NullShell

Kali Linux, a code editor, a dev-tools browser and a file manager — in one APK. No root.

Download · Screenshots · Features · Build · Contribute

NullShell runs a full Kali Linux userspace through PRoot, directly from the app — terminal, code editor, in-app browser, file manager and desktop, all in one APK, no root required. Kali Linux is a trademark of OffSec; NullShell is not affiliated with or endorsed by it.

Screenshots

Why NullShell?

• Everything in one app. Terminal, editor with language servers, a browser with DevTools-style panels, a file manager and a VNC desktop, instead of juggling several apps.
• Made for security work on a phone. Point the built-in browser at your own mitmproxy, Caido or Burp using an app-private CA certificate, without touching the system trust store.
• Real Kali userspace. apt install the tools you already know, and run a full IceWM or Openbox desktop over VNC.
• Works out of the box. The PRoot runtime is bundled, so there is no manual setup step.
• Open source (MIT). Third-party components keep their own licenses, listed in THIRD_PARTY_NOTICES.md.

Quick start

1. Download the latest APK from Releases and install it (allow installs from your browser or file manager if Android asks).
2. Open NullShell and let it set up the Kali userspace on first launch.
3. Run apt update && apt install <your tools> in the terminal.

Requirements: an ARM64 device running Android 8.0 (API 26) or newer.

Features

Terminal

• A real Kali Linux userspace (ARM64), launched through PRoot — install packages with apt, run the tools you already know.
• Background jobs run as a foreground service, so long commands keep going while you switch apps.
• A pure-Java terminal fast path, scrollback limits and other memory controls so long sessions stay responsive on phones.
• Sessions live in a left-hand drawer (the ☰ button or a tap on the title); rename a session with the pencil or a long-press, and the top bar shows the current session's name and state.
• Nerd Fonts: download JetBrains Mono, Fira Code, Hack, Meslo, Caskaydia Cove, Ubuntu Mono or Sauce Code Pro (patched with icons for Starship, Powerlevel10k, eza, lsd and similar) from Settings > Terminal, with real bold.

Code editor

• Built on sora-editor, with TextMate-grammar syntax highlighting and Language Server Protocol support.
• Highlighting and/or an LSP-backed language server (for diagnostics, completion and formatting) for: Python, JavaScript, TypeScript, JSON, HTML, CSS, XML, Markdown, Shell, C, C++, YAML, Java, Kotlin, Lua, Go, Rust, PHP, Ruby, SQL, Dockerfile, Makefile, INI/config files and Diff/patch files.
• Language servers install on demand into the Kali userspace (e.g. pylsp, typescript-language-server, clangd, gopls, rust-analyzer, intelephense, solargraph), with per-server memory caps and idle shutdown.
• Large-file mode and tab unloading keep memory in check when editing big projects.
• Open text files from other apps directly into the NullShell editor, and jump from the editor to "show in file manager".

In-app browser

• Tabbed WebView browser with history, and app-private CA-certificate trust so you can point it at your own intercepting proxy (mitmproxy, Caido, Burp, etc.) without touching the system trust store.
• A desktop-style developer tools panel: Elements, Console, Network, Sources, Application, Security, Performance and a Device (user-agent/viewport) emulation panel, with a code-wrap toggle in the Elements/Sources views.

Custom commands (snippets)

• Save frequently used shell commands as reusable, named snippets with a one-tap run dialog.
• Flexible variables in a command template: typed/picked file and directory inputs, filters ({url|host}), derived defaults, masked secret fields ({pass*}), multi-select choices ({tags+,:a|b}), and conditional blocks ({if ...}) so one snippet can adapt to how you fill it in.

File manager

• A native file manager (browse, move, copy, rename, delete, open-with) covering both the app's own storage and the Kali rootfs.

Appearance

• 16 built-in themes covering the terminal, editor and UI, each with its own matching launcher icon (with an optional "match theme" switch), adjustable accent colour and corner roundness, and automatic day/night switching.

Networking

• A Network screen to view and copy your device's IP and Wi-Fi gateway, and discover other devices on the same Wi-Fi network or your phone's hotspot.

VNC server

• Start and stop a VNC server in Kali that shows an IceWM or Openbox desktop (choose in Settings), and connect to it from a separate VNC viewer app (for example bVNC or RealVNC Viewer). One-tap install and uninstall, a foreground notification with a Stop button, and an in-app log when something fails.
• Openbox comes with a tint2 panel along the bottom (window buttons, tray, clock and a Menu button that opens the app menu, so no right-click is needed). The panel takes its colours from the window theme when its config is first written.
• GTK file managers such as Thunar and PCManFM work inside the desktop: a small bwrap stand-in lets the image loaders run under PRoot, where bubblewrap sandboxes are not available.
• Settings for resolution (with presets, including your phone's own screen size), colour depth, scale (DPI), display number, password, localhost-only or network access, shared sessions, clipboard sharing, an auto-opened terminal, and extra server arguments. Software rendered, so there is no GPU acceleration.
• NullShell never overwrites your desktop config in Kali: the IceWM and Openbox/tint2 files are written only when they are missing (a starting point for a phone screen), and are yours after that. Set themes, icons and fonts up inside Kali with lxappearance, obconf, rofi and friends. Your own PNG/JPEG wallpaper (and how it fits) is set with feh at every desktop start without touching any file.
• Rices. Save your whole desktop look under a name (Settings > Rices): window manager and panel settings (Openbox, tint2, IceWM, rofi, picom, polybar, dunst, conky ...), GTK/Qt settings written by lxappearance, ~/.themes, ~/.icons, fonts and the wallpapers your configs use. Export it as one .nsrice file, import one from someone else, and apply any saved rice later. Only a fixed list of folders is ever read or written (never ssh keys, history or browser data), files that look like they hold keys are flagged before saving, applying a rice first backs up your current settings, and imports are checked entry by entry.

Building from source

NullShell is a standard Android Gradle project (Java, no Kotlin in the app module) and is primarily developed on-device with CodeAssist, but builds the same way with Android Studio or plain Gradle.

Requirements: JDK 17, Android SDK (compileSdk 36), and a device or emulator running Android 8.0 (API 26) or newer.

git clone https://github.com/<your-username>/NullShell.git
cd NullShell
./gradlew assembleDebug

The debug APK is written to app/build/outputs/apk/debug/. A GitHub Actions workflow (.github/workflows/build.yml) builds the same target on every push and pull request against main, and uploads the APK as a build artifact.

Native PRoot runtime (bundled)

The prebuilt ARM64 native libraries needed to start a Kali session are included in this repository under app/src/main/jniLibs/arm64-v8a/:

app/src/main/jniLibs/arm64-v8a/
    libproot.so
    libproot-loader.so
    libproot-loader32.so   (optional)
    libtalloc.so
    libandroid-shmem.so

These are PRoot, talloc and libandroid-shmem binaries taken unmodified from the Termux packages. They are third-party software under their own licenses (PRoot: GPL-2.0+, talloc: LGPL-3.0+, libandroid-shmem: BSD-3-Clause), not NullShell's own MIT-licensed code. Versions, source links and license texts are in THIRD_PARTY_NOTICES.md and the licenses/ directory.

Because they are bundled, a plain ./gradlew assembleDebug produces an APK that can start Kali sessions out of the box.

Updating the libraries (optional)

To refresh them from a newer Termux build, run this on an Android device in Termux:

pkg update
pkg install proot libtalloc libandroid-shmem
bash scripts/prepare-proot-from-termux.sh

scripts/prepare-proot-from-termux.sh copies the Termux binaries into jniLibs/arm64-v8a and patches PRoot's DT_NEEDED entry from libtalloc.so.2 to libtalloc.so, since Android extracts packaged native libraries under a flat nativeLibraryDir. Run scripts/verify-native-runtime.sh afterwards to confirm all required files are present. If you update the binaries, also update the versions in THIRD_PARTY_NOTICES.md.

Contributing

Issues, ideas and pull requests are welcome. If you hit a bug, open an issue with your device model, Android version and what you were doing. For code changes, build with ./gradlew assembleDebug first and keep pull requests focused. If NullShell is useful to you, a star helps other people find it.

License

NullShell's own source code is released under the MIT License.

NullShell bundles and depends on third-party software under their own licenses — sora-editor (LGPL-2.1), Eclipse LSP4J (EPL-2.0), Apache Commons Compress/XZ, bundled TextMate grammars, JetBrains Mono, and the PRoot/talloc/libandroid-shmem native runtime (GPL-2.0+/LGPL-3.0+/BSD-3-Clause, redistributed unmodified from Termux builds). See THIRD_PARTY_NOTICES.md for the full list, source links and license texts.