Duck Detector
Duck Detector surfaces detector cards for bootloader state, LSPosed / Zygisk traces, native root evidence, virtualization, TEE attestation trust, and other integrity signals while keeping most analysis local to the device.
A device-side Android security inspection app built around modular detectors instead of one monolithic scan flow.
- Local evidence collection for root-related tampering, runtime hooking, mount manipulation, attestation trust, and virtualized execution environments.
- Kotlin-first app layer with Jetpack Compose, feature-scoped packages, view models, repositories, coroutines, and DataStore-backed settings.
- Native probes through the Android NDK with C++, CMake, and arm64 assembly paths where syscall timing or mount visibility matters.