为什么FreeRASP在Flutter应用程序中没有按预期工作,尽管他们的网站中描述了正确的配置?

m1m5dgzv  于 2023-01-06  发布在  Flutter
关注(0)|答案(1)|浏览(168)

我们开发了一个Flutter应用程序,最近添加了FreeRASP,这是一个Flutter(https://pub.dev/packages/freerasp)的运行时应用程序自我保护库。

import 'dart:io';
import 'package:flutter/material.dart';
import 'package:freerasp/talsec_app.dart';

void main() async {
  WidgetsFlutterBinding.ensureInitialized();
  ...
  runApp(MyApp(...));
}

class MyApp extends StatefulWidget {
  const MyApp({...})
      : super(key: key);
  ...
  @override
  _MyAppState createState() =>
      _MyAppState(...);
}

class _MyAppState extends State<MyApp> {
  _MyAppState({...});

  ...

  @override
  void initState() {
    super.initState();
    initSecurityState();
  }

  Future<void> initSecurityState() async {
    TalsecConfig config = TalsecConfig(
      // For Android
      androidConfig: AndroidConfig(
        expectedPackageName: 'com.company.mypackage',
        expectedSigningCertificateHash: 'xxxxxxxx',
        supportedAlternativeStores: ["com.sec.android.app.samsungapps"],
      ),

      // Common email for Alerts and Reports
      watcherMail: 'xxx@xxx.com',
    );
    TalsecCallback callback = TalsecCallback(
      // For Android
      androidCallback: AndroidCallback(
        onRootDetected: () => exit(0),
        onEmulatorDetected: () => exit(0),
        onHookDetected: () => exit(0),
        onTamperDetected: () => exit(0),
        onDeviceBindingDetected: () => print('device binding'),
        onUntrustedInstallationDetected: () => print('untrusted install'),
      ),
      // Common for both platforms
      onDebuggerDetected: () => print('debugger'),
    );

    TalsecApp app = TalsecApp(
      config: config,
      callback: callback,
    );

    app.start();
  }

  @override
  Widget build(BuildContext context) {
    return MaterialApp(...);
  }
}

但是当它在模拟器上运行时,它甚至检测不到,即使我们在这种情况下将它定向到exit(0)。在调试时,app.start()的执行给出了以下日志。请提供建议。

W/india.mobileap( 4242): Accessing hidden method Lcom/android/internal/os/PowerProfile;-><init>(Landroid/content/Context;)V (unsupported, reflection, allowed)
W/PowerProfile( 4242): ambient.on is deprecated! Use ambient.on.display0 instead.
W/PowerProfile( 4242): screen.on is deprecated! Use screen.on.display0 instead.
W/PowerProfile( 4242): screen.full is deprecated! Use screen.full.display0 instead.
W/india.mobileap( 4242): Accessing hidden method Lcom/android/internal/os/PowerProfile;->getBatteryCapacity()D (unsupported, reflection, allowed)
I/DrmHal  ( 4242): found instance=clearkey version=android.hardware.drm@1.4::IDrmFactory
I/DrmHal  ( 4242): found instance=default version=android.hardware.drm@1.0::IDrmFactory
I/DrmHal  ( 4242): found instance=widevine version=android.hardware.drm@1.4::IDrmFactory
E/HMSSDK_HMSPackageManager( 4242): resolveInfoList is null or empty
E/HMSSDK_HMSPackageManager( 4242): PackagePriorityInfo list is null
E/HMSSDK_HMSPackageManager( 4242): <initHmsPackageInfoForMultiService> Failed to find HMS apk
I/HMSSDK_HMSPackageManager( 4242): Enter getHMSPackageNameForMultiService
E/HMSSDK_HMSPackageManager( 4242): resolveInfoList is null or empty
E/HMSSDK_HMSPackageManager( 4242): PackagePriorityInfo list is null
E/HMSSDK_HMSPackageManager( 4242): <initHmsPackageInfoForMultiService> Failed to find HMS apk
I/HMSSDK_HuaweiMobileServicesUtil( 4242): hmsPackageName is com.huawei.hwid
E/HMSSDK_HMSPackageManager( 4242): resolveInfoList is null or empty
E/HMSSDK_HMSPackageManager( 4242): PackagePriorityInfo list is null
E/HMSSDK_HMSPackageManager( 4242): <initHmsPackageInfoForMultiService> Failed to find HMS apk
I/HMSSDK_HuaweiMobileServicesUtil( 4242): HMS is not installed
I/HMSSDK_HMSPackageManager( 4242): enter asyncOnceCheckMDMState
I/HMSSDK_HMSPackageManager( 4242): quit asyncOnceCheckMDMState
W/System  ( 4242): A resource failed to call close. 
I/TestLibrary( 4242): Failed with error code 7
W/System  ( 4242): A resource failed to call close
5tmbdcev

5tmbdcev1#

freeRASP作者在这里。你的代码似乎是好的。描述的问题是常见的应用程序意外地建立在调试模式。保护通常会成为活动的发布模式。你使用哪一个建立模式?freeRASP文档说:
开发版本在应用程序开发期间使用。它将开发数据和生产数据分开,并禁用开发过程中不会触发的某些检查:

  • 模拟器使用(检测到模拟器时,检测到模拟器时)
  • 调试(检测到调试器时)
  • 签名(检测到篡改时,检测到签名时)

使用哪个版本的freeRASP取决于应用程序的开发阶段--更准确地说,取决于应用程序是如何编译的。

  • 调试(汇编调试)=开发版本
  • release(assembleRelease)=发布版本

source: https://pub.dev/packages/freerasp#dev-vs-release-version

相关问题