AndroDR: Spyware Scanner & EDR

Yasir Hamza

About this app

Your phone holds your entire life. AndroDR is its black box — a security scanner and incident recorder that answers one question: is anything on this device watching you?

Built on a simple principle: your data stays on your device. The entire source code is publicly auditable — you don't have to trust our words, you can read the code. No accounts, no analytics, no telemetry. AndroDR phones home to no one.

WHAT IT DETECTS
▪ Stalkerware & spyware — installed apps checked against curated malware and stalkerware databases, updated automatically without app updates
▪ Impersonators — app signing certificates matched against known-malicious certificate hashes
▪ Dangerous permission patterns — surveillance combinations like accessibility + SMS + microphone
▪ Sideloaded apps — anything that didn't arrive through a store your device actually trusts
▪ Accessibility and device-admin abuse — the persistence tricks stalkerware relies on
▪ Suspicious network activity — optional DNS monitor uses Android's VPN service to build a local-only DNS filter that flags and blocks connections to known command-and-control servers; it runs entirely on your phone, no VPN server involved
▪ Device weaknesses — screen lock, bootloader, USB debugging, security patch age, and exposure to CVEs from the CISA Known Exploited Vulnerabilities catalog

FOR WHEN IT MATTERS
▪ Forensic timeline — every install, permission grant and finding, in order, exportable
▪ Analyst-ready reports — export findings as text or STIX 2.1 for MVT, MISP and SIEM workflows
▪ Bug-report analysis — deep-scan an Android bug report for spyware indicators, only when you ask

WHO IT'S FOR
Journalists, activists, survivors of stalking, IT administrators — and anyone who has ever wondered what an app on their phone is really doing.

THE OPTIONAL VPN, EXPLAINED
The network monitor uses Android's VPN service (VpnService) to inspect DNS queries on your device. It is local-only: no tunnel to any remote server, only DNS traffic enters it, and your browsing data never passes through it. Queries are checked against threat databases on your phone and forwarded to Google Public DNS (8.8.8.8) for normal resolution; blocked malicious domains are logged to your forensic timeline. Optional — every other feature works without it.

OPEN SOURCE, VERIFIABLE
Code: github.com/yasirhamza/AndroDR
Detection rules are public, reviewable, and delivered as data — detection improves without waiting for app updates.

EARLY ACCESS
You are testing what will become 1.0. Found a false positive or a bug? Report it in-app or on GitHub — every report makes detection sharper for everyone.

What’s new

NEW: Import your phone's Advanced Protection intrusion logs (Android 16+). AndroDR analyzes the log's DNS lookups, connections, and security events with its detection rules — including encrypted-DNS lookups the live monitor cannot see — and adds them to your forensic timeline and reports. Everything stays on your device.

FIXED: "Boot Persistence" no longer flags trusted store apps — it now only fires for apps installed from outside a store.