README
¶
DroidFS
DroidFS is an alternative way to use encrypted overlay filesystems on Android that uses its own internal file explorer instead of mounting virtual volumes. It currently only works with gocryptfs but support for CryFS is expected to be added soon.
Disclamer
DroidFS is provided "as is", without any warranty of any kind. It shouldn't be considered as an absolute safe way to store files. DroidFS cannot protect you from screen recording apps, keyloggers, apk backdooring, compromised root accesses, memory dumps etc. Do not use this app with volumes containing sensitive data unless you know exactly what you are doing.
Permissions
DroidFS need some permissions to work properly. Here is why:
Read & write access to shared storage:
Required for creating, opening and modifying volumes and for importing/exporting files to/from volumes.Biometric/Fingerprint hardware:
Required to encrypt/decrypt password hashes using a fingerprint protected key.Camera:
Needed to take photos directly from DroidFS to import them securely.
Unsafe features
DroidFS allows you to enable/disable unsafe features to fit your needs between security and comfort. It is strongly recommended to read the documentation of a feature before enabling it.
Allow screenshots:
Disable the secure flag of DroidFS activities. This will allow you to take screenshots from the app, but will also allow other apps to record the screen while using DroidFS. Note: apps with root access don't care about this flag: they can take screenshots or record the screen of any app without any permissions.Allow opening files with other applications:
Decrypt and open file using external apps. This require writing the plain file to disk (DroidFS internal storage).Allow exporting files:
Decrypt and write file to disk (external storage). Any app with storage permissions can access exported files.Allow sharing files via the android share menu:
Decrypt and share file with other apps. This require writing the plain file to disk (DroidFS internal storage).Allow saving password hash using fingerprint:
Generate an AES-256 GCM key in the Android Keystore (protected by fingerprint authentication), then use it to encrypt the volume password hash and store it to the DroidFS internal storage. This require Android v6.0+.
Download
You can download the latest version here.
Build
Most of the original gocryptfs code was used as is (written in Go) and compiled to native code. That's why you need Go and the Android Native Development Kit (NDK) to build DroidFS from source.
Install Requirements
Download Sources
$ git clone https://github.com/hardcore-sushi/DroidFS.git
Gocryptfs need openssl to work:
$ cd DroidFS/app/libgocryptfs
$ wget -qO - https://www.openssl.org/source/openssl-1.1.1h.tar.gz | tar -xvzf -
Build
First, we need to build libgocryptfs.
Retrieve your Android NDK installation path, usually someting like "/home/<user>/AndroidSDK/ndk/<NDK version>".
$ cd DroidFS/app/libgocryptfs
$ env ANDROID_NDK_HOME="<your ndk path>" OPENSSL_PATH="./openssl-1.1.1h" ./build.sh
Then, open the DroidFS project with Android Studio.
If a device (virtual or physical) is connected, just click on "Run".
If you want to generate a signed APK, you can follow this post.
Third party code
Thanks to these open source projects that DroidFS uses:
Modified code:
- gocryptfs to encrypt your data
Libraries:
- Cyanea to customize UI
- Glide to display pictures
- ExoPlayer to play media files
- CameraView to take photos
Directories
¶
| Path | Synopsis |
|---|---|
|
app
|
|
|
libgocryptfs/gocryptfs_internal/cryptocore
Package cryptocore wraps OpenSSL and Go GCM crypto and provides a nonce generator.
|
Package cryptocore wraps OpenSSL and Go GCM crypto and provides a nonce generator. |
|
libgocryptfs/gocryptfs_internal/eme
EME (ECB-Mix-ECB or, clearer, Encrypt-Mix-Encrypt) is a wide-block encryption mode developed by Halevi and Rogaway.
|
EME (ECB-Mix-ECB or, clearer, Encrypt-Mix-Encrypt) is a wide-block encryption mode developed by Halevi and Rogaway. |
|
libgocryptfs/gocryptfs_internal/exitcodes
Package exitcodes contains all well-defined exit codes that gocryptfs can return.
|
Package exitcodes contains all well-defined exit codes that gocryptfs can return. |
|
libgocryptfs/gocryptfs_internal/jacobsa_crypto/cmac
Package cmac implements the CMAC mode for message authentication, as defined by NIST Special Publication 800-38B. When a 16-byte key is used, this matches the AES-CMAC algorithm defined by RFC 4493.
|
Package cmac implements the CMAC mode for message authentication, as defined by NIST Special Publication 800-38B. When a 16-byte key is used, this matches the AES-CMAC algorithm defined by RFC 4493. |
|
libgocryptfs/gocryptfs_internal/jacobsa_crypto/common
Package common contains common implementation details of other packages, and should not be used directly.
|
Package common contains common implementation details of other packages, and should not be used directly. |
|
libgocryptfs/gocryptfs_internal/jacobsa_crypto/siv
Package siv implements the SIV (Synthetic Initialization Vector) mode of AES, as defined by RFC 5297.
|
Package siv implements the SIV (Synthetic Initialization Vector) mode of AES, as defined by RFC 5297. |
|
libgocryptfs/gocryptfs_internal/nametransform
Package nametransform encrypts and decrypts filenames.
|
Package nametransform encrypts and decrypts filenames. |
|
libgocryptfs/gocryptfs_internal/siv_aead
Package siv_aead wraps the functions provided by siv in a crypto.AEAD interface.
|
Package siv_aead wraps the functions provided by siv in a crypto.AEAD interface. |
|
libgocryptfs/gocryptfs_internal/stupidgcm
Package stupidgcm is a thin wrapper for OpenSSL's GCM encryption and decryption functions.
|
Package stupidgcm is a thin wrapper for OpenSSL's GCM encryption and decryption functions. |
|
libgocryptfs/rewrites/configfile
Package configfile reads and writes gocryptfs.conf does the key wrapping.
|
Package configfile reads and writes gocryptfs.conf does the key wrapping. |
|
libgocryptfs/rewrites/contentenc
Package contentenc encrypts and decrypts file blocks.
|
Package contentenc encrypts and decrypts file blocks. |
|
libgocryptfs/rewrites/syscallcompat
Package syscallcompat wraps Linux-specific syscalls.
|
Package syscallcompat wraps Linux-specific syscalls. |