An analyst-first methodology and open source toolset for identifying greyware behaviour in Android applications.
Not malware. Not clean software. The grey area in between — where advertising SDKs route data through channels invisible to VPN proxies, where apps persist after force-stop, where privacy policies say one thing and the bytecode does another.
Modern Android apps routinely embed advertising and analytics SDKs that collect data through channels invisible to standard monitoring tools. These are not malware techniques — they are deliberate architectural choices that maximise data collection while evading privacy controls.
The most common evasion vector is custom URI scheme IPC: data passed through Android WebView's shouldOverrideUrlLoading before any network call. This channel bypasses mitmproxy, Charles Proxy, and every VPN-based blocker.
Popular idle games and free-to-play apps with hundreds of millions of installs embed up to 11 advertising SDKs simultaneously. The Mintegral MBridge SDK alone — confirmed active in thousands of apps — routes device identifiers and behavioural data through the mv:// channel documented in CENT-2026-001.
GAMA was built to find these patterns systematically, document them with defensible evidence, and contribute them to a shared community knowledge base that grows with every analysis.
A popular idle game. 140MB APK. Millions of installs. This is what GAMA-Intel found in under 10 minutes of static analysis.
mv:// to route device identifiers and ad event data through Android WebView's shouldOverrideUrlLoading before any outbound network request is made.// GAMA-Community knowledge base — submit findings via GitHub PR. Every confirmed Class-C/D finding distributed to all labs.
| ID | Name | ATT&CK Mobile | Detection Method |
|---|---|---|---|
| GAMA-T001 | Custom URI scheme IPC bypass | T1637.002 (proposed) | URI scanner + Frida WebView hook |
| GAMA-T002 | Post-install silent payload delivery | T1407 | Size delta + DexClassLoader hook |
| GAMA-T003 | Background task persistence | T1624.003 (proposed) | WorkManager hook + post-termination DNS |
| GAMA-T004 | Domain fronting via CDN | T1665 | SNI vs destination IP in Zeek ssl.log |
| GAMA-T005 | JNI policy bypass | proposed | Native lib entropy + JNI symbol analysis |
| GAMA-T006 | Premium tier visual illusion | proposed | Runtime capture after paid tier activation |
| GAMA-T007 | Encoded string obfuscation | T1406 | Base64/hex decoder + obfuscation ratio |
7-phase investigation CLI. URI scanner, SDK fingerprint, finding management, enforcement rule generation. Full XAPK/APKS support.
Automated static analysis pipeline. STIX 2.1 report generation. Import from GAMA Framework workspaces. Batch analysis mode.
Three-channel ML anomaly scoring in Rust. CPU-only, no CUDA. Community module system. Obfuscation detector module.
First confirmed community finding. Mintegral MBridge mv:// URI bypass. Class-C, confirmed by two independent labs.
Public knowledge base on GitHub. PR-based finding submission. SQLite local sync. CenturiaLabs + independent lab governance.
Full backpropagation training. Transformer-based smali encoder. Network LSTM for temporal sequence analysis.
Pre-built hooks for all 7 GAMA techniques. Auto-generated from static findings. Integration with GAMA Framework Phase 3.
Full Zeek pipeline for post-termination detection. Domain fronting classifier. GAMA-T003 and GAMA-T004 automated confirmation.
Analysed an APK with GAMA and found something interesting? Submit a Class-C or Class-D finding to the community knowledge base. Every confirmed entry is distributed to all labs on the next sync. Security researchers, mobile privacy labs, and forensics teams welcome.