pip install frida-tools objection
# Rooted Android device with Magisk
# Jailbroken iOS device with Frida

# Android: search for root detection in decompiled source
grep -rn 'isRooted\|RootBeer\|SafetyNet\|isDeviceRooted' jadx_out/
grep -rn 'su\b.*which\|/system/xbin/su\|/sbin/su' jadx_out/
grep -rn 'test-keys\|Build\.TAGS' jadx_out/
grep -rn 'com.topjohnwu.magisk\|eu.chainfire.supersu' jadx_out/
grep -rn 'PlayIntegrity\|SafetyNetClient\|Attestation' jadx_out/

# iOS: search for jailbreak detection
grep -rn 'isJailbroken\|Cydia\|MobileSubstrate\|jailbreak' ios_source/
grep -rn 'canOpenURL.*cydia\|fileExistsAtPath.*sbin' ios_source/
grep -rn 'fork()\|svc.*0x80' ios_source/

# Android root detection bypass
objection -g com.target.app explore -s "android root disable"

# Simulate non-rooted environment
objection -g com.target.app explore -s "android root simulate"

# iOS jailbreak detection bypass
objection -g com.target.app explore -s "ios jailbreak disable"

# Simulate non-jailbroken environment
objection -g com.target.app explore -s "ios jailbreak simulate"

// Android: Universal root detection bypass
Java.perform(function() {
    // File.exists bypass
    var File = Java.use('java.io.File');
    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        var rootPaths = ['/system/xbin/su', '/sbin/su', '/system/su',
                         '/data/local/xbin/su', '/data/local/su'];
        if (rootPaths.some(p => path === p)) {
            console.log('[*] Blocked root file check: ' + path);
            return false;
        }
        return this.exists();
    };

    // Runtime.exec bypass for 'which su'
    var Runtime = Java.use('java.lang.Runtime');
    Runtime.exec.overload('java.lang.String').implementation = function(cmd) {
        if (cmd.indexOf('su') !== -1) {
            console.log('[*] Blocked exec: ' + cmd);
            throw Java.use('java.io.IOException').$new('not found');
        }
        return this.exec(cmd);
    };

    // Build.TAGS bypass
    var Build = Java.use('android.os.Build');
    Build.TAGS.value = 'release-keys';
});

// iOS: Universal jailbreak detection bypass
if (ObjC.available) {
    // fileExistsAtPath bypass
    var fm = ObjC.classes.NSFileManager;
    Interceptor.attach(fm['- fileExistsAtPath:'].implementation, {
        onEnter: function(args) {
            this.path = ObjC.Object(args[2]).toString();
        },
        onLeave: function(retval) {
            var jbPaths = ['/Applications/Cydia.app', '/usr/sbin/sshd',
                           '/bin/bash', '/usr/bin/ssh', '/etc/apt',
                           '/Library/MobileSubstrate'];
            if (jbPaths.some(p => this.path.includes(p))) {
                retval.replace(0x0);
            }
        }
    });

    // canOpenURL bypass
    var app = ObjC.classes.UIApplication;
    Interceptor.attach(app['- canOpenURL:'].implementation, {
        onEnter: function(args) {
            this.url = ObjC.Object(args[2]).toString();
        },
        onLeave: function(retval) {
            if (this.url.includes('cydia')) {
                retval.replace(0x0);
            }
        }
    });
}

# MagiskHide (deprecated in newer Magisk, use Shamiko/Zygisk DenyList)
magisk --hide enable
magisk --hide add com.target.app

# Zygisk DenyList
# Settings > Magisk > Enable Zygisk
# Configure DenyList > Add target app

# Hide Magisk Manager
# Magisk > Settings > Hide the Magisk app (randomize package name)

title: Rooted Jailbroken Devices Detection
id: d29e7f98-8166-4263-b698-86cafead687f
status: experimental
description: Detects suspicious activity related to detecting rooted jailbroken devices techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407
  - attack.t1398
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies