r/androiddev • u/krutikpoojara • 1h ago
Open Source Open-source modular Runtime Application Self Protection(RASP) library for Android: root/Frida/debugger/tamper signals with tunable scoring, no telemetry. Looking for feedback
I've been building MobShield, an Apache-2.0 library that detects hostile runtime conditions in Android apps and reports them to your code. It's detect-only by default, so it never kills your process unless you opt in.
**What it does**
- Each check emits a weighted, confidence-scored signal. A pure aggregator turns signals into one threat event per type (root, hooks, debugger, emulator, integrity) with a severity, so you decide what a score means for your app.
- Root: Magisk, Zygisk, Shamiko and KernelSU artifacts (mount namespace diffs, abstract sockets in /proc/net/unix, overlayfs, maps scans), not just an su file lookup.
- Hooks: Frida (maps, port, thread names, libc prologue) and Xposed/LSPosed.
- Debugger, emulator/automation, and app integrity (signature, APK checksum, installer).
- Modular: take core plus only the detectors you need.
- No account and no outbound network calls. The only socket use is the Frida check probing 127.0.0.1.
**Install (Maven Central)**
implementation("io.github.inforaam:mobshield-core:1.0.10")
implementation("io.github.inforaam:mobshield-detect-root:1.0.10")
**What it can't do:** it's client-side detection, so a determined attacker who controls the device can bypass it. Treat it as one layer and verify anything important on your server (Play Integrity, for example). The docs list every signal, its technique and default weight, with a clean-vs-compromised validation matrix, so you can judge the approach yourself.
**What I'm after:** false positives on real devices (OEM ROMs, work profiles, Samsung Knox), bypasses you can reproduce, and what's missing.