Skip to content

DeviceIntelligence 1.0.0

Choose a tag to compare

View all tags
@iamjosephmj iamjosephmj released this 03 May 19:45
· 121 commits to main since this release
1.0.0
7fc67e6

DeviceIntelligence 1.0.0

First stable release. The wire format and public Kotlin API are now committed-to: additive changes only without a major version bump; breaking changes will require both a schema_version increment and a major version bump.

What's in 1.0

Eight detectors with stable IDs and stable finding kinds:

  • integrity.apk — APK bytes vs. the build-time fingerprint baked by the Gradle plugin
  • integrity.bootloader — TEE-spoofing / cached-chain detection
  • integrity.art — In-process ART tampering across 5 vectors (Frida, Xposed, LSPosed, Pine, …)
  • attestation.key — TEE / StrongBox attestation: Verified Boot, bootloader lock, OS patch level
  • runtime.environment — Debugger / ptrace / native integrity stack (.text hash, GOT, injected libs) + runtime DEX-injection (InMemoryDexClassLoader / DexClassLoader payloads)
  • runtime.root — su binary, Magisk artifacts, test-keys, root-manager apps
  • runtime.emulator — CPU-instruction-level signals (arm64 MRS / x86_64 CPUID hypervisor bit)
  • runtime.cloner — Foreign APK mappings, mount-namespace inconsistencies, UID mismatches

Eight-layer native anti-hook stack (G0–G7): module liveness, .text SHA-256 vs build-time baseline, library inventory, GOT integrity, StackGuard call-stack inspection, StackWatchdog sampled inspection, JNI return-address verification.

Twelve hook framework signatures: Frida, Cydia Substrate, Xposed, LSPosed, Riru, Zygisk, Taichi, Dobby, Whale, YAHFA, FastHook, zygisk-il2cpp-dumper.

Runtime DEX injection detection (CTF Flag 1):

  • Channel (a) — multi-root BaseDexClassLoader chain walk
  • Channel (b) — /proc/self/maps named-anon scan (Android 14+ [anon:dalvik-DEX data] and ≤ Android 13 [anon:dalvik-classes.dex extracted in memory from <source>] formats)
  • Pre-baseline timing-gap handling via unattributable_dex_at_baseline (consolidated to one summary finding per session, not per region)

Three native ABIs: arm64-v8a, x86_64, armeabi-v7a. All runtime-validated on the Sauce Labs Android 11+ device farm spanning Samsung One UI, Xiaomi HyperOS / MIUI, Vivo OriginOS, Honor MagicOS, OPPO ColorOS, OnePlus OxygenOS, Motorola, plus AOSP-equivalent Pixels.

Cumulative session API (observeSession(), SessionFindings, SessionFindingsAggregator) for UIs / backends that don't want to lose sight of a transient signal the moment it stops appearing. Per-finding firstSeenAtEpochMs / lastSeenAtEpochMs / observationCount / stillActive flags. Canonical wire format via SessionFindings.toJson().

Hardware-attestation × runtime correlation (CTF Flag 5 — captured 1.0.0). Derived hardware_attested_but_userspace_tampered finding emitted at CRITICAL severity when both:

  1. attestation.key.verifiedBootState == "Verified" (TEE asserts a clean, locked-bootloader, signed-OS boot)
  2. Any IntegritySignal.HOOKING_FRAMEWORK_DETECTED-mapped finding fires in the same report

The strongest single tamper signal the SDK can produce. Either the TEE is compromised (rare but exists) or this is post-attestation injection (Magisk + Shamiko, etc.). Backends should treat this as a hard-block-grade signal.

Privacy-first analytics: SHA-256 of ro.build.fingerprint for client_id, no PII, no package names, no memory addresses on the wire. Disable via deviceintelligence { disableAnalytics.set(true) }.

Open-source end to end (Kotlin + native C++); zero Google Play Services dependency; works on AOSP, GrapheneOS, CalyxOS, OpenGApps, etc. Hardware key attestation still works on those builds because it's a Keymaster API call, not a Google API call.

Validation

  • 209 unit tests across 17 test classes
  • Pixel 6 Pro red-team (KernelSU + LSPosed + Frida): every Frida vector A–F + Frida-Java + DEX injection (in-memory and disk) + LSPosed late and pre-baseline scenarios + newer-frameworks signature trip
  • Sauce Labs cross-OEM (Android 11+ device farm) — Samsung, Xiaomi, Vivo, Honor, OnePlus, OPPO, Motorola, Pixel
  • Cross-ABI runtime stability: all three ABIs verified loading the native library and running every detector to completion

What "1.0 wire-format commitment" means concretely

For consumers building backends against the JSON contract:

  • The schema_version (currently 2) is the source of truth for wire-format breakage. It does NOT bump for additive changes.
  • Detector IDs (integrity.apk, integrity.art, etc.) are stable.
  • Finding.kind identifiers (hook_framework_present, art_method_entry_drifted, dex_in_anonymous_mapping, etc.) are stable.
  • Finding.severity, Finding.subject, Finding.message shapes are stable; specific message text may evolve (don't string-match on it server-side).
  • Finding.details is opaque diagnostic data — useful for forensics, but its keys may change between releases without a schema_version bump.
  • Adding new detectors, new finding kinds, or new IntegritySignal enum values is additive. Existing kind strings are never repurposed.

What's intentionally NOT in 1.0

Some detection capabilities are tracked for future minor releases, not deferred for any quality reason:

  • CTF Flag 3 (Shamiko / Magisk-hide property interception) — most-deployed real-world evasion, planned next.
  • Real Zygisk module for Flag 1 production-realism validation — the LSPosed-early simulation already proves the pre-baseline timing logic.
  • 32-bit ART struct characterisation — integrity.art reports INCONCLUSIVE on armeabi-v7a because the ArtMethod field-offset table is currently 64-bit-only. Per-API characterisation is a research task for a future minor.
  • ShadowHook / SandHook / Pine signature additions — these are commonly embedded in legitimate apps (Bytedance ships ShadowHook in TikTok / Douyin / CapCut / Lemon8 for in-app patching), so name-only detection would FP every install. The fix is the embedded-vs-injected distinction; tracked as a separate roadmap item.

See tools/red-team/CTF_ROADMAP.md for the full backlog.

Consumer (JitPack)

plugins {
    id("io.ssemaj.deviceintelligence") version "1.0.0"
}

com.github.iamjosephmj.DeviceIntelligence · tag 1.0.0

Documentation

  • README.md — install + quick start + IntegritySignal vocabulary + JSON contract
  • CHANGELOG.md — full version history from 0.5.2 → 1.0.0
  • SECURITY.md — vulnerability disclosure process, response SLOs
  • docs/DETECTORS.md — per-detector reference (threat model, finding kinds, sample tripped JSON)
  • NATIVE_INTEGRITY_DESIGN.md — design of the 8-layer (G0–G7) anti-hooking stack
  • tools/red-team/ — Frida + LSPosed offensive verification harnesses

Sample APK

minimal-release.apk is attached to this release — install on a rooted device + LSPosed manager to exercise every detector against real attacker tooling. Signed with the local debug keystore (matches every prior release).

Assets 3
Loading