<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Mobile Overlay Attacks

## Overlay Window Types
| Type | API Level | Description |
|------|-----------|-------------|
| `TYPE_APPLICATION_OVERLAY` | 26+ | Standard overlay (requires permission) |
| `TYPE_SYSTEM_ALERT` | < 26 | Legacy system alert window |
| `TYPE_PHONE` | < 26 | Phone window priority |
| `TYPE_TOAST` | < 26 | Toast-style overlay |

## Frida Overlay Detection
```javascript
// Hook WindowManager.addView
Java.perform(function() {
    var WMI = Java.use("android.view.WindowManagerImpl");
    WMI.addView.implementation = function(view, params) {
        var lp = Java.cast(params, Java.use("android.view.WindowManager$LayoutParams"));
        console.log("[OVERLAY] type=" + lp.type.value
            + " flags=" + lp.flags.value
            + " w=" + lp.width.value + " h=" + lp.height.value);
        if (lp.type.value === 2038) {  // TYPE_APPLICATION_OVERLAY
            console.log("[!] OVERLAY ATTACK — TYPE_APPLICATION_OVERLAY detected");
        }
        this.addView(view, params);
    };
});

// Monitor foreground app changes via accessibility
Java.perform(function() {
    var AS = Java.use("android.accessibilityservice.AccessibilityService");
    AS.onAccessibilityEvent.implementation = function(event) {
        if (event.getEventType() === 32) {  // TYPE_WINDOW_STATE_CHANGED
            console.log("[WINDOW] " + event.getPackageName() + "/"
                + event.getClassName());
        }
        this.onAccessibilityEvent(event);
    };
});
```

## ADB Overlay Investigation
```bash
adb shell appops query-op SYSTEM_ALERT_WINDOW allow   # Apps with overlay
adb shell dumpsys window | grep 'mSurface'             # Active windows
adb shell dumpsys window windows | grep -E 'Window #|mOwnerPid'
adb shell dumpsys activity top                          # Top activity
```

## drozer Commands
```bash
drozer console connect
# run app.activity.info -a com.suspect              # Activity info
# run app.service.info -a com.suspect               # Service info
# run app.activity.start --component com.suspect/.OverlayActivity
```

## Tapjacking Protection
```xml
<!-- Layout XML defense -->
<Button
    android:filterTouchesWhenObscured="true"
    android:text="Confirm" />
```
```java
// Programmatic defense
view.setFilterTouchesWhenObscured(true);
// Check MotionEvent for FLAG_WINDOW_IS_OBSCURED
if ((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_OBSCURED) != 0) {
    // Touch may be tapjacked — reject or warn
}
```
