Shizzi - Unlimited Hotspot Bypass for non-rooted devices!
TL;DR: Blew my monthly hotspot cap on a road trip and didn't want to root my phone to fix it, so I built Shizzi. It uses Shizuku and Android's hidden TestNetworkManager API to make your hotspot's upstream a TUN interface the app owns, then re-originates that traffic from the phone itself. Tethered traffic looks like normal on-device traffic. No root. IPv6 isn't handled yet.
I was just recently on a road trip when I blew my monthly hotspot usage on twenty minutes of a 4K stream of Avengers Infinity War. Back when my phone was rooted, this was a super simple fix, but I stopped rooting my phone for privacy reasons (it was also just a major pain in the butt). To my knowledge there's no real way to do this without just using something like TetherFi, but that has its own drawbacks and it's not always stable.
Anyway, I went looking around and found this thread for VPNHotspot (which is root-only), which led me to this open PR for v2rayNG (which I hadn't even heard of till a couple days ago) and therein lay the solution to my very annoying problem!
How it works
It creates a TUN interface via the hidden TestNetworkManager API (hence Shizuku) and tells Android to use it as the preferred tethering upstream. Hotspot traffic stops being forwarded by the kernel and gets pulled into a userspace Go datapath running on the phone.
That distinction is the whole trick. Normally your phone routes your laptop's packets: it passes them along and decrements the hop limit on the way out, which is the tell most carriers key on. Shizzi terminates those connections in userspace and opens fresh ones from the phone's own network stack, so what leaves the device is indistinguishable from ordinary on-device traffic.
Android still handles DHCP, NAT, and the hotspot itself. Shizzi only owns the upstream.
Requirements
- Android 13+, arm64
- Shizuku 13.6.0+, running and granted
- No root
Known limitations
- IPv6 is not suppressed on the downstream. If your carrier hands out IPv6 and your client uses it, that traffic can bypass the tunnel.
- Tested on a Pixel 10a. If it breaks on yours, please open an issue with your device and Android version.
- This defeats hop-limit inspection, which is the common detection method, not every method. Some carriers meter tethering device-side or over a separate APN. It's worth checking whether your hotspot counter actually stops moving.
Source and APK: https://github.com/carlelieser/shizzi
Feedback and device reports welcome, especially from anyone on a non-Pixel. This scratched my own itch on a road trip and I'd like it to work on more than just my phone.