# RELEASE NOTES - Shield for Android, Version 6.5.0, 2024-02-14 ## Highlights of Version 6.5.0 * New features and changed behavior: - Google Play Games Emulator support. - Extended the ShieldSDK-callback for untrusted installer apps. - No longer distrust system keyboards on rooted devices. - Shielder command line option to check if an application is shielded. - Removed deprecated APIs. * Improvements: - Shield runtime performance improvements. - Improved rooting detection. - Improved hooking framework detection. - Improved native code hook detection. - Improved emulator detection. - Improved adb status check. - Improved Shielder class name obfuscation. * Bug fixes and improvements. ## New features and changed behavior ### Google Play Games Emulator support To allow running the application on Google Play Games on PC (a gaming emulator provided by Google), enable the Shield configuration option "allowGooglePlayGamesEmulator" in your `config.xml` file. For example: ```xml ``` _(Resolves issue SHAND-3550)_ ### Extended the ShieldSDK-callback for untrusted installer apps Shield now reports all found untrusted installer apps in the ShieldSDK callbacks. _(Resolves issue SHAND-3993)_ ### No longer distrust system keyboards on rooted devices Shield used to distrust system keyboards on rooted devices. This made it more complicated for applications that didn't care about running on rooted devices but did care about keyboards. That is, with a Shield configuration that did not exit on detecting a rooted device, but did exit if an untrusted keyboard was used, you had to add the application signers for all keyboards that were pre-installed by mobile vendors, because Shield didn't trust them anymore. Thus, in the past, your `config.xml` file might have looked like the following example: ```xml ``` However, distrusting system keyboards on rooted devices does not add much extra security. Thus, from now on, you no longer have to add the signers of the pre-installed keyboards. If you want to protect against running on rooted devices, then you can enable exit on rooting with the following configuration: ```xml ``` ### Shielder command line option to check if an application is shielded Shielder now has the command line option `--check-app` to check if an application is shielded. For example: ```bash $ java -jar Shielder.jar --check-app my-app.apk * Shield not found. ``` Or if the application is shielded: ```bash $ java -jar Shielder.jar --check-app my-shielded-app.apk Shield version 6.5.0 found. ``` ## Removed deprecated APIs The deprecated feature `ForegroundOverrideData` has been removed and is no longer supported. ## Improvements ### Shield runtime performance improvements Improved startup performance. Shield moved the execution of slow security checks from the initial startup to a background thread and optimized the remaining code. Thus, the protected application will start a bit faster than with previous versions of Shield. _(Resolves issues SHAND-3766, SHAND-3895, etc.)_ ### Improved rooting detection * Improved detection of devices rooted with rooting toolkits like Magisk Manager, Magisk Hide, KernelSU, and Zygisk. ### Improved hooking framework detection * Improved detection of the LSPosed framework. * Improved detection of the MultiApp framework. * Improved detection of the Riru framework. * Improved detection of the XPosed framework. * Improved detection of Frida Stalker, a code tracer. Detection for code tracers can be enabled with the following `config.xml` configuration: ```xml ``` If a code tracer is detected, Shield terminates the application. _Note:_ In a future release, Shield will enable this option by default and later remove the configuration option. ### Improved native code hook detection Shield has been improved on detecting hooking frameworks that inject hooks into the application's native libraries. As part of the native code hook detection, Shield can be configured to verify the native libraries of your app. For example, your `rules.cfg` file can use the following line: ```cfg verify "lib/arm64-v8a/libmy-native.so"; ``` The Shield native library is always verified. Other native libraries of the application need to be added explicitly. In some situations, Shield encountered a race condition when the application loaded several native libraries from different threads. This could have caused a false positive. The race condition is now properly handled. ### Improved emulator detection Shield improved the detection of the mogume cloud emulator and BlueStacks emulator. _(Resolves issues SHAND-3937 and SHAND-3804)_ ### Improved adb status detection Shield now detects if ADB has been enabled with tools like the "WADB - Wireless ADB enabler". That tool can enable ADB without changing the Android System settings. See https://play.google.com/store/apps/details?id=moe.haruue.wadb&hl=en&gl=US _(Resolves issue SHAND-3973)_ ### Improved Shielder class name obfuscation #### Obfuscating Navigation Actions If a navigation component uses an `` element with an `app:argType`, and the class name of that `app:argType` is obfuscated, then Shielder now correctly updates the resource file with the obfuscated class names. Without this fix, the application would crash when trying to use the action. For example: ```xml ``` See "Use Navigation actions and Fragments": https://developer.android.com/guide/navigation/design/actions. #### Obfuscating Navigation Dialogs If a navigation component uses a `` element, and the class name of that dialog is obfuscated, then Shielder now correctly updates the resource file with the obfuscated class names. Without this fix, the application would crash when trying to load the dialog. For example: ```xml ... ``` _(Resolves issue SHAND-3899)_ See "Dialog destinations": https://developer.android.com/guide/navigation/design/dialog-destinations. ## Bug fixes and improvements ### Fixed race condition on excluding some activities from screenshot protection Shield can be configured to block all screenshots and then given rules that allow screenshots on selected activities. In your `config.xml` file, you can block screenshots with the following: ```xml ``` In the Shielder `rules.cfg` file, you can override this setting by allowing screenshots for one or more individual activities. For example: ```cfg allowScreenshotsForActivity com.example.MyScreenShotEnabledActivity; ``` In some cases, when the application switched from an activity for which screenshots were blocked to an activity for which screenshots were explicitly allowed, Shield did not unblock the screenshots due to a race condition. This has been resolved. _(Resolves issue SHAND-3923)_ ### Improved hiding of Shield Previously, each Shield version had a fixed random native library name (e.g., `libneanmmkiaomc.so`). Often, the random name was easy enough to identify as "this looks like it could be Shield". Instead of using such a random name, Shielder now takes the application's package name and uses that as inspiration for a non-suspicious looking library name. Thus, the Shield library name will now look like it is related to the public, visible package name. _(Resolves issue SHAND-3666.)_ ### Fixed Shielder crashes * Fixed a Shielder failure to protect some applications due to unexpected Java byte code. _(Resolves issue SHAND-3975)_ * Fix a Shielder crash with a ConcurrentModificationException. _(Resolves issue SHAND-3982)_ ### Fixed Shield runtime file descriptor leak ### Improved Shield runtime Java debugger detection Shield checks more frequently for an attached Java debugger. _(Resolves issue SHAND-3426)_ ### Support Shielder rules with flags "volatile" and "transient" Shielder rules can now use the flags "volatile" and "transient" when selecting methods. For example, to obfuscate all volatile methods, your `rules.cfg` file can use the following: ```cfg match class * { obfuscate volatile *; } ``` _(Resolves issue SHAND-3922)_ ### Fixed Shielder rules that used annotations Fixed a bug on handling Shielder rules with annotations. Previously, the annotation was not correctly matched. For example, if you don't want to obfuscate any members that are annotated with gson's `@SerializedName` annotation, your `rules.cfg` can now use the following without issue: ```cfg match class * { preserve @com.google.gson.annotations.SerializedName ; } ``` _(Resolves issue SHAND-3985)_ ### Fixed false positive on emulated input detection This applies to Shield configurations with the following `config.xml` setting: ```xml ``` _(Resolves issuses SHAND-3901, SHAND-3938)_ ### Jigsaw Binary Protection Engine (version 1.12.2) * Substantial improvements to the protection time of heavy Checksum and Control Flow Abstraction utilization for large binaries. * Bugfix for Jigsaw protected x86_64 libraries. It is no longer necessary to disable "internal block splitting" in the Jigsaw configuration. * Simplified Jigsaw Binary Protection Engine configurations for pull bindings and external checksums. These now have sensible default values that should only be changed when absolutely necessary and under the guidance of Promon support. * Fixed a Jigsaw Binary Protection runtime crash for armeabi-v7a binaries that were protected with Jigsaw's Control Flow Abstraction. * Fixed Google Play Games x86_64 runtime failure. * Fixed an issue which sometimes prevented Control Flow Abstraction from being applied along with Block Splitting. ### Other Fixes * Fixed Shielder warnings about configuration options. Shielder prints a dependency warning if the Shield `config.xml` file contains a configuration that depends on a second configuration which is disabled. Previously, Shielder printed such a warning in some cases even if the configuration was not explicitly set in the `config.xml` file. This was fixed, so you can now trust the warnings to be correct again. _(Resolves issue SHAND-3165.)_ * Fixed parsing applications that used non-ascii characters in field names. This affected application code that referenced an obfuscated field name in an annotation value, where the field name was obfuscated with non-ascii characters. _(Resolves issue SHAND-3865.)_ * Fixed handling mapping files inside an app bundle. Shielder adds/updates the mapping file inside an app bundle with the Java name obfuscation that was added by Shielder. _(Resolves issue SHAND-3824.)_ * Fixed crash on starting a shielded app on a Lenovo TB-X104F, Android 8.1.0 device. This occurred when the "advancedDebugGuard" option was enabled. The "advancedDebugGuard" config option increases the security of the shielded app. The option can be enabled by adding the following to your `config.xml` file: ```xml ``` _(Resolves issue SHAND-3800)_ * Fixed internal error reporting, where a Shield internal error was sometimes reported as a `HookingFrameworkException` instead of an `InternalErrorException`. _(Resolves issue SHAND-3784)_ * Fixed an `UnsupportedOperationException` crash when Shielder tried to detect the set of supported native library architectures for the input application. _(Resolves issue SHAND-3730)_ * Shielder now supports the SHA384 with RSA signature algorithm on signing app bundles. This signature algorithm is used by default with AGP 7.4 and Gradle 7.6 for Android App Bundles. _(Resolves issue SHAND-3738)_ * Fixed Java class name obfuscation. Shielder previously failed to obfuscate all classes if you enabled full Java class name obfuscation. This is accomplished via a `rules.cfg` file with the following line: ```cfg include "builtin:obfuscate-on.cfg"; ``` _(Resolves issue SHAND-3720)_ ### Third-party code usage * Upgraded Libressl to version 3.8.1 ## Supported platforms * Shield is supported on Android 5.0 (API 21) up to Android 14 (API 34). * The Shielder tool is supported on 64-bit Java 17 on Windows 10, Mac OSX (10.9+), and Ubuntu Linux LTS 20.04 or 22.04. * Shield Gradle Plugin version 2.x is supported. The plugin and documentation can be downloaded from: - https://dl.promon.no/pub/android/gradle/jar/shield-gradle-plugin-2.1.0.jar - https://dl.promon.no/pub/android/gradle/doc/shield-gradle-plugin-2.1.0.pdf ## Preview on upcoming changes in the next Shield version * The deprecated `CallbackManager.setExtendedObserver(observer)` and `CallbackManager.removeObserver()` methods will be removed. Instead, use `CallbackManager.addObserver(observer)` and `CallbackManager.removeObserver(observer)`. * The Shielder command line option `--profile [release, debug]` is deprecated and might be removed in a future version. ## Known limitations ### New Android version with 16k page size Google announced that Android is moving from a 4KB page size to a 16KB page size in Android 15. 16KB page hardware will be available in the market in the future, as well. The current version of Shield does not yet run on the new Android 15 images with a 16KB page size, but Promon is working on updating Shield's native libraries to no longer assume that the page size is 4K. ### Java 17 runtime Some Java 17 runtime versions cause the following error on shielding an app: ``` Error: java.util.zip.ZipException: Invalid CEN header (invalid zip64 extra data field size) ``` The error is caused by a problem with Java. A workaround is to pass the command line option `-Djdk.util.zip.disableZip64ExtraFieldValidation=true` to Java on running Shielder. For example: ```bash $ java -Djdk.util.zip.disableZip64ExtraFieldValidation=true -jar Shielder.jar ... ``` ### Magisk and root hider tools on new Android versions Root hider tools, such as Magisk Hide, are designed to hide the fact that the device is compromised (i.e., rooted). Android has been increasingly restricted in what can be inspected and observed of the system from inside an app. This means that a rooted system with a root hider tool can be hard to detect due to missing privileges. On Android 8+, Shield might not able to reliably detect a rooted device with Magisk Hide, depending on the version of these tools. ### SecureEditText in-app keyboard The SecureEditText in-app keyboard has focus problems on dialog windows on tablet devices. ## Tested devices * Asus Nexus 7 (Android 5.0 - Lollipop) * Asus ROG Phone (Android 8.1 - Oreo) * Asus Zenfone 2 (Android 5.0 - Lollipop) * Asus Zenfone 4 (Android 7.1.1 - Nougat) * Asus Zenfone4 SelfiePro (Android 7.1 - Nougat) * Asus ZenPad 10 (Android 7.0 - Nougat) * Google Pixel (Android 9.0 - Pie) * Google Pixel 2 (Android 9.0 - Pie) * Google Pixel 2 (Android 10 - Q) * Google Pixel 2 XL (Android 10 - Q) * Google Pixel 2 (Android 11 - R) * Google Pixel 3 (Android 10 - Q) * Google Pixel 3 XL (Android 10 - Q) * Google Pixel 4 (Android 11 - R) * Google Pixel 4 XL (Android 11 - R) * Google Pixel 5 (Android 11 - R) * Google Pixel 5 (Android 12 - S) * Google Pixel 5a (Android 12 - S) * Google Pixel 5a (Android 14) * Google Pixel 6 (Android 13) * Google Pixel 7a (Android 13) * Google Pixel 7 (Android 14) * Google Pixel 7 Pro (Android 13) * Google Pixel 6 Pro (Android 14) * Huawei Honor 6X (Android 7.0 - Nougat) * Huawei Honor 7 (Android 5.0.2 - Lollipop) * Huawei Honor 9X 9.0 (Pie) * Huawei Mate 10 Pro (Android 8.0 - Oreo) * Huawei Mate 30 (Android 10 -Q) * Huawei Mate 30 Pro (Android 10 - Q) * Huawei Mate 9 (Android 7.0 - Nougat) * Huawei MediaPad M5 BAH2-W19 (Android 8.0 - Oreo) * Huawei MediaPad M5 CMR-W09 (Android 9.0 - Pie) * Huawei Nexus 6P(Nexus 6P) (Android 8.1.0 - Oreo) * Huawei Nova 5T (Android 9.0 - Pie) * Huawei P Smart (Android 8.0 - Oreo) * Huawei P10 (Android 7.0 - Nougat) * Huawei P20 Pro (Android 8.1 - Oreo) * Huawei P9 (Android 6.0 - Marshmallow) * Huawei P9 Lite (Android 6.0 - Marshmallow) * Huawei Y6II Compact (Android 5.1 - Lollipop) * Lenovo Vibe K5 Note (Android 6.0 - Marshmallow) * Lenovo Tablet TB-X104F (Android 8.1 - Oreo) * LG G4 (Android 5.1 - Lollipop) * LG G4 Dual(LG-H818) (Android 6.0 - Marshmallow) * LG G5 (LG-H860) (Android 6.0.1 - Marshmallow) * LG G6 (Android 7.0 - Nougat) * LG Nexus 5 (Android 6.0 - Marshmallow) * LG Nexus 5X (Android 8.0 - Oreo) * LG V30 (Android 7.1.2 - Nougat) * Motorola Moto E (6) Plus (Android 9.0 - Pie) * Motorola moto G (6) plus (Android 8.0 - Oreo) * Motorola Moto G (8) Power (Android 10 - Q) * Motorola Moto G4 Plus (Android 7 - Nougat) * Motorola Moto X4 (Android 7.1.1 - Nougat) * Motorola Edge 30 (Android 12) * Nokia 2.3 (Android 11 - R) * Nokia 2.4 (Android 11 - R) * Nokia 7.2 10.0 (Android 10 - Q) * OnePlus OnePlus 11 (Android 14) * OnePlus OnePlus 5 (Android 7.1.1 - Nougat) * OnePlus OnePlus 6 (Android 8.1 - Oreo) * OnePlus OnePlus 6T (Android 9.0 - Pie) * OnePlus OnePlus 7T Pro (Android 10 - Q) * OnePlus OnePlus 8 Pro (Android 11 - R) * OnePlus OnePlus 9 (Android 12 - S) * Oppo A37fw (Android 5.1.1 - Lollipop) * Oppo A5 (Android 8.1 - Oreo) * Oppo A5s (Android 8.1 - Oreo) * Oppo F1 plus (Android 5.1 - Lollipop) * Oppo R9m (Android 5.1 - Lollipop) * Oppo Reno5 5G (Android 11 - R) * Samsung Galaxy A50 (Android 9.0 - Pie) * Samsung Galaxy A6 plus (Android 9.0 - Pie) * Samsung Galaxy A71 (Android 10 - Q) * Samsung Galaxy A8 (Android 8.0 - Oreo) * Samsung Galaxy A9 (2) (Android 8.0 - Oreo) * Samsung Galaxy A9 (Android 9.0 - Pie) * Samsung Galaxy J2 (2015) (Android 5.1.1 - Lollipop) * Samsung Galaxy J2 (2016) (Android 6.0.1 - Marshmallow) * Samsung Galaxy J3 (Android 8.0 - Oreo) * Samsung Galaxy J4 plus (Android 8.1 - Oreo) * Samsung Galaxy J5 (Android 7.0 - Nougat) * Samsung Galaxy J6 (Android 8.0 - Oreo) * Samsung Galaxy J7 (Android 7.0 - Nougat) * Samsung Galaxy Note 10 Lite (Android 10 - Q) * Samsung Galaxy Note 4 (Android 6.0.1 - Marshmallow) * Samsung Galaxy Note 8 (Android 8.0 - Oreo) * Samsung Galaxy Note 9 (Android 8.1 - Oreo) * Samsung Galaxy On Nxt (Android 8.1 - Oreo) * Samsung Galaxy S10 (Android 12) * Samsung Galaxy S10 (Android 10 - Q) * Samsung Galaxy S10 e (Android 9.0 - Pie) * Samsung Galaxy S10 plus (Android 9.0 - Pie) * Samsung Galaxy S20 5G (Android 11 - R) * Samsung Galaxy S4 (Android 5.0.1 - Lollipop) * Samsung Galaxy S5 (Android 6.0.1 - Marshmallow) * Samsung Galaxy S6 (Android 7.0 - Nougat) * Samsung Galaxy S6 Edge (Android 6.0 - Marshmallow) * Samsung Galaxy S6 Edge (Android 7.0 - Nougat) * Samsung Galaxy S6(SM-G920I) (Android 7.0 - Nougat) * Samsung Galaxy S7 (2) (Android 8.0 - Oreo) * Samsung Galaxy S7 Edge (Android 6.0.1 - Marshmallow) * Samsung Galaxy S7(SM-G930FD) (Android 8.0 - Oreo) * Samsung Galaxy S8 (Android 8.0 - Oreo) * Samsung Galaxy S8 plus (Android 8.0 - Oreo) * Samsung Galaxy S9 (Android 8.0 - Oreo) * Samsung Galaxy S9 plus (Android 8.0 - Oreo) * Samsung Galaxy Tab S4 (Android 9.0 - Pie) * Samsung Galaxy Xcover 4 (Android 7.0 - Nougat) * Samsung Galaxy Z Flip (Android 10 - Q) * Samsung Galaxy Z Fold 2 5G (Android 10 - Q) * Sony Xperia 1 (Android 9.0 - Pie) * Sony Xperia Z (Android 5.1.1 - Lollipop) * Sony Xperia Z3 (E6553) (Android 6.0 - Marshmallow) * Sony Xperia Z4 Tablet (Android 5.0.2 - Lollipop) * Sony Xperia Z5 Dual(E6683) (Android 7.1.1 - Nougat) * Vivo 1916 (Android 9.0 - Pie) * Vivo S1 1907 (Android 9.0 - Pie) * Vivo S7e (Android 10 - Q) * Vivo V2029 (Android 10 - Q) * Vivo X30 Pro (Android 9 - Pie) * Vivo X60 (Android 11 - R) * VSmart Live (Android 9.0 - Pie) * Xiaomi MI 8 (Android 8.1 - Oreo) * Xiaomi MI 9 (Android 9.0 - Pie) * Xiaomi Mi A2 (Android 8.1 - Oreo) * Xiaomi MI MAX 2 (Android 7.1.1 - Nougat) * Xiaomi MI Mix 2s (Android 8.0 - Oreo) * Xiaomi MI Mix 3 (Android 9.0 - Pie) * Xiaomi Mi Note 10 (Android 9.0 - Pie) * Xiaomi Redmi 3S (Android 6.0.1 - Marshmallow) * Xiaomi Redmi 4 (Android 6.0.1 - Marshmallow) * Xiaomi Redmi 4A (Android 6.0.1 - Marshmallow) * Xiaomi Redmi 5 (Android 7.1.2 - Nougat) * Xiaomi Redmi Note 4 (Android 7.0 - Nougat) * Xiaomi Redmi Note 8 Pro (Android 9.0 - Pie)