Jailbreak/Root Detection Plugin for Apache Cordova

Use this plugin to add an extra layer of security for your app by detecting if the device was rooted (on android) or jailbreaked (on iOS).

Install

cordova plugin add cordova-plugin-iroot

Upgrade

cordova plugin rm cordova-plugin-iroot
cordova plugin add cordova-plugin-iroot
cordova prepare

postInstall

iOS

To avoid errors like

-canOpenURL: failed for URL: "cydia://package/com.example.package" - error: "This app is not allowed to query for scheme cydia"

don’t forget to add "cydia" in LSApplicationQueriesSchemes key of info.plist. Otherwise canOpenURL will always return false.

<xxx>
  <key>LSApplicationQueriesSchemes</key>
  <array>
      <string>cydia</string>
  </array>
</xxx>

Usage in Javascript

// available => iOS + Android
IRoot.isRooted(successCallback, failureCallback);

// available => Android
IRoot.isRootedWithBusyBox(successCallback, failureCallback);

• successCallback(result:boolean) is called with true if the device is Jailbroken/rooted, otherwise false.
• failureCallback(error:string) is called if there was an error determining if the device is Jailbroken/rooted.

Info

Based on:

• iOS
  • cordova-plugin-jailbreak-detection
  • Shmoopi Anti-Piracy
• Android
  • RootBeer
  • cordova-plugin-root-detection
• Articles
  • Android Root Detection Techniques

Contributing

1. Fork it
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create new Pull Request

ToDo's

1. Cyanogenmod.superuser

If the Cyanogenmod ROM is installed, the cyanogenmod.superuser activity may be in the com.android.settings package. This can be detected by listing the activities within com.android.settings.

2. Su

Execute su and then id to check if the current user has a uid of 0 or if it contains (root). shell@android:/ $ su shell@android:/ # id uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r)

3. Busybox

If a device has been rooted, more often then not Busybox has been installed as well. Busybox is a binary that provides many common linux commands. Running Busybox is a good indication that a device has been rooted. root@android:/ # busybox df Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 958500 32 958468 0% /dev tmpfs 958500 0 958500 0% /mnt/secure tmpfs 958500 0 958500 0% /mnt/asec tmpfs 958500 0 958500 0% /mnt/obb

4. Check library

• https://github.com/Stericson/RootTools/tree/master/src/main/java/com/stericson/RootTools

5. Frida detect
6. Magestic detect