interplains/Zero-Breach-Toolkit

选用指南

AI 根据 README 整理 · 2026/10/28 06:51:16

适用场景

适用于怀疑设备被已知间谍软件（如Pegasus、Predator等）感染时进行本地检查，支持Windows电脑、Mac、Android手机和iPhone备份。

查看 README 依据

# Zero Breach Toolkit A free, open-source check for traces of known mercenary spyware (Pegasus, Predator, Graphite, Candiru and others) on computers, Android phones and iPhone backups. - **Read-only.** It does not modify source evidence or system settings. It writes only temporary database snapshots and the reports you ask for. - **No network requests during a scan.** It never looks up spyware addresses and has no upload feature. Python network calls are blocked and redirected paths are refused. This is not an operating-system network sandbox; see [PRIVACY.md](PRIVACY.md).

> many languages) or [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/). --- ## Step-by-step guide (no technical experience needed) You do not need a GitHub account or any technical knowledge. You need a Windows or Mac computer and about 20 minutes. Phones are checked by connecting them to the computer. **What do you want to check?** [This Windows computer](#windows) · [This Mac](#mac) · [An Android phone](#android-phone) · [An iPhone](#iphone) ### Windows **Set up (only the first time)**

目标用户

面向记者、活动人士、人权捍卫者等可能成为监控目标的群体，无需技术经验。

查看 README 依据

- **States its limits.** Every report says what was found, how strong the evidence is, and what could not be checked. A clean result is never presented as proof that you are safe. Made by archivegenocide. Built on [Zero Breach](https://github.com/interplains/zero-breach). > **If you think you are being targeted right now, get expert help first.** You do not > need to run this tool before asking. Journalists, activists, human-rights defenders and > civil society can contact the > [Access Now Digital Security Helpline](https://www.accessnow.org/help/) (free, 24/7,

> many languages) or [Amnesty International's Security Lab](https://securitylab.amnesty.org/get-help/). --- ## Step-by-step guide (no technical experience needed) You do not need a GitHub account or any technical knowledge. You need a Windows or Mac computer and about 20 minutes. Phones are checked by connecting them to the computer. **What do you want to check?** [This Windows computer](#windows) · [This Mac](#mac) · [An Android phone](#android-phone) · [An iPhone](#iphone) ### Windows **Set up (only the first time)**

使用方式

通过命令行运行，提供菜单式交互，支持Windows的run-scan.cmd脚本和macOS/Linux的python3命令。

查看 README 依据

5. Close your web browsers and chat apps (Chrome, Edge, WhatsApp, Signal…). 6. Open the **Zero-Breach-Toolkit-main** folder (if there is another folder with the same name inside, open that one too), then the **scan** folder, and double-click **run-scan.cmd**. If Windows shows a warning, click **Run** (or **More info**, then **Run anyway**). 7. A menu appears. Type the number next to **Update the indicator lists** and press Enter, then type `y` and press Enter. When it finishes, press Enter. 8. Press Enter again to start **This computer - standard check**. It takes about 15 minutes.

3. Open **System Settings → Privacy & Security → Full Disk Access**, click **+**, choose **Applications → Utilities → Terminal**, and turn it on. Without this, macOS hides Safari's records from the check. **Run the check** 4. Close your web browsers and chat apps. 5. Open **Terminal** (press Cmd+Space, type `Terminal`, press Enter). Copy this line, paste it into Terminal and press Enter: ``` cd ~/Downloads/Zero-Breach-Toolkit-main && python3 -X utf8 scan/zero-breach-toolkit.py ``` 6. A menu appears. Type the number next to **Update the indicator lists** and press Enter,

5. **Close your browsers and chat apps**, then run the check. A menu opens; press Enter for the standard check of this computer. ``` python -X utf8 scan/zero-breach-toolkit.py ``` On Windows you can instead double-click `scan\run-scan.cmd`. It saves the readable and JSON reports in a `findings` folder next to the toolkit. Reports contain private details from your computer; keep them out of shared and synced folders. Useful options: ``` python -X utf8 scan/zero-breach-toolkit.py --quick # faster: skips file fingerprints

部署要求

需要Python 3.8或更高版本，无需管理员权限，无需额外安装包。

查看 README 依据

the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt-indicators) project, the Citizen Lab and Echap's stalkerware research, and a hand-curated set from Citizen Lab reports (Candiru / DevilsTongue and Paragon's Graphite) with every line cited. The curated set works offline; `--update` downloads the rest from a fixed list of official sources. --- ## Install and run You need Python 3.8 or newer ([python.org](https://www.python.org/downloads/); on Windows, tick "Add python.exe to PATH" when installing). No administrator rights and no extra

已知限制

扫描结果不保证设备完全干净，未检查到的部分会明确列出；扫描过程不联网，但更新指标列表需要联网。

查看 README 依据

Still stuck? Ask in the [issues](https://github.com/interplains/Zero-Breach-Toolkit/issues) (do not post your report there; it contains private details). ### What the result means - **"No known indicators found"**: nothing from the published spyware lists was found in the places the tool could check. It is not proof that the device is clean: read the list of places that could not be checked. - **"Something matched"**: this means *look closer*, not *you are infected*. Do not delete anything and do not visit the address it names. Keep the report and contact the

3. **Recommended: download the latest indicator lists.** This is optional and is the only step that uses the internet; the checks themselves never do. Without it only a small built-in set is used. Repeat it every few weeks. ``` python -X utf8 scan/zero-breach-toolkit.py --update ``` 4. **On a Mac, give Terminal Full Disk Access first** (System Settings → Privacy & Security → Full Disk Access → add Terminal, then reopen it). Without it macOS blocks Safari's records and some folders, and the report lists them as not checked.