Class: AiRootShield::Analyzers::HookingDetector

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/analyzers/hooking_detector.rb

Overview

Detects hooking frameworks and runtime instrumentation

Constant Summary collapse

FRIDA_INDICATORS =

Frida indicators

%w[
  frida-server
  frida-agent
  frida-gadget
  re.frida.server
  /data/local/tmp/frida-server
  /system/bin/frida-server
  /system/xbin/frida-server
  libfrida-gadget.so
  frida-agent.so
  FridaGadget
].freeze
XPOSED_INDICATORS =

Xposed Framework indicators

%w[
  de.robv.android.xposed.installer
  XposedBridge
  XposedHelpers
  libxposed_art.so
  libxposed_dalvik.so
  /system/framework/XposedBridge.jar
  /system/bin/app_process_xposed
  /system/xbin/xposed
  XposedMods
].freeze
SUBSTRATE_INDICATORS =

Substrate/Cydia Substrate indicators

%w[
  MobileSubstrate
  libsubstrate.dylib
  /Library/MobileSubstrate/
  /usr/lib/libsubstrate.dylib
  CydiaSubstrate
  MSHookFunction
  MSHookMessageEx
  substrate.h
].freeze
MAGISK_INDICATORS =

Magisk indicators

%w[
  magisk
  magiskhide
  magiskpolicy
  /sbin/magisk
  /system/xbin/magisk
  com.topjohnwu.magisk
  magisk.img
  magisk_merge.img
  .magisk
  magiskinit
].freeze
DEBUG_INDICATORS =

Debugging indicators

%w[
  android:debuggable
  ro.debuggable
  gdb
  gdbserver
  lldb
  lldb-server
  strace
  ltrace
  /system/bin/gdbserver
  /data/local/tmp/gdbserver
].freeze

Instance Method Summary collapse

Instance Method Details

#analyze(device_data) ⇒ Object 



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
 
# File 'lib/ai_root_shield/analyzers/hooking_detector.rb', line 74

def analyze(device_data)
  factors = []
  risk_score = 0

  # Check for Frida
  frida_result = check_frida_presence(device_data)
  factors.concat(frida_result[:factors])
  risk_score += frida_result[:risk_score]

  # Check for Xposed Framework
  xposed_result = check_xposed_framework(device_data)
  factors.concat(xposed_result[:factors])
  risk_score += xposed_result[:risk_score]

  # Check for Substrate (iOS)
  substrate_result = check_substrate_presence(device_data)
  factors.concat(substrate_result[:factors])
  risk_score += substrate_result[:risk_score]

  # Check for Magisk
  magisk_result = check_magisk_presence(device_data)
  factors.concat(magisk_result[:factors])
  risk_score += magisk_result[:risk_score]

  # Check for debugging tools
  debug_result = check_debugging_tools(device_data)
  factors.concat(debug_result[:factors])
  risk_score += debug_result[:risk_score]

  # Check runtime behavior indicators
  runtime_result = check_runtime_indicators(device_data)
  factors.concat(runtime_result[:factors])
  risk_score += runtime_result[:risk_score]

  {
    factors: factors,
    risk_score: [risk_score, 100].min
  }
end