Skip to content

ShadowDroid v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 16:55
· 151 commits to main since this release
v1.1.0
d43208b

ShadowDroid 1.1

ShadowDroid 1.1 adds correlated investigation evidence, recording coverage, and more precise network failure experiments, with fixes that keep credentials redacted and failed requests visible.

Highlights

  • Capture evidence checkpoints that correlate UI, network, video, and selected private app state, then build a timeline across checkpoints. Missing sources are reported as partial evidence.
  • Inspect recording coverage, missing segments, and marker ranges without treating host timestamps as exact video positions.
  • Apply guarded, one-shot JSON response edits matched to request operations, clear HTTP interception explicitly, and abort downstream transport when simulating a lost response.
  • Use bounded lifecycle-lock waits and executable local recovery handles for redacted device references.

Fixes

  • Preserve source keys and sensitive ancestors before projecting evidence values. Passwords, opaque tokens, configured sensitive fields, and known-value aliases stay redacted; fingerprints and explicit JWT claims continue to use original input.
  • Persist ordinary HTTP drops and fail-closed timeout drops exactly once, including the synthetic response sent to the app.
  • Record OkHttp failures before a response returns, preserving request metadata and duration while rethrowing the original exception.
  • Honor the selected device when attaching to or listing Android clients, reject unsupported capture host filters before setup, and remove hidden idle waits from guarded actions and screen reads.
  • Upgrade quick-xml to 0.41.0 to resolve RUSTSEC-2026-0194 and RUSTSEC-2026-0195, preserve SharedPreferences entity handling, and update the yanked chacha20 dependency to 0.10.2.
  • Retire stale duplicate managed skills while preserving custom guidance.
  • Bundle the evidence driving guide inside the CLI crate so packaged source builds compile without the repository's outer documentation directory.

Install

macOS/Linux:

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/andriyo/ShadowDroid/releases/download/v1.1.0/shadowdroid-installer.sh | sh -s -- --version v1.1.0

Windows PowerShell:

powershell -ExecutionPolicy Bypass -c "irm https://github.com/andriyo/ShadowDroid/releases/latest/download/shadowdroid-installer.ps1 | iex"

Then connect to an attached device or running emulator:

shadowdroid connect

The release includes CLI archives for five host targets, the Android server APK pair, Android Studio plugin, core agent AAR, and optional OkHttp companion AAR. SHA256SUMS covers the published artifacts; RELEASE_PROVENANCE.json records their source commit and workflow run.

Full changelog: v1.0.0...v1.1.0

Release source mapping

After a commit metadata correction on 2026-09-09, v1.1.0 points to d43208b001a177e3220bb8a775bb6fbb5f2f8f04. Its source tree is identical to the original build commit 1cce703bb3cfb099ff1bd9d1c75e25b1aacb44f2. The published artifacts, checksums and RELEASE_PROVENANCE.json are unchanged; provenance continues to identify the original build commit and workflow run.

Assets 16
Loading