feat: rootsentry v0.1.0 — root/jailbreak/emulator/hook/tamper detection engine with scored posture verdict + Android/iOS reference collectors

Author: Cognis Digital

.github/workflows/ci.yml

@@ -0,0 +1,19 @@
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e ".[dev]"
+      - run: python -m pytest -q

.gitignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.pyc
+*.egg-info/
+.pytest_cache/
+build/
+dist/
+.venv/

LICENSE

@@ -0,0 +1,108 @@
+Cognis Open Collaboration License (COCL)
+Version 1.0 — 2026
+
+Copyright (c) 2026 Cognis Digital LLC (Wyoming, USA). All rights reserved.
+
+This software and associated documentation files (the "Software") are made
+available by Cognis Digital LLC ("Licensor") under the following terms. By
+using, copying, modifying, or distributing the Software, or by contributing to
+it, you ("You") agree to these terms.
+
+------------------------------------------------------------------------------
+1. DEFINITIONS
+------------------------------------------------------------------------------
+1.1 "Non-Commercial Use" means use for personal projects, internal evaluation,
+    research, education, security testing You are authorized to perform, and
+    other use that is not Commercial Use.
+1.2 "Commercial Use" means any use of the Software, in whole or in part, that
+    is primarily intended for or directed toward commercial advantage or
+    monetary compensation, including without limitation: (a) use in production
+    to operate a business; (b) offering the Software (or a modified version) to
+    third parties as a hosted, managed, or software-as-a-service offering;
+    (c) redistributing the Software as, or as part of, a commercial product;
+    or (d) use by a for-profit entity beyond a 30-day internal evaluation.
+1.3 "Contribution" means any work of authorship You intentionally submit to
+    Licensor for inclusion in the Software (e.g., via a pull request, patch,
+    or issue attachment).
+
+------------------------------------------------------------------------------
+2. GRANT FOR NON-COMMERCIAL USE
+------------------------------------------------------------------------------
+Subject to Your compliance with this License, Licensor grants You a worldwide,
+royalty-free, non-exclusive, non-transferable license to use, reproduce,
+modify, and create derivative works of the Software, and to distribute such
+copies and derivative works, FOR NON-COMMERCIAL USE ONLY, provided that:
+  (a) You retain this License, the NOTICE file, and all copyright,
+      attribution, and license notices in all copies and derivative works; and
+  (b) You clearly mark any modified files as changed.
+
+------------------------------------------------------------------------------
+3. COMMERCIAL USE REQUIRES A SEPARATE LICENSE
+------------------------------------------------------------------------------
+Commercial Use of the Software is NOT granted under this License. To obtain a
+commercial license, contact Cognis Digital LLC at licensing@cognis.digital.
+Nothing in this License limits rights You may separately negotiate in writing
+with Licensor.
+
+------------------------------------------------------------------------------
+4. CONTRIBUTIONS ("COLLABORATION PULL")
+------------------------------------------------------------------------------
+4.1 Inbound license. By submitting a Contribution, You license that
+    Contribution to Licensor and to all recipients of the Software under the
+    terms of this License (inbound = outbound).
+4.2 Relicensing grant. You additionally grant Licensor a perpetual, worldwide,
+    royalty-free, irrevocable, sublicensable license to use, reproduce, modify,
+    distribute, and RELICENSE Your Contribution (including under commercial or
+    other terms) as part of the Software or Cognis Digital offerings. This
+    enables the dual-licensing model in Sections 2 and 3.
+4.3 Representations. You represent that each Contribution is Your original work
+    or that You have the right to submit it under these terms, and that it does
+    not knowingly violate any third party's rights.
+4.4 Recognition. Accepted Contributions are credited in the project history and,
+    where appropriate, in a CONTRIBUTORS or NOTICE file.
+
+------------------------------------------------------------------------------
+5. PATENT
+------------------------------------------------------------------------------
+Licensor grants You a license to its patent claims necessarily infringed by the
+Software as provided, limited to the scope of the use granted in Section 2. If
+You initiate patent litigation alleging the Software infringes a patent, the
+licenses granted to You under this License terminate immediately.
+
+------------------------------------------------------------------------------
+6. TRADEMARKS
+------------------------------------------------------------------------------
+This License does not grant permission to use the trade names, trademarks,
+service marks, or product names of Licensor, including "Cognis", "Cognis
+Digital", and associated logos, except as required for reasonable and customary
+attribution.
+
+------------------------------------------------------------------------------
+7. TERMINATION
+------------------------------------------------------------------------------
+This License terminates automatically if You breach it and do not cure the
+breach within 30 days of becoming aware of it. Upon termination You must cease
+all use and distribution of the Software, except that copies held by downstream
+recipients in compliance with this License survive.
+
+------------------------------------------------------------------------------
+8. DISCLAIMER OF WARRANTY AND LIMITATION OF LIABILITY
+------------------------------------------------------------------------------
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+------------------------------------------------------------------------------
+9. SECURITY-TOOL ACCEPTABLE USE
+------------------------------------------------------------------------------
+Several Cognis tools are dual-use security software. You agree to use them only
+against systems, data, and identities You own or are explicitly authorized in
+writing to test, and in compliance with all applicable laws. You are solely
+responsible for Your use.
+
+------------------------------------------------------------------------------
+This is a source-available license. It is NOT an OSI-approved "open source"
+license. For questions: legal@cognis.digital · https://cognis.digital

NOTICE

@@ -0,0 +1,19 @@
+Cognis Neural Suite
+Copyright (c) 2026 Cognis Digital LLC (Wyoming, USA)
+
+This product is part of the Cognis Neural Suite and is distributed under the
+Cognis Open Collaboration License (COCL) v1.0. See the LICENSE file.
+
+  Website:        https://cognis.digital
+  Suite:          https://github.com/cognis-digital
+  Commercial use: licensing@cognis.digital
+
+This software may incorporate, compose, or interoperate with third-party
+open-source projects. Those components remain under their own licenses, and
+their copyright and license notices are retained in their respective files or
+in the per-tool README "Credits / Built on" section. Cognis Digital claims no
+ownership over upstream third-party works it composes or wraps.
+
+Trademarks "Cognis", "Cognis Digital", "Cognis Neural Suite", and associated
+logos are marks of Cognis Digital LLC and are not licensed for use except as
+required for reasonable attribution.

README.md

@@ -0,0 +1,88 @@
+# rootsentry
+
+**Mobile runtime-integrity detection — root, jailbreak, emulator, hooking, tamper.**
+
+`rootsentry` decides whether a mobile device's runtime can be trusted. An app
+collects a small telemetry snapshot on-device — suspicious files, installed
+packages, system properties, open ports, runtime flags — and `rootsentry`
+scores it against a catalog of well-known compromise indicators, returning a
+**posture verdict** (`TRUSTED` → `SUSPICIOUS` → `COMPROMISED` → `CRITICAL`) your
+app or backend can act on.
+
+Pure standard library, zero dependencies. Defensive by design: the point is for
+*your* app to recognize a rooted/jailbroken/instrumented runtime and react —
+degrade gracefully, warn, or refuse high-risk actions.
+
+## How it works
+
+```
+catalog.py   data-only list of indicators (su binaries, Magisk, Cydia,
+             frida-server ports, test-keys builds, MobileSubstrate, …)
+engine.py    match an Evidence snapshot -> fired signals + saturating score 0-100
+reference/   embeddable on-device collectors (Kotlin / Swift)
+```
+
+Scoring saturates: a single weight-10 indicator (e.g. a signing-cert mismatch)
+already reaches `CRITICAL`, while several medium indicators converge toward 100
+— so you don't get fooled by one cheap check passing.
+
+## Install
+
+```bash
+pip install -e .          # or ".[dev]" for tests
+```
+
+## Use
+
+```bash
+# Evaluate a device snapshot (see examples/evidence.android.json)
+rootsentry eval evidence.json
+# posture: CRITICAL  (score 97/100)
+#   [ 9] root      android.su.system_xbin — su binary present in /system/xbin
+#   [ 9] root      android.magisk.pkg — Magisk manager installed
+#   [ 8] hook      android.frida.port — frida-server default control port open
+#   ...
+
+# Gate a backend attestation check (exit 1 at/above threshold)
+rootsentry eval evidence.json --fail-on COMPROMISED
+
+# Inspect the indicator catalog
+rootsentry catalog --platform ios
+```
+
+### As a library
+
+```python
+from rootsentry import Evidence, Platform, evaluate
+
+ev = Evidence(platform=Platform.ANDROID,
+              present_files=["/system/xbin/su"],
+              installed_packages=["com.topjohnwu.magisk"])
+verdict = evaluate(ev)
+print(verdict.posture.label, verdict.score)   # COMPROMISED 75
+```
+
+## On-device collection
+
+`reference/android_RootCheck.kt` and `reference/ios_JailbreakCheck.swift` show
+how to gather the `Evidence` snapshot on each platform. Recommended pattern:
+collect on-device, attest + send to your backend (inside Play Integrity /
+DeviceCheck where possible), and evaluate server-side so the decision isn't made
+solely in an environment the attacker controls.
+
+## Indicator coverage
+
+Root (su, Magisk, SuperSU, busybox, test-keys, ro.secure), emulator
+(goldfish/ranchu/qemu), hooking (frida-server, Xposed, Substrate), iOS jailbreak
+(Cydia, Sileo, bash/apt, sandbox-escape, fork), and cross-platform tamper
+(signature mismatch, integrity failure, attached debugger).
+
+## Scope of use
+
+Defensive runtime self-protection (RASP-style) for apps you own/operate, plus
+device-posture analysis during authorized assessments. Detection only —
+`rootsentry` does not modify the device.
+
+## License
+
+Cognis Open Collaboration License (COCL) v1.0. See [LICENSE](LICENSE).

examples/evidence.android.json

@@ -0,0 +1,12 @@
+{
+  "platform": "android",
+  "present_files": ["/system/xbin/su", "/system/xbin/busybox", "/data/local/tmp/frida-server"],
+  "installed_packages": ["com.topjohnwu.magisk", "com.acme.app"],
+  "system_props": {
+    "ro.build.tags": "test-keys",
+    "ro.debuggable": "1",
+    "ro.hardware": "qcom"
+  },
+  "open_ports": [27042],
+  "runtime_flags": []
+}

pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "rootsentry"
+version = "0.1.0"
+description = "Mobile runtime-integrity detection: root/jailbreak/emulator/hook/tamper indicators with a scored posture verdict."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "COCL-1.0" }
+authors = [{ name = "Cognis Digital", email = "dev@cognis.digital" }]
+keywords = ["mobile-security", "root-detection", "jailbreak-detection", "android", "ios", "anti-tampering", "frida-detection", "rasp"]
+classifiers = [
+  "Intended Audience :: Information Technology",
+  "Topic :: Security",
+  "Programming Language :: Python :: 3",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["pytest>=7"]
+
+[project.scripts]
+rootsentry = "rootsentry.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["rootsentry"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

reference/android_RootCheck.kt

@@ -0,0 +1,58 @@
+// Reference: collecting rootsentry Evidence on Android (Kotlin).
+//
+// This snippet shows how an app gathers the telemetry rootsentry's engine
+// scores. Send the resulting JSON to your backend (ideally inside a Play
+// Integrity / attestation flow) and run `rootsentry eval` server-side, or port
+// the engine on-device. Defensive use only.
+
+import android.content.Context
+import org.json.JSONObject
+import java.io.File
+import java.net.Socket
+
+object RootEvidence {
+    private val SU_PATHS = listOf("/system/xbin/su", "/system/bin/su", "/sbin/su")
+    private val ROOT_FILES = SU_PATHS + listOf(
+        "/system/xbin/busybox",
+        "/system/lib/libsubstrate.so",
+        "/data/local/tmp/frida-server",
+    )
+    private val ROOT_PACKAGES = listOf(
+        "com.topjohnwu.magisk",
+        "eu.chainfire.supersu",
+        "de.robv.android.xposed.installer",
+    )
+
+    fun collect(ctx: Context): JSONObject {
+        val files = ROOT_FILES.filter { File(it).exists() }
+        val pm = ctx.packageManager
+        val pkgs = ROOT_PACKAGES.filter {
+            runCatching { pm.getPackageInfo(it, 0); true }.getOrDefault(false)
+        }
+        val props = mapOf(
+            "ro.build.tags" to getProp("ro.build.tags"),
+            "ro.debuggable" to getProp("ro.debuggable"),
+            "ro.secure" to getProp("ro.secure"),
+            "ro.hardware" to getProp("ro.hardware"),
+            "ro.kernel.qemu" to getProp("ro.kernel.qemu"),
+        )
+        val ports = listOf(27042).filter { portOpen(it) }
+
+        return JSONObject().apply {
+            put("platform", "android")
+            put("present_files", files)
+            put("installed_packages", pkgs)
+            put("system_props", JSONObject(props as Map<*, *>))
+            put("open_ports", ports)
+        }
+    }
+
+    private fun getProp(name: String): String = runCatching {
+        val p = Runtime.getRuntime().exec(arrayOf("getprop", name))
+        p.inputStream.bufferedReader().readLine().orEmpty().trim()
+    }.getOrDefault("")
+
+    private fun portOpen(port: Int): Boolean = runCatching {
+        Socket("127.0.0.1", port).use { true }
+    }.getOrDefault(false)
+}

reference/ios_JailbreakCheck.swift

@@ -0,0 +1,48 @@
+// Reference: collecting rootsentry Evidence on iOS (Swift).
+//
+// Gathers jailbreak/hook telemetry rootsentry's engine scores. Defensive use
+// only. Note: App Store apps must be careful which paths they probe; this is a
+// reference for in-house / assessment builds.
+
+import Foundation
+
+enum JailbreakEvidence {
+    static let suspiciousPaths = [
+        "/Applications/Cydia.app",
+        "/Applications/Sileo.app",
+        "/bin/bash",
+        "/etc/apt",
+        "/Library/MobileSubstrate/MobileSubstrate.dylib",
+    ]
+
+    static func collect() -> [String: Any] {
+        let files = suspiciousPaths.filter { FileManager.default.fileExists(atPath: $0) }
+        var flags: [String] = []
+        if canWriteOutsideSandbox() { flags.append("can_write_outside_sandbox") }
+        if forkSucceeds() { flags.append("fork_succeeded") }
+
+        return [
+            "platform": "ios",
+            "present_files": files,
+            "runtime_flags": flags,
+        ]
+    }
+
+    private static func canWriteOutsideSandbox() -> Bool {
+        let probe = "/private/rootsentry_probe.txt"
+        do {
+            try "x".write(toFile: probe, atomically: true, encoding: .utf8)
+            try? FileManager.default.removeItem(atPath: probe)
+            return true
+        } catch { return false }
+    }
+
+    private static func forkSucceeds() -> Bool {
+        let pid = fork()
+        if pid >= 0 {
+            if pid > 0 { /* parent: child will exit */ }
+            return true   // stock sandboxed iOS denies fork()
+        }
+        return false
+    }
+}