Known Limitations

HydraDragonAV Mobile is an ongoing development project. These limitations are currently expected behavior.

Platform Limitations

Limitation	Details
Android 10+ only features	`ConnectivityManager.getConnectionOwnerUid` for per-app network attribution requires API 29. The rest of the suite still runs on older versions, but per-app connection attribution is unavailable.
No root support	The app refuses to run on rooted devices (`RootCheck`). This is by design — a rooted device cannot guarantee the integrity of the detection stack.
One VPN at a time	Android's `VpnService` only allows one active VPN. Web Shield will not work alongside other VPN apps.
Accessibility Service may be killed	Some manufacturers aggressively optimize battery by stopping accessibility services. Add the app to your battery optimization whitelist.
MediaProjection restrictions	Some devices (Android TV, automotive) do not support MediaProjection. ScreenCaptureService is unavailable on those platforms.

Limitation	Details
Maximum file size	User-configurable from 10 MB to 2048 MB (default 650 MB). Files above the limit are skipped entirely — not partially scanned.
Minimum buffer size	Any extracted buffer of 12 bytes or less is never scanned, regardless of content — too small to carry a meaningful signature match, and scanning it would only add overhead.
Archive depth	Nested archives are extracted and scanned, but extreme nesting may hit resource limits.
Decompression-bomb rejection	Toggleable in settings. When enabled (default), any single decompressed unit exceeding 200 MB, or exceeding a 1000:1 output:input ratio past a 10 MB floor, is rejected and flagged as a detection (`HDR.Bomb.Decompression`) instead of being fully decompressed. Disabling this setting removes the cap — not recommended, as a bomb can then consume unbounded CPU/memory during extraction.
NSRL coverage	Only Android-relevant NSRL packages are included. Some legitimate apps may not be in the whitelist.
ClamAV scope	Only Android-filtered signatures are used. Windows/macOS-specific malware is not covered.
File-type gating	ClamAV and YARA-X only scan files confidently identified as APK/ZIP, DEX, ELF, HTML, ASCII text, PDF, or images. Desktop-only formats (PE, OLE2, Mail, Mach-O, SWF, Java) and files of an indeterminate type are skipped entirely, by design — see ClamAV-Integration.

Limitation	Details
First scan latency	Signature databases and ML models must be loaded into memory on first scan.
Battery impact	ScreenCaptureService and real-time monitoring increase battery usage. All components are individually toggleable.
Scan throughput	Archive extraction and Unicorn emulation are CPU-intensive and may slow down full scans.

Limitation	Details
No real-time packet firewall	Web Shield filters DNS only — not individual network packets. A full packet firewall would require root or VpnService in proxy mode (which breaks per-app attribution).
No cloud analysis	All detection is on-device. This means no cloud-based verdict correlation or threat intelligence updates in real time.
No CA-based HTTPS inspection	Malicious URL detection is limited to static extraction from files. Live HTTPS traffic interception is not performed (by design).
20 language coverage	On-screen text scanning covers 20 languages. Languages outside this set may not trigger detection.