Area 08
Android malware rarely needs an exploit: it asks for accessibility, notification access or device admin and the user grants it. This area shows how to find sideloaded and disguised packages, review granted runtime permissions and special access, spot commercial stalkerware, and run the Mobile Verification Toolkit against a live device or a bugreport.
Key artifacts
How Android stalkerware and banking trojans abuse accessibility, notification listeners and device admin: settings keys, device_policies.xml and checks.
Android 8-16
runtime-permissions.xml and appops.xml: which dangerous permissions each app holds, grant flags, last access and reject times, and Privacy dashboard history.
Android 8-16
Android settings stores: settings_secure.xml, settings_global.xml and settings_system.xml, the forensic keys, ABX format and the settings command.
Android 8-16
Android's package manager state: packages.xml install and update times, installer and initiator, UIDs, signatures and permissions, packages.list and ABX.
Android 8-16
Android notification evidence: Android 11+ notification_history protobuf files with title and text, notification_log.db on 8 to 10, and dumpsys notification.
Android 8-16
Triage an Android phone for stalkerware and spyware: sideloaded APKs, accessibility, notification access, device admin, permissions, and MVT with androidqf.