What is Priv Kit?

Priv Kit is an app-owned privileged runtime for Android. It lets a single application start, connect to, and manage its own Privileged Server through Root, ADB, Manual, or an external authorization bridge. Once connected, the application can use explicit Binder primitives, the built-in file proxy, or its own UserService while keeping domain logic under its control.

Most applications start with priv-ui, which provides the Compose authorization page and coordinates the runtime. priv-core is the lower-level option for a custom authorization interface.

Want to try it? Jump to Getting started.

What Priv Kit provides

Privilege UI for standard integration

priv-ui provides the ready-to-embed authorization page. It presents startup status, Wireless Debugging pairing, permissions, TCP/IP confirmation, Manual commands, and exact silent replay. Applications can use the supplied flow without rebuilding those interactions.

priv-core for custom interfaces

priv-core provides the runtime and transport APIs behind Root, wireless ADB, static TCP, Manual, and app-provided external bridges. A custom interface adds its own permission prompts, pairing input, confirmations, and error presentation. See startup methods for the underlying flows.

Binder building blocks

Priv Kit can resolve an explicit system service and perform raw Binder transactions without hiding the original contract or failure semantics. The application remains responsible for the service interface, transaction format, and domain behavior. Read the Binder guide for the available primitives.

Built-in file proxy

Basic absolute-path file operations can run directly in the Privileged Server without an application-defined UserService. Content uses real file descriptors, and directory entries stream over a pipe. Read the file proxy guide for its java.io.File-compatible return semantics and deliberate safety limits.

Application-defined UserService

When raw transactions are not the right boundary, an application can define its own AIDL interface and privileged implementation. Priv Kit manages the UserService lifecycle, process mode, and Binder handoff while the application owns the API and behavior. Read the UserService guide to choose an embedded or dedicated process.

Why is the runtime app-owned?

One application owns one Privileged Server and controls its startup, identity, connection state, recovery, and domain logic. Shared, device-wide services sit outside this runtime model.

Every startup method still converges on the same validated connection model. The runtime observes server death and connection failures instead of presenting an uncertain result as success.

Where to start

• Follow Getting started to add priv-ui and embed the authorization page.
• Configure the supplied foreground and silent flows in Privilege UI.
• Read startup methods when building a custom priv-core interface.
• Choose the file proxy for basic filesystem access, Binder for raw transactions, or UserService for an application-defined AIDL service.
• Browse the source and report issues on GitHub.