device_integrity_native #

Reusable Flutter plugin for Android/iOS device integrity checks (root, jailbreak, Frida, emulator/simulator, debugger, Xposed/Substrate, USB debugging).

Native detection runs in C++; Dart exposes a simple API with per-check enable/disable flags.

Install #

Path (local / monorepo) #

dependencies:
  device_integrity_native:
    path: ./packages/device_integrity

Git (recommended for all projects) #

dependencies:
  device_integrity_native:
    git:
      url: https://github.com/akhilftech/device_integrity.git

pub.flutter-io.cn #

dependencies:
  device_integrity_native: ^0.0.1

Then:

flutter pub get

No extra app-side CMake or Xcode source setup is required. The plugin ships Android NDK and iOS C++ sources.

Usage #

import 'package:device_integrity_native/device_integrity_native.dart';

void main() {
  final threat = DeviceIntegrity.check(
    config: const DeviceIntegrityConfig(
      rooted: true,
      frida: true,
      emulator: true,
      debugger: true,
      xposed: true,
      jailbroken: true,
      simulator: true,
      substrate: true,
      usbDebugging: false, // Android-only; off by default
    ),
  );

  if (threat != SecurityThreat.none) {
    // Host app decides: block UI, exit, log, etc.
  }

  runApp(MyApp());
}

Defaults / one-time configure #

DeviceIntegrity.configure(
  const DeviceIntegrityConfig(
    emulator: false,
    debugger: false,
  ),
);

final threat = DeviceIntegrity.check(); // uses configured defaults

Helper strings (English) #

DeviceIntegrity.threatTitle(threat);
DeviceIntegrity.threatMessage(threat);

Host apps should keep their own UI and i18n. This package only returns the threat result.

Checks #

Platform-irrelevant flags are ignored.

Threat results #

SecurityThreat: none, rooted, frida, emulator, debugger, xposed, jailbroken, simulator, substrate, usbDebugging, unknown.

unknown is returned if the native library is missing or tampered with.

Notes #

• Detection is best-effort; determined attackers can bypass client-side checks.
• Do not auto-kill the process inside the package — leave policy to the host app.
• usbDebugging defaults to false so typical development devices are not blocked unless enabled.