react-native-security-suite 0.9.21 → 1.0.0-rc.1

package/ios/Security/AppIntegrityChecker.swift

@@ -0,0 +1,85 @@
+import Foundation
+import Security
+
+enum AppIntegrityChecker {
+  static func verify() -> [String: Any] {
+    let bundleId = Bundle.main.bundleIdentifier ?? ""
+    let debuggable = isDebugBuild()
+    let buildType = resolveBuildType(debuggable: debuggable)
+    let validSignature = validateCodeSignature()
+    let suspiciousLibraries = scanInjectedDylibs()
+    let tampered = !validSignature || !suspiciousLibraries.isEmpty
+
+    var result: [String: Any] = [
+      "validSignature": validSignature,
+      "debuggable": debuggable,
+      "tampered": tampered,
+      "buildType": buildType,
+      "bundleIdentifier": bundleId,
+    ]
+
+    if debuggable {
+      result["installerTrusted"] = true
+    }
+
+    return result
+  }
+
+  private static func validateCodeSignature() -> Bool {
+    guard let bundleURL = Bundle.main.bundleURL as CFURL? else {
+      return false
+    }
+
+    var staticCode: SecStaticCode?
+    let createStatus = SecStaticCodeCreateWithPath(bundleURL, [], &staticCode)
+    guard createStatus == errSecSuccess, let code = staticCode else {
+      return false
+    }
+
+    let verifyStatus = SecStaticCodeCheckValidity(code, [], nil)
+    return verifyStatus == errSecSuccess
+  }
+
+  private static func scanInjectedDylibs() -> [String] {
+    let suspiciousKeywords = ["frida", "substrate", "cycript", "libhooker", "substitute", "ellekit"]
+    var matches: [String] = []
+    let imageCount = _dyld_image_count()
+
+    for index in 0..<imageCount {
+      guard let imageName = _dyld_get_image_name(index) else {
+        continue
+      }
+      let path = String(cString: imageName).lowercased()
+      guard path.hasPrefix("/var/") || path.contains("/mobilesubstrate/") else {
+        continue
+      }
+      for keyword in suspiciousKeywords where path.contains(keyword) {
+        matches.append(String(cString: imageName))
+        break
+      }
+    }
+
+    return matches
+  }
+
+  private static func isDebugBuild() -> Bool {
+    #if DEBUG
+    return true
+    #else
+    return false
+    #endif
+  }
+
+  private static func resolveBuildType(debuggable: Bool) -> String {
+    if debuggable {
+      return "debug"
+    }
+
+    if let receiptURL = Bundle.main.appStoreReceiptURL,
+       receiptURL.lastPathComponent == "sandboxReceipt" {
+      return "testflight"
+    }
+
+    return "release"
+  }
+}

package/ios/Security/EmulatorDetector.swift

@@ -0,0 +1,45 @@
+import Foundation
+import IOSSecuritySuite
+
+enum EmulatorDetector {
+  static func detect() -> [String: Any] {
+    var indicators: [String] = []
+
+    #if targetEnvironment(simulator)
+    indicators.append("TARGET_OS_SIMULATOR")
+    #endif
+
+    if IOSSecuritySuite.amIRunInEmulator() {
+      indicators.append("IOSSecuritySuite.amIRunInEmulator")
+    }
+
+    if let model = hardwareModel()?.lowercased() {
+      if model.contains("simulator") || model.contains("x86_64") || model.contains("i386") {
+        indicators.append("hw.model:\(model)")
+      }
+    }
+
+    let isSimulator = !indicators.isEmpty
+
+    return [
+      "isEmulator": false,
+      "isSimulator": isSimulator,
+      "indicators": indicators,
+    ]
+  }
+
+  private static func hardwareModel() -> String? {
+    var size: size_t = 0
+    sysctlbyname("hw.model", nil, &size, nil, 0)
+    guard size > 0 else {
+      return nil
+    }
+
+    var model = [CChar](repeating: 0, count: size)
+    let result = sysctlbyname("hw.model", &model, &size, nil, 0)
+    guard result == 0 else {
+      return nil
+    }
+    return String(cString: model)
+  }
+}

package/ios/Security/RuntimeDetector.swift

@@ -0,0 +1,107 @@
+import Foundation
+import IOSSecuritySuite
+import Darwin
+
+enum RuntimeDetector {
+  private static let fridaPorts: [UInt16] = [27042, 27043]
+  private static let suspiciousKeywords = [
+    "frida", "substrate", "cycript", "libhooker", "ellekit", "substitute", "xposed", "lsposed"
+  ]
+
+  static func detect() -> [String: Any] {
+    let suspiciousLibraries = scanLoadedLibraries()
+    let suspiciousPorts = scanFridaPorts()
+    let reverseEngineered = IOSSecuritySuite.amIReverseEngineered()
+    let fridaDetected = hasDyldInsert()
+      || reverseEngineered
+      || !suspiciousLibraries.isEmpty
+      || !suspiciousPorts.isEmpty
+      || canConnectToFrida()
+    let debuggerAttached = isDebuggerAttached()
+    let substrateDetected = suspiciousLibraries.contains(where: {
+      $0.lowercased().contains("substrate")
+        || $0.lowercased().contains("substitute")
+        || $0.lowercased().contains("ellekit")
+    })
+
+    return [
+      "debuggerAttached": debuggerAttached,
+      "fridaDetected": fridaDetected,
+      "substrateDetected": substrateDetected,
+      "suspiciousLibraries": suspiciousLibraries,
+      "suspiciousPorts": suspiciousPorts,
+    ]
+  }
+
+  private static func hasDyldInsert() -> Bool {
+    if let env = getenv("DYLD_INSERT_LIBRARIES") {
+      let value = String(cString: env)
+      return !value.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+    }
+    return false
+  }
+
+  private static func scanLoadedLibraries() -> [String] {
+    var matches: [String] = []
+    let imageCount = _dyld_image_count()
+    for index in 0..<imageCount {
+      guard let imageName = _dyld_get_image_name(index) else {
+        continue
+      }
+      let name = String(cString: imageName).lowercased()
+      for keyword in suspiciousKeywords where name.contains(keyword) {
+        matches.append(String(cString: imageName))
+        break
+      }
+    }
+    return matches
+  }
+
+  private static func scanFridaPorts() -> [Int] {
+    fridaPorts.compactMap { port in
+      canConnect(to: port) ? Int(port) : nil
+    }
+  }
+
+  private static func canConnectToFrida() -> Bool {
+    fridaPorts.contains(where: canConnect)
+  }
+
+  private static func canConnect(to port: UInt16) -> Bool {
+    var addr = sockaddr_in()
+    addr.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+    addr.sin_family = sa_family_t(AF_INET)
+    addr.sin_port = port.bigEndian
+    addr.sin_addr = in_addr(s_addr: inet_addr("127.0.0.1"))
+
+    let socketFd = socket(AF_INET, SOCK_STREAM, 0)
+    if socketFd < 0 {
+      return false
+    }
+    defer { close(socketFd) }
+
+    let result = withUnsafePointer(to: &addr) {
+      $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+        connect(socketFd, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+      }
+    }
+    return result == 0
+  }
+
+  private static func isDebuggerAttached() -> Bool {
+    if IOSSecuritySuite.amIDebugged() {
+      return true
+    }
+
+    var info = kinfo_proc()
+    var mib: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()]
+    var size = MemoryLayout<kinfo_proc>.stride
+    let result = mib.withUnsafeMutableBufferPointer { buffer -> Int32 in
+      sysctl(buffer.baseAddress, u_int(buffer.count), &info, &size, nil, 0)
+    }
+    if result != 0 {
+      return false
+    }
+    return (info.kp_proc.p_flag & P_TRACED) != 0
+  }
+}

package/ios/SecuritySuite.mm

@@ -5,22 +5,46 @@
 
 RCT_EXTERN_METHOD(getPublicKey:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
 
-RCT_EXTERN_METHOD(getSharedKey:(NSString)serverPK withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+RCT_EXTERN_METHOD(getSharedKey:(NSString)serverPK withOptions:(NSDictionary *)options withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
 
-RCT_EXTERN_METHOD(encrypt:(NSString)input withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+RCT_EXTERN_METHOD(establishSharedKey:(NSString)serverPK withOptions:(NSDictionary *)options withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
 
-RCT_EXTERN_METHOD(decrypt:(NSString)input withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+RCT_EXTERN_METHOD(encrypt:(NSString)input withOptions:(NSDictionary *)options withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
 
-RCT_EXTERN_METHOD(getDeviceId:(RCTResponseSenderBlock)callback)
+RCT_EXTERN_METHOD(decrypt:(NSString)input withOptions:(NSDictionary *)options withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(generateJWS:(NSDictionary)options withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(obfuscate:(NSString)input withSecret:(NSString)secret withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(deobfuscate:(NSString)input withSecret:(NSString)secret withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
 
 RCT_EXTERN_METHOD(storageEncrypt:(NSString)input withSecretKey:(NSString*)secretKey withHardEncryption:(BOOL)hardEncryption withCallback:(RCTResponseSenderBlock)callback)
 
 RCT_EXTERN_METHOD(storageDecrypt:(NSString)input withSecretKey:(NSString*)secretKey withHardEncryption:(BOOL)hardEncryption withCallback:(RCTResponseSenderBlock)callback)
 
+RCT_EXTERN_METHOD(secureStorageSetItem:(NSString)key withValue:(NSString)value withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(secureStorageGetItem:(NSString)key withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(secureStorageRemoveItem:(NSString)key withResolver:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(secureStorageClear:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(secureStorageGetAllKeys:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(getDeviceId:(RCTResponseSenderBlock)callback)
+
 RCT_EXTERN_METHOD(fetch:(NSString)url withData:(NSDictionary)data withCallback:(RCTResponseSenderBlock)callback)
 
 RCT_EXTERN_METHOD(deviceHasSecurityRisk:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
 
+RCT_EXTERN_METHOD(runtimeDetect:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(appIntegrityVerify:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(deviceGetEnvironment:(RCTPromiseResolveBlock)resolve withRejecter:(RCTPromiseRejectBlock)reject)
+
 + (BOOL)requiresMainQueueSetup
 {
   return NO;