diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..2bbb73dd
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "abstractcat"]
+	path = abstractcat
+	url = https://github.com/excitoon/abstractcat
diff --git a/abstractcat b/abstractcat
new file mode 160000
index 00000000..59d56840
--- /dev/null
+++ b/abstractcat
@@ -0,0 +1 @@
+Subproject commit 59d56840dbb08f948ba6b9f06c7726bcb34bd0bb
diff --git a/app/src/command.c b/app/src/command.c
index 8bb2b36c..4f4ae938 100644
--- a/app/src/command.c
+++ b/app/src/command.c
@@ -122,8 +122,9 @@ scp_execute(const char *const scp_cmd[], size_t len) {
 
 process_t
 ssh_execute(const char *endpoint, const char *const ssh_cmd[], size_t len,
-        const char *const ssh_options[], size_t ssh_options_len) {
-    const char *cmd[len + ssh_options_len + 3];
+            const char *const prefix_cmd[], size_t prefix_cmd_len,
+            const char *const ssh_options[], size_t ssh_options_len) {
+    const char *cmd[len + prefix_cmd_len + ssh_options_len + 3];
     unsigned i = 0;
     process_t process;
 
@@ -131,6 +132,8 @@ ssh_execute(const char *endpoint, const char *const ssh_cmd[], size_t len,
     memcpy(&cmd[i], ssh_options, ssh_options_len * sizeof(const char *));
     i += ssh_options_len;
     cmd[i++] = endpoint;
+    memcpy(&cmd[i], prefix_cmd, prefix_cmd_len * sizeof(const char *));
+    i += prefix_cmd_len;
     memcpy(&cmd[i], ssh_cmd, len * sizeof(const char *));
     i += len;
     cmd[i] = NULL;
diff --git a/app/src/command.h b/app/src/command.h
index 282df949..d69cddd4 100644
--- a/app/src/command.h
+++ b/app/src/command.h
@@ -62,6 +62,7 @@ scp_execute(const char *const ssh_cmd[], size_t len);
 
 process_t
 ssh_execute(const char *endpoint, const char *const ssh_cmd[], size_t len,
+            const char *const prefix_cmd[], size_t prefix_cmd_len,
             const char *const ssh_options[], size_t ssh_options_len);
 
 process_t
diff --git a/app/src/server.c b/app/src/server.c
index a4333e0d..d3489185 100644
--- a/app/src/server.c
+++ b/app/src/server.c
@@ -115,7 +115,7 @@ static bool prepare_ssh_socket_path(const struct server_params *params) {
         SSH_SOCKET_NAME,
     };
     process_t process = ssh_execute(params->ssh_endpoint, cmd, sizeof(cmd) / sizeof(cmd[0]),
-        NULL, 0);
+        NULL, 0, NULL, 0);
     return process_check_success(process, "ssh rm -f " SSH_SOCKET_NAME);
 }
 
@@ -267,17 +267,6 @@ log_level_to_server_string(enum sc_log_level level) {
     }
 }
 
-static process_t
-execute_socket_forwarding(const struct server_params *params) {
-    const char *const cmd[] = {
-        "/data/ssh/root/socat",
-        "abstract-listen:" SOCKET_NAME ",fork,reuseaddr",
-        "unix-connect:" SSH_SOCKET_NAME
-    };
-    return ssh_execute(params->ssh_endpoint, cmd, sizeof(cmd) / sizeof(cmd[0]),
-        NULL, 0);
-}
-
 static process_t
 execute_server(struct server *server, const struct server_params *params) {
     char max_size_string[6];
@@ -293,7 +282,7 @@ execute_server(struct server *server, const struct server_params *params) {
     const char *const cmd[] = {
         params->use_ssh ? "ANDROID_DATA=/data" : "shell",
         "CLASSPATH=" DEVICE_SERVER_PATH,
-        "app_process",
+        "/system/bin/app_process",
 #ifdef SERVER_DEBUGGER
 # define SERVER_DEBUGGER_PORT "5005"
 # ifdef SERVER_DEBUGGER_METHOD_NEW
@@ -341,6 +330,13 @@ execute_server(struct server *server, const struct server_params *params) {
             "-R", tunnel_desc,
         };
 
+        const char *const prefix_cmd[] = {
+            "/data/ssh/root/abstractcat",
+            "@" SOCKET_NAME, // Source.
+            SSH_SOCKET_NAME, // Destination.
+            "2", // Maximum connections to forward.
+        };
+
         for (uint16_t port = server->port_range.first;;) {
             server->server_socket = listen_on_port(port);
             if (server->server_socket == INVALID_SOCKET) {
@@ -363,6 +359,7 @@ execute_server(struct server *server, const struct server_params *params) {
             snprintf(tunnel_desc + strlen(tunnel_desc) - 5, 6, "%d", port);
 
             return ssh_execute(params->ssh_endpoint, cmd, sizeof(cmd) / sizeof(cmd[0]),
+                prefix_cmd, sizeof(prefix_cmd) / sizeof(prefix_cmd[0]),
                 ssh_options, sizeof(ssh_options) / sizeof(ssh_options[0]));
         }
     }
@@ -452,13 +449,8 @@ server_start(struct server *server, const char *serial,
         goto error1;
     }
 
-    if (params->use_ssh) {
-        if (!prepare_ssh_socket_path(params))
-            goto error1;
-        server->socket_forwarder = execute_socket_forwarding(params);
-        if (server->socket_forwarder == PROCESS_NONE)
-            goto error1;
-    }
+    if (params->use_ssh && !prepare_ssh_socket_path(params))
+        goto error1;
 
     if (!params->use_ssh && !enable_tunnel_any_port(server, params->port_range,
                                 params->force_adb_forward)) {
@@ -482,10 +474,6 @@ server_start(struct server *server, const char *serial,
     if (!server->wait_server_thread) {
         cmd_terminate(server->process);
         cmd_simple_wait(server->process, NULL); // ignore exit code
-        if (server->use_ssh) {
-            cmd_terminate(server->socket_forwarder);
-            cmd_simple_wait(server->socket_forwarder, NULL); // ignore exit code
-        }
         goto error2;
     }
 
@@ -572,12 +560,8 @@ server_stop(struct server *server) {
     }
 
     assert(server->process != PROCESS_NONE);
-    cmd_terminate(server->process);
 
-    if (server->use_ssh) {
-        assert(server->socket_forwarder != PROCESS_NONE);
-        cmd_terminate(server->socket_forwarder);
-    }
+    cmd_terminate(server->process);
 
     if (server->tunnel_enabled && !server->use_ssh) {
         // ignore failure
diff --git a/app/src/server.h b/app/src/server.h
index fbb49cc5..43ed02a7 100644
--- a/app/src/server.h
+++ b/app/src/server.h
@@ -16,7 +16,6 @@
 struct server {
     char *serial;
     process_t process;
-    process_t socket_forwarder;
     SDL_Thread *wait_server_thread;
     atomic_flag server_socket_closed;
     socket_t server_socket; // only used if !tunnel_forward
@@ -32,7 +31,6 @@ struct server {
 #define SERVER_INITIALIZER { \
     .serial = NULL, \
     .process = PROCESS_NONE, \
-    .socket_forwarder = PROCESS_NONE, \
     .wait_server_thread = NULL, \
     .server_socket_closed = ATOMIC_FLAG_INIT, \
     .server_socket = INVALID_SOCKET, \