FLAG_SECURE Bypass Research Toolkit

Android research toolkit for studying the FLAG_SECURE screen capture protection mechanism. Implements multiple bypass techniques including Xposed hooks, SurfaceFlinger analysis, MediaProjection workarounds, and virtual display capture for security research and testing.

Techniques

Technique	Requirement	Effectiveness	Android Versions
Xposed Hook	Root + Xposed/LSPosed	High	5.0 - 15
SurfaceFlinger Capture	Root	High	5.0 - 13
MediaProjection VirtualDisplay	MediaProjection permission	Low-Medium	5.0 - 12
ADB Shell Capture	ADB access	Medium	5.0 - 15
Framebuffer Read	Root	Medium	5.0 - 10

Xposed Hook

Strips FLAG_SECURE at multiple interception points:

• Window.setFlags() - Removes secure bit before it reaches WindowManager
• WindowManager.LayoutParams.copyFrom() - Intercepts layout parameter propagation
• SurfaceControl.Transaction.setSecure() - Blocks native secure flag enforcement
• Activity.onResume() / Dialog.show() - Clears flag after application sets it

SurfaceFlinger Bypass

Direct root-level capture via the hardware compositor:

• Root screencap bypasses software secure flag checks
• SurfaceFlinger service calls for compositor-level capture
• Layer enumeration and per-layer secure flag manipulation

MediaProjection Bypass

Virtual display flag manipulation:

• VIRTUAL_DISPLAY_FLAG_OWN_CONTENT_ONLY capture attempts
• VIRTUAL_DISPLAY_FLAG_PUBLIC display creation
• Reflection-based internal API access for modified parameters

ADB Capture

Shell-level capture using elevated permissions:

• screencap from shell UID context
• screenrecord for video capture
• Framebuffer device direct read

Build

# Clone the repository
git clone https://github.com/bypasscore/flag-secure-bypass.git
cd flag-secure-bypass

# Build debug APK
./gradlew assembleDebug

# Install on device
adb install app/build/outputs/apk/debug/app-debug.apk

Requirements

• Android Studio Iguana or later
• Android SDK 35
• JDK 17
• Rooted device for SurfaceFlinger and Xposed techniques
• Xposed/LSPosed framework for hook-based bypass

Project Structure

app/src/main/java/com/bypasscore/flagsecure/
  MainActivity.java              - Main UI with technique controls
  capture/
    ScreenCapture.java           - Base MediaProjection capture
    VirtualDisplayCapture.java   - Virtual display capture engine
  bypass/
    XposedBypass.java            - Xposed hook module
    SurfaceFlingerBypass.java    - Root SurfaceFlinger capture
    MediaProjectionBypass.java   - VirtualDisplay flag manipulation
    AdbCapture.java              - ADB shell capture
  analysis/
    FlagDetector.java            - Detect FLAG_SECURE applications
    WindowAnalyzer.java          - Window property inspection
  utils/
    RootHelper.java              - Root detection and shell execution
    PermissionManager.java       - Runtime permission handling
docs/
  flag-secure-internals.md       - FLAG_SECURE implementation details
  bypass-techniques.md           - Technique catalog and analysis
tests/
  FlagDetectorTest.java          - Unit tests

Blog

Read the full technical writeup:

How to Screen Record Protected Apps: FLAG_SECURE Bypass

Disclaimer

This toolkit is intended for security research, penetration testing, and educational purposes only. Understanding FLAG_SECURE bypass techniques helps developers build more robust screen capture protections. Use responsibly and only on devices you own or have authorization to test.

License

MIT License - see LICENSE for details.

Contact

• Email: contact@bypasscore.com
• Telegram: @bypasscore
• Web: bypasscore.com

Support

If you find this research useful, consider supporting development:

Network	Address
Polygon	0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Ethereum	0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
BSC	0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Arbitrum	0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Optimism	0xd0f38b51496bee61ea5e9e56e2c414b607ab011a
Avalanche	0xd0f38b51496bee61ea5e9e56e2c414b607ab011a