes for seamless installs without confirmation prompts
* Zero Google components, zero network calls home

Install from F-Droid:

Set SAI as the default app opener for .apk files in Settings, Apps, Default apps, Opening links, or by long pressing an APK in Amaze File Manager and selecting SAI.

#### Download Manager: Gopeed

Gopeed is a modern, actively maintained open source download manager that replaces Google's hidden Download Manager service entirely. It is under acti with regular releases and supports a broader range of protocols than older Android download managers.

Install from F-Droid:
Or download from gopeed.com

Key features:

After installing, go to Settings, Apps, Default apps, Opening links and ensure Gopeed handles download intents. In DuckDuckGo Privacy Browser, set Gopeed as the external download handler if prompted.

> Why This Matters: Google's Download Manager is a background service that silently handles every file download on the phone and can log metadata. Gopeed replaces it entirely with a transparent, open source alternative that is actively maintained.

#### APK Manager: F-Droid + Aurora Store

For sourcing and updating apps:

* F-Droid handles all open source apps from its repository and any added repos (like IzzyOnDroid for DresSecureComms). F-Droid all APK signatures against de keys.
* Aurora Store provides anonymous access to the Google Play Store catalogue without a Google account. Use Anonymous login mode only.

Together, these two replace the Google Play Store ecosystem completely.

---

Step 11: Final Setup & Defaults

Go to Settings, Apps, Default apps and set:

| Function | Default App |
| --- | --- |
| Browser | DuckDuckGo Privacy Browser |
| Gallery | A |
| Keyboard / Input method | HeliBoard |
| Home / Launcher | Fossify Launcher |
| Phone app | DresSecureComms |
| SMS / Messages | DresSecureComms |
| Email | Tuta Mail (also set for mailto: links) |
| File manager | Amaze File Manager |
| Package installer | SAI |
| Download manager | Gopeed |

DuckDuckGo Privacy Browser: Open it and complete initial setup. App Tracking Protection can and should be enabled, In Pro runs in proxy mode and does not occupy the Android VPN slot, so there is no conflict. Enable it in DuckDuckGo, Settings, App Tracking Protection, Enable. Android will prompt you to allow a for DuckDuckGo, confirm it. This gives you both In Pro's proxy level Tor/DNSCrypt routing AND DuckDuckGo's in app tracker blocking running simultaneously.

Optional hardening (ad):
* Stratum, set up your two factor authentication accounts now; it works fully offline and you can block it from the network in AFWall+
* Hide My Applist, prevents apps from detecting other apps installed on your phone
* Play Integrity, microG passing SafetyNet/Play Integrity for banking and similar apps is planned for a later DresOS microG release rather than the current pure o build

---

Part 2: Operational Security (OPSEC Stack)

OPSEC O

This repository provides a guide to enhancing operational security (OPSEC) and cybersecurity on Android devices. It focuses on protecting against phishing, malware, IP tracking, data mining, device fingerprinting, censorship detection, and network sur, using free, open source tools only.

This method creates a layered privacy setup: encrypted DNS at the OS level (Quad9 DNS over TLS), Tor routing + DNSCrypt + I2P at the network level Pro in proxy + root mode (which leaves the VPN slot free), a root le firewall + enforcing per app access control at the kernel level, app layer tracker blocking App Tracking Protection in the VPN slot, and location spoofing at the sensor level . The result is an extremely hardened device with multiple independent, non conflicting privacy layers operating simultaneously.

---

OPSEC Step 1: Configure DNS and MAC Randomization

This is the baseline privacy layer, applied at the OS level, before any apps run.

#### DNS over TLS (Quad9)

1. Go to Settings, Network & Internet, Private DNS.
2. Select Private DNS provider hostname.
3. Enter: dns.quad9.net
4. Save.

What this does: Quad9 DNS blocks malicious domains, protects against malware and phishing at the DNS resolution level, and does not log or collect user data, unlike Google DNS (8.8.8.8) or Cloudflare DNS (1.1.1.1) which both log queries. Quad9 is operated by a Swiss nonprofit. All DNS queries are now encrypted via DNS over TLS and filtered against Quad9's threat intelligence database.

> Note: Once In Pro is running in proxy mode (Step 2), it takes over DNS resolution , which is more private than system level DNS over TLS. The Quad9 setting here serves as a fallback if In Pro fails.

#### MAC Address Randomization

1. Go to Settings, Network & Internet, Internet, tap your Wi Fi network.
2. Tap Network usage, set to Treat as unmetered (reduces certain monitoring behaviors).
3. Go to Privacy (within the same network settings).
4. Enable Use randomized MAC address.
5. Disable Send device name.
6. Go to De options:
7. Enable Non persistent MAC (complements the randomization abo reboots)
8. Enable Tethering hardware acceleration (impro when hotspot is used)

What this does: Every Wi Fi device has a hardware MAC address that uniquely identifies it. By default, this allows any network operator to track your device across time even if you change your IP. Randomized MAC changes your device's hardware identifier on each network, pre this form of persistent tracking. Your device might appear as a completely random hardware identifier, pre physical location tracking via Wi Fi network logs.

---

OPSEC Step 2: Set Up In Pro

In is the network privacy engine of the DresOS stack. It combines Tor, I2P, and DNSCrypt into a single application. In this setup it runs in proxy mode with root, which means:

* It runs as a local proxy server on your device, the Android VPN slot is not used at all
* DuckDuckGo's App Tracking Protection can be fully enabled alongside it with zero conflict
* Magisk root lets In Pro redirect DNS at the iptables le any
* Android's built in system proxy setting routes your traffic through In Pro's Tor HTTP proxy, your apparent IP address to every website and service becomes a Tor exit node IP, not your real IP

---

#### What Each Component Does

DNSCrypt:
DNS converts domain names like example.com into IP addresses. By default this happens in plain text, your ISP, network operator, and any middlebox on the network can see every domain you visit, even when page content is HTTPS encrypted. DNSCrypt encrypts and cryptographically authenticates every DNS query. In proxy + root mode, In Pro uses iptables to redirect all DNS traffic (UDP and TCP port 53) to its local DNSCrypt listener at port 5354, no app can bypass it, no VPN is needed.

Tor (The Onion Router):
Tor routes your traffic through three operated relays. Each relay only knows the immediately previous and next hop, no single relay can identify both your identity and your destination. In Pro exposes Tor as a local HTTP proxy on port 8118. When you set Android's system proxy to 127.0.0.1:8118, all apps that respect the system proxy route their traffic through Tor. From the perspective of every website and service you connect to, your IP address is the Tor exit node's IP, a relay in another country, different from your real IP, rotating every 10 minutes.

I2P (In Internet Project):
A separate anonymising network using garlic routing (bundles multiple encrypted messages per hop). Independent of Tor, runs on its own relay network. Suited for accessing .i2p hidden services (eepsites) and provides a different anonymity model from Tor that resists certain traffic correlation attacks differently. In Pro exposes the I2P HTTP proxy locally on port 4444.

Root Mode / iptables DNS Redirection:
With Magisk root, In Pro writes iptables rules at the kernel level to redirect all outbound DNS queries (port 53 to port 5354) to DNSCrypt, regardless of which app generates them. No VPN slot needed. This runs below the application layer: it cannot be bypassed by any app.

* Proxy mode, exposes Tor as HTTP proxy on 127.0.0.1:8118 and SOCKS5 on 127.0.0.1:9050; Android system proxy routes all compatible app traffic through Tor without touching the VPN slot. Works alongside DuckDuckGo App Tracking Protection (VPN slot is completely free).

---

#### Full Setup: Proxy + Root Mode with Tor + I2P + DNSCrypt

Follow these steps in order. Do not start any service until Phase 6.

##### Phase 1: Install and Open

1. Install In Pro or the direct APK link abo with SAI).
2. Open In Pro.
3. Allow notification permissions when prompted.
4. Do not tap Start on anything yet.

##### Phase 2: Set Connection Mode to Proxy + Enable Root

1. Tap the menu, top right corner, Settings, Common settings.
2. Select Proxy mode (not VPN mode, not Root only mode).
3. Enable In Pro in Magisk
4. Under settings in the top left:
* Confirm SOCKS5 proxy port: 9050 (Tor SOCKS5)
* Confirm HTTP proxy port: 8118 (Tor HTTP CONNECT proxy, this is what you will enter into Android's Wi Fi proxy setting)
5. Go to fast settings Enable All, restores all services and iptables rules automatically after every reboot.
6. Go back to the main screen.

##### Phase 3: Configure DNSCrypt

1. Tap the settings gear icon.
2. In DNS settings, enable all of these:
* suspicious logging, can reveal presence of malware etc
* require no log, server does not share data with third parties
* require dnssec, ser DNS responses cryptographically
3. Block IPv6, reduces attack surface if you do not actively use IPv6 services
4. Click Bootstrap resolvers, allows initial encrypted resolver list fetch; only contacts a plain resolver once for bootstrapping, then stays encrypted
5. Go back.

##### Phase 4: Configure Tor

1. Tap the settings gear icon.
2. Under Tor settings, enable:
* Isolate dest addr, forces each destination domain to use a separate Tor circuit; prevents one service from correlating your traffic to another
* Isolate dest port, additional circuit isolation per port number
3. Note the HTTP Tunnel port is 8118 (used in Phase 7 below).
4. Go Back
5. Do this if you are in a country where Tor is blocked:
* Go to fast settings and click Use bridges
* Tap Request bridges click the bridges you want then it will get them for you automatically (fetches fresh bridges from Tor Project) or enter bridges manually from bridges.torproject.org
6. Go back.

##### Phase 5: Configure I2P

For most users the default settings are correct. If you plan to access I2P eepsites, go into settings and confirm the I2P HTTP proxy is enabled on port 4444.

Note: I2P takes 10 to 20 minutes to fully build its routing table on first run, this is expected behaviour, not an error.

##### Phase 6: Start All Services

On the main screen tick all 3 Boxes then click the big start buttom.

In Pro is now running. The iptables DNS redirect is active (all DNS to DNSCrypt). Your local Tor HTTP proxy is live at 127.0.0.1:8118.

##### Phase 7: Configure Android System Proxy for IP Spoofing via Tor

This is how you route app traffic through In Pro's Tor proxy using Android's built in system proxy, no VPN slot used. Apps that respect the system proxy will ha HTTP/HTTPS traffic exit through a Tor exit node. Your real IP is not to any destination.

Repeat this for every Wi Fi network you connect to:

1. Settings, Network & Internet, Wi Fi
2. Press the settings icon on the network you're connected to
3. Press the pencil in the upper right hand corner
4. Expand Ad options
5. Under Proxy, select Manual
6. Enter:
* Proxy hostname: 127.0.0.1
* Proxy port: 8118
* Bypass proxy for: localhost,127.0.0.1
7. Tap Save

> Mobile data: Android's system proxy setting is Wi Fi only in standard UI. For cellular data, AFWall+ (OPSEC Step 4) with custom iptables rules can enforce routing at the kernel level. For most users, Wi Fi proxy co is sufficient.

##### Phase 9: E Is Working

1. In Pro main screen, all three services: Running (green)
2. Open DuckDuckGo Privacy Browser
3. Visit , should confirm "Congratulations. This browser is configured to use Tor."
4. Visit , run Extended Test, DNS should resol your DNSCrypt server, not your ISP
5. Visit , IP shown should be a Tor exit node IP, not your real IP or ISP IP
6. All three checks passing = DNS encrypted, traffic anonymised through Tor, real IP hidden

##### Ongoing Usage Tips

* In Pro restores services and iptables rules on every boot automatically.
* If Tor is slow: stop I2P temporarily to free bandwidth for Tor circuits. Restart I2P when you need eepsites.
* Check In Pro Logs to see active Tor circuits, DNSCrypt queries, and any errors.
* Update In Pro regularly, outdated Tor binaries can ha .
* Do not log into personal accounts (Google, Facebook, etc.) while routing through Tor, account le defeats network le.

To Check whats being blocked and censored in your proxy network then follow the steps below to add OONI Probe to your device

---

OPSEC Step 3: OONI Probe Network Censorship Detector

Download: F-Droid

OONI Probe (Open Obser of Network Interference) is a network measurement tool de by the Tor Project and independent researchers. It detects censorship, sur infrastructure, and network manipulation on your internet connection, telling you exactly what your ISP or go is blocking or tampering with.

#### Key Features

* Website blocking detection, tests whether specific websites are blocked on your network
* Censorship measurement, detects DNS manipulation, HTTP blocking, TCP/IP blocking, and TLS interference
* Sur infrastructure detection, identifies middleboxes (equipment used for network sur)
* VPN and Tor reachability, tests whether Tor, VPNs, and circum tools are blocked
* Global network data, contributes your test results to OONI's public database, helping document censorship worldwide
* Runs automatic tests at scheduled intervals
* Completely open source (Tor Project affiliated)

#### Setup and Usage

1. Install from F-Droid using the link above (or search "OONI Probe" in F-Droid).
2. Open OONI Probe complete the onboarding by answering the questions (both are true).
3. Go into settings then into test options, toggle off both things that are toggled on and if you want to run tests automatically
4. Run immediate tests:
* Tap Run on the main dashboard
* OONI Probe runs the full test suite: websites, instant messaging, circum tools, middleboxes
5. View results:
* Results appear under the Test tab
* Green checkmarks = no blocking detected
* Red X = blocking or manipulation detected
* Orange warning = anomaly (possible interference)
6. Interpret results:
* If websites you expect to be accessible show as blocked, your ISP/go is censoring them, use In Pro's Tor routing to bypass
* If circum tools (Tor, VPNs) show as blocked, use In Pro's Tor bridge mode with obfs4 bridges (see OPSEC Step 2)

Understanding your threat en is the first step in defending against it. OONI Probe tells you exactly what your network operator is doing to your traffic whether you are in a heavily censored country or simply want to know if your ISP is silently blocking certain content. Along with telling you how free your proxy network is.

---

OPSEC Step 4: Install AFWall+ Root Le

Download: F-Droid, de.ufirewall

AFWall+ (Android Firewall+) is a root le that uses iptables, the same Linux kernel le filtering used in professional firewalls and servers. Unlike app based firewalls that operate through the Android VPN slot, AFWall+ works at the kernel level, meaning it intercepts and controls network traffic before any app can touch it. No VPN slot is used. No app can bypass it. It runs silently in the background and survi root.

This is your system wide network policy layer. In Pro (covered in Part 2) handles routing your traffic through Tor/I2P/DNSCrypt . AFWall+ handles which apps are permitted to reach the network at all, including blocking apps that would try to bypass the proxy entirely.

#### Key Features

* Per app, per interface rules, separately control Wi Fi, mobile data, and VPN for every installed app
* Whitelist mode, default deny; only explicitly approved apps can reach the internet
* Custom iptables rules, write raw iptables rules for ad control (e.g. mobile data proxy redirect to port 8118)
* Logging, logs every blocked connection attempt; reveals apps trying to phone home
* PIN lock, locks the firewall UI so no app or accidental tap can disable rules
* LAN control, optionally block apps from accessing your local network
* Works on any rooted Android device with Magisk; no VPN slot consumed

#### Why AFWall+ Is a Separate Layer From In Pro

In Pro's internal firewall (when running in proxy mode) handles routing decisions which traffic goes through Tor, which goes through I2P. AFWall+ handles access control which apps are allowed to communicate at all, on which network interfaces (Wi Fi, mobile data, VPN), and to which addresses. These are complementary, not redundant:

* In Pro routes and anonymises traffic
* AFWall+ decides at the kernel le apps are e to generate network traffic in the first place

Running both gives you defence in depth: even if In Pro's proxy routing fails or an app bypasses the system proxy, AFWall+'s iptables rules are still enforced at the kernel.

#### Setup

1. Install AFWall+ from F-Droid.
2. Open AFWall+ it will request root . Grant it permanently.
3. The main screen shows every installed app as a row with toggle switches for:
* WiFi (left column), allow/block on Wi Fi networks
* Data (middle column), allow/block on mobile data
* (right column, if shown), allow/block on VPN or roaming
4. Tick all the apps then click the options menu in the right hand corner then press apply.

Block e else like games, offline tools, system apps that have no reason to phone home, and any remaining Google service remnants if you dont use internet with them.

##### Configure Per App Rules

AFWall+ shows all installed apps with toggles for each interface:

* Wi Fi column, whether this app can use Wi Fi
* Data column, whether this app can use mobile/cellular data

Recommended starting rules:

| App | Wi Fi | Mobile Data | Notes |
| --- | --- | --- | --- |
| DuckDuckGo Privacy Browser | ✓ | ✓ | Primary browser, allow all |
| In Pro | ✓ | ✓ | Must ha to reach Tor network |
| Tuta Mail | ✓ | ✓ | Email, allow all |
| Arcane Chat | ✓ | ✓ | Messaging, allow all |
| Aurora Store | ✓ | ✗ | Updates via Wi Fi only to save data |
| OONI Probe | ✓ | ✓ | Needs both for network testing |
| F-Droid | ✓ | ✗ | Update repo via Wi Fi only |
| DresSecureComms | ✓ | ✓ | Calls and SMS use data |
| Metrolist | ✓ | ✗ | Stream via Wi Fi only |
| Games / offline apps | ✗ | ✗ | Block all, no reason for internet access |
| Any Google remnant | ✗ | ✗ | Block completely |

##### Enable Logging

1. menu, Log, Enable log, AFWall+ will log all blocked connection attempts.
2. Check the log periodically, blocked entries reveal apps attempting to phone home, connect to ad networks, or bypass your privacy stack.

##### Set a PIN Lock on AFWall+

1. menu, Preferences, security, enable protection, set a PIN.
2. This prevents any app or accidental tap from disabling your firewall.

#### AD: Force Apps Through In Pro Proxy

On rooted devices, AFWall+ can redirect traffic at the kernel level to ensure apps route through In Pro's local Tor proxy even if they do not respect Android's system proxy setting. Go to:

AFWall+, menu, Custom Scripts, Startup Script

Add the following rule to redirect all outgoing HTTP/HTTPS traffic through In Pro's Tor HTTP proxy on port 8118 (replace UID with the app's Android user ID from Settings, Apps, [App], App info):

> For most users, the combination of In Pro system proxy + DuckDuckGo App Tracking Protection + AFWall+ default deny whitelist is sufficient without custom iptables rules. The custom script approach is for ad users who want guaranteed per app Tor enforcement regardless of system proxy compliance.

---

OPSEC Step 5: Set Up The Tuta & DuckDuckGo Suite

This two layer setup gives you the strongest a email privacy. Tuta Mail is your real, encrypted inbox. Duck Addresses are disposable forwarding aliases you hand out to every app, website, and service instead of your real address, so your actual Tuta inbox is ne.

#### Part A1, Set Up Tuta Mail

1. Open Tuta Mail and create a new account.
2. Use a .de domain address (e.g., ), German privacy laws (DSGVO/GDPR) provide strong legal protections for accounts hosted in Germany.
3. No phone number is required. Tuta only asks for an email address and gives you an encryption key / recovery code, write this down and store it somewhere physically safe. This recovery code is how you regain access to your account if you ever lose access. Guard it the same way you would guard a physical key to your home.
4. Enable biometric lock or a strong PIN within Tuta Mail's security settings.
5. All emails between Tuta accounts are automatically end to end encrypted. Emails to external recipients (Gmail, etc.) can be password encrypted using Tuta's "secure external password" feature.

#### Key Features

* End to end encryption for all emails (both subject and body, not just body like most pro)
* Zero knowledge, Tuta cannot read your emails; they are encrypted before leaving your device
* Encrypted contacts and calendar included in the free plan
* Encrypted search (searches happen locally on your device, never on the server)
* Email aliases for compartmentalization (use different aliases for different purposes)
* Secure external email (password protected messages to non Tuta recipients)
* German and EU jurisdiction with GDPR protections
* Free plan a; paid plans add more aliases and storage
* Fully open source client

---

#### Part A2: Set up Tuta Calendar

Tuta Calendar is the standalone end to end encrypted calendar app from the Tuta team, split out from the Tuta Mail app into its own package. Your events, descriptions, attendees, and notifications are encrypted before they leave the device, and they sync across all your devices through the same Tuta account that holds your encrypted mail. It is the calendar counterpart to Tuta Mail and the DresOS choice when you want an encrypted calendar that syncs, rather than a purely local one.

#### Key Features

* End to end encrypted events, including titles, descriptions, and attendees
* Zero knowledge: Tuta cannot read your calendar
* Syncs across devices through your existing Tuta account, no Google account
* Encrypted reminders and recurring events
* German and EU jurisdiction with GDPR protections
* Fully open source client

#### Setup and Usage

1. Install Tuta Calendar from F-Droid.
2. Sign in with the same Tuta account you created in Part A1. Your encrypted calendar is a immediately and stays in sync with Tuta Mail.
3. In AFWall+, allow Tuta Calendar on Wi Fi and Data, since it needs the network to sync your encrypted calendar.

---

#### Part A3, Setting Up DuckDuckGo,

1. Install DuckDuckGo from F-Droid.
2. When it offers App Tracking Protection, enable it. Android will ask you to allow a for DuckDuckGo; confirm it. In Pro uses proxy plus root mode and leaves the VPN slot free, so there is no conflict.
3. Set it as your default browser in Settings, Apps, Default apps, Browser.
4. Set up your Duck Address: menu, Settings, Email Protection, Get Started, enter your Tuta Mail address as the forwarding address, and store the generated key alongside your Tuta recovery code.
5. Allow DuckDuckGo on Wi Fi and Data in AFWall+, since it is your browser and needs full access.
6. For YouTube, turn on Duck Player in menu, Settings, Duck Player and set it to open YouTube automatically. then play in a clean, distraction free window with targeted ads stripped and without YouTube tying the session to your watch history or recommendation profile.

Duck Addresses are free, private email aliases provided by DuckDuckGo. The idea is simple: instead of giving any website, app, or service your real Tuta address, you give them a Duck Address like . DuckDuckGo strips all email trackers from messages and forwards them clean to your real Tuta inbox. If a service gets breached, sells your data, or starts spamming you, you just deactivate that alias. Your real Tuta address is ne.

Full Email Setup:

1. Open DuckDuckGo Privacy Browser.
2. Tap the menu, Settings, Email Protection.
3. Tap Get Started and follow the setup flow.
4. When asked for your forwarding address, enter your Tuta Mail address, all forwarded emails will arrive in your Tuta inbox, stripped of trackers.
5. You will receive a Duck Address (e.g., ). This is your primary alias. No phone number required, just your Tuta address to recei mail.
6. You will also be given an encryption key / personal Duck Key, store this safely alongside your Tuta recovery code. This is how you manage your account if needed.

Using Duck Addresses e:

* Whenever any app, website, or form asks for your email address, tap the DuckDuckGo keyboard suggestion "Use Duck Address", or manually enter your .com address
* DuckDuckGo can also auto generate unique one time aliases for each service (e.g., ), these appear as autofill suggestions in DuckDuckGo browser when you tap an email field
* Each unique alias forwards to your Tuta inbox with all trackers removed
* If a specific service starts sending spam or your alias appears in a breach, go to DuckDuckGo Settings, Email Protection, Manage and deactivate just that alias, without touching your real address

What this stops:
* Phishers, they only have a disposable alias, never your real Tuta address
* Doxxers, your real inbox cannot be searched for, looked up, or correlated across services
* Data brokers, even if fi companies share your email address, they each have a different alias and cannot link your accounts together
* Email trackers, DuckDuckGo strips tracking pixels, spy links, and hidden tracking code from every forwarded email before it reaches Tuta

The complete email security chain:

Your real address ne anywhere outside of the DuckDuckGo Email Protection settings on your own device.

---

#### Part A4, Auto Generated Passwords in DuckDuckGo

DuckDuckGo's browser also includes a built in password manager that integrates with Duck Address setup. Once you ha Protection enabled:

* When you create a new account on any website in the DuckDuckGo browser, it will automatically suggest a strong, randomly generated password for the password field tap to accept and it is saved to DuckDuckGo's encrypted local password storage
* Sa are stored on device, encrypted, and sync only to other devices you control via your Duck account (optional)
* On returning to a site, DuckDuckGo autofills both the Duck Address alias and your sa
* This means for most sign ups you ne type or choose a password the browser generates, saves, and fills it all automatically

Use IYPS (App #2) to analyse the strength of any existing passwords you want to migrate, then replace weak ones with DuckDuckGo generated or IYPS passwords going forward.

IYPS (It's Your Password Security) is an open source password strength analyser and generator. It does not store passwords that job is handled by DuckDuckGo's built in password manager. What IYPS does is tell you exactly how strong or weak any gi is, with real world crack time estimates across different attack scenarios, and generate strong random passwords on demand.

#### Key Features

* Password strength analyser, paste any existing password and get a detailed breakdown: entropy score, estimated crack time under online attack, offline attack, and distributed cracking scenarios
* Password generator, creates strong, random passwords with customisable length and character sets
* Completely offline, no password e your device during analysis
* No storage, no vault, no sync, purely an analysis and generation tool
* No ads, no trackers, no telemetry

#### Setup and Usage

1. Install via SAI from the direct APK link Here: GitHub Releases (latest).
2. Open IYPS, no account or setup required.
3. Check an existing password:
* Paste it into the analyser field
* IYPS shows the entropy score and estimated crack time across attack scenarios (online throttled, offline fast hash, distributed brute force)
* Anything under "centuries" for an offline attack is worth replacing
4. Generate a strong password:
* Go to the Generator tab
* Set desired length (20+ characters recommended) and character set (uppercase, lowercase, numbers, symbols)
* Tap generate copy the result and save it in DuckDuckGo's password manager.

---

OPSEC Step 6: Set up DresSecureComms

DresSecureComms is our in house FOSS, fully de Googled application that handles private messaging, calling, contacts, link threat scanning, photo metadata wiping, and location spoofing. It is built and signed by us The DresOS Team and is designed to be set as your default SMS and phone app.

It puts the most sensiti of the device, your texts, calls, contacts, and the links you open, inside one audited, de Googled app built by DresOS. Nothing leaves the device except the lookups you choose to run.

#### Key Features

* Private offline SMS client with optional per message AES 256 GCM encryption, readable only by another DresSecureComms user. Keys are set per contact, so every person you talk to has their own code
* Full default phone app with its own in call screen (mute, speaker, keypad, hold, add call) and a deletable call history
* Spam Shield, which screens incoming calls on the device before the phone rings. Premium rate numbers are rejected, short codes are silenced, and callers faking the first digits of your own number are flagged. Sa always ring through and every block is listed in Settings so you can undo it
* An encrypted on device contacts vault with add, edit (name, number, email), and import
* Threat Scan, which checks any link against and returns a clear safe, suspicious, or dangerous
* Metadata Wipe, which strips GPS and EXIF data from photos before you share them
* Geo Spoofer, which sets a fixed or random mock GPS location
* App lock (fingerprint or device PIN) and an app wide block screenshots mode
* No Google services, no trackers, no analytics; the only network call is the lookup you trigger yourself
* File Scan, which checks a single file or every app on your device against . The file ne the phone, only its SHA 256 fingerprint is sent, and that comes back checked against seventy or more antivirus engines at once. This is what replaces a separate antivirus app in DresOS

#### Setup and Usage

1. Open the app then go into settings and set as defualt if it says it has been restricted then Open Settings, Apps, DresSecureComms, the options menu, then Allow restricted settings. This is required for sideloaded SMS and phone apps.
2. For encrypted SMS, set a shared key in Settings and share it by hand with your contact.
3. For link scanning get a Virus Total api key and set it in settings via the Threat scanning block.

#### Setting up mock location

Physical location is one of the most sensitive data points your phone broadcasts constantly. DresSecureComms lets you replace your real GPS coordinates with any location in the world.

1. Open DresSecureComms.
2. Go into settings
3. Click Randomize location then press apply
4. Go to Settings, About phone, tap Build number se to ensure De Options is open.
5. In De Options scroll down to Select mock location app then choose DresSecureComms.
6. Your device's GPS will now report the fake location to all apps that request it.

What this does: Spoofs your device's geolocation, pre apps from determining your real position. Combined with In Pro's Tor routing (which masks your IP address from network observers), this gives you both network level and sensor le protection simultaneously.

---

OPSEC Step 7: Final Checks and Hardening Tips

Test & Backup:
* Make and receive a test phone call via DresSecureComms
* Send and receive a test SMS via DresSecureComms
* Send and receive a test email via Tuta Mail
* Open a website in DuckDuckGo Privacy Browser, confirm it is working and App Tracking Protection shows active
* DresOS WebView is the acti provider via adb shell dumpsys web | grep "Current WebView package", the output should show org.dresos.webview
* Open AFWall+, confirm firewall rules are applied and iptables is active
* Open Aurora Store, apps load and anonymous mode works
* Open an APK via SAI, confirm it installs correctly
* Download a file in DuckDuckGo, confirm it opens in Gopeed
* E working through microG and DresOS WebView as expected

In Pro / proxy setup:
* Confirm In Pro is running (all three services green) and the Android system proxy is set to 127.0.0.1:8118 on your Wi Fi network.
* Allow In Pro background network access and disable any battery optimization that would kill it (Settings, Battery, Battery optimization, In Pro, Not optimized).
* Allow background network and battery usage for Tuta Mail (for push notifications) the same way.

DuckDuckGo App Tracking Protection:
* Since In Pro uses proxy mode and does not occupy the Android VPN slot, DuckDuckGo's App Tracking Protection should show up as a VPN.

Network preference:
* Use Wi Fi o data where possible, Tor performance is significantly better on Wi Fi, and the system proxy applies automatically to saved Wi Fi networks.
* On public Wi Fi, AFWall+'s whitelist ensures no unexpected apps phone home even on untrusted networks.

Periodic maintenance:
* Run a File Scan in DresSecureComms weekly, on anything you ha and across your installed apps.
* Run OONI Probe to monitor for censorship or network manipulation in your area.
* Run SD Maid SE monthly to clear leftover data from removed apps.
* Update all apps regularly, security patches are critical.

Your device is now a hardened security software Android system reducing risks from sur, phishing, malware, censorship, and network le.

---

Part 3: Fossify Suite

Download: All , search each app name or visit fossify.org/apps

Fossify is a suite of open source replacements for core Android system apps. In DresOS several of these are already covered: phone, SMS, and contacts by DresSecureComms, the gallery by A, files by Amaze, and the calendar by Tuta Calendar. From Fossify you only need the system apps that nothing else covers, listed below.

Apps in the Suite

| App | Replaces | Features |
| --- | --- | --- |
| Fossify Launcher | Pixel Launcher | Open source home screen, no Google Feed integration |
| Fossify Clock | Google Clock | Alarm, timer, stopwatch, zero telemetry |
| Fossify Notes | Google Keep | Local encrypted notes, no cloud sync |

Setup

1. Install Fossify Launcher, Clock, and Notes .
2. Set Fossify Launcher as your default home app in Settings, Apps, Default apps, Home app.
3. Open Notes and Clock and just allow the permissions they ask for.

---

Part 4: Additional Apps and Core Components

Apps O

The following apps form the complete DresOS defensi system. Every single one is open source, has zero Google dependencies, and is sourced directly from de releases or F-Droid.

---

1. RedReader, Private Reddit Client

Download: F-Droid

RedReader is a free, open source Reddit client that removes all ad, tracking, data collection, and analytics present in the official Reddit app and other third party clients.

#### Key Features

* No ads whatsoever, not e's own promoted posts
* No tracking or analytics, no telemetry sent to Reddit or any third party
* No account required to browse, full anonymous access to Reddit content
* Optional account login for commenting/ without Reddit app telemetry
* Clean, fast, highly readable interface
* Full image, GIF, and video support
* Offline reading mode cache posts for reading without connectivity
* Night mode and customizable text sizes

#### Setup and Usage

1. Install via SAI from the direct APK link above.
2. Open RedReader, no setup required to start reading anonymously.
3. Browse without account: You can immediately browse subreddits, search, and read posts without logging in.
4. Optional account login:
* Settings, Accounts, Add Account
* Log in with your Reddit credentials, RedReader does not store these beyond the session token
5. Customize feed:
* Add subreddits to your front page by searching (magnifying glass) and subscribing
* If not logged in, subreddits are stored locally in the app

---

2. Metrolist, Private YouTube Music Client

Download: GitHub Releases (latest)

#### What It Is

Metrolist is a privacy focused, modded YouTube Music client. It provides access to YouTube Music's full catalogue, including all your existing playlists and library if you have a YouTube Music account, without Google's tracking, ad, or data collection.

#### Key Features

* Ad free YouTube Music, no pre roll ads, no mid song interruptions, no audio ads
* No tracking, Google Analytics, ad identifiers, and telemetry calls are removed
* Background playback, music plays when the screen is off or when using other apps (normally requires a paid YouTube Music Premium subscription)
* Audio quality control, select specific bitrates and codec preferences
* Offline capability, cache songs locally for offline listening
* Account support, optionally log in with a YouTube/Google account to access your playlists and liked songs (note: if you log in, Google still knows what you are listening to, use without account for maximum privacy)
* Custom theme support, AMOLED dark mode

#### Setup and Usage

1. Install via SAI from the direct APK link above.
2. Open Metrolist.
3. Without account (maximum privacy):
* Browse and search the full YouTube Music catalogue freely
* Your listening history is stored locally only
* make playlists
4. With account (access your library):
* Tap the account icon, sign in via DuckDuckGo Privacy Browser with your Google account
* Your playlists, liked songs, and subscriptions will sync
* Understand that YouTube/Google will still log your listening activity server side when you are logged in
5. Background playback:
* Just minimize the app, music continues playing without needing any subscription
6. Cache for offline listening:
* Long press a song or playlist, Download, select audio quality
* Downloaded files are stored in your chosen directory (manage with Amaze File Manager)

---

3. Arcane Chat, Decentralized Encrypted Messaging

Download: GitHub Releases (latest)

Arcane Chat is a fully decentralized, end to end encrypted messaging application built on the Delta Chat protocol, which uses email as the transport layer with OpenPGP end to end encryption. This means your messages are transmitted o infrastructure, making them extremely difficult to block, and giving you full control of your identity (your email address) without depending on any centralized messaging server.

#### Key Features

* End to end encryption (Autocrypt standard), messages are encrypted on your device before transmission and can only be decrypted by the recipient
* Decentralized, no central Arcane Chat server; messages route through standard email servers. There is no single point of failure or sur
* No phone number required, your identity is your email address (use your Tuta Mail address for full privacy)
* No metadata har, unlike Messenger, WhatsApp, and Signal, there is no central ser who you talk to, when, or how frequently
* Censorship resistant, email infrastructure is nearly impossible to block globally; even in censored regions, email typically works
* Group chats, image/file sharing, voice messages
* Multiple accounts (use different email addresses for different contexts)
* FOSS (fully open source), no ads, no tracking

#### Setup and Usage

1. Install via SAI from the direct APK link above.
2. Open Arcane Chat.
* Tap Create new profile
* Enter your name
* Click agree and create profile
3. To talk to someome tap the plus button and scan the qr code they gave you or send the other person a link to connect to your profile.
4. Group chats:
* Tap + then New Group give it a name, add members then click continue
5. Disappearing messages:
* Open a chat press the options menu click Disappearing Messages and set a timer

---

4. HeliBoard, Offline Keyboard

Download: F-Droid, search "HeliBoard" or visit

HeliBoard is a fully open source, completely offline keyboard for Android. It is a direct replacement for Google's Gboard, which is one of the most in data collection tools on Android it can capture e you type (passwords, messages, searches) and transmit it to Google's servers for "personalization" and other undisclosed purposes.

#### Key Features

* Completely offline, zero network access, zero data transmission
* Full multilingual support with offline dictionaries
* Swipe typing (gesture input)
* Auto correction and predictive text (fully local)
* Customizable themes, layouts, and key sizes
* No analytics, no crash reporting, no permissions beyond keyboard input
* Actively de and maintained

#### Setup and Usage

1. Install .
2. Open HeliBoard, follow the setup wizard to enable it as a system keyboard.
3. Remo during the debloating step.
4. Download offline language dictionaries for your languages within HeliBoard settings.

#### DresOS HeliBoard Design (One Tap Restore)

We worked up a ready made DresOS HeliBoard configuration so you do not have to tune the keyboard by hand. It is a privacy tuned setup with always incognito mode on, contacts and personalized dictionaries off, sound off, and the DresOS theme with key borders, a number row, and narrow key gaps. You restore it as a single backup file and the keyboard is fully set up.

1. Download the design file: DresOS HeliBoard Design.zip
2. Open HeliBoard then click ad then scroll down to Backup and restore.
3. Tap Restore, select the downloaded DresOS HeliBoard Design.zip, and confirm.
4. HeliBoard applies the full DresOS configuration immediately. No further setup is needed.

---

5. A, Gallery and Photo Manager

Download: F-Droid

A is a fully open source gallery and photo manager for Android. It handles photos and of every common format, reads and displays full image metadata, and organises your library by album, country, place, tag, and date, all locally on the device with no cloud, no account, and no trackers.

#### Key Features

* Photos and , including raw, GIF, SVG, and many other formats
* Map view and place or country grouping from on device metadata only
* Tags, fa, and powerful search across your local library
* Full EXIF and metadata and editor
* No cloud sync, no Google Photos backup, no AI face scanning, no telemetry
* Works fully offline; you can block it from the network in AFWall+

#### Setup and Usage

1. Install A from F-Droid.
2. Grant it media and storage access when prompted.
3. In AFWall+, leave A blocked on both Wi Fi and Data, since a local gallery has no reason to reach the internet.

---

6. Stratum, 2FA Authenticator

Download: stratumauth.com/download / GitHub

Stratum (formerly Authenticator Pro) is a free and open source two factor authentication app, released under GPL 3.0. It generates the rolling login codes that protect your accounts, and unlike Google Authenticator or Authy it does not lock your data in or talk to any server. E stays on the device, encrypted, and you can export it at any time.

#### Key Features

* TOTP, HOTP, mOTP and more, compatible with almost every provider
* Fully offline: it requires a single permission and ne internet access
* Encrypted, exportable backups so you can move to a new phone without being locked out
* Password and biometric lock on the code list
* Import from other authenticator apps
* Icons, categories, and Material You theming

#### Setup and Usage

1. Install Stratum from the official download page or GitHub.
2. Open it and set a password plus biometric unlock in the security settings.
3. For each account choose add, then scan the provider's QR code or paste the secret. Stratum starts generating codes immediately.
4. Make an encrypted backup from the backup menu and store it somewhere safe, for example inside an AES 256 archive, so you can restore your 2FA if you lose the phone.
5. In AFWall+, block Stratum on both Wi Fi and Data. It works entirely offline, so denying it the network is a free privacy and security win.

---

Made with love for privacy by DresOS

You now have a fully de Googled, secure Android device: no Google apps and no Google Services, DresOS WebView as the system WebView through the DresOS WebView Module v2.2.0, Google Play compatibility through the DresOS microG Module v3.1.2 with the ROM pro signature spoofing, Tor plus DNSCrypt through In Pro in proxy mode, a kernel le firewall through AFWall+, app tracker blocking through DuckDuckGo App Tracking Protection, and the full DresOS defensive app suite on top, from encrypted Tuta mail and calendar to offline two factor with Stratum, a local A gallery, and an offline HeliBoard keyboard. Every tool is open source, every download is sourced directly from a de, and every component is designed to hand control of your device, your data, and your privacy back to you.

---

License

This project is released under the Creati Attribution Non Commercial Share Alike 4.0 International License (CC BY NC SA 4.0). See the LICENSE file for the full terms.

---

Donate

> Help fund future de. DresOS is built by a small open source team in our spare time. If our guide, Magisk modules or app saved you a weekend of research, please tip the jar. Funds go to test devices, de, and de time on updates and future projects.

![Please Help fund future projects and keep this one going]()

项目信息

开发语言：未知

Star 数：45

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Turn any Android device into a secure fortress, TWRP + Magisk + MicroG + Fossify + iVizblePro + DresOS App Suite – For 2026展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。