ai_root_shield 0.1.0

data/lib/ai_root_shield/analyzers/hooking_detector.rb

@@ -0,0 +1,375 @@
+# frozen_string_literal: true
+
+module AiRootShield
+  module Analyzers
+    # Detects hooking frameworks and runtime instrumentation
+    class HookingDetector
+      # Frida indicators
+      FRIDA_INDICATORS = %w[
+        frida-server
+        frida-agent
+        frida-gadget
+        re.frida.server
+        /data/local/tmp/frida-server
+        /system/bin/frida-server
+        /system/xbin/frida-server
+        libfrida-gadget.so
+        frida-agent.so
+        FridaGadget
+      ].freeze
+
+      # Xposed Framework indicators
+      XPOSED_INDICATORS = %w[
+        de.robv.android.xposed.installer
+        XposedBridge
+        XposedHelpers
+        libxposed_art.so
+        libxposed_dalvik.so
+        /system/framework/XposedBridge.jar
+        /system/bin/app_process_xposed
+        /system/xbin/xposed
+        XposedMods
+      ].freeze
+
+      # Substrate/Cydia Substrate indicators
+      SUBSTRATE_INDICATORS = %w[
+        MobileSubstrate
+        libsubstrate.dylib
+        /Library/MobileSubstrate/
+        /usr/lib/libsubstrate.dylib
+        CydiaSubstrate
+        MSHookFunction
+        MSHookMessageEx
+        substrate.h
+      ].freeze
+
+      # Magisk indicators
+      MAGISK_INDICATORS = %w[
+        magisk
+        magiskhide
+        magiskpolicy
+        /sbin/magisk
+        /system/xbin/magisk
+        com.topjohnwu.magisk
+        magisk.img
+        magisk_merge.img
+        .magisk
+        magiskinit
+      ].freeze
+
+      # Debugging indicators
+      DEBUG_INDICATORS = %w[
+        android:debuggable
+        ro.debuggable
+        gdb
+        gdbserver
+        lldb
+        lldb-server
+        strace
+        ltrace
+        /system/bin/gdbserver
+        /data/local/tmp/gdbserver
+      ].freeze
+
+      def analyze(device_data)
+        factors = []
+        risk_score = 0
+
+        # Check for Frida
+        frida_result = check_frida_presence(device_data)
+        factors.concat(frida_result[:factors])
+        risk_score += frida_result[:risk_score]
+
+        # Check for Xposed Framework
+        xposed_result = check_xposed_framework(device_data)
+        factors.concat(xposed_result[:factors])
+        risk_score += xposed_result[:risk_score]
+
+        # Check for Substrate (iOS)
+        substrate_result = check_substrate_presence(device_data)
+        factors.concat(substrate_result[:factors])
+        risk_score += substrate_result[:risk_score]
+
+        # Check for Magisk
+        magisk_result = check_magisk_presence(device_data)
+        factors.concat(magisk_result[:factors])
+        risk_score += magisk_result[:risk_score]
+
+        # Check for debugging tools
+        debug_result = check_debugging_tools(device_data)
+        factors.concat(debug_result[:factors])
+        risk_score += debug_result[:risk_score]
+
+        # Check runtime behavior indicators
+        runtime_result = check_runtime_indicators(device_data)
+        factors.concat(runtime_result[:factors])
+        risk_score += runtime_result[:risk_score]
+
+        {
+          factors: factors,
+          risk_score: [risk_score, 100].min
+        }
+      end
+
+      private
+
+      def check_frida_presence(device_data)
+        factors = []
+        risk_score = 0
+
+        # Check processes
+        processes = device_data[:processes] || []
+        process_names = processes.map { |proc| proc.is_a?(Hash) ? proc["name"] : proc.to_s }
+
+        FRIDA_INDICATORS.each do |indicator|
+          if process_names.any? { |proc| proc.downcase.include?(indicator.downcase) }
+            factors << "FRIDA_GADGET"
+            risk_score += 25
+            break
+          end
+        end
+
+        # Check file system
+        file_system = device_data[:file_system] || {}
+        all_files = (file_system[:suspicious_files] || []) + (file_system[:system_binaries] || [])
+
+        FRIDA_INDICATORS.each do |indicator|
+          if all_files.any? { |file| file.to_s.downcase.include?(indicator.downcase) }
+            factors << "FRIDA_FILES_DETECTED"
+            risk_score += 20
+            break
+          end
+        end
+
+        # Check installed packages
+        packages = device_data[:installed_packages] || []
+        package_names = packages.map { |pkg| pkg.is_a?(Hash) ? pkg["name"] : pkg.to_s }
+
+        if package_names.any? { |pkg| pkg.downcase.include?("frida") }
+          factors << "FRIDA_PACKAGE_INSTALLED"
+          risk_score += 22
+        end
+
+        {
+          factors: factors,
+          risk_score: risk_score
+        }
+      end
+
+      def check_xposed_framework(device_data)
+        factors = []
+        risk_score = 0
+
+        # Check installed packages
+        packages = device_data[:installed_packages] || []
+        package_names = packages.map { |pkg| pkg.is_a?(Hash) ? pkg["name"] : pkg.to_s }
+
+        XPOSED_INDICATORS.each do |indicator|
+          if package_names.any? { |pkg| pkg.downcase.include?(indicator.downcase) }
+            factors << "XPOSED_FRAMEWORK"
+            risk_score += 22
+            break
+          end
+        end
+
+        # Check file system for Xposed files
+        file_system = device_data[:file_system] || {}
+        all_files = (file_system[:suspicious_files] || []) + (file_system[:system_binaries] || [])
+
+        XPOSED_INDICATORS.each do |indicator|
+          if all_files.any? { |file| file.to_s.include?(indicator) }
+            factors << "XPOSED_FILES_DETECTED"
+            risk_score += 18
+            break
+          end
+        end
+
+        # Check system logs for Xposed activity
+        logs = device_data[:logs] || []
+        if logs.any? { |log| log.to_s.downcase.include?("xposed") }
+          factors << "XPOSED_LOG_ACTIVITY"
+          risk_score += 15
+        end
+
+        {
+          factors: factors,
+          risk_score: risk_score
+        }
+      end
+
+      def check_substrate_presence(device_data)
+        factors = []
+        risk_score = 0
+
+        return { factors: factors, risk_score: risk_score } unless device_data[:platform] == "ios"
+
+        # Check file system for Substrate files
+        file_system = device_data[:file_system] || {}
+        all_files = (file_system[:suspicious_files] || []) + (file_system[:system_binaries] || [])
+
+        SUBSTRATE_INDICATORS.each do |indicator|
+          if all_files.any? { |file| file.to_s.include?(indicator) }
+            factors << "SUBSTRATE_INJECTION"
+            risk_score += 18
+            break
+          end
+        end
+
+        # Check installed packages for Substrate-related apps
+        packages = device_data[:installed_packages] || []
+        package_names = packages.map { |pkg| pkg.is_a?(Hash) ? pkg["name"] : pkg.to_s }
+
+        if package_names.any? { |pkg| pkg.downcase.include?("substrate") || pkg.downcase.include?("cydia") }
+          factors << "SUBSTRATE_PACKAGE_DETECTED"
+          risk_score += 20
+        end
+
+        {
+          factors: factors,
+          risk_score: risk_score
+        }
+      end
+
+      def check_magisk_presence(device_data)
+        factors = []
+        risk_score = 0
+
+        return { factors: factors, risk_score: risk_score } unless device_data[:platform] == "android"
+
+        # Check processes for Magisk
+        processes = device_data[:processes] || []
+        process_names = processes.map { |proc| proc.is_a?(Hash) ? proc["name"] : proc.to_s }
+
+        MAGISK_INDICATORS.each do |indicator|
+          if process_names.any? { |proc| proc.downcase.include?(indicator.downcase) }
+            factors << "MAGISK_MODULES"
+            risk_score += 20
+            break
+          end
+        end
+
+        # Check file system for Magisk files
+        file_system = device_data[:file_system] || {}
+        all_files = (file_system[:suspicious_files] || []) + (file_system[:system_binaries] || [])
+
+        MAGISK_INDICATORS.each do |indicator|
+          if all_files.any? { |file| file.to_s.downcase.include?(indicator.downcase) }
+            factors << "MAGISK_FILES_DETECTED"
+            risk_score += 18
+            break
+          end
+        end
+
+        # Check installed packages
+        packages = device_data[:installed_packages] || []
+        package_names = packages.map { |pkg| pkg.is_a?(Hash) ? pkg["name"] : pkg.to_s }
+
+        if package_names.any? { |pkg| pkg.downcase.include?("magisk") }
+          factors << "MAGISK_APP_INSTALLED"
+          risk_score += 22
+        end
+
+        {
+          factors: factors,
+          risk_score: risk_score
+        }
+      end
+
+      def check_debugging_tools(device_data)
+        factors = []
+        risk_score = 0
+
+        # Check processes for debugging tools
+        processes = device_data[:processes] || []
+        process_names = processes.map { |proc| proc.is_a?(Hash) ? proc["name"] : proc.to_s }
+
+        DEBUG_INDICATORS.each do |indicator|
+          if process_names.any? { |proc| proc.downcase.include?(indicator.downcase) }
+            factors << "DEBUGGER_ATTACHED"
+            risk_score += 15
+            break
+          end
+        end
+
+        # Check file system for debugging binaries
+        file_system = device_data[:file_system] || {}
+        all_files = (file_system[:suspicious_files] || []) + (file_system[:system_binaries] || [])
+
+        DEBUG_INDICATORS.each do |indicator|
+          if all_files.any? { |file| file.to_s.include?(indicator) }
+            factors << "DEBUG_TOOLS_PRESENT"
+            risk_score += 12
+            break
+          end
+        end
+
+        # Check system settings for debugging flags
+        system_info = device_data[:system_info] || {}
+        security_settings = device_data[:security_settings] || {}
+
+        if security_settings[:usb_debugging] == true
+          factors << "USB_DEBUGGING_ENABLED"
+          risk_score += 10
+        end
+
+        {
+          factors: factors,
+          risk_score: risk_score
+        }
+      end
+
+      def check_runtime_indicators(device_data)
+        factors = []
+        risk_score = 0
+
+        # Check for suspicious library injections
+        processes = device_data[:processes] || []
+        
+        processes.each do |process|
+          next unless process.is_a?(Hash)
+          
+          libraries = process["loaded_libraries"] || []
+          
+          # Check for known hooking libraries
+          hooking_libs = %w[libfrida libxposed libsubstrate libmagisk]
+          
+          hooking_libs.each do |lib|
+            if libraries.any? { |library| library.to_s.downcase.include?(lib) }
+              factors << "RUNTIME_LIBRARY_INJECTION"
+              risk_score += 18
+              break
+            end
+          end
+        end
+
+        # Check system logs for hooking activity
+        logs = device_data[:logs] || []
+        
+        hooking_keywords = %w[hook inject frida xposed substrate magisk]
+        
+        hooking_keywords.each do |keyword|
+          if logs.any? { |log| log.to_s.downcase.include?(keyword) }
+            factors << "HOOKING_LOG_ACTIVITY"
+            risk_score += 12
+            break
+          end
+        end
+
+        # Check for method swizzling indicators (iOS)
+        if device_data[:platform] == "ios"
+          swizzling_indicators = %w[method_exchangeImplementations class_replaceMethod]
+          
+          if logs.any? { |log| swizzling_indicators.any? { |indicator| log.to_s.include?(indicator) } }
+            factors << "METHOD_SWIZZLING_DETECTED"
+            risk_score += 15
+          end
+        end
+
+        {
+          factors: factors,
+          risk_score: risk_score
+        }
+      end
+    end
+  end
+end