Duck Apps

Version: 2026.08.15-fd211f8df1bf (512) APK: Duck Detector-2026.08.15-fd211f8df1bf.apk Commit: fix(native): isolate seccomp probes and clean up SELinux AVC (#108) Author: 小潼 Branch: master@fd211f8d Build time: 7m 20s Signature: verified : by Eltavine

Version: 2026.08.15-de2e72c14050 (511) APK: Duck Detector-2026.08.15-de2e72c14050.apk Commit: fix: tighten proc mount view scanning (#107) Ensure the WebView sampler is attached before Compose starts, accurately track scanned PIDs, and stop mount scanning immediately after detecting a direct root token. Add regression coverage for the new early-exit behavior. Author: 小潼 Branch: master@de2e72c1 Build time: 6m 34s Signature: verified : by Eltavine

Version: 2026.08.14-f1a87e4f93e2 (510) APK: Duck Detector-2026.08.14-f1a87e4f93e2.apk Commit: fix(mount): move cross-process mount detection into mount scan (#105) Move the isolated-process `/proc/<pid>/mountinfo` detection out of the native-root detector and make it part of the mount scan, so cross-process mount visibility evidence is owned and evaluated together with other mount-layer signals. Remove the standalone `ProcMountViewDivergenceProbe` and all corresponding native-root report, method, and UI plumbing, avoiding duplicate ownership and keeping the root detector focused on native-root-specific evidence. Author: 小潼 Branch: master@f1a87e4f Build time: 6m 56s Signature: verified : by Eltavine

Version: 2026.08.13-fc94d5d30ebe (509) APK: Duck Detector-2026.08.13-fc94d5d30ebe.apk Commit: fix(tee): harden KeyMint identity, VINTF validation, and MGF1 probing (#104) Tighten TEE verification around KeyMint runtime identity, VINTF declarations, and RSA-OAEP MGF1 capability probing. The previous implementation could infer a stricter KeyMint backend from conflicting version signals, treat an unexecuted MGF1 probe as a cryptographic failure when security-level identity was inconsistent, and apply overly permissive VINTF matching without considering the vendor API level. Author: 小潼 Branch: master@fc94d5d3 Build time: 7m 01s Signature: verified : by Eltavine

Version: 2026.08.13-3ca03d3c628b (507) APK: Duck Detector-2026.08.13-3ca03d3c628b.apk Commit: fix(tee): make RSA-OAEP MGF1 probing backend-aware (#101) Replace the RSA-OAEP MGF1 capability checks with a backend-aware keystore2/KeyMint probe instead of relying on AndroidKeyStore's public framework API surface. Author: 小潼 Branch: master@3ca03d3c Build time: 6m 56s Signature: verified : by Eltavine

Version: 2026.08.12-5be62652f2f3 (506) APK: Duck Detector-2026.08.12-5be62652f2f3.apk Commit: Merge pull request #100 from XiaoTong6666/master fix: handle isolated process paths in virtualization probe payload Author: 芙兰朵布丁 Branch: master@5be62652 Build time: 6m 42s Signature: verified : by Eltavine

Version: 2026.08.12-dbc9aaebd54d (504) APK: Duck Detector-2026.08.12-dbc9aaebd54d.apk Commit: feat(nativeroot): port Privisolated cross-process mount view probe (#98) Port the cross-process mountinfo divergence detector from LSPosed/Privisolated (https://github.com/LSPosed/Privisolated, by vvb2060). A new pure-JVM scanner runs inside the isolated helper process, enumerates /proc/<pid>/mountinfo of every visible process, counts distinct mount tables, and detects hidden mount divergence plus direct root tokens (magisk/KSU//adb/). The nativeroot card gains a procMountViewDivergence method row, findings, and detail rows. Author: 小潼 Branch: master@dbc9aaeb Build time: 6m 28s Signature: verified : by Eltavine

3 Green BASICI✅ DEVICE✅ STRONG✅

特权隔离 本应该是Android系统中最受限的隔离进程，却拥有众多特权，非常奇妙。 0. 随机uid，曾经的magiskhide绕过方案，magisk已处理。 https://t.me/magiskalpha/255 1. app zygote的setuid权能在selinux关闭时不受限制，已失效。 https://t.me/vvb2060_Channel/81 2. app zygote可以检测selinux状态，ksu已处理。 https://t.me/magiskalpha/714 3. app zygote native没有unshare，和init挂载命名空间相同，无法隐藏。 https://t.me/vvb2060_Channel/60 现在，我们又发现了一个隔离进程的特权：遍历进程。隔离进程拥有gid 3009，可以不受限访问/proc。 这是从隔离进程诞生起就拥有的能力，但10年来无人发现。2020年Project Zero偶然发现app zygote拥有gid 3009，可惜的是，没有发现存在时间更久的隔离进程有一模一样的问题，并且修复补丁特意忽略了隔离进程情况，只对is_child_zygote清空groups，真是哭笑不得。 由于我们在某加固壳中观察到了野外利用，因此决定直接公开该漏洞细节。我们还编写了一个poc，以检测root为例： https://github.com/LSPosed/Privisolated

https://github.com/LSPosed/Privisolated

The update service is now available

Version: 2026.08.10-df12d44def51 (503) APK: Duck Detector-2026.08.10-df12d44def51.apk Commit: Update README.md and remove some duplicate information Author: Eltavine Branch: master@df12d44d Build time: 6m 33s Signature: verified : by Eltavine

Version: 2026.08.10-5dbb4d8c67d2 (502) APK: Duck Detector-2026.08.10-5dbb4d8c67d2.apk Commit: ci: harden nightly release updates Co-authored-by: NEURAX-FX <234716687+NEURAX-FX@users.noreply.github.com> Author: Eltavine Branch: master@5dbb4d8c Build time: 6m 26s Signature: verified : by Eltavine

Duck Apps pinned «GitHub Discussions is now available https://github.com/eltavine/Duck-Detector-Refactoring/discussions»

GitHub Discussions is now available https://github.com/eltavine/Duck-Detector-Refactoring/discussions

Version: 2026.08.08-3c137eccab46 (498) APK: Duck Detector-2026.08.08-3c137eccab46.apk Commit: Updating this software's dependencies to prove I'm still alive Author: Eltavine Branch: master@3c137ecc Build time: 9m 00s Signature: verified : by Eltavine

I'm back

Version: 2026.07.31-490cfbce5b6a (496) APK: Duck Detector-2026.07.31-490cfbce5b6a.apk Commit: Updating this software's dependencies to prove I'm still alive Author: Eltavine Branch: master@490cfbce Build time: 7m 12s Signature: verified : by Eltavine

Version: 2026.07.30-d1e9257cab46 (495) APK: Duck Detector-2026.07.30-d1e9257cab46.apk Commit: Merge pull request #93 from MhmRdd/feat/keystore2-postprocessing-detection feat(tee): detect keystore2 certificate post-processing via split attest path Author: 芙兰朵布丁 Branch: master@d1e9257c Build time: 6m 59s Signature: verified : by Eltavine