MobShield: Open-Source RASP Library for Android Security
A modular, telemetry-free library detecting root, hooks, and debugger presence in Android applications.
1New Open-Source Security Tool
MobShield is a newly released Apache-2.0 licensed library designed for Android developers. It functions as a Runtime Application Self Protection tool, focusing on detecting hostile environments. By default, the library operates in a detect-only mode, providing developers with granular control over how their applications respond to potential security threats or unauthorized modifications.
2Modular Detection Architecture
The library utilizes a modular design, allowing developers to integrate the core engine alongside specific detectors. This approach minimizes the application footprint by including only necessary security checks. Available modules on Maven Central currently cover root detection, hook identification, and integrity verification, ensuring that developers can tailor the security posture to their needs.
3Advanced Root Detection Techniques
Unlike basic tools that merely check for the existence of an su file, MobShield performs deep system analysis. It identifies artifacts related to Magisk, Zygisk, Shamiko, and KernelSU. The detection mechanism scans for mount namespace differences, abstract sockets within /proc/net/unix, overlayfs configurations, and memory map scans to identify sophisticated rooting methods.
4Identifying Hooks and Debuggers
MobShield actively monitors for instrumentation frameworks such as Frida, Xposed, and LSPosed. It detects these hooks by inspecting memory maps, port activity, thread naming conventions, and libc prologue modifications. Additionally, the library includes specific detectors for debugger presence, emulator usage, and automation tools, providing a comprehensive view of the application's runtime environment.
5Weighted Signal Scoring System
Each security check generates a weighted, confidence-scored signal rather than a binary result. A central aggregator processes these signals to produce a single threat event per category, such as root or integrity. This scoring system allows developers to define their own severity thresholds, determining what constitutes a critical threat for their specific application.
6Privacy and Network Integrity
The library is designed with a strict no-telemetry policy, ensuring that no data is transmitted to external servers. It does not require user accounts or outbound network calls for its operation. The only network-related activity is a local socket probe to 127.0.0.1, specifically used to detect the presence of Frida instrumentation.
7Limitations and Security Context
As a client-side detection tool, MobShield acknowledges that a determined attacker with full device control can bypass these checks. The developer explicitly advises treating this library as a single layer of defense. Critical security validations should always be performed on the server side, utilizing services like Google Play Integrity for robust verification.
8Community Feedback and Evolution
The project is currently seeking community feedback regarding false positives on various OEM ROMs, work profiles, and Samsung Knox environments. By sharing reproducible bypasses and missing detection techniques, developers can help refine the validation matrix. This collaborative effort aims to improve the library's reliability across the diverse Android device ecosystem.
Original article: Developing Android Apps — MobShield: Open-Source RASP Library for Android Security