Home

HydraDragonAV Mobile

Welcome to the official wiki for HydraDragonAV Mobile, a multi-layered Android antivirus and security suite combining static analysis (YARA-X + ClamAV signatures + code anomaly detection), dynamic behavior analysis, and a lightweight on-device ML classifier — all gated by an NSRL-backed whitelist. When a flagged malware app is launched, it is automatically force-stopped and blocked in real time.

Requirements: Android 8.0 Oreo (API 26) or newer. Per-app dynamic network analysis (DNS/connection attribution) requires Android 10+; the rest of the suite runs on Oreo+.

Quick Links

• New here? Start with the Quick-Start-Guide — build and run in minutes.
• Why HydraDragonAV Mobile? See Why-HydraDragonAV-Mobile — no root, no ADB, no CA certs, no cloud needed.
• Building from source? See Installation-Setup — complete build instructions.
• Having issues? Check Troubleshooting — common problems and solutions.
• Play Protect / AV false positives? See False-Positives-Play-Protect — why sensitive permissions may trigger warnings.
• Understanding the architecture? See Architecture — system design and data flow.

Wiki Navigation

Core & Architecture

• Architecture: High-level system design, four core pillars, and component interactions.
• Performance-Optimization: Photon caching, concurrency, and memory tuning.
• Why-HydraDragonAV-Mobile: No root, no ADB, no CA certs, no cloud — why this approach.

Detection Engines

• Detection-Engines: Overview of all scanning technologies.
• YARA-X-Usage: Fast pattern matching with the custom hydradragon module (usage overview).
• YARA-X-Modules: Complete function-level reference for the custom modules, every rule file, and the .yar → .yrc build chain.
• ClamAV-Integration: Signature-based detection filtered for Android relevance.
• AI-ML-Models: Burn binary classifier, AIEngine logistic regression, and the MinHash benign whitelist.
• Ransomware-Defense: File traps, rename-burst detection, OCR, and Unicorn emulation.

Network Security

• Network-Security: Web Shield VPN, connection monitoring, MITM/ARP detection.
• Malicious-URL-Scanning: Embedded URL extraction and XOR-filter checking.

Behavioral & System Protection

• Behavioral-Protection: Clickjacking, notification spam mitigation, settings self-protection.
• NSRL-Whitelisting: Binary-fuse XOR filter and SQLite whitelist layers (NSRL MD5).

Data Pipeline & Signatures

• Data-Pipeline: Generating whitelists, IP/URL/domain XOR filters.
• Contributing: How to contribute code, rules, and reports.

API Reference (function-level)

• Rust-API-Reference: Every public function/struct across all 5 Rust crates (hydradragonandroid, hydradragonclamav, hydradragonml, hydradragonextractor, hydradragonxorfilter) + dev-tools — including all 24 JNI functions.
• Java-API-Reference: Every method across all 46 engine classes, 12 services, UI fragments/activities, models, views, adapters, security guards, and app entry.
• YARA-X-Modules: Every hydradragon/dex export function, the full JSON schemas, all 6 rule files, and the build chain.

Getting Started & Reference

• Quick-Start-Guide: Build and run in minutes.
• Current build: versionCode 30 / versionName 1.2.5 (minSdk 26 / targetSdk 35 / compileSdk 37). Active Threats counter, rich threat dialogs with clickable VirusTotal URLs, threat alerts as dialog overlays, AND-based auto-YARA rule generation, launcher-change detection, Base64-encoded URL extraction, and the hydradragon YARA-X custom module on the pulley portable-interpreter backend.
• Installation-Setup: Detailed requirements and build guide.
• Developer-Guide: Architecture deep-dive for contributors (real file structure, build steps).
• Troubleshooting: Common issues and FAQ.
• Known-Limitations: Current scanner and deployment limitations.
• Glossary: Technical terms and abbreviations.
• Roadmap: Future plans and planned improvements.