HARDAX

pip install hardax

Overview

HARDAX (Hardening Audit eXaminer) is a comprehensive security configuration auditor for Android-based devices. It performs 816 security checks across 29 categories to identify misconfigurations, vulnerabilities, and security weaknesses.

HARDAX is designed for:

• Security Researchers - Penetration testing and vulnerability assessment
• IoT Security Teams - Auditing Android-based IoT devices
• POS Security Auditors - PCI-DSS compliance verification for payment terminals
• Enterprise Security - MDM compliance verification
• Developers - Pre-release security validation

Features

Supported Devices

HARDAX works with any Android-based device accessible via ADB, SSH, or UART:

Installation

Prerequisites

• Python 3.10 or higher
• ADB (Android Debug Bridge) installed and in PATH
• USB Debugging enabled on target device

Install with pip (recommended)

pip install hardax

paramiko, pyserial, and cryptography are pulled in automatically so all four modes (ADB, SSH, UART, certificate audit) work out of the box.

The [ssh], [uart], [certs], [all] extras still exist for backward compat with any script that used them; they are now no-ops since the deps are required.

After installation the hardax console command is available:

adb devices
hardax

Install from source (development)

git clone https://github.com/V33RU/hardax.git
cd hardax
pip install -e '.[all]'

# Or run without installing
python3 -m hardax

Usage

Basic Usage (ADB)

# Auto-detect connected device
hardax

# Show commands being executed
hardax --show-commands

# Load all check files from commands/ directory
hardax --json-dir commands

# Specify device by serial
hardax --serial DEVICE_SERIAL

# Custom output directory
hardax --out ./my_reports

# Skip certificate audit
hardax --skip-certs

# Analysis is on by default. Weight prioritisation for a device profile:
hardax --profile pos        # or: medical, kiosk, automotive, iot, generic

# Disable the analysis layer entirely
hardax --no-analyze

Analysis Engine

After the checks run, HARDAX adds a deterministic analysis layer that reasons only over the findings it already confirmed - it runs no extra commands, makes no network calls, and never invents a finding. It produces:

• a risk score (0-100) and letter grade,
• attack chains correlated from confirmed findings (a chain only appears when every supporting finding is actually present),
• a prioritised "fix in this order" list (chain members and profile-relevant categories are weighted up),
• a VERIFY triage grouping the manual-review items.

It is fully offline and deterministic (no LLM), so it is safe to run against POS, medical, and other sensitive devices. The output appears in the terminal summary, the HTML report, the TXT report, and under the analysis key of the JSON report (--json-out).

Optional AI Narrative (--ai)

On top of the deterministic engine you can add an opt-in LLM narrative that explains the findings in plain language. It is off by default and never replaces the deterministic analysis - it only re-phrases and connects the findings the engine already confirmed, and is instructed never to introduce a vulnerability that was not in the data.

# Local, fully offline (recommended for sensitive devices) - needs Ollama running
hardax --ai --ai-provider ollama --ai-model llama3

# Anthropic (key from ANTHROPIC_API_KEY env var, or --ai-key)
hardax --ai --ai-provider anthropic

# OpenAI
hardax --ai --ai-provider openai --ai-model gpt-4o-mini

Privacy model:

• Only the redacted structured analysis is sent (risk score, finding labels, categories, statuses, remediation text). The raw output of each check is never sent - so serials, PHI strings, IPs and ports do not leave the machine. A redaction backstop also scrubs IP/MAC/hex tokens.
• Ollama runs locally and sends nothing off-machine.
• Cloud providers (Anthropic/OpenAI) print a one-time data-egress warning and require consent (interactive, or --ai-yes for CI).
• API keys are read from env vars or --ai-key and are never stored, logged, or written to the report.
• If the model is unavailable or errors, the audit still completes on the deterministic engine alone.

The narrative appears as a clearly-labelled, visually distinct block in the CLI, HTML and TXT reports, and under analysis.ai_narrative in JSON. It is not a HARDAX finding and is marked as such.

SSH Mode (Network)

hardax --mode ssh --host 192.168.1.100 --ssh-user root --ssh-pass password

The target host's SSH key must be in ~/.ssh/known_hosts first, otherwise the connection is refused (strict host-key checking, the safe default). Populate it once with:

ssh-keyscan -H -t ed25519,rsa 192.168.1.100 >> ~/.ssh/known_hosts

For CI / lab environments auditing many fresh devices where pre-population is impractical, pass --ssh-tofu to silently accept unknown host keys on first contact. A clear warning is printed each time:

hardax --mode ssh --host 192.168.1.100 --ssh-user root --ssh-pass "$AUDIT_PASS" --ssh-tofu

The SSH password can also come from the HARDAX_SSH_PASS environment variable, which keeps it out of ps and shell history.

UART Mode (Serial Console)

# Auto-detect baud rate
hardax --mode uart --uart-port /dev/ttyUSB0

# Specify baud rate
hardax --mode uart --uart-port /dev/ttyUSB0 --baud 115200

# Windows
hardax --mode uart --uart-port COM3 --baud 115200

Network ADB

adb connect 192.168.1.100:5555
hardax --json-dir commands

Baseline / Tamper Detection

Integrity values such as the AVB VBMeta digest, VBMeta size, and the adbd SHA-256 are device- and build-specific, so there is no universal "safe" value to hard-code. Instead, capture a known-good baseline on a trusted device and compare future audits against it. Any check carrying a baseline_key participates automatically.

# 1. Capture a known-good baseline on a trusted, freshly-flashed device
hardax --save-baseline baseline.json

# 2. On later audits, compare against it. A changed value is reported CRITICAL (tamper)
hardax --baseline baseline.json

# Gate CI on tampering (exit 2 when any baseline value changed)
hardax --baseline baseline.json --exit-code

The baseline file records the device fingerprint, so HARDAX warns if you compare against a baseline captured on a different build (where the values legitimately differ). Connection/transport errors mark a check SKIPPED, and a key absent from the baseline is reported VERIFY (nothing to compare). But a value that the baseline recorded yet the device fails to return on the same build is treated as a CRITICAL tamper/evasion indicator (fail closed), so an attacker cannot silence the check by making it return nothing.

All Options

usage: hardax [OPTIONS]

Options:
  --version             Show version
  --mode {adb,ssh,uart} Connection mode (default: adb)
  --serial SERIAL       ADB device serial number
  --host HOST           SSH hostname/IP
  --port PORT           SSH port (default: 22)
  --ssh-user USER       SSH username
  --ssh-pass PASS       SSH password (also accepts HARDAX_SSH_PASS env var)
  --ssh-tofu            SSH trust-on-first-use: silently accept unknown
                        host keys (CI / lab convenience; weakens MITM
                        protection on first connection). Default off.
  --uart-port PORT      UART serial port (e.g. /dev/ttyUSB0, COM3)
  --baud RATE           UART baud rate (0 = auto-detect, default: 0)
  --json FILE           Path to single JSON checks file
  --json-dir DIR        Directory with JSON check files
  --out DIR             Output directory (default: hardax_output)
  --progress-numbers    Show numeric progress counter
  --show-commands       Display each command being executed
  --skip-certs          Skip certificate audit
  --save-baseline FILE  Capture a known-good baseline of integrity values
                        (checks with a baseline_key) for later comparison
  --baseline FILE       Compare integrity values against a saved baseline;
                        a changed value is reported CRITICAL (tamper)

Hidden debug flags (prefix before other args):
  --net-debug           Verbose network check output
  --net-strict          Strict network check mode
  --cert-debug          Verbose certificate audit output
  --cert-limit N        Limit certificate files scanned (default: 50)

Security Categories

HARDAX organizes 816 checks into 29 security categories:

Report Formats

Every run writes TXT, CSV, a detailed XLSX workbook and an interactive HTML dashboard (plus JSON with --json-out) into a timestamped folder under --out.

Interactive HTML dashboard

• Summary Dashboard - total checks and per-severity counts (click a card to filter), doughnut chart
• Deterministic Analysis card - risk score, grade, attack chains, and the fix-in-order priorities
• Device Information - model, Android version, build, serial, SoC
• Collapsible categories with per-category severity badges
• Per-check technical detail - description, why it matters, risk if failed, expected secure state, the exact command and its output, remediation, and compliance chips (check ID, NIST 800-53, CIS, tags)
• Certificate Audit Table - CA certificates with expiry dates and risk status
• Search & Filter - find checks by label, description, ID, NIST control or tag

Detailed XLSX workbook

A multi-sheet, audit-grade Excel workbook:

• Summary - risk score / grade / posture, findings-by-severity, device info, and a per-category breakdown
• Findings - one row per check with the full technical context (category, ID, label, status, level, why it matters, risk if failed, expected secure state, command, output, description, remediation, NIST 800-53, CIS, tags, baseline), colour-coded by severity, with a frozen header row and auto-filter
• Certificates - the CA certificate audit
• Analysis - correlated attack chains and the prioritised remediation order

Extending HARDAX

Adding Custom Checks

Create or modify JSON files in the commands/ directory:

{
  "checks": [
    {
      "category": "CUSTOM",
      "label": "My Custom Port Check",
      "command": "netstat -tlnp 2>/dev/null | grep ':8080'",
      "safe_pattern": "^$",
      "level": "warning",
      "description": "Check if port 8080 is open",
      "empty_is_safe": true
    }
  ]
}

JSON Check Fields

Project Structure

HARDAX/
├── pyproject.toml         # Package metadata, dependencies, entry point
├── README.md              # This file
├── LICENSE                # MIT
└── hardax/                # The installable Python package
    ├── __init__.py        # Main engine (was hardax.py)
    ├── __main__.py        # Enables 'python -m hardax'
    ├── analysis.py        # Deterministic risk engine (score, attack chains, prioritisation)
    ├── ai.py              # Optional opt-in LLM narrative (Ollama/Anthropic/OpenAI, stdlib only)
    ├── templates/
    │   └── report.html    # Interactive HTML report template
    └── commands/          # Security check definitions (816 checks, 29 categories)
        ├── system.json        #  86 checks - Kernel, TEE (QSEE/Mobicore/TEEGRIS/Trusty), SECCOMP, build, emulator, WebView
        ├── bluetooth.json     #  82 checks - BLE/Classic, pairing, all profiles
        ├── network.json       #  61 checks - Ports, WiFi, VPN, IoT protocols, Allow 2G, hotspot WPA
        ├── privacy.json       #  42 checks - Screen lock, location, sensors, clipboard, Restricted Settings
        ├── biometric.json     #   5 checks - Fingerprint/face enrollment, biometric strength (Strong/Weak), keyguard, auto-lock
        ├── apps.json          #  47 checks - Permissions, overlay, backup, install, APK signature scheme
        ├── binary_hardening.json # 36 checks - PIE, NX, RELRO, stack canaries, ASLR
        ├── partition.json     #  35 checks - dm-verity, A/B slots, FBE, mount flags (noexec/nosuid/nodev)
        ├── selinux.json       #  30 checks - Enforcement, policy version, audit
        ├── certificate_audit.json # 25 checks - CA certs, expiry, MITM
        ├── pos_security.json  #  24 checks - PCI-DSS, kiosk, NFC relay, PAX CVE
        ├── storage.json       #  24 checks - Encryption, partitions, backup
        ├── forensic_indicators.json # 22 checks - Crashes, logcat, temp artifacts
        ├── attestation.json   #  20 checks - SafetyNet/Play Integrity, Knox, Titan M, bypass detection
        ├── automotive.json    #  20 checks - Vehicle, CAN bus, infotainment
        ├── boot_security.json #  27 checks - Verified boot, AVB (VBMeta digest/hash/size/ver), dm-verity error modes, verifiedbootstate=yellow
        ├── cryptography.json  #  20 checks - Keystore, StrongBox, kernel entropy, Widevine DRM
        ├── malware.json       #  18 checks - Root, Frida, Xposed, RATs, scrapers
        ├── cis_benchmark.json #  17 checks - CIS Android Benchmark v1.6.0
        ├── usb_security.json  #  16 checks - USB debug, MTP, gadget mode
        ├── cve_indicators.json # 33 checks - Dirty Pipe, Bad Binder, MTK-su, kernel CVEs, WebView debug
        ├── device_management.json # 13 checks - MDM, accounts, dev options
        ├── input.json         #  12 checks - Keyboards, accessibility, IME INTERNET audit, kbd layout, clipboard auto-clear
        ├── medical.json       #  11 checks - Medical apps, IEEE 11073 PHD, PACS C-STORE, insulin/cardiac telemetry
        ├── nfc_security.json  #   9 checks - NFC, reader mode, secure element, tag write protection, HCE AID priority
        ├── adb_security.json  #   8 checks - ADB keys, network ADB allowlist, shell privilege, USB-debug notify, adbd integrity
        ├── modern_android.json #  9 checks - A13/A14/A15/16/17: Photo Picker, READ_MEDIA_*, POST_NOTIFICATIONS, FGS type, Theft/Identity, Restricted Networking, Advanced Protection, A17 Local Network Access
        └── mdm_policy.json    #  15 checks - DevicePolicyManager state (dumpsys device_policy): keyguard, camera, lock/wipe, logging, USB signaling, MTE, Wi-Fi lockdown, etc.

Roadmap

Shipped

• --category flag to run specific categories (v5.0.0)
• --severity flag to filter by level (v5.0.0)
• --json-out for machine-readable JSON output (v5.0.0)
• --exit-code for CI/CD integration, exit 0/1/2 (v5.0.0)
• Branch-protected main with PR workflow (v5.0.0)
• CI workflow validates every commands/*.json regex (v5.0.0)
• 20 new checks: mount-flag hardening, Restricted Settings, Allow 2G, Hotspot WPA, kernel entropy, Widevine DRM level, SELinux policy version, APK signature scheme, app permission audits, WebView SafeBrowsing and debug (v5.1.0)
• Lock Screen Timeout false-positive fix (v5.1.0)
• Pip-installable Python package, pip install hardax (v5.2.0)
• PyPI Trusted Publishing on every GitHub release (v5.2.1)
• 5 new SELinux checks from the 8ksec internals audit (v5.3.0)
• Supply-chain hardening: SHA-pinned actions + Sigstore attestations on every wheel (v5.3.1)
• Python 3.10 support (v5.3.3)
• Safe SSH host-key default restored, --ssh-tofu opt-in for CI / lab convenience (v5.3.3)
• 6 AVB metadata-integrity checks - VBMeta digest, hash algorithm, size, required libavb version, managed dm-verity error-mode policy, and CONFIG_DM_VERITY_AVB kernel support (v5.12.0)
• dm-verity eio/panicking false-positive fix: the AVB-recommended MANAGED_RESTART_AND_EIO mode is no longer flagged CRITICAL (v5.12.0)
• Baseline tamper detection: --save-baseline / --baseline compare integrity values (VBMeta digest/size, adbd SHA-256) and flag any change CRITICAL (v5.13.0)
• Android 17 Local Network Access (ACCESS_LOCAL_NETWORK) grant audit; dm-verity restart mode accepted; /proc/bootconfig (Android 12+) fallback on cmdline readers; verifiedbootstate=yellow (custom root of trust) surfaced as a distinct warning (v5.14.0)
• Dedicated BIOMETRIC category: fingerprint/face/strength/keyguard/auto-lock checks split out of PRIVACY into biometric.json (v5.15.0)
• Deterministic risk score (0-100) with grade, correlated attack chains and prioritised remediation, plus a --profile weighting flag (generic/pos/medical/kiosk/automotive/iot) (v5.10.0)
• pytest suite (engine, analysis, AI redaction, helpers, reporters) + formal hardax/commands.schema.json validated in CI (v5.16.0)
• Detailed XLSX report (Summary / Findings / Certificates / Analysis sheets) and richer HTML/CSV surfacing per-check technical context: why it matters, risk if failed, expected secure state, NIST/CIS mappings and tags (v5.17.0)
• Fix a Windows-only stdout/stderr encoding crash, a CSV unbounded-result bug, 9 binary_hardening.json shell-precedence bugs (PIE/canary/RELRO/NX/FORTIFY checks), and CLI visibility for redirected/logged runs and narrow terminals - all found by running HARDAX end-to-end against a real device (v5.18.0)
• CLI visual redesign: one rounded-corner box family reserved for panels that print once or redraw in place (banner, live HUD, final summary, final analysis), boxless hairline-rule category headers instead of a 3-line box repeated per category, a ❯_ HARDAX wordmark, a strict two-role colour discipline (structure vs. severity), a guaranteed space between every status icon and its count (some terminal fonts render icons like ⚠ at double width), and terminal-width-aware truncation for --show-commands command/remediation lines so nothing needs horizontal scrolling - chosen from an independently-judged panel of 3 redesign directions and verified on both native Windows console and git-bash/mintty (v5.19.0)
• 10 new checks from a 2025-2026 Android security feature gap analysis: null cipher protection (A14+) and cellular identifier disclosure notifications (A16+) - the first cellular-security checks in network.json; Certificate Transparency platform flags (A16+); Private Space profile (A15+); Intrusion Logging / Advanced Protection service state (A16+); Advanced Protection subfeature audit and KeyMint post-quantum readiness (A17+); io_uring restriction and 16KB page-size build (kernel); pKVM/AVF protected-VM support (v5.20.0)
• 3 new exploited-in-the-wild CVE indicators: LANDFALL Samsung spyware chain (CVE-2025-21042/21043, CISA KEV, zero-click via DNG images, Samsung-gated), the December 2025 Framework zero-day pair (CVE-2025-48633/48572), and the June 2026 zero-interaction remote privesc (CVE-2025-48595); plus a fix to the Screenshot Prevention check which mistakenly read the unrelated screensaver_enabled setting instead of the DevicePolicyManager screen-capture-disabled policy (v5.21.0)
• 8 new detections for uncovered surfaces: hardware-backed keystore / KeyMint HAL presence (the root every other ATTESTATION claim depends on), remote key provisioning, Scudo/GWP-ASan allocator hardening, GKI kernel and module-loading restriction, Credential Manager / passkey provider, eSIM/eUICC provisioning, Sandboxed SDK Runtime, Health Connect (v5.22.0)
• Attestation spoofing detection: TrickyStore framework and its target/patch config, keybox key material on disk, KernelSU and APatch root frameworks, plus verified-boot state consistency (ro.boot.verifiedbootstate compared against /proc/cmdline and /proc/bootconfig, which resetprop cannot rewrite, so a mismatch is proof of forgery) (v6.0.0)
• New KERNEL_DRIVERS category (29th): non-standard world-writable device nodes, DSP/FastRPC exposure (the CVE-2024-43047 CISA KEV surface), DMA-BUF and legacy ION heaps, GPU and binder node permissions. Plus tracefs, procfs hidepid, native daemon capability sets, binder service inventory, hidden API enforcement, system-UID packages, priv-app allowlist, dalvik-cache writability, abstract unix and netlink socket inventories, and RPMB availability. CVE-033 now probes the FastRPC node instead of reading only a patch date (v6.0.1)
• 16 kernel, filesystem and network hardening sysctls: unprivileged eBPF, SUID core dumps, protected FIFOs and regular files, magic SysRq, panic-on-oops, SGID binaries, world-writable executables, ICMP redirects (v4 and v6), source routing, SYN cookies, broadcast echo, reverse path filtering and IPv6 router advertisement acceptance (v6.0.1)
• 29 duplicate and dead checks removed, 7 false positives fixed. Three scored CRITICAL on every device: $(( parsed as arithmetic expansion so the ADB loopback script never ran, three kernel checks turned a zcat error into a finding, and the patch-currency check failed a current patch wherever date -d was unavailable. Plus grep '/system' matching /system_ext, and CONFIG_SECCOMP=Y which could never match a lowercase kernel config (v6.0.1)
• tests/test_command_hygiene.py: 10 invariants pinning defect classes that shipped, including sh -n on every command, stderr redirected on optional path reads, failable checks must be capable of failing, no shared commands, no confusable labels, and config.gz checks must declare NOT_OBSERVABLE (v6.0.1)
• Engine reworked so a verdict carries its evidence. ShellResult keeps stdout, stderr and the exit status apart on all four transports; safe_pattern is matched against stdout only; a failed probe is routed to VERIFY and can no longer reach empty_is_safe; every result carries evidence{stdout, stderr, exit_code, basis}. On a real device SAFE verdicts fell from 524 to 351, and the 59 that had been produced by an error message fell to 0 (v6.2.0)
• Transport capability gate. A shell in a vendor SELinux domain can be root and still reach no binder service, which made every dumpsys/pm/settings check fail identically. Those are now reported NOT APPLICABLE with the reason, and checks carrying a non-binder fallback declare binder_optional so they still run (v6.2.0)
• Device-confirmed defect classes fixed: GNU regex extensions that bionic treats as literals (\| 31 checks, \b 14, \s 2), ps -A unsupported by BusyBox which silently disabled 12 critical malware detections, find over a tree it cannot fully read passing as clean, grep -c doubling its own count, -exec grep timing out the transport, counting checks treating empty as safe, unanchored port patterns, and a # comment inside a one-line sh -c script that never parsed (v6.2.0)
• Root and privilege inventory: init services configured to run as root with their binaries, Linux capabilities granted to init services, kernel taint state, unprivileged userfaultfd, kexec loading, ASLR entropy bits (v6.2.0)
• Hardware identity: SoC vendor and model, storage chip part number and firmware revision, UFS/eMMC wear and end-of-life state, dynamic partition inventory (v6.2.0)
• Report header carries the platform profile: kernel, ABI, build type, security patch, SELinux mode, verified boot state, bootloader lock, dm-verity mode, RAM and storage. The text, XLSX and HTML writers now share one field list, so a collected field cannot go unrendered (v6.2.0)
• Package install chain and remaining surfaces: exported components without permission, secret-code dialer receivers (OEM service menus), split APK and staged install sessions, APK signature scheme distribution, package rollback, biometric template storage, Gatekeeper lockout state, APEX active versions, filesystem repair tool permissions, eBPF network policy maps, Wi-Fi chipset firmware, USB-C port roles, secure boot fuse state, cgroup hierarchy, crash artifact accumulation, OTA signing certificates (AOSP test key detection), radio DIAG/AT interface exposure, property context labelling, boot mode and fastbootd, UWB, sensor privacy toggles, bugreport artifacts and metadata encryption (v6.1.0)

Open

Grouped by theme. Order within a group is rough priority.

Verification (highest priority)

• Run against a device with framework access. 67 checks have never executed anywhere and 316 are gated on a transport without binder. A shell confined to a vendor SELinux domain reaches no binder service, so dumpsys, pm, cmd and settings cannot answer and those checks are reported NOT APPLICABLE rather than scored
• Extend tests/fixtures/device_outputs.json with output captured from real devices across several OEMs, not only from reasoning about the shell

Check metadata completeness

• Stable id on every check. Only 38% carry one, so reports are keyed on labels and a rename breaks downstream consumers
• baseline_key on the boot and identity checks. Only 7 of 822 carry one, so --save-baseline watches almost nothing
• why and risk_if_fail beyond the current 8%. The XLSX and HTML reports fall back to description for the rest
• expected_secure_state beyond the current 2%, which is the field a Test ID / Component / Expected State methodology format needs
• Collapse the seven severity levels. low, medium and high are historical and map onto the same three buckets as info, warning and critical

Analysis features

• Full scan-to-scan diff (compare two complete audits, surface all finding regressions; integrity-value baselines already shipped via --baseline in v5.13.0)
• CVE correlation (map findings to relevant CVE IDs automatically)
• Extend the CVE checks that read only a patch date to also probe the reachable attack surface, as CVE-033 now does for FastRPC

Additional security checks

• TLS protocol minimum / cipher policy on the device
• Wi-Fi Protected Management Frames (PMF) state
• TrustZone / TEE OS specific version (beyond presence detection)
• Hidden SSID hotspot detection
• Samsung Knox Container / Workspace state
• Deepen the domains still at a single check: eSIM/LPA, SMS/MMS, GNSS, Thread/Matter, HDCP, IMS/VoLTE, Bluetooth controller firmware

Compliance mappings

• CIS Android Benchmark v1.6.0: fill the remaining 11% to 100% coverage. The current claim is not independently verified
• OWASP MASVS / MSTG mapping per check
• NIST 800-53 / 800-171 mapping per check (31 of 822 checks carry one today)
• PCI-DSS 4.0 detailed mapping (POS terminals)

Tooling and ergonomics

• Inline remediation suggestions in the HTML report
• Multi-device parallel scanning
• Plugin architecture for custom check loaders
• Official Docker image with adb / paramiko / pyserial pre-installed
• Web dashboard (Flask / FastAPI) for centralised audit storage and history

Code quality

• Split the 3200-line hardax/__init__.py into modules (transports, engine, reporters, cli). ai.py and analysis.py are already separate; the core is not
• Type hints throughout, clean under mypy --strict
• macOS CI job. Windows was added in the pytest matrix; pyproject.toml also advertises macOS

External integration

• APK static analysis (apktool / jadx integration)
• SARIF output (for GitHub code scanning and similar tools)

Scope boundary

HARDAX audits device configuration over a shell transport (ADB, SSH, UART). Some parts of a complete Android security assessment are not reachable from that position and are deliberately not claimed. They need a different tool class:

There is also a hard platform limit: there is no shell path to the Keystore attestation API. HARDAX cannot generate an attested key, so it cannot parse a real KeyDescription, read RootOfTrust from a certificate, or verify an attestation chain. It reads the underlying properties the secure hardware would report instead. Attestation chain validation belongs on a backend, not on the device being audited.