---
title: Window Punching | Guardsquare
description: Window punching is a defense technique against activity and view injections. Learn about how to use window punching, and its limitations.
---

[![guardsquare-logo](https://insights.guardsquare.com/hs-fs/hubfs/Logos/logo-white.png?length=536&name=logo-white.png "guardsquare-logo") ](https://23593082.hs-sites.com/)

- pricing

[Request Pricing](https://www.guardsquare.com/request-pricing?hsCtaTracking=646b0379-d596-4b1a-8526-2ccbdbb0f81b%7Ce8809087-a83f-4476-8b22-34b9572013fd)

[Login](https://customers.guardsquare.com/login?utm_referrer=https%3A%2F%2Fwww.guardsquare.com%2F)

En

- [中文](https://www.guardsquare.com/zh-hans)
- [한국어](https://www.guardsquare.com/ko)
- [Português](https://www.guardsquare.com/pt-br)
- [Español](https://www.guardsquare.com/es)

# [Mobile Application]

# Security Research Center

 Table of contents

# Window punching

|   | **Technique summary** |
| --- | --- |
| **Technique** | Window punching |
| **Against** | [UI injections](https://23593082.hs-sites.com/knowledgebasetest/attacks/overlay-attacks): Activity injections and View injections |
| **Limitations** | API Level <33 (Android <13) |
|   | **Cannot** have `INJECT_EVENTS` permission |
|   | Does not detect non-touchable overlays |
| **Side effects** | None |
| **Recommendations** | Recommended for use [combined with other techniques](https://23593082.hs-sites.com/knowledgebasetest/attacks/overlay-attacks). |

Window punching is a defense technique against activity and view injections.

This technique was proposed by AlJarrah et al.1 and endorsed by Kalysch et al.2. It relies on the possibility that the `android.app.Instrumentation` API provides a way to simulate touches on the screen. An application can generate touches only on views that belong to itself. In order to do that on external views, the `INJECT_EVENTS` permission is needed. Thus, an app can simulate touches ("punches") on specific areas of the screen and, if it touches a view that belongs to a different application, a `SecurityException`exception will raise:

`Injecting to another application requires INJECT_EVENTS permission`

Use that behavior to detect the presence of an overlay or injection. Thus, if we throw punches on, e.g., a password field, and we see an exception, we will know that there is an injection or overlay positioned over that field.

This code snippet would simulate one punch in specific coordinates:

 private void throwPunch(int x, int y) { long downTime = SystemClock.uptimeMillis(); long eventTime = SystemClock.uptimeMillis(); MotionEvent event = MotionEvent.obtain(downTime, eventTime, MotionEvent.ACTION_DOWN, x, y, 0); event.setSource(InputDevice.SOURCE_TOUCHSCREEN); instrumentation.sendPointerSync(event); }

To trigger a burst of a specific number of touches on a specific area:

 private void launchBarrageOfPunches(int xMax, int yMax, int nPunches, boolean randomX, boolean randomY) { for (int punchCount = 0; punchCount < nPunches; punchCount++) { // (...) throwPunch(x, y); } }

Burst of touches can be launched at a specific time interval, and if an exception occurs, it will lead to a detection.

 try { launchBarrageOfPunches(xMax, yMax, n, true, false); return false; } catch(SecurityException e) { return true; // injection detected }

![overlay-punching](https://23593082.hs-sites.com/hs-fs/hubfs/knowledge-base-photos/overlay-punching.gif?width=800&height=1708&name=overlay-punching.gif)

*Example implementation of top package inspection defense*

One limitation is that this mechanism does not work from API level 33 (Android 13) onward. In this case, the exception is generated even when trying to simulate touches on the same application.

## [Guardsquare](https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare)

Connect with the author

** Table of contents **

![HubSpot CMS](https://cdn2.hubspot.net/hubfs/302335/hubspot-cms-logo-gray.svg "HubSpot CMS")

[General Terms](https://23593082.hs-sites.com/terms-of-use) | [Privacy Policy](https://23593082.hs-sites.com/privacy-policy) | [Cookie Policy](https://23593082.hs-sites.com/cookie-policy)

Tervuursevest 362 bus 1, 3000 Leuven, Belgium | VAT: BE0550675829 |

© 2016-2026 Guardsquare nv. All rights reserved.

<https://www.facebook.com/guardsquare> <https://twitter.com/Guardsquare> <https://www.linkedin.com/company/guardsquare/> <https://www.youtube.com/channel/UCP9s5F1ksT1E-7vSF2CDyhw> <https://github.com/Guardsquare>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Guardsquare",
    "url" : "https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare"
  },
  "dateModified" : "2024-02-28T02:20:20.399Z",
  "datePublished" : "2024-02-13T19:32:25.000Z",
  "headline" : "Window Punching | Guardsquare",
  "mainEntityOfPage" : {
    "@id" : "https://23593082.hs-sites.com/knowledgebasetest/defense/overlay-window-punching",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    }
  }
}
```