Listening to App Changes

An observer of app changes can be registered by the app integrating Malwarelytics for Android.

The observer notifies the app about these changes:

• A new app has been installed.
• An app has been updated.
• An app has been uninstalled.

The exact functionality of the listener differs slightly based on the Android version the device is running. Older versions of Android allow spotting an app change and delivering an observer callback immediately. On newer versions of Android, the callbacks are delivered with some delay.

The install and update callbacks deliver analyzed threat information. The uninstall callback cannot provide such details since the app has already been uninstalled; only the package name is therefore provided in such case.

Registering App Observer

When Smart Protection is enabled, apps are observed automatically. However, the SDK also offers a way to observe changes explicitly by registering an ApkThreatObserver. An example of an observer:

val threatObserver = object : ApkThreatObserver {
    // The callback is delivered on a background thread
    override fun onInstallDetected(apkThreat: ApkThreat) {
        // Handle info about app install
    }

    // The callback is delivered on a background thread
    override fun onUpdateDetected(apkThreat: ApkThreat) {
        // Handle info about app update
    }

    // The callback is delivered on a background thread
    override fun onUninstallDetected(apkThreat: ApkThreat) {
        // Handle info about app uninstall. 
        // Only the app's 'packageName' is available.
    }
}

The observer can be registered in Antivirus. When it is no longer needed, it can be unregistered again.

antivirus.registerApkThreatObserver(threatObserver)
antivirus.unregisterApkThreatObserver(threatObserver)