Technical Documentation

Introduction & Dual Architecture

Who Tried is a comprehensive physical endpoint security ecosystem developed by Jutt Cyber Tech. The suite comprises two purpose-built defensive implementations designed to protect user privacy across mobile and desktop environments:

Platform	Target Environment	Primary Security Role	Distribution
Android Edition	Smartphones & Tablets (Android 8.0 - 16+)	Covert front-camera intruder photography, motion theft sirens, and encrypted photo vault.	Google Play Store
Windows PC Edition	Workstations & Laptops (Windows 10/11 x64)	2-Step Verification hardware lock screen, TOTP authenticator enforcement, webcam snapshots, and anti-tamper hooks.	Microsoft Store / MSIX

Physical Threat Model

Most modern security solutions focus solely on remote network threats, malware, and phishing. Who Tried specifically addresses the critical vulnerability of physical device compromise:

• Opportunistic Snooping: Colleagues, visitors, or acquaintances attempting to glance at personal documents or open applications while you step away.
• Credential Shoulder-Surfing: Intruders who have memorized or guessed your standard PIN or Windows password.
• Workstation Tampering: Malicious individuals attempting to bypass endpoint security using task termination shortcuts, system key combinations, or USB access.

Android System Requirements Android

The Android edition is engineered to operate on a wide variety of hardware architectures with zero cloud dependencies:

• Operating System: Android 8.0 (API level 26) through Android 16+.
• Hardware: Front-facing camera required for photo capture. Accelerometer/Gyroscope required for motion theft alarm.
• Storage Footprint: Under 25MB application package size.
• Memory: Lightweight runtime consumption (~35MB RAM).

Permissions & Device Administrator Android

To detect invalid unlock attempts without compromising operating system integrity, Who Tried utilizes standard Android Enterprise APIs:

BIND_DEVICE_ADMIN

The DeviceAdminReceiver API is required to register an unlock failure broadcast listener. When an intruder inputs an incorrect pattern, PIN, or password on the lock screen, the OS fires an ACTION_DEVICE_ADMIN_DISABLED or password failure event that Who Tried listens to.

Camera Permission (android.permission.CAMERA)

Used strictly in an isolated background thread to trigger silent front-camera snapshots. Who Tried never streams video, never accesses the microphone during captures, and never uses camera flash.

Silent Camera Capture Engine Android

Unlike conventional camera applications that require a visible surface preview, Who Tried implements a headless Camera2 API pipeline. A virtual ImageReader surface receives raw sensor frames silently in the background:

• Zero Flash & Zero Shutter Sound: Audio streams are suppressed and hardware flash units remain dormant so the intruder is unaware of the capture.
• Instant Shutter Execution: Photos are captured within 450 milliseconds of the invalid unlock signal.
• EXIF Timestamping: Each photo is watermarked with the local date and time of the intrusion event.

Foreground Service & Trampolines Android

Starting with Android 14 and Android 15, Google introduced strict limitations on launching activities from the background. Who Tried conforms with modern Android guidelines through a certified architecture:

By declaring FOREGROUND_SERVICE_SPECIAL_USE in the application manifest and coordinating lock events through lightweight broadcast trampolines, the surveillance service is protected against aggressive OEM battery killers (Doze Mode) while adhering strictly to Google Play developer policies.

Theft Alarm & Disguise Icons Android

Motion Detection Siren

When armed, the app reads hardware accelerometer telemetry. If a charging cable is disconnected or the device is moved from a desk, Who Tried triggers a harsh, maximum-volume alarm to deter unauthorized handling.

Dynamic Launcher Icon Disguise

Using Android's <activity-alias> component, Who Tried allows the user to disguise the app as an innocent Calculator or Clock. The real interface can only be launched by entering your secret passkey inside the disguised utility.

Battery Announcer Mechanics Android

The Battery Announcer monitors device power rails locally using an unmetered broadcast receiver. It provides synthesized voice announcements when:

• Charger is plugged in or unplugged.
• Battery level reaches 100% full charge (preventing overcharging).
• Battery drops below user-configured low thresholds (e.g. 15% or 20%).

Windows PC System Requirements Windows PC

Component	Minimum Specification	Recommended Specification
Operating System	Windows 10 64-bit (Build 19041+)	Windows 11 64-bit (Build 22621+)
Processor Architecture	x64 (Intel Core i3 / AMD Ryzen 3 or faster)	x64 Multi-core processor (2.0 GHz+)
System RAM	1 GB available memory	2 GB - 4 GB
Webcam	Optional for basic lock screen	Integrated HD or USB webcam for intruder capture
Runtime Environment	Self-contained (No .NET installation required)	Self-contained Desktop Bridge MSIX

Endpoint Security Architecture Windows PC

Who Tried for Windows PC is constructed using a modern C# / WPF native Win32 framework packaged through the Windows Desktop Bridge (MSIX). It operates with system-level security privileges granted under the declared runFullTrust capability:

Unlike web apps or basic wrappers, Who Tried interfaces directly with Windows NT core subsystems: the Windows Terminal Services session notification manager, the low-level Win32 input hook chain, and the native MediaCapture video pipeline.

2-Step Verification Lock Screen Windows PC

Standard Windows authentication relies on passwords, PINs, or Windows Hello. If an intruder obtains your Windows credentials, your files are completely exposed. Who Tried creates an impenetrable secondary hardware barrier:

• Immediate Session Interception: Upon logging into Windows or waking the PC from a lock screen, Who Tried activates a full-screen, topmost security window.
• 6-Digit Time-Based Passcode: The desktop remains locked until the user provides the rotating 6-digit TOTP code generated by their paired mobile authenticator.
• Dynamic Countdown Meter: A real-time graphic indicator informs the user of the active token validity window (30-second cycles).

Mobile Authenticator Synchronization Windows PC

Who Tried adheres to the open, industry-standard RFC 6238 Time-based One-Time Password (TOTP) algorithm. It works with all major authenticator apps:

• Google Authenticator
• Microsoft Authenticator
• Twilio Authy
• Bitwarden Authenticator / 1Password

During setup, the dashboard generates a cryptographically secure 160-bit base32 secret seed rendered as a standard otpauth:// QR code. Your mobile phone scans this seed offline. Both devices calculate the exact same dynamic passcode every 30 seconds using synchronized Unix time steps without needing any network or internet connection.

Silent Webcam Intrusion Bursts Windows PC

When an intruder types an incorrect 6-digit code or attempts to guess credentials on your computer, Who Tried's surveillance module immediately commands the hardware camera:

• Rapid Frame Bursts: Captures three consecutive high-definition snapshots in rapid succession to ensure a clear facial angle even if the intruder moves.
• Silent Execution: Operates directly via the DirectShow / MediaCapture pipeline with zero screen flicker or camera popups.
• Local Audit Timeline: Each failed attempt is logged with the exact system date, time, failed code attempt number, and associated photograph in the administrator dashboard.

Anti-Tamper & Low-Level Hooks Windows PC

Physical intruders frequently attempt to bypass lock screens by killing processes or triggering system shortcuts. Who Tried employs robust kernel-level defensive techniques:

• WH_KEYBOARD_LL Low-Level Hook: Intercepts and suppresses escape hotkeys including Alt+Tab, Win+Tab, Alt+F4, and Windows key combinations while the verification lock is active.
• Task Manager Protection: Disables or suppresses task switching while the system is locked, preventing unauthorized task termination.
• Process Integrity Watchdog: Background service monitors process heartbeats and prevents unauthorized tampering with configuration files.

Workstation Lock & Sleep Sentinel Windows PC

The application registers directly with the Windows Station API via WTSRegisterSessionNotification. The background sentinel constantly monitors system events:

• WTS_SESSION_LOCK: Automatically re-arms the two-step verification barrier the exact millisecond Windows enters a locked state.
• Power Management Events: Detects system suspend, sleep, and hibernate events, ensuring that waking the laptop immediately presents the verification challenge.
• Reboot Resilience: Configured via Windows Startup registry Run keys to activate before user desktop interaction begins.

Zero-Cloud Cryptography Vault Dual Platform

Security and privacy are fundamental pillars of Jutt Cyber Tech. Both Who Tried applications operate under a strict 100% Serverless Policy:

Security Metric	Implementation Architecture
Network Telemetry	Zero outbound connections. No analytics, tracking, or remote error reporting.
Credential Hashing	PBKDF2 (Password-Based Key Derivation Function 2) with HMAC-SHA256 and unique cryptographic salt.
Photo Storage	Stored exclusively in local, isolated application folders. Never uploaded or shared.
Secret Key Isolation	TOTP seeds are generated using cryptographically secure random number generators (RNGCryptoServiceProvider).

Emergency Recovery & Support Important

To maintain absolute endpoint integrity, Who Tried does not transmit recovery tokens over the public internet, nor are passwords ever stored in plaintext.