appIntegrity on android is not working with v"3.11.0"

[a-raosaheb-gunjal]

Describe the bug
The appIntegrity feature has stopped working on Android. It was functioning correctly as of 10 days ago with the current version 3.11.0. No code changes were made to the integrity logic during this period.

In our React Native app, we’ve integrated three FreeRASP features: privilegedAccess, simulator, and appIntegrity. In v3.11.0, the appIntegrity feature has stopped working on Android. The other two features—privilegedAccess and simulator—continue to function as expected.

To Reproduce

Build and sign the app normally.
Decompile the APK using standard tools.
Modify and re-sign the APK with a different key.
Install the tampered APK on a device.
Launch the app and observe that no appIntegrity alert or popup is triggered.

Expected behavior

App should show a popup at the time of launching as its working for privilegedAccess and simulator

Screenshots

App should show app intergrity popup like it is detected simulator one. Attached screenshot below.

Please complete the following information:

• Device: All android devices
• OS version: andorid 10 and above
• Version of freeRASP: v"3.11.0"

Additional context
This behavior was not present in the previous version (tested ~10 days ago).
No changes were made to the configuration or callback logic.

Please check and let us know any changes has done from freeRasp side.

[tompsota]

Hello @a-raosaheb-gunjal,

Firstly, I recommend updating to the latest version of the plugin (currently 4.2.1) to ensure you have the most up-to-date detection capabilities from the SDK. The version 3.11.0 is quite outdated now.

Regarding your question, the appIntegrity check should behave consistently across all plugin versions. To better assist you, could you please provide more details about your testing process? For example, are you repackaging your app, modifying the certificate hash in the freeRASP configuration, or using any other specific methods to verify if the incident is reported?

Kind regards,
Tomas from Talsec

[a-raosaheb-gunjal]

Hi @tompsota - Thanks for the quick response.

Below are the steps that we are following to create tampered apk.

1. Create Signed apk with keystore file
2. Using apktool to decompile the apk
3. Again using apktool to recompile the
4. apksigner tool is used modifying the certificate.
5. Install the tampered apk on mobile

Also we have added valid hash in base64 format in below object which passed to talsecStart function.

androidConfig: {
packageName: ...,
certificateHashes: [base64String1],
supportedAlternativeStores: [''],
},

Please let me know any additional info is required.

[tompsota]

@a-raosaheb-gunjal ,

Can you send us your package name and watcher mail address registered with freeRASP to support@talsec.app? We will look at the data, maybe we will notice something interesting.

[a-raosaheb-gunjal]

Hi @tompsota - I will share the required information soon.

We have observed that the app integrity check is functioning correctly on some devices, but not working on few devices. We have tested this on the following devices.

realme gt 2(Android 15) - Working
Xiaomi 11T pro(Android 14) - Not Working
One Plus Nord CE(Android 13) - Working

Can you please check and comment on this behaviour? Also as suggested we are working on upgrading the npm version.