DeviceIntelligence 1.1.0

DeviceIntelligence 1.1.0

First minor since 1.0. Four additive Finding kinds across three detectors, plus internal infrastructure for the next round. Wire-format additive only — schema_version stays at 2.

What's new

runtime.root — Magisk hide-module bypass + TLS-trust-store MITM

Three new finding kinds close the most common bypass paths for the cheap-channel root checks. Shamiko — the LSPosed module that targeted-app-hides Magisk — operates by unsharing the per-process mount namespace of the target app. It cannot patch init (PID 1)'s namespace, and it cannot un-bind the daemon's actively-held abstract Unix socket. Hence:

• magisk_in_init_mountinfo (HIGH) — /proc/1/mountinfo scan. A hit here while /proc/self/mountinfo looks clean is a strong "Magisk is actively hiding from us" signal.
• magisk_daemon_socket_present (HIGH) — @magisk_daemon abstract Unix socket via /proc/self/net/unix. Bound in init's network namespace; visible to every process in the namespace, survives filesystem-artifact hides.
• tls_trust_store_tampered (CRITICAL) — tmpfs bind-mount over /apex/com.android.conscrypt. This is the MagiskTrustUserCerts-family technique that swaps Android's system TLS trust store with one accepting user-installed roots. Once mounted, any HTTPS the app makes is MITM-interceptable by whoever installed the cert (Burp / Charles / mitmproxy / etc.). The signal is active TLS interception enablement, not just "root tool present" — backends should treat as a hard block for sensitive flows.

All three Shamiko-bypass channels read procfs paths through File.readText(); on a denied EACCES (e.g. hidepid=2 locked-down ROMs that hide PID 1's namespace from non-root processes) the read fails and the channel silently degrades to "no signal" — read failures never escalate into findings.

runtime.environment — Frida 16+ Gum memfd-JIT attribution

• frida_memfd_jit_present (HIGH) — /proc/self/maps shows a /memfd:jit-cache mapping with rwxp perms AND region size > 8 MB. ART legitimately maps the same memfd path but only with r-xp / r--p perms — the rwxp combination is a Frida-only signature on Android. Fires in addition to the generic rwx_memory_mapping so backends that want a Frida-attribution signal can pivot on this kind directly without inspecting rwx_memory_mapping's details.

attestation.key — EAT/CBOR format detection (KeyMint 200+)

• attestation_eat_format_detected (LOW) — the leaf cert's KeyDescription extension (OID 1.3.6.1.4.1.11129.2.1.17) carries CBOR-EAT bytes instead of the legacy ASN.1 KeyDescription SEQUENCE. KeyMint 200+ on Android 14+ devices using RKP-provisioned keys can emit attestation in this format. Library-side parsed fields are null on those leaves; backends must re-parse the raw chain bytes (app.attestation.chain_b64) server-side for full field-level data. Heuristic detection only — full on-device CBOR-EAT decoding is tracked for a follow-up minor.

Plus an internal Knox extension-presence helper carried on AttestationResult.Success.knoxExtensionPresent for the follow-up minor that adds Samsung Knox warranty-bit byte parsing.

Wire-format impact

Additive only. Four new Finding.kind strings; no detector ID renames, no IntegritySignal enum changes. schema_version stays at 2. Backends with strict-mode kind allowlists need to add:

• magisk_in_init_mountinfo
• magisk_daemon_socket_present
• tls_trust_store_tampered
• frida_memfd_jit_present
• attestation_eat_format_detected

Everything else continues working unchanged.

IntegritySignal mapping

New kind	Maps to
magisk_in_init_mountinfo, magisk_daemon_socket_present, tls_trust_store_tampered	ROOT_INDICATORS_PRESENT
frida_memfd_jit_present	HOOKING_FRAMEWORK_DETECTED
attestation_eat_format_detected	TEE_ATTESTATION_DEGRADED

Backends already gating on the existing signals will pick up the new channels automatically without code changes.

Validation

• JVM unit tests for every new finding kind (+19 tests across MapsParser, RootIndicators, KeyDescriptionParser, IntegritySignalMapper).
• Pixel 6 Pro on-device validation tracked alongside the existing CTF roadmap rigs.
• Sample :samples:minimal release APK assembled and instrumented through the Gradle plugin's fingerprint baking pipeline — all three ABIs (arm64-v8a, x86_64, armeabi-v7a) hashed, asset injected, APK re-signed v1+v2+v3.

Install

Same as 1.0.0 — just bump the version:

plugins {
    id("io.ssemaj.deviceintelligence") version "1.1.0"
}

Technique credits

All four runtime-detection channels are clean-room reimplementations from public Android security knowledge; no source borrowed:

• Shamiko-bypass channels, MagiskTrustUserCerts MITM detection, Frida memfd-JIT signature: inspired by techniques in the snitchtt project (MIT + Commons Clause; license incompatible with our Apache 2.0 distribution, so no code reuse).
• EAT format heuristic, Knox extension OID prefix: referenced from vvb2060/KeyAttestation (Apache 2.0; cryptographic OIDs are non-copyrightable identifiers).

Full per-detector reference: docs/DETECTORS.md. Detection backlog: tools/red-team/CTF_ROADMAP.md.