Skip to content

Developer Guide

Jump to bottom
Emirhan Uçan edited this page Jul 7, 2026 · 13 revisions

Developer Guide

Deep-dive into the HydraDragonAV Mobile codebase for contributors.

Project Structure

HydraDragonAV-Mobile/
├── app/                          # Android application module
│   ├── src/main/java/            # Java/Kotlin source
│   │   ├── com/hydradragon/av/   # Main app package
│   │   │   ├── engine/           # ScanEngine + NativeScanner
│   │   │   ├── services/         # GuardService, DnsVpnService, etc.
│   │   │   ├── accessibility/    # DynamicAnalysisService
│   │   │   ├── screen/           # ScreenCaptureService
│   │   │   ├── network/          # NetworkSecurityScanner/Monitor
│   │   │   ├── models/           # ML model interfaces
│   │   │   └── ui/               # Settings and UI
│   └── src/main/jniLibs/        # Compiled native .so files
├── hydradragonandroid/           # Native Rust engine
│   ├── src/                      # Rust source
│   │   ├── jni_bridge.rs         # JNI interface
│   │   ├── scanner.rs            # Main scan orchestrator
│   │   ├── yara.rs               # YARA-X integration
│   │   ├── clamav.rs             # ClamAV integration
│   │   ├── tlsh.rs               # TLSH fuzzy hashing
│   │   ├── ml.rs                 # ML anomaly detection
│   │   ├── url_scanner.rs        # URL extraction + XOR filter check
│   │   └── emulation.rs          # Unicorn CPU sandbox
│   └── Cargo.toml                # Dependencies
├── hydradragonclamav/            # ClamAV bindings crate
├── hydradragonml/                # ML model crate
├── hydradragonextractor/         # Archive extraction crate
├── hydradragonxorfilter/         # XOR filter crate
├── yara-x/                       # YARA-X rules directory
├── database/                     # ClamAV signature databases
├── database_non_filtered/        # Unfiltered ClamAV databases
├── whitelist/                    # NSRL whitelist data
├── allxfilter/                    # URL XOR filters
├── allips/                       # Malicious IP lists
└── *.py                          # Data pipeline scripts

Native Engine (Rust)

The native Rust engine (libhydradragonandroid.so) communicates with Java via JNI.

Key Crates

Crate Purpose
hydradragonandroid Main engine — JNI bridge, scan orchestration
hydradragonclamav ClamAV libclamav Rust bindings
hydradragonml MinHash/LSH + Isolation Forest + AIEngine
hydradragonextractor Archive extraction (zip/gz/tar/xz/lzma/7z/rar)
hydradragonxorfilter Binary-fuse XOR filter implementation

Building

cd hydradragonandroid
build-android.cmd

Or with specific ABI:

build-android.cmd -Abi arm64-v8a

Adding a New YARA Rule

  1. Add the rule to yara-x/*.yar
  2. Validate: yara-x check yara-x/your_rule.yar
  3. Rebuild the native engine and APK

Updating YARA-X Dependency

After making changes to the yara-x fork (e.g. adding module functions), update the Cargo.lock in both dependent crates:

cd hydradragonclamav
cargo update
cd ../dev-tools/hydradragon_yara_x_compile
cargo update

This pins the lock files to the latest commit without triggering a full rebuild. Use cargo update -p yara-x to update only the yara-x packages if preferred.

Android App (Java/Kotlin)

The Android app is a standard Gradle project targeting API 29+.

Key Services

Service Type Purpose
GuardService Foreground Service 24/7 monitoring and scan orchestration
DynamicAnalysisService Accessibility Service On-screen text scanning, clickjacking prevention
ScreenCaptureService MediaProjection Periodic screen OCR
DnsVpnService VpnService DNS filtering (Web Shield)

Code Standards

Rust

  • cargo clippy -- -D warnings must pass
  • Use rustfmt for formatting
  • JNI functions must follow the Java_com_hydradragon_av_* naming convention
  • All unsafe blocks must have safety comments

Java/Kotlin

  • Follow Android AOSP style guidelines
  • Use dependency injection where practical
  • Services must handle lifecycle properly (particularly VpnService and AccessibilityService)

Testing

Unit Tests

./gradlew test

Native Tests

cd hydradragonandroid && cargo test

Manual Testing

  1. Build debug APK and install on a physical device or emulator (Android 10+)
  2. Verify all permission flows
  3. Test scan with known EICAR/malware test files
  4. Test accessibility and VPN service toggles

See Also

Clone this wiki locally