ai_root_shield 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/.rspec +3 -0
- data/CHANGELOG.md +56 -0
- data/Gemfile +16 -0
- data/Gemfile.lock +88 -0
- data/LICENSE +21 -0
- data/README.md +310 -0
- data/Rakefile +36 -0
- data/examples/device_logs/clean_device.json +74 -0
- data/examples/device_logs/rooted_android.json +93 -0
- data/exe/ai_root_shield +155 -0
- data/lib/ai_root_shield/analyzers/emulator_detector.rb +331 -0
- data/lib/ai_root_shield/analyzers/hooking_detector.rb +375 -0
- data/lib/ai_root_shield/analyzers/integrity_checker.rb +407 -0
- data/lib/ai_root_shield/analyzers/network_analyzer.rb +352 -0
- data/lib/ai_root_shield/analyzers/root_detector.rb +292 -0
- data/lib/ai_root_shield/detector.rb +78 -0
- data/lib/ai_root_shield/device_log_parser.rb +118 -0
- data/lib/ai_root_shield/risk_calculator.rb +161 -0
- data/lib/ai_root_shield/version.rb +5 -0
- data/lib/ai_root_shield.rb +36 -0
- metadata +179 -0
checksums.yaml
ADDED
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
---
|
|
2
|
+
SHA256:
|
|
3
|
+
metadata.gz: 3f124192172da4bb34ee0ec2c385049a4c25de229d2e14fc1df4a5459f2dab1a
|
|
4
|
+
data.tar.gz: e2bf7708d0ea5c292b04ba932d9537a3982554493959161ae09f6deb8997ef78
|
|
5
|
+
SHA512:
|
|
6
|
+
metadata.gz: 0c3d53358069b9c79ca803256d41972e9390662d300033377127f7bf8e5ec6500147e0cdd4d742310a439943a00b2e1c78c58e2484d3f1cb98b21be6703c8d00
|
|
7
|
+
data.tar.gz: a2997cb19587cb3a49270252407b4f3c002c6af9de81801fba5697494d6cd232b268dd35814fd455106c8dbe65c37d1840197eb71d7d345ceba7ffb804988622
|
data/.rspec
ADDED
data/CHANGELOG.md
ADDED
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to this project will be documented in this file.
|
|
4
|
+
|
|
5
|
+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
|
+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
|
+
|
|
8
|
+
## [Unreleased]
|
|
9
|
+
|
|
10
|
+
### Added
|
|
11
|
+
- AI behavioral analysis integration (ONNX model support)
|
|
12
|
+
- Enhanced hooking detection for iOS method swizzling
|
|
13
|
+
- Real-time threat monitoring capabilities
|
|
14
|
+
- Custom rule engine for security policies
|
|
15
|
+
|
|
16
|
+
## [0.1.0] - 2024-09-09
|
|
17
|
+
|
|
18
|
+
### Added
|
|
19
|
+
- Initial release of AI Root Shield
|
|
20
|
+
- Root/jailbreak detection for Android and iOS
|
|
21
|
+
- Emulator and simulator detection
|
|
22
|
+
- Hooking framework detection (Frida, Xposed, Substrate, Magisk)
|
|
23
|
+
- Application integrity and repackaging checks
|
|
24
|
+
- Network security analysis and MITM detection
|
|
25
|
+
- TLS configuration validation
|
|
26
|
+
- Comprehensive risk scoring system (0-100)
|
|
27
|
+
- CLI tool with multiple output formats
|
|
28
|
+
- Offline-first architecture with no data collection
|
|
29
|
+
- Cross-platform support (Android/iOS)
|
|
30
|
+
- Modular analyzer system for extensibility
|
|
31
|
+
|
|
32
|
+
### Security Checks
|
|
33
|
+
- **Root Detection**: Su binaries, root management apps, SELinux status, bootloader unlock
|
|
34
|
+
- **Jailbreak Detection**: Cydia, MobileSubstrate, jailbreak files and packages
|
|
35
|
+
- **Emulator Detection**: QEMU indicators, missing hardware, generic device models
|
|
36
|
+
- **Hooking Detection**: Frida gadgets, Xposed framework, debugging tools
|
|
37
|
+
- **Integrity Checks**: Code signatures, certificate validation, DEX/bundle tampering
|
|
38
|
+
- **Network Analysis**: Proxy detection, custom CAs, MITM tools, VPN analysis
|
|
39
|
+
|
|
40
|
+
### Risk Factors
|
|
41
|
+
- 50+ security indicators with weighted risk scoring
|
|
42
|
+
- Risk amplification for multiple high-risk factors
|
|
43
|
+
- Contextual recommendations based on detected threats
|
|
44
|
+
- Four-tier risk classification (LOW/MEDIUM/HIGH/CRITICAL)
|
|
45
|
+
|
|
46
|
+
### Documentation
|
|
47
|
+
- Comprehensive README with usage examples
|
|
48
|
+
- API documentation with risk factor explanations
|
|
49
|
+
- Device log format specification
|
|
50
|
+
- CLI usage guide and configuration options
|
|
51
|
+
|
|
52
|
+
### Testing
|
|
53
|
+
- Unit tests for all analyzer modules
|
|
54
|
+
- Integration tests for end-to-end scanning
|
|
55
|
+
- Example device logs for testing and demonstration
|
|
56
|
+
- RSpec test suite with comprehensive coverage
|
data/Gemfile
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
source "https://rubygems.org"
|
|
4
|
+
|
|
5
|
+
# Specify your gem's dependencies in ai_root_shield.gemspec
|
|
6
|
+
gemspec
|
|
7
|
+
|
|
8
|
+
gem "rake", "~> 13.0"
|
|
9
|
+
gem "rspec", "~> 3.0"
|
|
10
|
+
gem "rubocop", "~> 1.21"
|
|
11
|
+
gem "yard", "~> 0.9"
|
|
12
|
+
|
|
13
|
+
group :development, :test do
|
|
14
|
+
gem "pry", "~> 0.14"
|
|
15
|
+
gem "simplecov", "~> 0.21"
|
|
16
|
+
end
|
data/Gemfile.lock
ADDED
|
@@ -0,0 +1,88 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: .
|
|
3
|
+
specs:
|
|
4
|
+
ai_root_shield (0.1.0)
|
|
5
|
+
digest (~> 3.1)
|
|
6
|
+
json (~> 2.6)
|
|
7
|
+
openssl (~> 3.0)
|
|
8
|
+
|
|
9
|
+
GEM
|
|
10
|
+
remote: https://rubygems.org/
|
|
11
|
+
specs:
|
|
12
|
+
ast (2.4.3)
|
|
13
|
+
coderay (1.1.3)
|
|
14
|
+
diff-lcs (1.6.2)
|
|
15
|
+
digest (3.2.0)
|
|
16
|
+
docile (1.4.1)
|
|
17
|
+
json (2.13.2)
|
|
18
|
+
language_server-protocol (3.17.0.5)
|
|
19
|
+
lint_roller (1.1.0)
|
|
20
|
+
method_source (1.1.0)
|
|
21
|
+
openssl (3.3.0)
|
|
22
|
+
parallel (1.27.0)
|
|
23
|
+
parser (3.3.9.0)
|
|
24
|
+
ast (~> 2.4.1)
|
|
25
|
+
racc
|
|
26
|
+
prism (1.4.0)
|
|
27
|
+
pry (0.15.2)
|
|
28
|
+
coderay (~> 1.1)
|
|
29
|
+
method_source (~> 1.0)
|
|
30
|
+
racc (1.8.1)
|
|
31
|
+
rainbow (3.1.1)
|
|
32
|
+
rake (13.3.0)
|
|
33
|
+
regexp_parser (2.11.2)
|
|
34
|
+
rspec (3.13.1)
|
|
35
|
+
rspec-core (~> 3.13.0)
|
|
36
|
+
rspec-expectations (~> 3.13.0)
|
|
37
|
+
rspec-mocks (~> 3.13.0)
|
|
38
|
+
rspec-core (3.13.5)
|
|
39
|
+
rspec-support (~> 3.13.0)
|
|
40
|
+
rspec-expectations (3.13.5)
|
|
41
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
42
|
+
rspec-support (~> 3.13.0)
|
|
43
|
+
rspec-mocks (3.13.5)
|
|
44
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
45
|
+
rspec-support (~> 3.13.0)
|
|
46
|
+
rspec-support (3.13.5)
|
|
47
|
+
rubocop (1.80.2)
|
|
48
|
+
json (~> 2.3)
|
|
49
|
+
language_server-protocol (~> 3.17.0.2)
|
|
50
|
+
lint_roller (~> 1.1.0)
|
|
51
|
+
parallel (~> 1.10)
|
|
52
|
+
parser (>= 3.3.0.2)
|
|
53
|
+
rainbow (>= 2.2.2, < 4.0)
|
|
54
|
+
regexp_parser (>= 2.9.3, < 3.0)
|
|
55
|
+
rubocop-ast (>= 1.46.0, < 2.0)
|
|
56
|
+
ruby-progressbar (~> 1.7)
|
|
57
|
+
unicode-display_width (>= 2.4.0, < 4.0)
|
|
58
|
+
rubocop-ast (1.46.0)
|
|
59
|
+
parser (>= 3.3.7.2)
|
|
60
|
+
prism (~> 1.4)
|
|
61
|
+
ruby-progressbar (1.13.0)
|
|
62
|
+
simplecov (0.22.0)
|
|
63
|
+
docile (~> 1.1)
|
|
64
|
+
simplecov-html (~> 0.11)
|
|
65
|
+
simplecov_json_formatter (~> 0.1)
|
|
66
|
+
simplecov-html (0.13.2)
|
|
67
|
+
simplecov_json_formatter (0.1.4)
|
|
68
|
+
unicode-display_width (3.2.0)
|
|
69
|
+
unicode-emoji (~> 4.1)
|
|
70
|
+
unicode-emoji (4.1.0)
|
|
71
|
+
yard (0.9.37)
|
|
72
|
+
|
|
73
|
+
PLATFORMS
|
|
74
|
+
arm64-darwin-24
|
|
75
|
+
ruby
|
|
76
|
+
|
|
77
|
+
DEPENDENCIES
|
|
78
|
+
ai_root_shield!
|
|
79
|
+
bundler (~> 2.0)
|
|
80
|
+
pry (~> 0.14)
|
|
81
|
+
rake (~> 13.0)
|
|
82
|
+
rspec (~> 3.0)
|
|
83
|
+
rubocop (~> 1.21)
|
|
84
|
+
simplecov (~> 0.21)
|
|
85
|
+
yard (~> 0.9)
|
|
86
|
+
|
|
87
|
+
BUNDLED WITH
|
|
88
|
+
2.6.9
|
data/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2024 AI Root Shield
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
data/README.md
ADDED
|
@@ -0,0 +1,310 @@
|
|
|
1
|
+
# AI Root Shield
|
|
2
|
+
|
|
3
|
+
[](https://badge.fury.io/rb/ai_root_shield)
|
|
4
|
+
[](https://opensource.org/licenses/MIT)
|
|
5
|
+
[](https://www.ruby-lang.org/)
|
|
6
|
+
[](https://github.com/ahmetxhero/ai-root-shield)
|
|
7
|
+
|
|
8
|
+
> **Created by [Ahmet KAHRAMAN](https://ahmetxhero.web.app)** - Mobile Developer & Cyber Security Expert
|
|
9
|
+
> *"Security first, innovation always"* 🛡️
|
|
10
|
+
|
|
11
|
+
An AI-powered Ruby library that performs comprehensive on-device compromise detection for mobile applications without requiring a backend. Protects against root/jailbreak, emulators, hooking frameworks, and provides behavioral risk analysis.
|
|
12
|
+
|
|
13
|
+
## 🚀 Features
|
|
14
|
+
|
|
15
|
+
- **Root & Jailbreak Detection**: Detects binaries, file system anomalies, SELinux states (Android), DYLD injections (iOS), and system property manipulation
|
|
16
|
+
- **Emulator/Simulator Detection**: Identifies QEMU drivers, missing baseband, sensor entropy anomalies, and virtualized environments
|
|
17
|
+
- **Hooking & Instrumentation Detection**: Flags Frida gadgets, Magisk modules, Xposed frameworks, method swizzling, and debugger attachments
|
|
18
|
+
- **Repackaging & Integrity Checks**: Validates code signatures, DEX hashes, app bundle integrity, and tamper indicators
|
|
19
|
+
- **Network Security Analysis**: Provides TLS pinning helpers and detects custom CA injections or MITM proxies
|
|
20
|
+
- **AI Behavioral Analysis**: Ready for lightweight ONNX model integration for behavioral risk scoring
|
|
21
|
+
- **Offline & Privacy-Preserving**: Works fully offline, requires no cloud connectivity, and collects no PII
|
|
22
|
+
|
|
23
|
+
## 📦 Installation
|
|
24
|
+
|
|
25
|
+
Add this line to your application's Gemfile:
|
|
26
|
+
|
|
27
|
+
```ruby
|
|
28
|
+
gem 'ai_root_shield'
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
And then execute:
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
$ bundle install
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
Or install it yourself as:
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
$ gem install ai_root_shield
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
## 🔧 Usage
|
|
44
|
+
|
|
45
|
+
### Basic Usage
|
|
46
|
+
|
|
47
|
+
```ruby
|
|
48
|
+
require "ai_root_shield"
|
|
49
|
+
|
|
50
|
+
# Scan device using device logs
|
|
51
|
+
result = AiRootShield.scan_device("device_logs/sample.json")
|
|
52
|
+
|
|
53
|
+
puts result[:risk_score] # => 87
|
|
54
|
+
puts result[:factors] # => ["ROOT_SU_FOUND", "FRIDA_GADGET", "TLS_UNPINNED"]
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
### Advanced Configuration
|
|
58
|
+
|
|
59
|
+
```ruby
|
|
60
|
+
# Custom configuration
|
|
61
|
+
config = {
|
|
62
|
+
enable_root_detection: true,
|
|
63
|
+
enable_emulator_detection: true,
|
|
64
|
+
enable_hooking_detection: true,
|
|
65
|
+
enable_integrity_checks: true,
|
|
66
|
+
enable_network_analysis: true,
|
|
67
|
+
risk_threshold: 70
|
|
68
|
+
}
|
|
69
|
+
|
|
70
|
+
result = AiRootShield.scan_device_with_config("device_logs/sample.json", config)
|
|
71
|
+
|
|
72
|
+
# Get risk level description
|
|
73
|
+
risk_level = AiRootShield::RiskCalculator.risk_level_description(result[:risk_score])
|
|
74
|
+
puts risk_level # => "HIGH" or "CRITICAL"
|
|
75
|
+
|
|
76
|
+
# Get recommended actions
|
|
77
|
+
actions = AiRootShield::RiskCalculator.recommended_actions(result[:factors])
|
|
78
|
+
actions.each { |action| puts "→ #{action}" }
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
### CLI Usage
|
|
82
|
+
|
|
83
|
+
The gem includes a command-line interface:
|
|
84
|
+
|
|
85
|
+
```bash
|
|
86
|
+
# Basic scan
|
|
87
|
+
$ ai_root_shield device_logs/sample.json
|
|
88
|
+
|
|
89
|
+
# With options
|
|
90
|
+
$ ai_root_shield --format text --threshold 60 device_logs/sample.json
|
|
91
|
+
|
|
92
|
+
# Disable specific checks
|
|
93
|
+
$ ai_root_shield --no-emulator --no-network device_logs/sample.json
|
|
94
|
+
|
|
95
|
+
# Get help
|
|
96
|
+
$ ai_root_shield --help
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
## 📊 Risk Scoring
|
|
100
|
+
|
|
101
|
+
The library provides a comprehensive risk score (0-100) based on detected security factors:
|
|
102
|
+
|
|
103
|
+
- **0-20**: LOW - Minimal security concerns
|
|
104
|
+
- **21-40**: MEDIUM - Some security issues detected
|
|
105
|
+
- **41-70**: HIGH - Significant security threats present
|
|
106
|
+
- **71-100**: CRITICAL - Severe compromise indicators
|
|
107
|
+
|
|
108
|
+
### Risk Factors
|
|
109
|
+
|
|
110
|
+
| Category | Examples | Risk Weight |
|
|
111
|
+
|----------|----------|-------------|
|
|
112
|
+
| Root/Jailbreak | `ROOT_SU_FOUND`, `JAILBREAK_CYDIA` | High (15-25) |
|
|
113
|
+
| Emulator | `EMULATOR_QEMU`, `MISSING_BASEBAND` | Medium-High (10-20) |
|
|
114
|
+
| Hooking | `FRIDA_GADGET`, `XPOSED_FRAMEWORK` | High (18-25) |
|
|
115
|
+
| Integrity | `REPACKAGED_APP`, `DEX_TAMPERED` | Medium (10-18) |
|
|
116
|
+
| Network | `TLS_UNPINNED`, `MITM_PROXY_DETECTED` | Medium (8-18) |
|
|
117
|
+
|
|
118
|
+
## 📋 Device Log Format
|
|
119
|
+
|
|
120
|
+
The library expects device logs in JSON format with the following structure:
|
|
121
|
+
|
|
122
|
+
```json
|
|
123
|
+
{
|
|
124
|
+
"platform": "android",
|
|
125
|
+
"system_info": {
|
|
126
|
+
"os_version": "Android 11",
|
|
127
|
+
"kernel_version": "4.19.95-g0123456789ab",
|
|
128
|
+
"build_fingerprint": "google/flame/flame:11/RQ3A.210905.001/7511028:user/release-keys",
|
|
129
|
+
"bootloader_status": "unlocked",
|
|
130
|
+
"selinux_status": "enforcing"
|
|
131
|
+
},
|
|
132
|
+
"installed_packages": [
|
|
133
|
+
{
|
|
134
|
+
"name": "com.example.app",
|
|
135
|
+
"signature": "release-keys"
|
|
136
|
+
}
|
|
137
|
+
],
|
|
138
|
+
"file_system": {
|
|
139
|
+
"suspicious_files": ["/system/bin/su"],
|
|
140
|
+
"system_binaries": ["/system/bin/sh"],
|
|
141
|
+
"writable_system_dirs": []
|
|
142
|
+
},
|
|
143
|
+
"running_processes": [
|
|
144
|
+
{
|
|
145
|
+
"name": "system_server",
|
|
146
|
+
"pid": 123
|
|
147
|
+
}
|
|
148
|
+
],
|
|
149
|
+
"network": {
|
|
150
|
+
"proxy_settings": {"enabled": false},
|
|
151
|
+
"vpn_active": false,
|
|
152
|
+
"certificates": []
|
|
153
|
+
},
|
|
154
|
+
"hardware": {
|
|
155
|
+
"device_model": "Pixel 4",
|
|
156
|
+
"manufacturer": "Google",
|
|
157
|
+
"sensors": ["accelerometer", "gyroscope"]
|
|
158
|
+
}
|
|
159
|
+
}
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
See the `examples/device_logs/` directory for complete examples.
|
|
163
|
+
|
|
164
|
+
## 🛡️ Security Checks
|
|
165
|
+
|
|
166
|
+
### Root/Jailbreak Detection
|
|
167
|
+
- Su binary presence (`/system/bin/su`, `/system/xbin/su`)
|
|
168
|
+
- Root management apps (SuperSU, Magisk, Superuser)
|
|
169
|
+
- Jailbreak files (`/Applications/Cydia.app`, MobileSubstrate)
|
|
170
|
+
- SELinux status (permissive/disabled)
|
|
171
|
+
- Bootloader unlock status
|
|
172
|
+
- Custom ROM indicators
|
|
173
|
+
|
|
174
|
+
### Emulator/Simulator Detection
|
|
175
|
+
- QEMU indicators (`/dev/qemu_pipe`, goldfish kernel)
|
|
176
|
+
- Emulator packages (Genymotion, BlueStacks, Nox)
|
|
177
|
+
- Missing hardware components (baseband, sensors)
|
|
178
|
+
- Generic device identifiers
|
|
179
|
+
- Virtualization processes
|
|
180
|
+
|
|
181
|
+
### Hooking/Instrumentation Detection
|
|
182
|
+
- Frida framework (`frida-server`, `libfrida-gadget.so`)
|
|
183
|
+
- Xposed framework (`XposedBridge.jar`, Xposed installer)
|
|
184
|
+
- Cydia Substrate (`MobileSubstrate`, `libsubstrate.dylib`)
|
|
185
|
+
- Magisk modules and hiding mechanisms
|
|
186
|
+
- Debugging tools (gdb, lldb, strace)
|
|
187
|
+
|
|
188
|
+
### Integrity Checks
|
|
189
|
+
- Application signature validation
|
|
190
|
+
- Debug certificate detection
|
|
191
|
+
- Repackaging indicators (test-keys, unsigned)
|
|
192
|
+
- DEX file tampering (Android)
|
|
193
|
+
- Bundle modification (iOS)
|
|
194
|
+
- Code injection detection
|
|
195
|
+
|
|
196
|
+
### Network Security Analysis
|
|
197
|
+
- TLS configuration and certificate pinning
|
|
198
|
+
- Custom CA certificate installation
|
|
199
|
+
- Proxy configuration detection
|
|
200
|
+
- MITM tool presence (Burp Suite, Charles Proxy)
|
|
201
|
+
- VPN analysis for suspicious patterns
|
|
202
|
+
|
|
203
|
+
## 🗺️ Roadmap
|
|
204
|
+
|
|
205
|
+
- **v0.1** ✅ Static root/jailbreak checks
|
|
206
|
+
- **v0.2** ✅ Emulator/simulator detection + TLS pinning helper
|
|
207
|
+
- **v0.3** 🔄 AI behavioral model (ONNX inference)
|
|
208
|
+
- **v0.4** 📋 Enhanced hooking/instrumentation detection
|
|
209
|
+
- **v1.0** 🎯 Full compromise detection with comprehensive risk scoring
|
|
210
|
+
|
|
211
|
+
## 🤝 Contributing
|
|
212
|
+
|
|
213
|
+
Bug reports and pull requests are welcome on GitHub at https://github.com/ai-root-shield/ai-root-shield.
|
|
214
|
+
|
|
215
|
+
1. Fork the repository
|
|
216
|
+
2. Create your feature branch (`git checkout -b feature/amazing-feature`)
|
|
217
|
+
3. Commit your changes (`git commit -am 'Add some amazing feature'`)
|
|
218
|
+
4. Push to the branch (`git push origin feature/amazing-feature`)
|
|
219
|
+
5. Open a Pull Request
|
|
220
|
+
|
|
221
|
+
## 📄 License
|
|
222
|
+
|
|
223
|
+
The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
|
|
224
|
+
|
|
225
|
+
## 🎯 Use Cases
|
|
226
|
+
|
|
227
|
+
### Financial Services
|
|
228
|
+
- Mobile banking applications
|
|
229
|
+
- Payment processing apps
|
|
230
|
+
- Cryptocurrency wallets
|
|
231
|
+
- Trading platforms
|
|
232
|
+
|
|
233
|
+
### Healthcare
|
|
234
|
+
- Electronic health records
|
|
235
|
+
- Telemedicine applications
|
|
236
|
+
- Medical device interfaces
|
|
237
|
+
- Patient data management
|
|
238
|
+
|
|
239
|
+
### Government & Defense
|
|
240
|
+
- Secure communication apps
|
|
241
|
+
- Identity verification systems
|
|
242
|
+
- Classified information access
|
|
243
|
+
- Military applications
|
|
244
|
+
|
|
245
|
+
### Enterprise Security
|
|
246
|
+
- Corporate mobile applications
|
|
247
|
+
- VPN clients
|
|
248
|
+
- Secure document viewers
|
|
249
|
+
- Enterprise resource planning
|
|
250
|
+
|
|
251
|
+
## 🔬 Technical Details
|
|
252
|
+
|
|
253
|
+
### Architecture
|
|
254
|
+
- Modular analyzer system for extensibility
|
|
255
|
+
- Risk calculation engine with weighted factors
|
|
256
|
+
- Offline-first design for privacy and performance
|
|
257
|
+
- Cross-platform support (Android/iOS)
|
|
258
|
+
|
|
259
|
+
### Performance
|
|
260
|
+
- Lightweight footprint (~2MB)
|
|
261
|
+
- Fast scanning (typically <100ms)
|
|
262
|
+
- No network dependencies
|
|
263
|
+
- Minimal memory usage
|
|
264
|
+
|
|
265
|
+
### Privacy
|
|
266
|
+
- No data collection or transmission
|
|
267
|
+
- All processing happens locally
|
|
268
|
+
- No user identification or tracking
|
|
269
|
+
- Transparent open-source implementation
|
|
270
|
+
|
|
271
|
+
## 📞 Support
|
|
272
|
+
|
|
273
|
+
For questions, issues, or feature requests:
|
|
274
|
+
- GitHub Issues: [Report a bug or request a feature](https://github.com/ahmetxhero/ai-root-shield/issues)
|
|
275
|
+
- Documentation: [Wiki](https://github.com/ahmetxhero/ai-root-shield/wiki)
|
|
276
|
+
- Security Issues: Please email ahmetxhero@gmail.com
|
|
277
|
+
|
|
278
|
+
## 👨💻 About the Author
|
|
279
|
+
|
|
280
|
+
**Ahmet KAHRAMAN** is a Mobile Developer & Cyber Security Expert with 10+ years of experience in Public Sector IT.
|
|
281
|
+
|
|
282
|
+
- 🌐 **Website**: [ahmetxhero.web.app](https://ahmetxhero.web.app)
|
|
283
|
+
- 🎥 **YouTube**: [@ahmetxhero](https://youtube.com/@ahmetxhero)
|
|
284
|
+
- 💼 **LinkedIn**: [linkedin.com/in/ahmetxhero](https://linkedin.com/in/ahmetxhero)
|
|
285
|
+
- 🐤 **Twitter**: [@ahmetxhero](https://x.com/ahmetxhero)
|
|
286
|
+
- 📧 **Email**: ahmetxhero@gmail.com
|
|
287
|
+
- 🏠 **Location**: Ankara, Turkey 🇹🇷
|
|
288
|
+
|
|
289
|
+
**Education & Expertise:**
|
|
290
|
+
- Master's Degree in Forensic Informatics (Gazi University)
|
|
291
|
+
- Certified Ethical Hacker (CEH)
|
|
292
|
+
- Digital Forensics Expert
|
|
293
|
+
- Mobile Development (iOS, Android, Flutter)
|
|
294
|
+
- Cybersecurity & Penetration Testing
|
|
295
|
+
|
|
296
|
+
---
|
|
297
|
+
|
|
298
|
+
**AI Root Shield** - Protecting mobile applications from compromise, one device at a time. 🛡️
|
|
299
|
+
|
|
300
|
+
---
|
|
301
|
+
|
|
302
|
+
<div align="center">
|
|
303
|
+
<strong>Built with ❤️ by <a href="https://ahmetxhero.web.app">Ahmet KAHRAMAN</a></strong><br>
|
|
304
|
+
<em>Mobile Developer & Cyber Security Expert</em><br><br>
|
|
305
|
+
|
|
306
|
+
[](https://youtube.com/@ahmetxhero)
|
|
307
|
+
[](https://linkedin.com/in/ahmetxhero)
|
|
308
|
+
[](https://x.com/ahmetxhero)
|
|
309
|
+
[](https://ahmetxhero.web.app)
|
|
310
|
+
</div>
|
data/Rakefile
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
require "bundler/gem_tasks"
|
|
4
|
+
require "rspec/core/rake_task"
|
|
5
|
+
require "rubocop/rake_task"
|
|
6
|
+
|
|
7
|
+
RSpec::Core::RakeTask.new(:spec)
|
|
8
|
+
RuboCop::RakeTask.new
|
|
9
|
+
|
|
10
|
+
desc "Run all tests and linting"
|
|
11
|
+
task :test => [:spec, :rubocop]
|
|
12
|
+
|
|
13
|
+
desc "Generate documentation"
|
|
14
|
+
task :doc do
|
|
15
|
+
sh "yard doc"
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
desc "Clean generated files"
|
|
19
|
+
task :clean do
|
|
20
|
+
sh "rm -rf coverage/"
|
|
21
|
+
sh "rm -rf doc/"
|
|
22
|
+
sh "rm -rf pkg/"
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
desc "Run example scans"
|
|
26
|
+
task :examples do
|
|
27
|
+
puts "Running example scans..."
|
|
28
|
+
|
|
29
|
+
puts "\n=== Clean Device Scan ==="
|
|
30
|
+
sh "ruby exe/ai_root_shield --format text examples/device_logs/clean_device.json"
|
|
31
|
+
|
|
32
|
+
puts "\n=== Rooted Device Scan ==="
|
|
33
|
+
sh "ruby exe/ai_root_shield --format text examples/device_logs/rooted_android.json"
|
|
34
|
+
end
|
|
35
|
+
|
|
36
|
+
task :default => :test
|
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
{
|
|
2
|
+
"platform": "android",
|
|
3
|
+
"system_info": {
|
|
4
|
+
"os_version": "Android 12",
|
|
5
|
+
"kernel_version": "5.4.147-android12-9-00009-g277909d0bff5",
|
|
6
|
+
"build_fingerprint": "google/redfin/redfin:12/SQ3A.220705.003.A1/8672226:user/release-keys",
|
|
7
|
+
"bootloader_status": "locked",
|
|
8
|
+
"selinux_status": "enforcing",
|
|
9
|
+
"developer_options": false
|
|
10
|
+
},
|
|
11
|
+
"installed_packages": [
|
|
12
|
+
{
|
|
13
|
+
"name": "com.android.chrome",
|
|
14
|
+
"signature": "release-keys"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"name": "com.google.android.gms",
|
|
18
|
+
"signature": "platform"
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"name": "com.whatsapp",
|
|
22
|
+
"signature": "valid"
|
|
23
|
+
}
|
|
24
|
+
],
|
|
25
|
+
"file_system": {
|
|
26
|
+
"suspicious_files": [],
|
|
27
|
+
"system_binaries": [
|
|
28
|
+
"/system/bin/sh",
|
|
29
|
+
"/system/bin/ls"
|
|
30
|
+
],
|
|
31
|
+
"writable_system_dirs": []
|
|
32
|
+
},
|
|
33
|
+
"running_processes": [
|
|
34
|
+
{
|
|
35
|
+
"name": "zygote",
|
|
36
|
+
"pid": 123
|
|
37
|
+
},
|
|
38
|
+
{
|
|
39
|
+
"name": "system_server",
|
|
40
|
+
"pid": 456
|
|
41
|
+
}
|
|
42
|
+
],
|
|
43
|
+
"network": {
|
|
44
|
+
"proxy_settings": {
|
|
45
|
+
"enabled": false
|
|
46
|
+
},
|
|
47
|
+
"vpn_active": false,
|
|
48
|
+
"certificates": []
|
|
49
|
+
},
|
|
50
|
+
"security": {
|
|
51
|
+
"screen_lock_enabled": true,
|
|
52
|
+
"encryption_enabled": true,
|
|
53
|
+
"unknown_sources": false,
|
|
54
|
+
"usb_debugging": false
|
|
55
|
+
},
|
|
56
|
+
"hardware": {
|
|
57
|
+
"device_model": "Pixel 5",
|
|
58
|
+
"manufacturer": "Google",
|
|
59
|
+
"sensors": ["accelerometer", "gyroscope", "magnetometer", "proximity", "light"],
|
|
60
|
+
"baseband_version": "g7250-00168-210528-B-7167256",
|
|
61
|
+
"serial_number": "1A2B3C4D5E6F"
|
|
62
|
+
},
|
|
63
|
+
"certificates": [
|
|
64
|
+
{
|
|
65
|
+
"subject": "CN=Google Inc, O=Google Inc, C=US",
|
|
66
|
+
"issuer": "CN=GeoTrust Global CA, O=GeoTrust Inc., C=US",
|
|
67
|
+
"not_after": "2025-12-31T23:59:59Z"
|
|
68
|
+
}
|
|
69
|
+
],
|
|
70
|
+
"system_logs": [
|
|
71
|
+
"system_server: System ready",
|
|
72
|
+
"zygote: Process started"
|
|
73
|
+
]
|
|
74
|
+
}
|