eltavine/Duck-Detector-Refactoring

DuckDetector is an Android environment integrity inspection tool that diagnoses security-relevant signals on a device through on-device analysis backed by Kotlin and native probes.

The tool addresses the need to detect tampering, modification, and compromise on Android devices by collecting evidence across multiple integrity vectors. It examines boot state, searches for root and privilege escalation artifacts, detects runtime injection and hooking mechanisms, identifies mount namespace anomalies, checks for modified system properties, flags suspicious applications, validates KeyStore and attestation consistency, and looks for virtualization indicators. The approach combines a Jetpack Compose user interface with feature-oriented Gradle modules and a native C++ and assembly library to perform these checks efficiently on-device.

Developers should understand that DuckDetector produces diagnostic signals rather than definitive security verdicts. The tool suits applications that need to assess device integrity as part of their security posture, particularly those handling sensitive operations or data. It is available both as a standalone diagnostic application and as a UI-free SDK that other applications can embed for programmatic integrity checking. The project targets Android 10 and later devices.

The project maintains active build automation with passing workflows on the main branch. Development follows a feature-oriented modular architecture that separates concerns across Gradle modules. The codebase is written primarily in Kotlin with native components in C++ and assembly, indicating a performance-conscious approach to integrity detection. Documentation includes SDK integration guidance for developers embedding the tool in other applications.