Stationary Cell Monitoring: Added "Lock-in Mode" to detect cell changes while the device is stationary. Signal Inconsistency Monitoring: Added SNR/SINR analysis to identify suspicious high-power signal anomalies. Neighbor Cell Inconsistency Monitoring: Detects isolated cells with zero neighbors, typical for malicious cell site simulators. eBPF Firewall Integration: Replaced standard iptables rules in Panic-Mode with deep eBPF-based (cBPF) kernel filtering for absolute network isolation. SELinux Policy Hardening: Added Magisk/KSU sepolicy rules to isolate radio device nodes (/dev/smd*), restricting access exclusively to Sentry and system radio processes. Libsu Integration: Replaced legacy Runtime.exec with libsu in ForensicService for more stable, persistent, and performant root shell management. Native RIL Parcel Parsing: Enhanced Xposed module to parse native RIL response parcels directly, providing manufacturer-consistent detection of encryption (A5/0) status beyond simple regex matching. Xposed Package Hiding: Implemented advanced stealth by hooking PackageManager to hide Sentry Radio and Magisk/Root-related packages from all other apps on the system. Forensic Engine Update: Integrated new monitors into the core forensic service.

Sentry Radio is a professional-grade Android forensic tool designed to detect, analyze, and map cellular network anomalies, including potential IMSI catchers (Stingrays), cell site simulators, and suspicious network downgrades. Built for security researchers and privacy-conscious users, it provides deep insights into the radio stack, monitoring both SIM slots in real-time. 🚀 Key Features - 🛡️ Real-time Threat Detection: Monitors for encryption deactivation, silent SMS, and suspicious cell handovers. - 📊 Advanced Radio Metrics: Tracks PCI, EARFCN, signal strength (RSSI/RSRP), timing advance, and neighboring cells. - 🌐 Forensic Mapping: Visualizes detected cell towers and your movement on an offline-capable map using OSMDroid. - 📡 Dual SIM Support: Full monitoring for multi-SIM devices. - 🔍 Database Verification: Cross-references cell data with OpenCellID, Unwired Labs, and BeaconDB to identify "fake" towers. - 🛠️ Root-Powered Monitoring: Utilizes root access to sniff the radio logcat and execute low-level telephony dumps. - 💾 PCAP Export: Exports radio events to GSMTAP-compatible PCAP files for further analysis in Wireshark. 🛠️ Requirements - Android 10 (API 29) or higher. - Root access: Required for deep radio logcat monitoring and low-level diagnostic data. - (Optional) Xposed/LSPosed: For enhanced API hooking and stealth. ⚙️ Configuration To enable live database verification, add your API keys in the app settings: - OpenCellID API Key: https://opencellid.org - Unwired Labs Token: https://unwiredlabs.com 🛡️ Security Analysis Layers Sentry Radio analyzes several layers of the cellular protocol: - Physical Layer: Unrealistic signal jumps or timing advance values. - Protocol Layer: RRC state transitions and Location Update Rejects. - Security Layer: Monitoring for Ciphering indicator (A5/0) and silent paging. - Baseband Layer: Fingerprinting of known vulnerable modem firmware. ⚠️ Disclaimer This tool is for educational and research purposes only. Monitoring cellular networks may be subject to legal restrictions in some jurisdictions. The developer assumes no liability for misuse.