ScreenshotDetector

What it is

ScreenshotDetector is an Android application-layer tool that detects screenshots, screen recording, audio recording, and casting/mirroring. The summary names the APIs; what it omits is the version boundaries, the permissions each detection requires, and the inference logic where AOSP hides the responsible app. Those are what an engineer evaluating detection reliability needs.

How it works

Detection paths degrade by Android version and granted permission, not uniformly:

• Key-press screenshots: ScreenCaptureCallback on Android 14+. On Android 11–13 it needs this app's Accessibility service to observe KEYCODE_SCREENSHOT from the global key stream — and only while the app is foregrounded. The fallback across versions is MediaStore attribution: a SystemUI writer row is annotated as a key-press screenshot.
• Audio/recorder attribution: AOSP strips the recorder's identity, so AudioManager detects that recording happens but not who. The source is suspected via "most-recently-used app × microphone permission × foreground-service start," with system-flow apps (Settings, launcher, permission dialog) excluded. With Accessibility enabled, real-time window events replace the "Usage access" dependency. The page states this suspicion may be inaccurate.
• Recording/casting service: crosses two independent facts rather than naming heuristics — an app with an ongoing foreground-service notification that also owns a virtual display (DisplayInfo.ownerPackageName) or holds persistent project_media consent. Android 14+ forces MediaProjection services to keep an ongoing notification, so a live recorder satisfies both.

flowchart TD
  A[Ongoing foreground-service notification] --> C{Same package?}
  B[Owns virtual display OR holds project_media consent] --> C
  C -->|yes| D[Report as recorder/caster<br/>package name shown]
  C -->|no| E[Not flagged]

• Shell/ADB captures: a MediaStore row whose writer attribution is com.android.shell is treated as a factual shell-channel capture (adb shell screencap / screenrecord), reported on separate cards. Because the write path and filename are unconstrained, the scan ignores screenshot/recording naming features — it covers Download/ and non-primary volumes.

Preconditions

• Recording/casting service detection requires Notification access.
• Key-press detection on Android 11–13 and improved audio attribution require this app's Accessibility service.
• DisplayInfo and WifiDisplayStatus are hidden APIs reached by reflection; owner_package_name cross-app visibility "varies by ROM and degrades gracefully."
• A 15-second lookback query at registration catches events just before the app opened.

Caveats

The author states this plainly: it is application-layer only, with limited capability against system-framework-level behavior, and is "intended as an auxiliary detection reference." The audio source suspicion can be wrong. Attribution visibility depends on the ROM. It is positioned as the research counterpart to ScreenshotFaker — treat it as a signal aggregator, not a guarantee.