Hello, we are DresOS, an open source organization dedicated to enhancing security and development for Android devices, Linux machines, and the apps that run on them. Our mission is to provide privacy focused, secure and innovative tools that empower users in a digital world.
Click the tabs above to explore our work.
What we do
DresOS Android - A complete guide to build your own fully private, deGoogled Android system using TWRP, Magisk, our own microG and WebView modules, and the FOSS apps that replace everything Google takes out
Magisk Modules - 2 Magisk Modules we built for our operating system. They are DresOS WebView v2.3.2 and DresOS microG v3.1.7.
DresSecureComms - Our own in house FOSS app. Private SMS and MMS with optional AES-256-GCM encryption, a full default dialer, and an encrypted contacts vault. Now at v1.8.2 and available on IzzyOnDroid.
DresOS: The Defensive Security Distro - Our upcoming Linux defensive security distribution. The build starts after a short break, targeting late 2026 into early 2027
Open Source Tools - Kali Linux tools and Android utilities, all on GitHub
Support DresOS
DresOS is built by a small open source team in our spare time. Every Magisk module, every guide, and every bug fix is unpaid work. If our tools help you, drop a tip in the jar.
Funds go directly to test devices for module compatibility (Pixel, Samsung, Motorola, OnePlus, Xiaomi), servers, domain renewals, and developer time on the next release.
August 9, 2026 - DresSecureComms Nearly Finished, a Fresh Demo, and a Batch of Hardening
The push on DresSecureComms is nearly at the finish line. Since the modules were signed off we have been heads down on the app, working through bug reports as they come in and tightening the parts that needed it, and it is close now to sitting at the same level as the rest of the system.
The geo spoofer. A user on a OnePlus Nord 4 running Android 16 reported that the mock location feature failed with a message every time they tried it. It turned out to be ours, not their phone. When the app registers itself as a location source it has to tell Android how accurate that source is, and it was handing over a value that newer Android no longer accepts, so the whole thing was refused and the refusal was being swallowed without anyone being told. It is fixed, it now gives Android the values it expects and registers through the newer interface on Android 12 and later, the spoofed position is also handed to the combined location source that most apps actually read today, and there is a new button to stop mocking without restarting the phone. A real thank you to the person who reported it and tested another app on the same handset to prove the fault was ours.
Hardening. Alongside the visible fixes we closed a couple of quieter things. One of the app's internal receivers was reachable by other apps on the device when it never needed to be, so it has been shut to the app itself, and one of the screens that other apps can hand information to is now guarded against being handed something malformed. Neither was known to be exploited, both are the sort of thing you fix before it ever becomes a problem rather than after.
A new demo. The demo video on the site was showing an older build, so we recorded a fresh one on a Moto g32 running the current system, and this time we host it here ourselves rather than on a third party. You can watch it in the DresOS Android tab above. It runs through the whole system on a real device, the file scanner and the spam shield included.
What is left. One more major update finishes DresSecureComms, the big piece being the offline signature side of the file scanner, the part that brings in what Hypatia was known for so a file can be checked with nothing leaving the phone at all. After that the app joins the rest of the system at the stage of simply being kept maintained. We are also lining up the last of the housekeeping, and there is groundwork going on behind the scenes toward the Linux distribution and toward the bonus module for Google's September install restriction.
Get the app from GitHub releases or IzzyOnDroid. If something breaks on your device, tell us with the device and ROM, that is how these get found.
August 4, 2026 - The Modules Are Complete: microG v3.1.7, WebView v2.3.2, and Both Now Self-Maintaining
Over the past couple of days we pushed the last manual patches to both Magisk modules, and from our end they are now complete. From here they keep themselves current. A GitHub Action runs every week, pulls the newest version of everything the modules carry straight from its original source, including our own DresOS WebView engine from its own repository, checks each one against its pinned signing key, then rebuilds the module, bumps the version and publishes the new release by itself. Nobody has to rebuild them by hand anymore, and the new releases come through the same way they always have. This is something we planned for a long time, to switch on once the modules were finished, so that keeping them current stops being a weekly job and that time can go into the rest of the organisation instead.
Where that leaves the system. With the build guide refined, both modules patched and now maintaining themselves, and the WebView engine tracking Cromite's latest, three of the four parts of the DresOS Android system are solid and only need keeping current from everything we can see. The last part is DresSecureComms, and the next couple of weeks are tunnel vision on bringing it up to the same level as the other three. Alongside that we will keep pushing engine updates to bring the WebView to completion and keep refining the parts that are already done. This is us holding to our word: every part of the system stays updated and maintained, not shipped and forgotten.
The WebView engine, honestly. The newer engine we put out caused pages to crash inside some apps, so we have reverted to the previous engine and there should be no more browser problems. We tried to take a shortcut to build the new one and it did not work out, which is simply how you learn what works and what does not. A proper updated engine is coming, but not this week. The current workload is full with finishing DresSecureComms and getting some bug bounty work going to bring in funding for the organisation's future.
After that. Once DresSecureComms is where it needs to be, the whole system is at the stage of simply being kept maintained, and from then on we only push an update when something major genuinely needs changing in one of the four parts. Over the next couple of months it is looking promising that our Linux distribution project run begins, with a roadmap and a full plan released right here on the website, so keep an eye out for it. There may also be one last module before then, one that gets around the app installation restriction Google brings in this September. That one is not part of the Android system, just a bonus for the community.
To everyone who has used our projects, tested them on their devices, sent in bug reports, or helped in any other way, thank you. This began as one person's dream and you are the reason it keeps becoming real. Let us keep building, and keep fighting to keep Android open.
August 1, 2026 - microG v3.1.5, WebView v2.2.1, and the Modules Now Update Themselves
Both Magisk modules have been audited end to end and both have a release out of it. The short version: the bundled apps inside the microG module now keep themselves current without us.
The automation is live. A pipeline runs every week against GmsCore, the microG Companion, GsfProxy, Aurora Store and Aurora Services. If any one of them has moved, the module is rebuilt, the version bumped and the release published on its own. Until now only a GmsCore change could set that off, so an Aurora update could sit there unnoticed for as long as it took someone to spot it. Every bundled app is also checked against a pinned signing key before it is staged as a system app, which previously only applied to the microG core. If a download ever comes back signed by someone else, the build stops rather than shipping it.
The rest is smaller. The WebView module's update check still pointed at our old GitHub account, so in-app update checks were not resolving properly; that is fixed. And a permission entry added to the microG module in v3.1.4 for Aurora Services turned out to do nothing at all, because the app never asked for those permissions in the first place, so it has been taken back out and the generator that writes that file now handles an app with no entry yet.
What we are doing next. The WebView module gets the same treatment microG just had: an automatic build and release workflow, so when we push a new engine the module rebuilds, versions and publishes itself rather than waiting on us to remember. That is the whole point of this stretch. The Android system is finished, so the work now is making sure it stays current on its own, because a privacy system that quietly falls behind upstream is worse than useless. Between the two modules and the app, that is nearly everything we ship maintaining itself.
Grab them from the module releases. As always, if you flash something and it breaks, tell us with your device, ROM and Android version, and it gets fixed.
July 30, 2026 - DresSecureComms 1.8.1, the Scan Engine, and What Comes Next
Three bug reports came in from people running 1.8.0 and all three turned out to be real, so 1.8.1 is out and it is worth updating to straight away. Thank you to everyone who sent them in. This is exactly why we ask.
Messages that only showed up in the notification. If someone's number reached you in one format and you had saved it in another, with the country code against without it for instance, Android could file the same person under two separate conversations. Your replies went into one and their messages went into the other, so what you received was nowhere to be found inside the app even though the notification showed it fine. Conversations are now matched on the number itself, so everything with that person sits in one thread whichever way it arrived, and threads that were already split show up joined back together.
Calls. The message notification sound no longer plays just before the ringtone on an incoming call. The screen now always comes back on after you move the phone away from your ear too. That one only bit phones using virtual proximity sensing rather than a real sensor, where the screen simply stayed dark and you had to wake it before you could hang up. There is a switch under Settings, Calls if you would rather it never blanked at all.
Sending. A message that fails to send now says so and is marked as failed, instead of sitting there looking like it went. Replies sent straight from a notification now appear in the conversation, and long ones are split properly rather than being dropped.
The scan engine is nearly complete. Until now, if VirusTotal had never seen a file, File Scan told you exactly that and left you there, which is the most common result for anything built outside the Play Store. You can now send that file to VirusTotal yourself and have its engines analyse it. It asks every single time, it is one file at a time, and the prompt says plainly that the file leaves your phone and that VirusTotal keeps what it is sent and shares it with the antivirus companies it works with. Nothing is ever uploaded on its own, and a sweep of your installed apps still never uploads anything. You can also scan one app on its own now instead of sweeping all of them. What is left for version two is offline signature scanning, the part Hypatia is known for, and then the engine is finished.
Automation on the module repos. The microG module already pulls the latest officially signed microG core on a schedule and bumps itself when upstream moves. We are extending that to everything else the modules carry, so every app bundled inside them stays current on its own instead of waiting on us to rebuild by hand. That work starts shortly.
The Linux distro. Work on our defensive security distribution starts soon. We are taking a short break first. Seven months on the Android system is a long run, and the right thing to do before we point our attention somewhere else is to make sure that system is properly robust, so the next stretch goes on bug reports, fixes and keeping everything current. Then the distro build begins in earnest.
July 23, 2026 - DresSecureComms 1.8.0, Hypatia Dropped, and microG v3.1.3
This is the update that finishes what we set out to do with DresSecureComms. It now handles the malware scanning and the spam calls too, which means another two apps come out of the build and more than half of the system's core functions run on components we build and sign ourselves.
File Scan. DresSecureComms can now check a single file, or every app installed on your device, for malware. It does it by fingerprint, so the file never leaves your phone: only a SHA-256 goes out, and it comes back checked against seventy or more antivirus engines at once. This is version one, and it is what replaces Hypatia inside DresOS. Hypatia set the bar for on device scanning and it served the system well, and offline signature scanning, the thing Hypatia is known for, is what version two adds.
Spam Shield. Incoming calls are now screened before your phone rings. Premium rate numbers are rejected, short codes are silenced, and callers faking the first digits of your own number get flagged. You can go stricter and silence anyone not in your contacts, or reject withheld numbers outright. Saved contacts always ring through. The important part is that all of it runs on the device: no number is ever sent anywhere to be looked up, which is the whole problem with every mainstream spam blocker.
Encryption keys are now per contact. This was the real weakness people kept pointing at, and they were right. One code shared with everybody meant anyone with the code could read everything. Now each contact gets their own code, set from the conversation menu, used only for that thread. The old shared key still covers anyone you have not set a code for, and every message you have already sent still opens.
Fixes people asked for. The screen now turns off when you hold the phone to your ear on a call. Starting a new message suggests your contacts as you type, so you no longer have to go and look a number up first. The option to save a number is hidden once that number is already saved. And you can block or unblock any number straight from the call log.
microG v3.1.3. The module's update and issues links now point at the current organisation, so update checks resolve properly again, and the leftover build plumbing from the retired Google signed flavour is gone. Nothing changed in what lands on your device.
The guide has been cut down again to match. Hypatia is out of it entirely, its section, its firewall rule and its weekly scan step, with the scanning folded into the DresSecureComms section where it now belongs.
July 18, 2026 - The DresOS Android Defensive Security System Project Run Is Now Finished
This has been our first ever proper project run, and it lasted 7 months altogether. Within these 7 months we gained many loyal users who now put their trust into DresOS, and we could not thank each and every one of you enough, especially everyone who sent in bug reports. Without you our job would have been 100x harder.
Over the past few days we put out some of our last big updates to everything to do with parts of our system, that being the build guide, the Magisk modules, and DresSecureComms. We only have one more module left to release that is part of our system, but it is not a main component. It will be released in September, when Google brings the next restriction into place around app installation, as our system solely focuses on battling Google and its data mining monopoly by bypassing each and every restriction they bring into place.
The reason the project run has come to an end is that we have done everything we set out to do. Continuing with the Magisk module roadmap is not a viable option, as both our microG suite and our system WebView module with our own WebView engine are enough, and the guide as a whole has been refined, debloated, and rewritten to be less convoluted. The rest of the roadmap was just covering things in the guide that can be done manually, whereas the microG suite and the WebView module were genuinely needed.
DresSecureComms was a recent addition we brought in over the rest of the Magisk modules, as it covers and secures core components needed for your day to day life on Android. Soon we will add our file scan engine, and after that it will be complete in full, along with one final massive change within the system: dropping Hypatia for DresSecureComms for the malware scanning.
Of course this does not mean we are dropping the projects. No, no, no. Each and every single one of them will be maintained and updated constantly to bring you the latest device security, and at some point in the future, when Google has calmed down, we will release a full custom ROM, starting off with the Moto G32.
But for now, as an organisation, we must change gears and move on to the build and release of our Linux distribution, which should elevate us to whole new heights by bringing secure solutions to both mobile phones and computers.
One last thing: if you enjoyed using any of our projects and love what we are doing, then please help us out by telling a friend about DresOS, shouting us out in your social media stories, posting links to our website dresos.org, and/or putting a tip in the jar to go towards test devices, servers, and coffees for the devs on late night build sessions.
July 3, 2026 - The DresOS Foundation, dresos.org, and DresSecureComms 1.6.0
We are now The DresOS Foundation. DresOS has grown out of a personal GitHub account and into its own organisation at github.com/The-DresOS-Foundation. The full DresOS Android guide has already made the move, and DresSecureComms and the Magisk modules follow it over shortly. Links to repositories that have moved redirect automatically, so nothing breaks while the migration finishes.
The website has its own domain. This site is now at dresos.org, and we finally have a proper contact address to match: security@dresos.org. Same site, real home.
DresSecureComms 1.6.0 is out, and it is on IzzyOnDroid. The app is now listed on IzzyOnDroid and scans completely clean on VirusTotal, zero detections across every engine. 1.6.0 makes picture messaging work end to end: the crash when sending a photo or group message is fixed, and incoming photos now download automatically, appear inside the conversation, and raise a notification, with picture only conversations showing up in the message list. Your own sent messages appear in the chat instantly and stay in your history whether or not the app is the default SMS app. The in call keypad and call controls are much larger, message notifications carry a Copy action, and tapping a notification opens that conversation. Coming next: importing your own PGP, age, or SSH ED25519 keys to sign your messages. Thanks to the Fossify team, whose Messages, Phone, and Contacts apps we used as references for the MMS work. A huge thank you must also go to Fake Traveler; our mock location components are built on references from their application. And to URL Check, just for the scan part that connects to VirusTotal; we built our scan engine from that.
DresOS microG v3.1.1. The microG module dropped the experimental Google signed build path entirely; grafting Google's certificate onto microG's bytes is not possible without Google's private key, so the module no longer pretends otherwise. Stock ROM guidance was replaced with honest, version aware signature spoofing instructions: LSPosed (JingMatrix fork) plus FakeGApps on Android 15 and below, and on Android 16 or newer a ROM with built in microG signature spoofing is required. Everything else about the bootloop safe pure file overlay design is unchanged.
June 23, 2026 - DresSecureComms, the DresOS Secure Communications App
DresOS now has its own secure communications app. DresSecureComms is a single, FOSS, fully de Googled app that brings private messaging, calling, contacts, link threat scanning, photo metadata wiping, and location spoofing together in one place, built and signed by DresOS with no Google services and no trackers.
It can be set as your default SMS and phone app. Messaging is a private offline SMS client with optional per message AES-256-GCM encryption, readable only by another DresSecureComms user who shares the key. The dialer is a full default phone app with its own in call screen - mute, speaker, keypad, hold, add call - plus a deletable call history and caller ID and spam screening. Contacts live in an encrypted on device vault with add, edit, and import. Threat Scan checks any link against VirusTotal and returns a clear safe, suspicious, or dangerous verdict. There is also a photo metadata wiper, a geo spoofer for mock locations, an app lock, and an app wide block screenshots mode.
In the DresOS Android system it consolidates several separate tools into one app, taking over URL Check, the Fossify Phone, Messages, and Contacts apps, and Fake Traveler.
This is one of the largest coordinated updates DresOS has shipped. The whole system WebView path is now DresOS's own from source to signature, microG gained an automatic update pipeline, and the entire DresOS Android guide and security architecture were rewritten to match. Here is everything in one place.
DresOS WebView - our own system WebView engine. DresOS now ships its own system WebView. DresOS WebView is a Chromium engine built from Cromite (Chromium 145.0.7632.120), with Google services and telemetry stripped and Cromite's privacy and security hardening throughout. It replaces the previous third party WebView engine entirely. Where that engine was someone else's build, DresOS WebView is our own, signed with the DresOS release key, so the whole WebView path is under DresOS end to end.
It installs the same proven way as before: the signed APK is placed in the systemless tree at system/product/app/ via Magisk magic mount, a static RRO adds the package plus the DresOS certificate to config_webview_packages, and service.sh promotes it to the active provider with cmd webviewupdate set-webview-implementation after boot complete, verified via dumpsys. The post-fs-data bootloop sentinel and the inert mode fallback carry over, so a failed activation can never bootloop the device, and removing the module restores the stock WebView. Flashing it over the previous WebView module updates in place, with nothing to uninstall first.
The engine is also published on its own as a standalone signed APK, DresOS WebView v1.0.0, so it can be installed independently of the module. It is distributed through its own GitHub releases only.
DresOS microG v3.0.1 - now self updating. The DresOS microG module has been bumped to v3.0.1. A weekly GitHub Actions pipeline now pulls the latest officially signed microG core (GmsCore, Companion, GsfProxy) straight from the official microG F-Droid repo and auto-bumps the module whenever upstream changes, so microG stays current without a manual rebuild. The bundled APKs and the install logic are unchanged, and it remains the same bootloop safe pure file overlay with ROM provided signature spoofing.
The guide and security architecture, rewritten end to end. The full DresOS Android Defensive Security guide, the SECURITY_ARCHITECTURE diagram, and the system changelog were all updated to the new WebView engine and microG v3.0.1. Step 7, the Part 3 app suite, the What You Will Need table, the Replacement Overview, and the Layer 5 WebView diagram now describe DresOS WebView and org.dresos.webview throughout.
Requirements (WebView module): Magisk 29.0 or newer, Android 10 through 16, arm64. After flashing, verify with adb shell dumpsys webviewupdate; the active provider should be org.dresos.webview.
We rely on community testing. If you flash any of this and something breaks, please open a bug report at github.com/The-DresOS-Foundation/DresOS-Magisk-Modules/issues with device model, Android version, ROM, root provider, and the logs at /data/adb/modules/dresoswv/logs/.
June 5, 2026 - DresOS microG v3.0.0 Released
The DresOS microG Magisk module has been rebuilt from the ground up and released as v3.0.0, replacing the v2.0.0 design entirely. v3.0.0 is a pure file overlay: no Zygisk payload, no Xposed or LSPosed dependency, and no boot time PackageManager work, which means it physically cannot bootloop the device and it coexists cleanly with the DresOS WebView module.
It ships the officially signed microG suite as privileged system apps under product: GmsCore 0.3.15, Companion (FakeStore at com.android.vending), GsfProxy, DroidGuard Helper, Aurora Store, and Aurora Services, with a privapp permissions allowlist generated from the bundled manifests.
Signature spoofing is now provided by the ROM rather than by the module. Because the bundled microG APKs carry the official microG key, any ROM with microG signature spoofing support spoofs them automatically once they are placed in priv-app. There is no bundled hook and no Xposed framework on any ABI.
Aurora Services now lands as a priv-app with its own permissions allowlist, so silent prompt free installs through Aurora Store work without the standard Android installer prompt for every app. This resolves the v2.0.0 Aurora Privileged Extension issue. ROMs that already ship an upstream signed microG (CalyxOS, LineageOS for microG, iodeOS, /e/OS) are autodetected by cert match and their copy is preserved. GrapheneOS is hard refused.
The DresOS Android guide has been updated end to end: Step 5, Step 6, the What You Will Need table, and the SECURITY_ARCHITECTURE.md Layer 8 entry all reflect v3.0.0. The guide also gained an Aves Libre gallery, the Stratum offline 2FA app, the Tuta Calendar encrypted calendar, and a one tap DresOS HeliBoard design, and every download link was audited to a stable form.
Watch the full system running on a Motorola Moto g32 in the demo video further down this page, recorded on the current build and hosted here on our own site.
We rely on community testing. If you flash v3.0.0 and something breaks, please open a bug report at github.com/The-DresOS-Foundation/DresOS-Magisk-Modules/issues with device model, Android version, ROM, root provider, the output of the Action button on the module, and the logs at /data/adb/modules/dresosmicrog/logs/.
May 25, 2026 - DresOS microG v2.0.0 Released
The DresOS microG Magisk module has been released as v2.0.0. It replaced the older manual microG plus signature spoofing framework setup in the DresOS Android guide with a single flash.
The module stages the full microG suite as systemless privileged apps: microG GmsCore 0.3.7.250932, microG Companion (FakeStore at com.android.vending), microG GsfProxy, microG DroidGuard Helper, plus Aurora Store as a user app. APKs and matching privapp permissions XML land in the same partition (system/product/priv-app on API 28 plus, system/priv-app on API 26 and 27), satisfying Android 11 plus same partition enforcement.
Signature spoofing is bundled as a Zygisk hook scoped to the microG process only. On arm64 and x86_64 LSPosed is no longer required. On armeabi-v7a, armeabi, x86, or riscv64 the bundled hook does not ship a prebuilt and LSPosed plus FakeGApps remains the fallback.
Cert identity is verified post boot by reading the X.509 SHA-256 that PackageManager itself computes via cmd package dump, not by hashing META-INF/*.RSA blobs which legitimately vary between build environments. ROMs that already ship a working upstream signed microG (CalyxOS, LineageOS for microG, iodeOS, /e/OS) are autodetected by cert match and their copy is preserved; only the Aurora components are staged on those ROMs. GrapheneOS is hard refused because GrapheneOS deliberately blocks signature spoofing and ships its own Sandboxed Google Play.
Debloat moved off systemless overlay markers onto runtime pm disable-user, persisted in /data/system/users/0/package-restrictions.xml. This ends the Android 14 plus boot loop class where overlaying a priv-app directory hid the ART OAT cache. Uninstalling the module re enables every package the module disabled.
The bootloop sentinel is per component: a strike for the Zygisk hook only disables Zygisk on the next boot, a strike for the priv-app overlay only disables the overlay, a strike for the debloat pass only disables debloat. The rest of the module keeps running.
Known issue in v2.0.0: the Aurora Privileged Extension (com.aurora.services) does not always land as a system priv app on every device. Aurora Store itself works fine. The silent install path through Aurora Services is the affected piece, which means you will see the standard Android installer prompt for each Aurora Store install. This was resolved in the v3.0.0 rebuild.
The DresOS Android guide has been updated end to end. Step 5 (Install Magisk Modules), Step 6 (Set Up microG), the SECURITY_ARCHITECTURE.md Layer 8 entry, the What You Will Need table, and the Magisk Modules Roadmap all reflect the new module.
We rely on community testing. If you flash v2.0.0 and something breaks, please open a bug report at github.com/The-DresOS-Foundation/DresOS-Magisk-Modules/issues with device model, Android version, ROM, root provider, the output of the Action button on the module, and the three logs at /data/adb/modules/dresosmicrog/logs/.
May 12, 2026 - First Official Website Update: DresEcoVerse Archived
The DresEcoVerse has been officially closed down. We now maintain this actively updated website where all our resources, guides, and announcements can be found in one place. This is easier for everyone to navigate and keeps everything centralized.
With our focus now on the already released DresOS Magisk Modules for our Android Defensive Security System build, and with the full app list included directly in the DresOS Android guide, there is no longer a need for the EcoVerse as a separate hub.
Important: DresOS has no active Telegram presence. This website is the only place to verify link authenticity and official announcements.
April 30, 2026 - Keep Android Open
Hello and we have a massive favour for you guys all open source organisations like ours need your help to keep the android world open, the world of android is starting to Look bleak but with your help we can keep the fight against google going, to find out how you can help and do your part please check the links below and lets keep the struggle going
Work on the distro starts shortly. We are taking a short break first and using it to keep the Android system solid, since seven months of building it deserves a proper settling period before our attention moves elsewhere. Targeting late 2026 into early 2027.
Check the Updates tab for progress announcements and devlogs.
Magisk Modules Live
These are the two modules the DresOS system needs: our microG suite, which replaces Google Play Services, and our system WebView, which replaces the browser engine that hundreds of apps quietly render web content through. Between them they cover the two parts of an Android system you cannot practically replace by hand, which is why the set is complete at two rather than growing forever. Everything else in the guide is an app you install or a setting you change yourself.
Both are built to keep themselves current rather than drift. The microG module already rebuilds and publishes itself whenever any of the apps it bundles moves upstream, and the WebView module is getting the same workflow next.
Due to Google's restrictions on app distribution and firmware swaps, we never shipped DresOS as a custom ROM. Instead the system is delivered as a build guide with Magisk modules and standalone FOSS apps like DresSecureComms, built on top of whatever Android you already run. This lets us bypass many of Google's restrictions while continuing the fight against data mining, data selling, and surveillance.
Replaces Android's system WebView with DresOS WebView, a Chromium engine built from Cromite with Google services and telemetry stripped and Cromite's privacy and security hardening throughout. The system WebView is the browser engine used internally by hundreds of apps whenever they render web content. Google's version phones home on every render. This module replaces it in a single Magisk flash with DresOS's own engine, signed with the DresOS release key.
How it works: a static RRO is placed in the systemless overlay partition to add DresOS WebView plus the DresOS signing certificate to config_webview_packages, the DresOS WebView APK is dropped into the systemless system tree via Magisk magic mount, and after boot complete service.sh runs cmd webviewupdate set-webview-implementation to promote it to the active provider. Activation is verified via dumpsys. Two layers of bootloop safety sit on top: a post-fs-data sentinel that auto-disables the module if a previous boot crashed, and an inert mode flag that prevents retry storms on activation failure.
Requirements: Magisk 29.0 or newer, Android 10 through 16, arm64. Other architectures are refused cleanly at flash time and nothing on the device is changed.
The engine is also available on its own as a standalone signed APK from its own GitHub releases, which is the only place it is distributed. It is too large for IzzyOnDroid to accept, so it is not listed there.
After flashing: reboot, then verify with adb shell dumpsys webviewupdate. The active provider should be org.dresos.webview.
Systemless microG suite as a single Magisk flash. Replaces Google Play Services without Google's proprietary code or servers. Ships the officially signed microG GmsCore 0.3.15, microG Companion (FakeStore at com.android.vending), microG GsfProxy, Aurora Store, and Aurora Services as privileged system apps under product, with a privapp permissions allowlist generated from the bundled manifests. DroidGuard is no longer a separate app, as microG folded it into GmsCore upstream.
The module keeps the same bootloop safe pure file overlay design: no Zygisk payload, no Xposed or LSPosed dependency in the module itself, and no boot time PackageManager work. It physically cannot bootloop the device and it coexists cleanly with the DresOS WebView module.
The bundled apps now keep themselves current. A weekly pipeline checks GmsCore, the Companion, GsfProxy, Aurora Store and Aurora Services, and if any of them has moved it rebuilds the module, bumps the version and publishes the release on its own. Before this only a GmsCore change could trigger a refresh, so an Aurora update could sit unnoticed. Every bundled APK is now verified against a pinned signing key before it is staged, which previously only applied to the microG core.
v3.1.4 fixes two real bugs found from a user report on a Samsung J600F. On a stock device where Play Services had updated itself, the module only masked the first copy it found, so the copy in the system partition kept winning and every Google dependent app crash looped. It now masks every copy it finds. Because a Magisk module cannot touch the data partition at all, it also detects that case up front and stops before changing anything, telling you to uninstall the Play Services, Play Store and Services Framework updates, clear their data and reboot before flashing. The second fix is Aurora Services, which could not install apps because its allowlist was missing two permissions; the allowlist generator now reads every bundled APK rather than just the two core ones.
On ROMs with microG signature spoofing support the bundled official key APKs are spoofed automatically once placed in priv-app. On stock ROMs, Android 15 and below can use LSPosed (JingMatrix fork) with FakeGApps, while Android 16 and newer requires a ROM with built in microG spoofing.
Aurora Services lands as a priv-app with its own permissions allowlist, so silent prompt free installs through Aurora Store work without the standard Android installer prompt for every app. Cert identity is verified post boot via cmd package dump reading the X.509 SHA-256 that PackageManager itself computes.
ROMs that already ship a working upstream signed microG (CalyxOS, LineageOS for microG, iodeOS, /e/OS) are autodetected by cert match and the ROM's copy is preserved. GrapheneOS is hard refused.
Requirements: Magisk, KernelSU, or APatch. Android 8.0 through 16. Any ABI. The module bundles no Zygisk or Xposed framework; signature spoofing comes from the ROM where supported, otherwise follow the version aware guidance above.
Stay tuned, stay private, and keep building. - The DresOS Team
DresOS Android
We originally wanted to release our own system but due to all these new cyber laws and the pressure Google is putting on firmware swaps we just could never release it. So we hope our project can bring our organisation back to its core values and release an idea we had once in a different light.
The DresOS Android project has been fully merged into a single comprehensive guide. The old two repo method (Android-Degoogling and Android-opsec) is now combined into one unified system with a security architecture document and a changelog.
Confirmed Working Devices
DresOS is built for universal compatibility. The degoogling and OPSEC steps work on any rooted Android 10 or newer device, and the Magisk modules are written to run on any ABI and any OEM partition layout. These are the combinations confirmed working end to end so far.
Motorola Moto G32 on LineageOS Android 15 and 16
Motorola ThinkPhone on stock Android 15
Motorola Moto G7 Plus on stock Android 10
Motorola Moto G7 Plus on LineageOS Android 15
Google Pixel 9 Pro XL on LineageOS 23.2, Android 16
Samsung Galaxy A05s on stock Android 10
Samsung Galaxy A02s on stock Android 12
Samsung Galaxy J6 (J600F) on stock Android 10, One UI 2.0
If you run DresOS on a device that is not listed, a confirmation report is welcome so the list can grow.
Built on our own components
More than half of the core functions of a DresOS Android device now run on software we build, sign and maintain ourselves rather than on third party apps. That matters because the parts you touch every day, the parts that see your messages, your calls and the web pages you open, are the parts we control end to end.
DresSecureComms handles messaging, calling, contacts, spam and scam call screening, link threat scanning, file and malware scanning, photo metadata wiping and location spoofing
DresOS WebView is our own Chromium engine, built from Cromite and signed with our release key, replacing Google's system WebView for every app on the device
DresOS WebView Module installs and activates that engine systemlessly with a bootloop sentinel and an inert mode fallback
DresOS microG Module replaces Google Play Services with the officially signed microG suite as a pure file overlay that cannot bootloop the device
Every one of those started as a separate third party app in earlier versions of the guide. Each release has pulled another one in house, and each one that comes in house is one less unknown in the stack.
Watch the System in Action
A full walkthrough of a DresOS Android 16 device on a Motorola Moto g32, with every layer of the stack running. This is the current build, recorded fresh, and it is hosted here on our own site rather than any third party.
A full run through the current DresOS Android system on a Moto g32, including the file scanner and the spam shield.
Build Your DresOS Android System
Follow the unified guide below. It covers everything from unlocking the bootloader and flashing Magisk, to the full OPSEC stack with InviZible Pro and AFWall+, and every app and core component the system runs on.
Part 1, DeGoogling the full root method: TWRP, Magisk, the DresOS microG module, DresOS WebView via its Magisk module, Shizuku, system debloat and the FOSS app replacements
Part 2, Operational Security the OPSEC stack: InviZible Pro in proxy and root mode with Tor, I2P and DNSCrypt, the AFWall+ kernel firewall, Tuta Mail with Duck Address aliases, and location spoofing through DresSecureComms
Part 3, Fossify Suite the system apps nothing else covers: launcher, clock, notes and camera
Part 4, Additional Apps and Core Components the remaining apps documented with setup, features and usage
Apps and Core Components
DresSecureCommsThe DresOS secure communications app. Private SMS and MMS picture messaging with optional AES-256-GCM encryption using a separate key for each contact, a full default dialer with in call controls and a searchable call history, on device spam and scam call screening, an encrypted contacts vault, VirusTotal link scanning, file and app malware scanning by fingerprint, photo metadata wiping, and a geo spoofer. No Google services, built and signed by DresOS. Replaces URL Check, Fossify Phone, Messages and Contacts, Fake Traveler, and a separate antivirus app.IzzyOnDroidGitHub
Amaze File ManagerOpen source file manager with built in AES-256 encryption, biometric lock, root explorer, and APK management. Replaces Fossify Files and ZArchiver Pro.F-Droid
IYPSPassword strength analyser and generator. Completely offline, zero data collection.Download APK
RedReaderSecure, modded Reddit client with no ads or tracking.F-Droid
OONI ProbeNetwork measurement tool that detects censorship and surveillance on your connection.F-Droid
InviZible ProTor + I2P + DNSCrypt in proxy and root mode. Runs alongside DuckDuckGo App Tracking Protection without VPN slot conflicts.F-Droid
MetrolistPrivacy focused, modded YouTube Music client. Ad free, background playback, no Google tracking.Download APK
Arcane ChatFully decentralized, end to end encrypted messaging built on the Delta Chat protocol over standard email infrastructure.Download APK
Aves LibreOpen source gallery and photo and video manager. Local metadata, map and tag organisation, no cloud, no trackers. Replaces Fossify Gallery and Google Photos.F-Droid
StratumOpen source offline two factor authenticator. TOTP and HOTP, encrypted backups, single permission, no internet access. Replaces Google Authenticator and Authy.Download
Tuta CalendarEnd to end encrypted calendar that syncs across devices through your Tuta account. Zero knowledge, no Google Calendar.F-Droid
How This System Protects You
Removes all Google services and tracking from the device
Replaces system WebView with DresOS WebView via Magisk module - Cromite based hardened Chromium
Routes all traffic through Tor via InviZible Pro proxy and root mode
Encrypts all DNS queries via DNSCrypt enforced at kernel level via iptables
Blocks in app trackers via DuckDuckGo App Tracking Protection
Kernel level firewall via AFWall+ with per app rules and mobile data proxy redirect
Screens spam and scam calls on the device via DresSecureComms, with no number ever sent off the phone
AES-256 file encryption via Amaze File Manager with biometric lock
Scans every link before opening and every file or app for malware via DresSecureComms
End to end encrypted email via Tuta Mail with Duck Address aliases so your real address is never exposed
GPS spoofing via DresSecureComms
MAC address randomisation per Wi-Fi network
Wallpapers
Click each image to open it full size, then save.
Open Source License
The DresOS Android guide and all associated documentation is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0).
You are free to share, copy, redistribute, adapt, remix, transform, and build upon the material for non commercial purposes, as long as you give appropriate credit to The DresOS Foundation, provide a link to the license, and release any modifications under the same license.
Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International
CC BY-NC-SA 4.0
Copyright (C) 2026 The DresOS Foundation
https://dresos.org
https://github.com/DresOperatingSystems
You are free to:
• Share - copy and redistribute the material in any medium or format
• Adapt - remix, transform, and build upon the material
Under the following terms:
• Attribution - Give appropriate credit, provide a link to the license,
and indicate if changes were made.
• NonCommercial - You may not use the material for commercial purposes.
• ShareAlike - If you remix, transform, or build upon the material,
you must distribute your contributions under the same license.
Full license text: https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode
GitHub Projects
Our work sits in two places. The DresOS Android guide, the Magisk modules and the DresOS WebView engine are in the The DresOS Foundation organisation. DresSecureComms and this website stay on the original account, along with most of the older archived projects. Every link on this page points at the repository's real home rather than relying on a redirect.
DresOS Android
DresOS-The-Android-Defensive-Security-System - The complete unified DresOS Android guide: DeGoogling, operational security, the Magisk modules, the app and core component list, security architecture, and changelog. (34 stars)
DresOS-Magisk-Modules - The two Magisk modules the DresOS system needs: our microG suite and our system WebView engine. Current releases: DresOS WebView v2.3.3 and DresOS microG v3.1.7. (Shell, 19 stars)
DresOS-WebView - The DresOS WebView engine itself, our Cromite based hardened Chromium build with Google services and telemetry stripped, signed with our own release key. (Smali, 9 stars)
Android-Degoogling - The original rooted degoogling guide, now merged into the unified DresOS guide. (Archived, 11 stars)
Android-opsec - The original on device OPSEC guide, now merged into the unified DresOS guide. (Archived, 7 stars)
kali-linux-private-network-setup - Set up Kali Linux as a private, encrypted server for your home or business network. (Archived, 1 star)
Other Projects
DresTermuxAI - AI assistant for Termux with coding assistant abilities. (Archived, Python, 9 stars)
DresSecureComms - The DresOS secure communications app. Private SMS and MMS with per contact AES-256-GCM encryption, a full default dialer, on device spam and scam call screening, an encrypted contacts vault, and VirusTotal link, file and app scanning. On IzzyOnDroid. (Kotlin, 29 stars)
Docker-android - A Docker like environment on mobile, for advanced users. (Archived, 4 stars)
Terms of Service
By using DresOS projects, guides, modules, applications or services, you agree to the terms below. Last updated July 2026.
What we provide
DresOS is a non profit open source project. Everything we publish, the DresOS Android guide, the Magisk modules, DresSecureComms and DresOS WebView, is free, open source and provided as is.
We are not a company and we sell nothing. Donations are voluntary and fund test devices, build machines, domains and developer time. They buy no warranty, no support agreement and no priority.
This website is the only authoritative source for our releases and announcements. Anything presented as an official DresOS release, statement or communication should be verified against what is published here, and treated as unofficial if it does not appear on this site.
Use at your own risk
Unlocking a bootloader, flashing a recovery, rooting a device and installing Magisk modules can permanently damage your device, void your warranty and erase your data. You accept that risk entirely. We are not liable for bricked devices, lost data, voided warranties or failed banking and integrity checks.
Our guide tells you to take a full backup before you start. If you skip that step, the consequences are yours.
Our software is provided without warranty of any kind, express or implied, including fitness for a particular purpose. Our work is scanned before release, DresSecureComms was reviewed and reproducible build verified by IzzyOnDroid before it was listed, and the system is built specifically to remove Google services and the tracking that comes with them. What we cannot promise is protection against every possible threat, or that any configuration will defeat a determined, well resourced attacker who is targeting you directly.
If our guides, modules or applications are used unlawfully or unethically, we take no responsibility and accept no liability for the consequences.
Privacy and data
We operate no accounts, no analytics, no telemetry and no tracking. We do not collect, store, sell or share personal data, and there is no server of ours for your data to sit on.
DresSecureComms keeps everything on your device. Its only outbound network calls are the VirusTotal scans you choose to run yourself. File scanning sends a fingerprint of a file rather than the file itself, and the file is only ever uploaded if VirusTotal has never seen that fingerprint and you then choose to send that one file, from a prompt that spells out what uploading means. Nothing is uploaded automatically and a sweep of your installed apps never uploads anything. Call screening runs entirely on the device and never sends a number anywhere. The full detail is in the app's privacy policy in its repository.
If you email us, we hold that message only for as long as it takes to answer you.
Security reports
Report security issues to security@dresos.org rather than opening a public issue. Email reaches us immediately, whereas notifications from GitHub and elsewhere do not always get seen straight away. Please give us reasonable time to fix an issue before disclosing it.
We answer every email within 24 hours, provided it concerns one of our projects, repositories or the organisation itself. Sales pitches, scams and spam are not answered.
We publish our security posture openly, including the things we deliberately did not implement and why. Read it before assuming a behaviour is a bug.
Bug reports are welcome and genuinely useful. Include your device, Android version, ROM, root provider and the relevant logs, as our guide describes.
Licensing and reuse
Each project carries its own licence in its repository, and that licence governs. The Android guide is Creative Commons BY-NC-SA 4.0, the Magisk modules are GPL-3.0, and DresSecureComms is Apache-2.0.
You may study, modify and redistribute our work within the terms of the relevant licence. Keep the attribution and licence notices intact.
Do not redistribute our applications under our name with modifications, and do not sign a modified build with anything implying it came from us.
Third party software
Our guide recommends software we did not write. Those applications belong to their own authors and carry their own licences and terms, which you must follow.
We do not control them, cannot vouch for their future behaviour, and are not responsible for them. Always download them from the official sources our guide links to.
The same applies to services used alongside our software, including VirusTotal, F-Droid, IzzyOnDroid, GitHub and Ko-fi. Each has its own terms and privacy policy, and your use of them is between you and them.
Conduct
Zero tolerance for racism, violence, harassment and CSAM. Anything of that nature will be reported to the relevant authorities.
Be decent to people in our issue threads, forum posts and bug reports. Harassment, bullying and deliberate disruption are not tolerated.
Support requests should relate to our organisation, projects or services. Unrelated messages may not get a reply.
Follow the rules of the platforms our work is hosted on, including GitHub, F-Droid, IzzyOnDroid and XDA.
These terms may change. Continued use of our projects means you accept the current version.
Contact Us
Reach us through any of the channels below. For support requests, please make sure your message is related to our organization, projects, or services.
✉
Email
General enquiries, bug reports, and project feedback.
Response times vary. We are a small open source team and handle all support in our free time. We will always get back to you on project related questions.
