<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Mobile Spyware

## MVT (Mobile Verification Toolkit)
```bash
# Android
mvt-android check-adb -o results/                           # Live device
mvt-android check-backup backup.ab -o results/ -i iocs.stix2  # Backup
mvt-android download-apks -o apks/                           # Extract APKs

# iOS
mvt-ios check-backup --input backup/ -o results/ -i iocs.stix2
mvt-ios check-fs --input fs/ -o results/
mvt-ios decrypt-backup --destination decrypted/ --password PASS backup/
```

## ADB Forensic Commands
```bash
adb shell pm list packages -3 -f               # Third-party with paths
adb shell dumpsys package PKG                   # Full package info
adb shell dumpsys device_policy                 # Device admins
adb shell dumpsys activity services             # Running services
adb shell dumpsys batterystats                  # Battery consumers
adb shell dumpsys alarm                         # Scheduled alarms
adb shell settings list secure                  # Secure settings
adb shell getprop | grep -i 'debug\|root'      # Debug/root props
```

## Frida Spyware Monitoring
```javascript
// Monitor location access
Java.perform(function() {
    var LM = Java.use("android.location.LocationManager");
    LM.getLastKnownLocation.overload('java.lang.String').implementation =
        function(provider) {
            console.log("[LOCATION] getLastKnownLocation: " + provider);
            return this.getLastKnownLocation(provider);
        };
});

// Monitor microphone access
Java.perform(function() {
    var AR = Java.use("android.media.AudioRecord");
    AR.startRecording.implementation = function() {
        console.log("[AUDIO] Recording started!");
        this.startRecording();
    };
});
```

## Known Spyware IOC Sources
| Source | URL |
|--------|-----|
| Amnesty Tech | github.com/AmnestyTech/investigations |
| Citizen Lab | citizenlab.ca/category/research |
| EFF | eff.org/issues/stalkerware |
| Lookout | lookout.com/threat-intelligence |
