Common Security Threats

Common Security Threats

The SDK can detect various security threats. Below are the actual detection types returned by the SDK:

Development & Testing Environment Detections

• SIMULATOR_ENVIRONMENT: App running in iOS simulator
• SIMULATOR_RUNTIME: Simulator runtime environment detected
• EMULATOR_DETECTED: Android emulator detected

Debugging & Analysis Tool Detections

• DEBUGGER_SYSTEM_CHECK: Debugger detected via system checks
• DEBUGGER_PROCESS_CHECK: Debugger detected via process inspection
• DEBUGGER_EXCEPTION_CHECK: Debugger detected via exception handling
• FRIDA_DETECTED: Frida dynamic instrumentation framework detected
• FRIDA_SERVER_RUNNING: Active Frida server found

Security & Integrity Detections

• COMMON_SUSPICIOUS_PATH: Suspicious file paths accessible
• VPN_IN_USE: VPN connection detected
• ROOT_DETECTED: Device has root/jailbreak access
• HOOK_DETECTED: Runtime hooking framework detected
• TAMPERED: App binary or resources modified
• REPACKAGED: App has been decompiled and repackaged

Detection Format

All detections follow this format:

DETECTION: <TYPE> <Description>

Example:

DETECTION: FRIDA_DETECTED Frida traces detected
DETECTION: SIMULATOR_RUNTIME Simulator runtime detected
DETECTION: DEBUGGER_SYSTEM_CHECK Debugger detected (system check)

Parsing Detection Types:

class DetectionInfo {
  final String type;
  final String description;

  DetectionInfo(this.type, this.description);

  @override
  String toString() => 'DetectionInfo(type: $type, description: $description)';
}

DetectionInfo? parseDetection(String detection) {
  if (detection.startsWith('DETECTION:')) {
    // Remove 'DETECTION: ' prefix
    final withoutPrefix = detection.substring(11).trim();

    // Split into type and description
    final firstSpaceIndex = withoutPrefix.indexOf(' ');
    if (firstSpaceIndex > 0) {
      final type = withoutPrefix.substring(0, firstSpaceIndex);
      final description = withoutPrefix.substring(firstSpaceIndex + 1);
      return DetectionInfo(type, description);
    } else {
      // No description, just type
      return DetectionInfo(withoutPrefix, '');
    }
  }
  return null;
}

// Example usage with real data
// getRejectReasons() returns a newline-separated string; split it into a list
final rejectReasonsRaw = await AlphynSdk.getRejectReasons();
final rejectReasons = rejectReasonsRaw.split('\n').where((line) => line.trim().isNotEmpty).toList();
for (var reason in rejectReasons) {
  final detection = parseDetection(reason);
  if (detection != null) {
    print('Type: ${detection.type}');
    print('Description: ${detection.description}');
    print('---');
  }
}

// Example output:
// Type: FRIDA_DETECTED
// Description: Frida traces detected
// ---
// Type: SIMULATOR_RUNTIME
// Description: Simulator runtime detected
// ---
// Type: DEBUGGER_SYSTEM_CHECK
// Description: Debugger detected (system check)
// ---

// Check for specific detection types
bool hasFridaDetection(List<String> reasons) {
  return reasons.any((reason) =>
    parseDetection(reason)?.type == 'FRIDA_DETECTED' ||
    parseDetection(reason)?.type == 'FRIDA_SERVER_RUNNING'
  );
}

bool hasDebuggerDetection(List<String> reasons) {
  return reasons.any((reason) {
    final type = parseDetection(reason)?.type ?? '';
    return type.startsWith('DEBUGGER_');
  });
}

bool hasSimulatorDetection(List<String> reasons) {
  return reasons.any((reason) {
    final type = parseDetection(reason)?.type ?? '';
    return type.startsWith('SIMULATOR_') || type == 'EMULATOR_DETECTED';
  });
}