Hypatia - A realtime malware scanner (fork of Divestos versi

项目说明

> [!WARNING]
> ### This is a fork of the original (and discontinued) app from Di.

!Banner

Hypatia
=======

O
--------
Hypatia is the world's first FOSS malware scanner for Android. It is powered by ClamA signature databases.

<!-- <img src="
alt="Get it on F-Droid"
height="80"> -->
<img src="
alt="Get it on IzzyOnDroid"
height="80">
<img src="
alt="Translation status"
height="66">

Features
--------

Near zero battery impact: you'll ne any impact on battery at all

Extremely fast: it can scan small files (1MB) in <20ms, and e files (40MB) in 1000ms.

Memory efficient: with the default databases enabled it uses under 120MB.

Regular scan: allowing selection of /system, internal storage, external storage, and installed apps

Realtime scanner: can detect malware in realtime on write/rename in internal storage

Completely offline: Internet is only used to download signature databases, files will never e your device

Persistence: will automatically restart on boot/update

Tiny codebase: coming in at under 1000 sloc, it can be audited by e with basic programming experience

Minimal dependencies: the app only uses libraries when necessary

Signature databases can be enabled/disabled at the users demand

Troubleshooting
------------------

The app crashes and is very buggy:

The first thing to check is if you ha databases enabled. Extended databases require more RAM (8 GB), and can occasionally cause the app to be very buggy.

Unable to download databases:

If this occurs, try tapping the ellipsis in the top right of the main screen and tap Database ser. This uses a mirror database in case the main database is down.

There are false positives:

This occasionally occurs due to the nature of bloom filters. If you belie is a false positi, rescan. This will sometimes fix the false positive. And if this still returns a false positive, scan the file to , and this will tell you if you truly have a false positive or rather some malware.

APK Info & Security
--------------------

Both debug, release and nightly built by GitHub Actions. You can check checksum notice in Release Actions or/and checksum.txt in releases to compare with Application's

This is the SHA fingerprint of Hypatia's signing key to downloaded APKs which are signed by us.

Technical Details
------------------

Signature databases are serialized Gua object format

Signature databases will not be redownloaded if the file hasn't changed on the server (304 not modified)

Signatures are stored using BloomFilters for O(k) lookup

Files ha MD5/SHA-1/SHA-256 hashes calculated in one pass

Realtime scanner is multithreaded and will use half of the device's core count for scanning multiple files asynchronously

Realtime scanning powered by a recursi

Permissions
-----------------

ACCESS_NETWORK_STATE: Checks if a network is a before updating databases.

FOREGROUND_SERVICE and FOREGROUND_SER: Used for realtime scanning.

INTERNET: Download and update databases.

MANAGE_EXTERNAL_STORAGE: Used for reading malicious files for scanning, and deleting infected files.

WRITE_EXTERNAL_STORAGE and READ_EXTERNAL_STORAGE: Used for scanning and removing infected files on older Android .

QUERY_ALL_PACKAGES: Used for scanning malicious apps.

RECEI: Restart the app on reboot.

REQUEST_DELETE_PACKAGES: Used for removing infected apps.

POST_NOTIFICATIONS: Notifications.

WAKE_LOCK: Keeps phone awake while scanning to prevent the process from being killed.

ACCESIBILITY_SERVICE: Used to allow the link scanner to read the screen and check for malicious domains.

DYNAMIC_RECEIION: Required for recei in Android.

Building
-----
Building the app is simliar to most android apps, but if you would like to sync the app in Android Studio, you might need to add the following to metadata-.xml:

Planned Updates
----------------
In order to view the immediate roadmap, please check out the milestones. From here, you can gauge the time untill the next release. 😀

Option to scan on access

Scan newly installed/updated apps

Option to let 3rd-party apps invoke scans

Automatic database updates

Database sanity checks

Testing

Better GUI

Translations

Scanning entire system using root (low priority)

Goals
-----

Be fast

Don't eat batteries

Use minimal permissions

Use libraries only when necessary

Credits
-------

ClamAV for the databases (GPLv2)

ESET for extra databases (BSD 2-Clause)

Nex () for extra databases (CC BY-SA 4.0)

Amnesty International for extra databases (CC BY 2.0)

Echap for extra databases (CC BY 4.0)

MalwareBazaar for extra databases (CC0)

Recursi.ja.0-or-later): Daniel Gultsch, ownCloud Inc., Bartek Przybylski

GPGDetachedSignature.ja.0-or-later): Federico Fissore, Arduino LLC

Petra Mirelli for the app banner/feature graphic and tweaks.

: Translations work

Icons: Google/Android/AOSP, License: Apache 2.0,

Translations
------------

Afrikaans: Oswald

Arabic: abdelbasset jabrane, ABDO GM

Chinese (Simplified): Sdarfeesh, Crit, 大王叫我来巡山

Chinese (Traditional Han script): 張可揚

Croatian: lukapiplica

Czech: Fjuro

Estonian: Priit Jõerüüt

Finnish: huuhaa, Ricky Tigg

French: cardpuncher, Jean-Luc Tibaux, Petra Mirelli, thraex

Hebrew: elid34

Galician: ghose, josé m

German: thereisnoanderson, Balthazar1234, Petra Mirelli, Ettore Atalan

Greek: Dimitris

Indonesian: Adrien N

Italian: Tommaso Fonda, srccrow, Petra Mirelli, Dark Space

Japanese: honyaku

Polish: Marcin Mikołajczak

Portuguese (Brazil): lucasmz

Portuguese: jontaix, inkhorn, ssantos

Romanian: Renko

Russian: yurtpage, q1011, Andrey

Slovak: Pa Di

Spanish: gallegonovato, Manuel-Senpai, Petra Mirelli

Turkish: cardpuncher

Ukrainian: Fqwe1

Notices
-------

Di Computing Group is not affiliated with Cisco or ESET

MaintainTeam is not affiliated with Cisco or ESET

Hypatia is not sponsored or endorsed by Cisco or ESET

项目信息

开发语言：Kotlin

Star 数：461

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A realtime malware scanner (fork of Divestos version)| Maintained by: @Inhishonor展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。