991 probes, 4535 readings (measured on a Motorola Android 16).
Highlights of 2.21:
- Kernel identity is now cross-checked across the syscall, the sysctls and the
ro.kernel.versionproperty; a resolver that sets the property to one kernel line while the kernel underneath is another shows up as a divergence. Kernel build date vs ROM date,/proc/config.gzmarkers, and a/sys/module+/proc/kallsymsscan join the sweep. - StrongBox vs TEE signer cross-check catches a single keybox faking both.
- Three app-perspective verdicts (enabled IME, store authenticity, dev-gated settings), a loader-module scan that survives maps-scrubbing (
dl_iterate_phdr), a Frida-port check, and an executable-maps injection classifier. - Install source is cross-checked over every visible app, and the phantom
"0"fromcontent://settingscall(GET_...)no longer fakes an identifier divergence.
Full detail: https://github.com/VD171/VD-Infos/blob/main/CHANGELOG.md