Shizuku guide

Safety

Safety and how to undo everything

Shizuku is not root, and it is gone after a restart. What apps do with it can stay. Here is what to know, and how to put everything back.

On this page

What Shizuku is, and isn't

  • Shizuku runs a helper process with the powers adb has (the shell user), or root powers if your phone is rooted. Apps you allow can ask that helper to use system functions for them.
  • It does not root your phone. Without root it can only do what adb can do. That is limited, and it differs between Android versions. It can't reach /data or other apps' private data, it can't run in other users, and it can't start itself again after it was stopped without you.
  • Every app has to ask you first. You can say no, and you can take access back per app in Shizuku's list of authorized apps. On Android 17 that list currently shows empty.
  • Shizuku doesn't survive a restart. A restart, or turning off both USB debugging and Wireless debugging, ends it. Shizuku itself changes nothing for good.
  • But changes an app makes through Shizuku can stay, such as apps it disabled or permissions it granted. Undo those in that app, before you stop Shizuku.

Sources: Shizuku introduction, Shizuku README, Issue 413, Issue 393, Discussion 322, Issue 451, Issue 1965, Shizuku setup guide, Discussion 1000, Issue 147

The risks, honestly

  • Other apps can see that Developer options is on. Some banking, payment and game apps refuse to run while it is on, or even when Shizuku is only installed. A work profile or second space only sometimes helps. On OxygenOS you can hide an app from other apps, and Shizuku keeps working while hidden.
  • Only install the official app. Its id is moe.shizuku.privileged.api, and it comes from GitHub releases or Google Play. A fake copy would get the same powers as the real one.
  • Every app you allow can use adb powers. Allow only apps you trust, and take access back from apps you no longer use.
  • Some brands make you lower a protection to use Shizuku: Samsung Auto Blocker off, Xiaomi USB debugging (Security settings) on, OnePlus and OPPO Disable permission monitoring on, Huawei charge only debugging on, GrapheneOS Secure app spawning off, Meizu Flyme payment protection off. Turn them back when you are done (below).

Sources: Issue 595, Issue 1340, Issue 1980, Issue 523, Shizuku README, Issue 1431, Shizuku setup guide, Samsung support: Auto Blocker, Issue 226, Issue 54

Undo everything

In this order. Each step is one action; tick them as you go.

  1. In each app that used Shizuku, undo what it changed, while Shizuku still runs. For Firewall and Fileglow, see below.

  2. In Shizuku, switch off every app in the list of authorized apps.

  3. Stop Shizuku: use its stop option, or restart the phone.

  4. Open Developer options, then Wireless debugging, then Paired devices, tap shizuku, then Forget.

  5. In Developer options, tap Revoke USB debugging authorizations. This clears every paired computer and device.

  6. Turn off Wireless debugging, then USB debugging.

  7. Turn off Disable adb authorization timeout if you turned it on. Set Default USB configuration back to file transfer if you want.

  8. Undo your brand's extra switches (table below).

  9. Turn off the switch at the top of Developer options.

  10. Set Shizuku's battery setting back to Optimized and take it off any lists such as Never sleeping apps or Autostart.

  11. Uninstall Shizuku the normal way, if you no longer need it.

Brand switches to undo
BrandUndo this too
SamsungTurn Auto Blocker back on.
Xiaomi, Redmi, POCOTurn off USB debugging (Security settings). Turn MIUI optimization back on if you turned it off.
OnePlus, OPPO, realmeTurn off Disable permission monitoring or Disable system optimization.
Huawei, HonorTurn off Allow ADB debugging in charge only mode.
GrapheneOSTurn Secure app spawning back on.
MeizuTurn Flyme payment protection back on.

Shizuku won't uninstall? The usual causes:

  • A device owner app such as Island or Ice Box is active. That caused restarts on uninstall.
  • On HarmonyOS 3.0, stop Shizuku and take back every app's access first.

As a last resort, from a computer:

adb uninstall moe.shizuku.privileged.api

Sources: Shizuku setup guide, Android adb docs, Samsung support: Auto Blocker, Issue 467, Issue 451, Discussion 1000, Issue 83, Issue 2490, Issue 526, Issue 2349

Zanoshky apps that use Shizuku

The author of this guide makes two apps that can use Shizuku. Here is exactly what each does with it, from a read only code audit in November 2026 (Firewall 1.38).

Zanoshky Firewall: Pro Kill switch

Firewall normally blocks with its own VPN. The Pro Kill switch uses Shizuku to cut chosen apps off the network with Android's own firewall.

What it runs through Shizuku

These commands, and nothing else. Each runs as a list of words, never through a shell, so a name can't sneak in another command. App names are checked before each command.

Commands Firewall runs
CommandWhen
cmd connectivity helpOnce, to see whether the commands exist on your phone.
cmd connectivity get-chain3-enabledBefore turning the chain on, to see whether something else already did.
cmd connectivity set-chain3-enabled trueWhen the Kill switch is on and the firewall runs.
cmd connectivity set-chain3-enabled falseWhen it lets go, only if Firewall turned the chain on itself.
cmd connectivity set-package-networking-enabled false PACKAGETo cut each app you set to Blocked off the network.
cmd connectivity set-package-networking-enabled true PACKAGETo give an app its network back.
pm grant com.zanoshky.firewall android.permission.WRITE_SECURE_SETTINGSWhen you turn the Kill switch on. See below.

No iptables, no appops, no settings commands, no disabling or uninstalling apps, no file access.

What it can touch
  • It never touches files.
  • It only cuts the network of apps you chose, through Android's own firewall chain (called chain3).
  • It never cuts off core system apps (Android refuses those too), the network stack, System UI, Settings, the captive portal login, the phone and calling services, Google Play services, your launcher, Shizuku, or Firewall itself. Other system apps only if you set the rule yourself.
A restart clears it

A phone restart clears every Kill switch rule; the audit checked this against Android's source. Firewall puts the rules back only if the switch is still on, the firewall starts by itself, and you start Shizuku again.

Know this
  • Turn the Kill switch off before you uninstall Firewall or clear its storage; from Firewall 1.39 the Kill page says this too. Android gives an app no warning before it is removed, so Firewall can't do it for you. Otherwise the blocked apps stay offline until you restart the phone. Clearing storage also makes Firewall forget which apps it cut off. Force stopping it and never opening it again has the same effect.
  • If Shizuku isn't running when you turn the switch off, the apps stay cut off until Shizuku runs again (then Firewall lifts them) or you restart the phone. From Firewall 1.39 the Kill page says so and counts the apps still cut off, and the notice comes at once instead of up to 12 hours later.
  • A rule hits the same app in your work profile, Private Space and other users too, because Android applies it to the app in every user.
  • When you turn the Kill switch on, Firewall also grants itself the WRITE_SECURE_SETTINGS permission through Shizuku. The permission screen in Firewall lists it, and from Firewall 1.39 the Kill switch page says so too (older versions said Shizuku was used for nothing else). It uses it to switch Private DNS to Automatic while it runs, and puts your setting back when it stops. The permission stays until you take it back or uninstall. If Firewall is killed or crashes while running, from Firewall 1.39 it puts your Private DNS back the next time it starts. If it was uninstalled or its storage cleared while running, check your Private DNS setting yourself.
  • Other Shizuku firewalls use the same chain. On some Android 13 builds, Firewall letting go can also lift another tool's blocks. That only ever gives apps network back.

Undo it by hand

  1. In Firewall, with Shizuku running, turn the Kill switch off in Settings, or switch the firewall off. Either lifts every rule. Check the Kill page no longer shows a count.

  2. Shizuku not running? Start it and open Firewall; it lifts the rules on its own. Or just restart the phone.

  3. A restart clears every rule.

  4. No restart possible? From a computer (or a rish shell), check the chain:

    adb shell cmd connectivity get-chain3-enabled

    Check one app (Android 13 or newer). Put the app's package name in place of PACKAGE:

    adb shell cmd connectivity get-package-networking-enabled PACKAGE

    Give that app its network back:

    adb shell cmd connectivity set-package-networking-enabled true PACKAGE

    Or lift every chain3 block at once:

    adb shell cmd connectivity set-chain3-enabled false

  5. Private DNS: open Settings, then Network & internet, then Private DNS and put your hostname back. Or from a computer, with your hostname in place of HOSTNAME:

    adb shell settings put global private_dns_specifier HOSTNAME
adb shell settings put global private_dns_mode hostname

    Check it:

    adb shell settings get global private_dns_mode

  6. Take back the permission (uninstalling also drops it):

    adb shell pm revoke com.zanoshky.firewall android.permission.WRITE_SECURE_SETTINGS

  7. In Shizuku's list of authorized apps, switch Firewall off. Stop Shizuku if nothing else uses it.

  8. Uninstall: do step 1 first. If the app is already gone, restart the phone, or run step 4.

Turning the chain off makes every block stop working at once. The entries stay until a restart, and would work again if something turned the chain back on.

Sources: Zanoshky app audit, November 2026

Fileglow: Pro App data

Fileglow is a file manager. Pro App data uses Shizuku to open the app folders Android normally hides: Android/data, Android/obb and Android/media.

What it runs through Shizuku

No shell commands at all. Shizuku starts a small file helper for Fileglow, and that helper can only list a folder, read a file's details, open a file to read or write, make one folder, delete one file or one empty folder, rename (refused if the new name exists), and set a file's date.

What it can touch
  • Only the Android folder on each storage. Every action is checked first; paths that lead outside, through .. or links in folders, are refused.
  • Inside it, everything the shell user may change, in every app's folder. That is the point of the feature. It only acts when you tap.
  • Deleting there is permanent. Fileglow asks first (Delete for good?) and says it can't be undone. Moves and renames have Undo.
  • It changes no system setting, firewall rule or permission.
When it stops

The helper lives only while Fileglow uses it. Closing or force stopping Fileglow ends it, and so do stopping Shizuku and a restart.

Know this

The audit found small edge cases, rated low: a link another app plants in its own folder could let the helper list or read one place outside Android, and a file name with a tab or line break in it could make Fileglow show the wrong name, or act on another file in the same folder. What it reads goes to you, not to that app.

Undo it by hand

  1. Leave App data. Force stop Fileglow or swipe it away; its helper ends with it. To check from a computer:

    adb shell ps -A | grep fileglow

    To stop it:

    adb shell am force-stop com.zanoshky.fileglow

  2. In Shizuku's list of authorized apps, switch Fileglow off.

  3. Files: undo moves and renames in Fileglow with Undo. Deletions in App data can't be undone. Nothing else needs undoing, and uninstalling leaves nothing behind.

Sources: Zanoshky app audit, November 2026