Class: AiRootShield::Analyzers::IntegrityChecker

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/analyzers/integrity_checker.rb

Overview

Checks application integrity and detects repackaging/tampering

Constant Summary collapse

REPACKAGING_INDICATORS =

Known repackaging indicators

%w[
  test-keys
  platform.pk8
  shared.pk8
  media.pk8
  debug.keystore
  androiddebugkey
  unsigned
  CERT.RSA
  CERT.DSA
].freeze
SUSPICIOUS_CAS =

Suspicious certificate authorities

%w[
  CN=Android Debug
  CN=Test
  CN=Debug
  O=Android
  OU=Android
].freeze

Instance Method Summary collapse

Instance Method Details

#analyze(device_data) ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/ai_root_shield/analyzers/integrity_checker.rb', line 32

def analyze(device_data)
  factors = []
  risk_score = 0

  # Check application signatures
  signature_result = check_app_signatures(device_data)
  factors.concat(signature_result[:factors])
  risk_score += signature_result[:risk_score]

  # Check for repackaging indicators
  repackaging_result = check_repackaging_indicators(device_data)
  factors.concat(repackaging_result[:factors])
  risk_score += repackaging_result[:risk_score]

  # Check file integrity
  integrity_result = check_file_integrity(device_data)
  factors.concat(integrity_result[:factors])
  risk_score += integrity_result[:risk_score]

  # Check for code injection
  injection_result = check_code_injection(device_data)
  factors.concat(injection_result[:factors])
  risk_score += injection_result[:risk_score]

  {
    factors: factors,
    risk_score: [risk_score, 100].min
  }
end