guard_kit

A Flutter plugin that provides essential mobile security primitives for Android and iOS.

Features

Feature	Android	iOS
Root / Jailbreak detection	✅	✅
Developer mode detection	✅	✅ (heuristic)
Emulator / simulator detection	✅	✅
SSL certificate pinning	✅	✅
Screenshot blocking	✅	✅

Installation

dependencies:
  guard_kit: ^0.1.0

Usage

Quick start

import 'package:guard_kit/guard_kit.dart';

final guard = GuardKit.create();

Security status (all checks at once)

final status = await guard.getSecurityStatus();

print(status.isRooted);               // bool
print(status.isDeveloperModeEnabled); // bool
print(status.isRunningOnEmulator);    // bool
print(status.riskLevel);              // SecurityRiskLevel.none / low / medium / high

if (status.riskLevel == SecurityRiskLevel.high) {
  // Block access, log event, or exit
}

Individual checks

final isRooted    = await guard.isDeviceRooted();
final isDevMode   = await guard.isDeveloperModeEnabled();
final isEmulator  = await guard.isRunningOnEmulator();

Screenshot blocking

Widget approach (recommended):

ScreenshotBlocker(
  child: Scaffold(
    body: SensitiveContent(),
  ),
)

Imperative approach:

await guard.setScreenshotBlocking(enabled: true);
// ... later:
await guard.setScreenshotBlocking(enabled: false);

SSL Pinning

By SHA-256 fingerprint (recommended — resilient to certificate rotation):

final client = await guard.createPinnedClient(
  FingerprintPinningConfig(
    sha256Fingerprints: ['base64encodedSHA256fingerprint=='],
  ),
);
final response = await client.get(Uri.parse('https://api.example.com/data'));
client.close();

By full DER certificate:

final certBytes = await rootBundle.load('assets/cert.der');
final client = await guard.createPinnedClient(
  CertificatePinningConfig(
    certificates: [certBytes.buffer.asUint8List()],
  ),
);

Architecture

guard_kit is built with Clean Architecture and SOLID principles:

Presentation  GuardKit (facade)   ScreenshotBlocker (widget)
              ↓ depends on use-cases only (DIP)
Domain        UseCase<R,P>  →  ISecurityRepository
                               IScreenshotRepository
                               ISslPinningRepository
              ↑ implemented by
Data          SecurityRepositoryImpl  →  IPlatformDataSource
              ScreenshotRepositoryImpl      ↓
              SslPinningRepositoryImpl   PlatformDataSourceImpl (MethodChannel)

Dependency Injection

All classes accept dependencies via constructor injection. Use GuardKit.create() in production; inject mocks in tests:

final guard = GuardKit(
  checkRootUseCase:          CheckRootUseCase(MockSecurityRepository()),
  checkDeveloperModeUseCase: CheckDeveloperModeUseCase(MockSecurityRepository()),
  checkEmulatorUseCase:      CheckEmulatorUseCase(MockSecurityRepository()),
  getSecurityStatusUseCase:  GetSecurityStatusUseCase(MockSecurityRepository()),
  toggleScreenshotUseCase:   ToggleScreenshotUseCase(MockScreenshotRepository()),
  createPinnedClientUseCase: CreatePinnedClientUseCase(MockSslPinningRepository()),
);

Platform Notes

Android

• Root detection: su binary paths, known root packages (com.topjohnwu.magisk, eu.chainfire.supersu), Build.TAGS, Runtime.exec("which su").
• Screenshot blocking: FLAG_SECURE on the Activity window (requires ActivityAware).
• Minimum SDK: 21.

iOS

• Jailbreak detection: file-system probes (/Applications/Cydia.app, /bin/bash, etc.), cydia:// URL scheme, sandbox write attempt, fork().
• Developer mode detection: embedded.mobileprovision presence (heuristic; iOS 16+ has no public API for the developer mode toggle).
• Screenshot & screen-recording blocking: auto-selects strategy by iOS version — UITextField layer trick (iOS 13–16) or UIWindow black overlay (iOS 17+). Both support a notification hook for logging.
• Minimum iOS version: 13.0.

Security Note

No detection mechanism is 100% reliable. Use these checks as one layer in a defense-in-depth strategy, not as the sole security control.

License

MIT