Secure Storage vs Plain-Text Storage Simulator

Pick how a mobile app stores a sensitive token locally — as plain text in ordinary app storage, or encrypted through a hardware-backed secure keystore — then simulate an attacker who has gained full filesystem access to the device (a rooted phone, a jailbreak, or a stolen backup) and watch what they can actually recover. Plain-text storage hands over the token immediately; the keystore path leaves them holding only unusable encrypted bytes, because the decryption key itself never leaves the isolated secure hardware.