Root and hook detection
Protection against root and hooking
How rooted devices and hooking frameworks are used against apps that move money, and what an app can do about them.
Short answer
Root gives full control of the operating system; hooking frameworks such as Frida and Xposed rewrite what an app does while it runs. To protect against both, an app combines several detections (root artifacts, instrumentation, hooked functions, modified code), decides the response by policy and verifies sensitive actions on the server.
What root changes
On a rooted device the protections of the operating system no longer hold: other apps and tools can read your app's files and memory and change its behavior. Many power users root their phones for legitimate reasons, so root is a signal, not a verdict.
What hooking does
A hooking framework intercepts functions inside your process: it can make a check return true, read a token before it is encrypted or change the destination of a transfer. It works on rooted devices and, with an injected gadget, on repackaged copies of the app.
How to respond
Detect several signals, not one. Start by reporting, then warn or step up authentication, and block only the actions that matter, such as payments. Keep the decision in a reviewed policy, and confirm sensitive actions with a verdict the server can check.
What the sources say
Frida describes itself as a dynamic code instrumentation toolkit, the capability used to hook functions in a running app.
Source · checked on
OWASP MASVS-RESILIENCE-2 asks that the app implements anti-tampering mechanisms.
Source · checked on
Play Integrity's device verdict labels a device as meeting basic, device or strong integrity, which helps the server judge the environment.
Source · checked on
What Moatgator does
Runtime detects root and jailbreak indicators, Frida server and gadget, Xposed and similar frameworks, and hooked system functions.
Source · checked on
Each detection has its own response in moatgator.yml, and every one starts in monitor mode.
Source · checked on
Attest builds on Play Integrity and adds Moatgator's runtime signals into one verdict your backend verifies.
Source · checked on
Where it stops
Root and hook detection is an arms race: tools change and some hide from checks. No detection is perfect, which is why Runtime layers several signals and pairs with Shield and server-side verification.
Frequently asked questions
Should I block every rooted device?
Usually not. Root is a signal; many users root their phones for legitimate reasons. Block the sensitive actions, not the whole app, and watch the data first.
Can Frida be detected?
Frida server, the gadget and hooked functions leave traces that apps can detect. None of these checks is perfect alone, so layer several.
What about Magisk hiding root?
Tools that hide root defeat simple checks. Combine on-device signals with a server-checked verdict such as Play Integrity, which the device cannot simply forge.
Does detection slow the app down?
Checks add some overhead. Measure it on your app and choose which detections to run and how often.
See where your app stands
Upload an APK, AAB or IPA to the free Scan and get a grade, without an account.