<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Mobile Device Encryption Audit

## Android Encryption Properties
```bash
adb shell getprop ro.crypto.state          # encrypted / unencrypted
adb shell getprop ro.crypto.type           # file (FBE) / block (FDE)
adb shell getprop ro.crypto.fbe.enabled    # true / false
adb shell getprop ro.hardware.keystore     # KeyStore implementation
adb shell getprop ro.crypto.volume.filenames_mode  # aes-256-cts
```

## Android KeyStore API
```java
// Generate key with hardware backing
KeyGenParameterSpec spec = new KeyGenParameterSpec.Builder("alias",
    KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
    .setUserAuthenticationRequired(true)
    .setIsStrongBoxBacked(true)
    .build();
KeyGenerator kg = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
kg.init(spec);
SecretKey key = kg.generateKey();
```

## iOS Data Protection Classes
| Class | Access |
|-------|--------|
| `NSFileProtectionComplete` | Only when unlocked |
| `NSFileProtectionCompleteUnlessOpen` | Created when unlocked, readable after |
| `NSFileProtectionCompleteUntilFirstUserAuthentication` | After first unlock |
| `NSFileProtectionNone` | Always accessible — FINDING |

## Frida Crypto Hooks
```javascript
// Hook Cipher.doFinal
Java.perform(function() {
    var Cipher = Java.use("javax.crypto.Cipher");
    Cipher.doFinal.overload('[B').implementation = function(input) {
        console.log("[NERF] mode=" + this.getAlgorithm()
            + " input_len=" + input.length);
        return this.doFinal(input);
    };
});

// Hook SecretKeySpec to capture keys
Java.perform(function() {
    var SKS = Java.use("javax.crypto.spec.SecretKeySpec");
    SKS.$init.overload('[B', 'java.lang.String').implementation = function(key, alg) {
        console.log("[KEY] algorithm=" + alg + " key_hex="
            + Array.from(key).map(b => ('0' + (b & 0xFF).toString(16)).slice(-2)).join(''));
        return this.$init(key, alg);
    };
});
```

## objection Commands
```bash
objection -g com.target.app explore
# android keystore list                  # List KeyStore entries
# android keystore clear                 # Clear KeyStore
# ios keychain dump                      # Dump Keychain items
# ios keychain dump --json               # JSON format
```
