Migration Guide to Version 2.0.x
Malwarelytics for Android version 2.0.x introduces:
- a new RASP feature: camera stream tampering detection (fake camera and virtual camera detection).
- a generalized, confidence-aware detection configuration, shared by root detection, runtime tampering detection, and the new camera stream tampering detection.
Summary of Config Item Changes
| Config Item in version 1.7.x | Config item in version 2.0.x |
|---|---|
RaspConfig.root(RootDetectionConfig) |
RaspConfig.root(ConfidenceAwareDetectionConfig) |
RaspConfig.runtimeTampering(DetectionConfig) |
RaspConfig.runtimeTampering(ConfidenceAwareDetectionConfig) |
| N/A | RaspConfig.cameraStreamTampering(ConfidenceAwareDetectionConfig) |
Summary of API Changes
| Affected APIs | API Change |
|---|---|
RootDetectionConfig |
Class renamed to ConfidenceAwareDetectionConfig |
RootDetectionConfig.Exit.exitOnRootMinConfidence |
Property renamed to ConfidenceAwareDetectionConfig.Exit.exitOnMinConfidence |
CameraStreamTamperingDetection |
Class addition |
RaspManager.isCameraStreamTamperingPresent() |
Method addition |
RaspManager.getCameraStreamTamperingDetection() |
Method addition |
RaspObserver.onCameraStreamTamperingDetected(CameraStreamTamperingDetection) |
Method addition |
Confidence-Aware Detection Configuration Changes
RootDetectionConfig was renamed to ConfidenceAwareDetectionConfig and generalized so that it can be reused by any RASP feature whose detection result carries a confidence value. It is now used to configure root detection, runtime tampering detection, and the new camera stream tampering detection.
// before
val raspConfig = RaspConfig.Builder()
.root(RootDetectionConfig.Exit(exitOnRootMinConfidence = 0.8f))
.runtimeTampering(DetectionConfig.Notify)
.build()
// after
val raspConfig = RaspConfig.Builder()
.root(ConfidenceAwareDetectionConfig.Exit(exitOnMinConfidence = 0.8f))
.runtimeTampering(ConfidenceAwareDetectionConfig.Notify)
.cameraStreamTampering(ConfidenceAwareDetectionConfig.Notify)
.build()
The available values of ConfidenceAwareDetectionConfig are the same as the previous RootDetectionConfig ones, just renamed:
| Value | Description |
|---|---|
NoAction |
indicates that the RASP feature will not be automatically detected. A manual check is still possible. |
Notify |
indicates that the RASP feature will be automatically detected and registered instances of RaspObserver will be notified in their appropriate callback. |
Exit(exitUrl: String?, exitOnMinConfidence: Float) |
indicates that the RASP feature will be automatically detected (as with Notify) and the app will be terminated if the detection confidence reaches at least exitOnMinConfidence (defaults to 1f). |
The Exit data class now implements the new ConfidenceAwareExitConfigItem interface (extending ExitConfigItem) instead of implementing ExitConfigItem directly, and its confidence threshold property was renamed:
| Property in version 1.7.x | Property in version 2.0.x |
|---|---|
RootDetectionConfig.Exit.exitOnRootMinConfidence: Float |
ConfidenceAwareDetectionConfig.Exit.exitOnMinConfidence: Float |
If your app configures RaspConfig.root or references RootDetectionConfig directly, update the type name (and the Exit property name, if used) at all call sites.
Camera Stream Tampering Detection
A new RASP feature detects camera stream tampering tools, such as fake/virtual camera apps and image/video (AI) editing tools that are known to be used for injecting fabricated video into the camera stream.
val raspConfig = RaspConfig.Builder()
.cameraStreamTampering(ConfidenceAwareDetectionConfig.Notify)
// configuration of other RASP features
.build()
Camera stream tampering detection defaults to ConfidenceAwareDetectionConfig.Notify.
New APIs introduced with this feature:
| API | Description |
|---|---|
RaspManager.isCameraStreamTamperingPresent() |
Manual (@WorkerThread) check whether camera stream tampering is detected. |
RaspManager.getCameraStreamTamperingDetection() |
Manual (@WorkerThread) retrieval of the full detection data. |
RaspObserver.onCameraStreamTamperingDetected(CameraStreamTamperingDetection) |
Callback invoked when the camera stream tampering detection changes. |
CameraStreamTamperingDetection |
Detection data class with isCameraStreamTamperingPresent, detectionConfidence, and troubleshootingMessage properties. |