DeviceIntelligence 0.9.0

Highlights

CTF Flag 2 captured: detection coverage for five additional hook frameworks. MapsParser.HOOK_FRAMEWORK_SIGNATURES now matches the canonical library names of frameworks the previous releases didn't know about:

Framework	Substrings matched	Notes
Dobby	libdobby, dobby_bridge	General-purpose ARM inline-hook lib (github.com/jmpews/Dobby).
Whale	libwhale	Java method-hook framework (github.com/asLody/whale).
YAHFA	libyahfa	"Yet Another Hook Framework for ART" — used as the ART-side backend by EdXposed and some LSPosed configurations.
FastHook	libfasthook	Niche, mostly seen in game-modding kits.
il2cpp-dumper	libil2cppdumper, zygisk-il2cpp	Zygisk module that dumps Unity IL2CPP game logic. Common on cheating frameworks targeting Unity-based games.

All five emit through the existing hook_framework_present finding kind under runtime.environment, with the canonical name in details.framework. Same IntegritySignal.HOOKING_FRAMEWORK_DETECTED mapping. Backends already speaking the runtime.environment wire format keep working unchanged — the only delta is that details.framework can now contain the new names on attacked devices.

Three frameworks intentionally NOT shipped

ShadowHook (libshadowhook), SandHook (libsandhook), and Pine (libpine) are deferred. Detecting them on library name alone would false-positive on every legitimate consumer app that embeds them (Bytedance ships ShadowHook in TikTok / Douyin / CapCut / Lemon8 for in-app instrumentation; SandHook + Pine are used by some legitimate game-cheat-prevention frameworks).

The proper fix is the embedded-vs-injected distinction — cross-reference each loaded library's path against the consumer app's own build-time native-lib inventory (already captured in Fingerprint.expectedSoList). Tracked under tools/red-team/CTF_ROADMAP.md for a future minor release.

Validation

• 27 unit tests pass, including 8 new ones — one per shipped framework + a negative-control test confirming the deferred-FP-risk signatures do NOT trip when their library names appear in synthesised maps lines.
• Pixel 6 Pro (KernelSU + Frida) end-to-end:
  • Clean baseline at prewarm (Frida not yet attached): zero hook_framework_present findings — no false positives from the new signature additions.
  • Post-tamper (harness names 5 anon pages via prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ...) + Frida self-attaches): runtime.environment.findings contains 6 hook_framework_present entries — all 5 new frameworks plus Frida itself.

New red-team harness

tools/red-team/maps-newer-frameworks.js — Frida script that uses Memory.alloc + prctl(PR_SET_VMA_ANON_NAME) to label anonymous pages with each candidate framework's library name, runs a fresh collectBlocking() (after RuntimeEnvironmentDetector.resetForTest() to drop the cached scan), and asserts every new signature trips. FLAG CAPTURED lands when all five fire.

Wire format

Additive only — no schema bump, no new finding kinds, no new IntegritySignal values, no public API changes. Just new strings the existing detector knows how to recognise.

Consumer (JitPack)

plugins {
    id("io.ssemaj.deviceintelligence") version "0.9.0"
}

com.github.iamjosephmj.DeviceIntelligence · tag 0.9.0

Sample APK

minimal-release.apk attached. APK size unchanged from 0.8.1 — the addition is a few hundred bytes of constant strings in MapsParser.kt.