// the find
asLody/VirtualApp
Virtual Engine for Android(Support 14.0 in business version)
VirtualApp is an Android process-level sandbox that lets you run apps inside apps without root — it intercepts every system service call at the Java, native, and Binder layers and re-routes them through its own fake Android framework. The open-source repo on GitHub stopped updating in December 2017; what you're looking at is an 8-year-old museum exhibit. The actual product is a paid commercial SDK available only via a WeChat contact.
- The interception architecture is genuinely sophisticated: hooking at three layers (dynamic Java proxies for Binder calls, inline native hooks for libc/IO, and more recently Seccomp-BPF) means it can intercept things that most sandbox approaches miss entirely.
- The 32/64-bit dual-package design is a real engineering solution to a hard constraint — Android won't let a single process run in both ABIs, and VA's split-package approach handles this without requiring the user to pick one.
- Near-native runtime performance because it's a process-level sandbox, not an interpreter or emulator — the guest app code runs directly on ART, not through any translation layer.
- The commercial changelog (700+ entries from 2017–2026) shows they track compatibility regressions obsessively against specific popular apps like WeChat, Douyin, and WhatsApp, which matters for anyone building multi-account tooling.
- The public code is frozen at Android 8.0-era internals. Running it on anything Android 9+ requires significant surgery; on Android 12+ it simply doesn't work. The README is upfront about this but it means this repo is useless as a starting point without the commercial license.
- The whole approach is load-bearing on Android's internal, non-public APIs — every major Android release breaks something, as evidenced by hundreds of 'API adaptation' entries in the changelog. You are permanently on a treadmill chasing Android internals that Google never promised to keep stable.
- Serious legal and platform risk: the primary use cases listed (account cloning, device fingerprint spoofing, bypassing app integrity checks, data harvesting from sandboxed apps) will get your app pulled from the Play Store and potentially violate anti-cheating agreements in gaming contexts. The README's threat to report users to law enforcement for unlicensed use adds another layer of exposure.
- No real documentation in English, no public issue tracker for the version that actually works, and a sales funnel gated entirely on WeChat DMs — if you adopt this and hit a compatibility bug on a new Android version, your only recourse is to pay more and wait.