Nondeterministic Postrequisite Metaprotocol

    react-native-pvt-jail-monkey
    TypeScript icon, indicating that this package has built-in type declarations

    2.4.7 • Public • Published

    WARNING: I don't have the devices to test anymore, so testing is done by those submitting PRs bona fide.

    Jail Monkey

    Can you ever really trust a phone?

    Why?

    Are users claiming they are crossing the globe in seconds and collecting all the Pokeballs? Some apps need to protect themselves in order to protect data integrity. JailMonkey allows you to:

    • Identify if a phone has been jail-broken or rooted for iOS/Android.
    • Detect mocked locations for phones set in "developer mode".
    • (ANDROID ONLY) Detect if the application is running on external storage such as an SD card.

    Use

    import JailMonkey from 'react-native-pvt-jail-monkey'
    
    //debug - if true will skips all validations 
    //checkEmulator - check for simulator and emulator 
    //keyStoreSignature - [Android only] check signing signature of the install apk (SHA1 format)
    let params = {debug:false,checkEmulator:false,keyStoreSignature:"5E:8F:16:206:2E:A3:CD:2C:4A:0D:54:78:76:BA:A6:F3:8C:AB:F6:25"}
    //custom method with all security checking 
    JailMonkey.isSafe(params).then(()=>{
      // is not rooted/jailbreak/emulator/simulator
    },()=>{
      // is rooted/jailbreak/emulator/simulator)
      })
    
    
       JailMonkey.externalCheck({ 
        "magisk": true, //android only
        'isRunningOnMac': true, //ios only
        'isJb': true, //ios only
        'isInjectedWithDynamicLibrary': true, //ios only
        'isSecurityCheckPassed': true, //ios only
        'isDebugged':true, //ios only
        'isFromAppStore':true //ios only
       }).then((ok) => {
          console.log("safe device")
        }, ({ code, message }) => {
          // {"code":"error","message":"magisk"}
          console.log("error", JSON.stringify(message))
        })

    keystore signature check command

    use SHA1 format

    keytool -list -v -keystore <keyStore>

    IOS Setup

    prerequisite content hide when minimize

    //in appDelegate.m
    
    #import <JailMonkey.h>
    
    - (void)applicationWillResignActive:(UIApplication *)application{
      [JailMonkey showSecureScreen:[self window]];
    }
    
    - (void)applicationDidBecomeActive:(UIApplication *)application{
      [JailMonkey hideSecureScreen:[self window]];
    }
    
    

    API

    Method Returns Description
    isJailBroken boolean is this device jail-broken/rooted.
    canMockLocation boolean Can this device fake its GPS location.
    trustFall boolean Checks if the device violates either isJailBroken or canMockLocation.
    isDebuggedMode Promise<boolean> Is the application is running in debug mode. Note that this method returns a Promise.
    isSafe Promise<boolean> [Custom methood] custom method with all security checking
    secureScreen void [Custom methood] enable minimize content hiding (note: android will also disallow screenshot in this mode)
    unSecureScreen void [Custom methood] disable minimize content hiding

    Android Only APIs

    Method Returns Description
    hookDetected boolean Detects if there is any suspicious installed applications.
    isOnExternalStorage boolean Is the application running on external storage (ie. SD Card)
    AdbEnabled boolean Is Android Debug Bridge enabled.
    isDevelopmentSettingsMode Promise<boolean> Whether user has enabled development settings on their device. Note that this method returns a Promise.

    On iOS all of the Android only methods will return false or Promise<false> where appropriate.

    Since emulators are usually rooted, you might want to bypass these checks during development. Unless you're keen on constant false alarms

    Install

    npm i jail-monkey --save
    react-native link # Not required as of React Native 0.60.0
    cd ios/
    pod install #ios will need pod install to link

    If you use rnpm, you may have trouble as rnpm does not link Android properly after 0.29.0!

    Note: On Android you should include location.isFromMockProvider() from your location provider to compliment JailMonkey.canMockLocation(). Most react-native location libraries already have this check built in

    Additional Info

    This has been made public to help keep it up to date. As detection measures get better or out-dated, please send updates to this project so it can be the best method of detection.

    Special thanks to this fantastic blog article: http://blog.geomoby.com/2015/01/25/how-to-avoid-getting-your-location-based-app-spoofed/

    Keywords

    none

    Install

    npm i react-native-pvt-jail-monkey

    DownloadsWeekly Downloads

    14

    Version

    2.4.7

    License

    MIT

    Unpacked Size

    222 kB

    Total Files

    38

    Last publish

    Collaborators

    • privaterepo2021