Anubee-Detector

An open-source, tracer-agnostic reference RASP for Android: it runs real anti-tamper checks across four on-screen families - MEMORY TAMPER (hook/injection + W^X memory), INSTRUMENTATION (Frida, Xposed/LSPosed), CODE INTEGRITY (DEX + APK signature), and DEVICE INTEGRITY (root/su, system properties, anti-debug) - and shows every result on-screen and in logcat instead of hiding them. The headline hook-scan turns its SELF-INTEGRITY banner red the moment any tracer or hook writes into the app's memory.

Prebuilt APK

Each tagged release attaches a prebuilt arm64-v8a, debug-signed APK under Releases. Grab it and install directly, no build needed:

adb install Anubee-Detector-<tag>.apk
adb shell am start -n dev.anubee.detector/.MainActivity

Prerequisites

• A connected arm64-v8a Android device (adb devices shows it).
• JDK 21 and Android SDK (platform 35, NDK 27, CMake 3.22.1).

Build & install

JAVA_HOME=/path/to/jdk-21 ./gradlew installDebug
adb shell am start -n dev.anubee.detector/.MainActivity

On devices whose vendor blocks USB installs, install the built APK via a root shell (pm install) instead of installDebug.

Run the demo

The app opens on a command deck: a hero SELF-INTEGRITY banner up top, and four family cards below it (MEMORY TAMPER first, then INSTRUMENTATION, CODE INTEGRITY, DEVICE INTEGRITY), each listing its checks with a roll-up count like 1/1 or 0/3.

1. On launch the app auto-runs every check once - the banner reads green (✔ CLEAN) and each family card shows its roll-up.
2. Tap Run all any time to re-run every check, or flip Auto-loop to keep re-running in the background (off by default).
3. Tap any family card to open its detail page - one card per check, with a verdict pill, the technique name, key details, and the exact SENTINEL JSON line it emitted. Back (hardware or on-screen) returns to the deck.
4. Watch logcat: adb logcat -s SENTINEL prints the same JSON, one line per check.
5. Attach a loud tracer to the app. The tripped family's card jumps to the top with a flashing red border, and the banner flips to ⚠ COMPROMISED with a bold color-and-pulse animation - the app caught the tracer live.
6. The same scan catches an unrelated second adversary: attach Frida and hook anything - the moment its agent injects or patches code, the banner slams red and names the culprit, exactly as with a loud tracer. One generic scan, any hook.