We Keep Coding

The root deduction code has been Bypassed by frida and Object Bypassing how to save apps from those bypass method?

My application is Under VAPT report certification. in my application i wrote a code for detecting weather the device is root or not. the method is returning boolean values. but they Bypassed the code with Magisk or some other root application. How to disable the bypassing???? How????
public class DeviceUtils {
public static boolean isDeviceRooted() {
return checkRootMethod1() || checkRootMethod2() || checkRootMethod3() || checkRootMethod4() || checkRootMethod5();
}
private static boolean checkRootMethod1() {
String buildTags = android.os.Build.TAGS;
return buildTags != null && buildTags.contains("test-keys");
}
private static boolean checkRootMethod2() {
String[] paths = { "/system/app/Superuser.apk", "/sbin/su", "/system/bin/su", "/system/xbin/su", "/data/local/xbin/su", "/data/local/bin/su", "/system/sd/xbin/su",
"/system/bin/failsafe/su", "/data/local/su", "/su/bin/su"};
for (String path : paths) {
if (new File(path).exists()) return true;
}
return false;
}
private static boolean checkRootMethod3() {
Process process = null;
try {
process = Runtime.getRuntime().exec(new String[] { "/system/xbin/which", "su" });
BufferedReader in = new BufferedReader(new InputStreamReader(process.getInputStream()));
if (in.readLine() != null) return true;
return false;
} catch (Throwable t) {
return false;
} finally {
if (process != null) process.destroy();
}
}
private static boolean checkRootMethod4() {
File file = new File("/system/app/Superuser.apk");
if (file.exists()) {
return true;
}
return false;
}
public static boolean findBinary(String binaryName)
{ boolean found = false;
if (!found) { String[] places = { "/sbin/", "/system/bin/", "/system/xbin/", "/data/local/xbin/", "/data/local/bin/", "/system/sd/xbin/", "/system/bin/failsafe/", "/data/local/", "/system/app/Superuser.apk", "/sbin/su", "/sbin/su/", "/system/bin/su","/system/bin/su/", "/system/xbin/su", "/system/xbin/su/", "/data/local/xbin/su", "/data/local/bin/su", "/system/sd/xbin/su", "/system/bin/failsafe/su", "/data/local/su", "/su/bin/su", "/su/", "/data/local/xbin/", "/system/bin/.ext/", "/system/bin/failsafe/", "/system/sd/xbin/", "/su/xbin/", "/su/bin/", "/magisk/.core/bin/", "/system/usr/we-need-root/", "/system/xbin/", "/system/su","/system/bin/.ext/.su","/system/usr/we-need-root/su-backup", "/system/xbin/mu", "/system/su/","/system/bin/.ext/.su/","/system/usr/we-need-root/su-backup/", "/system/xbin/mu/"};
for (String where : places)
{
if (new File(where + binaryName).exists())
{
found = true;
break;
}
}
}
return found;
}
private static boolean checkRootMethod5()
{
return findBinary("su");
}
}

Android root detection not working with mentioned code

I'm using following code for root detection in Android device. But still my security expert saying it can be installed and run in rooted device. Could someone detect what the issue with my code
public static boolean isDeviceRooted() {
// get from build info
String buildTags = android.os.Build.TAGS;
if (buildTags != null && buildTags.contains("test-keys")) {
return true;
}
return checkFiles() || checkLocations();
}
private static boolean checkFiles(){
String[] files = {
"/system/app/Superuser.apk",
"/system/etc/init.d/99SuperSUDaemon",
"/dev/com.koushikdutta.superuser.daemon/",
"/system/xbin/daemonsu"
};
for (String fileData : files) {
try {
File file = new File(fileData);
if (file.exists()) {
return true;
}
} catch (Exception e1) {
// ignore
}
}
return false;
}
private static boolean checkLocations(){
String su = "su";
String[] locations = {
"/system/bin/",
"/system/xbin/",
"/sbin/",
"/system/sd/xbin/",
"/system/bin/failsafe/",
"/data/local/xbin/",
"/data/local/bin/",
"/data/local/",
"/system/sbin/",
"/usr/bin/",
"/vendor/bin/"
};
for (String location : locations) {
if (new File(location + su).exists()) {
return true;
}
}
return false;
}

Authenticate as first pass param to BLE device

I need to authenticate to BLE device that requires a key >SBIK12345< first all. I can't write any characteristic and service without the key before.
Some idea?
This is my connect method (from this repo BluLeGatt from Anlif)
public boolean connect(final String address)
{
if (mBluetoothAdapter == null || address == null)
{
System.out.println(TAG+"BluetoothAdapter not initialized or unspecified address.");
return false;
}
// Previously connected device. Try to reconnect.
if (mBluetoothDeviceAddress != null && address.equals(mBluetoothDeviceAddress)
&& mBluetoothGatt != null)
{
System.out.println(TAG+"Trying to use an existing mBluetoothGatt for connection.");
if (mBluetoothGatt.connect()) {
mConnectionState = STATE_CONNECTING;
return true;
} else {
return false;
}
}
final BluetoothDevice device = mBluetoothAdapter.getRemoteDevice(address);
if (device == null)
{
System.out.println(TAG+"Device not found. Unable to connect.");
return false;
}
// We want to directly connect to the device, so we are setting the autoConnect
// parameter to false.
try
{
device.createInsecureRfcommSocketToServiceRecord(UUID.fromString(SampleGattAttributes.UUID_BLE_080));
}
catch (IOException e)
{
System.out.println("exc createInsecureRfcommSocketToServiceRecord "+e.getLocalizedMessage());
}
mBluetoothGatt = device.connectGatt(this, true, mGattCallback);
System.out.println(TAG+" Trying to create a new connection.");
BluetoothGattCharacteristic characteristic1 = new BluetoothGattCharacteristic(UUID.fromString(SampleGattAttributes.UUID_BLE_080),BluetoothGattCharacteristic.WRITE_TYPE_NO_RESPONSE,BluetoothGattCharacteristic.WRITE_TYPE_NO_RESPONSE);
characteristic1.setValue(">SBIK1234<");
mBluetoothGatt.writeCharacteristic(characteristic1);
mBluetoothDeviceAddress = address;
mConnectionState = STATE_CONNECTING;
return true;
}
And the static var is
public static String UUID_BLE_080 = "00000000-dc70-0080-dc70-a07ba85ee4d6";

New user held with searching array

I am trying to search an array and if the two Strings are matched then it will return true otherwise false, firstly i want to search to see if the account is already there if so then search Code if the two exsis then return true
public boolean searchArray(String account, String code) {
for (Accounts a : bAccounts) {
if (a.getAccount().equals(account)) {
for (Accounts c : bAccounts) {
if (c.getCode().equals(Code))
return true;
}
}
}
return false;
}
Think I've got a little lost within this search method, can anyone please help me on this, thanks. This all compiles fine but doesn't seem to return anything. I have get methods in my Accounts class which has get and set methods for Account and Sort.

public boolean searchArray(String account, String code) {
for (Accounts a : bAccounts) {
if (a.getAccount().equals(account)
&& a.getCode().equals(code)) {
return true;
}
}
return false;
}
Inner for should be removed.

You didn't mention if you'll accept nulls for account and code parameters.
If null values are possible/desirable to compare, this is what I suggest:
public boolean searchArray(String account, String code) {
for (Account a : accounts) {
if (account == null) {
if (code == null) {
if ((a.getAccount() == null) && (a.getCode() == null)) {
return true;
}
} else {
if ((a.getAccount() == null) && code.equals(a.getCode())) {
return true;
}
}
} else {
if (code == null) {
if (account.equals(a.getAccount()) && (a.getCode() == null)) {
return true;
}
} else {
if (account.equals(a.getAccount()) && code.equals(a.getCode())) {
return true;
}
}
}
}
return false;
}
If you won't consider nulls for account and code parameters, I suggest this:
public boolean searchArray(String account, String code) {
// if you won't consider nulls then there's no need to search
// when at least one of them is null
if ((account == null) || (code == null)) {
return false;
}
for (Account a : accounts) {
if (account.equals(a.getAccount()) && code.equals(a.getCode())) {
return true;
}
}
return false;
}
Hope it helps you

how to check AccessibilityService [duplicate]

I was wondering how could I detect if my own service is enabled. So I could check if my service is not enabled, then tell the user to enable it.

Below is the method to check if your accessibility service is enabled or not. 
Note: Change value of YOURAccessibilityService with your Service. 
// To check if service is enabled
private boolean isAccessibilitySettingsOn(Context mContext) {
int accessibilityEnabled = 0;
final String service = getPackageName() + "/" + YOURAccessibilityService.class.getCanonicalName();
try {
accessibilityEnabled = Settings.Secure.getInt(
mContext.getApplicationContext().getContentResolver(),
android.provider.Settings.Secure.ACCESSIBILITY_ENABLED);
Log.v(TAG, "accessibilityEnabled = " + accessibilityEnabled);
} catch (Settings.SettingNotFoundException e) {
Log.e(TAG, "Error finding setting, default accessibility to not found: "
+ e.getMessage());
}
TextUtils.SimpleStringSplitter mStringColonSplitter = new TextUtils.SimpleStringSplitter(':');
if (accessibilityEnabled == 1) {
Log.v(TAG, "***ACCESSIBILITY IS ENABLED*** -----------------");
String settingValue = Settings.Secure.getString(
mContext.getApplicationContext().getContentResolver(),
Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES);
if (settingValue != null) {
mStringColonSplitter.setString(settingValue);
while (mStringColonSplitter.hasNext()) {
String accessibilityService = mStringColonSplitter.next();
Log.v(TAG, "-------------- > accessibilityService :: " + accessibilityService + " " + service);
if (accessibilityService.equalsIgnoreCase(service)) {
Log.v(TAG, "We've found the correct setting - accessibility is switched on!");
return true;
}
}
}
} else {
Log.v(TAG, "***ACCESSIBILITY IS DISABLED***");
}
return false;
}
And to call this method:
if (!isAccessibilitySettingsOn(getApplicationContext())) {
startActivity(new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS));
}
This will check and launch accessibility settings if not enabled.

This is a modified version of Jakub Bláha's answer in java.
public boolean isAccessServiceEnabled(Context context, Class accessibilityServiceClass)
{
String prefString = Settings.Secure.getString(context.getContentResolver(), Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES);
return prefString!= null && prefString.contains(context.getPackageName() + "/" + accessibilityServiceClass.getName());
}

This is somehow a smaller version, but it is working.
fun isAccessServiceEnabled(context: Context): Boolean {
val prefString =
Settings.Secure.getString(context.contentResolver, Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES)
return prefString.contains("${context.packageName}/${context.packageName}.${context.getString(R.string.access_service_name)}")
}
Feel free to correct me if there is something missing.

1:Kotlin Based answer
2:Added a current package name check as well cos it will return true only if accessibility service will be Enabled for current package, Recently it was returning true if any package accessibility service enabled
private fun checkAccessibilityPermission(): Boolean {
var isAccessibilityEnabled = false
(requireActivity().getSystemService(Context.ACCESSIBILITY_SERVICE) as AccessibilityManager).apply {
installedAccessibilityServiceList.forEach { installedService ->
installedService.resolveInfo.serviceInfo.apply {
if (getEnabledAccessibilityServiceList(AccessibilityServiceInfo.FEEDBACK_ALL_MASK).any { it.resolveInfo.serviceInfo.packageName == packageName && it.resolveInfo.serviceInfo.name == name && permission == Manifest.permission.BIND_ACCESSIBILITY_SERVICE && it.resolveInfo.serviceInfo.packageName == requireActivity().packageName })
isAccessibilityEnabled = true
}
}
}
if (isAccessibilityEnabled.not())
startActivity(Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS).apply {
flags = Intent.FLAG_ACTIVITY_NEW_TASK
})
return isAccessibilityEnabled
}

Kotlin version based on answer of #Pankaj Kumar
inline fun <reified T> Context.isAccessibilityEnabled(): Boolean {
var enabled = 0
try {
enabled = Settings.Secure.getInt(contentResolver, Settings.Secure.ACCESSIBILITY_ENABLED)
} catch (e: SettingNotFoundException) {
Timber.e(e)
}
if (enabled == 1) {
val name = ComponentName(applicationContext, T::class.java)
val services = Settings.Secure.getString(contentResolver, Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES)
return services?.contains(name.flattenToString()) ?: false
}
return false
}