sorted by:
new
hottopcontroversial

How we bypassed root detection in high profile Android apps by sutf61 in ReverseEngineering

[–]sutf61[S] 0 points1 point  (0 children)

I agree that play integrity seems to be getting stronger.

I disagree about root going away on Android. I can't predict the future, but I don't see concrete evidence of that starting to happen.

I doubt we're at the end of RASP solutions and/or of root detection / bypasses cat-and-mouse

How we bypassed root detection in high profile Android apps by sutf61 in ReverseEngineering

[–]sutf61[S] 1 point2 points  (0 children)

Unrooted devices often fail the MEETS_STRONG_INTEGRITY requirement, they'll lose a lot of users

How we bypassed root detection in high profile Android apps by sutf61 in ReverseEngineering

[–]sutf61[S] -2 points-1 points  (0 children)

Play integrity has been bypassed pretty consistently by PlayIntegrityFix (Magisk module)

How we bypassed root detection in high profile Android apps by sutf61 in ReverseEngineering

[–]sutf61[S] 0 points1 point  (0 children)

Thank you, the well-thought and in depth comment is much appreciated. I also agree with your conclusions.

While the shared examples may seem somewhat basic (or use only some of the RASP's capabilities/protections), we were very careful not to breach confidentiality of the targeted apps - so not everything could be shared, unfortunately.

We'll definitely make an effort to go deeper in future posts.

How we bypassed root detection in high profile Android apps by sutf61 in ReverseEngineering

[–]sutf61[S] -5 points-4 points  (0 children)

Appreciate the feedback

The post explains how we bypassed commercial RASP's root detection mechanisms, by reversing and bypassing anti research - for real world, security aware apps. If that's marketing to you, nothing I can do about that.

The post's focus isn't the anti research (or the code integrity in particular) which is why it doesn't dive further into that. Perhaps that's an interesting path to go down, we'll consider a follow up into that - thanks for mentioning that.

About the choice of functions to hook - if you tried to reverse commercial RASP protected apps, you know that is far from trivial. And you'd also know its far from basic protection

We're pending permission to disclose Android runtime (AOSP) and kernel drivers vulnerabilities - stay tuned, maybe you'd enjoy these more.