BastionGuard™ Endpoint 1.0

BastionGuard™ Endpoint is an independent Android endpoint security application designed to provide antivirus scanning, real-time protection, anti-phishing, ransomware defense, quarantine, and other security capabilities with a privacy-first, local-processing approach.

Implemented

• Jetpack Compose dashboard and scan-results UI in the same dark/emerald visual language.
• Runtime SaneSecurity signature updater. Signature payloads are not bundled in this source archive or APK.
• Native YARA-X 1.19.0 heuristic engine through Rust/JNI, with DEX/ELF-aware rules, strict mobile time/size budgets and compiled-rule caching.
• Every bundled BastionGuard YARA rule declares author = "Calogero Scarnà"; both the project validator and the on-device loader reject rule sets that violate this requirement.
• Local parser/engine for SaneSecurity/ClamAV-style:
  • HDB / HSB exact file hashes (MD5/SHA-1/SHA-256 according to hash length).
  • NDB extended hex signatures with fixed bytes, ??, nibble wildcards, *, {n}, {-n}, {n-}, {n-m}.
  • IGN / IGN2 whitelist names.
  • Unsupported ClamAV constructs are skipped conservatively and counted in the UI.
• APK/ZIP scanning: whole-file hashes plus bounded archive-entry inspection for realtime/single-item scans. Bulk scans use the fast path to avoid repeatedly inflating archives already protected at download time.
• Real-time protection foreground service:
  • progressive CREATE/MODIFY inspection of readable browser downloads while bytes are still arriving;
  • immediate full-file scan on CLOSE_WRITE/MOVED_TO, with no artificial settle delay;
  • immediate deep archive/APK inspection for completed browser downloads, even under battery saver/Doze;
  • MediaStore.Downloads plus filtered MediaStore.Files observation on Android 10+, so browser-owned downloads saved to custom shared folders are covered too;
  • Android DownloadManager.ACTION_DOWNLOAD_COMPLETE as an extra completion signal, deduplicated against filesystem/MediaStore events;
  • package-added/package-replaced receiver to scan the installed source APK after installation.
• High-throughput scanning engine: bounded 2–3 worker parallelism, one-pass hash + body-prefix I/O, throttled UI progress updates, and cooperative cancellation checked during traversal and file reads.
• The scan-results screen exposes Stop scan while a scan is running; cancellation shows partial results and does not overwrite the last completed dashboard scan.
• Full device scan:
  • all user-accessible shared-storage files when All files access is granted;
  • installed application source APKs.
• Night scan scheduled around 02:30 with WorkManager, requiring charging and battery-not-low.
• Phishing-email analysis through Android Share / Process Text for text, HTML, RFC822/EML-style content and shared attachments.
• Link Guard pre-click URL scoring with Safe/Balanced/Aggressive thresholds, Android link-handler integration, a user-selectable external browser, and local allow/block overrides.
• Optional Browser Shield using explicitly enabled Android Accessibility access to inspect only the active browser address bar, check the normalized domain, and show Link Guard-style phishing warnings while browsing.
• Ransomware Guard correlating shared-storage write/delete/rename bursts, extension mutations, entropy changes and harmless canary files; high-confidence events trigger an immediate local security response and alert.
• Cross-engine global threat score that time-decays and rewards corroboration between independent security categories.
• Mandatory private quarantine for detected ordinary shared-storage files, with restore-to-trusted SHA-256 allowlisting.
• Threat notifications and persistent real-time-protection notification, including live manual-scan and download activity status.
• Dashboard phishing-domain checker with in-app results, bounded HTML fetch, SaneSecurity/YARA-X matching and local heuristics.
• Multilingual UI matching the previous BastionGuard app: Italian, English, French, German, Arabic, Japanese, Spanish, Portuguese, Polish, Dutch and Russian.
• First-run language selector plus an in-app Language screen; AppCompat persists the selected locale on Android 12 and lower, while Android 13+ exposes the declared app locales through the platform per-app language system.
• RTL support remains enabled for Arabic.

Localization

The base resources are English (values/strings.xml). The same 331 user-facing strings are present in values-it, values-de, values-es, values-fr, values-pt, values-nl, values-pl, values-ru, values-ja, and values-ar. The first-run language flow and supported-language order mirror the supplied BastionGuard Secure Bank source. Notifications, scan status text, phishing results, quarantine metadata and detection-kind labels use localized resources instead of hardcoded Italian UI text.

See docs/LOCALIZATION.md for the locale list and implementation details.

Android security boundary

A normal Play-distributed Android app cannot inspect other apps' private /data/data/... content and cannot universally intercept every package installation before Package Installer runs. BastionGuard therefore scans downloads as they appear, scans APK files before/after installation when accessible, scans installed source APKs, and scans all user-accessible shared storage.

Email protection uses Android Notification Access only when explicitly enabled, and Android Share for complete messages/attachments. Browser Shield accessibility access is not used to scrape Gmail or other mail clients; email protection remains limited to notification access and explicit Share/Process Text flows. For phishing URLs/domains found in mail, the app checks BastionGuard online intelligence first and then runs the local SaneSecurity/YARA-X layer; the surrounding message text and attachments are not uploaded to the online phishing checker.

Advanced protection boundary

Link Guard and Ransomware Guard are implemented without bypassing Android security boundaries. Link-handler protection is activated through Android's default-app/browser-role flow. The consumer build contains no VPN Network Shield and does not claim a global network kill-switch that stock Android cannot provide to an ordinary app. Ransomware Guard observes only storage that the antivirus is authorized to scan and does not inspect another app's private sandbox. See docs/ADVANCED_PROTECTION.md for architecture, thresholds, limitations and privacy behavior.

SaneSecurity integration

Default public mirror build setting:

BuildConfig.SANE_SIGNATURE_BASE_URL = https://ftp.swin.edu.au/sanesecurity/

For production, configure a SaneSecurity-approved mirror/private donor URL and coordinate commercial-product usage with SaneSecurity. The downloader has a four-hour anti-abuse floor and the scheduled update cadence is six hours.

Configured databases:

• phish.ndb
• blurl.ndb
• jurlbl.ndb
• scam.ndb
• spear.ndb
• spearl.ndb
• badmacro.ndb
• rogue.hdb
• malwarehash.hsb
• hackingteam.hsb
• spamattach.hdb
• sigwhitelist.ign2

The project intentionally does not redistribute these database payloads.

Build

Open this folder with Android Studio using JDK 17+ and sync Gradle. For command-line builds, ./build-debug.sh uses the project Wrapper when present; otherwise it bootstraps the official Gradle 9.6.1 binary distribution with SHA-256 verification instead of relying on distro-packaged Gradle. See docs/GRADLE_BOOTSTRAP.md. The project uses:

• compileSdk 37
• targetSdk 36
• minSdk 26
• AGP 9.3.0
• Kotlin Compose plugin 2.4.10
• WorkManager 2.11.2
• YARA-X 1.19.0 via Rust 1.91.0 + Android NDK/cargo-ndk

The YARA-X bridge is compiled from native/yarax-android with Rust/cargo-ndk. Run ./build-debug.sh: when the three required native libraries are absent it invokes ./build-yarax-android.sh first, then runs validation, unit tests and the Android debug build. This source archive intentionally does not contain prebuilt YARA-X .so binaries.

See docs/YARA_X_INTEGRATION.md for the native architecture, performance limits and rule-author policy.

YARA-X integration

BastionGuard keeps SaneSecurity as the low-cost first layer and adds YARA-X as a bounded second layer for APK/DEX/native payloads, scripts, phishing content and selected high-value file types. APK acquisition and installed-app scans perform a bounded security pass over classes*.dex and lib/**/*.so; deeper generic archive recursion remains resource-controlled. Under the current protection policy, readable shared-storage files are quarantined only after the scan result is actionable; a file restored by the user is trusted by its exact SHA-256.

Bundled rules live in app/src/main/assets/yara/ and all of them carry the exact author metadata Calogero Scarnà. Android/native heuristic rules use correlation-aware scores: the strongest rule per behavioral category contributes to a 0..100 risk score and correlation-required heuristics need at least 80/100 before BastionGuard treats the result as infected. A single loader, root-check, accessibility or native-memory capability therefore remains informational instead of becoming an automatic malware verdict.

Google Play

Read docs/PLAY_STORE_RELEASE.md before publishing. The app requests permissions that require Play Console declarations because antivirus scanning is its core purpose.

The supplied visual mockup is copied to docs/mockup-reference.png only as a design reference; it is not presented as an actual application screenshot.

UI revision aligned to the supplied antivirus mockup

The dashboard now follows the supplied BastionGuard antivirus mockup instead of exposing developer-style controls on the home screen. The hamburger menu is functional and contains the antivirus sections plus Settings. Scan targets are selected from a dedicated screen (Quick, Full device, Internal storage, microSD/removable storage when detected, Downloads, installed apps/APKs). Language selection is under Settings, not on the dashboard. Real-time protection runs through an Android foreground service with an ongoing notification. The exact user-supplied BastionGuard SVG is retained in app/src/main/res/raw/bastionguard_logo_source.svg and rendered for the in-app/notification large icon; the Android small notification icon is a monochrome shield derived from that mark as required by Android.

Fast scan / cancellation revision

Manual scans now use a bounded parallel pipeline rather than scanning every file serially. Small/risk-relevant content is hashed and its NDB inspection prefix is captured in a single filesystem pass, reducing duplicate reads. Bulk scans do not recursively inflate every ZIP/APK entry; persistent realtime scanning retains deep archive inspection for newly downloaded individual items. The scan UI has an explicit Stop scan action. Cancellation is cooperative and checked between directories and on every file I/O buffer so it normally responds quickly without corrupting scan state.

Automatic email phishing checks

The optional EmailNotificationScanService uses Android Notification Access to scan new-message subject/body previews from email clients. It is declared with android.permission.BIND_NOTIFICATION_LISTENER_SERVICE; the user grants the special access from Android settings. Full mailbox access is not claimed or requested. URL/domain indicators extracted from a preview are checked first by BastionGuard online intelligence; the preview is then scanned locally with SaneSecurity/YARA-X. Complete messages and attachments sent through Android Share use the same online-indicator-first/local-engine-second order.

Desktop-parity phishing intelligence

The in-app domain checker calls https://bastionguard.eu/bastionguard-security-intelligence/?q=..., mirroring the desktop phishing_search GET lookup. The Android parser recognizes the desktop classifications and the Matched Indicator field. A non-empty matched indicator is treated as an authoritative online phishing hit even if surrounding page markup changes, and is covered by a unit regression test. Local SaneSecurity/YARA-X analysis always follows, including when the online engine is unavailable.

Identity Leak password check

Identity Leak is available from the left drawer. The Android implementation follows BastionGuard desktop HibpPasswordProvider: SHA-1 is computed locally, only the first five uppercase hexadecimal characters are sent to the HIBP Pwned Passwords Range endpoint with Add-Padding: true, and the returned 35-character suffix is compared locally for an exact match and occurrence count. The password field is cleared before the background request starts; passwords and full hashes are not persisted or logged.

Quarantine management

The quarantine list is counted directly from verified private payload/metadata pairs. Each item is numbered and can be restored to its original path or permanently deleted. Restore never overwrites an existing destination and removes the isolated copy only after the restored file size is verified.

YARA-X community rules

In addition to the bundled BastionGuard YARA-X rules (author = "Calogero Scarnà"), the app can download a public Yara-Rules community feed at runtime without an account. The Android profile imports mobile_malware and email, validates them with YARA-X in staging, skips incompatible/slow files, and atomically activates the last-known-good set. See docs/YARA_RULES_FEED.md.

Root Guard

On rooted devices BastionGuard can optionally use explicitly granted root access for deeper, read-only self-protection diagnostics. It detects signer changes, disabled critical components, runtime instrumentation, tracer attachment, SELinux weakening and writable protected mounts. Root access is never requested silently and is not used to hide the app, prevent uninstall or weaken Android security controls.

License

BastionGuard™ Endpoint for Android is free software licensed under the GNU General Public License version 3 (GPLv3).

You are free to use, study, modify and redistribute the software under the terms of the GNU GPLv3. Any redistribution or derivative work must comply with the obligations of that license.

Copyright © 2026 Calogero Scarnà.

See LICENSE for the complete license text.

Third-party components, libraries, signature sources and other external dependencies included or referenced by this project remain subject to their respective licenses, copyright notices and terms.

Branding and trademarks

The GNU GPLv3 applies to the software source code. It does not grant any trademark rights in the BastionGuard™ name, BastionGuard™ Endpoint product name, logos, icons, visual identity or associated branding.

Modified versions and independent redistributions must not be presented as official BastionGuard releases, must not imply endorsement or affiliation, and should use distinct naming and branding unless explicit permission has been granted.

References to BastionGuard may be used where reasonably necessary to describe the origin, compatibility or derivation of the software, provided that such use does not imply official status or endorsement.

Official BastionGuard builds are those distributed through channels explicitly identified by the BastionGuard project.

See TRADEMARK.md for the project trademark and branding policy.

Release / Google Play

Per una release firmata usa ./build-release.sh; produce APK + Android App Bundle in dist/ e richiama automaticamente ./verify-release.sh. Le credenziali di firma sono lette solo dalle variabili BG_KEYSTORE_FILE, BG_KEYSTORE_PASSWORD, BG_KEY_ALIAS e BG_KEY_PASSWORD. Dettagli: docs/RELEASE_SIGNING.md e docs/PLAY_STORE_RELEASE.md.