fun handleSensitiveInput(password: CharArray) {
    try {
        // 認(rèn)證邏輯
        authenticate(password)
    } finally {
        // 主動(dòng)覆蓋內(nèi)存痕跡
        Arrays.fill(password, '\u0000')
    }
}

// 使用示例
fun login() {
    val password = charArrayOf('p','a','s','s','w','o','r','d')
    handleSensitiveInput(password)
}

fun encryptData(data: ByteArray, keyAlias: String): ByteArray {
    val key = getKeyFromKeyStore(keyAlias)
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
    
    try {
        cipher.init(Cipher.ENCRYPT_MODE, key)
        return cipher.doFinal(data)
    } finally {
        // 清理臨時(shí)緩沖區(qū)
        cipher.engineDoFinal(ByteArray(0), 0, 0)
    }
}

private fun getKeyFromKeyStore(alias: String): SecretKey {
    val keyStore = KeyStore.getInstance("AndroidKeyStore").apply {
        load(null)
    }
    
    return (keyStore.getEntry(alias, null) as KeyStore.SecretKeyEntry).secretKey
}

sequenceDiagram
    participant App as 應(yīng)用程序
    participant KeyStore as AndroidKeyStore
    participant TEE as 可信執(zhí)行環(huán)境
    
    App->>KeyStore: 生成密鑰請(qǐng)求
    KeyStore->>TEE: 創(chuàng)建密鑰(硬件安全區(qū))
    TEE-->>KeyStore: 返回密鑰引用
    KeyStore-->>App: 返回密鑰句柄
    
    App->>KeyStore: 加密/解密請(qǐng)求
    KeyStore->>TEE: 執(zhí)行操作(密鑰不離開TEE)
    TEE-->>KeyStore: 返回結(jié)果
    KeyStore-->>App: 返回操作結(jié)果

fun generateSecureKey(alias: String) {
    val keyGenerator = KeyGenerator.getInstance(
        KeyProperties.KEY_ALGORITHM_AES, 
        "AndroidKeyStore"
    )
    
    val keySpec = KeyGenParameterSpec.Builder(
        alias,
        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
    ).apply {
        setBlockModes(KeyProperties.BLOCK_MODE_GCM)
        setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
        setKeySize(256)
        setUserAuthenticationRequired(true)
        setUserAuthenticationValidityDurationSeconds(30)
    }.build()
    
    keyGenerator.init(keySpec)
    keyGenerator.generateKey()
}

fun encryptWithKeyStore(data: ByteArray, alias: String): ByteArray {
    val key = getKeyFromKeyStore(alias)
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
    
    cipher.init(Cipher.ENCRYPT_MODE, key)
    return cipher.doFinal(data)
}

// Kotlin聲明
external fun lockMemory(address: Long, size: Long): Int
external fun unlockMemory(address: Long, size: Long): Int

// Native實(shí)現(xiàn) (memory_locker.c)
#include <sys/mman.h>
#include <unistd.h>

JNIEXPORT jint JNICALL
Java_com_example_MemoryUtils_lockMemory(JNIEnv *env, jobject thiz, jlong addr, jlong size) {
    return mlock((void *) addr, (size_t) size);
}

JNIEXPORT jint JNICALL
Java_com_example_MemoryUtils_unlockMemory(JNIEnv *env, jobject thiz, jlong addr, jlong size) {
    return munlock((void *) addr, (size_t) size);
}

fun handleUltraSensitiveData(data: ByteArray) {
    val nativeBuffer = ByteBuffer.allocateDirect(data.size)
    nativeBuffer.put(data)
    
    val address = getDirectBufferAddress(nativeBuffer)
    lockMemory(address, data.size.toLong())
    
    try {
        // 處理敏感數(shù)據(jù)
        processSensitiveData(nativeBuffer)
    } finally {
        // 清理并解鎖
        nativeBuffer.clear()
        fillWithZeros(nativeBuffer)
        unlockMemory(address, data.size.toLong())
    }
}

private fun fillWithZeros(buffer: ByteBuffer) {
    val zeroArray = ByteArray(buffer.remaining())
    Arrays.fill(zeroArray, 0)
    buffer.put(zeroArray)
    buffer.clear()
}

object DebugProtector {
    private const val DEBUG_CHECK_INTERVAL = 5000L
    
    fun startDebugMonitoring() {
        val handler = Handler(Looper.getMainLooper())
        val debugCheck = object : Runnable {
            override fun run() {
                if (isDebuggerAttached()) {
                    handleDebuggerDetected()
                }
                handler.postDelayed(this, DEBUG_CHECK_INTERVAL)
            }
        }
        handler.post(debugCheck)
    }
    
    private fun isDebuggerAttached(): Boolean {
        return Debug.isDebuggerConnected() || 
               BuildConfig.DEBUG ||
               (Build.TAGS != null && Build.TAGS.contains("debug"))
    }
    
    private fun handleDebuggerDetected() {
        // 1. 清除敏感數(shù)據(jù)
        clearAllSensitiveData()
        
        // 2. 記錄安全事件
        logSecurityEvent("Debugger attached")
        
        // 3. 退出或進(jìn)入安全模式
        if (!BuildConfig.DEBUG) {
            System.exit(1)
        }
    }
}

object SecureLogger {
    private const val MAX_LOG_LENGTH = 4000
    
    fun d(tag: String, message: String) {
        if (BuildConfig.DEBUG) {
            // 自動(dòng)截?cái)嚅L(zhǎng)日志
            val safeMessage = if (message.length > MAX_LOG_LENGTH) {
                message.substring(0, MAX_LOG_LENGTH) + "..."
            } else {
                message
            }
            
            Log.d(tag, sanitize(safeMessage))
        }
    }
    
    private fun sanitize(input: String): String {
        // 過濾敏感信息
        val patterns = listOf(
            "password" to "***",
            "token" to "***",
            "cc_number" to "****-****-****-####"
        )
        
        var output = input
        patterns.forEach { (pattern, replacement) ->
            output = output.replace(Regex(pattern, RegexOption.IGNORE_CASE), replacement)
        }
        return output
    }
}

class SecureMemory<T : Any>(private var value: T) {
    private var cleared = false
    
    fun get(): T {
        if (cleared) throw IllegalStateException("Data has been cleared")
        return value
    }
    
    fun clear() {
        if (cleared) return
        
        when (value) {
            is CharArray -> Arrays.fill(value as CharArray, '\u0000')
            is ByteArray -> Arrays.fill(value as ByteArray, 0)
            is String -> {
                // 反射覆蓋String內(nèi)部值
                try {
                    val field = String::class.java.getDeclaredField("value")
                    field.isAccessible = true
                    val chars = field.get(value) as CharArray
                    Arrays.fill(chars, '\u0000')
                } catch (e: Exception) {
                    // 備用方案
                    value = ""
                }
            }
            else -> {
                // 自定義清理邏輯
            }
        }
        
        value = null as T
        cleared = true
    }
    
    inline fun <R> use(block: (T) -> R): R {
        try {
            return block(value)
        } finally {
            clear()
        }
    }
}

// 使用示例
fun processPassword(password: String) {
    val securePassword = SecureMemory(password)
    
    securePassword.use { pwd ->
        // 在此作用域內(nèi)使用密碼
        authenticate(pwd)
    }
    // 離開作用域后密碼自動(dòng)清除
}

finally { Arrays.fill(data, 0) }

KeyStore.getInstance("AndroidKeyStore")

secureData.use { /* 限定作用域 */ }

// 定期檢查調(diào)試狀態(tài)
DebugProtector.startDebugMonitoring()

// CharArray清理 + KeyStore + 內(nèi)存鎖定

./gradlew lintSecurityCheck

// 使用Android 14+的Confidential Compute空間
val vm = ConfidentialSpaceManager.create()

StrongBoxSecurity.get().generateKey(...)

// 分配時(shí)預(yù)填充隨機(jī)數(shù)據(jù)
val secureBuffer = SecureRandom.allocate(size)

// 使用ARMv8.4內(nèi)存標(biāo)記擴(kuò)展
mte_tag_memory(ptr, size, tag)