PingTamperDetector

PingTamperDetector module provides comprehensive utilities for analyzing iOS device tampering, including jailbreak detection, system integrity verification, and security compromise identification. It employs multiple detection strategies to provide reliable assessment of device security status.

Getting Started

Prerequisites

iOS 16.0+
Swift 6.0+
Xcode 15+

Installation

To integrate the module into your iOS project, add the following dependency to your Package.swift or Podfile file.

Swift Package Manager

dependencies: [
    .package(url: "https://github.com/ForgeRock/ping-ios-sdk.git", from: "<version>")
]

Then add the PingTamperDetector product to your target’s dependencies.

CocoaPods

pod 'PingTamperDetector', '~> <version>'

Import the Module

import PingTamperDetector

How to use

The TamperDetector class is responsible for analyzing and providing a score indicating whether the device is suspicious of being jailbroken. It uses a set of detectors, each performing a specific check.

Default Usage

To use the TamperDetector with the default set of detectors, simply create an instance of the class and call the analyze() method:

let tamperDetector = TamperDetector()
let score = tamperDetector.analyze()

if score > 0 {
    print("The device is likely jailbroken. Score: \(score)")
} else {
    print("The device is likely not jailbroken.")
}

The analyze() method returns a score between 0.0 and 1.0, where 1.0 indicates a high probability of a jailbroken device.

Built-in Detectors

The TamperDetector includes the following built-in detectors, which are available through the TamperDetector.defaultDetectors static property:

SuspiciousFilesExistenceDetector: Checks for the existence of files that are commonly found on jailbroken devices.
SuspiciousFilesAccessibleDetector: Checks if suspicious files can be accessed.
URLSchemeDetector: Checks if well-known URL schemes used by jailbreak tools can be opened.
RestrictedDirectoriesWritableDetector: Checks if it is possible to write to restricted directories.
SymbolicLinkDetector: Checks for the presence of symbolic links that are common on jailbroken devices.
DyldDetector: Checks for suspicious dynamic libraries loaded into the application.
SandboxDetector: Checks if the application is running outside of the sandbox.
SuspiciousObjCClassesDetector: Checks for the presence of suspicious Objective-C classes.
SandboxRestrictedFilesAccessable: Checks if restricted files are readable.

Custom Detectors

You can also create your own custom detectors. To do this, you need to create a class that conforms to the TamperDetectorProtocol and implement the analyze() method.

Here is an example of a custom detector:

import Foundation

class MyCustomDetector: TamperDetectorProtocol {
    func analyze() -> Double {
        // Implement your custom jailbreak detection logic here
        // Return a score between 0.0 and 1.0
        return 0.0
    }
}

Combining Default and Custom Detectors

You can easily combine the default detectors with your own custom detectors.

Adding Custom Detectors to the Default Set

If you want to use the default detectors and add your own, you can use the init(customDetectors:) initializer:

let customDetector = MyCustomDetector()
let tamperDetector = TamperDetector(customDetectors: [customDetector])
let score = tamperDetector.analyze()

Creating a Custom Set of Detectors

If you want to use a specific set of detectors, you can create your own array of detectors and pass it to the init(detectors:) initializer. You can use the TamperDetector.defaultDetectors static property to get the array of default detectors and modify it as you wish.

let customDetector = MyCustomDetector()
var detectors = TamperDetector.defaultDetectors
detectors.append(customDetector)

let tamperDetector = TamperDetector(detectors: detectors)
let score = tamperDetector.analyze()

License

This software may be modified and distributed under the terms of the MIT license. See the LICENSE file for details.