VOID Auditor

Zero Trust mobile forensics toolkit for Android: Shizuku, AI Governance, Risk Aggregator, Cache Cleaner, Network Scan.

VOID Auditor is a professional no-root Android security audit and forensics tool. It uses the Shizuku API for shell-level capabilities and optional Google Gemini for advisory analysis under a strict governance model (AI never executes commands directly).

Features

- Security Dashboard: risk score 0–100, findings for ADB Wi-Fi, Accessibility, SELinux, overlays, banking apps. - Cache Cleaner: scan external cache, dry-run, three-factor confirm (PURGE), selective purge, honest EXTERNAL_CACHE_ONLY banner. - NET_SCAN: subnet host discovery with per-host ping (PingIp, bounded concurrency 32, isolated per-host failures), MAC via /proc/net/arp, common-port probes. - WIFI_ADB: honest status via getprop; the enable path verifies the port is active or reports SETPROP_FAILED / VERIFY_FAILED. - AI Forensics: Gemini as advisor only, with Intent Proposal, Policy Engine and human confirmation. - Banking Deep Scan: permissions, WebView, deep links and persistent services on finance-related packages. - Apps / Activities: force-stop, disable, clear data, activity launcher (with confirmation for destructive operations). - Audit Trail (TRACE): structured timeline of commands, risk, decisions, exit codes. - Terminal & Scripts: shell via Shizuku plus preset scripts (audit, lockdown, cleanup, network). - File Manager: browse and copy via Shizuku where policy allows.

Security model

- Zero Trust execution: typed capabilities, Policy Engine and confirmation for high-risk actions. - AI is advisory only; no direct shell from the model. - Gemini API keys stored with EncryptedSharedPreferences (AES-256-GCM). - Audit logs in the app-private directory (not world-readable /sdcard). - Optional biometric or device credential gate at launch.

Requirements

- Android 8.0+ (API 26), minSdk 26, targetSdk 35. - Shizuku v13+, started via USB ADB or Wireless Debugging, with permission granted to VOID Auditor. - Optional: Gemini API key for AI features.

Limits (by design or platform): - Full internal /data/data/*/cache visibility usually needs root; without root the UI shows EXTERNAL_CACHE_ONLY and offers pm trim-caches where applicable. - ENABLE_WIFI_ADB via setprop is often blocked by SELinux on non-root devices; the app reports failure honestly instead of a fake "enabled".

Security and responsible use

This tool is intended for authorized device audit and lab work only. Report vulnerabilities privately. Do not use VOID Auditor to access devices or data without permission.

License

MIT