How to Inspect Display Hash Verification and UI Integrity on Android Using ADB dumpsys display_hash

Modern mobile banking, digital identity, and secure payment applications face continuous threats from malicious screen overlays, clickjacking attacks, and visual spoofing. If an attacker overlays a transparent or deceptive window over a banking transaction button, a user may inadvertently authorize a fraudulent fund transfer without realizing the underlying content was obscured. To counter this vector, Android 12 (API level 31) introduced the Display Hash subsystem (DisplayHashManager). This framework allows applications to generate a cryptographically signed HMAC hash of a specific rendered UI component directly from SurfaceFlinger and the hardware composer, proving that the exact pixels were rendered visibly to the human user without occlusion. Using the Android Debug Bridge (ADB), security engineers and mobile developers can query dumpsys display_hash to inspect hashing algorithms, audit verification requests, and evaluate UI integrity policies.

Understanding the Android Display Hash Architecture

The Display Hash framework bridges application view hierarchies with the low-level graphics composition pipeline to guarantee visual authenticity. Key components include:

• Verified Display Hash: A cryptographically signed token generated by the system service. It binds the hash of the rendered pixels, the bounding rectangle, the time of rendering, and a system-held HMAC key.
• Hardware SurfaceFlinger Integration: Instead of trusting application-level view snapshots (which could be intercepted or manipulated in memory), the hash is computed directly by SurfaceFlinger at the moment of composition.
• Occlusion Detection: If another window, permission dialog, floating overlay, or picture-in-picture window partially or fully covers the target view, the display hash request is rejected, protecting users from clickjacking.
• DisplayHashManagerService: Resides in the system server, enforcing rate limits, managing per-app quotas, selecting hashing algorithms (such as PHASH for perceptual hashing), and arbitrating cross-app verification requests.

Prerequisites and ADB Environment Setup

Inspecting display hash operations requires an Android device or emulator running Android 12 (API level 31) or later. Ensure Developer Options and USB Debugging are enabled on the test device.

Confirm the device connection via the terminal:

adb devices -l

Verify that the display_hash system service is operational:

adb shell service check display_hash

The command should return: Service display_hash: found.

Querying Complete Display Hash Service Telemetry

To inspect the configuration, supported hashing algorithms, rate limits, and verification history, dump the service state via ADB:

adb shell dumpsys display_hash

The output reveals key operational parameters governing UI integrity:

DisplayHashManagerService:
  mSupportedAlgorithms: [PHASH]
  mIntervalBetweenRequestsMs: 10
  mVerificationSecret: [REDACTED]
  Recent Requests:
    Package: com.example.banking.auth
    Bounds: Rect(48, 1200 - 1032, 1380)
    Algorithm: PHASH
    Status: VERIFIED
    Timestamp: 2026-11-08 04:50:12

Key metrics in the dump include:

• mSupportedAlgorithms: Identifies which hashing algorithms the hardware and graphics pipeline support. PHASH (Perceptual Hash) is the standard algorithm, designed to remain resilient against minor subpixel antialiasing differences while detecting significant visual alterations.
• mIntervalBetweenRequestsMs: The throttling interval enforced by the kernel to prevent rogue applications from overwhelming the GPU and SurfaceFlinger with continuous hash generation calls.
• Recent Requests: A rolling buffer of recent hash generation and verification events, logging package names, screen coordinates, and status outcomes.

Inspecting and Testing Display Hash Generation via Command Line

Developers validating security implementations can interact directly with the display hash command-line provider to test hashing functionality and verify rate-limiting behaviour.

Check the available command subcommands supported by the display hash service:

adb shell cmd display_hash help

Inspect the device’s installed display hash algorithm configurations:

adb shell cmd display_hash get-supported-algorithms

To temporarily adjust the throttling interval between hash requests during automated stress testing (e.g. lowering the interval to 0 ms for test harnesses):

adb shell cmd display_hash set-interval-between-requests 0

To restore default system throttling after test execution:

adb shell cmd display_hash set-interval-between-requests 10

Auditing Clickjacking and Overlay Protections

When an application requests a VerifiedDisplayHash, Android evaluates whether any overlay is positioned above the target view.

To audit whether an active floating overlay or system alert window is interfering with display hash generation, inspect the active window stack:

adb shell dumpsys window windows | grep -E "mCurrentFocus|TYPE_APPLICATION_OVERLAY|mHasSurface"

Check for apps holding the SYSTEM_ALERT_WINDOW permission that could potentially cast overlays:

adb shell cmd appops query-op SYSTEM_ALERT_WINDOW allow

In application code, developers initiate verification by attaching a listener to the target view:

View secureButton = findViewById(R.id.btn_authorize_transfer);
secureButton.generateDisplayHash(
    "PHASH",
    new Rect(0, 0, secureButton.getWidth(), secureButton.getHeight()),
    executor,
    new DisplayHashResultCallback() {
        @Override
        public void onDisplayHashResult(DisplayHash displayHash) {
            // Forward displayHash token to banking backend for cryptographic verification
        }
        @Override
        public void onDisplayHashError(int errorCode) {
            // Handle DISPLAY_HASH_ERROR_UNKNOWN, TOO_MANY_REQUESTS, or NOT_VISIBLE_ON_SCREEN
        }
    }
);

Troubleshooting Hash Verification Failures

When security audits reveal recurring display hash failures, investigate these common graphics and view anomalies:

1. Off-Screen or Partially Clipped Views: If any portion of the requested view bounds falls outside the physical display area (or is hidden behind the status bar or navigation gesture bar), the service returns DISPLAY_HASH_ERROR_NOT_VISIBLE_ON_SCREEN. Ensure layout coordinates account for system insets.
2. Dynamic View Transformations: Views undergoing active translation, rotation, or alpha fading during the exact composition frame may fail perceptual hash thresholds. Always capture the display hash once animations have settled into their resting state.
3. Secure Surfaces (FLAG_SECURE): Views contained within windows marked with WindowManager.LayoutParams.FLAG_SECURE are protected against screenshots and screen recorders. The display hash framework operates seamlessly on secure surfaces, but remote screen recording tools will capture black frames while the hash verification succeeds natively.

By monitoring dumpsys display_hash via ADB, security teams ensure that mobile financial interfaces, authentication buttons, and transactional confirmations remain visually intact and immune to screen overlay attacks.