Android security

Scan apps and files without pretending Android is a desktop OS.

Android 0.2.0-dev is a new buildable preview. The previous Android 0.1.0 product claims did not have corresponding runnable source in this repository. This preview provides local SHA-256 file inspection and EICAR test signature only; not a production antivirus.

Official: aq.kingai.work
KINGAI Security Android interface preview
Android interface preview. Illustration only, not an actual Android screen capture. The new 0.2.0 app uses a simpler native interface.

Installation status

Android 8+ / API 26target API 35Debug APK

The preview APK is signed with an Android development key. It is not a Play Store package and cannot update a differently signed app with the same package name. Downloads currently reside in a private GitHub repository.

What works in Android 0.2.0-dev

A genuine installable Android app — with narrowly defined protection.

Core capabilities are checked by automated tests and emulator installation. Real-device compatibility and full antivirus coverage remain unverified.

✓
Android 8+ installable APKNative Java screen, English and Chinese, built and debug-signed in CI. No account or WebView required.
✓
Choose a file or APKAndroid's built-in file picker; local SHA-256 hashing and a 128 MiB maximum scan size.
✓
EICAR test-file recognitionVerifies the scanning pathway using the standard EICAR marker. It is NOT a malware detection database.
✓
APK container and visible-app listBasic ZIP header check and launchable-app metadata, not real signature analysis or hidden-app enumeration.
✓
Honest UNKNOWN verdictsWithout a production intelligence feed, an ordinary file must never be labeled CLEAN or Protected.
Release status

What still separates candidate from Commercial Stable.

Real-device install and lifecycle

Install, app launch, file picker, language, update and uninstall still need evidence from multiple physical phones.

Threat engine missing

Production threat signatures, signed updates, quarantine and DNS-only VPN are not implemented in Android 0.2.0-dev.

Debug signing is not production signing

The private debug APK is not Play-signed and is not cleared for store distribution.

Production feed verification

The actual release job must validate the live Threat DB manifest, exact schema/types, P-256 signature and time window before signing builds.

Track the Android release path.

Review current status before installing a build.

aq.kingai.work