Class: AiRootShield::Analyzers::RootDetector

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/analyzers/root_detector.rb

Overview

Detects root/jailbreak indicators on Android and iOS devices

Constant Summary collapse

ROOT_BINARIES =

Known root/jailbreak binaries and files

%w[
  /system/bin/su
  /system/xbin/su
  /sbin/su
  /vendor/bin/su
  /system/app/Superuser.apk
  /system/app/SuperSU.apk
  /system/etc/init.d/99SuperSUDaemon
  /dev/com.koushikdutta.superuser.daemon/
  /system/xbin/daemonsu
  /system/xbin/sugote
  /system/xbin/sugote-mksh
  /system/xbin/supolicy
  /system/bin/.ext/.su
  /cache/su
  /data/local/su
  /data/local/bin/su
  /data/local/xbin/su
  /system/sd/xbin/su
  /system/bin/failsafe/su
  /data/local/tmp/su
].freeze
JAILBREAK_FILES = 
%w[
  /Applications/Cydia.app
  /Library/MobileSubstrate/MobileSubstrate.dylib
  /bin/bash
  /usr/sbin/sshd
  /etc/apt
  /private/var/lib/apt/
  /private/var/lib/cydia
  /private/var/mobile/Library/SBSettings/Themes
  /Library/MobileSubstrate/DynamicLibraries/Veency.plist
  /Library/MobileSubstrate/DynamicLibraries/LiveClock.plist
  /System/Library/LaunchDaemons/com.ikey.bbot.plist
  /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
  /etc/ssh/sshd_config
  /var/tmp/cydia.log
  /Applications/Icy.app
  /Applications/MxTube.app
  /Applications/RockApp.app
  /Applications/blackra1n.app
  /Applications/SBSettings.app
  /Applications/FakeCarrier.app
  /Applications/WinterBoard.app
  /Applications/IntelliScreen.app
].freeze
ROOT_PACKAGES = 
%w[
  com.noshufou.android.su
  com.noshufou.android.su.elite
  eu.chainfire.supersu
  com.koushikdutta.superuser
  com.thirdparty.superuser
  com.yellowes.su
  com.koushikdutta.rommanager
  com.koushikdutta.rommanager.license
  com.dimonvideo.luckypatcher
  com.chelpus.lackypatch
  com.ramdroid.appquarantine
  com.ramdroid.appquarantinepro
  com.topjohnwu.magisk
  de.robv.android.xposed.installer
  com.saurik.substrate
].freeze
JAILBREAK_PACKAGES = 
%w[
  cydia
  apt7
  com.saurik.substrate.safemode
  com.bigboss.categories.sbsettings
  com.exile90.icleanerpro
  winterboard
  com.saurik.cydia.startup
  com.saurik.mobilesubstrate
  com.rpetrich.rocketbootstrap
  preferenceloader
  applist
  com.saurik.substrate
].freeze

Instance Method Summary collapse

Instance Method Details

#analyze(device_data) ⇒ Object 



89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/ai_root_shield/analyzers/root_detector.rb', line 89

def analyze(device_data)
  factors = []
  risk_score = 0

  # Check for root/jailbreak based on platform
  case device_data[:platform]
  when "android"
    android_result = check_android_root(device_data)
    factors.concat(android_result[:factors])
    risk_score += android_result[:risk_score]
  when "ios"
    ios_result = check_ios_jailbreak(device_data)
    factors.concat(ios_result[:factors])
    risk_score += ios_result[:risk_score]
  end

  {
    factors: factors,
    risk_score: [risk_score, 100].min
  }
end