Configuration

The freeMalware Detection module is configured directly in code — no external files or API calls are required. Pass your detection parameters through SuspiciousAppDetectionConfig (V2 API) or via the legacy configuration fields (V1 API).

Modern (V2) API

Compatibility

The V2 configuration API is available from the following minimum SDK versions:

Android: 18.1.0 | Flutter: 8.0.0 | React Native: 5.0.0 |

Capacitor: 3.0.0 | Cordova: 9.0.0 | KMP: 2.0.0

val detectionConfig = SuspiciousAppDetectionConfig(
    packageNames = setOf("com.suspicious.app"),
    hashes = setOf("755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21"),
    requestedPermissions = setOf(
        setOf("android.permission.READ_SMS"),
        setOf("android.permission.BIND_ACCESSIBILITY_SERVICE"),
        setOf("android.permission.REQUEST_INSTALL_PACKAGES")
    ),
    grantedPermissions = setOf(
        setOf("android.permission.BIND_ACCESSIBILITY_SERVICE")
    ),
    malwareScanScope = MalwareScanScope(
        scanScope = ScopeType.SIDELOADED_ONLY,
        trustedInstallSources = listOf("com.android.vending")
    ),
    reasonMode = ReasonMode.HIGHEST_CONFIDENCE
)

val config = TalsecConfig.Builder(packageName, certificateHash)
    .suspiciousAppDetectionConfig(detectionConfig)
    .build()

final detectionConfig = SuspiciousAppDetectionConfig(
    packageNames: ["com.suspicious.app"],
    hashes: ["755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21"],
    requestedPermissions: [
        ["android.permission.READ_SMS"],
        ["android.permission.BIND_ACCESSIBILITY_SERVICE"],
        ["android.permission.REQUEST_INSTALL_PACKAGES"]
    ],
    grantedPermissions: [
        ["android.permission.BIND_ACCESSIBILITY_SERVICE"]
    ],
    scanScope: ScanScope(
        scopeType: ScopeType.sideloadedOnly,
        trustedInstallSources: ["com.android.vending"]
    ),
    reasonMode: ReasonMode.highestConfidence,
);

final config = TalsecConfig(
    androidConfig: AndroidConfig(
        packageName: packageName,
        signingCertHashes: [certificateHash],
        suspiciousAppDetectionConfig: detectionConfig,
    ),
);

const config: TalsecConfig = {
    androidConfig: {
        packageName: 'com.example.app',
        certificateHashes: ['...'],
        suspiciousAppDetectionConfig: {
            packageNames: ['com.suspicious.app'],
            hashes: ['755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21'],
            requestedPermissions: [
                ['android.permission.READ_SMS'],
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
                ['android.permission.REQUEST_INSTALL_PACKAGES'],
            ],
            grantedPermissions: [
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
            ],
            scanScope: {
                scopeType: 'SIDELOADED_ONLY',
                trustedInstallSources: ['com.android.vending'],
            },
            reasonMode: 'HIGHEST_CONFIDENCE',
        },
    },
};

const config: TalsecConfig = {
    watcherMail: 'your@email.com',
    androidConfig: {
        packageName: 'com.example.app',
        certificateHashes: ['...'],
        suspiciousAppDetectionConfig: {
            packageNames: ['com.suspicious.app'],
            hashes: ['755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21'],
            requestedPermissions: [
                ['android.permission.READ_SMS'],
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
                ['android.permission.REQUEST_INSTALL_PACKAGES'],
            ],
            grantedPermissions: [
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
            ],
            scanScope: {
                scopeType: 'SIDELOADED_ONLY',
                trustedInstallSources: ['com.android.vending'],
            },
            reasonMode: 'HIGHEST_CONFIDENCE',
        },
    },
};

const config: TalsecConfig = {
    watcherMail: 'your@email.com',
    androidConfig: {
        packageName: 'com.example.app',
        certificateHashes: ['...'],
        suspiciousAppDetectionConfig: {
            packageNames: ['com.suspicious.app'],
            hashes: ['755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21'],
            requestedPermissions: [
                ['android.permission.READ_SMS'],
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
                ['android.permission.REQUEST_INSTALL_PACKAGES'],
            ],
            grantedPermissions: [
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
            ],
            scanScope: {
                scopeType: 'SIDELOADED_ONLY',
                trustedInstallSources: ['com.android.vending'],
            },
            reasonMode: 'HIGHEST_CONFIDENCE',
        },
    },
};

val detectionConfig = SuspiciousAppDetectionConfig(
    packageNames = listOf("com.suspicious.app"),
    hashes = listOf("755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21"),
    requestedPermissions = listOf(
        listOf("android.permission.READ_SMS"),
        listOf("android.permission.BIND_ACCESSIBILITY_SERVICE"),
        listOf("android.permission.REQUEST_INSTALL_PACKAGES")
    ),
    grantedPermissions = listOf(
        listOf("android.permission.BIND_ACCESSIBILITY_SERVICE")
    ),
    scanScope = ScanScope(
        scopeType = ScopeType.SIDELOADED_ONLY,
        trustedInstallSources = listOf("com.android.vending")
    ),
    reasonMode = ReasonMode.HIGHEST_CONFIDENCE
)

val config = freeraspConfig(
    watcherMail = "your@email.com",
    androidConfig = AndroidConfig(
        packageName = packageName,
        certificateHashes = listOf(certificateHash),
        suspiciousAppDetectionConfig = detectionConfig
    )
)

Configuration Parameters

Parameter

Type

Default

Description

packageNames

Set/List<String>

null

Package identifiers to explicitly blocklist.

hashes

Set/List<String>

null

SHA-256 APK hashes to explicitly blocklist.

requestedPermissions

Set/List<List<String>>

null

Permission sets — flagged if all permissions in any set appear in the app's manifest.

grantedPermissions

Set/List<List<String>>

null

Permission sets — flagged if all permissions in any set are actively granted by the user.

malwareScanScope (Android) / scanScope (others)

MalwareScanScope / ScanScope

SIDELOADED_ONLY, no trusted sources

Controls which applications enter the scan. See Scan Scope below.

reasonMode

ReasonMode

HIGHEST_CONFIDENCE

Controls the detection decision logic. See Reason Mode below.

Scan Scope

The scan scope determines which installed applications are subject to heuristic evaluation.

scopeType

Behavior

SIDELOADED_ONLY (default)

Evaluates non-system, non-OEM applications not installed from a trusted source.

SIDELOADED_AND_OEM

Includes OEM pre-installed applications.

SIDELOADED_AND_SYSTEM_EXCLUDE_OEM

Includes system applications, excludes OEM.

SIDELOADED_AND_SYSTEM_AND_OEM

Includes all non-trusted applications regardless of origin.

ALL

Evaluates every installed application without exception.

Exclusions

Description

trustedInstallSources

Accepts a list of installer package names (e.g., com.android.vending for Google Play). Applications installed from these sources are excluded from scope-based evaluation.

Official stores are not excluded by default. To exclude Google Play apps from evaluation, explicitly add com.android.vending to trustedInstallSources.

Reason Mode

The reason mode determines the logic used to decide which applications are surfaced as threats based on the available signals.

Mode

Behavior

HIGHEST_CONFIDENCE (default)

Flags scope-based results only when a permission match is also present. Blocklist matches are always included.

ALL

Flags every application within the configured scan scope, regardless of permission results.

Legacy (V1) API

Compatibility

The legacy V1 API is only supported in SDK versions prior to the V2 update (listed below). It does not provide reasonMode control, requestedPermissions, or granular scan scoping, and defaults to ALL mode.

Android: <18.1.0 | Flutter: <8.0.0 | React Native: <5.0.0 |

Capacitor: <3.0.0 | Cordova: <9.0.0 | KMP: <2.0.0

val config = TalsecConfig.Builder(packageName, certificateHash)
    .blacklistedPackageNames(arrayOf("com.suspicious.app"))
    .blacklistedHashes(arrayOf("755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21"))
    .suspiciousPermissions(arrayOf(
        arrayOf("android.permission.READ_SMS"),
        arrayOf("android.permission.BIND_ACCESSIBILITY_SERVICE")
    ))
    .whitelistedInstallationSources(arrayOf("com.android.vending"))
    .build()

final config = TalsecConfig(
    androidConfig: AndroidConfig(
        packageName: packageName,
        signingCertHashes: [certificateHash],
        malwareConfig: MalwareConfig(
            blacklistedPackageNames: ["com.suspicious.app"],
            blacklistedHashes: ["755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21"],
            suspiciousPermissions: [
                ["android.permission.READ_SMS"],
                ["android.permission.BIND_ACCESSIBILITY_SERVICE"]
            ],
            whitelistedInstallationSources: ["com.android.vending"],
        ),
    ),
);

const config: TalsecConfig = {
    androidConfig: {
        packageName: 'com.example.app',
        certificateHashes: ['...'],
        blacklistedPackageNames: ['com.suspicious.app'],
        blacklistedHashes: ['755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21'],
        suspiciousPermissions: [
            ['android.permission.READ_SMS'],
            ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
        ],
        whitelistedInstallationSources: ['com.android.vending'],
    },
};

const config: TalsecConfig = {
    watcherMail: 'your@email.com',
    androidConfig: {
        packageName: 'com.example.app',
        certificateHashes: ['...'],
        malwareConfig: {
            blacklistedPackageNames: ['com.suspicious.app'],
            blacklistedHashes: ['755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21'],
            suspiciousPermissions: [
                ['android.permission.READ_SMS'],
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
                ['android.permission.REQUEST_INSTALL_PACKAGES'],
            ],
            whitelistedInstallationSources: ['com.android.vending'],
        },
    },
};

const config: TalsecConfig = {
    watcherMail: 'your@email.com',
    androidConfig: {
        packageName: 'com.example.app',
        certificateHashes: ['...'],
        malwareConfig: {
            blacklistedPackageNames: ['com.suspicious.app'],
            blacklistedHashes: ['755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21'],
            suspiciousPermissions: [
                ['android.permission.READ_SMS'],
                ['android.permission.BIND_ACCESSIBILITY_SERVICE'],
                ['android.permission.REQUEST_INSTALL_PACKAGES'],
            ],
            whitelistedInstallationSources: ['com.android.vending'],
        },
    },
};

val config = freeraspConfig(
    watcherMail = "your@email.com",
    androidConfig = AndroidConfig(
        packageName = packageName,
        certificateHashes = listOf(certificateHash),
        malwareConfig = MalwareConfig(
            blacklistedPackageNames = listOf("com.suspicious.app"),
            blacklistedHashes = listOf("755ee39ff11bad65193c4806cadb9cedda41e20663c35494cb7d4e9646ddcf21"),
            suspiciousPermissions = listOf(
                listOf("android.permission.READ_SMS"),
                listOf("android.permission.BIND_ACCESSIBILITY_SERVICE")
            ),
            whitelistedInstallationSources = listOf("com.android.vending")
        )
    )
)

Configuration Parameters

Parameter

Type

Description

blacklistedPackageNames

Array/List<String>

Package identifiers to explicitly blocklist.

blacklistedHashes

Array/List<String>

SHA-256 APK hashes to explicitly blocklist.

suspiciousPermissions

Array/List<List<String>>

Permission sets — flagged if all permissions in any set are actively granted.

whitelistedInstallationSources

Array/List<String>

Trusted installer package names. Apps from unlisted sources are treated as sideloaded.

PreviousRequirements NextHandling Results

Last updated 2 months ago