Port MASTG-TEST-0050: Testing Runtime Integrity Checks (android) #3692

Diolor · 2026-02-06T15:50:03Z

This PR closes #3017

Description

Ports MASTG-TEST-0050 to v2
Creates 2 demos pass/fail
Enriches the KNOW related to RASP

AI Tool Disclosure

This contribution includes AI-generated content.

If AI tools were used to generate or substantially modify code or text, complete the following.

AI tools used: Claude 4.5, 4.6
Prompt summary: File generation, Demo generation, information gathering for knowledge,

…chniques and examples

Diolor · 2026-02-06T15:54:41Z

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0032.md

+1. **Memory checksums**: Comparing memory contents or checksums against known good values.
+2. **Signature-based detection**: Searching memory for signatures of unwanted modifications.
+3. **Java Runtime tampering detection**: Detecting modifications to the Android Runtime (ART) made by hooking frameworks.
+4. **Injected class detection**: Identifying classes injected by frameworks like Xposed.
+5. **GOT hook detection**: Verifying Global Offset Table entries point to legitimate libraries.
+6. **Inline hook detection**: Inspecting function prologues/epilogues for trampolines or suspicious jump instructions.
+
+Techniques 1 and 2 are foundational approaches that underpin the more specific detection methods (3-6).


I tried to give a good structure here. I would definitely need a 2nd or 3rd expert to proof-read this as I am not extremely familiar with all techniques, especially native ones.

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0032.md

Diolor · 2026-02-06T15:58:19Z

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0032.md

+
+On Android, common signatures to detect include:
+
+- **Inline hook trampolines**: A trampoline is a small piece of code that redirects execution from one location to another. Hooking frameworks insert trampolines at function entry points to intercept calls—when the original function is called, the trampoline jumps to the hook handler instead. On ARM64, a common trampoline pattern loads a 64-bit target address into a scratch register and branches to it: `LDR X16, .+8; BR X16` followed by the 8-byte absolute address. Scratch registers (X16 and X17 on ARM64) are temporary registers that the calling convention allows to be overwritten without saving, making them ideal for trampolines. Based on the [ARM A64 instruction set encoding](https://developer.arm.com/documentation/ddi0602/latest/), this sequence encodes to bytes `50 00 00 58 00 02 1F D6`. Scanning for such patterns at function entry points can reveal hooks. The [O-MVLL anti-hooking pass](https://obfuscator.re/omvll/passes/anti-hook/) exploits the fact that Frida's Interceptor requires X16/X17 as scratch registers by injecting prologues that use these registers, preventing Frida from hooking. Note that ARM32/Thumb code uses different trampoline patterns (e.g., `LDR PC, [PC, #-4]`) and should be checked separately if the app includes 32-bit libraries.


I can unshamelessly say that this bullet is AI-assisted, especially the bytes. However it looked interesting to bring for discussion here.

Let's not rush merging this before validating.

Love the honest AI disclosure!

Diolor · 2026-02-06T16:01:23Z

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088/MASTG-DEMO-0088.md

+---
+platform: android
+title: App Terminating on Frida Hook Detection Before Cipher.doFinal Execution
+id: MASTG-DEMO-0088


Update before merge + filename

Diolor · 2026-02-06T16:01:27Z

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/MASTG-DEMO-0087.md

+---
+platform: android
+title: Extracting Sensitive Data from Cipher.doFinal via Frida Hooking
+id: MASTG-DEMO-0087


Update before merge + filename

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-03te.md

Diolor · 2026-02-06T16:07:50Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-03te.md

+---
+platform: android
+title: Testing Runtime Hook Detection
+id: MASTG-TEST-03te


Allocate before merge + filename

Diolor · 2026-02-06T16:08:09Z

tests/android/MASVS-RESILIENCE/MASTG-TEST-0050.md

 - R
 profiles: [R]
+status: deprecated
+covered_by: [MASTG-TEST-03te]


Update before merge

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/script.js

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088/script.js

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0030.md

cpholguera · 2026-02-07T14:48:16Z

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0032.md

 ---

-Controls in this category verify the integrity of the app's memory space to defend the app against memory patches applied during runtime. Such patches include unwanted changes to binary code, bytecode, function pointer tables, and important data structures, as well as rogue code loaded into process memory. Integrity can be verified by:
+Controls in this category verify the integrity of the app's memory to defend against runtime memory patches. Such patches include unwanted changes to binary code, bytecode, function pointer tables, and important data structures, as well as rogue code loaded into process memory.


I know "controls" was already there but I don't think this refers (anymore?) to MASVS controls. Should we say methods/techniques or something like that?

I don't mind much the term "controls" but we can also say "techniques" as you suggest. A technique that verifies a security goal such as integrity can be considered a control.

From ISC2's glossary:

control The use of access rules or countermeasures to limit a subject’s access to an object. See also security control, safeguards, and countermeasures.
Security control The mechanism used to address security vulnerabilities to reduce or man- age risk. See also control, safeguards, and countermeasures.

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0032.md

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088/script.js

Diolor · 2026-02-09T11:35:10Z

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0de2/MASTG-DEMO-0de2.md

+title: App Terminating on Frida Hook Detection Before Cipher.doFinal Execution
+id: MASTG-DEMO-0088
+code: [kotlin]
+test: MASTG-TEST-03te


Update before merge

Diolor · 2026-02-09T11:35:21Z

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0de1/MASTG-DEMO-0de1.md

+title: Extracting Sensitive Data from Cipher.doFinal via Frida Hooking
+id: MASTG-DEMO-0087
+code: [kotlin]
+test: MASTG-TEST-03te


Update before merge

Diolor · 2026-02-09T11:35:26Z

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0de3/MASTG-DEMO-0de3.md

+title: Bypassing Frida Detection in /proc/self/maps to Extract Sensitive Data
+id: MASTG-DEMO-0089
+code: [kotlin]
+test: MASTG-TEST-03te


Update before merge

Diolor · 2026-02-09T11:35:32Z

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0089/MASTG-DEMO-0089.md

+---
+platform: android
+title: Bypassing Frida Detection in /proc/self/maps to Extract Sensitive Data
+id: MASTG-DEMO-0089


Update before merge + filename

Diolor · 2026-02-09T11:37:16Z

best-practices/MASTG-BEST-0029.md

+---
+title: Hardening Against Runtime Hooking
+alias: hardening-against-runtime-hooking
+id: MASTG-BEST-0029


Allocate before merge + filname

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-03te.md

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0030.md

Diolor · 2026-02-09T11:43:36Z

best-practices/MASTG-BEST-00be.md

+
+Defending against runtime hooking requires a layered approach that combines several types of security controls:
+
+- **Preventive controls**: Implement root detection (@MASTG-KNOW-0027) and device/app attestation (https://github.com/OWASP/mastg/issues/3505) as the first line of defense, since most hooking frameworks (e.g., Frida server, Xposed) require rooted devices.


Create new BEST practice: device, app attestation with hardware backed keys #3505 should be removed before merge. Demonstrated the connection of the topics

Diolor · 2026-02-09T11:47:25Z

best-practices/MASTG-BEST-00be.md

+- **Memory scanning**: Scan `/proc/self/maps` and process memory for known artifacts (e.g., "LIBFRIDA", frida-agent libraries, Xposed bridge classes).
+- **Integrity checksums**: Compute checksums of critical code sections at build/load time and verify them periodically at runtime to detect patches and inline hooks.
+- **GOT/PLT verification**: Verify that Global Offset Table entries point to addresses within their expected libraries.
+- **Function prologue inspection**: Compare the first bytes of security-critical functions against their expected values to detect trampoline patterns (e.g., `LDR X16, .+8; BR X16` on ARM64).


Also consider: #3692 (comment)

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0089/MASTG-DEMO-0089.md

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0de3/MASTG-DEMO-0de3.md

Co-authored-by: Carlos Holguera <[email protected]>

cpholguera · 2026-02-11T19:44:48Z

@Diolor please move temporarily to "fake IDs" to avoid the conflicts we're seeing here with other demos, best practices, etc. Thanks 🙏

…test-0050

Diolor added 17 commits January 19, 2026 09:36

Deprecate v1 test

05f3e3c

Layout the knowledge

b44f8f4

Improve grammar

0177d94

Enhance runtime integrity verification documentation with detailed te…

6783f22

…chniques and examples

Add reference

296b1e4

Reorder

7afdb80

Add initial test

ae571d0

Merge branch 'master' into port-v1-test-0050

6d1e5d0

Format table

1e8b982

Fix notes

ac48167

Create the test

561a677

Add generic bullet and grammarly

562cbd0

Merge branch 'master' into port-v1-test-0050

a519993

Initial commit of demos

4593cda

Update demo 87 output

7ff16cb

Update demo 88 output

d3868e3

Fix demo wording

411ee2a

Diolor self-assigned this Feb 6, 2026

Diolor commented Feb 6, 2026

View reviewed changes

Diolor added MASVS-RESILIENCE MASTG Refactor labels Feb 6, 2026

Diolor added 2 commits February 6, 2026 17:06

Fix lints

dd68825

EOF

eb14e51

Diolor commented Feb 6, 2026

View reviewed changes

Diolor marked this pull request as ready for review February 6, 2026 16:10

cpholguera reviewed Feb 7, 2026

View reviewed changes

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/script.js Show resolved Hide resolved

cpholguera reviewed Feb 7, 2026

View reviewed changes

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088/script.js Show resolved Hide resolved

cpholguera reviewed Feb 7, 2026

View reviewed changes

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0030.md Show resolved Hide resolved

cpholguera reviewed Feb 7, 2026

View reviewed changes

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0032.md Outdated Show resolved Hide resolved

Diolor added 11 commits February 9, 2026 10:59

Initial BE for runtime hook detection

8acd5e6

Rewrite BE to emphasize the layers

25129d6

Rename

0745792

Rename

f90b55c

Grammar

6e3373c

Mark the lack of BE

eca2026

Add know-0027

5d42595

Create bypass demo

e21c4f5

Rewrite

3c38385

Remove process kill hook and simplify

a795d81

Inline references

fbafc6f

Diolor commented Feb 9, 2026

View reviewed changes

Fix headers

358631f

Diolor commented Feb 9, 2026

View reviewed changes

Diolor requested a review from cpholguera February 9, 2026 11:50

cpholguera reviewed Feb 9, 2026

View reviewed changes

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0089/MASTG-DEMO-0089.md Outdated Show resolved Hide resolved

cpholguera reviewed Feb 9, 2026

View reviewed changes

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0de3/MASTG-DEMO-0de3.md Show resolved Hide resolved

Diolor and others added 2 commits February 9, 2026 14:40

Update demos/android/MASVS-RESILIENCE/MASTG-DEMO-0089/MASTG-DEMO-0089.md

6058aee

Co-authored-by: Carlos Holguera <[email protected]>

Migrate DEMOs to use frooky

4cf1f15

cpholguera requested a review from jacobocasado February 11, 2026 19:40

Diolor added 5 commits February 12, 2026 11:33

Allocate temp ids

caa10a0

Merge branch 'master' into port-v1-test-0050

ce15515

Use de not te for demos

fd14735

Add notes

2162e22

Merge remote-tracking branch 'origin/port-v1-test-0050' into port-v1-…

27efaab

…test-0050


		On Android, common signatures to detect include:

		- Inline hook trampolines: A trampoline is a small piece of code that redirects execution from one location to another. Hooking frameworks insert trampolines at function entry points to intercept calls—when the original function is called, the trampoline jumps to the hook handler instead. On ARM64, a common trampoline pattern loads a 64-bit target address into a scratch register and branches to it: `LDR X16, .+8; BR X16` followed by the 8-byte absolute address. Scratch registers (X16 and X17 on ARM64) are temporary registers that the calling convention allows to be overwritten without saving, making them ideal for trampolines. Based on the [ARM A64 instruction set encoding](https://developer.arm.com/documentation/ddi0602/latest/), this sequence encodes to bytes `50 00 00 58 00 02 1F D6`. Scanning for such patterns at function entry points can reveal hooks. The [O-MVLL anti-hooking pass](https://obfuscator.re/omvll/passes/anti-hook/) exploits the fact that Frida's Interceptor requires X16/X17 as scratch registers by injecting prologues that use these registers, preventing Frida from hooking. Note that ARM32/Thumb code uses different trampoline patterns (e.g., `LDR PC, [PC, #-4]`) and should be checked separately if the app includes 32-bit libraries.


		Defending against runtime hooking requires a layered approach that combines several types of security controls:

		- Preventive controls: Implement root detection (@MASTG-KNOW-0027) and device/app attestation (https://github.com/OWASP/mastg/issues/3505) as the first line of defense, since most hooking frameworks (e.g., Frida server, Xposed) require rooted devices.

Uh oh!

Port MASTG-TEST-0050: Testing Runtime Integrity Checks (android) #3692

Are you sure you want to change the base?

Port MASTG-TEST-0050: Testing Runtime Integrity Checks (android) #3692

Uh oh!

Conversation

Diolor commented Feb 6, 2026

Description

AI Tool Disclosure

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Diolor Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Diolor Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cpholguera commented Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Diolor Feb 6, 2026 •

edited

Loading

Diolor Feb 6, 2026 •

edited

Loading